diff --git a/.github/labeler.yml b/.github/labeler.yml
index ede4bb5a02fce7..129357df2bf3bc 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -180,6 +180,13 @@
 - changed-files:
   - any-glob-to-any-file:
     - "target/linux/starfive/**"
+"target/stm32":
+- changed-files:
+  - any-glob-to-any-file:
+    - "target/linux/stm32/**"
+    - "package/boot/arm-trusted-firmware-stm32/**"
+    - "package/boot/optee-os-stm32/**"
+    - "package/boot/uboot-stm32/**"
 "target/sunxi":
 - changed-files:
   - any-glob-to-any-file:
diff --git a/config/Config-build.in b/config/Config-build.in
index 41c1daccd99564..a9e968f944e787 100644
--- a/config/Config-build.in
+++ b/config/Config-build.in
@@ -70,7 +70,8 @@ menu "Global build settings"
 
 	config USE_APK
 		imply PACKAGE_apk-mbedtls
-		bool "Use APK instead of OPKG to build distribution (EXPERIMENTAL)"
+		bool "Use APK instead of OPKG to build distribution (BROKEN)"
+		depends on BROKEN
 
 	comment "General build options"
 
@@ -295,12 +296,22 @@ menu "Global build settings"
 		  Enable GCC Stack Smashing Protection (SSP) for userspace applications
 		config PKG_CC_STACKPROTECTOR_NONE
 			bool "None"
+			help
+				No stack smashing protection.
 		config PKG_CC_STACKPROTECTOR_REGULAR
 			bool "Regular"
+			help
+				Protects functions with vulnerable objects.
+				This includes functions with buffers larger than 8 bytes or calls to alloca.
 		config PKG_CC_STACKPROTECTOR_STRONG
 			bool "Strong"
+			help
+				Like Regular, but also protects functions with
+				local arrays or references to local frame addresses.
 		config PKG_CC_STACKPROTECTOR_ALL
 			bool "All"
+			help
+				Protects all functions.
 	endchoice
 
 	choice
@@ -310,10 +321,18 @@ menu "Global build settings"
 		  Enable GCC Stack-Smashing Protection (SSP) for the kernel
 		config KERNEL_CC_STACKPROTECTOR_NONE
 			bool "None"
+			help
+				No stack smashing protection.
 		config KERNEL_CC_STACKPROTECTOR_REGULAR
 			bool "Regular"
+			help
+				Protects functions with vulnerable objects.
+				This includes functions with buffers larger than 8 bytes or calls to alloca.
 		config KERNEL_CC_STACKPROTECTOR_STRONG
 			bool "Strong"
+			help
+				Like Regular, but also protects functions with
+				local arrays or references to local frame addresses.
 	endchoice
 
 	config KERNEL_STACKPROTECTOR
@@ -404,11 +423,11 @@ menu "Global build settings"
 
 	endchoice
 
-	config SECCOMP
+	config USE_SECCOMP
 		bool "Enable SECCOMP"
 		select KERNEL_SECCOMP
 		select PACKAGE_procd-seccomp
-		depends on (aarch64 || arm || armeb || mips || mipsel || mips64 || mips64el || i386 || powerpc || x86_64)
+		depends on (aarch64 || arm || armeb || mips || mipsel || mips64 || mips64el || i386 || loongarch64 || powerpc || x86_64)
 		depends on !TARGET_uml
 		default y
 		help
diff --git a/config/Config-kernel.in b/config/Config-kernel.in
index 43ed9eaf36b861..64c8c63466a75a 100644
--- a/config/Config-kernel.in
+++ b/config/Config-kernel.in
@@ -333,6 +333,25 @@ if KERNEL_TASKSTATS
 
 endif
 
+config KERNEL_PSI
+	bool "Compile the kernel with pressure stall information tracking"
+	help
+	  Collect metrics that indicate how overcommitted the CPU, memory,
+	  and IO capacity are in the system.
+
+	  If you say Y here, the kernel will create /proc/pressure/ with the
+	  pressure statistics files cpu, memory, and io. These will indicate
+	  the share of walltime in which some or all tasks in the system are
+	  delayed due to contention of the respective resource.
+
+	  In kernels with cgroup support, cgroups (cgroup2 only) will
+	  have cpu.pressure, memory.pressure, and io.pressure files,
+	  which aggregate pressure stalls for the grouped tasks only.
+
+	  For more details see Documentation/accounting/psi.rst.
+
+	  Say N if unsure.
+
 config KERNEL_KALLSYMS
 	bool "Compile the kernel with symbol table information"
 	default y if !SMALL_FLASH
@@ -1187,9 +1206,11 @@ endif
 
 config KERNEL_NET_L3_MASTER_DEV
 	bool "L3 Master device support"
+	default y if !SMALL_FLASH
 	help
 	  This module provides glue between core networking code and device
 	  drivers to support L3 master devices like VRF.
+  	  Increases the compressed kernel size by ~4kB (as of Linux 6.6).
 
 config KERNEL_XDP_SOCKETS
 	bool "XDP sockets support"
@@ -1218,6 +1239,13 @@ config KERNEL_MPTCP_IPV6
 	default KERNEL_MPTCP
 endif
 
+config KERNEL_NF_CONNTRACK_TIMEOUT
+	bool "Per-connection connection tracking timeout"
+	default y if !SMALL_FLASH
+	help
+	   Select this option to enable support for per-connection conntrack timeouts.
+	   Increases the (uncompressed) size of nf_conntrack.ko by ~8kB.
+
 #
 # NFS related symbols
 #
diff --git a/feeds.conf.default b/feeds.conf.default
index fc679335e0e47f..581de056c41e3e 100644
--- a/feeds.conf.default
+++ b/feeds.conf.default
@@ -1,8 +1,4 @@
-src-git packages https://git.openwrt.org/feed/packages.git
-src-git luci https://git.openwrt.org/project/luci.git
-src-git routing https://git.openwrt.org/feed/routing.git
-src-git telephony https://git.openwrt.org/feed/telephony.git
-#src-git video https://github.com/openwrt/video.git
-#src-git targets https://github.com/openwrt/targets.git
-#src-git oldpackages http://git.openwrt.org/packages.git
-#src-link custom /usr/src/openwrt/custom-feed
+src-git packages https://git.openwrt.org/feed/packages.git;openwrt-24.10
+src-git luci https://git.openwrt.org/project/luci.git;openwrt-24.10
+src-git routing https://git.openwrt.org/feed/routing.git;openwrt-24.10
+src-git telephony https://git.openwrt.org/feed/telephony.git;openwrt-24.10
diff --git a/include/bpf.mk b/include/bpf.mk
index 2b7aa8512c2cb9..b9c8034c683722 100644
--- a/include/bpf.mk
+++ b/include/bpf.mk
@@ -1,30 +1,40 @@
-BPF_DEPENDS := @HAS_BPF_TOOLCHAIN
-LLVM_VER:=
+BPF_DEPENDS := @HAS_BPF_TOOLCHAIN +@NEED_BPF_TOOLCHAIN
 
 CLANG_MIN_VER:=12
 
 ifneq ($(CONFIG_USE_LLVM_HOST),)
+  find-llvm-tool=$(firstword $(shell PATH='$(BPF_PATH)' command -v $(1) || echo '$(firstword $(1))-not-found'))
+
   BPF_TOOLCHAIN_HOST_PATH:=$(call qstrip,$(CONFIG_BPF_TOOLCHAIN_HOST_PATH))
   ifneq ($(BPF_TOOLCHAIN_HOST_PATH),)
     BPF_PATH:=$(BPF_TOOLCHAIN_HOST_PATH)/bin:$(PATH)
   else
     BPF_PATH:=$(PATH)
   endif
-  CLANG:=$(firstword $(shell PATH='$(BPF_PATH)' command -v clang clang-13 clang-12 clang-11))
+  CLANG:=$(call find-llvm-tool,clang clang-13 clang-12)
   LLVM_VER:=$(subst clang,,$(notdir $(CLANG)))
-endif
-ifneq ($(CONFIG_USE_LLVM_PREBUILT),)
-  CLANG:=$(TOPDIR)/llvm-bpf/bin/clang
-endif
-ifneq ($(CONFIG_USE_LLVM_BUILD),)
-  CLANG:=$(STAGING_DIR_HOST)/llvm-bpf/bin/clang
-endif
 
-LLVM_PATH:=$(dir $(CLANG))
-LLVM_LLC:=$(LLVM_PATH)/llc$(LLVM_VER)
-LLVM_DIS:=$(LLVM_PATH)/llvm-dis$(LLVM_VER)
-LLVM_OPT:=$(LLVM_PATH)/opt$(LLVM_VER)
-LLVM_STRIP:=$(LLVM_PATH)/llvm-strip$(LLVM_VER)
+  BPF_PATH:=$(dir $(CLANG)):$(BPF_PATH)
+  LLVM_LLC:=$(call find-llvm-tool,llc$(LLVM_VER))
+  LLVM_DIS:=$(call find-llvm-tool,llvm-dis$(LLVM_VER))
+  LLVM_OPT:=$(call find-llvm-tool,opt$(LLVM_VER))
+  LLVM_STRIP:=$(call find-llvm-tool,llvm-strip$(LLVM_VER))
+else
+  LLVM_PATH:=/invalid
+
+  ifneq ($(CONFIG_USE_LLVM_PREBUILT),)
+    LLVM_PATH:=$(TOPDIR)/llvm-bpf/bin
+  endif
+  ifneq ($(CONFIG_USE_LLVM_BUILD),)
+    LLVM_PATH:=$(STAGING_DIR_HOST)/llvm-bpf/bin
+  endif
+
+  CLANG:=$(LLVM_PATH)/clang
+  LLVM_LLC:=$(LLVM_PATH)/llc
+  LLVM_DIS:=$(LLVM_PATH)/llvm-dis
+  LLVM_OPT:=$(LLVM_PATH)/opt
+  LLVM_STRIP:=$(LLVM_PATH)/llvm-strip
+endif
 
 BPF_KARCH:=mips
 BPF_ARCH:=mips$(if $(CONFIG_ARCH_64BIT),64)$(if $(CONFIG_BIG_ENDIAN),,el)
diff --git a/include/cmake.mk b/include/cmake.mk
index 87309dd0458a82..f59410c2f32dd8 100644
--- a/include/cmake.mk
+++ b/include/cmake.mk
@@ -97,7 +97,7 @@ define Build/Configure/Default
 			-DCMAKE_SYSTEM_NAME=Linux \
 			-DCMAKE_SYSTEM_VERSION=1 \
 			-DCMAKE_SYSTEM_PROCESSOR=$(ARCH) \
-			-DCMAKE_BUILD_TYPE=Release \
+			-DCMAKE_BUILD_TYPE=$(if $(CONFIG_DEBUG),Debug,Release) \
 			-DCMAKE_C_FLAGS_RELEASE="-DNDEBUG" \
 			-DCMAKE_CXX_FLAGS_RELEASE="-DNDEBUG" \
 			-DCMAKE_C_COMPILER_LAUNCHER="$(CMAKE_C_COMPILER_LAUNCHER)" \
diff --git a/include/default-packages.mk b/include/default-packages.mk
new file mode 100644
index 00000000000000..c964e92a033aec
--- /dev/null
+++ b/include/default-packages.mk
@@ -0,0 +1,5 @@
+ifneq ($(CONFIG_USE_APK),)
+  DEFAULT_PACKAGES += apk-mbedtls
+else
+  DEFAULT_PACKAGES += opkg
+endif
diff --git a/include/feeds.mk b/include/feeds.mk
index 87b1562c3edbf7..c3a47cf5f92252 100644
--- a/include/feeds.mk
+++ b/include/feeds.mk
@@ -37,7 +37,7 @@ define FeedSourcesAppendOPKG
   echo 'src/gz %d_core %U/targets/%S/packages'; \
   $(strip $(if $(CONFIG_PER_FEED_REPO), \
 	echo 'src/gz %d_base %U/packages/%A/base'; \
-	$(if $(filter %SNAPSHOT-y,$(VERSION_NUMBER)-$(CONFIG_BUILDBOT)), \
+	$(if $(CONFIG_BUILDBOT), \
 		echo 'src/gz %d_kmods %U/targets/%S/kmods/$(LINUX_VERSION)-$(LINUX_RELEASE)-$(LINUX_VERMAGIC)';) \
 	$(foreach feed,$(FEEDS_AVAILABLE), \
 		$(if $(CONFIG_FEED_$(feed)), \
@@ -51,7 +51,7 @@ define FeedSourcesAppendAPK
   echo '%U/targets/%S/packages/packages.adb'; \
   $(strip $(if $(CONFIG_PER_FEED_REPO), \
 	echo '%U/packages/%A/base/packages.adb'; \
-	$(if $(filter %SNAPSHOT-y,$(VERSION_NUMBER)-$(CONFIG_BUILDBOT)), \
+	$(if $(CONFIG_BUILDBOT), \
 		echo '%U/targets/%S/kmods/$(LINUX_VERSION)-$(LINUX_RELEASE)-$(LINUX_VERMAGIC)/packages.adb';) \
 	$(foreach feed,$(FEEDS_AVAILABLE), \
 		$(if $(CONFIG_FEED_$(feed)), \
diff --git a/include/image-commands.mk b/include/image-commands.mk
index 2568fb3ade5f3d..a627ffc202cc0a 100644
--- a/include/image-commands.mk
+++ b/include/image-commands.mk
@@ -732,6 +732,10 @@ define Build/zip
 	rm -rf $@.tmp
 endef
 
+define Build/zyimage
+	$(STAGING_DIR_HOST)/bin/zyimage $(1) $@
+endef
+
 define Build/zyxel-ras-image
 	let \
 		newsize="$(call exp_units,$(RAS_ROOTFS_SIZE))"; \
diff --git a/include/image.mk b/include/image.mk
index a4ac1b49cf8aa4..6408719bdc48e3 100644
--- a/include/image.mk
+++ b/include/image.mk
@@ -21,6 +21,11 @@ include $(INCLUDE_DIR)/rootfs.mk
 override MAKE:=$(_SINGLE)$(SUBMAKE)
 override NO_TRACE_MAKE:=$(_SINGLE)$(NO_TRACE_MAKE)
 
+##@
+# @brief Convert size with unit postfix to unitless expression in bytes.
+#
+# @param 1: Size with unit. Possible unit postfix are `g`, `m`, `k`.
+##
 exp_units = $(subst k, * 1024,$(subst m, * 1024k,$(subst g, * 1024m,$(1))))
 
 target_params = $(subst +,$(space),$*)
@@ -111,6 +116,12 @@ endef
 
 PROFILE_SANITIZED := $(call tolower,$(subst DEVICE_,,$(subst $(space),-,$(PROFILE))))
 
+##@
+# @brief Call function for each group of arguments.
+#
+# @param 1: List of lists of arguments. Lists are separated by `|`.
+# @param 2: Function to call for list of arguments.
+##
 define split_args
 $(foreach data, \
 	$(subst |,$(space),\
@@ -118,12 +129,24 @@ $(foreach data, \
 	$(call $(2),$(strip $(subst ^,$(space),$(data)))))
 endef
 
+##@
+# @brief Call build function with arguments.
+#
+# @param 1: Function to call. Function name is prepended with `Build/`.
+# @param 2...: Function arguments.
+##
 define build_cmd
 $(if $(Build/$(word 1,$(1))),,$(error Missing Build/$(word 1,$(1))))
 $(call Build/$(word 1,$(1)),$(wordlist 2,$(words $(1)),$(1)))
 
 endef
 
+##@
+# @brief Call build functions from the list.
+#
+# @param 1: List of build functions with arguments, separated by `|`.
+#           First word in each group is a build command without `Build/` prefix.
+##
 define concat_cmd
 $(call split_args,$(1),build_cmd)
 endef
@@ -163,6 +186,12 @@ DTC_WARN_FLAGS := \
 DTC_FLAGS += $(DTC_WARN_FLAGS)
 DTCO_FLAGS += $(DTC_WARN_FLAGS)
 
+##@
+# @brief Pad file to specified size.
+#
+# @param 1: File.
+# @param 2: Padding.
+##
 define Image/pad-to
 	dd if=$(1) of=$(1).new bs=$(2) conv=sync
 	mv $(1).new $(1)
@@ -403,26 +432,53 @@ define Device/InitProfile
   DEVICE_DESCRIPTION = Build firmware images for $$(DEVICE_TITLE)
 endef
 
+##@
+# @brief Image configuration variables.
+#
+# @param 1: Device name.
+##
 define Device/Init
+  ##@ Device name.
   DEVICE_NAME := $(1)
+  ##@ Commands to build kernel.
+  # Commands with arguments are separated by `|`.
+  ##
   KERNEL:=
+  ##@ Commands to build initramfs.
+  # Commands with arguments are separated by `|`.
+  ##
   KERNEL_INITRAMFS = $$(KERNEL)
+  ##@ Kernel command line.
   CMDLINE:=
 
+  ##@ Images to build.
   IMAGES :=
+  ##@ Artifacts to build.
   ARTIFACTS :=
+  ##@ Device image prefix.
   DEVICE_IMG_PREFIX := $(IMG_PREFIX)-$(1)
+  ##@ Device image name.
   DEVICE_IMG_NAME = $$(DEVICE_IMG_PREFIX)-$$(1)-$$(2)
+  ##@ Factory image name.
   FACTORY_IMG_NAME :=
+  ##@ Maximum image size. Optional.
   IMAGE_SIZE :=
+  ##@ Maximum image size. Optional.
   NAND_SIZE :=
+  ##@ Kernel image prefix.
   KERNEL_PREFIX = $$(DEVICE_IMG_PREFIX)
+  ##@ Kernel image suffix.
   KERNEL_SUFFIX := -kernel.bin
+  ##@ Initramfs image suffix.
   KERNEL_INITRAMFS_SUFFIX = $$(KERNEL_SUFFIX)
+  ##@ Kernel image name.
   KERNEL_IMAGE = $$(KERNEL_PREFIX)$$(KERNEL_SUFFIX)
+  ##@ Initramfs image prefix.
   KERNEL_INITRAMFS_PREFIX = $$(DEVICE_IMG_PREFIX)-initramfs
   KERNEL_INITRAMFS_IMAGE = $$(KERNEL_INITRAMFS_PREFIX)$$(KERNEL_INITRAMFS_SUFFIX)
+  ##@ Initramfs image name.
   KERNEL_INITRAMFS_NAME = $$(KERNEL_NAME)-initramfs
+  ##@ Kernel install flag.
   KERNEL_INSTALL :=
   KERNEL_NAME := vmlinux
   KERNEL_DEPENDS :=
@@ -513,6 +569,15 @@ endef
 
 define Device/Check/Common
   _PROFILE_SET = $$(strip $$(foreach profile,$$(PROFILES) DEVICE_$(1),$$(call DEVICE_CHECK_PROFILE,$$(profile))))
+  # Check if device is disabled and if so do not mark to be installed when ImageBuilder is used
+  ifeq ($(IB),1)
+    ifeq ($$(DEFAULT),n)
+      _PROFILE_SET :=
+    endif
+    ifeq ($$(BROKEN),y)
+      _PROFILE_SET :=
+    endif
+  endif
   DEVICE_PACKAGES += $$(call extra_packages,$$(DEVICE_PACKAGES))
   ifdef TARGET_PER_DEVICE_ROOTFS
     $$(eval $$(call merge_packages,_PACKAGES,$$(DEVICE_PACKAGES) $$(call DEVICE_EXTRA_PACKAGES,$(1))))
diff --git a/include/kernel-6.6 b/include/kernel-6.6
index df3464ab4118fa..70decb678662eb 100644
--- a/include/kernel-6.6
+++ b/include/kernel-6.6
@@ -1,2 +1,2 @@
-LINUX_VERSION-6.6 = .58
-LINUX_KERNEL_HASH-6.6.58 = e7df81e588d70fab5ec3ec3bb04ac53d51f0860fc3b1ec45e0a4167a026899db
+LINUX_VERSION-6.6 = .104
+LINUX_KERNEL_HASH-6.6.104 = 2a772f9d661afabaaddcdfd1116239acb2d943377aceab9e0baed2b7a915e36a
diff --git a/include/kernel-defaults.mk b/include/kernel-defaults.mk
index f94ed3323051f2..cbe415abe64ab9 100644
--- a/include/kernel-defaults.mk
+++ b/include/kernel-defaults.mk
@@ -175,7 +175,6 @@ define Kernel/PrepareConfigPerRootfs
 		[ ! -d "$(1)" ] || rm -rf $(1); \
 		mkdir $(1) && $(CP) -T $(LINUX_DIR) $(1); \
 		touch $(1)/.config; \
-		rm -rf $(1)/usr/initramfs_data.cpio*; \
 	}
 endef
 
@@ -190,6 +189,7 @@ define Kernel/CompileImage/Initramfs
 		$(call Kernel/Configure/Initramfs,$(if $(1),$(1),$(TARGET_DIR)),$(LINUX_DIR)$(2)); \
 		$(CP) $(GENERIC_PLATFORM_DIR)/other-files/init $(if $(1),$(1),$(TARGET_DIR))/init; \
 		$(if $(SOURCE_DATE_EPOCH),touch -hcd "@$(SOURCE_DATE_EPOCH)" $(if $(1),$(1),$(TARGET_DIR)) $(if $(1),$(1),$(TARGET_DIR))/init;) \
+		rm -rf $(LINUX_DIR)$(2)/usr/initramfs_data.cpio*; \
 		$(if $(CONFIG_TARGET_ROOTFS_INITRAMFS_SEPARATE), \
 			$(call locked,{ \
 				$(if $(call qstrip,$(CONFIG_EXTERNAL_CPIO)), \
diff --git a/include/meson.mk b/include/meson.mk
index 2a20c2bd6bd04e..ff452d8b01fa4c 100644
--- a/include/meson.mk
+++ b/include/meson.mk
@@ -124,7 +124,7 @@ define Build/Configure/Meson
 	$(call Meson/CreateCrossFile,$(PKG_BUILD_DIR)/openwrt-cross.txt)
 	$(call Meson, \
 		setup \
-		--buildtype plain \
+		--buildtype $(if $(CONFIG_DEBUG),debug,plain) \
 		--native-file $(PKG_BUILD_DIR)/openwrt-native.txt \
 		--cross-file $(PKG_BUILD_DIR)/openwrt-cross.txt \
 		-Ddefault_library=both \
diff --git a/include/optee-os.mk b/include/optee-os.mk
new file mode 100644
index 00000000000000..3694b498fd583a
--- /dev/null
+++ b/include/optee-os.mk
@@ -0,0 +1,113 @@
+include $(INCLUDE_DIR)/prereq.mk
+
+PKG_NAME ?= optee-os
+
+ifndef PKG_SOURCE_PROTO
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL_FILE:=$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL = https://github.com/OP-TEE/optee_os/archive/refs/tags/
+TAR_OPTIONS+= --transform 's/optee_os/$(PKG_NAME)/'
+endif
+
+PKG_BUILD_DIR = $(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
+
+PKG_TARGETS := bin
+PKG_FLAGS:=nonshared
+
+PKG_LICENSE:=BSD 2-Clause
+PKG_LICENSE_FILES:=LICENSE
+
+PKG_BUILD_PARALLEL ?= 1
+
+$(eval $(call TestHostCommand,python3-cryptography, \
+  Please install the Python3 cryptography module, \
+  $(STAGING_DIR_HOST)/bin/python3 -c 'import cryptography'))
+
+$(eval $(call TestHostCommand,python3-pyelftools, \
+    Please install the Python3 pyelftools module, \
+    $(STAGING_DIR_HOST)/bin/python3 -c 'import elftools'))
+
+export GCC_HONOUR_COPTS=s
+
+define Package/optee-os/install/default
+	$(CP) $(patsubst %,$(PKG_BUILD_DIR)/out/arm-plat-$(PLAT)/core/%,$(OPTEE_IMAGE)) $(1)/
+endef
+
+Package/optee-os/install = $(Package/optee-os/install/default)
+
+define Optee-os/Init
+  BUILD_TARGET:=
+  BUILD_SUBTARGET:=
+  BUILD_DEVICES:=
+  NAME:=
+  DEPENDS:=
+  HIDDEN:=
+  DEFAULT:=
+  VARIANT:=$(1)
+  PLAT:=$(1)
+  PLAT_FLAVOR:=
+  OPTEE_IMAGE:=tee-header_v2.bin tee-pager_v2.bin tee-pageable_v2.bin
+endef
+
+TARGET_DEP = TARGET_$(BUILD_TARGET)$(if $(BUILD_SUBTARGET),_$(BUILD_SUBTARGET))
+
+define Build/Optee-os/Target
+  $(eval $(call Optee-os/Init,$(1)))
+  $(eval $(call Optee-os/Default,$(1)))
+  $(eval $(call Optee-os/$(1),$(1)))
+
+  define Package/optee-os-$(1)
+    SECTION:=boot
+    CATEGORY:=Boot Loaders
+    TITLE:=OPTEE-OS for $(NAME)
+    VARIANT:=$(VARIANT)
+    DEPENDS:=@!IN_SDK $(DEPENDS)
+    HIDDEN:=$(HIDDEN)
+    ifneq ($(BUILD_TARGET),)
+      DEPENDS += @$(TARGET_DEP)
+      ifneq ($(BUILD_DEVICES),)
+        DEFAULT := y if ($(TARGET_DEP)_Default \
+		$(patsubst %,|| $(TARGET_DEP)_DEVICE_%,$(BUILD_DEVICES)) \
+		$(patsubst %,|| $(patsubst TARGET_%,TARGET_DEVICE_%,$(TARGET_DEP))_DEVICE_%,$(BUILD_DEVICES)))
+      endif
+    endif
+    $(if $(DEFAULT),DEFAULT:=$(DEFAULT))
+    URL:=https://optee.readthedocs.io
+  endef
+
+  define Package/optee-os-$(1)/install
+	$$(Package/optee-os/install)
+  endef
+endef
+
+define Build/Configure/Optee-os
+endef
+
+define Build/Compile/Optee-os
+	+$(MAKE) $(PKG_JOBS) -C $(PKG_BUILD_DIR) \
+		PATH=$(LINUX_DIR)/scripts/dtc/:$(STAGING_DIR_HOST)/bin:$(PATH) \
+		CROSS_COMPILE=$(TARGET_CROSS) \
+		CROSS_COMPILE_core="$(TARGET_CROSS)" \
+		CROSS_COMPILE_ta_arm64="$(TARGET_CROSS)" \
+		CROSS_COMPILE_ta_arm32="$(TARGET_CROSS)" \
+		$(if $(CONFIG_ARCH_64BIT), CFG_ARM64_core=y CFG_USER_TA_TARGETS=ta_arm64, CFG_ARM32_core=y) \
+		PLATFORM="$(PLAT)" \
+		PLATFORM_FLAVOR="$(call qstrip,$(PLAT_FLAVOR))" \
+		$(OPTEE_MAKE_FLAGS)
+endef
+
+define BuildPackage/Optee-os/Defaults
+  Build/Configure/Default = $$$$(Build/Configure/Optee-os)
+  Build/Compile/Default = $$$$(Build/Compile/Optee-os)
+endef
+
+define BuildPackage/Optee-os
+  $(eval $(call BuildPackage/Optee-os/Defaults))
+  $(foreach type,$(if $(DUMP),$(OPTEE_TARGETS),$(BUILD_VARIANT)), \
+    $(eval $(call Build/Optee-os/Target,$(type)))
+  )
+  $(eval $(call Build/DefaultTargets))
+  $(foreach type,$(if $(DUMP),$(OPTEE_TARGETS),$(BUILD_VARIANT)), \
+    $(call BuildPackage,optee-os-$(type))
+  )
+endef
diff --git a/include/target.mk b/include/target.mk
index d13902ad6e78ec..02ea68b15c8121 100644
--- a/include/target.mk
+++ b/include/target.mk
@@ -7,10 +7,17 @@ ifneq ($(__target_inc),1)
 __target_inc=1
 
 
-# default device type
+##@
+# @brief Default device type ( basic | nas | router ).
+##
 DEVICE_TYPE?=router
 
-# Default packages - the really basic set
+##@
+# @brief Default packages.
+#
+# The really basic set. Additional packages are added based on @DEVICE_TYPE and
+# @CONFIG_* values.
+##
 DEFAULT_PACKAGES:=\
 	base-files \
 	ca-bundle \
@@ -27,15 +34,21 @@ DEFAULT_PACKAGES:=\
 	urandom-seed \
 	urngd
 
-# For the basic set
+##@
+# @brief Default packages for @DEVICE_TYPE basic.
+##
 DEFAULT_PACKAGES.basic:=
-# For nas targets
+##@
+# @brief Default packages for @DEVICE_TYPE nas.
+##
 DEFAULT_PACKAGES.nas:=\
 	block-mount \
 	fdisk \
 	lsblk \
 	mdadm
-# For router targets
+##@
+# @brief Default packages for @DEVICE_TYPE router.
+##
 DEFAULT_PACKAGES.router:=\
 	dnsmasq \
 	firewall4 \
@@ -77,51 +90,26 @@ else
   endif
 endif
 
-ifneq ($(DUMP),)
-  # Parse generic config that might be set before a .config is generated to modify the
-  # default package configuration
-  # Keep DYNAMIC_DEF_PKG_CONF in sync with toplevel.mk to reflect the same configs
-  DYNAMIC_DEF_PKG_CONF := CONFIG_USE_APK CONFIG_SELINUX CONFIG_SMALL_FLASH CONFIG_SECCOMP
-  $(foreach config, $(DYNAMIC_DEF_PKG_CONF), \
-    $(eval $(config) := $(shell grep "$(config)=y" $(TOPDIR)/.config 2>/dev/null)) \
-  )
-  # The config options that are enabled by default and where other default
-  # packages depends on needs to be set if they are missing in the .config.
-  ifeq ($(shell grep "CONFIG_SECCOMP" $(TOPDIR)/.config 2>/dev/null),)
-    ifeq ($(filter $(BOARD), uml),)
-    ifneq ($(filter $(ARCH), aarch64 arm armeb mips mipsel mips64 mips64el i386 powerpc x86_64),)
-      CONFIG_SECCOMP := y
-    endif
-    endif
-  endif
-endif
-
-ifneq ($(CONFIG_USE_APK),)
-DEFAULT_PACKAGES+=apk-mbedtls
-else
-DEFAULT_PACKAGES+=opkg
-endif
-
-ifneq ($(CONFIG_SELINUX),)
-DEFAULT_PACKAGES+=busybox-selinux procd-selinux
-else
-DEFAULT_PACKAGES+=busybox procd
-endif
-
 # include ujail on systems with enough storage
-ifeq ($(CONFIG_SMALL_FLASH),)
-DEFAULT_PACKAGES+=procd-ujail
-endif
-
-# include seccomp ld-preload hooks if kernel supports it
-ifneq ($(CONFIG_SECCOMP),)
-DEFAULT_PACKAGES+=procd-seccomp
+ifeq ($(filter small_flash,$(FEATURES)),)
+  DEFAULT_PACKAGES+=procd-ujail
 endif
 
 # Add device specific packages (here below to allow device type set from subtarget)
 DEFAULT_PACKAGES += $(DEFAULT_PACKAGES.$(DEVICE_TYPE))
 
+##@
+# @brief Filter out packages, prepended with `-`.
+#
+# @param 1: Package list.
+##
 filter_packages = $(filter-out -% $(patsubst -%,%,$(filter -%,$(1))),$(1))
+
+##@
+# @brief Append extra package dependencies.
+#
+# @param 1: Package list.
+##
 extra_packages = $(if $(filter wpad wpad-% nas,$(1)),iwinfo)
 
 define ProfileDefault
diff --git a/include/toplevel.mk b/include/toplevel.mk
index e5f5e0fecd8de4..092dff786c9922 100644
--- a/include/toplevel.mk
+++ b/include/toplevel.mk
@@ -75,22 +75,7 @@ endif
 
 _ignore = $(foreach p,$(IGNORE_PACKAGES),--ignore $(p))
 
-# Config that will invalidate the .targetinfo as they will affect
-# DEFAULT_PACKAGES.
-# Keep DYNAMIC_DEF_PKG_CONF in sync with target.mk to reflect the same configs
-DYNAMIC_DEF_PKG_CONF := CONFIG_USE_APK CONFIG_SELINUX CONFIG_SMALL_FLASH CONFIG_SECCOMP
-check-dynamic-def-pkg: FORCE
-	@+DEF_PKG_CONFS=""; \
-	if [ -f $(TOPDIR)/.config ]; then \
-		for config in $(DYNAMIC_DEF_PKG_CONF); do \
-			DEF_PKG_CONFS="$$DEF_PKG_CONFS "$$(grep "$$config"=y $(TOPDIR)/.config); \
-		done; \
-	fi; \
-	[ ! -f tmp/.packagedynamicdefault ] || OLD_DEF_PKG_CONFS=$$(cat tmp/.packagedynamicdefault); \
-	[ "$$DEF_PKG_CONFS" = "$$OLD_DEF_PKG_CONFS" ] || rm -rf tmp/info/.targetinfo*; \
-	mkdir -p tmp && echo "$$DEF_PKG_CONFS" > tmp/.packagedynamicdefault;
-
-prepare-tmpinfo: check-dynamic-def-pkg FORCE
+prepare-tmpinfo: FORCE
 	@+$(MAKE) -r -s $(STAGING_DIR_HOST)/.prereq-build $(PREP_MK)
 	mkdir -p tmp/info feeds
 	[ -e $(TOPDIR)/feeds/base ] || ln -sf $(TOPDIR)/package $(TOPDIR)/feeds/base
diff --git a/include/trusted-firmware-a.mk b/include/trusted-firmware-a.mk
index e469dae9840087..521225fa2898bb 100644
--- a/include/trusted-firmware-a.mk
+++ b/include/trusted-firmware-a.mk
@@ -1,12 +1,20 @@
 PKG_NAME ?= trusted-firmware-a
 PKG_CPE_ID ?= cpe:/a:arm:trusted_firmware-a
 
-ifndef PKG_SOURCE_PROTO
-PKG_SOURCE = trusted-firmware-a-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/snapshot
-endif
+PKG_LTS ?=
 
+ifneq ($(PKG_LTS),)
+PKG_VERSION_PREFIX:=lts-v
+PKG_BUILD_DIR = $(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION_PREFIX)$(PKG_VERSION)
+else
+PKG_VERSION_PREFIX:=v
 PKG_BUILD_DIR = $(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_VERSION)
+endif
+
+ifndef PKG_SOURCE_PROTO
+PKG_SOURCE = trusted-firmware-a-$(PKG_VERSION_PREFIX)$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://codeload.github.com/TrustedFirmware-A/trusted-firmware-a/tar.gz/$(PKG_VERSION_PREFIX)$(PKG_VERSION)?
+endif
 
 PKG_TARGETS := bin
 PKG_FLAGS:=nonshared
@@ -82,7 +90,7 @@ define Build/Compile/Trusted-Firmware-A
 		OPENSSL_DIR=$(STAGING_DIR_HOST) \
 		$(if $(DTC),DTC="$(DTC)") \
 		PLAT=$(PLAT) \
-		BUILD_STRING="OpenWrt v$(PKG_VERSION)-$(PKG_RELEASE) ($(VARIANT))" \
+		BUILD_STRING="OpenWrt $(PKG_VERSION_PREFIX)$(PKG_VERSION)-$(PKG_RELEASE) ($(VARIANT))" \
 		$(if $(CONFIG_BINUTILS_VERSION_2_37)$(CONFIG_BINUTILS_VERSION_2_38),,LDFLAGS="-no-warn-rwx-segments") \
 		$(TFA_MAKE_FLAGS)
 endef
diff --git a/include/version.mk b/include/version.mk
index 1ac29b629adb6b..a6ebe587797707 100644
--- a/include/version.mk
+++ b/include/version.mk
@@ -23,13 +23,13 @@ PKG_CONFIG_DEPENDS += \
 sanitize = $(call tolower,$(subst _,-,$(subst $(space),-,$(1))))
 
 VERSION_NUMBER:=$(call qstrip,$(CONFIG_VERSION_NUMBER))
-VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),SNAPSHOT)
+VERSION_NUMBER:=$(if $(VERSION_NUMBER),$(VERSION_NUMBER),24.10-SNAPSHOT)
 
 VERSION_CODE:=$(call qstrip,$(CONFIG_VERSION_CODE))
 VERSION_CODE:=$(if $(VERSION_CODE),$(VERSION_CODE),$(REVISION))
 
 VERSION_REPO:=$(call qstrip,$(CONFIG_VERSION_REPO))
-VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),https://downloads.openwrt.org/snapshots)
+VERSION_REPO:=$(if $(VERSION_REPO),$(VERSION_REPO),https://downloads.openwrt.org/releases/24.10-SNAPSHOT)
 
 VERSION_DIST:=$(call qstrip,$(CONFIG_VERSION_DIST))
 VERSION_DIST:=$(if $(VERSION_DIST),$(VERSION_DIST),OpenWrt)
diff --git a/package/Makefile b/package/Makefile
index abe76a619fac4a..2343777195d969 100644
--- a/package/Makefile
+++ b/package/Makefile
@@ -142,10 +142,7 @@ else
 			$(call ERROR_MESSAGE,WARNING: Applying padding in $$d/Packages to workaround usign SHA-512 bug!); \
 			{ echo ""; echo ""; } >> Packages;; \
 		esac; \
-		echo -n '{"architecture": "$(ARCH_PACKAGES)", "packages":{' > index.json; \
-		sed -n -e 's/^Package: \(.*\)$$/"\1":/p' -e 's/^Version: \(.*\)$$/"\1",/p' Packages | tr '\n' ' ' >> index.json; \
-		echo '}}' >> index.json; \
-		sed -i 's/, }}/}}/' index.json; \
+		$(SCRIPT_DIR)/make-index-json.py -f opkg -a "$(ARCH_PACKAGES)" Packages > index.json; \
 		gzip -9nc Packages > Packages.gz; \
 	); done
 ifdef CONFIG_SIGNED_PACKAGES
diff --git a/package/base-files/Makefile b/package/base-files/Makefile
index 4da50a27362dce..c78c073699f2dc 100644
--- a/package/base-files/Makefile
+++ b/package/base-files/Makefile
@@ -39,7 +39,11 @@ endif
 define Package/base-files
   SECTION:=base
   CATEGORY:=Base system
-  DEPENDS:=+netifd +libc +jsonfilter +SIGNED_PACKAGES:usign +SIGNED_PACKAGES:openwrt-keyring +NAND_SUPPORT:ubi-utils +fstools +fwtool
+  DEPENDS:= \
+	+netifd +libc +jsonfilter +SIGNED_PACKAGES:usign +SIGNED_PACKAGES:openwrt-keyring \
+	+NAND_SUPPORT:ubi-utils +fstools +fwtool \
+	+SELINUX:procd-selinux +!SELINUX:procd +USE_SECCOMP:procd-seccomp \
+	+SELINUX:busybox-selinux +!SELINUX:busybox
   TITLE:=Base filesystem for OpenWrt
   URL:=http://openwrt.org/
   VERSION:=$(PKG_RELEASE)~$(lastword $(subst -, ,$(REVISION)))
@@ -251,6 +255,7 @@ ifneq ($(CONFIG_USE_APK),)
 	$(VERSION_SED_SCRIPT) $(1)/etc/apk/repositories
 
 	rm -f $(1)/etc/uci-defaults/13_fix-group-user
+	rm -f $(1)/sbin/pkg_check
 else
 	$(if $(CONFIG_CLEAN_IPKG),, \
 		mkdir -p $(1)/etc/opkg; \
diff --git a/package/base-files/files/etc/init.d/boot b/package/base-files/files/etc/init.d/boot
index c7d1d4af3ad375..a26d4886b2873b 100755
--- a/package/base-files/files/etc/init.d/boot
+++ b/package/base-files/files/etc/init.d/boot
@@ -24,6 +24,8 @@ boot() {
 	chmod 1777 /var/lock
 	mkdir -p /var/log
 	mkdir -p /var/run
+	ln -s /var/run /run
+	ln -s /var/lock /run/lock
 	mkdir -p /var/state
 	mkdir -p /var/tmp
 	mkdir -p /tmp/.uci
@@ -33,9 +35,9 @@ boot() {
 	mkdir -p /tmp/resolv.conf.d
 	touch /tmp/resolv.conf.d/resolv.conf.auto
 	ln -sf /tmp/resolv.conf.d/resolv.conf.auto /tmp/resolv.conf
-	grep -q debugfs /proc/filesystems && /bin/mount -o noatime -t debugfs debugfs /sys/kernel/debug
+	grep -q debugfs /proc/filesystems && /bin/mount -o nosuid,nodev,noexec,noatime -t debugfs debugfs /sys/kernel/debug
 	grep -q bpf /proc/filesystems && /bin/mount -o nosuid,nodev,noexec,noatime,mode=0700 -t bpf bpffs /sys/fs/bpf
-	grep -q pstore /proc/filesystems && /bin/mount -o noatime -t pstore pstore /sys/fs/pstore
+	grep -q pstore /proc/filesystems && /bin/mount -o nosuid,nodev,noexec,noatime -t pstore pstore /sys/fs/pstore
 	[ "$FAILSAFE" = "true" ] && touch /tmp/.failsafe
 
 	touch /tmp/.config_pending
diff --git a/package/base-files/files/etc/rc.common b/package/base-files/files/etc/rc.common
index d7473038444cb1..abf72ea3372fe8 100755
--- a/package/base-files/files/etc/rc.common
+++ b/package/base-files/files/etc/rc.common
@@ -100,10 +100,6 @@ service_triggers() {
 	return 0
 }
 
-service_data() {
-	return 0
-}
-
 service_running() {
 	local instance="${1:-*}"
 
diff --git a/package/base-files/files/etc/uci-defaults/50-root-passwd b/package/base-files/files/etc/uci-defaults/50-root-passwd
index 9eddf1559baf33..f0bb519aece4f4 100644
--- a/package/base-files/files/etc/uci-defaults/50-root-passwd
+++ b/package/base-files/files/etc/uci-defaults/50-root-passwd
@@ -3,10 +3,16 @@
 json_init
 json_load "$(cat /etc/board.json)"
 
-json_select credentials
-	json_get_vars root_password_hash root_password_hash
-	[ -z "$root_password_hash" ] || sed -i "s|^root:[^:]*|root:$root_password_hash|g" /etc/shadow
+if json_is_a credentials object; then
+	json_select credentials
+		json_get_vars root_password_hash root_password_hash
+		if [ -n "$root_password_hash" ]; then
+			sed -i "s|^root:[^:]*|root:$root_password_hash|g" /etc/shadow
+		fi
 
-	json_get_vars root_password_plain root_password_plain
-	[ -z "$root_password_plain" ] || { (echo "$root_password_plain"; sleep 1; echo "$root_password_plain") | passwd root }
-json_select ..
+		json_get_vars root_password_plain root_password_plain
+		if [ -n "$root_password_plain" ]; then
+			(echo "$root_password_plain"; sleep 1; echo "$root_password_plain") | passwd root
+		fi
+	json_select ..
+fi
diff --git a/package/base-files/files/lib/functions/caldata.sh b/package/base-files/files/lib/functions/caldata.sh
index 09289728c0f5e3..f0fc907aeff1a2 100644
--- a/package/base-files/files/lib/functions/caldata.sh
+++ b/package/base-files/files/lib/functions/caldata.sh
@@ -125,8 +125,8 @@ caldata_valid() {
 caldata_patch_data() {
 	local data=$1
 	local data_count=$((${#1} / 2))
-	local data_offset=$(($2))
-	local chksum_offset=$(($3))
+	[ -n "$2" ] && local data_offset=$(($2))
+	[ -n "$3" ] && local chksum_offset=$(($3))
 	local target=$4
 	local fw_data
 	local fw_chksum
diff --git a/package/base-files/files/lib/functions/system.sh b/package/base-files/files/lib/functions/system.sh
index 048e32f0e16414..f43281b5dceb07 100644
--- a/package/base-files/files/lib/functions/system.sh
+++ b/package/base-files/files/lib/functions/system.sh
@@ -66,7 +66,7 @@ get_mac_ascii() {
 	local key="$2"
 	local mac_dirty
 
-	mac_dirty=$(strings "$part" | sed -n 's/^'"$key"'=//p')
+	mac_dirty=$(strings "$part" | tr -d ' \t' | sed -n 's/^'"$key"'=//p' | head -n 1)
 
 	# "canonicalize" mac
 	[ -n "$mac_dirty" ] && macaddr_canonicalize "$mac_dirty"
diff --git a/package/base-files/image-config.in b/package/base-files/image-config.in
index dee06e9b864b78..80db993d46b837 100644
--- a/package/base-files/image-config.in
+++ b/package/base-files/image-config.in
@@ -190,7 +190,7 @@ if VERSIONOPT
 	config VERSION_REPO
 		string
 		prompt "Release repository"
-		default "https://downloads.openwrt.org/snapshots"
+		default "https://downloads.openwrt.org/releases/24.10-SNAPSHOT"
 		help
 			This is the repository address embedded in the image, it defaults
 			to the trunk snapshot repo; the url may contain the following placeholders:
diff --git a/package/boot/arm-trusted-firmware-mediatek/Makefile b/package/boot/arm-trusted-firmware-mediatek/Makefile
index 3f70f337845150..a543196feb5d73 100644
--- a/package/boot/arm-trusted-firmware-mediatek/Makefile
+++ b/package/boot/arm-trusted-firmware-mediatek/Makefile
@@ -35,6 +35,8 @@ define Trusted-Firmware-A/Default
   DRAM_USE_COMB:=
   RAM_BOOT_UART_DL:=
   USE_UBI:=
+  FIP_OFFSET:=
+  FIP_SIZE:=
 endef
 
 define Trusted-Firmware-A/mt7622-nor-1ddr
@@ -221,6 +223,16 @@ define Trusted-Firmware-A/mt7981-spim-nand-ddr3
   DDR_TYPE:=ddr3
 endef
 
+define Trusted-Firmware-A/mt7981-cudy-tr3000-v1
+  NAME:=Cudy TR3000 v1 (SPI-NAND via SPIM, DDR3)
+  BOOT_DEVICE:=spim-nand
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7981
+  DDR_TYPE:=ddr3
+  FIP_OFFSET:=0x3c0000
+  FIP_SIZE:=0x200000
+endef
+
 define Trusted-Firmware-A/mt7986-ram-ddr4
   NAME:=MediaTek MT7986 (RAM, DDR4)
   BOOT_DEVICE:=ram
@@ -352,6 +364,15 @@ define Trusted-Firmware-A/mt7986-spim-nand-ddr3
   DDR_TYPE:=ddr3
 endef
 
+define Trusted-Firmware-A/mt7986-spim-nand-ubi-ddr3
+  NAME:=MediaTek MT7986 (SPI-NAND via SPIM using UBI, DDR3)
+  BOOT_DEVICE:=spim-nand
+  BUILD_SUBTARGET:=filogic
+  PLAT:=mt7986
+  DDR_TYPE:=ddr3
+  USE_UBI:=1
+endef
+
 define Trusted-Firmware-A/mt7988-nor-ddr3
   NAME:=MediaTek MT7988 (SPI-NOR, DDR3)
   BOOT_DEVICE:=nor
@@ -525,12 +546,14 @@ TFA_TARGETS:= \
 	mt7981-ram-ddr4 \
 	mt7981-emmc-ddr4 \
 	mt7981-spim-nand-ddr4 \
+	mt7981-cudy-tr3000-v1 \
 	mt7986-ram-ddr3 \
 	mt7986-emmc-ddr3 \
 	mt7986-nor-ddr3 \
 	mt7986-sdmmc-ddr3 \
 	mt7986-snand-ddr3 \
 	mt7986-spim-nand-ddr3 \
+	mt7986-spim-nand-ubi-ddr3 \
 	mt7986-ram-ddr4 \
 	mt7986-emmc-ddr4 \
 	mt7986-nor-ddr4 \
@@ -570,6 +593,9 @@ TFA_MAKE_FLAGS += \
 	$(if $(RAM_BOOT_UART_DL),RAM_BOOT_UART_DL=1) \
 	$(if $(USE_UBI),UBI=1 $(if $(findstring mt7622,$(PLAT)),OVERRIDE_UBI_START_ADDR=0x80000)) \
 	$(if $(USE_UBI),UBI=1 $(if $(findstring mt7981,$(PLAT)),OVERRIDE_UBI_START_ADDR=0x100000)) \
+	$(if $(USE_UBI),UBI=1 $(if $(findstring mt7986,$(PLAT)),OVERRIDE_UBI_START_ADDR=0x200000)) \
+	$(if $(FIP_OFFSET),OVERRIDE_FIP_BASE=$(FIP_OFFSET)) \
+	$(if $(FIP_SIZE),OVERRIDE_FIP_SIZE=$(FIP_SIZE)) \
 	$(if $(RAM_BOOT_UART_DL),bl2,all)
 
 define Package/trusted-firmware-a-ram/install
diff --git a/package/boot/arm-trusted-firmware-stm32/Makefile b/package/boot/arm-trusted-firmware-stm32/Makefile
new file mode 100644
index 00000000000000..46c00a51d13e06
--- /dev/null
+++ b/package/boot/arm-trusted-firmware-stm32/Makefile
@@ -0,0 +1,64 @@
+#
+# Copyright (C) 2024 Bootlin
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_VERSION:=2.10.17
+PKG_RELEASE:=1
+PKG_LTS:=1
+
+PKG_HASH:=2558b2579dd1c45db6de89c49e647c109022d45da03eb74e0f6123c294295099
+PKG_MAINTAINER:=Thomas Richard <thomas.richard@bootlin.com>
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/trusted-firmware-a.mk
+include $(INCLUDE_DIR)/package.mk
+
+define Trusted-Firmware-A/Default
+  BUILD_TARGET:=stm32
+  BUILD_DEVICES:=$(1)
+  DEPENDS:=+u-boot-$(1) +optee-os-$(1)
+endef
+
+define Trusted-Firmware-A/stm32mp1
+  BUILD_SUBTARGET:=stm32mp1
+  PLAT:=stm32mp1
+  MAKE_ARGS += BL32_EXTRA2=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-tee-pageable_v2.bin \
+	       STM32MP_USB_PROGRAMMER=1 \
+	       STM32MP1_OPTEE_IN_SYSRAM=1 \
+	       ARM_ARCH_MAJOR=7
+endef
+
+define Trusted-Firmware-A/stm32mp135f-dk
+  $(call Trusted-Firmware-A/stm32mp1)
+  NAME:=STM32MP135F-DK
+  DTB_FILE_NAME=stm32mp135f-dk.dtb
+endef
+
+TFA_TARGETS := stm32mp135f-dk
+
+TFA_MAKE_FLAGS += \
+		ARCH=aarch32 AARCH32_SP=optee \
+		BL32=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-tee-header_v2.bin \
+		BL32_EXTRA1=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-tee-pager_v2.bin \
+		BL33=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-u-boot.bin \
+		BL33_CFG=$(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-u-boot.dtb \
+		DTB_FILE_NAME=$(DTB_FILE_NAME) \
+		STM32MP_SDMMC=1 \
+		TARGET_BOARD="" \
+		$(MAKE_ARGS) \
+		all fip
+
+define Package/trusted-firmware-a/install
+	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
+	$(CP) $(PKG_BUILD_DIR)/build/$(PLAT)/release/tf-a-$(BUILD_VARIANT).stm32 \
+		$(STAGING_DIR_IMAGE)/tf-a-$(BUILD_VARIANT).stm32
+	$(CP) $(PKG_BUILD_DIR)/build/$(PLAT)/release/fip.bin \
+		$(STAGING_DIR_IMAGE)/fip-$(BUILD_VARIANT).bin
+endef
+
+$(eval $(call BuildPackage/Trusted-Firmware-A))
diff --git a/package/boot/optee-os-stm32/Makefile b/package/boot/optee-os-stm32/Makefile
new file mode 100644
index 00000000000000..9e681127e6a1b2
--- /dev/null
+++ b/package/boot/optee-os-stm32/Makefile
@@ -0,0 +1,49 @@
+#
+# Copyright (C) 2024 Bootlin
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_VERSION:=4.3.0
+PKG_RELEASE:=1
+
+PKG_HASH:=390b271905c828d6def9fa6a77bbaa425f3b434d733c8eb18f582ccbc6896096
+PKG_MAINTAINER:=Thomas Richard <thomas.richard@bootlin.com>
+
+OPTEE_USE_INTREE_DTC:=1
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/optee-os.mk
+include $(INCLUDE_DIR)/package.mk
+
+define Optee-os/Default
+  BUILD_TARGET:=stm32
+endef
+
+define Optee-os/stm32mp1
+  BUILD_SUBTARGET:=stm32mp1
+  PLAT:=stm32mp1
+endef
+
+define Optee-os/stm32mp135f-dk
+  $(call Optee-os/stm32mp1)
+  NAME:=STM32MP135F-DK
+  PLAT_FLAVOR:=135F_DK
+endef
+
+OPTEE_TARGETS := stm32mp135f-dk
+
+define Package/optee-os/install/default
+endef
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
+	$(foreach img,$(OPTEE_IMAGE), \
+		$(CP) $(PKG_BUILD_DIR)/out/arm-plat-$(PLAT)/core/$(img) $(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-$(img); \
+	)
+endef
+
+$(eval $(call BuildPackage/Optee-os))
diff --git a/package/boot/uboot-d1/Makefile b/package/boot/uboot-d1/Makefile
index 083a219baf6fab..611922443b0800 100644
--- a/package/boot/uboot-d1/Makefile
+++ b/package/boot/uboot-d1/Makefile
@@ -30,7 +30,7 @@ define U-Boot/dongshan_nezha_stu
   OPENSBI:=generic
   DEPENDS:=+opensbi_generic
   UBOOT_DTS:=sun20i-d1-dongshan-nezha-stu.dtb
-  BUILD_DEVICES:=dongshan_nezha_stu
+  BUILD_DEVICES:=100ask_dongshan-nezha-stu
 endef
 
 define U-Boot/lichee_rv_dock
@@ -38,7 +38,7 @@ define U-Boot/lichee_rv_dock
   OPENSBI:=generic
   DEPENDS:=+opensbi_generic
   UBOOT_DTS:=sun20i-d1-lichee-rv-dock.dtb
-  BUILD_DEVICES:=lichee_rv_dock
+  BUILD_DEVICES:=sipeed_lichee-rv-dock
 endef
 
 define U-Boot/mangopi_mq_pro
@@ -46,7 +46,7 @@ define U-Boot/mangopi_mq_pro
   OPENSBI:=generic
   DEPENDS:=+opensbi_generic
   UBOOT_DTS:=sun20i-d1-mangopi-mq-pro.dtb
-  BUILD_DEVICES:=mangopi_mq_pro
+  BUILD_DEVICES:=widora_mangopi-mq-pro
 endef
 
 define U-Boot/nezha
@@ -54,7 +54,7 @@ define U-Boot/nezha
   OPENSBI:=generic
   DEPENDS:=+opensbi_generic
   UBOOT_DTS:=sun20i-d1-nezha.dtb
-  BUILD_DEVICES:=nezha
+  BUILD_DEVICES:=allwinner_d1-nezha
 endef
 
 UBOOT_TARGETS := \
@@ -74,7 +74,7 @@ endef
 define Build/InstallDev
 	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/$(DTS_DIR)/$(UBOOT_DTS) $(STAGING_DIR_IMAGE)/$(UBOOT_DTS)
-	$(INSTALL_BIN) $(PKG_BUILD_DIR)/$(UBOOT_IMAGE) $(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-$(UBOOT_IMAGE)
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/$(UBOOT_IMAGE) $(STAGING_DIR_IMAGE)/$(BUILD_DEVICES)-$(UBOOT_IMAGE)
 	mkimage -C none -A riscv -T script -d uEnv-$(UENV).txt \
 		$(STAGING_DIR_IMAGE)/$(BUILD_DEVICES)-boot.scr
 endef
diff --git a/package/boot/uboot-envtools/files/ath79 b/package/boot/uboot-envtools/files/ath79
index 1d9d3bcfaa1fc5..c989e61bd550f4 100644
--- a/package/boot/uboot-envtools/files/ath79
+++ b/package/boot/uboot-envtools/files/ath79
@@ -28,6 +28,7 @@ asus,rt-ac59u-v2|\
 asus,zenwifi-cd6n|\
 asus,zenwifi-cd6r|\
 buffalo,bhr-4grv2|\
+buffalo,wzr-450hp2|\
 devolo,magic-2-wifi|\
 engenius,eap300-v2|\
 engenius,eap350-v1|\
@@ -163,6 +164,7 @@ ruckus,zf7372)
 	ubootenv_add_uci_config "/dev/mtd2" "0x0" "0x40000" "0x10000"
 	;;
 sophos,ap15|\
+sophos,ap15c|\
 sophos,ap55|\
 sophos,ap55c|\
 sophos,ap100|\
diff --git a/package/boot/uboot-envtools/files/imx_cortexa53 b/package/boot/uboot-envtools/files/imx_cortexa53
new file mode 100644
index 00000000000000..6aad4ce86710de
--- /dev/null
+++ b/package/boot/uboot-envtools/files/imx_cortexa53
@@ -0,0 +1,21 @@
+[ -e /etc/config/ubootenv ] && exit 0
+
+touch /etc/config/ubootenv
+
+. /lib/uboot-envtools.sh
+. /lib/functions.sh
+
+board=$(board_name)
+
+case "$board" in
+gw,imx8m*|\
+gateworks,imx8m*)
+	# board boots from emmc boot0 hardware partition
+	ubootenv_add_uci_config /dev/mmcblk2boot0 0x3f0000 0x8000
+	ubootenv_add_uci_config /dev/mmcblk2boot0 0x3f8000 0x8000
+esac
+
+config_load ubootenv
+config_foreach ubootenv_add_app_config ubootenv
+
+exit 0
diff --git a/package/boot/uboot-envtools/files/mediatek_filogic b/package/boot/uboot-envtools/files/mediatek_filogic
index a38024de65976b..3f8fa0d54388c0 100644
--- a/package/boot/uboot-envtools/files/mediatek_filogic
+++ b/package/boot/uboot-envtools/files/mediatek_filogic
@@ -34,11 +34,16 @@ ubootenv_add_ubi_default() {
 
 case "$board" in
 abt,asr3000|\
+cmcc,a10-ubootmod|\
+cudy,tr3000-v1-ubootmod|\
 h3c,magic-nx30-pro|\
 jcg,q30-pro|\
+mercusys,mr90x-v1-ubi|\
 netcore,n60|\
+netis,nx31|\
 nokia,ea0326gmp|\
 qihoo,360t7|\
+routerich,ax3000-ubootmod|\
 tplink,tl-xdr4288|\
 tplink,tl-xdr6086|\
 tplink,tl-xdr6088|\
@@ -49,6 +54,17 @@ xiaomi,redmi-router-ax6000-ubootmod|\
 zyxel,ex5601-t0-ubootmod)
 	ubootenv_add_ubi_default
 	;;
+acer,predator-w6|\
+acer,predator-w6d|\
+acer,vero-w6m|\
+glinet,gl-mt2500|\
+glinet,gl-mt6000|\
+glinet,gl-x3000|\
+glinet,gl-xe3000|\
+huasifei,wh3000)
+	local envdev=$(find_mmc_part "u-boot-env")
+	ubootenv_add_uci_config "$envdev" "0x0" "0x80000"
+	;;
 asus,rt-ax59u)
 	ubootenv_add_uci_config "/dev/mtd0" "0x100000" "0x20000" "0x20000"
 	;;
@@ -83,21 +99,20 @@ zbtlink,zbt-z8102ax|\
 zbtlink,zbt-z8103ax)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x20000"
 	;;
-dlink,aquila-pro-ai-m30-a1)
+dlink,aquila-pro-ai-m30-a1|\
+dlink,aquila-pro-ai-m60-a1)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x40000" "0x40000"
 	;;
-glinet,gl-x3000|\
-glinet,gl-xe3000|\
-glinet,gl-mt2500|\
-glinet,gl-mt6000)
-	local envdev=$(find_mmc_part "u-boot-env")
-	ubootenv_add_uci_config "$envdev" "0x0" "0x80000"
+gatonetworks,gdsp)
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x10000" "0x10000"
 	;;
 glinet,gl-mt3000)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x80000" "0x20000"
 	;;
+mercusys,mr80x-v3|\
 mercusys,mr90x-v1|\
 routerich,ax3000|\
+routerich,ax3000-v1|\
 tplink,re6000xd)
 	local envdev=/dev/mtd$(find_mtd_index "u-boot-env")
 	ubootenv_add_uci_config "$envdev" "0x0" "0x20000" "0x20000" "1"
@@ -115,6 +130,9 @@ smartrg,sdg-8734)
 	local envdev=$(find_mmc_part "u-boot-env" "mmcblk0")
 	ubootenv_add_uci_config "$envdev" "0x0" "0x8000" "0x8000"
 	;;
+tplink,archer-ax80-v1)
+	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x20000" "0x20000" "8"
+	;;
 ubnt,unifi-6-plus)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x80000" "0x10000"
 	;;
diff --git a/package/boot/uboot-envtools/files/qualcommax_ipq807x b/package/boot/uboot-envtools/files/qualcommax_ipq807x
index f5fb07a4db0bf0..2d76045c66e568 100644
--- a/package/boot/uboot-envtools/files/qualcommax_ipq807x
+++ b/package/boot/uboot-envtools/files/qualcommax_ipq807x
@@ -37,6 +37,11 @@ linksys,mx8500)
 	[ -n "$idx" ] && \
 		ubootenv_add_uci_config "/dev/mtd$idx" "0x0" "0x40000" "0x20000" "2"
 	;;
+linksys,mx4300)
+	idx="$(find_mtd_index u_env)"
+	[ -n "$idx" ] && \
+		ubootenv_add_uci_config "/dev/mtd$idx" "0x0" "0x40000" "0x40000" "1"
+	;;
 netgear,sxr80|\
 netgear,sxs80|\
 tplink,eap660hd-v1)
diff --git a/package/boot/uboot-envtools/files/ramips b/package/boot/uboot-envtools/files/ramips
index 341687625c8603..b0f8c1c1689944 100644
--- a/package/boot/uboot-envtools/files/ramips
+++ b/package/boot/uboot-envtools/files/ramips
@@ -19,6 +19,7 @@ alfa-network,r36m-e4g|\
 alfa-network,tube-e4g|\
 engenius,epg600|\
 engenius,esr600h|\
+hongdian,h8922-v30|\
 linksys,re7000|\
 meig,slt866|\
 sitecom,wlr-4100-v1-002|\
@@ -62,6 +63,7 @@ kroks,kndrt31r19|\
 mediatek,linkit-smart-7688|\
 samknows,whitebox-v8|\
 xiaomi,mi-router-4c|\
+xiaomi,miwifi-3a|\
 xiaomi,miwifi-nano|\
 zbtlink,zbt-wg2626|\
 zte,mf283plus)
@@ -147,7 +149,8 @@ xiaomi,mi-router-cr6608|\
 xiaomi,mi-router-cr6609)
 	ubootenv_add_uci_config "/dev/mtd1" "0x0" "0x10000" "0x20000"
 	;;
-dna,valokuitu-plus-ex400)
+dna,valokuitu-plus-ex400|\
+genexis,pulse-ex400)
 	ubootenv_add_uci_config "/dev/ubi0_0" "0x0" "0x1f000" "0x1f000" "1"
 	ubootenv_add_uci_config "/dev/ubi0_1" "0x0" "0x1f000" "0x1f000" "1"
 	;;
diff --git a/package/boot/uboot-envtools/files/realtek b/package/boot/uboot-envtools/files/realtek
index cd2446432d7dac..055730eb27b3d2 100644
--- a/package/boot/uboot-envtools/files/realtek
+++ b/package/boot/uboot-envtools/files/realtek
@@ -28,6 +28,7 @@ zyxel,gs1900-10hp|\
 zyxel,gs1900-16|\
 zyxel,gs1900-24-v1|\
 zyxel,gs1900-24e|\
+zyxel,gs1900-24ep|\
 zyxel,gs1900-24hp-v1|\
 zyxel,gs1900-24hp-v2)
 	idx="$(find_mtd_index u-boot-env)"
diff --git a/package/boot/uboot-mediatek/Makefile b/package/boot/uboot-mediatek/Makefile
index e5a0a393fe5cb8..f68a5d6ff583ba 100644
--- a/package/boot/uboot-mediatek/Makefile
+++ b/package/boot/uboot-mediatek/Makefile
@@ -231,6 +231,18 @@ define U-Boot/mt7981_abt_asr3000
   DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr3
 endef
 
+define U-Boot/mt7981_cmcc_a10
+  NAME:=CMCC A10
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=cmcc_a10-ubootmod
+  UBOOT_CONFIG:=mt7981_cmcc_a10
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand
+  BL2_SOC:=mt7981
+  BL2_DDRTYPE:=ddr3
+  DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr3
+endef
+
 define U-Boot/mt7981_cmcc_rax3000m-emmc
   NAME:=CMCC RAX3000M
   BUILD_SUBTARGET:=filogic
@@ -255,6 +267,17 @@ define U-Boot/mt7981_cmcc_rax3000m-nand
   DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr4
 endef
 
+define U-Boot/mt7981_cudy_tr3000-v1
+  NAME:=Cudy TR3000 v1
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=cudy_tr3000-v1-ubootmod
+  UBOOT_CONFIG:=mt7981_cudy_tr3000-v1
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=cudy-tr3000-v1
+  BL2_SOC:=mt7981
+  DEPENDS:=+trusted-firmware-a-mt7981-cudy-tr3000-v1
+endef
+
 define U-Boot/mt7981_glinet_gl-x3000
   NAME:=GL.iNet GL-X3000
   BUILD_SUBTARGET:=filogic
@@ -303,6 +326,18 @@ define U-Boot/mt7981_jcg_q30-pro
   DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr3
 endef
 
+define U-Boot/mt7981_netis_nx31
+  NAME:=netis NX31
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=netis_nx31
+  UBOOT_CONFIG:=mt7981_netis_nx31
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand
+  BL2_SOC:=mt7981
+  BL2_DDRTYPE:=ddr3
+  DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr3
+endef
+
 define U-Boot/mt7981_nokia_ea0326gmp
   NAME:=Nokia EA0326GMP
   BUILD_SUBTARGET:=filogic
@@ -364,13 +399,26 @@ define U-Boot/mt7981_rfb-emmc
   DEPENDS:=+trusted-firmware-a-mt7981-emmc-ddr3
 endef
 
+define U-Boot/mt7981_gatonetworks_gdsp
+  NAME:=GatoNetworks GDSP
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=gatonetworks_gdsp
+  UBOOT_CONFIG:=mt7981_gatonetworks_gdsp
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=nor
+  BL2_SOC:=mt7981
+  BL2_DDRTYPE:=ddr3
+  DEPENDS:=+trusted-firmware-a-mt7981-nor-ddr3
+  FIP_COMPRESS:=1
+endef
+
 define U-Boot/mt7981_rfb-nor
   NAME:=MT7981 Reference Board
   BUILD_SUBTARGET:=filogic
   BUILD_DEVICES:=mediatek_mt7981-rfb
   UBOOT_CONFIG:=mt7981_nor_rfb
   UBOOT_IMAGE:=u-boot.fip
-  BL2_BOOTDEV:=spim-nand
+  BL2_BOOTDEV:=nor
   BL2_SOC:=mt7981
   BL2_DDRTYPE:=ddr3
   DEPENDS:=+trusted-firmware-a-mt7981-nor-ddr3
@@ -400,6 +448,18 @@ define U-Boot/mt7981_rfb-snfi
   DEPENDS:=+trusted-firmware-a-mt7981-snand-ddr3
 endef
 
+define U-Boot/mt7981_routerich_ax3000
+  NAME:=Routerich AX3000
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=routerich_ax3000-ubootmod
+  UBOOT_CONFIG:=mt7981_routerich_ax3000
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand
+  BL2_SOC:=mt7981
+  BL2_DDRTYPE:=ddr3
+  DEPENDS:=+trusted-firmware-a-mt7981-spim-nand-ddr3
+endef
+
 define U-Boot/mt7981_qihoo_360t7
   NAME:=Qihoo 360T7
   BUILD_SUBTARGET:=filogic
@@ -545,6 +605,18 @@ define U-Boot/mt7986_jdcloud_re-cp-03
   DEPENDS:=+trusted-firmware-a-mt7986-emmc-ddr4
 endef
 
+define U-Boot/mt7986_mercusys_mr90x-v1
+  NAME:=MERCUSYS MR90X v1
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=mercusys_mr90x-v1-ubi
+  UBOOT_CONFIG:=mt7986_mercusys_mr90x-v1
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=spim-nand-ubi
+  BL2_SOC:=mt7986
+  BL2_DDRTYPE:=ddr3
+  DEPENDS:=+trusted-firmware-a-mt7986-spim-nand-ubi-ddr3
+endef
+
 define U-Boot/mt7986_netcore_n60
   NAME:=Netcore N60
   BUILD_SUBTARGET:=filogic
@@ -629,6 +701,18 @@ define U-Boot/mt7986_zyxel_ex5601-t0
   DEPENDS:=+trusted-firmware-a-mt7986-spim-nand-4k-ddr4
 endef
 
+define U-Boot/mt7988_arcadyan_mozart
+  NAME:=Arcadyan Mozart
+  BUILD_SUBTARGET:=filogic
+  BUILD_DEVICES:=arcadyan_mozart
+  UBOOT_CONFIG:=mt7988a_arcadyan_mozart
+  UBOOT_IMAGE:=u-boot.fip
+  BL2_BOOTDEV:=emmc
+  BL2_SOC:=mt7988
+  BL2_DDRTYPE:=comb
+  DEPENDS:=+trusted-firmware-a-mt7988-emmc-comb
+endef
+
 define U-Boot/mt7988_bananapi_bpi-r4-emmc
   NAME:=BananaPi BPi-R4
   BUILD_SUBTARGET:=filogic
@@ -783,12 +867,16 @@ UBOOT_TARGETS := \
 	mt7628_ravpower_rp-wd009 \
 	mt7629_rfb \
 	mt7981_abt_asr3000 \
+	mt7981_cmcc_a10 \
 	mt7981_cmcc_rax3000m-emmc \
 	mt7981_cmcc_rax3000m-nand \
+	mt7981_cudy_tr3000-v1 \
+	mt7981_gatonetworks_gdsp \
 	mt7981_glinet_gl-x3000 \
 	mt7981_glinet_gl-xe3000 \
 	mt7981_h3c_magic-nx30-pro \
 	mt7981_jcg_q30-pro \
+	mt7981_netis_nx31 \
 	mt7981_nokia_ea0326gmp \
 	mt7981_openwrt_one-snand \
 	mt7981_openwrt_one-nor \
@@ -797,6 +885,7 @@ UBOOT_TARGETS := \
 	mt7981_rfb-nor \
 	mt7981_rfb-sd \
 	mt7981_rfb-snfi \
+	mt7981_routerich_ax3000 \
 	mt7981_qihoo_360t7 \
 	mt7981_xiaomi_mi-router-ax3000t \
 	mt7981_xiaomi_mi-router-wr30u \
@@ -808,6 +897,7 @@ UBOOT_TARGETS := \
 	mt7986_bananapi_bpi-r3-mini-snand \
 	mt7986_glinet_gl-mt6000 \
 	mt7986_jdcloud_re-cp-03 \
+	mt7986_mercusys_mr90x-v1 \
 	mt7986_netcore_n60 \
 	mt7986_tplink_tl-xdr4288 \
 	mt7986_tplink_tl-xdr6086 \
@@ -816,6 +906,7 @@ UBOOT_TARGETS := \
 	mt7986_xiaomi_redmi-router-ax6000 \
 	mt7986_zyxel_ex5601-t0 \
 	mt7986_rfb \
+	mt7988_arcadyan_mozart \
 	mt7988_bananapi_bpi-r4-emmc \
 	mt7988_bananapi_bpi-r4-sdmmc \
 	mt7988_bananapi_bpi-r4-snand \
@@ -831,7 +922,8 @@ UBOOT_TARGETS := \
 UBOOT_CUSTOMIZE_CONFIG := \
 	--disable TOOLS_KWBIMAGE \
 	--disable TOOLS_LIBCRYPTO \
-	--disable TOOLS_MKEFICAPSULE
+	--disable TOOLS_MKEFICAPSULE \
+	--enable SERIAL_RX_BUFFER
 
 ifdef CONFIG_TARGET_mediatek
 UBOOT_MAKE_FLAGS += $(UBOOT_IMAGE:.fip=.bin)
diff --git a/package/boot/uboot-mediatek/patches/010-menu-fix-the-logic-checking-whether-ESC-key-is-press.patch b/package/boot/uboot-mediatek/patches/010-menu-fix-the-logic-checking-whether-ESC-key-is-press.patch
new file mode 100644
index 00000000000000..f3589c46220c4c
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/010-menu-fix-the-logic-checking-whether-ESC-key-is-press.patch
@@ -0,0 +1,63 @@
+From 72b4ba8417d33516b8489bac3c90dbbbf781a3d2 Mon Sep 17 00:00:00 2001
+From: Weijie Gao <weijie.gao@mediatek.com>
+Date: Tue, 29 Oct 2024 17:47:10 +0800
+Subject: [PATCH 1/3] menu: fix the logic checking whether ESC key is pressed
+
+It's observed that the bootmenu on a serial console sometimes
+incorrectly quitted with superfluous characters filled to command
+line input:
+
+>  *** U-Boot Boot Menu ***
+>
+>      1. Startup system (Default)
+>      2. Upgrade firmware
+>      3. Upgrade ATF BL2
+>      4. Upgrade ATF FIP
+>      5. Load image
+>      0. U-Boot console
+>
+>
+>  Press UP/DOWN to move, ENTER to select, ESC to quit
+>MT7988> [B
+
+Analysis shows it was caused by the wrong logic of bootmenu_loop:
+
+At first the bootmenu_loop received the first ESC char correctly.
+
+However, during the second call to bootmenu_loop, there's no data
+in the UART Rx FIFO. Due to the low baudrate, the second char of
+the down array key sequence hasn't be fully received.
+
+But bootmenu_loop just did a mdelay(10), and then treated it as a
+single ESC key press event. It didn't even try tstc() again after
+the 10ms timeout.
+
+This patch fixes this issue by letting bootmenu_loop check tstc()
+twice.
+
+Tested-By: E Shattow <lucent@gmail.com>
+Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
+---
+ common/menu.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/common/menu.c
++++ b/common/menu.c
+@@ -525,14 +525,15 @@ enum bootmenu_key bootmenu_loop(struct b
+ 				struct cli_ch_state *cch)
+ {
+ 	enum bootmenu_key key;
+-	int c;
++	int c, errchar = 0;
+ 
+ 	c = cli_ch_process(cch, 0);
+ 	if (!c) {
+ 		while (!c && !tstc()) {
+ 			schedule();
+ 			mdelay(10);
+-			c = cli_ch_process(cch, -ETIMEDOUT);
++			c = cli_ch_process(cch, errchar);
++			errchar = -ETIMEDOUT;
+ 		}
+ 		if (!c) {
+ 			c = getchar();
diff --git a/package/boot/uboot-mediatek/patches/011-menu-add-support-to-check-if-menu-needs-to-be-reprin.patch b/package/boot/uboot-mediatek/patches/011-menu-add-support-to-check-if-menu-needs-to-be-reprin.patch
new file mode 100644
index 00000000000000..9d356ff0b4c257
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/011-menu-add-support-to-check-if-menu-needs-to-be-reprin.patch
@@ -0,0 +1,112 @@
+From f1cbdd3330f0055dfbff0ef7d86276c4cc3cff2a Mon Sep 17 00:00:00 2001
+From: Weijie Gao <weijie.gao@mediatek.com>
+Date: Tue, 29 Oct 2024 17:47:16 +0800
+Subject: [PATCH 2/3] menu: add support to check if menu needs to be reprinted
+
+This patch adds a new callback named need_reprint for menu.
+The need_reprint will be called before printing the menu. If the
+callback exists and returns FALSE, menu printing will be canceled.
+
+This is very useful if the menu was not changed. It can save time
+for serial-based menu to handle more input data.
+
+Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
+---
+ boot/pxe_utils.c |  2 +-
+ cmd/bootmenu.c   |  2 +-
+ cmd/eficonfig.c  |  2 +-
+ common/menu.c    | 11 +++++++++++
+ include/menu.h   |  1 +
+ 5 files changed, 15 insertions(+), 3 deletions(-)
+
+--- a/boot/pxe_utils.c
++++ b/boot/pxe_utils.c
+@@ -1449,7 +1449,7 @@ static struct menu *pxe_menu_to_menu(str
+ 	 * Create a menu and add items for all the labels.
+ 	 */
+ 	m = menu_create(cfg->title, DIV_ROUND_UP(cfg->timeout, 10),
+-			cfg->prompt, NULL, label_print, NULL, NULL);
++			cfg->prompt, NULL, label_print, NULL, NULL, NULL);
+ 	if (!m)
+ 		return NULL;
+ 
+--- a/cmd/bootmenu.c
++++ b/cmd/bootmenu.c
+@@ -506,7 +506,7 @@ static enum bootmenu_ret bootmenu_show(i
+ 
+ 	menu = menu_create(NULL, bootmenu->delay, 1, menu_display_statusline,
+ 			   bootmenu_print_entry, bootmenu_choice_entry,
+-			   bootmenu);
++			   NULL, bootmenu);
+ 	if (!menu) {
+ 		bootmenu_destroy(bootmenu);
+ 		return BOOTMENU_RET_FAIL;
+--- a/cmd/eficonfig.c
++++ b/cmd/eficonfig.c
+@@ -443,7 +443,7 @@ efi_status_t eficonfig_process_common(st
+ 		efi_menu->menu_desc = menu_desc;
+ 
+ 	menu = menu_create(NULL, 0, 1, display_statusline, item_data_print,
+-			   item_choice, efi_menu);
++			   item_choice, NULL, efi_menu);
+ 	if (!menu)
+ 		return EFI_INVALID_PARAMETER;
+ 
+--- a/common/menu.c
++++ b/common/menu.c
+@@ -43,6 +43,7 @@ struct menu {
+ 	void (*display_statusline)(struct menu *);
+ 	void (*item_data_print)(void *);
+ 	char *(*item_choice)(void *);
++	bool (*need_reprint)(void *);
+ 	void *item_choice_data;
+ 	struct list_head items;
+ 	int item_cnt;
+@@ -117,6 +118,11 @@ static inline void *menu_item_destroy(st
+  */
+ static inline void menu_display(struct menu *m)
+ {
++	if (m->need_reprint) {
++		if (!m->need_reprint(m->item_choice_data))
++			return;
++	}
++
+ 	if (m->title) {
+ 		puts(m->title);
+ 		putc('\n');
+@@ -362,6 +368,9 @@ int menu_item_add(struct menu *m, char *
+  * item. Returns a key string corresponding to the chosen item or NULL if
+  * no item has been selected.
+  *
++ * need_reprint - If not NULL, will be called before printing the menu.
++ * Returning FALSE means the menu does not need reprint.
++ *
+  * item_choice_data - Will be passed as the argument to the item_choice function
+  *
+  * Returns a pointer to the menu if successful, or NULL if there is
+@@ -371,6 +380,7 @@ struct menu *menu_create(char *title, in
+ 				void (*display_statusline)(struct menu *),
+ 				void (*item_data_print)(void *),
+ 				char *(*item_choice)(void *),
++				bool (*need_reprint)(void *),
+ 				void *item_choice_data)
+ {
+ 	struct menu *m;
+@@ -386,6 +396,7 @@ struct menu *menu_create(char *title, in
+ 	m->display_statusline = display_statusline;
+ 	m->item_data_print = item_data_print;
+ 	m->item_choice = item_choice;
++	m->need_reprint = need_reprint;
+ 	m->item_choice_data = item_choice_data;
+ 	m->item_cnt = 0;
+ 
+--- a/include/menu.h
++++ b/include/menu.h
+@@ -13,6 +13,7 @@ struct menu *menu_create(char *title, in
+ 				void (*display_statusline)(struct menu *),
+ 				void (*item_data_print)(void *),
+ 				char *(*item_choice)(void *),
++				bool (*need_reprint)(void *),
+ 				void *item_choice_data);
+ int menu_default_set(struct menu *m, char *item_key);
+ int menu_get_choice(struct menu *m, void **choice);
diff --git a/package/boot/uboot-mediatek/patches/012-bootmenu-add-reprint-check.patch b/package/boot/uboot-mediatek/patches/012-bootmenu-add-reprint-check.patch
new file mode 100644
index 00000000000000..8f4db3a82eb8a5
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/012-bootmenu-add-reprint-check.patch
@@ -0,0 +1,75 @@
+From 702752cfae954648d6133bdff19283343b3339ef Mon Sep 17 00:00:00 2001
+From: Weijie Gao <weijie.gao@mediatek.com>
+Date: Tue, 29 Oct 2024 17:47:22 +0800
+Subject: [PATCH 3/3] bootmenu: add reprint check
+
+Record the last active menu item and check if it equals to the
+current selected item before reprint.
+
+Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
+---
+ cmd/bootmenu.c | 16 +++++++++++++++-
+ include/menu.h |  1 +
+ 2 files changed, 16 insertions(+), 1 deletion(-)
+
+--- a/cmd/bootmenu.c
++++ b/cmd/bootmenu.c
+@@ -103,11 +103,13 @@ static char *bootmenu_choice_entry(void
+ 
+ 		switch (key) {
+ 		case BKEY_UP:
++			menu->last_active = menu->active;
+ 			if (menu->active > 0)
+ 				--menu->active;
+ 			/* no menu key selected, regenerate menu */
+ 			return NULL;
+ 		case BKEY_DOWN:
++			menu->last_active = menu->active;
+ 			if (menu->active < menu->count - 1)
+ 				++menu->active;
+ 			/* no menu key selected, regenerate menu */
+@@ -133,6 +135,17 @@ static char *bootmenu_choice_entry(void
+ 	return NULL;
+ }
+ 
++static bool bootmenu_need_reprint(void *data)
++{
++	struct bootmenu_data *menu = data;
++	bool need_reprint;
++
++	need_reprint = menu->last_active != menu->active;
++	menu->last_active = menu->active;
++
++	return need_reprint;
++}
++
+ static void bootmenu_destroy(struct bootmenu_data *menu)
+ {
+ 	struct bootmenu_entry *iter = menu->first;
+@@ -332,6 +345,7 @@ static struct bootmenu_data *bootmenu_cr
+ 
+ 	menu->delay = delay;
+ 	menu->active = 0;
++	menu->last_active = -1;
+ 	menu->first = NULL;
+ 
+ 	default_str = env_get("bootmenu_default");
+@@ -506,7 +520,7 @@ static enum bootmenu_ret bootmenu_show(i
+ 
+ 	menu = menu_create(NULL, bootmenu->delay, 1, menu_display_statusline,
+ 			   bootmenu_print_entry, bootmenu_choice_entry,
+-			   NULL, bootmenu);
++			   bootmenu_need_reprint, bootmenu);
+ 	if (!menu) {
+ 		bootmenu_destroy(bootmenu);
+ 		return BOOTMENU_RET_FAIL;
+--- a/include/menu.h
++++ b/include/menu.h
+@@ -40,6 +40,7 @@ int menu_show(int bootdelay);
+ struct bootmenu_data {
+ 	int delay;			/* delay for autoboot */
+ 	int active;			/* active menu entry */
++	int last_active;		/* last active menu entry */
+ 	int count;			/* total count of menu entries */
+ 	struct bootmenu_entry *first;	/* first menu entry */
+ };
diff --git a/package/boot/uboot-mediatek/patches/100-16-cmd-bootmenu-add-ability-to-select-item-by-shortkey.patch b/package/boot/uboot-mediatek/patches/100-16-cmd-bootmenu-add-ability-to-select-item-by-shortkey.patch
index 4aa4318493ef5f..47e158b521ceca 100644
--- a/package/boot/uboot-mediatek/patches/100-16-cmd-bootmenu-add-ability-to-select-item-by-shortkey.patch
+++ b/package/boot/uboot-mediatek/patches/100-16-cmd-bootmenu-add-ability-to-select-item-by-shortkey.patch
@@ -35,7 +35,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  		}
  
  		switch (key) {
-@@ -112,6 +113,12 @@ static char *bootmenu_choice_entry(void
+@@ -114,6 +115,12 @@ static char *bootmenu_choice_entry(void
  				++menu->active;
  			/* no menu key selected, regenerate menu */
  			return NULL;
@@ -48,7 +48,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  		case BKEY_SELECT:
  			iter = menu->first;
  			for (i = 0; i < menu->active; ++i)
-@@ -169,6 +176,9 @@ static int prepare_bootmenu_entry(struct
+@@ -182,6 +189,9 @@ static int prepare_bootmenu_entry(struct
  	unsigned short int i = *index;
  	struct bootmenu_entry *entry = NULL;
  	struct bootmenu_entry *iter = *current;
@@ -58,7 +58,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  
  	while ((option = bootmenu_getoption(i))) {
  
-@@ -183,11 +193,24 @@ static int prepare_bootmenu_entry(struct
+@@ -196,11 +206,24 @@ static int prepare_bootmenu_entry(struct
  		if (!entry)
  			return -ENOMEM;
  
@@ -84,15 +84,15 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  
  		entry->command = strdup(sep + 1);
  		if (!entry->command) {
-@@ -333,6 +356,7 @@ static struct bootmenu_data *bootmenu_cr
- 	menu->delay = delay;
+@@ -347,6 +370,7 @@ static struct bootmenu_data *bootmenu_cr
  	menu->active = 0;
+ 	menu->last_active = -1;
  	menu->first = NULL;
 +	menu->last_choiced = false;
  
  	default_str = env_get("bootmenu_default");
  	if (default_str)
-@@ -368,9 +392,9 @@ static struct bootmenu_data *bootmenu_cr
+@@ -382,9 +406,9 @@ static struct bootmenu_data *bootmenu_cr
  
  		/* Add Quit entry if exiting bootmenu is disabled */
  		if (!IS_ENABLED(CONFIG_BOOTMENU_DISABLE_UBOOT_CONSOLE))
@@ -106,7 +106,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  			free(entry);
 --- a/common/menu.c
 +++ b/common/menu.c
-@@ -48,6 +48,33 @@ struct menu {
+@@ -49,6 +49,33 @@ struct menu {
  	int item_cnt;
  };
  
@@ -140,7 +140,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  /*
   * An iterator function for menu items. callback will be called for each item
   * in m, with m, a pointer to the item, and extra being passed to callback. If
-@@ -426,7 +453,7 @@ int menu_destroy(struct menu *m)
+@@ -437,7 +464,7 @@ int menu_destroy(struct menu *m)
  }
  
  enum bootmenu_key bootmenu_autoboot_loop(struct bootmenu_data *menu,
@@ -149,7 +149,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  {
  	enum bootmenu_key key = BKEY_NONE;
  	int i, c;
-@@ -461,6 +488,19 @@ enum bootmenu_key bootmenu_autoboot_loop
+@@ -472,6 +499,19 @@ enum bootmenu_key bootmenu_autoboot_loop
  				break;
  			default:
  				key = BKEY_NONE;
@@ -169,7 +169,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  				break;
  			}
  			break;
-@@ -481,7 +521,8 @@ enum bootmenu_key bootmenu_autoboot_loop
+@@ -492,7 +532,8 @@ enum bootmenu_key bootmenu_autoboot_loop
  	return key;
  }
  
@@ -179,7 +179,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  {
  	enum bootmenu_key key;
  
-@@ -513,6 +554,20 @@ enum bootmenu_key bootmenu_conv_key(int
+@@ -524,6 +565,20 @@ enum bootmenu_key bootmenu_conv_key(int
  	case ' ':
  		key = BKEY_SPACE;
  		break;
@@ -200,15 +200,16 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  	default:
  		key = BKEY_NONE;
  		break;
-@@ -522,11 +577,16 @@ enum bootmenu_key bootmenu_conv_key(int
+@@ -533,11 +588,17 @@ enum bootmenu_key bootmenu_conv_key(int
  }
  
  enum bootmenu_key bootmenu_loop(struct bootmenu_data *menu,
 -				struct cli_ch_state *cch)
-+				struct cli_ch_state *cch, int *choice)
++				struct cli_ch_state *cch,
++				int *choice)
  {
  	enum bootmenu_key key;
- 	int c;
+ 	int c, errchar = 0;
  
 +	if (menu->last_choiced) {
 +		menu->last_choiced = false;
@@ -218,7 +219,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  	c = cli_ch_process(cch, 0);
  	if (!c) {
  		while (!c && !tstc()) {
-@@ -540,7 +600,7 @@ enum bootmenu_key bootmenu_loop(struct b
+@@ -552,7 +613,7 @@ enum bootmenu_key bootmenu_loop(struct b
  		}
  	}
  
@@ -238,7 +239,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  struct cli_ch_state;
  struct menu;
  
-@@ -19,6 +21,8 @@ int menu_get_choice(struct menu *m, void
+@@ -20,6 +22,8 @@ int menu_get_choice(struct menu *m, void
  int menu_item_add(struct menu *m, char *item_key, void *item_data);
  int menu_destroy(struct menu *m);
  int menu_default_choice(struct menu *m, void **choice);
@@ -247,15 +248,15 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  
  /**
   * menu_show() Show a boot menu
-@@ -41,6 +45,7 @@ struct bootmenu_data {
- 	int active;			/* active menu entry */
+@@ -43,6 +47,7 @@ struct bootmenu_data {
+ 	int last_active;		/* last active menu entry */
  	int count;			/* total count of menu entries */
  	struct bootmenu_entry *first;	/* first menu entry */
 +	bool last_choiced;
  };
  
  /** enum bootmenu_key - keys that can be returned by the bootmenu */
-@@ -51,6 +56,7 @@ enum bootmenu_key {
+@@ -53,6 +58,7 @@ enum bootmenu_key {
  	BKEY_SELECT,
  	BKEY_QUIT,
  	BKEY_SAVE,
@@ -263,7 +264,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  
  	/* 'extra' keys, which are used by menus but not cedit */
  	BKEY_PLUS,
-@@ -81,7 +87,7 @@ enum bootmenu_key {
+@@ -83,7 +89,7 @@ enum bootmenu_key {
   *	anything else: KEY_NONE
   */
  enum bootmenu_key bootmenu_autoboot_loop(struct bootmenu_data *menu,
@@ -272,7 +273,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  
  /**
   * bootmenu_loop() - handle waiting for a keypress when autoboot is disabled
-@@ -107,7 +113,7 @@ enum bootmenu_key bootmenu_autoboot_loop
+@@ -109,7 +115,7 @@ enum bootmenu_key bootmenu_autoboot_loop
   *	Space: BKEY_SPACE
   */
  enum bootmenu_key bootmenu_loop(struct bootmenu_data *menu,
@@ -281,7 +282,7 @@ Signed-off-by: Weijie Gao <weijie.gao@mediatek.com>
  
  /**
   * bootmenu_conv_key() - Convert a U-Boot keypress into a menu key
-@@ -115,6 +121,7 @@ enum bootmenu_key bootmenu_loop(struct b
+@@ -117,6 +123,7 @@ enum bootmenu_key bootmenu_loop(struct b
   * @ichar: Keypress to convert (ASCII, including control characters)
   * Returns: Menu key that corresponds to @ichar, or BKEY_NONE if none
   */
diff --git a/package/boot/uboot-mediatek/patches/211-cmd-bootmenu-custom-title.patch b/package/boot/uboot-mediatek/patches/211-cmd-bootmenu-custom-title.patch
index 76ff745e93f8b4..be06832ea1ea32 100644
--- a/package/boot/uboot-mediatek/patches/211-cmd-bootmenu-custom-title.patch
+++ b/package/boot/uboot-mediatek/patches/211-cmd-bootmenu-custom-title.patch
@@ -1,6 +1,6 @@
 --- a/cmd/bootmenu.c
 +++ b/cmd/bootmenu.c
-@@ -451,7 +451,11 @@ static void menu_display_statusline(stru
+@@ -465,7 +465,11 @@ static void menu_display_statusline(stru
  	printf(ANSI_CURSOR_POSITION, 1, 1);
  	puts(ANSI_CLEAR_LINE);
  	printf(ANSI_CURSOR_POSITION, 2, 3);
@@ -13,7 +13,7 @@
  	puts(ANSI_CLEAR_LINE_TO_END);
  	printf(ANSI_CURSOR_POSITION, 3, 1);
  	puts(ANSI_CLEAR_LINE);
-@@ -536,6 +540,7 @@ static enum bootmenu_ret bootmenu_show(i
+@@ -550,6 +554,7 @@ static enum bootmenu_ret bootmenu_show(i
  		return BOOTMENU_RET_FAIL;
  	}
  
@@ -23,8 +23,8 @@
  			goto cleanup;
 --- a/include/menu.h
 +++ b/include/menu.h
-@@ -45,6 +45,7 @@ struct bootmenu_data {
- 	int active;			/* active menu entry */
+@@ -47,6 +47,7 @@ struct bootmenu_data {
+ 	int last_active;		/* last active menu entry */
  	int count;			/* total count of menu entries */
  	struct bootmenu_entry *first;	/* first menu entry */
 +	char *mtitle;			/* custom menu title */
diff --git a/package/boot/uboot-mediatek/patches/401-update-u7623-defconfig.patch b/package/boot/uboot-mediatek/patches/401-update-u7623-defconfig.patch
index 1fb0ae9c9eb0b7..7d193696720214 100644
--- a/package/boot/uboot-mediatek/patches/401-update-u7623-defconfig.patch
+++ b/package/boot/uboot-mediatek/patches/401-update-u7623-defconfig.patch
@@ -187,13 +187,12 @@
  	leds {
  		compatible = "gpio-leds";
  
-@@ -109,6 +122,19 @@
+@@ -109,6 +122,18 @@
  		};
  	};
  
 +	key_pins_a: keys-alt {
 +		mux {
-+			function = "gpio";
 +			groups = "msdc3";
 +		};
 +
diff --git a/package/boot/uboot-mediatek/patches/445-add-cudy_tr3000-v1.patch b/package/boot/uboot-mediatek/patches/445-add-cudy_tr3000-v1.patch
new file mode 100644
index 00000000000000..e7d83b90cacdf5
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/445-add-cudy_tr3000-v1.patch
@@ -0,0 +1,330 @@
+--- /dev/null
++++ b/configs/mt7981_cudy_tr3000-v1_defconfig
+@@ -0,0 +1,107 @@
++CONFIG_ARM=y
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_ARCH_MEDIATEK=y
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_DEFAULT_DEVICE_TREE="mt7981-cudy-tr3000-v1"
++CONFIG_OF_LIBFDT_OVERLAY=y
++CONFIG_TARGET_MT7981=y
++CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
++CONFIG_DEBUG_UART_BASE=0x11002000
++CONFIG_DEBUG_UART_CLOCK=40000000
++CONFIG_SYS_LOAD_ADDR=0x46000000
++CONFIG_DEBUG_UART=y
++CONFIG_FIT=y
++CONFIG_BOOTDELAY=30
++CONFIG_AUTOBOOT_KEYED=y
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_DEFAULT_FDT_FILE="mediatek/mt7981-cudy-tr3000-v1.dtb"
++CONFIG_LOGLEVEL=7
++CONFIG_PRE_CONSOLE_BUFFER=y
++CONFIG_LOG=y
++CONFIG_BOARD_LATE_INIT=y
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_PROMPT="MT7981> "
++CONFIG_CMD_CPU=y
++CONFIG_CMD_LICENSE=y
++CONFIG_CMD_BOOTMENU=y
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_ERASEENV=y
++CONFIG_CMD_ENV_FLAGS=y
++CONFIG_CMD_STRINGS=y
++CONFIG_CMD_DM=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_GPT=y
++CONFIG_CMD_MTD=y
++CONFIG_CMD_PART=y
++CONFIG_CMD_DHCP=y
++CONFIG_CMD_TFTPSRV=y
++CONFIG_CMD_RARP=y
++CONFIG_CMD_PING=y
++CONFIG_CMD_CDP=y
++CONFIG_CMD_SNTP=y
++CONFIG_CMD_DNS=y
++CONFIG_CMD_LINK_LOCAL=y
++CONFIG_CMD_PXE=y
++CONFIG_CMD_CACHE=y
++CONFIG_CMD_PSTORE=y
++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
++CONFIG_CMD_UUID=y
++CONFIG_CMD_HASH=y
++CONFIG_CMD_SMC=y
++CONFIG_CMD_UBI=y
++CONFIG_CMD_UBI_RENAME=y
++CONFIG_OF_EMBED=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_UBI=y
++CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
++CONFIG_ENV_UBI_PART="ubi"
++CONFIG_ENV_UBI_VOLUME="ubootenv"
++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_DEFAULT_ENV_FILE="cudy_tr3000-v1_env"
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_VERSION_VARIABLE=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_NETCONSOLE=y
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_BUTTON=y
++CONFIG_BUTTON_GPIO=y
++CONFIG_CLK=y
++CONFIG_GPIO_HOG=y
++CONFIG_LED=y
++CONFIG_LED_BLINK=y
++CONFIG_LED_GPIO=y
++# CONFIG_MMC is not set
++CONFIG_MTD=y
++CONFIG_DM_MTD=y
++CONFIG_MTD_SPI_NAND=y
++CONFIG_MTD_UBI_FASTMAP=y
++CONFIG_PHY_FIXED=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PHY=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7981=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_REGULATOR_GPIO=y
++CONFIG_RAM=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_SPI=y
++CONFIG_DM_SPI=y
++CONFIG_MTK_SPIM=y
++CONFIG_ZSTD=y
++CONFIG_HEXDUMP=y
++CONFIG_LMB_MAX_REGIONS=64
+--- /dev/null
++++ b/arch/arm/dts/mt7981-cudy-tr3000-v1.dts
+@@ -0,0 +1,160 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++
++/dts-v1/;
++#include "mt7981.dtsi"
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/linux-event-codes.h>
++
++/ {
++	#address-cells = <1>;
++	#size-cells = <1>;
++	model = "Cudy TR3000 v1";
++	compatible = "mediatek,mt7981", "mediatek,mt7981-rfb";
++
++	chosen {
++		stdout-path = &uart0;
++		tick-timer = &timer0;
++	};
++
++	memory@40000000 {
++		device_type = "memory";
++		reg = <0x40000000 0x20000000>;
++	};
++
++	gpio-keys {
++		compatible = "gpio-keys";
++
++		button-reset {
++			label = "reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
++		};
++
++		button-mode {
++			label = "mode";
++			linux,code = <EV_SW>;
++			linux,input-type = <BTN_0>;
++			gpios = <&gpio 0 GPIO_ACTIVE_HIGH>;
++			debounce-interval = <60>;
++		};
++	};
++
++	gpio-leds {
++		compatible = "gpio-leds";
++
++		led_status: led-0 {
++			label = "red:power";
++			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
++			default-state = "on";
++		};
++
++		led-1 {
++			label = "white:status";
++			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
++			default-state = "off";
++		};
++	};
++};
++
++&eth {
++	status = "okay";
++	mediatek,gmac-id = <1>;
++	phy-mode = "gmii";
++	phy-handle = <&phy0>;
++
++	mdio {
++		phy0: ethernet-phy@0 {
++			compatible = "ethernet-phy-id03a2.9461";
++			reg = <0x0>;
++			phy-mode = "gmii";
++		};
++	};
++};
++
++&pinctrl {
++	spi_flash_pins: spi0-pins-func-1 {
++		mux {
++			function = "flash";
++			groups = "spi0", "spi0_wp_hold";
++		};
++
++		conf-pu {
++			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-up = <MTK_PUPD_SET_R1R0_00>;
++		};
++
++		conf-pd {
++			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-down = <MTK_PUPD_SET_R1R0_00>;
++		};
++	};
++};
++
++&spi0 {
++	#address-cells = <1>;
++	#size-cells = <0>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi_flash_pins>;
++	status = "okay";
++	must_tx;
++	enhance_timing;
++	dma_ext;
++	ipm_design;
++	support_quad;
++	tick_dly = <2>;
++	sample_sel = <0>;
++
++	spi_nand@0 {
++		compatible = "spi-nand";
++		reg = <0>;
++		spi-max-frequency = <52000000>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				label = "bl2";
++				reg = <0x0 0x100000>;
++			};
++
++			partition@100000 {
++				label = "u-boot-env";
++				reg = <0x100000 0x80000>;
++			};
++
++			partition@180000 {
++				label = "factory";
++				reg = <0x180000 0x200000>;
++			};
++
++			partition@380000 {
++				label = "bdinfo";
++				reg = <0x380000 0x40000>;
++			};
++
++			partition@3c0000 {
++				label = "fip";
++				reg = <0x3c0000 0x200000>;
++			};
++
++			partition@5c0000 {
++				label = "ubi";
++				reg = <0x5c0000 0x7a40000>;
++				compatible = "linux,ubi";
++			};
++		};
++	};
++};
++
++&uart0 {
++	mediatek,force-highspeed;
++	status = "okay";
++};
++
++&watchdog {
++	status = "disabled";
++};
+--- /dev/null
++++ b/cudy_tr3000-v1_env
+@@ -0,0 +1,54 @@
++ipaddr=192.168.1.1
++serverip=192.168.1.254
++loadaddr=0x46000000
++console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
++bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
++bootconf=config-1
++bootdelay=0
++bootfile=openwrt-mediatek-filogic-cudy_tr3000-v1-ubootmod-initramfs-recovery.itb
++bootfile_bl2=openwrt-mediatek-filogic-cudy_tr3000-v1-ubootmod-preloader.bin
++bootfile_fip=openwrt-mediatek-filogic-cudy_tr3000-v1-ubootmod-bl31-uboot.fip
++bootfile_upg=openwrt-mediatek-filogic-cudy_tr3000-v1-ubootmod-squashfs-sysupgrade.itb
++bootled_pwr=red:power
++bootled_rec=white:status
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
++bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
++bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
++bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to NAND.=run boot_tftp_write_fip ; run bootmenu_confirm_return
++bootmenu_7=Load BL2 preloader via TFTP then write to NAND.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
++bootmenu_8=Reboot.=reset
++bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
++boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
++boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
++boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
++boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
++boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
++boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
++boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
++boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
++reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
++mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
++mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
++ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
++ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
++ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
++ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
++ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
++ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
++ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
++ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
++_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
++_firstboot=setenv _firstboot ; run _switch_to_menu ; run _init_env ; run boot_first
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
diff --git a/package/boot/uboot-mediatek/patches/445-add-netis-nx31.patch b/package/boot/uboot-mediatek/patches/445-add-netis-nx31.patch
new file mode 100644
index 00000000000000..55a94189d30687
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/445-add-netis-nx31.patch
@@ -0,0 +1,334 @@
+--- /dev/null
++++ b/configs/mt7981_netis_nx31_defconfig
+@@ -0,0 +1,106 @@
++CONFIG_ARM=y
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_ARCH_MEDIATEK=y
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_DEFAULT_DEVICE_TREE="mt7981-netis_nx31"
++CONFIG_OF_LIBFDT_OVERLAY=y
++CONFIG_TARGET_MT7981=y
++CONFIG_SYS_LOAD_ADDR=0x46000000
++CONFIG_PRE_CON_BUF_ADDR=0x4007ef00
++CONFIG_DEBUG_UART_BASE=0x11002000
++CONFIG_DEBUG_UART_CLOCK=40000000
++CONFIG_DEBUG_UART=y
++CONFIG_FIT=y
++CONFIG_BOOTDELAY=30
++CONFIG_AUTOBOOT_KEYED=y
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_DEFAULT_FDT_FILE="mediatek/mt7981-netis_nx31.dtb"
++CONFIG_LOGLEVEL=7
++CONFIG_PRE_CONSOLE_BUFFER=y
++CONFIG_LOG=y
++CONFIG_BOARD_LATE_INIT=y
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_PROMPT="MT7981> "
++CONFIG_CMD_CPU=y
++CONFIG_CMD_LICENSE=y
++CONFIG_CMD_BOOTMENU=y
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_ERASEENV=y
++CONFIG_CMD_ENV_FLAGS=y
++CONFIG_CMD_STRINGS=y
++CONFIG_CMD_DM=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_GPT=y
++CONFIG_CMD_MTD=y
++CONFIG_CMD_PART=y
++CONFIG_CMD_TFTPSRV=y
++CONFIG_CMD_RARP=y
++CONFIG_CMD_CDP=y
++CONFIG_CMD_SNTP=y
++CONFIG_CMD_LINK_LOCAL=y
++CONFIG_CMD_DHCP=y
++CONFIG_CMD_DNS=y
++CONFIG_CMD_PING=y
++CONFIG_CMD_PXE=y
++CONFIG_CMD_CACHE=y
++CONFIG_CMD_PSTORE=y
++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
++CONFIG_CMD_UUID=y
++CONFIG_CMD_HASH=y
++CONFIG_CMD_SMC=y
++CONFIG_CMD_UBI=y
++CONFIG_CMD_UBI_RENAME=y
++CONFIG_OF_EMBED=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_UBI=y
++CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
++CONFIG_ENV_UBI_PART="ubi"
++CONFIG_ENV_UBI_VOLUME="ubootenv"
++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_DEFAULT_ENV_FILE="defenvs/netis_nx31_env"
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_VERSION_VARIABLE=y
++CONFIG_NETCONSOLE=y
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_BUTTON=y
++CONFIG_BUTTON_GPIO=y
++CONFIG_CLK=y
++CONFIG_GPIO_HOG=y
++CONFIG_LED=y
++CONFIG_LED_BLINK=y
++CONFIG_LED_GPIO=y
++# CONFIG_MMC is not set
++CONFIG_MTD=y
++CONFIG_DM_MTD=y
++CONFIG_MTD_SPI_NAND=y
++CONFIG_MTD_UBI_FASTMAP=y
++CONFIG_PHY_FIXED=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PHY=y
++CONFIG_PHY_MTK_TPHY=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7981=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_REGULATOR_GPIO=y
++CONFIG_RAM=y
++CONFIG_DM_SERIAL=y
++CONFIG_SERIAL_RX_BUFFER=y
++CONFIG_MTK_SERIAL=y
++CONFIG_SPI=y
++CONFIG_DM_SPI=y
++CONFIG_MTK_SPIM=y
++CONFIG_ZSTD=y
++CONFIG_HEXDUMP=y
+--- /dev/null
++++ b/arch/arm/dts/mt7981-netis_nx31.dts
+@@ -0,0 +1,162 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2025
++ * Author: Mikhail Zhilkin <csharper2005@gmail.com>
++ */
++
++/dts-v1/;
++#include "mt7981.dtsi"
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/linux-event-codes.h>
++
++/ {
++	#address-cells = <1>;
++	#size-cells = <1>;
++	model = "netis NX31";
++	compatible = "netis,nx31", "mediatek,mt7981";
++
++	chosen {
++		stdout-path = &uart0;
++		tick-timer = &timer0;
++	};
++
++	memory@40000000 {
++		device_type = "memory";
++		reg = <0x40000000 0x10000000>;
++	};
++
++	keys {
++		compatible = "gpio-keys";
++
++		button-0 {
++			label = "mesh";
++			linux,code = <BTN_0>;
++			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
++		};
++
++		button-1 {
++			label = "reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		led-0 {
++			label = "blue:wlan2g";
++			gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
++		};
++
++		led-1 {
++			label = "blue:status";
++			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
++		};
++
++		led-2 {
++			label = "blue:wan";
++			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
++		};
++
++		led-3 {
++			label = "blue:wlan5g";
++			gpios = <&gpio 34 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
++
++&uart0 {
++	mediatek,force-highspeed;
++	status = "okay";
++};
++
++&eth {
++	status = "okay";
++	mediatek,gmac-id = <0>;
++	phy-mode = "2500base-x";
++	mediatek,switch = "mt7531";
++	reset-gpios = <&gpio 39 GPIO_ACTIVE_HIGH>;
++
++	fixed-link {
++		speed = <2500>;
++		full-duplex;
++	};
++};
++
++&pinctrl {
++	spi_flash_pins: spi0-pins-func-1 {
++		mux {
++			function = "flash";
++			groups = "spi0", "spi0_wp_hold";
++		};
++
++		conf-pu {
++			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
++		};
++
++		conf-pd {
++			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
++		};
++	};
++};
++
++&spi0 {
++	#address-cells = <1>;
++	#size-cells = <0>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi_flash_pins>;
++	status = "okay";
++	must_tx;
++	enhance_timing;
++	dma_ext;
++	ipm_design;
++	support_quad;
++	tick_dly = <2>;
++	sample_sel = <0>;
++
++	spi_nand@0 {
++		compatible = "spi-nand";
++		reg = <0>;
++		spi-max-frequency = <52000000>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				label = "BL2";
++				reg = <0x0 0x100000>;
++			};
++
++			partition@100000 {
++				label = "u-boot-env (unused)";
++				reg = <0x100000 0x80000>;
++			};
++
++			partition@160000 {
++				label = "Factory";
++				reg = <0x180000 0x200000>;
++			};
++
++			partition@380000 {
++				label = "FIP";
++				reg = <0x380000 0x200000>;
++			};
++
++			partition@580000 {
++				label = "ubi";
++				reg = <0x580000 0x7a80000>;
++			};
++		};
++	};
++};
++
++&watchdog {
++	status = "disabled";
++};
+--- /dev/null
++++ b/defenvs/netis_nx31_env
+@@ -0,0 +1,57 @@
++ipaddr=192.168.1.1
++serverip=192.168.1.254
++loadaddr=0x46000000
++console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
++bootcmd=run check_buttons ; if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
++bootconf=config-1
++bootdelay=0
++bootfile=openwrt-mediatek-filogic-netis_nx31-initramfs-recovery.itb
++bootfile_bl2=openwrt-mediatek-filogic-netis_nx31-preloader.bin
++bootfile_fip=openwrt-mediatek-filogic-netis_nx31-bl31-uboot.fip
++bootfile_upg=openwrt-mediatek-filogic-netis_nx31-squashfs-sysupgrade.itb
++bootled_status=blue:status
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
++bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
++bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
++bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to NAND.=run boot_tftp_write_fip ; run bootmenu_confirm_return
++bootmenu_7=Load BL2 preloader via TFTP then write to NAND.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
++bootmenu_8=Reboot.=reset
++bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
++boot_first=if button reset ; then led $bootled_status on ; run boot_default ; fi ; bootmenu
++boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
++boot_production=led $bootled_status on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led bootled_status off
++boot_recovery=led $bootled_status on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led bootled_status off
++boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
++boot_tftp_forever=led $bootled_status on ; while true ; do run boot_tftp ; sleep 1 ; done
++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
++boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
++boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
++check_buttons=if button reset ; then run boot_tftp ; fi
++ethaddr_factory=mtd read Factory 0x40080000 0x1e0000 0x20000 && env readmem -b ethaddr 0x4009ef20 0x6 ; setenv ethaddr_factory
++part_default=production
++part_recovery=recovery
++reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
++mtd_write_fip=mtd erase FIP && mtd write FIP $loadaddr
++mtd_write_bl2=mtd erase BL2 && mtd write BL2 $loadaddr
++ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
++ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
++ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
++ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
++ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
++ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
++ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
++ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
++_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
++_firstboot=setenv _firstboot ; run ethaddr_factory ; run _switch_to_menu ; run _init_env ; run boot_first
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
diff --git a/package/boot/uboot-mediatek/patches/446-add-cmcc_a10.patch b/package/boot/uboot-mediatek/patches/446-add-cmcc_a10.patch
new file mode 100644
index 00000000000000..b6165a797b055d
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/446-add-cmcc_a10.patch
@@ -0,0 +1,327 @@
+--- /dev/null
++++ b/configs/mt7981_cmcc_a10_defconfig
+@@ -0,0 +1,107 @@
++CONFIG_ARM=y
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_ARCH_MEDIATEK=y
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_DEFAULT_DEVICE_TREE="mt7981-cmcc-a10"
++CONFIG_OF_LIBFDT_OVERLAY=y
++CONFIG_TARGET_MT7981=y
++CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
++CONFIG_DEBUG_UART_BASE=0x11002000
++CONFIG_DEBUG_UART_CLOCK=40000000
++CONFIG_SYS_LOAD_ADDR=0x46000000
++CONFIG_DEBUG_UART=y
++CONFIG_FIT=y
++CONFIG_BOOTDELAY=30
++CONFIG_AUTOBOOT_KEYED=y
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_DEFAULT_FDT_FILE="mediatek/mt7981-cmcc-a10.dtb"
++CONFIG_LOGLEVEL=7
++CONFIG_PRE_CONSOLE_BUFFER=y
++CONFIG_LOG=y
++CONFIG_BOARD_LATE_INIT=y
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_PROMPT="MT7981> "
++CONFIG_CMD_CPU=y
++CONFIG_CMD_LICENSE=y
++CONFIG_CMD_BOOTMENU=y
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_ERASEENV=y
++CONFIG_CMD_ENV_FLAGS=y
++CONFIG_CMD_STRINGS=y
++CONFIG_CMD_DM=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_GPT=y
++CONFIG_CMD_MTD=y
++CONFIG_CMD_PART=y
++CONFIG_CMD_DHCP=y
++CONFIG_CMD_TFTPSRV=y
++CONFIG_CMD_RARP=y
++CONFIG_CMD_PING=y
++CONFIG_CMD_CDP=y
++CONFIG_CMD_SNTP=y
++CONFIG_CMD_DNS=y
++CONFIG_CMD_LINK_LOCAL=y
++CONFIG_CMD_PXE=y
++CONFIG_CMD_CACHE=y
++CONFIG_CMD_PSTORE=y
++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
++CONFIG_CMD_UUID=y
++CONFIG_CMD_HASH=y
++CONFIG_CMD_SMC=y
++CONFIG_CMD_UBI=y
++CONFIG_CMD_UBI_RENAME=y
++CONFIG_OF_EMBED=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_UBI=y
++CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
++CONFIG_ENV_UBI_PART="ubi"
++CONFIG_ENV_UBI_VOLUME="ubootenv"
++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_DEFAULT_ENV_FILE="cmcc_a10_env"
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_VERSION_VARIABLE=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_NETCONSOLE=y
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_BUTTON=y
++CONFIG_BUTTON_GPIO=y
++CONFIG_CLK=y
++CONFIG_GPIO_HOG=y
++CONFIG_LED=y
++CONFIG_LED_BLINK=y
++CONFIG_LED_GPIO=y
++# CONFIG_MMC is not set
++CONFIG_MTD=y
++CONFIG_DM_MTD=y
++CONFIG_MTD_SPI_NAND=y
++CONFIG_MTD_UBI_FASTMAP=y
++CONFIG_PHY_FIXED=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PHY=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7981=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_REGULATOR_GPIO=y
++CONFIG_RAM=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_SPI=y
++CONFIG_DM_SPI=y
++CONFIG_MTK_SPIM=y
++CONFIG_ZSTD=y
++CONFIG_HEXDUMP=y
++CONFIG_LMB_MAX_REGIONS=64
+--- /dev/null
++++ b/arch/arm/dts/mt7981-cmcc-a10.dts
+@@ -0,0 +1,157 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++
++/dts-v1/;
++#include "mt7981.dtsi"
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/linux-event-codes.h>
++
++/ {
++	#address-cells = <1>;
++	#size-cells = <1>;
++	model = "CMCC A10";
++	compatible = "mediatek,mt7981", "mediatek,mt7981-rfb";
++
++	chosen {
++		stdout-path = &uart0;
++		tick-timer = &timer0;
++	};
++
++	memory@40000000 {
++		device_type = "memory";
++		reg = <0x40000000 0x10000000>;
++	};
++
++	gpio-keys {
++		compatible = "gpio-keys";
++
++		button-reset {
++			label = "reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
++		};
++
++		button-wps {
++			label = "wps";
++			linux,code = <KEY_WPS_BUTTON>;
++			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	gpio-leds {
++		compatible = "gpio-leds";
++
++		led-0 {
++			label = "blue:status";
++			gpios = <&gpio 9 GPIO_ACTIVE_LOW>;
++			default-state = "off";
++		};
++
++		running_led: led-1 {
++			label = "green:status";
++			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
++			default-state = "off";
++		};
++
++		boot_led: led-2 {
++			label = "red:status";
++			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
++			default-state = "on";
++		};
++	};
++};
++
++&eth {
++	status = "okay";
++	mediatek,gmac-id = <0>;
++	phy-mode = "2500base-x";
++	mediatek,switch = "mt7531";
++	reset-gpios = <&gpio 39 GPIO_ACTIVE_HIGH>;
++
++	fixed-link {
++		speed = <2500>;
++		full-duplex;
++	};
++};
++
++&pinctrl {
++	spi_flash_pins: spi0-pins-func-1 {
++		mux {
++			function = "flash";
++			groups = "spi0", "spi0_wp_hold";
++		};
++
++		conf-pu {
++			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-up = <MTK_PUPD_SET_R1R0_00>;
++		};
++
++		conf-pd {
++			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-down = <MTK_PUPD_SET_R1R0_00>;
++		};
++	};
++};
++
++&spi0 {
++	#address-cells = <1>;
++	#size-cells = <0>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi_flash_pins>;
++	status = "okay";
++	must_tx;
++	enhance_timing;
++	dma_ext;
++	ipm_design;
++	support_quad;
++	tick_dly = <2>;
++	sample_sel = <0>;
++
++	spi_nand@0 {
++		compatible = "spi-nand";
++		reg = <0>;
++		spi-max-frequency = <52000000>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				label = "bl2";
++				reg = <0x0 0x100000>;
++			};
++
++			partition@100000 {
++				label = "u-boot-env";
++				reg = <0x100000 0x80000>;
++			};
++
++			partition@180000 {
++				label = "factory";
++				reg = <0x180000 0x200000>;
++			};
++
++			partition@380000 {
++				label = "fip";
++				reg = <0x380000 0x200000>;
++			};
++
++			partition@580000 {
++				label = "ubi";
++				reg = <0x580000 0x7a80000>;
++				compatible = "linux,ubi";
++			};
++		};
++	};
++};
++
++&uart0 {
++	mediatek,force-highspeed;
++	status = "okay";
++};
++
++&watchdog {
++	status = "disabled";
++};
+--- /dev/null
++++ b/cmcc_a10_env
+@@ -0,0 +1,54 @@
++ipaddr=192.168.1.1
++serverip=192.168.1.254
++loadaddr=0x46000000
++console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
++bootcmd=if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
++bootconf=config-1
++bootdelay=0
++bootfile=openwrt-mediatek-filogic-cmcc_a10-ubootmod-initramfs-recovery.itb
++bootfile_bl2=openwrt-mediatek-filogic-cmcc_a10-ubootmod-preloader.bin
++bootfile_fip=openwrt-mediatek-filogic-cmcc_a10-ubootmod-bl31-uboot.fip
++bootfile_upg=openwrt-mediatek-filogic-cmcc_a10-ubootmod-squashfs-sysupgrade.itb
++bootled_pwr=red:status
++bootled_rec=blue:status
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
++bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
++bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
++bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to NAND.=run boot_tftp_write_fip ; run bootmenu_confirm_return
++bootmenu_7=Load BL2 preloader via TFTP then write to NAND.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
++bootmenu_8=Reboot.=reset
++bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
++boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
++boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
++boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
++boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
++boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
++boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
++boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
++boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
++reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
++mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
++mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
++ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
++ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
++ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
++ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
++ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
++ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
++ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
++ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
++_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
++_firstboot=setenv _firstboot ; run _switch_to_menu ; run _init_env ; run boot_first
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
diff --git a/package/boot/uboot-mediatek/patches/453-add-openwrt-one.patch b/package/boot/uboot-mediatek/patches/453-add-openwrt-one.patch
index cf5f79f5841996..1968f66953d8fe 100644
--- a/package/boot/uboot-mediatek/patches/453-add-openwrt-one.patch
+++ b/package/boot/uboot-mediatek/patches/453-add-openwrt-one.patch
@@ -519,7 +519,7 @@
 +_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
 --- /dev/null
 +++ b/openwrt-one-spi-nand_env
-@@ -0,0 +1,60 @@
+@@ -0,0 +1,61 @@
 +ethaddr_factory=mtd read factory 0x46000000 0x0 0x20000 && env readmem -b ethaddr 0x4600002a 0x6 ; setenv ethaddr_factory
 +ipaddr=192.168.11.11
 +serverip=192.168.11.23
@@ -561,6 +561,7 @@
 +check_buttons=if button front ; then run boot_recovery ; run boot_tftp ; run led_loop_error ; else if button back ; then ; run usb_recover ; run led_loop_error ; fi ; fi
 +led_boot=led green on ; led white on ; led red on
 +led_done=led green on ; led white off ; led red off
++led_loop_done=led white off ; led green on ; echo done ; while true ; do  sleep 1 ; done
 +led_loop_error=led white off ; led green off ; while true ; do led red on ; sleep 1 ; led red off ; sleep 1 ; done
 +led_start=led white on ; led green off ; led red off
 +preboot=run led_boot
diff --git a/package/boot/uboot-mediatek/patches/456-add-arcadyan-mozart.patch b/package/boot/uboot-mediatek/patches/456-add-arcadyan-mozart.patch
new file mode 100644
index 00000000000000..5c9c6e697719c4
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/456-add-arcadyan-mozart.patch
@@ -0,0 +1,308 @@
+--- /dev/null
++++ b/configs/mt7988a_arcadyan_mozart_defconfig
+@@ -0,0 +1,119 @@
++CONFIG_ARM=y
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_ARCH_MEDIATEK=y
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_ENV_SIZE=0x40000
++CONFIG_ENV_OFFSET=0x400000
++CONFIG_DEFAULT_DEVICE_TREE="mt7988a-arcadyan-mozart"
++CONFIG_OF_LIBFDT_OVERLAY=y
++CONFIG_TARGET_MT7988=y
++CONFIG_PRE_CON_BUF_ADDR=0x4007EF00
++CONFIG_DEBUG_UART_BASE=0x11000000
++CONFIG_DEBUG_UART_CLOCK=40000000
++CONFIG_ENV_OFFSET_REDUND=0x440000
++CONFIG_SYS_LOAD_ADDR=0x50000000
++CONFIG_PCI=y
++CONFIG_DEBUG_UART=y
++CONFIG_AHCI=y
++CONFIG_FIT=y
++CONFIG_BOOTDELAY=30
++CONFIG_AUTOBOOT_KEYED=y
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_OF_SYSTEM_SETUP=y
++CONFIG_DEFAULT_FDT_FILE="mediatek/mt7988a-arcadyan-mozart.dtb"
++CONFIG_SYS_CBSIZE=512
++CONFIG_SYS_PBSIZE=1049
++CONFIG_LOGLEVEL=7
++CONFIG_PRE_CONSOLE_BUFFER=y
++CONFIG_LOG=y
++CONFIG_BOARD_LATE_INIT=y
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_PROMPT="MT7988> "
++CONFIG_CMD_CPU=y
++CONFIG_CMD_LICENSE=y
++# CONFIG_CMD_BOOTEFI_BOOTMGR is not set
++CONFIG_CMD_BOOTMENU=y
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_ERASEENV=y
++CONFIG_CMD_ENV_FLAGS=y
++CONFIG_CMD_STRINGS=y
++CONFIG_CMD_DM=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_PWM=y
++CONFIG_CMD_GPT=y
++CONFIG_CMD_MMC=y
++CONFIG_CMD_MTD=y
++CONFIG_CMD_PART=y
++CONFIG_CMD_PCI=y
++CONFIG_CMD_SF_TEST=y
++CONFIG_CMD_USB=y
++CONFIG_CMD_DHCP=y
++CONFIG_CMD_TFTPSRV=y
++CONFIG_CMD_RARP=y
++CONFIG_CMD_PING=y
++CONFIG_CMD_CDP=y
++CONFIG_CMD_SNTP=y
++CONFIG_CMD_DNS=y
++CONFIG_CMD_LINK_LOCAL=y
++CONFIG_CMD_PXE=y
++CONFIG_CMD_CACHE=y
++CONFIG_CMD_PSTORE=y
++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
++CONFIG_CMD_UUID=y
++CONFIG_CMD_HASH=y
++CONFIG_CMD_SMC=y
++CONFIG_CMD_EXT4=y
++CONFIG_CMD_FAT=y
++CONFIG_CMD_FS_GENERIC=y
++CONFIG_CMD_FS_UUID=y
++CONFIG_OF_EMBED=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_MMC=y
++CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_DEFAULT_ENV_FILE="arcadyan_mozart_env"
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_VERSION_VARIABLE=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_NETCONSOLE=y
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_BUTTON=y
++CONFIG_BUTTON_GPIO=y
++CONFIG_CLK=y
++CONFIG_GPIO_HOG=y
++CONFIG_LED=y
++CONFIG_LED_BLINK=y
++CONFIG_LED_GPIO=y
++CONFIG_SUPPORT_EMMC_BOOT=y
++CONFIG_MMC_HS200_SUPPORT=y
++CONFIG_MMC_MTK=y
++CONFIG_PHY_FIXED=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PHY=y
++CONFIG_PHY_MTK_TPHY=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7988=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_REGULATOR_GPIO=y
++CONFIG_DM_PWM=y
++CONFIG_PWM_MTK=y
++CONFIG_RAM=y
++CONFIG_SCSI=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_ZSTD=y
++CONFIG_HEXDUMP=y
++CONFIG_LMB_MAX_REGIONS=64
+--- /dev/null
++++ b/arcadyan_mozart_env
+@@ -0,0 +1,55 @@
++ipaddr=192.168.1.1
++serverip=192.168.1.254
++loadaddr=0x50000000
++bootargs=console=ttyS0,115200n1 pci=pcie_bus_perf root=/dev/fit0 rootwait
++bootcmd=if pstore check ; then run boot_recovery ; else run boot_emmc ; fi
++bootconf=config-1
++bootconf_extra=
++bootdelay=0
++bootfile=openwrt-mediatek-filogic-arcadyan_mozart-initramfs.itb
++bootfile_bl2=openwrt-mediatek-filogic-arcadyan_mozart-emmc-preloader.bin
++bootfile_fip=openwrt-mediatek-filogic-arcadyan_mozart-emmc-bl31-uboot.fip
++bootfile_upg=openwrt-mediatek-filogic-arcadyan_mozart-squashfs-sysupgrade.itb
++bootled_pwr=blue:status
++bootled_rec=red:status
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )  [eMMC]
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
++bootmenu_2=Boot production system from eMMC.=run boot_production ; run bootmenu_confirm_return
++bootmenu_3=Boot recovery system from eMMC.=run boot_recovery ; run bootmenu_confirm_return
++bootmenu_4=Load production system via TFTP then write to eMMC.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_5=Load recovery system via TFTP then write to eMMC.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to eMMC.=run boot_tftp_write_fip ; run bootmenu_confirm_return
++bootmenu_7=Load BL2 preloader via TFTP then write to eMMC.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
++bootmenu_8=Reboot.=reset
++bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
++boot_first=if button reset ; then led $bootled_rec on ; run boot_tftp_recovery ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
++boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
++boot_production=led $bootled_pwr on ; run emmc_read_production && bootm $loadaddr#$bootconf#$bootconf_extra ; led $bootled_pwr off
++boot_recovery=led $bootled_rec on ; run emmc_read_recovery && bootm $loadaddr#$bootconf#$bootconf_extra ; led $bootled_rec off
++boot_emmc=run boot_production ; run boot_recovery
++boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp_recovery ; sleep 1 ; done
++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run emmc_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf#$bootconf_extra ; fi
++boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run emmc_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run emmc_write_fip
++boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run emmc_write_bl2
++boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
++mmc_write_vol=imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc erase 0x$part_addr 0x$image_size && mmc write $loadaddr 0x$part_addr 0x$image_size
++mmc_read_vol=mmc read $loadaddr $part_addr 0x100 && imszb $loadaddr image_size && test 0x$image_size -le 0x$part_size && mmc read $loadaddr 0x$part_addr 0x$image_size && setexpr filesize $image_size * 0x200
++part_default=production
++part_recovery=recovery
++reset_factory=eraseenv && reset
++emmc_read_production=part start mmc 0 $part_default part_addr && part size mmc 0 $part_default part_size && run mmc_read_vol
++emmc_read_recovery=part start mmc 0 $part_recovery part_addr && part size mmc 0 $part_recovery part_size && run mmc_read_vol
++emmc_write_bl2=mmc partconf 0 1 1 1 && mmc erase 0x0 0x400 && mmc write $fileaddr 0x0 0x400 ; mmc partconf 0 1 1 0
++emmc_write_fip=mmc erase 0x3400 0x2000 && mmc write $fileaddr 0x3400 0x2000 && mmc erase 0x2000 0x800
++emmc_write_production=part start mmc 0 $part_default part_addr && part size mmc 0 $part_default part_size && run mmc_write_vol
++emmc_write_recovery=part start mmc 0 $part_recovery part_addr && part size mmc 0 $part_recovery part_size && run mmc_write_vol
++_init_env=setenv _init_env ; setenv _create_env ; saveenv ; saveenv
++_firstboot=setenv _firstboot ; run _switch_to_menu ; run _init_env ; run boot_first
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
+--- /dev/null
++++ b/arch/arm/dts/mt7988a-arcadyan-mozart.dts
+@@ -0,0 +1,125 @@
++// SPDX-License-Identifier: GPL-2.0
++
++/dts-v1/;
++#include "mt7988.dtsi"
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/linux-event-codes.h>
++
++/ {
++	model = "MediaTek / Arcadyan - Mozart";
++	compatible = "arcadyan,mozart", "mediatek,mt7988";
++
++	chosen {
++		stdout-path = &uart0;
++	};
++
++	memory@40000000 {
++		device_type = "memory";
++		reg = <0 0x40000000 0 0x40000000>;
++	};
++
++	reg_3p3v: regulator-3p3v {
++		compatible = "regulator-fixed";
++		regulator-name = "fixed-3.3V";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++		regulator-boot-on;
++		regulator-always-on;
++	};
++
++	reg_1p8v: regulator-1p8v {
++		compatible = "regulator-fixed";
++		regulator-name = "fixed-1.8V";
++		regulator-min-microvolt = <1800000>;
++		regulator-max-microvolt = <1800000>;
++		regulator-boot-on;
++		regulator-always-on;
++	};
++
++	keys {
++		compatible = "gpio-keys";
++
++		wps {
++			label = "reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&gpio 143 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		led-red {
++			label = "red:status";
++			gpios = <&gpio 29 GPIO_ACTIVE_HIGH>;
++		};
++
++		led-green {
++			label = "blue:status";
++			gpios = <&gpio 30 GPIO_ACTIVE_HIGH>;
++		};
++		
++		led-blue {
++			label = "blue:status";
++			gpios = <&gpio 31 GPIO_ACTIVE_HIGH>;
++		};
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&eth {
++	status = "okay";
++	mediatek,gmac-id = <0>;
++	phy-mode = "usxgmii";
++	mediatek,switch = "mt7988";
++
++	fixed-link {
++		speed = <1000>;
++		full-duplex;
++		pause;
++	};
++};
++
++&pinctrl {
++	mmc0_pins_default: mmc0default {
++		mux {
++			function = "flash";
++			groups =  "emmc_51";
++		};
++
++		conf-cmd-dat {
++			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
++			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
++			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
++			input-enable;
++		};
++
++		conf-clk {
++			pins = "EMMC_CK";
++		};
++
++		conf-dsl {
++			pins = "EMMC_DSL";
++		};
++
++		conf-rst {
++			pins = "EMMC_RSTB";
++		};
++	};
++};
++
++&mmc0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&mmc0_pins_default>;
++	max-frequency = <52000000>;
++	bus-width = <8>;
++	cap-mmc-highspeed;
++	cap-mmc-hw-reset;
++	vmmc-supply = <&reg_3p3v>;
++	vqmmc-supply = <&reg_1p8v>;
++	non-removable;
++	status = "okay";
++};
diff --git a/package/boot/uboot-mediatek/patches/457-initialized-the-watchdog-subsystem-later.patch b/package/boot/uboot-mediatek/patches/457-initialized-the-watchdog-subsystem-later.patch
new file mode 100644
index 00000000000000..7919b365601a7a
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/457-initialized-the-watchdog-subsystem-later.patch
@@ -0,0 +1,54 @@
+From 9c1ad8a18ac1a20aee7a617964bcae3e90dac700 Mon Sep 17 00:00:00 2001
+From: Enrico Mioso <mrkiko.rs@gmail.com>
+Date: Wed, 23 Oct 2024 17:46:35 +0200
+Subject: [PATCH] uboot-mediatek: initialized the watchdog subsystem later
+
+Initialize the watchdog subsystem later during initialization, to allow for
+the gpio-wdt driver to work.
+
+Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com>
+---
+ common/board_r.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/common/board_r.c
++++ b/common/board_r.c
+@@ -663,19 +663,13 @@ static init_fnc_t init_sequence_r[] = {
+ 	serial_initialize,
+ 	initr_announce,
+ 	dm_announce,
+-#if CONFIG_IS_ENABLED(WDT)
+-	initr_watchdog,
+-#endif
+-	INIT_FUNC_WATCHDOG_RESET
+ 	arch_initr_trap,
+ #if defined(CONFIG_BOARD_EARLY_INIT_R)
+ 	board_early_init_r,
+ #endif
+-	INIT_FUNC_WATCHDOG_RESET
+ #ifdef CONFIG_POST
+ 	post_output_backlog,
+ #endif
+-	INIT_FUNC_WATCHDOG_RESET
+ #if defined(CONFIG_PCI_INIT_R) && defined(CONFIG_SYS_EARLY_PCI_INIT)
+ 	/*
+ 	 * Do early PCI configuration _before_ the flash gets initialised,
+@@ -690,7 +684,6 @@ static init_fnc_t init_sequence_r[] = {
+ #ifdef CONFIG_MTD_NOR_FLASH
+ 	initr_flash,
+ #endif
+-	INIT_FUNC_WATCHDOG_RESET
+ #if defined(CONFIG_PPC) || defined(CONFIG_M68K) || defined(CONFIG_X86)
+ 	/* initialize higher level parts of CPU like time base and timers */
+ 	cpu_init_r,
+@@ -719,6 +712,10 @@ static init_fnc_t init_sequence_r[] = {
+ #ifdef CONFIG_PVBLOCK
+ 	initr_pvblock,
+ #endif
++#if CONFIG_IS_ENABLED(WDT)
++	initr_watchdog,
++#endif
++	INIT_FUNC_WATCHDOG_RESET
+ 	initr_env,
+ #ifdef CONFIG_SYS_MALLOC_BOOTPARAMS
+ 	initr_malloc_bootparams,
diff --git a/package/boot/uboot-mediatek/patches/458-add-GatoNetworks-GDSP.patch b/package/boot/uboot-mediatek/patches/458-add-GatoNetworks-GDSP.patch
new file mode 100644
index 00000000000000..28bdd95e15355d
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/458-add-GatoNetworks-GDSP.patch
@@ -0,0 +1,406 @@
+From 57d0f608d925cb688b5c9b71512fca7d228f07f6 Mon Sep 17 00:00:00 2001
+From: Enrico Mioso <mrkiko.rs@gmail.com>
+Date: Wed, 23 Oct 2024 20:39:28 +0200
+Subject: [PATCH] add GatoNetworks GDSP
+
+Signed-off-by: Enrico Mioso <mrkiko.rs@gmail.com>
+---
+ arch/arm/dts/mt7981-gatonetworks_gdsp.dts  | 200 +++++++++++++++++++++
+ configs/mt7981_gatonetworks_gdsp_defconfig | 144 +++++++++++++++
+ gatonetworks_gdsp_env                      |  38 ++++
+ 3 files changed, 382 insertions(+)
+ create mode 100644 arch/arm/dts/mt7981-gatonetworks_gdsp.dts
+ create mode 100644 configs/mt7981_gatonetworks_gdsp_defconfig
+ create mode 100644 gatonetworks_gdsp_env
+
+--- /dev/null
++++ b/arch/arm/dts/mt7981-gatonetworks_gdsp.dts
+@@ -0,0 +1,200 @@
++// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
++
++/dts-v1/;
++#include "mt7981.dtsi"
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/linux-event-codes.h>
++
++/ {
++	#address-cells = <1>;
++	#size-cells = <1>;
++	model = "GatoNetworks GDSP";
++	compatible = "gatonetworks,gdsp", "mediatek,mt7981";
++  chosen {
++		stdout-path = &uart0;
++		tick-timer = &timer0;
++  };
++
++	memory {
++		device_type = "memory";
++		reg = <0x40000000 0x10000000>;
++	};
++
++	keys {
++		compatible = "gpio-keys";
++
++		reset {
++			label = "reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		sim1 {
++			label = "sim1";
++			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
++		};
++
++		sim2 {
++			label = "sim2";
++			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
++		};
++
++		sg1 {
++			label = "sg1";
++			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
++		};
++
++		sg2 {
++			label = "sg2";
++			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
++		};
++
++		sg3 {
++			label = "sg3";
++			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
++		};
++
++		sg4 {
++			label = "sg4";
++			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
++		};
++
++		sg5 {
++			label = "sg5";
++			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
++		};
++
++		sg6 {
++			label = "sg6";
++			gpios = <&gpio 9 GPIO_ACTIVE_LOW>;
++		};
++	};
++	gpio-watchdog {
++		compatible = "linux,wdt-gpio";
++		gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
++		hw_algo = "toggle";
++		hw_margin_ms = <25000>;
++		always-running;
++		u-boot,autostart;
++	};
++};
++
++&eth {
++	status = "okay";
++	mediatek,gmac-id = <0>;
++	phy-mode = "2500base-x";
++	mediatek,switch = "mt7531";
++	reset-gpios = <&gpio 39 GPIO_ACTIVE_HIGH>;
++
++	fixed-link {
++		speed = <2500>;
++		full-duplex;
++	};
++};
++
++&spi2 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi2_flash_pins>;
++	status = "okay";
++	must_tx;
++	enhance_timing;
++	dma_ext;
++	ipm_design;
++	support_quad;
++	tick_dly = <2>;
++	sample_sel = <0>;
++
++	flash@0 {
++		compatible = "jedec,spi-nor";
++		reg = <0>;
++		spi-max-frequency = <52000000>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@00000 {
++				label = "BL2";
++				reg = <0x00000 0x0040000>;
++				read-only;
++			};
++
++			partition@40000 {
++				label = "u-boot-env";
++				reg = <0x40000 0x0010000>;
++			};
++
++			partition@50000 {
++				label = "Factory";
++				reg = <0x50000 0x00B0000>;
++				read-only;
++			};
++
++			partition@100000 {
++				label = "FIP";
++				reg = <0x100000 0x0080000>;
++			};
++
++			partition@180000 {
++				label = "firmware";
++				reg = <0x180000 0x1E80000>;
++			};
++		};
++	};
++};
++
++&pinctrl {
++	uart1_pins: uart1-pins {
++		mux {
++			function = "uart";
++			groups = "uart1_0";
++		};
++	};
++
++	uart2_pins: uart2-pins {
++		mux {
++			function = "uart";
++			groups = "uart2_0_tx_rx";
++		};
++	};
++
++	spi2_flash_pins: spi2-pins {
++		mux {
++			function = "spi";
++			groups = "spi2", "spi2_wp_hold";
++		};
++
++		conf-pu {
++			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
++		};
++
++		conf-pd {
++			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
++		};
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart1_pins>;
++	status = "okay";
++};
++
++&uart2 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart2_pins>;
++	status = "okay";
++};
+--- /dev/null
++++ b/configs/mt7981_gatonetworks_gdsp_defconfig
+@@ -0,0 +1,144 @@
++CONFIG_ARM=y
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_ARCH_MEDIATEK=y
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_ENV_SIZE=0x10000
++CONFIG_ENV_OFFSET=0x0
++CONFIG_DEFAULT_DEVICE_TREE="mt7981-gatonetworks_gdsp"
++CONFIG_OF_LIBFDT_OVERLAY=y
++CONFIG_TARGET_MT7981=y
++CONFIG_WATCHDOG_TIMEOUT_MSECS=25000
++CONFIG_DEBUG_UART_BASE=0x11002000
++CONFIG_DEBUG_UART_CLOCK=40000000
++CONFIG_SYS_LOAD_ADDR=0x46000000
++CONFIG_DEBUG_UART=y
++CONFIG_FIT=y
++CONFIG_SPI_BOOT=y
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_USE_PREBOOT=y
++CONFIG_DEFAULT_FDT_FILE="mt7981-gatonetworks_gdsp"
++CONFIG_SYS_CBSIZE=512
++CONFIG_SYS_PBSIZE=1049
++CONFIG_LOGLEVEL=7
++CONFIG_CONSOLE_MUX=y
++CONFIG_LOG=y
++CONFIG_BOARD_LATE_INIT=y
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_PROMPT="GDSP> "
++CONFIG_SYS_MAXARGS=16
++CONFIG_CMD_BDINFO_EXTRA=y
++CONFIG_CMD_CPU=y
++CONFIG_CMD_HISTORY=y
++CONFIG_CMD_LICENSE=y
++# CONFIG_BOOTM_NETBSD is not set
++# CONFIG_BOOTM_PLAN9 is not set
++# CONFIG_BOOTM_RTEMS is not set
++# CONFIG_BOOTM_VXWORKS is not set
++# CONFIG_CMD_BOOTEFI_BOOTMGR is not set
++CONFIG_CMD_BOOTMENU=y
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_ERASEENV=y
++CONFIG_CMD_ENV_CALLBACK=y
++CONFIG_CMD_ENV_FLAGS=y
++CONFIG_CRC32_VERIFY=y
++CONFIG_LOOPW=y
++CONFIG_CMD_MEMINFO=y
++CONFIG_CMD_MEMTEST=y
++CONFIG_CMD_STRINGS=y
++# CONFIG_CMD_UNLZ4 is not set
++# CONFIG_CMD_UNZIP is not set
++CONFIG_CMD_DM=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_GPIO_READ=y
++CONFIG_CMD_PWM=y
++CONFIG_CMD_MTD=y
++# CONFIG_CMD_NAND_EXT is not set
++CONFIG_CMD_SF_TEST=y
++CONFIG_CMD_CAT=y
++CONFIG_CMD_SETEXPR_FMT=y
++CONFIG_CMD_XXD=y
++CONFIG_CMD_DHCP=y
++CONFIG_CMD_TFTPPUT=y
++CONFIG_CMD_TFTPSRV=y
++CONFIG_CMD_RARP=y
++CONFIG_CMD_PING=y
++CONFIG_CMD_CDP=y
++CONFIG_CMD_SNTP=y
++CONFIG_CMD_DNS=y
++CONFIG_CMD_LINK_LOCAL=y
++CONFIG_CMD_PXE=y
++CONFIG_CMD_CACHE=y
++# CONFIG_CMD_EFICONFIG is not set
++CONFIG_CMD_PSTORE=y
++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
++CONFIG_CMD_UUID=y
++CONFIG_CMD_HASH=y
++CONFIG_CMD_SMC=y
++CONFIG_CMD_FAT=y
++CONFIG_CMD_FS_GENERIC=y
++CONFIG_CMD_FS_UUID=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_MTD=y
++CONFIG_ENV_MTD_NAME="u-boot-env"
++CONFIG_ENV_SIZE_REDUND=0x0
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_DEFAULT_ENV_FILE="gatonetworks_gdsp_env"
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_VERSION_VARIABLE=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_NETCONSOLE=y
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_BUTTON=y
++CONFIG_BUTTON_GPIO=y
++CONFIG_CLK=y
++CONFIG_GPIO_HOG=y
++CONFIG_LED=y
++CONFIG_LED_BLINK=y
++CONFIG_LED_GPIO=y
++# CONFIG_MMC is not set
++CONFIG_MTD=y
++CONFIG_DM_MTD=y
++CONFIG_MTD_SPI_NAND=y
++CONFIG_DM_SPI_FLASH=y
++CONFIG_SPI_FLASH_SFDP_SUPPORT=y
++CONFIG_SPI_FLASH_EON=y
++CONFIG_SPI_FLASH_GIGADEVICE=y
++CONFIG_SPI_FLASH_ISSI=y
++CONFIG_SPI_FLASH_MACRONIX=y
++CONFIG_SPI_FLASH_SPANSION=y
++CONFIG_SPI_FLASH_STMICRO=y
++CONFIG_SPI_FLASH_WINBOND=y
++CONFIG_SPI_FLASH_XMC=y
++CONFIG_SPI_FLASH_XTX=y
++CONFIG_SPI_FLASH_MTD=y
++CONFIG_UBI_SILENCE_MSG=y
++CONFIG_PHY_FIXED=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PHY=y
++CONFIG_PHY_MTK_TPHY=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7981=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_DM_PWM=y
++CONFIG_PWM_MTK=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_SPI=y
++CONFIG_DM_SPI=y
++CONFIG_MTK_SPIM=y
++CONFIG_USB=y
++CONFIG_USB_XHCI_HCD=y
++CONFIG_USB_XHCI_MTK=y
++CONFIG_USB_STORAGE=y
++CONFIG_WDT=y
++CONFIG_WDT_GPIO=y
++CONFIG_UBIFS_SILENCE_MSG=y
++CONFIG_HEXDUMP=y
++CONFIG_LMB_MAX_REGIONS=64
+--- /dev/null
++++ b/gatonetworks_gdsp_env
+@@ -0,0 +1,38 @@
++load_factory_data=if env exists factory_data_present ; then else mtd read Factory $loadaddr 0x0 0x1000 ; setenv factory_data_present 1 ; fi
++lan_mac_factory=run load_factory_data ; setexpr macoffs $loadaddr + 0x2a ; env readmem -b lan_mac $macoffs 0x6 ; setenv lan_mac_factory ; setenv macoffs
++wan_mac_factory=run load_factory_data ; setexpr macoffs $loadaddr + 0x24 ; env readmem -b wan_mac $macoffs 0x6 ; setenv wan_mac_factory ; setenv macoffs
++label_mac_factory=run load_factory_data ; setexpr macoffs $loadaddr + 0x4 ; env readmem -b label_mac $macoffs 0x6 ; setenv label_mac_factory ; setenv macoffs
++ethaddr_factory=setenv ethaddr $lan_mac ; setenv ethaddr_factory
++wifi_mac_factory=setenv wifi_mac $label_mac ; setenv wifi_mac_factory
++env_cleanup=setenv load_factory_data ; setenv factory_data_present ; setenv env_cleanup
++ipaddr=192.168.1.1
++serverip=192.168.1.10
++loadaddr=0x46000000
++bootcmd=run boot_nor
++bootdelay=0
++bootfile=openwrt-mediatek-filogic-gatonetworks_gdsp-initramfs-kernel.bin
++bootfile_upg=openwrt-mediatek-filogic-gatonetworks_gdsp-squashfs-sysupgrade.bin
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
++bootmenu_2=Boot system from flash.=run boot_nor ; run bootmenu_confirm_return
++bootmenu_3=Load system via TFTP then write to flash.=run boot_tftp_sysupgrade ; run bootmenu_confirm_return
++bootmenu_4=Reset all settings to factory defaults.=run reset_factory ; reset
++bootmenu_5=Reboot.=reset
++boot_first=if button reset ; then run boot_tftp ; setenv flag_recover 1 ; run boot_default ; fi ; bootmenu
++boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_tftp_forever
++boot_nor=mtd read firmware ${loadaddr} ; bootm $loadaddr
++boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr
++boot_tftp_forever=while true ; do run boot_tftp ; sleep 1 ; done
++boot_tftp_sysupgrade=tftpboot $loadaddr $bootfile_upg && iminfo $loadaddr && run nor_write_production
++reset_factory=env default -a && saveenv && reset
++nor_pad_size=setexpr image_eb $filesize / 0x1000 ; setexpr tmp1 image_size % 0x1000 ; test 0x$tmp1 -gt 0 && setexpr image_eb $image_eb + 1 ; setexpr image_eb $image_eb * 0x1000
++nor_write_production=run nor_pad_size ; test 0x$image_eb -le 0x1e80000 && mtd erase firmware 0x0 0x$image_eb && mtd write firmware $loadaddr 0x0 $filesize
++_init_env=setenv _init_env ; saveenv
++_firstboot=setenv _firstboot ; run _switch_to_menu ; run lan_mac_factory ; run wan_mac_factory ; run label_mac_factory ; run env_cleanup ; run ethaddr_factory ; run wifi_mac_factory ; run _init_env ; run boot_first
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
diff --git a/package/boot/uboot-mediatek/patches/459-add-mercusys-mr90x-v1.patch b/package/boot/uboot-mediatek/patches/459-add-mercusys-mr90x-v1.patch
new file mode 100644
index 00000000000000..4fae619aa1a2a9
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/459-add-mercusys-mr90x-v1.patch
@@ -0,0 +1,343 @@
+--- /dev/null
++++ b/configs/mt7986_mercusys_mr90x-v1_defconfig
+@@ -0,0 +1,107 @@
++CONFIG_ARM=y
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_ARCH_MEDIATEK=y
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_DEFAULT_DEVICE_TREE="mt7986b-mercusys_mr90x-v1"
++CONFIG_OF_LIBFDT_OVERLAY=y
++CONFIG_TARGET_MT7986=y
++CONFIG_PRE_CON_BUF_ADDR=0x4007ef00
++CONFIG_DEBUG_UART_BASE=0x11002000
++CONFIG_DEBUG_UART_CLOCK=40000000
++CONFIG_SYS_LOAD_ADDR=0x46000000
++CONFIG_DEBUG_UART=y
++CONFIG_FIT=y
++CONFIG_BOOTDELAY=30
++CONFIG_AUTOBOOT_KEYED=y
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_DEFAULT_FDT_FILE="mediatek/mt7986b-mercusys_mr90x-v1.dtb"
++CONFIG_LOGLEVEL=7
++CONFIG_PRE_CONSOLE_BUFFER=y
++CONFIG_LOG=y
++CONFIG_BOARD_LATE_INIT=y
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_PROMPT="MT7986> "
++CONFIG_CMD_CPU=y
++CONFIG_CMD_LICENSE=y
++CONFIG_CMD_BOOTMENU=y
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_ERASEENV=y
++CONFIG_CMD_ENV_FLAGS=y
++CONFIG_CMD_STRINGS=y
++CONFIG_CMD_DM=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_MTD=y
++CONFIG_CMD_DHCP=y
++CONFIG_CMD_TFTPSRV=y
++CONFIG_CMD_RARP=y
++CONFIG_CMD_PING=y
++CONFIG_CMD_CDP=y
++CONFIG_CMD_SNTP=y
++CONFIG_CMD_DNS=y
++CONFIG_CMD_LINK_LOCAL=y
++CONFIG_CMD_PXE=y
++CONFIG_CMD_CACHE=y
++CONFIG_CMD_PSTORE=y
++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
++CONFIG_CMD_UUID=y
++CONFIG_CMD_HASH=y
++CONFIG_CMD_SMC=y
++CONFIG_CMD_UBI=y
++CONFIG_CMD_UBI_RENAME=y
++CONFIG_OF_EMBED=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_UBI=y
++CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
++CONFIG_ENV_UBI_PART="ubi"
++CONFIG_ENV_UBI_VOLUME="ubootenv"
++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_DEFAULT_ENV_FILE="mercusys_mr90x-v1_env"
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_VERSION_VARIABLE=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_NETCONSOLE=y
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_BUTTON=y
++CONFIG_BUTTON_GPIO=y
++CONFIG_CLK=y
++CONFIG_GPIO_HOG=y
++# CONFIG_I2C is not set
++# CONFIG_MMC is not set
++CONFIG_LED=y
++CONFIG_LED_BLINK=y
++CONFIG_LED_GPIO=y
++CONFIG_MTD=y
++CONFIG_DM_MTD=y
++CONFIG_MTD_SPI_NAND=y
++CONFIG_MTD_UBI_FASTMAP=y
++CONFIG_PHY_FIXED=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PHY=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7986=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_REGULATOR_GPIO=y
++CONFIG_RAM=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_SPI=y
++CONFIG_DM_SPI=y
++CONFIG_MTK_SPIM=y
++CONFIG_RANDOM_UUID=y
++CONFIG_ZSTD=y
++CONFIG_HEXDUMP=y
++CONFIG_LMB_MAX_REGIONS=64
+--- /dev/null
++++ b/arch/arm/dts/mt7986b-mercusys_mr90x-v1.dts
+@@ -0,0 +1,174 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2024
++ * Author: Mikhail Zhilkin <csharper2005@gmail.com>
++ */
++
++/dts-v1/;
++#include "mt7986.dtsi"
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/linux-event-codes.h>
++
++/ {
++	#address-cells = <1>;
++	#size-cells = <1>;
++	model = "MERCUSYS MR90X v1";
++	compatible = "mediatek,mt7986", "mediatek,mt7986-rfb";
++
++	chosen {
++		stdout-path = &uart0;
++		tick-timer = &timer0;
++	};
++
++	memory@40000000 {
++		device_type = "memory";
++		reg = <0x40000000 0x20000000>;
++	};
++
++	keys {
++		compatible = "gpio-keys";
++
++		reset {
++			label = "reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		led-0 {
++			label = "green:lan2";
++			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
++		};
++
++		led-1 {
++			label = "green:lan1";
++			gpios = <&gpio 9 GPIO_ACTIVE_LOW>;
++		};
++
++		led-2 {
++			label = "green:lan0";
++			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
++		};
++
++		led-3 {
++			label = "green:wan";
++			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
++		};
++
++		led-4 {
++			label = "amber:status";
++			gpios = <&gpio 16 GPIO_ACTIVE_HIGH>;
++		};
++
++		led_status_green: led-5 {
++			label = "green:status";
++			gpios = <&gpio 17 GPIO_ACTIVE_HIGH>;
++		};
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
++
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&uart1_pins>;
++	status = "disabled";
++};
++
++&eth {
++	status = "okay";
++	mediatek,gmac-id = <0>;
++	phy-mode = "2500base-x";
++	mediatek,switch = "mt7531";
++	reset-gpios = <&gpio 5 GPIO_ACTIVE_HIGH>;
++
++	fixed-link {
++		speed = <2500>;
++		full-duplex;
++	};
++};
++
++&pinctrl {
++	spi_flash_pins: spi0-pins-func-1 {
++		mux {
++			function = "flash";
++			groups = "spi0", "spi0_wp_hold";
++		};
++
++		conf-pu {
++			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-up = <MTK_PUPD_SET_R1R0_00>;
++		};
++
++		conf-pd {
++			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-down = <MTK_PUPD_SET_R1R0_00>;
++		};
++	};
++
++	spic_pins: spi1-pins-func-1 {
++		mux {
++			function = "spi";
++			groups = "spi1_2";
++		};
++	};
++
++	uart1_pins: spi1-pins-func-3 {
++		mux {
++			function = "uart";
++			groups = "uart1_2";
++		};
++	};
++};
++
++&spi0 {
++	#address-cells = <1>;
++	#size-cells = <0>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi_flash_pins>;
++	status = "okay";
++	must_tx;
++	enhance_timing;
++	dma_ext;
++	ipm_design;
++	tick_dly = <2>;
++	sample_sel = <0>;
++
++	spi_nand@1 {
++		compatible = "spi-nand";
++		reg = <1>;
++		spi-max-frequency = <20000000>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				reg = <0x0 0x100000>;
++				label = "bl2";
++			};
++
++			partition@100000 {
++				reg = <0x100000 0x100000>;
++				label = "factory";
++			};
++
++			partition@200000 {
++				reg = <0x200000 0x7e00000>;
++				label = "ubi";
++			};
++		};
++	};
++};
++
++&watchdog {
++	status = "disabled";
++};
+--- /dev/null
++++ b/mercusys_mr90x-v1_env
+@@ -0,0 +1,53 @@
++ipaddr=192.168.1.1
++serverip=192.168.1.254
++loadaddr=0x46000000
++console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
++bootargs=console=ttyS0,115200n8 console_msg_format=syslog
++bootcmd=run check_buttons ; run boot_production ; run boot_recovery
++bootconf=config-1
++bootdelay=0
++bootfile=openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-initramfs-recovery.itb
++bootfile_bl2=openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-preloader.bin
++bootfile_fip=openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-bl31-uboot.fip
++bootfile_upg=openwrt-mediatek-filogic-mercusys_mr90x-v1-ubi-squashfs-sysupgrade.itb
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )  [SPI-NAND]
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
++bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
++bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
++bootmenu_4=Load production system via TFTP then write to NAND.=noboot=1 ; replacevol=1 ; run boot_tftp_production ; noboot= ; replacevol= ; run bootmenu_confirm_return
++bootmenu_5=Load recovery system via TFTP then write to NAND.=noboot=1 ; replacevol=1 ; run boot_tftp_recovery ; noboot= ; replacevol= ; run bootmenu_confirm_return
++bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to NAND.=run boot_tftp_write_fip ; run bootmenu_confirm_return
++bootmenu_7=Load BL2 preloader via TFTP then write to NAND.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
++bootmenu_8=Reboot.=reset
++bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
++boot_default=run led_boot ; run bootcmd ; run boot_recovery ; replacevol=1 ; run boot_tftp_forever
++boot_production=run led_boot ; run ubi_read_production && bootm $loadaddr#$bootconf
++boot_recovery=run led_boot ; run ubi_read_recovery && bootm $loadaddr#$bootconf
++boot_tftp=run led_boot ; tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
++boot_tftp_forever=run led_boot ; while true ; do run boot_tftp ; sleep 1 ; done
++boot_tftp_production=run led_boot ; tftpboot $loadaddr $bootfile_upg && test $replacevol = 1 && iminfo $loadaddr && run ubi_write_production ; if test $noboot = 1 ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_recovery=run led_boot ; tftpboot $loadaddr $bootfile && test $replacevol = 1 && iminfo $loadaddr && run ubi_write_recovery ; if test $noboot = 1 ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_write_fip=run led_boot ; tftpboot $loadaddr $bootfile_fip && run ubi_write_fip && run reset_factory
++boot_tftp_write_bl2=run led_boot ; tftpboot $loadaddr $bootfile_bl2 && run snand_write_bl2
++check_buttons=if button reset ; then run boot_tftp ; fi
++ethaddr_factory=mtd read factory 0x40080000 0x0 0x20000 && env readmem -b ethaddr 0x40088000 0x6 ; setenv ethaddr_factory
++led_boot=led green:status off ; led amber:status on
++reset_factory=mw $loadaddr 0xff 0x1f000 ; ubi write $loadaddr ubootenv 0x1f000 ; ubi write $loadaddr ubootenv2 0x1f000 ; ubi remove rootfs_data
++snand_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr 0x0 0x40000
++ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x1f000 dynamic ; ubi check ubootenv2 || ubi create ubootenv2 0x1f000 dynamic
++ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
++ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
++ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
++ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
++ubi_write_fip=run ubi_remove_rootfs ; ubi check fip && ubi remove fip ; ubi create fip $filesize static && ubi write $loadaddr fip $filesize
++ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
++ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
++_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
++_firstboot=setenv _firstboot ; run ethaddr_factory ; run _switch_to_menu ; run _init_env ; bootmenu
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
diff --git a/package/boot/uboot-mediatek/patches/460-add-routerich-ax3000.patch b/package/boot/uboot-mediatek/patches/460-add-routerich-ax3000.patch
new file mode 100644
index 00000000000000..f33ca076330d1c
--- /dev/null
+++ b/package/boot/uboot-mediatek/patches/460-add-routerich-ax3000.patch
@@ -0,0 +1,362 @@
+--- /dev/null
++++ b/configs/mt7981_routerich_ax3000_defconfig
+@@ -0,0 +1,108 @@
++CONFIG_ARM=y
++CONFIG_SYS_HAS_NONCACHED_MEMORY=y
++CONFIG_POSITION_INDEPENDENT=y
++CONFIG_ARCH_MEDIATEK=y
++CONFIG_TEXT_BASE=0x41e00000
++CONFIG_SYS_MALLOC_F_LEN=0x4000
++CONFIG_NR_DRAM_BANKS=1
++CONFIG_DEFAULT_DEVICE_TREE="mt7981-routerich_ax3000"
++CONFIG_OF_LIBFDT_OVERLAY=y
++CONFIG_TARGET_MT7981=y
++CONFIG_PRE_CON_BUF_ADDR=0x4007ef00
++CONFIG_DEBUG_UART_BASE=0x11002000
++CONFIG_DEBUG_UART_CLOCK=40000000
++CONFIG_SYS_LOAD_ADDR=0x46000000
++CONFIG_DEBUG_UART=y
++CONFIG_FIT=y
++CONFIG_BOOTDELAY=30
++CONFIG_AUTOBOOT_KEYED=y
++CONFIG_AUTOBOOT_MENU_SHOW=y
++CONFIG_DEFAULT_FDT_FILE="mediatek/mt7981-routerich_ax3000.dtb"
++CONFIG_LOGLEVEL=7
++CONFIG_PRE_CONSOLE_BUFFER=y
++CONFIG_LOG=y
++CONFIG_BOARD_LATE_INIT=y
++CONFIG_HUSH_PARSER=y
++CONFIG_SYS_PROMPT="MT7981> "
++CONFIG_CMD_CPU=y
++CONFIG_CMD_LICENSE=y
++CONFIG_CMD_BOOTMENU=y
++CONFIG_CMD_ASKENV=y
++CONFIG_CMD_ERASEENV=y
++CONFIG_CMD_ENV_FLAGS=y
++CONFIG_CMD_STRINGS=y
++CONFIG_CMD_DM=y
++CONFIG_CMD_GPIO=y
++CONFIG_CMD_GPT=y
++CONFIG_CMD_MTD=y
++CONFIG_CMD_PART=y
++CONFIG_CMD_DHCP=y
++CONFIG_CMD_TFTPSRV=y
++CONFIG_CMD_RARP=y
++CONFIG_CMD_PING=y
++CONFIG_CMD_CDP=y
++CONFIG_CMD_SNTP=y
++CONFIG_CMD_DNS=y
++CONFIG_CMD_LINK_LOCAL=y
++CONFIG_CMD_PXE=y
++CONFIG_CMD_CACHE=y
++CONFIG_CMD_PSTORE=y
++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000
++CONFIG_CMD_UUID=y
++CONFIG_CMD_HASH=y
++CONFIG_CMD_SMC=y
++CONFIG_CMD_UBI=y
++CONFIG_CMD_UBI_RENAME=y
++CONFIG_OF_EMBED=y
++CONFIG_ENV_OVERWRITE=y
++CONFIG_ENV_IS_IN_UBI=y
++CONFIG_SYS_REDUNDAND_ENVIRONMENT=y
++CONFIG_ENV_UBI_PART="ubi"
++CONFIG_ENV_UBI_VOLUME="ubootenv"
++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2"
++CONFIG_SYS_RELOC_GD_ENV_ADDR=y
++CONFIG_USE_DEFAULT_ENV_FILE=y
++CONFIG_DEFAULT_ENV_FILE="routerich_ax3000_env"
++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y
++CONFIG_VERSION_VARIABLE=y
++CONFIG_NET_RANDOM_ETHADDR=y
++CONFIG_NETCONSOLE=y
++CONFIG_USE_IPADDR=y
++CONFIG_IPADDR="192.168.1.1"
++CONFIG_USE_SERVERIP=y
++CONFIG_SERVERIP="192.168.1.254"
++CONFIG_REGMAP=y
++CONFIG_SYSCON=y
++CONFIG_BUTTON=y
++CONFIG_BUTTON_GPIO=y
++CONFIG_CLK=y
++CONFIG_GPIO_HOG=y
++CONFIG_LED=y
++CONFIG_LED_BLINK=y
++CONFIG_LED_GPIO=y
++# CONFIG_MMC is not set
++CONFIG_MTD=y
++CONFIG_DM_MTD=y
++CONFIG_MTD_SPI_NAND=y
++CONFIG_MTD_UBI_FASTMAP=y
++CONFIG_PHY_FIXED=y
++CONFIG_MEDIATEK_ETH=y
++CONFIG_PHY=y
++CONFIG_PHY_MTK_TPHY=y
++CONFIG_PINCTRL=y
++CONFIG_PINCONF=y
++CONFIG_PINCTRL_MT7981=y
++CONFIG_POWER_DOMAIN=y
++CONFIG_MTK_POWER_DOMAIN=y
++CONFIG_DM_REGULATOR=y
++CONFIG_DM_REGULATOR_FIXED=y
++CONFIG_DM_REGULATOR_GPIO=y
++CONFIG_RAM=y
++CONFIG_DM_SERIAL=y
++CONFIG_MTK_SERIAL=y
++CONFIG_SPI=y
++CONFIG_DM_SPI=y
++CONFIG_MTK_SPIM=y
++CONFIG_ZSTD=y
++CONFIG_HEXDUMP=y
++CONFIG_LMB_MAX_REGIONS=64
+--- /dev/null
++++ b/arch/arm/dts/mt7981-routerich_ax3000.dts
+@@ -0,0 +1,187 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2022 MediaTek Inc.
++ * Author: Sam Shih <sam.shih@mediatek.com>
++ */
++
++/dts-v1/;
++#include "mt7981.dtsi"
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/input/linux-event-codes.h>
++
++/ {
++	#address-cells = <1>;
++	#size-cells = <1>;
++	model = "Routerich AX3000";
++	compatible = "routerich,ax3000", "mediatek,mt7981";
++
++	chosen {
++		stdout-path = &uart0;
++		tick-timer = &timer0;
++	};
++
++	memory@40000000 {
++		device_type = "memory";
++		reg = <0x40000000 0x10000000>;
++	};
++
++	keys {
++		compatible = "gpio-keys";
++
++		button-0 {
++			label = "mesh";
++			linux,code = <BTN_0>;
++			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
++		};
++
++		button-1 {
++			label = "reset";
++			linux,code = <KEY_RESTART>;
++			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
++		};
++	};
++
++	leds {
++		compatible = "gpio-leds";
++
++		led-0 {
++			label = "red:wlan5g";
++			gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
++		};
++
++		led-1 {
++			label = "red:wan";
++			gpios = <&gpio 6 GPIO_ACTIVE_HIGH>;
++		};
++
++		led-2 {
++			label = "blue:power";
++			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
++		};
++
++		led-3 {
++			label = "blue:lan1";
++			gpios = <&gpio 9 GPIO_ACTIVE_LOW>;
++		};
++
++		led-4 {
++			label = "blue:lan2";
++			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
++		};
++
++		led-5 {
++			label = "blue:lan3";
++			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
++		};
++
++		led-6 {
++			label = "blue:wan";
++			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
++		};
++
++		led-7 {
++			label = "blue:wlan2g";
++			gpios = <&gpio 34 GPIO_ACTIVE_LOW>;
++		};
++
++		led-8 {
++			label = "blue:mesh";
++			gpios = <&gpio 35 GPIO_ACTIVE_LOW>;
++		};
++	};
++};
++
++&uart0 {
++	mediatek,force-highspeed;
++	status = "okay";
++};
++
++&eth {
++	status = "okay";
++	mediatek,gmac-id = <0>;
++	phy-mode = "2500base-x";
++	mediatek,switch = "mt7531";
++	reset-gpios = <&gpio 39 GPIO_ACTIVE_HIGH>;
++
++	fixed-link {
++		speed = <2500>;
++		full-duplex;
++	};
++};
++
++&pinctrl {
++	spi_flash_pins: spi0-pins-func-1 {
++		mux {
++			function = "flash";
++			groups = "spi0", "spi0_wp_hold";
++		};
++
++		conf-pu {
++			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
++		};
++
++		conf-pd {
++			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
++			drive-strength = <MTK_DRIVE_8mA>;
++			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
++		};
++	};
++};
++
++&spi0 {
++	#address-cells = <1>;
++	#size-cells = <0>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&spi_flash_pins>;
++	status = "okay";
++	must_tx;
++	enhance_timing;
++	dma_ext;
++	ipm_design;
++	support_quad;
++	tick_dly = <2>;
++	sample_sel = <0>;
++
++	spi_nand@0 {
++		compatible = "spi-nand";
++		reg = <0>;
++		spi-max-frequency = <52000000>;
++
++		partitions {
++			compatible = "fixed-partitions";
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			partition@0 {
++				label = "bl2";
++				reg = <0x0 0x100000>;
++			};
++
++			partition@100000 {
++				label = "uboot-env-orig";
++				reg = <0x100000 0x80000>;
++			};
++
++			partition@160000 {
++				label = "Factory";
++				reg = <0x180000 0x200000>;
++			};
++
++			partition@380000 {
++				label = "fip";
++				reg = <0x380000 0x200000>;
++			};
++
++			partition@580000 {
++				label = "ubi";
++				reg = <0x580000 0x7a80000>;
++			};
++		};
++	};
++};
++
++&watchdog {
++	status = "disabled";
++};
+--- /dev/null
++++ b/routerich_ax3000_env
+@@ -0,0 +1,58 @@
++ipaddr=192.168.1.1
++serverip=192.168.1.254
++loadaddr=0x46000000
++console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0
++bootcmd=run check_buttons ; if pstore check ; then run boot_recovery ; else run boot_ubi ; fi
++bootconf=config-1
++bootdelay=0
++bootfile=openwrt-mediatek-filogic-routerich_ax3000-ubootmod-initramfs-recovery.itb
++bootfile_bl2=openwrt-mediatek-filogic-routerich_ax3000-ubootmod-preloader.bin
++bootfile_fip=openwrt-mediatek-filogic-routerich_ax3000-ubootmod-bl31-uboot.fip
++bootfile_upg=openwrt-mediatek-filogic-routerich_ax3000-ubootmod-squashfs-sysupgrade.itb
++bootled_pwr=blue:power
++bootled_rec=blue:power
++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60
++bootmenu_default=0
++bootmenu_delay=0
++bootmenu_title=      ( ( ( OpenWrt ) ) )
++bootmenu_0=Initialize environment.=run _firstboot
++bootmenu_0d=Run default boot command.=run boot_default
++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return
++bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return
++bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return
++bootmenu_4=Load production system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_production ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_5=Load recovery system via TFTP then write to NAND.=setenv noboot 1 ; setenv replacevol 1 ; run boot_tftp_recovery ; setenv noboot ; setenv replacevol ; run bootmenu_confirm_return
++bootmenu_6=Load BL31+U-Boot FIP via TFTP then write to NAND.=run boot_tftp_write_fip ; run bootmenu_confirm_return
++bootmenu_7=Load BL2 preloader via TFTP then write to NAND.=run boot_tftp_write_bl2 ; run bootmenu_confirm_return
++bootmenu_8=Reboot.=reset
++bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset
++boot_first=if button reset ; then led $bootled_rec on ; run boot_default ; fi ; bootmenu
++boot_default=if env exists flag_recover ; then else run bootcmd ; fi ; run boot_recovery ; setenv replacevol 1 ; run boot_tftp_forever
++boot_production=led $bootled_pwr on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led $bootled_pwr off
++boot_recovery=led $bootled_rec on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led $bootled_rec off
++boot_ubi=run boot_production ; run boot_recovery ; run boot_tftp_forever
++boot_tftp_forever=led $bootled_rec on ; while true ; do run boot_tftp ; sleep 1 ; done
++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && env exists replacevol && iminfo $loadaddr && run ubi_write_production ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp_recovery=tftpboot $loadaddr $bootfile && env exists replacevol && iminfo $loadaddr && run ubi_write_recovery ; if env exists noboot ; then else bootm $loadaddr#$bootconf ; fi
++boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf
++boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run mtd_write_fip && run reset_factory
++boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run mtd_write_bl2
++check_buttons=if button reset ; then run boot_tftp ; fi
++ethaddr_factory=mtd read Factory 0x40080000 0x0 0x20000 && env readmem -b ethaddr 0x40080004 0x6 ; setenv ethaddr_factory
++part_default=production
++part_recovery=recovery
++reset_factory=ubi part ubi ; mw $loadaddr 0x0 0x800 ; ubi write $loadaddr ubootenv 0x800 ; ubi write $loadaddr ubootenv2 0x800
++mtd_write_fip=mtd erase fip && mtd write fip $loadaddr
++mtd_write_bl2=mtd erase bl2 && mtd write bl2 $loadaddr
++ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x100000 dynamic || run ubi_format ; ubi check ubootenv2 || ubi create ubootenv2 0x100000 dynamic || run ubi_format
++ubi_format=ubi detach ; mtd erase ubi && ubi part ubi ; reset
++ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi
++ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs
++ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery
++ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data
++ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize
++ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize
++_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv
++_firstboot=setenv _firstboot ; run ethaddr_factory ; run _switch_to_menu ; run _init_env ; run boot_first
++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title
++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title       $ver"
diff --git a/package/boot/uboot-rockchip/Makefile b/package/boot/uboot-rockchip/Makefile
index 7070ca973d3200..7bb95d3b612b0c 100644
--- a/package/boot/uboot-rockchip/Makefile
+++ b/package/boot/uboot-rockchip/Makefile
@@ -136,6 +136,20 @@ define U-Boot/nanopi-r4s-rk3399
     friendlyarm_nanopi-r4s-enterprise
 endef
 
+define U-Boot/rock-4c-plus-rk3399
+  $(U-Boot/rk3399/Default)
+  NAME:=ROCK 4C+
+  BUILD_DEVICES:= \
+    radxa_rock-4c-plus
+endef
+
+define U-Boot/rock-4se-rk3399
+  $(U-Boot/rk3399/Default)
+  NAME:=ROCK 4SE
+  BUILD_DEVICES:= \
+    radxa_rock-4se
+endef
+
 define U-Boot/rock-pi-4-rk3399
   $(U-Boot/rk3399/Default)
   NAME:=Rock Pi 4
@@ -300,6 +314,8 @@ endef
 UBOOT_TARGETS := \
   nanopc-t4-rk3399 \
   nanopi-r4s-rk3399 \
+  rock-4c-plus-rk3399 \
+  rock-4se-rk3399 \
   rock-pi-4-rk3399 \
   rockpro64-rk3399 \
   rock-pi-s-rk3308 \
diff --git a/package/boot/uboot-rockchip/patches/002-scripts-dtc-pylibfdt-libfdt-i_shipped-Use-SWIG_AppendOutp.patch b/package/boot/uboot-rockchip/patches/002-scripts-dtc-pylibfdt-libfdt-i_shipped-Use-SWIG_AppendOutp.patch
new file mode 100644
index 00000000000000..f5beca8d77a1ae
--- /dev/null
+++ b/package/boot/uboot-rockchip/patches/002-scripts-dtc-pylibfdt-libfdt-i_shipped-Use-SWIG_AppendOutp.patch
@@ -0,0 +1,55 @@
+From a63456b9191fae2fe49f4b121e025792022e3950 Mon Sep 17 00:00:00 2001
+From: Markus Volk <f_l_k@t-online.de>
+Date: Wed, 30 Oct 2024 06:07:16 +0100
+Subject: [PATCH] scripts/dtc/pylibfdt/libfdt.i_shipped: Use SWIG_AppendOutput
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Swig has changed language specific AppendOutput functions. The helper
+macro SWIG_AppendOutput remains unchanged. Use that instead
+of SWIG_Python_AppendOutput, which would require an extra parameter
+since swig 4.3.0.
+
+/home/flk/poky/build-test/tmp/work/qemux86_64-poky-linux/u-boot/2024.10/git/arch/x86/cpu/u-boot-64.lds
+| scripts/dtc/pylibfdt/libfdt_wrap.c: In function ‘_wrap_fdt_next_node’:
+| scripts/dtc/pylibfdt/libfdt_wrap.c:5581:17: error: too few arguments to function ‘SWIG_Python_AppendOutput’
+|  5581 |     resultobj = SWIG_Python_AppendOutput(resultobj, val);
+|       |                 ^~~~~~~~~~~~~~~~~~~~~~~~
+
+Signed-off-by: Markus Volk <f_l_k@t-online.de>
+Reported-by: Rudi Heitbaum <rudi@heitbaum.com>
+Link: https://github.com/dgibson/dtc/pull/154
+---
+ scripts/dtc/pylibfdt/libfdt.i_shipped | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/scripts/dtc/pylibfdt/libfdt.i_shipped
++++ b/scripts/dtc/pylibfdt/libfdt.i_shipped
+@@ -1037,7 +1037,7 @@ typedef uint32_t fdt32_t;
+ 			fdt_string(fdt1, fdt32_to_cpu($1->nameoff)));
+ 		buff = PyByteArray_FromStringAndSize(
+ 			(const char *)($1 + 1), fdt32_to_cpu($1->len));
+-		resultobj = SWIG_Python_AppendOutput(resultobj, buff);
++		resultobj = SWIG_AppendOutput(resultobj, buff);
+ 	}
+ }
+ 
+@@ -1076,7 +1076,7 @@ typedef uint32_t fdt32_t;
+ 
+ %typemap(argout) int *depth {
+         PyObject *val = Py_BuildValue("i", *arg$argnum);
+-        resultobj = SWIG_Python_AppendOutput(resultobj, val);
++        resultobj = SWIG_AppendOutput(resultobj, val);
+ }
+ 
+ %apply int *depth { int *depth };
+@@ -1092,7 +1092,7 @@ typedef uint32_t fdt32_t;
+            if (PyTuple_GET_SIZE(resultobj) == 0)
+               resultobj = val;
+            else
+-              resultobj = SWIG_Python_AppendOutput(resultobj, val);
++              resultobj = SWIG_AppendOutput(resultobj, val);
+         }
+ }
+ 
diff --git a/package/boot/uboot-stm32/Makefile b/package/boot/uboot-stm32/Makefile
new file mode 100644
index 00000000000000..58754aedd5a7c5
--- /dev/null
+++ b/package/boot/uboot-stm32/Makefile
@@ -0,0 +1,51 @@
+#
+# Copyright (C) 2024 Bootlin
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_VERSION:=2024.07
+PKG_RELEASE:=1
+
+PKG_HASH:=f591da9ab90ef3d6b3d173766d0ddff90c4ed7330680897486117df390d83c8f
+PKG_MAINTAINER:=Thomas Richard <thomas.richard@bootlin.com>
+
+UBOOT_USE_INTREE_DTC:=1
+
+include $(INCLUDE_DIR)/u-boot.mk
+include $(INCLUDE_DIR)/package.mk
+
+define U-Boot/Default
+  BUILD_TARGET:=stm32
+  UBOOT_IMAGE:=u-boot.bin u-boot.dtb
+endef
+
+define U-Boot/stm32mp13
+  BUILD_SUBTARGET:=stm32mp1
+  UBOOT_CONFIG:=stm32mp13
+endef
+
+define U-Boot/stm32mp135f-dk
+  $(call U-Boot/stm32mp13)
+  NAME:=STM32MP135F-DK
+  DEVICE_TREE:=stm32mp135f-dk
+endef
+
+UBOOT_TARGETS := stm32mp135f-dk
+
+UBOOT_MAKE_FLAGS += DEVICE_TREE=$(DEVICE_TREE)
+
+define Build/InstallDev
+	$(INSTALL_DIR) $(STAGING_DIR_IMAGE)
+	$(foreach img,$(UBOOT_IMAGE), \
+		$(CP) $(PKG_BUILD_DIR)/$(img) $(STAGING_DIR_IMAGE)/$(BUILD_VARIANT)-$(img); \
+	)
+endef
+
+define Package/u-boot/install/default
+endef
+
+$(eval $(call BuildPackage/U-Boot))
diff --git a/package/devel/gdb/Makefile b/package/devel/gdb/Makefile
index 366746be87fbaf..7bdc6c83cbe899 100644
--- a/package/devel/gdb/Makefile
+++ b/package/devel/gdb/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=gdb
 PKG_VERSION:=15.2
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@GNU/gdb
@@ -37,7 +37,7 @@ $(call Package/gdb/Default)
 endef
 
 define Package/gdb/description
-GDB, the GNU Project debugger, allows you to see what is going on `inside'
+GDB, the GNU Project debugger, allows you to see what is going on 'inside'
 another program while it executes -- or what another program was doing at the
 moment it crashed.
 endef
diff --git a/package/devel/perf/Makefile b/package/devel/perf/Makefile
index 20be59516dad12..0129dc61186da0 100644
--- a/package/devel/perf/Makefile
+++ b/package/devel/perf/Makefile
@@ -10,7 +10,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=perf
 PKG_VERSION:=$(LINUX_VERSION)
-PKG_RELEASE:=5
+PKG_RELEASE:=6
 
 PKG_BUILD_FLAGS:=no-mips16 no-lto
 PKG_BUILD_PARALLEL:=1
@@ -50,6 +50,7 @@ MAKE_FLAGS = \
 	NO_LZMA=1 \
 	NO_BACKTRACE=1 \
 	NO_LIBNUMA=1 \
+	NO_SLANG=1 \
 	NO_GTK2=1 \
 	NO_LIBAUDIT=1 \
 	NO_LIBCRYPTO=1 \
diff --git a/package/devel/strace/Makefile b/package/devel/strace/Makefile
index f418bea5a724c7..892c05467e4ebf 100644
--- a/package/devel/strace/Makefile
+++ b/package/devel/strace/Makefile
@@ -9,12 +9,12 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=strace
-PKG_VERSION:=6.11
+PKG_VERSION:=6.12
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://strace.io/files/$(PKG_VERSION)
-PKG_HASH:=83262583a3529f02c3501aa8b8ac772b4cbc03dc934e98bab6e4883626e283a5
+PKG_HASH:=c47da93be45b6055f4dc741d7f20efaf50ca10160a5b100c109b294fd9c0bdfe
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=LGPL-2.1-or-later
diff --git a/package/firmware/intel-microcode/Makefile b/package/firmware/intel-microcode/Makefile
index bdd8ae73d88f3c..2ec1f22c35d872 100644
--- a/package/firmware/intel-microcode/Makefile
+++ b/package/firmware/intel-microcode/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=intel-microcode
-PKG_VERSION:=20240531
+PKG_VERSION:=20250211
 PKG_RELEASE:=1
 
 PKG_SOURCE:=intel-microcode_3.$(PKG_VERSION).1.tar.xz
 PKG_SOURCE_URL:=@DEBIAN/pool/non-free-firmware/i/intel-microcode/
-PKG_HASH:=808cbb57a790dab7060b59b31e70e54ac47d3798d75e9784ed57a65b9f951fc4
+PKG_HASH:=06b7aca49790d673623cb42f7a62a517d82555ce96371d2967b568d6e30fd787
 PKG_BUILD_DIR:=$(BUILD_DIR)/intel-microcode-3.$(PKG_VERSION).1
 PKG_CPE_ID:=cpe:/a:intel:microcode
 
diff --git a/package/firmware/ipq-wifi/Makefile b/package/firmware/ipq-wifi/Makefile
index 4732a14b1b4e1b..41a2a009cb3ce9 100644
--- a/package/firmware/ipq-wifi/Makefile
+++ b/package/firmware/ipq-wifi/Makefile
@@ -6,9 +6,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/firmware/qca-wireless.git
-PKG_SOURCE_DATE:=2024-10-08
-PKG_SOURCE_VERSION:=dcbab62272bf5cab2ed857bc655d240970e14f2a
-PKG_MIRROR_HASH:=e53a3872abf5e35db6baaceb56e6ffa289f8dd9b6226cf8a4d5b87b541179175
+PKG_SOURCE_DATE:=2025-08-25
+PKG_SOURCE_VERSION:=a510502e7922b0a61e455e43479a62e7d27cf3ba
+PKG_MIRROR_HASH:=0b8120ce09fdd9176e77b65f2c0866e14aa580ba7e6dd9440f37011418346be7
 PKG_FLAGS:=nonshared
 
 include $(INCLUDE_DIR)/package.mk
@@ -54,7 +54,9 @@ ALLWIFIBOARDS:= \
 	skspruce_wia3300-20 \
 	spectrum_sax1v1k \
 	tplink_eap660hd-v1 \
+	tplink_archer-c6-v2 \
 	wallys_dr40x9 \
+	xiaomi_aiot-ac2350 \
 	xiaomi_ax3600 \
 	xiaomi_ax9000 \
 	yyets_le1 \
@@ -72,7 +74,7 @@ define Package/ipq-wifi-default
   SUBMENU:=ath10k Board-Specific Overrides
   SECTION:=firmware
   CATEGORY:=Firmware
-  DEPENDS:=@(TARGET_ipq40xx||TARGET_ipq806x||TARGET_qualcommax)
+  DEPENDS:=@(TARGET_ath79||TARGET_ipq40xx||TARGET_ipq806x||TARGET_qualcommax)
   TITLE:=Custom Board
 endef
 
@@ -95,6 +97,8 @@ define ipq-wifi-install-one
     $(call ipq-wifi-install-one-to,$(1),$(2),QCA9887/hw1.0),\
   $(if $(filter $(suffix $(1)),.QCA9984 .qca9984),\
     $(call ipq-wifi-install-one-to,$(1),$(2),QCA9984/hw1.0),\
+  $(if $(filter $(suffix $(1)),.QCA9988 .qca9988),\
+    $(call ipq-wifi-install-one-to,$(1),$(2),QCA9984/hw1.0),\
   $(if $(filter $(suffix $(1)),.QCA99X0 .qca99x0),\
     $(call ipq-wifi-install-one-to,$(1),$(2),QCA99X0/hw2.0),\
   $(if $(filter $(suffix $(1)),.IPQ6018 .ipq6018),\
@@ -104,7 +108,7 @@ define ipq-wifi-install-one
   $(if $(filter $(suffix $(1)),.QCN9074 .qcn9074),\
     $(call ipq-wifi-install-ath11-one-to,$(1),$(2),QCN9074/hw1.0),\
     $(error Unrecognized board-file suffix '$(suffix $(1))' for '$(1)')\
-  ))))))))
+  )))))))))
 
 endef
 # Blank line required at end of above define due to foreach context
@@ -181,7 +185,9 @@ $(eval $(call generate-ipq-wifi-package,redmi_ax6,Redmi AX6))
 $(eval $(call generate-ipq-wifi-package,skspruce_wia3300-20,SKSpruce WIA3300-20))
 $(eval $(call generate-ipq-wifi-package,spectrum_sax1v1k,Spectrum SAX1V1K))
 $(eval $(call generate-ipq-wifi-package,tplink_eap660hd-v1,TP-Link EAP660 HD v1))
+$(eval $(call generate-ipq-wifi-package,tplink_archer-c6-v2,TP-Link Archer C6 V2))
 $(eval $(call generate-ipq-wifi-package,wallys_dr40x9,Wallys DR40X9))
+$(eval $(call generate-ipq-wifi-package,xiaomi_aiot-ac2350,Xiaomi AIoT AC2350))
 $(eval $(call generate-ipq-wifi-package,xiaomi_ax3600,Xiaomi AX3600))
 $(eval $(call generate-ipq-wifi-package,xiaomi_ax9000,Xiaomi AX9000))
 $(eval $(call generate-ipq-wifi-package,yyets_le1,YYeTs LE1))
diff --git a/package/firmware/lantiq/dsl-vrx200-firmware-xdsl/Makefile b/package/firmware/lantiq/dsl-vrx200-firmware-xdsl/Makefile
index 37db950beae54f..b6e1d11efc60a6 100644
--- a/package/firmware/lantiq/dsl-vrx200-firmware-xdsl/Makefile
+++ b/package/firmware/lantiq/dsl-vrx200-firmware-xdsl/Makefile
@@ -40,7 +40,7 @@ define Package/dsl-vrx200-firmware-xdsl-a
   CATEGORY:=Firmware
   TITLE:=VRX200 / VR9 CPE xDSL Annex A firmware
   URL:=http://www.lantiq.com/
-  DEPENDS:=@TARGET_lantiq_xrx200
+  DEPENDS:=@(TARGET_lantiq_xrx200||TARGET_lantiq_xrx200_legacy)
 endef
 
 define Package/dsl-vrx200-firmware-xdsl-a/description
@@ -52,7 +52,7 @@ define Package/dsl-vrx200-firmware-xdsl-b
   CATEGORY:=Firmware
   TITLE:=VRX200 / VR9 CPE xDSL Annex B firmware
   URL:=http://www.lantiq.com/
-  DEPENDS:=@TARGET_lantiq_xrx200
+  DEPENDS:=@(TARGET_lantiq_xrx200||TARGET_lantiq_xrx200_legacy)
 endef
 
 define Package/dsl-vrx200-firmware-xdsl-b/description
@@ -64,7 +64,7 @@ define Package/dsl-vrx200-firmware-xdsl-a-patch
   CATEGORY:=Firmware
   TITLE:=VRX200 / VR9 CPE xDSL Annex B to Annex A firmware patch
   URL:=http://www.lantiq.com/
-  DEPENDS:=@TARGET_lantiq_xrx200 +dsl-vrx200-firmware-xdsl-b +bspatch
+  DEPENDS:=@(TARGET_lantiq_xrx200||TARGET_lantiq_xrx200_legacy) +dsl-vrx200-firmware-xdsl-b +bspatch
 endef
 
 define Package/dsl-vrx200-firmware-xdsl-a-patch/description
@@ -76,7 +76,7 @@ define Package/dsl-vrx200-firmware-xdsl-b-patch
   CATEGORY:=Firmware
   TITLE:=VRX200 / VR9 CPE xDSL Annex A to Annex B firmware patch
   URL:=http://www.lantiq.com/
-  DEPENDS:=@TARGET_lantiq_xrx200 +dsl-vrx200-firmware-xdsl-a +bspatch
+  DEPENDS:=@(TARGET_lantiq_xrx200||TARGET_lantiq_xrx200_legacy) +dsl-vrx200-firmware-xdsl-a +bspatch
 endef
 
 define Package/dsl-vrx200-firmware-xdsl-b-patch/description
diff --git a/package/firmware/linux-firmware/Makefile b/package/firmware/linux-firmware/Makefile
index de69360aff5232..a2b78967f7a676 100644
--- a/package/firmware/linux-firmware/Makefile
+++ b/package/firmware/linux-firmware/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=linux-firmware
-PKG_VERSION:=20241017
-PKG_RELEASE:=1
+PKG_VERSION:=20241110
+PKG_RELEASE:=2
 
 PKG_SOURCE_URL:=@KERNEL/linux/kernel/firmware
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
-PKG_HASH:=a26c38ef5a83272f2b98ce8bf8ca1865a852a3deea49ce5a8dd804b914351273
+PKG_HASH:=32e6d3eb5c7fcb69fe5d58976c6deafa0d6552719c6e74835064aff049d25bd7
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 
diff --git a/package/firmware/linux-firmware/broadcom.mk b/package/firmware/linux-firmware/broadcom.mk
index c4e5885f77c232..c37edf211c0b7a 100644
--- a/package/firmware/linux-firmware/broadcom.mk
+++ b/package/firmware/linux-firmware/broadcom.mk
@@ -128,12 +128,18 @@ define Package/brcmfmac-nvram-43455-sdio/install
 	$(LN) \
 		brcmfmac43455-sdio.raspberrypi,4-model-b.txt \
 		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.raspberrypi,5-model-b.txt
+	$(LN) \
+		brcmfmac43455-sdio.raspberrypi,4-model-b.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.raspberrypi,5-compute-module.txt
 	$(LN) \
 		brcmfmac43455-sdio.raspberrypi,4-model-b.txt \
 		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.Raspberry\ Pi\ Foundation-Raspberry\ Pi\ Compute\ Module\ 4.txt
 	$(LN) \
 		brcmfmac43455-sdio.raspberrypi,4-model-b.txt \
 		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.Raspberry\ Pi\ Foundation-Raspberry\ Pi\ 5\ Model\ B.txt
+	$(LN) \
+		brcmfmac43455-sdio.raspberrypi,4-model-b.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43455-sdio.Raspberry\ Pi\ Foundation-Raspberry\ Pi\ Compute\ Module\ 5.txt
 	$(INSTALL_DATA) \
 		$(PKG_BUILD_DIR)/brcm/brcmfmac43455-sdio.MINIX-NEO\ Z83-4.txt \
 		$(1)/lib/firmware/brcm/
diff --git a/package/firmware/linux-firmware/intel.mk b/package/firmware/linux-firmware/intel.mk
index 225b2aa86295e3..eb5ac29159aecf 100644
--- a/package/firmware/linux-firmware/intel.mk
+++ b/package/firmware/linux-firmware/intel.mk
@@ -199,6 +199,14 @@ define Package/iwlwifi-firmware-ax210/install
 endef
 $(eval $(call BuildPackage,iwlwifi-firmware-ax210))
 
+Package/iwlwifi-firmware-ax411 = $(call Package/firmware-default,Intel AX411 firmware)
+define Package/iwlwifi-firmware-ax411/install
+	$(INSTALL_DIR) $(1)/lib/firmware
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-so-a0-gf4-a0-89.ucode $(1)/lib/firmware
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/iwlwifi-so-a0-gf4-a0.pnvm $(1)/lib/firmware
+endef
+$(eval $(call BuildPackage,iwlwifi-firmware-ax411))
+
 Package/iwlwifi-firmware-be200 = $(call Package/firmware-default,Intel BE200 firmware)
 define Package/iwlwifi-firmware-be200/install
 	$(INSTALL_DIR) $(1)/lib/firmware
@@ -216,29 +224,49 @@ define Package/e100-firmware/install
 endef
 $(eval $(call BuildPackage,e100-firmware))
 
-Package/intel-igpu-firmware-dmc = $(call Package/firmware-default,Intel iGPU DMC Display MC firmware)
-define Package/intel-igpu-firmware-dmc/install
+i915_deps:=+i915-firmware-dmc +i915-firmware-guc +i915-firmware-huc +i915-firmware-gsc
+Package/i915-firmware = $(call Package/firmware-default,Intel I915 firmware \(meta package\),$(i915_deps),LICENSE.i915)
+define Package/i915-firmware/install
+	true
+endef
+$(eval $(call BuildPackage,i915-firmware))
+
+Package/i915-firmware-dmc = $(call Package/firmware-default,Intel I915 DMC firmware,,LICENSE.i915)
+define Package/i915-firmware-dmc/install
 	$(INSTALL_DIR) $(1)/lib/firmware/i915
-	$(CP) \
-		$(PKG_BUILD_DIR)/i915/*_dmc_*.bin* \
-		$(1)/lib/firmware/i915/
+	for f in $(PKG_BUILD_DIR)/i915/*_dmc*.bin; do                        \
+	  t=`echo $$$${f##*/} | cut -d_ -f2 | cut -d. -f1`;                  \
+	  if [ "$$$$t" = dmc ]; then $(CP) $$$$f $(1)/lib/firmware/i915/; fi \
+	done
 endef
-$(eval $(call BuildPackage,intel-igpu-firmware-dmc))
+$(eval $(call BuildPackage,i915-firmware-dmc))
 
-Package/intel-igpu-firmware-guc = $(call Package/firmware-default,Intel iGPU GUC Graphics MC firmware)
-define Package/intel-igpu-firmware-guc/install
+Package/i915-firmware-guc = $(call Package/firmware-default,Intel I915 GUC firmware,,LICENSE.i915)
+define Package/i915-firmware-guc/install
 	$(INSTALL_DIR) $(1)/lib/firmware/i915
-	$(CP) \
-		$(PKG_BUILD_DIR)/i915/*_guc_*.bin* \
-		$(1)/lib/firmware/i915/
+	for f in $(PKG_BUILD_DIR)/i915/*_guc*.bin; do                        \
+	  t=`echo $$$${f##*/} | cut -d_ -f2 | cut -d. -f1`;                  \
+	  if [ "$$$$t" = guc ]; then $(CP) $$$$f $(1)/lib/firmware/i915/; fi \
+	done
 endef
-$(eval $(call BuildPackage,intel-igpu-firmware-guc))
+$(eval $(call BuildPackage,i915-firmware-guc))
 
-Package/intel-igpu-firmware-huc = $(call Package/firmware-default,Intel iGPU HUC H.265 MC firmware)
-define Package/intel-igpu-firmware-huc/install
+Package/i915-firmware-huc = $(call Package/firmware-default,Intel I915 HUC firmware,,LICENSE.i915)
+define Package/i915-firmware-huc/install
 	$(INSTALL_DIR) $(1)/lib/firmware/i915
-	$(CP) \
-		$(PKG_BUILD_DIR)/i915/*_huc_*.bin* \
-		$(1)/lib/firmware/i915/
+	for f in $(PKG_BUILD_DIR)/i915/*_huc*.bin; do                        \
+	  t=`echo $$$${f##*/} | cut -d_ -f2 | cut -d. -f1`;                  \
+	  if [ "$$$$t" = huc ]; then $(CP) $$$$f $(1)/lib/firmware/i915/; fi \
+	done
+endef
+$(eval $(call BuildPackage,i915-firmware-huc))
+
+Package/i915-firmware-gsc = $(call Package/firmware-default,Intel I915 GSC firmware,,LICENSE.i915)
+define Package/i915-firmware-gsc/install
+	$(INSTALL_DIR) $(1)/lib/firmware/i915
+	for f in $(PKG_BUILD_DIR)/i915/*_gsc*.bin; do                        \
+	  t=`echo $$$${f##*/} | cut -d_ -f2 | cut -d. -f1`;                  \
+	  if [ "$$$$t" = gsc ]; then $(CP) $$$$f $(1)/lib/firmware/i915/; fi \
+	done
 endef
-$(eval $(call BuildPackage,intel-igpu-firmware-huc))
+$(eval $(call BuildPackage,i915-firmware-gsc))
diff --git a/package/firmware/linux-firmware/qca_ath11k.mk b/package/firmware/linux-firmware/qca_ath11k.mk
index 3571198d1b666b..9fdd6119488dd9 100644
--- a/package/firmware/linux-firmware/qca_ath11k.mk
+++ b/package/firmware/linux-firmware/qca_ath11k.mk
@@ -10,7 +10,11 @@ Package/ath11k-firmware-wcn6750 = $(call Package/firmware-default,WCN6750 ath11k
 define Package/ath11k-firmware-wcn6750/install
 	$(INSTALL_DIR) $(1)/lib/firmware/ath11k/WCN6750/hw1.0
 	$(INSTALL_DATA) \
-		$(PKG_BUILD_DIR)/ath11k/WCN6750/hw1.0/* $(1)/lib/firmware/ath11k/WCN6750/hw1.0/
+		$(PKG_BUILD_DIR)/ath11k/WCN6750/hw1.0/board-2.bin $(1)/lib/firmware/ath11k/WCN6750/hw1.0/
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/ath11k/WCN6750/hw1.0/Notice.txt $(1)/lib/firmware/ath11k/WCN6750/hw1.0/
+	$(INSTALL_DATA) \
+	        $(PKG_BUILD_DIR)/ath11k/WCN6750/hw1.0/sc7280/wpss.mbn $(1)/lib/firmware/ath11k/WCN6750/hw1.0/
 endef
 $(eval $(call BuildPackage,ath11k-firmware-wcn6750))
 
diff --git a/package/firmware/linux-firmware/realtek.mk b/package/firmware/linux-firmware/realtek.mk
index c2ab1c9d0dee0a..749d93be3e2909 100644
--- a/package/firmware/linux-firmware/realtek.mk
+++ b/package/firmware/linux-firmware/realtek.mk
@@ -140,6 +140,20 @@ define Package/rtl8761bu-firmware/install
 endef
 $(eval $(call BuildPackage,rtl8761bu-firmware))
 
+Package/rtl8812a-firmware = $(call Package/firmware-default,RealTek RTL8812AU firmware)
+define Package/rtl8812a-firmware/install
+	$(INSTALL_DIR) $(1)/lib/firmware/rtw88
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtw88/rtw8812a_fw.bin $(1)/lib/firmware/rtw88
+endef
+$(eval $(call BuildPackage,rtl8812a-firmware))
+
+Package/rtl8821a-firmware = $(call Package/firmware-default,RealTek RTL8821AU firmware)
+define Package/rtl8821a-firmware/install
+	$(INSTALL_DIR) $(1)/lib/firmware/rtw88
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/rtw88/rtw8821a_fw.bin $(1)/lib/firmware/rtw88
+endef
+$(eval $(call BuildPackage,rtl8821a-firmware))
+
 Package/rtl8821ae-firmware = $(call Package/firmware-default,RealTek RTL8821AE firmware,,LICENCE.rtlwifi_firmware.txt)
 define Package/rtl8821ae-firmware/install
 	$(INSTALL_DIR) $(1)/lib/firmware/rtlwifi
diff --git a/package/firmware/murata-firmware/Makefile b/package/firmware/murata-firmware/Makefile
new file mode 100644
index 00000000000000..1d9efda576201c
--- /dev/null
+++ b/package/firmware/murata-firmware/Makefile
@@ -0,0 +1,57 @@
+#
+# Copyright (C) 2024 Bootlin
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=murata-firmware
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_DATE:=2024-09-12
+PKG_SOURCE_URL:=https://github.com/murata-wireless/cyw-fmac-fw.git
+PKG_MIRROR_HASH:=26f8a2df800666daab183b2842e5b3d591b1e5b31769d5429f9d70527f43d152
+PKG_SOURCE_VERSION:=50ac17bb65b2342cd954d49d9bc492709d431c3c
+
+PKG_MAINTAINER:=Thomas Richard <thomas.richard@bootlin.com>
+PKG_LICENSE_FILES:=LICENCE
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/murata-firmware-default
+  SECTION:=firmware
+  CATEGORY:=Firmware
+  URL:=https://community.murata.com/
+endef
+
+define Build/Compile
+endef
+
+define Package/murata-firmware-43430-sdio
+  $(Package/murata-firmware-default)
+  TITLE:=BCM43430 FullMac SDIO firmware
+  CONFLICTS:=cypress-firmware-43430-sdio
+endef
+
+define Package/murata-firmware-43430-sdio/install
+	$(INSTALL_DIR) $(1)/lib/firmware/murata
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/cyfmac43430-sdio.bin \
+		$(1)/lib/firmware/murata/
+	$(INSTALL_DATA) \
+		$(PKG_BUILD_DIR)/cyfmac43430-sdio.1DX.clm_blob \
+		$(1)/lib/firmware/murata/
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(LN) \
+		../murata/cyfmac43430-sdio.bin \
+		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.bin
+	$(LN) \
+		../murata/cyfmac43430-sdio.1DX.clm_blob \
+		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.clm_blob
+endef
+
+$(eval $(call BuildPackage,murata-firmware-43430-sdio))
+
diff --git a/package/firmware/murata-nvram/Makefile b/package/firmware/murata-nvram/Makefile
new file mode 100644
index 00000000000000..daf382e3bc003d
--- /dev/null
+++ b/package/firmware/murata-nvram/Makefile
@@ -0,0 +1,48 @@
+#
+# Copyright (C) 2024 Bootlin
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=murata-nvram
+PKG_RELEASE:=1
+
+PKG_SOURCE_PROTO:=git
+PKG_SOURCE_DATE:=2024-09-28
+PKG_SOURCE_URL:=https://github.com/murata-wireless/cyw-fmac-nvram.git
+PKG_MIRROR_HASH:=e2fc6f1f9898edfd67f5495e615882700f03b42a75efa2e3f4e2d524aed0efb8
+PKG_SOURCE_VERSION:=255819aab07572d87576a13329ef9d4c654167aa
+
+PKG_MAINTAINER:=Thomas Richard <thomas.richard@bootlin.com>
+PKG_LICENSE_FILES:=LICENCE.cypress
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/murata-nvram-default
+  SECTION:=firmware
+  CATEGORY:=Firmware
+  URL:=https://community.murata.com/
+endef
+
+define Build/Compile
+endef
+
+define Package/murata-nvram-43430-sdio
+  $(Package/murata-nvram-default)
+  TITLE:=BCM43430 SDIO NVRAM
+  CONFLICTS:=brcmfmac-nvram-43430-sdio
+endef
+
+define Package/murata-nvram-43430-sdio/install
+	$(INSTALL_DIR) $(1)/lib/firmware/brcm
+	$(INSTALL_DATA)	./files/cyfmac43430-sdio.1DX.stm32.txt \
+		$(1)/lib/firmware/brcm/
+	$(LN) \
+		cyfmac43430-sdio.1DX.stm32.txt \
+		$(1)/lib/firmware/brcm/brcmfmac43430-sdio.st,stm32mp135f-dk.txt
+endef
+
+$(eval $(call BuildPackage,murata-nvram-43430-sdio))
diff --git a/package/firmware/murata-nvram/files/cyfmac43430-sdio.1DX.stm32.txt b/package/firmware/murata-nvram/files/cyfmac43430-sdio.1DX.stm32.txt
new file mode 100755
index 00000000000000..f06abf03808e94
--- /dev/null
+++ b/package/firmware/murata-nvram/files/cyfmac43430-sdio.1DX.stm32.txt
@@ -0,0 +1,47 @@
+# This NVRAM file is based on cyfmac43430-sdio.1DX.txt, except that the muxenab
+# parameter was unset to enable IB IRQ (OOB IRQ is not stable on STM32
+# platforms).
+# 2.4 GHz, 20 MHz BW mode
+manfid=0x2d0
+prodid=0x0726
+vendid=0x14e4
+devid=0x43e2
+boardtype=0x0726
+boardrev=0x1202
+boardnum=22
+macaddr=00:90:4c:c5:12:38
+sromrev=11
+boardflags=0x00404201
+boardflags3=0x08000000
+xtalfreq=37400
+nocrc=1
+ag0=0
+aa2g=1
+ccode=ALL
+#pa0itssit=0x20
+extpagain2g=0
+pa2ga0=-145,6667,-751
+AvVmid_c0=0x0,0xc8
+cckpwroffset0=2
+maxp2ga0=74
+#txpwrbckof=6
+cckbw202gpo=0
+legofdmbw202gpo=0x88888888
+mcsbw202gpo=0xaaaaaaaa
+propbw202gpo=0xdd
+ofdmdigfilttype=18
+ofdmdigfilttypebe=18
+papdmode=1
+papdvalidtest=1
+pacalidx2g=48
+papdepsoffset=-22
+papdendidx=58
+il0macaddr=00:90:4c:c5:12:38
+wl0id=0x431b
+# muxenab defined to enable OOB IRQ. Level sensitive interrupt via WL_HOST_WAKE line. 
+# muxenab=0x10
+#BT COEX deferral limit setting
+#btc_params 8 45000
+#btc_params 10 20000
+#spurconfig=0x3
+# End of NVRAM - do not remove this line #
diff --git a/package/firmware/omnia-mcu-firmware/Makefile b/package/firmware/omnia-mcu-firmware/Makefile
index 6f7bd6ca70737e..9c1c8fbe6c6b55 100644
--- a/package/firmware/omnia-mcu-firmware/Makefile
+++ b/package/firmware/omnia-mcu-firmware/Makefile
@@ -29,7 +29,6 @@ define Package/omnia-mcu-firmware
   CATEGORY:=Firmware
   URL:=https://gitlab.nic.cz/turris/hw/$(PKG_DISTNAME)/-/releases
   TITLE:=CZ.NIC Turris Omnia MCU firmware
-  DEPENDS:=@TARGET_mvebu_cortexa9_DEVICE_cznic_turris-omnia
 endef
 
 define Package/omnia-mcu-firmware/description
diff --git a/package/firmware/wireless-regdb/Makefile b/package/firmware/wireless-regdb/Makefile
index 7d4cf63c479f4b..d45c95e5e3d4f0 100644
--- a/package/firmware/wireless-regdb/Makefile
+++ b/package/firmware/wireless-regdb/Makefile
@@ -1,14 +1,14 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wireless-regdb
-PKG_VERSION:=2024.10.07
+PKG_VERSION:=2025.07.10
 PKG_RELEASE:=1
 PKG_LICENSE:=ISC
 PKG_LICENSE_FILES:=LICENSE
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/software/network/wireless-regdb/
-PKG_HASH:=f76f2bd79a653e9f9dd50548d99d03a4a4eb157da056dfd5892f403ec28fb3d5
+PKG_HASH:=a8340bcdcd1b5db6c79149879d122b170f3bb075381718d4f429ad831a6fa28d
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 
diff --git a/package/kernel/ath10k-ct/patches/130-ath10k-read-qcom-coexist-support-as-a-u32.patch b/package/kernel/ath10k-ct/patches/130-ath10k-read-qcom-coexist-support-as-a-u32.patch
deleted file mode 100644
index 61090a49d0e44f..00000000000000
--- a/package/kernel/ath10k-ct/patches/130-ath10k-read-qcom-coexist-support-as-a-u32.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From 630df9786fdaeb78c21f1e28c9b70ac83a1b482c Mon Sep 17 00:00:00 2001
-From: Vincent Tremblay <vincent@vtremblay.dev>
-Date: Sat, 31 Dec 2022 09:24:00 -0500
-Subject: [PATCH] ath10k: read qcom,coexist-support as a u32
-
-Read qcom,coexist-support as a u32 instead of a u8
-
-When we set the property to <1> in the DT (as specified in the doc),
-"of_property_read_u8" read 0 instead of 1. This is because of the data format. 
-
-By default <1> is written with 32 bits. 
-The problem is that the driver is trying to read a u8.
-
-The difference can be visualized using hexdump in a running device:
-Default 32 bits output:
-=======================
-0000000 0000 0100
-0000004
-
-8 bits output:
-==============
-0000000 0001
-0000001
-
-By changing "of_property_read_u8" by "of_property_read_u32", the driver
-is aligned with the documentation and is able to read the value without
-modifying the DT.
-
-The other solution would be to force the value in the DT to be saved as
-an 8 bits value (qcom,coexist-support = /bits/ 8 <1>), 
-which is against the doc and less intuitive.
-
-Validation:
-===========
-The patch was tested on a real device and we can see in the debug logs
-that the feature is properly initialized:
-
-[  109.102097] ath10k_ahb a000000.wifi: boot coex_support 1 coex_gpio_pin 52
-
-Signed-off-by: Vincent Tremblay <vincent@vtremblay.dev>
-
---- a/ath10k-6.10/core.c
-+++ b/ath10k-6.10/core.c
-@@ -2871,14 +2871,14 @@ done:
- static void ath10k_core_fetch_btcoex_dt(struct ath10k *ar)
- {
- 	struct device_node *node;
--	u8 coex_support = 0;
-+	u32 coex_support = 0;
- 	int ret;
- 
- 	node = ar->dev->of_node;
- 	if (!node)
- 		goto out;
- 
--	ret = of_property_read_u8(node, "qcom,coexist-support", &coex_support);
-+	ret = of_property_read_u32(node, "qcom,coexist-support", &coex_support);
- 	if (ret) {
- 		ar->coex_support = true;
- 		goto out;
diff --git a/package/kernel/ath10k-ct/patches/205-ath10k-ct-silence-warning-caused-by-unsupported-retr.patch b/package/kernel/ath10k-ct/patches/205-ath10k-ct-silence-warning-caused-by-unsupported-retr.patch
new file mode 100644
index 00000000000000..9d6b0954ff027f
--- /dev/null
+++ b/package/kernel/ath10k-ct/patches/205-ath10k-ct-silence-warning-caused-by-unsupported-retr.patch
@@ -0,0 +1,34 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Fri, 28 Mar 2025 20:26:04 +0800
+Subject: [PATCH] ath10k-ct: silence warning caused by unsupported retry_limit
+ value
+
+Some retry_limit values are not supported by ath10k wave2 chips.
+We can just skip config it for these chips. And it's safe to
+return 0 in this case because the hardware is still working.
+
+Suggested-by: Ben Greear <greearb@candelatech.com>
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ ath10k-6.14/mac.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/ath10k-6.10/mac.c
++++ b/ath10k-6.10/mac.c
+@@ -5395,7 +5395,7 @@ static int ath10k_config_retry_limit(str
+ 		 */
+ 		ath10k_warn(ar, "Firmware lacks feature flag indicating a retry limit of > 2 is OK, requested limit: %d\n",
+ 			    limit);
+-		return -EINVAL;
++		goto skip_retry_limit;
+ 	}
+ 
+ 	list_for_each_entry(arvif, &ar->arvifs, list) {
+@@ -5406,6 +5406,7 @@ static int ath10k_config_retry_limit(str
+ 		}
+ 	}
+ 
++skip_retry_limit:
+ 	return ret;
+ }
+ 
diff --git a/package/kernel/ath10k-ct/patches/206-ath10k-ct-silence-noisy-log-caused-by-flushing-queue.patch b/package/kernel/ath10k-ct/patches/206-ath10k-ct-silence-noisy-log-caused-by-flushing-queue.patch
new file mode 100644
index 00000000000000..8b8042e5d701d8
--- /dev/null
+++ b/package/kernel/ath10k-ct/patches/206-ath10k-ct-silence-noisy-log-caused-by-flushing-queue.patch
@@ -0,0 +1,31 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Fri, 28 Mar 2025 21:02:27 +0800
+Subject: [PATCH] ath10k-ct: silence noisy log caused by flushing queue
+
+.flush() is a regular mac80211 operation aims to clear all pending
+frames from the hardware queue. Only developers need to care about it.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ ath10k-6.14/mac.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/ath10k-6.10/mac.c
++++ b/ath10k-6.10/mac.c
+@@ -9061,12 +9061,12 @@ static void ath10k_flush(struct ieee8021
+         if (vif) {
+                 arvif = (void *)vif->drv_priv;
+                 vid = arvif->vdev_id;
+-                ath10k_info(ar, "mac flush vdev %d drop %d queues 0x%x ar->paused: 0x%lx  arvif->paused: 0x%lx\n",
+-                            arvif->vdev_id, drop, queues, ar->tx_paused, arvif->tx_paused);
++                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac flush vdev %d drop %d queues 0x%x ar->paused: 0x%lx  arvif->paused: 0x%lx\n",
++                           arvif->vdev_id, drop, queues, ar->tx_paused, arvif->tx_paused);
+         }
+         else {
+-                ath10k_info(ar, "mac flush null vif, drop %d queues 0x%x\n",
+-                            drop, queues);
++                ath10k_dbg(ar, ATH10K_DBG_MAC, "mac flush null vif, drop %d queues 0x%x\n",
++                           drop, queues);
+         }
+ 
+ 
diff --git a/package/kernel/ath10k-ct/patches/988-ath10k-always-use-mac80211-loss-detection.patch b/package/kernel/ath10k-ct/patches/988-ath10k-always-use-mac80211-loss-detection.patch
index 35026cc0f943d5..1f9f38c2b04dae 100644
--- a/package/kernel/ath10k-ct/patches/988-ath10k-always-use-mac80211-loss-detection.patch
+++ b/package/kernel/ath10k-ct/patches/988-ath10k-always-use-mac80211-loss-detection.patch
@@ -18,7 +18,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/ath10k-6.10/mac.c
 +++ b/ath10k-6.10/mac.c
-@@ -11316,7 +11316,6 @@ int ath10k_mac_register(struct ath10k *a
+@@ -11317,7 +11317,6 @@ int ath10k_mac_register(struct ath10k *a
  	ieee80211_hw_set(ar->hw, CHANCTX_STA_CSA);
  	ieee80211_hw_set(ar->hw, QUEUE_CONTROL);
  	ieee80211_hw_set(ar->hw, SUPPORTS_TX_FRAG);
diff --git a/package/kernel/bcm27xx-gpu-fw/Makefile b/package/kernel/bcm27xx-gpu-fw/Makefile
index 6de2fd7501c45b..2d90406b58926d 100644
--- a/package/kernel/bcm27xx-gpu-fw/Makefile
+++ b/package/kernel/bcm27xx-gpu-fw/Makefile
@@ -2,13 +2,13 @@ include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=bcm27xx-gpu-fw
-PKG_VERSION:=2024.10.08
+PKG_VERSION:=2025.04.30
 PKG_VERSION_REAL:=1.$(subst .,,$(PKG_VERSION))
 PKG_RELEASE:=1
 
 PKG_SOURCE:=raspi-firmware_$(PKG_VERSION_REAL).orig.tar.xz
 PKG_SOURCE_URL:=https://github.com/raspberrypi/firmware/releases/download/$(PKG_VERSION_REAL)
-PKG_HASH:=11e7bedcd0f52729bbc82ae8de3cb3f52eb4ae3d6bdb3e11fbfdbea9c4a2b1c3
+PKG_HASH:=25bcff5992c6d7057de4a5c6834b7f90b7136fe12aa63fa32793329bf74a95bf
 
 PKG_FLAGS:=nonshared
 
@@ -33,6 +33,10 @@ define Build/Compile
 	true
 endef
 
+define Package/bcm27xx-gpu-fw/install
+	true
+endef
+
 define Build/InstallDev
 	$(CP) $(PKG_BUILD_DIR)/boot/bootcode.bin $(KERNEL_BUILD_DIR)
 	$(CP) $(PKG_BUILD_DIR)/boot/LICENCE.broadcom $(KERNEL_BUILD_DIR)
diff --git a/package/kernel/bcm63xx-cfe/Makefile b/package/kernel/bcm63xx-cfe/Makefile
index 9bd61afdead5c3..8b6fa8010c650b 100644
--- a/package/kernel/bcm63xx-cfe/Makefile
+++ b/package/kernel/bcm63xx-cfe/Makefile
@@ -6,9 +6,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_URL:=https://github.com/openwrt/bcm63xx-cfe.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2024-06-25
-PKG_SOURCE_VERSION:=6519bd2dde3535cafeea43157755f4dbef2f90c5
-PKG_MIRROR_HASH:=db4da580b7a611a2b4ddd4ff812e5f8ddfd9694b6f5fd8246a341e61967c00ef
+PKG_SOURCE_DATE:=2025-04-02
+PKG_SOURCE_VERSION:=b8128fa4bdcdaf97549138965b00d5d7ceb7bb0f
+PKG_MIRROR_HASH:=d33fad4fb5f4419bb287f3c3df6cceabab01fc7852c24cf29a15befa38cc0d45
 
 PKG_FLAGS:=nonshared
 
diff --git a/package/kernel/cryptodev-linux/Makefile b/package/kernel/cryptodev-linux/Makefile
index ea1bd241617b7d..165cc60487b5b0 100644
--- a/package/kernel/cryptodev-linux/Makefile
+++ b/package/kernel/cryptodev-linux/Makefile
@@ -28,7 +28,7 @@ include $(INCLUDE_DIR)/package.mk
 define KernelPackage/cryptodev
   SUBMENU:=Cryptographic API modules
   TITLE:=Driver for cryptographic acceleration
-  URL:=http://cryptodev-linux.org/
+  URL:=https://github.com/cryptodev-linux/cryptodev-linux
   DEPENDS:=+kmod-crypto-authenc +kmod-crypto-hash
   FILES:=$(PKG_BUILD_DIR)/cryptodev.$(LINUX_KMOD_SUFFIX)
   AUTOLOAD:=$(call AutoLoad,50,cryptodev)
@@ -36,8 +36,9 @@ define KernelPackage/cryptodev
 endef
 
 define KernelPackage/cryptodev/description
-  This is a driver for that allows to use the Linux kernel supported
-  hardware ciphers by user-space applications.
+  This driver allows use of the Linux kernel supported hardware-based
+  cryptographic and hash accelerators by user-space applications,
+  via a "/dev/crypto" device.
 endef
 
 define Build/Configure
diff --git a/package/kernel/gpio-button-hotplug/src/gpio-button-hotplug.c b/package/kernel/gpio-button-hotplug/src/gpio-button-hotplug.c
index 1dd0ff2a1a1abf..9876dee90fc821 100644
--- a/package/kernel/gpio-button-hotplug/src/gpio-button-hotplug.c
+++ b/package/kernel/gpio-button-hotplug/src/gpio-button-hotplug.c
@@ -302,7 +302,7 @@ struct gpio_keys_button_dev {
 
 	struct device *dev;
 	struct gpio_keys_platform_data *pdata;
-	struct gpio_keys_button_data data[0];
+	struct gpio_keys_button_data data[];
 };
 
 static void gpio_keys_polled_queue_work(struct gpio_keys_button_dev *bdev)
@@ -693,7 +693,6 @@ static struct platform_driver gpio_keys_driver = {
 	.remove	= gpio_keys_remove,
 	.driver	= {
 		.name	= "gpio-keys",
-		.owner	= THIS_MODULE,
 		.of_match_table = of_match_ptr(gpio_keys_of_match),
 	},
 };
@@ -703,7 +702,6 @@ static struct platform_driver gpio_keys_polled_driver = {
 	.remove	= gpio_keys_remove,
 	.driver	= {
 		.name	= "gpio-keys-polled",
-		.owner	= THIS_MODULE,
 		.of_match_table = of_match_ptr(gpio_keys_polled_of_match),
 	},
 };
diff --git a/package/kernel/gpio-nct5104d/src/gpio-nct5104d.c b/package/kernel/gpio-nct5104d/src/gpio-nct5104d.c
index e31a94b5cfb20d..ffeab29eda2efa 100644
--- a/package/kernel/gpio-nct5104d/src/gpio-nct5104d.c
+++ b/package/kernel/gpio-nct5104d/src/gpio-nct5104d.c
@@ -366,7 +366,6 @@ nct5104d_gpio_device_add(const struct nct5104d_sio *sio)
 
 static struct platform_driver nct5104d_gpio_driver = {
 	.driver = {
-		.owner	= THIS_MODULE,
 		.name	= DRVNAME,
 	},
 	.probe		= nct5104d_gpio_probe,
diff --git a/package/kernel/lantiq/ltq-adsl-mei/src/drv_mei_cpe.c b/package/kernel/lantiq/ltq-adsl-mei/src/drv_mei_cpe.c
index ba23232ee9429c..5ee5b70b4774e4 100644
--- a/package/kernel/lantiq/ltq-adsl-mei/src/drv_mei_cpe.c
+++ b/package/kernel/lantiq/ltq-adsl-mei/src/drv_mei_cpe.c
@@ -1787,6 +1787,7 @@ extern void ifx_usb_enable_afe_oc(void);
  */
 static irqreturn_t IFX_MEI_IrqHandle (int int1, void *void0)
 {
+	u32 stat;
 	u32 scratch;
 	DSL_DEV_Device_t *pDev = (DSL_DEV_Device_t *) void0;
 #if defined(CONFIG_LTQ_MEI_FW_LOOPBACK) && defined(DFE_PING_TEST)
@@ -1820,6 +1821,12 @@ static irqreturn_t IFX_MEI_IrqHandle (int int1, void *void0)
                 if (dsl_bsp_event_callback[event].function)
                         (*dsl_bsp_event_callback[event].function)(pDev, event, dsl_bsp_event_callback[event].pData);
         } else { // normal message
+                IFX_MEI_LongWordReadOffset (pDev, (u32) ME_ARC2ME_STAT, &stat);
+                if (!(stat & ARC_TO_MEI_MSGAV)) {
+                        // status register indicates there is no message
+                        return IRQ_NONE;
+                }
+
                 IFX_MEI_MailboxRead (pDev, DSL_DEV_PRIVATE(pDev)->CMV_RxMsg, MSG_LENGTH);
                 if (DSL_DEV_PRIVATE(pDev)-> cmv_waiting == 1) {
                         DSL_DEV_PRIVATE(pDev)-> arcmsgav = 1;
@@ -2807,7 +2814,6 @@ static struct platform_driver ltq_mei_driver = {
 	.remove = ltq_mei_remove,
 	.driver = {
 		.name = "lantiq,mei-xway",
-		.owner = THIS_MODULE,
 		.of_match_table = ltq_mei_match,
 	},
 };
diff --git a/package/kernel/lantiq/ltq-adsl/patches/120-platform.patch b/package/kernel/lantiq/ltq-adsl/patches/120-platform.patch
index 7bbcf35cd2834c..69f2b45e321cd3 100644
--- a/package/kernel/lantiq/ltq-adsl/patches/120-platform.patch
+++ b/package/kernel/lantiq/ltq-adsl/patches/120-platform.patch
@@ -36,7 +36,7 @@
  }
  
  #ifndef _lint
-@@ -1159,8 +1159,30 @@ module_param(debug_level, byte, 0);
+@@ -1159,8 +1159,29 @@ module_param(debug_level, byte, 0);
  MODULE_PARM_DESC(debug_level, "set to get more (1) or fewer (4) debug outputs");
  #endif /* #ifndef DSL_DEBUG_DISABLE*/
  
@@ -59,7 +59,6 @@
 +	.remove = __devexit_p(ltq_adsl_remove),
 +	.driver = {
 +		.name = "adsl",
-+		.owner = THIS_MODULE,
 +		.of_match_table = ltq_adsl_match,
 +	},
 +};
diff --git a/package/kernel/lantiq/ltq-atm/Makefile b/package/kernel/lantiq/ltq-atm/Makefile
index b81f3bb2938224..ca19c5052e9b24 100644
--- a/package/kernel/lantiq/ltq-atm/Makefile
+++ b/package/kernel/lantiq/ltq-atm/Makefile
@@ -33,7 +33,7 @@ endef
 KernelPackage/ltq-atm-danube=$(call KernelPackage/ltq-atm-template,danube,(TARGET_lantiq_xway||TARGET_lantiq_xway_legacy))
 KernelPackage/ltq-atm-ar9=$(call KernelPackage/ltq-atm-template,ar9,TARGET_lantiq_xway)
 KernelPackage/ltq-atm-ase=$(call KernelPackage/ltq-atm-template,ase,TARGET_lantiq_ase)
-KernelPackage/ltq-atm-vr9=$(call KernelPackage/ltq-atm-template,vr9,TARGET_lantiq_xrx200)
+KernelPackage/ltq-atm-vr9=$(call KernelPackage/ltq-atm-template,vr9,(TARGET_lantiq_xrx200||TARGET_lantiq_xrx200_legacy))
 
 define Build/Configure
 endef
diff --git a/package/kernel/lantiq/ltq-atm/src/ltq_atm.c b/package/kernel/lantiq/ltq-atm/src/ltq_atm.c
index 0cb49a59bd0e4d..6b1e0321b3ee17 100644
--- a/package/kernel/lantiq/ltq-atm/src/ltq_atm.c
+++ b/package/kernel/lantiq/ltq-atm/src/ltq_atm.c
@@ -1894,7 +1894,6 @@ static struct platform_driver ltq_atm_driver = {
 	.remove = ltq_atm_remove,
 	.driver = {
 		.name = "atm",
-		.owner = THIS_MODULE,
 		.of_match_table = ltq_atm_match,
 	},
 };
diff --git a/package/kernel/lantiq/ltq-deu/Makefile b/package/kernel/lantiq/ltq-deu/Makefile
index 4e8127afabb986..96414bf186f696 100644
--- a/package/kernel/lantiq/ltq-deu/Makefile
+++ b/package/kernel/lantiq/ltq-deu/Makefile
@@ -21,14 +21,14 @@ define KernelPackage/ltq-deu-template
   TITLE:=deu driver for $(1)
   URL:=http://www.lantiq.com/
   VARIANT:=$(1)
-  DEPENDS:=@TARGET_lantiq_$(2) +kmod-crypto-manager +kmod-crypto-des
+  DEPENDS:=@$(2) +kmod-crypto-manager +kmod-crypto-des
   FILES:=$(PKG_BUILD_DIR)/ltq_deu_$(1).ko
   AUTOLOAD:=$(call AutoProbe,ltq_deu_$(1))
 endef
 
-KernelPackage/ltq-deu-danube=$(call KernelPackage/ltq-deu-template,danube,xway)
-KernelPackage/ltq-deu-ar9=$(call KernelPackage/ltq-deu-template,ar9,xway)
-KernelPackage/ltq-deu-vr9=$(call KernelPackage/ltq-deu-template,vr9,xrx200)
+KernelPackage/ltq-deu-danube=$(call KernelPackage/ltq-deu-template,danube,TARGET_lantiq_xway)
+KernelPackage/ltq-deu-ar9=$(call KernelPackage/ltq-deu-template,ar9,TARGET_lantiq_xway)
+KernelPackage/ltq-deu-vr9=$(call KernelPackage/ltq-deu-template,vr9,(TARGET_lantiq_xrx200||TARGET_lantiq_xrx200_legacy))
 
 define Build/Configure
 endef
diff --git a/package/kernel/lantiq/ltq-deu/src/ifxmips_deu.c b/package/kernel/lantiq/ltq-deu/src/ifxmips_deu.c
index 096b8b5bba83fb..e44e84c03cd7a3 100644
--- a/package/kernel/lantiq/ltq-deu/src/ifxmips_deu.c
+++ b/package/kernel/lantiq/ltq-deu/src/ifxmips_deu.c
@@ -196,7 +196,6 @@ static struct platform_driver ltq_deu_driver = {
 	.remove = ltq_deu_remove,
 	.driver = {
 		.name = "deu",
-		.owner = THIS_MODULE,
 		.of_match_table = ltq_deu_match,
 	},
 };
diff --git a/package/kernel/lantiq/ltq-ptm/Makefile b/package/kernel/lantiq/ltq-ptm/Makefile
index 03b121887470d0..c3ab47c1b3e5fb 100644
--- a/package/kernel/lantiq/ltq-ptm/Makefile
+++ b/package/kernel/lantiq/ltq-ptm/Makefile
@@ -22,7 +22,7 @@ define KernelPackage/ltq-ptm-template
   TITLE:=ptm driver for $(1)
   URL:=http://www.lantiq.com/
   VARIANT:=$(1)
-  DEPENDS:=@TARGET_lantiq_$(2)
+  DEPENDS:=@$(2)
 ifeq ($(1),vr9)
   DEPENDS+= +PACKAGE_kmod-ltq-ptm-$(1):kmod-ltq-vdsl-vr9-mei
 else
@@ -34,10 +34,10 @@ endif
   FILES:=$(PKG_BUILD_DIR)/ltq_ptm_$(1).ko 
 endef
 
-KernelPackage/ltq-ptm-danube=$(call KernelPackage/ltq-ptm-template,danube,xway)
-KernelPackage/ltq-ptm-ar9=$(call KernelPackage/ltq-ptm-template,ar9,xway)
-KernelPackage/ltq-ptm-ase=$(call KernelPackage/ltq-ptm-template,ase,ase)
-KernelPackage/ltq-ptm-vr9=$(call KernelPackage/ltq-ptm-template,vr9,xrx200)
+KernelPackage/ltq-ptm-danube=$(call KernelPackage/ltq-ptm-template,danube,TARGET_lantiq_xway)
+KernelPackage/ltq-ptm-ar9=$(call KernelPackage/ltq-ptm-template,ar9,TARGET_lantiq_xway)
+KernelPackage/ltq-ptm-ase=$(call KernelPackage/ltq-ptm-template,ase,TARGET_lantiq_ase)
+KernelPackage/ltq-ptm-vr9=$(call KernelPackage/ltq-ptm-template,vr9,(TARGET_lantiq_xrx200||TARGET_lantiq_xrx200_legacy))
 
 define Build/Configure
 endef
diff --git a/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_adsl.c b/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_adsl.c
index 3ff01d588ad24a..5e5535348d832f 100644
--- a/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_adsl.c
+++ b/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_adsl.c
@@ -1600,7 +1600,6 @@ static struct platform_driver ltq_ptm_driver = {
        .remove = ltq_ptm_remove,
        .driver = {
                .name = "ptm",
-               .owner = THIS_MODULE,
                .of_match_table = ltq_ptm_match,
        },
 };
diff --git a/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c b/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c
index 6731904bba9a85..c5bbd9fd874594 100644
--- a/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c
+++ b/package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c
@@ -1138,7 +1138,6 @@ static struct platform_driver ltq_ptm_driver = {
 	.remove = ltq_ptm_remove,
 	.driver = {
 		.name = "ptm",
-		.owner = THIS_MODULE,
 		.of_match_table = ltq_ptm_match,
 	},
 };
diff --git a/package/kernel/lantiq/ltq-vdsl-fw/Makefile b/package/kernel/lantiq/ltq-vdsl-fw/Makefile
index 88883ffdee0f4a..61833e018c28db 100644
--- a/package/kernel/lantiq/ltq-vdsl-fw/Makefile
+++ b/package/kernel/lantiq/ltq-vdsl-fw/Makefile
@@ -19,7 +19,7 @@ define Package/ltq-vdsl-vr9-vectoring-fw-installer
   TITLE:=VDSL2 Vectoring Firmware installer
   SECTION:=net
   CATEGORY:=Network
-  DEPENDS:=@TARGET_lantiq_xrx200 +kmod-ltq-vdsl-vr9
+  DEPENDS:=@(TARGET_lantiq_xrx200||TARGET_lantiq_xrx200_legacy) +kmod-ltq-vdsl-vr9
 endef
 
 define Build/Prepare
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9-mei/Makefile b/package/kernel/lantiq/ltq-vdsl-vr9-mei/Makefile
index e9c5a681fd0098..9b3dac299feac1 100644
--- a/package/kernel/lantiq/ltq-vdsl-vr9-mei/Makefile
+++ b/package/kernel/lantiq/ltq-vdsl-vr9-mei/Makefile
@@ -29,7 +29,7 @@ define KernelPackage/ltq-vdsl-vr9-mei
   TITLE:=mei driver for vdsl
   SECTION:=sys
   SUBMENU:=Network Devices
-  DEPENDS:=@TARGET_lantiq_xrx200 +kmod-ltq-ifxos +kmod-ltq-vectoring
+  DEPENDS:=@(TARGET_lantiq_xrx200||TARGET_lantiq_xrx200_legacy) +kmod-ltq-ifxos +kmod-ltq-vectoring
   FILES:=$(PKG_BUILD_DIR)/src/drv_mei_cpe.ko
   AUTOLOAD:=$(call AutoLoad,50,drv_mei_cpe)
 endef
@@ -44,7 +44,7 @@ define Package/ltq-vdsl-vr9-mei-test
   CATEGORY:=Network
   TITLE:=Lantiq mei driver test tool
   URL:=http://www.lantiq.com/
-  DEPENDS:=@TARGET_lantiq_xrx200
+  DEPENDS:=@(TARGET_lantiq_xrx200||TARGET_lantiq_xrx200_legacy)
 endef
 
 define Package/ltq-vdsl-vr9-mei-test/description
diff --git a/package/kernel/lantiq/ltq-vdsl-vr9/Makefile b/package/kernel/lantiq/ltq-vdsl-vr9/Makefile
index ebcb935a739dc4..5a53c050d4bfc0 100644
--- a/package/kernel/lantiq/ltq-vdsl-vr9/Makefile
+++ b/package/kernel/lantiq/ltq-vdsl-vr9/Makefile
@@ -29,7 +29,7 @@ define KernelPackage/ltq-vdsl-vr9
   TITLE:=vdsl driver
   SECTION:=sys
   SUBMENU:=Network Devices
-  DEPENDS:=@TARGET_lantiq_xrx200 +kmod-ltq-vdsl-vr9-mei
+  DEPENDS:=@(TARGET_lantiq_xrx200||TARGET_lantiq_xrx200_legacy) +kmod-ltq-vdsl-vr9-mei
   FILES:=$(PKG_BUILD_DIR)/src/drv_dsl_cpe_api.ko
   AUTOLOAD:=$(call AutoLoad,51,drv_dsl_cpe_api)
 endef
diff --git a/package/kernel/lantiq/ltq-vectoring/Makefile b/package/kernel/lantiq/ltq-vectoring/Makefile
index 6076df77428091..ea177942b48c59 100644
--- a/package/kernel/lantiq/ltq-vectoring/Makefile
+++ b/package/kernel/lantiq/ltq-vectoring/Makefile
@@ -20,7 +20,7 @@ define KernelPackage/ltq-vectoring
   CATEGORY:=Kernel modules
   SUBMENU:=Network Devices
   TITLE:=driver for sending vectoring error samples
-  DEPENDS:=@TARGET_lantiq_xrx200
+  DEPENDS:=@(TARGET_lantiq_xrx200||TARGET_lantiq_xrx200_legacy)
   FILES:=$(PKG_BUILD_DIR)/$(MAKE_PATH)/ltq_vectoring.ko
   AUTOLOAD:=$(call AutoLoad,49,ltq_vectoring)
 endef
@@ -38,7 +38,7 @@ define KernelPackage/ltq-vectoring-test
   CATEGORY:=Kernel modules
   SUBMENU:=Network Devices
   TITLE:=driver for testing the vectoring driver
-  DEPENDS:=@TARGET_lantiq_xrx200 +kmod-ltq-vectoring
+  DEPENDS:=@(TARGET_lantiq_xrx200||TARGET_lantiq_xrx200_legacy) +kmod-ltq-vectoring
   FILES:=$(PKG_BUILD_DIR)/$(MAKE_PATH)/ltq_vectoring_test.ko
 endef
 
diff --git a/package/kernel/lantiq/vrx518_tc/Makefile b/package/kernel/lantiq/vrx518_tc/Makefile
index a5718d9d5b2a2d..d92c6d1c639133 100644
--- a/package/kernel/lantiq/vrx518_tc/Makefile
+++ b/package/kernel/lantiq/vrx518_tc/Makefile
@@ -10,7 +10,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=vrx518_tc
 PKG_VERSION:=1.5.12.4
-PKG_RELEASE:=3
+PKG_RELEASE:=4
 PKG_BASE_NAME:=vrx518_tc_drv
 
 UGW_VERSION=8.5.2.10
diff --git a/package/kernel/lantiq/vrx518_tc/patches/100-compat.patch b/package/kernel/lantiq/vrx518_tc/patches/100-compat.patch
index d04c1ed5df0dc2..81e32369baefcc 100644
--- a/package/kernel/lantiq/vrx518_tc/patches/100-compat.patch
+++ b/package/kernel/lantiq/vrx518_tc/patches/100-compat.patch
@@ -166,7 +166,7 @@
  
 -	return (skb->DW0 >> 3) & 0xF;
 +// 	return (skb->DW0 >> 3) & 0xF;
-+	return 1;
++	return 0;	/* We use only one connection for now, so return the first connection id */
  }
  
  static int atm_get_qid_by_vcc(struct net_device *dev, struct sk_buff *skb,
diff --git a/package/kernel/lantiq/vrx518_tc/patches/101-dcdp-atm_tc-drop-extra-qos-classes.patch b/package/kernel/lantiq/vrx518_tc/patches/101-dcdp-atm_tc-drop-extra-qos-classes.patch
new file mode 100644
index 00000000000000..5c7b24654538e5
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_tc/patches/101-dcdp-atm_tc-drop-extra-qos-classes.patch
@@ -0,0 +1,144 @@
+Extra ATM traffic classes requires atm_qos struct extension and a set of
+new defines. What itself requires atm.h updates both in the kernel and
+in the toolchain. On another hand we do not have any real users of these
+traffic classes.
+
+In absence of real user there are no benefits to support this
+functionality. There is only the burden of maintenance of extra patches
+all around the building framework. So just drop these extra QoS traffic
+classes in order to facilitate maintenance and avoid side effects like
+breaking compatibility with existing userspace tools like linux-atm.
+
+Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+--
+--- a/dcdp/atm_tc.c
++++ b/dcdp/atm_tc.c
+@@ -463,34 +463,9 @@ static void set_qsb(struct atm_priv *pri
+ 	/* Weighted Fair Queueing Factor (WFQF) */
+ 	switch (qos->txtp.traffic_class) {
+ 	case ATM_CBR:
+-	case ATM_VBR_RT:
+ 		/*  real time queue gets weighted fair queueing bypass  */
+ 		q_parm_tbl.bit.wfqf = 0;
+ 		break;
+-	case ATM_VBR_NRT:
+-	case ATM_UBR_PLUS:
+-		/*  WFQF calculation here is based on virtual cell rates,
+-		      to reduce granularity for high rates
+-		*/
+-		/*  WFQF is maximum cell rate / garenteed cell rate */
+-		/*  wfqf = qsb_minimum_cell_rate * QSB_WFQ_NONUBR_MAX /
+-			requested_minimum_peak_cell_rate
+-		*/
+-		if (qos->txtp.min_pcr == 0)
+-			q_parm_tbl.bit.wfqf = QSB_WFQ_NONUBR_MAX;
+-		else {
+-			tmp = QSB_GCR_MIN * QSB_WFQ_NONUBR_MAX /
+-				qos->txtp.min_pcr;
+-			if (tmp == 0)
+-				q_parm_tbl.bit.wfqf = 1;
+-			else if (tmp > QSB_WFQ_NONUBR_MAX)
+-				q_parm_tbl.bit.wfqf
+-					= QSB_WFQ_NONUBR_MAX;
+-			else
+-				q_parm_tbl.bit.wfqf = tmp;
+-		}
+-		break;
+-
+ 	case ATM_UBR:
+ 	default:
+ 		q_parm_tbl.bit.wfqf = QSB_WFQ_UBR_BYPASS;
+@@ -498,42 +473,9 @@ static void set_qsb(struct atm_priv *pri
+ 	}
+ 
+ 	/* Sustained Cell Rate (SCR) Leaky Bucket Shaper VBR.0/VBR.1 */
+-	if (qos->txtp.traffic_class == ATM_VBR_RT ||
+-		qos->txtp.traffic_class == ATM_VBR_NRT) {
+-		if (qos->txtp.scr == 0) {
+-			/* disable shaper */
+-			q_vbr_parm_tbl.bit.taus = 0;
+-			q_vbr_parm_tbl.bit.ts = 0;
+-		} else {
+-			/* Cell Loss Priority  (CLP) */
+-			if ((vcc->atm_options & ATM_ATMOPT_CLP))
+-				/* CLP1 */
+-				q_parm_tbl.bit.vbr = 1;
+-			else
+-				/* CLP0 */
+-				q_parm_tbl.bit.vbr = 0;
+-			/* Rate Shaper Parameter (TS) and
+-			    Burst Tolerance Parameter for SCR (tauS)
+-			*/
+-			tmp = ((qsb_clk * param->qsb_tstep) >> 5) /
+-					qos->txtp.scr + 1;
+-			q_vbr_parm_tbl.bit.ts
+-				= tmp > QSB_TP_TS_MAX ? QSB_TP_TS_MAX : tmp;
+-			tmp = (qos->txtp.mbs - 1) *
+-				(q_vbr_parm_tbl.bit.ts -
+-					q_parm_tbl.bit.tp) / 64;
+-			if (tmp == 0)
+-				q_vbr_parm_tbl.bit.taus = 1;
+-			else if (tmp > QSB_TAUS_MAX)
+-				q_vbr_parm_tbl.bit.taus
+-					= QSB_TAUS_MAX;
+-			else
+-				q_vbr_parm_tbl.bit.taus = tmp;
+-		}
+-	} else {
+-		q_vbr_parm_tbl.bit.taus = 0;
+-		q_vbr_parm_tbl.bit.ts = 0;
+-	}
++	/* NB: shaper disabled since there no user interface to activate it */
++	q_vbr_parm_tbl.bit.taus = 0;
++	q_vbr_parm_tbl.bit.ts = 0;
+ 
+ 	/* Queue Parameter Table (QPT) */
+ 	tc_w32(QSB_QPT_SET_MASK, QSB_RTM);
+@@ -1064,15 +1006,6 @@ static int ppe_open(struct atm_vcc *vcc)
+ 	/* check bandwidth */
+ 	if ((vcc->qos.txtp.traffic_class == ATM_CBR &&
+ 		vcc->qos.txtp.max_pcr >
+-			(port->tx_max_cell_rate - port->tx_used_cell_rate))
+-		|| (vcc->qos.txtp.traffic_class == ATM_VBR_RT &&
+-		vcc->qos.txtp.max_pcr >
+-			(port->tx_max_cell_rate - port->tx_used_cell_rate))
+-		|| (vcc->qos.txtp.traffic_class == ATM_VBR_NRT &&
+-		vcc->qos.txtp.scr >
+-			(port->tx_max_cell_rate - port->tx_used_cell_rate))
+-		|| (vcc->qos.txtp.traffic_class == ATM_UBR_PLUS &&
+-		vcc->qos.txtp.min_pcr >
+ 			(port->tx_max_cell_rate - port->tx_used_cell_rate))) {
+ 		tc_dbg(priv->tc_priv, MSG_INIT, "exceed TX line rate\n");
+ 		return -EINVAL;
+@@ -1128,15 +1061,8 @@ static int ppe_open(struct atm_vcc *vcc)
+ 	/*  reserve bandwidth */
+ 	switch (vcc->qos.txtp.traffic_class) {
+ 	case ATM_CBR:
+-	case ATM_VBR_RT:
+ 		port->tx_used_cell_rate += vcc->qos.txtp.max_pcr;
+ 		break;
+-	case ATM_VBR_NRT:
+-		port->tx_used_cell_rate += vcc->qos.txtp.scr;
+-		break;
+-	case ATM_UBR_PLUS:
+-		port->tx_used_cell_rate += vcc->qos.txtp.min_pcr;
+-		break;
+ 	}
+ 
+ 	/* update atm_vcc structure */
+@@ -1222,15 +1148,8 @@ static void ppe_close(struct atm_vcc *vc
+ 	/* release bandwidth */
+ 	switch (vcc->qos.txtp.traffic_class) {
+ 	case ATM_CBR:
+-	case ATM_VBR_RT:
+ 		port->tx_used_cell_rate -= vcc->qos.txtp.max_pcr;
+ 		break;
+-	case ATM_VBR_NRT:
+-		port->tx_used_cell_rate -= vcc->qos.txtp.scr;
+-		break;
+-	case ATM_UBR_PLUS:
+-		port->tx_used_cell_rate -= vcc->qos.txtp.min_pcr;
+-		break;
+ 	}
+ 
+ 	/* idle for a while to let parallel operation finish */
diff --git a/package/kernel/lantiq/vrx518_tc/patches/200-swplat.patch b/package/kernel/lantiq/vrx518_tc/patches/200-swplat.patch
index edc97998b739de..930fa6632c373f 100644
--- a/package/kernel/lantiq/vrx518_tc/patches/200-swplat.patch
+++ b/package/kernel/lantiq/vrx518_tc/patches/200-swplat.patch
@@ -3,7 +3,7 @@ This replaces it by a basic working implementation.
 
 --- a/dcdp/atm_tc.c
 +++ b/dcdp/atm_tc.c
-@@ -603,7 +603,11 @@ static void atm_aca_init(struct atm_priv
+@@ -545,7 +545,11 @@ static void atm_aca_init(struct atm_priv
  	cfg = &priv->tc_priv->cfg;
  
  	txin = &param.aca_txin;
@@ -15,7 +15,7 @@ This replaces it by a basic working implementation.
  	txin->hd_size_in_dw = cfg->txin.soc_desc_dwsz;
  	txin->pd_desc_base = SB_XBAR_ADDR(__ACA_TX_IN_PD_LIST_BASE);
  	txin->pd_desc_num = __ACA_TX_IN_PD_LIST_NUM;
-@@ -625,7 +629,11 @@ static void atm_aca_init(struct atm_priv
+@@ -567,7 +571,11 @@ static void atm_aca_init(struct atm_priv
  		txin->soc_cmlt_cnt_addr);
  
  	txout = &param.aca_txout;
@@ -27,7 +27,7 @@ This replaces it by a basic working implementation.
  	txout->hd_size_in_dw = cfg->txout.soc_desc_dwsz;
  	txout->pd_desc_base = SB_XBAR_ADDR(__ACA_TX_OUT_PD_LIST_BASE);
  	txout->pd_desc_num = __ACA_TX_OUT_PD_LIST_NUM;
-@@ -647,7 +655,11 @@ static void atm_aca_init(struct atm_priv
+@@ -589,7 +597,11 @@ static void atm_aca_init(struct atm_priv
  		txout->soc_cmlt_cnt_addr);
  
  	rxout = &param.aca_rxout;
@@ -39,7 +39,7 @@ This replaces it by a basic working implementation.
  	rxout->hd_size_in_dw = cfg->rxout.soc_desc_dwsz;
  	rxout->pd_desc_base = SB_XBAR_ADDR(__ACA_RX_OUT_PD_LIST_BASE);
  	rxout->pd_desc_num = __ACA_RX_OUT_PD_LIST_NUM;
-@@ -669,7 +681,11 @@ static void atm_aca_init(struct atm_priv
+@@ -611,7 +623,11 @@ static void atm_aca_init(struct atm_priv
  		rxout->soc_cmlt_cnt_addr);
  
  	rxin = &param.aca_rxin;
@@ -51,7 +51,7 @@ This replaces it by a basic working implementation.
  	rxin->hd_size_in_dw = cfg->rxin.soc_desc_dwsz;
  	rxin->pd_desc_base = SB_XBAR_ADDR(__RX_IN_PD_DES_LIST_BASE);
  	rxin->pd_desc_num = __ACA_RX_IN_PD_LIST_NUM;
-@@ -1261,7 +1277,7 @@ static int ppe_ioctl(struct atm_dev *dev
+@@ -1180,7 +1196,7 @@ static int ppe_ioctl(struct atm_dev *dev
  static int ppe_send(struct atm_vcc *vcc, struct sk_buff *skb)
  {
  	int ret, qid, mpoa_pt, mpoa_type, vid;
@@ -60,7 +60,7 @@ This replaces it by a basic working implementation.
  	struct atm_priv *priv;
  
  	if (!vcc) {
-@@ -1327,12 +1343,14 @@ static int ppe_send(struct atm_vcc *vcc,
+@@ -1246,12 +1262,14 @@ static int ppe_send(struct atm_vcc *vcc,
  	tc_dbg(priv->tc_priv, MSG_TX, "vid: 0x%x, qid: 0x%x\n",
  			vid, qid);
  
@@ -855,12 +855,12 @@ This replaces it by a basic working implementation.
 -			continue;
 +
 +		// this seems to be a pointer to a DS PKT buffer
-+		phyaddr = desc->data_ptr + desc->byte_off;
++		phyaddr = desc->data_ptr;
 +		ptr = plat_mem_virt(phyaddr);
-+
 +		len = desc->data_len;
 +
-+		dma_sync_single_range_for_cpu(pdev, phyaddr, 0, len, DMA_FROM_DEVICE);
++		dma_sync_single_for_cpu(pdev, phyaddr, desc->byte_off + len,
++					DMA_FROM_DEVICE);
 +
 +		skb = netdev_alloc_skb(g_plat_priv->netdev, len);
 +		if (unlikely(!skb)) {
@@ -871,7 +871,7 @@ This replaces it by a basic working implementation.
 -		ring_idx_inc(rxout, idx);
 +
 +		dst = skb_put(skb, len);
-+		memcpy(dst, ptr, len);
++		memcpy(dst, ptr + desc->byte_off, len);
 +
 +		priv->tc_ops.recv(g_plat_priv->netdev, skb);
 +
diff --git a/package/kernel/lantiq/vrx518_tc/patches/202-napi.patch b/package/kernel/lantiq/vrx518_tc/patches/202-napi.patch
index 266beba1a7e41c..75d18138c0803c 100644
--- a/package/kernel/lantiq/vrx518_tc/patches/202-napi.patch
+++ b/package/kernel/lantiq/vrx518_tc/patches/202-napi.patch
@@ -296,7 +296,7 @@
  	priv->tc_ops.umt_start = plat_umt_start;
 --- a/dcdp/atm_tc.c
 +++ b/dcdp/atm_tc.c
-@@ -3650,7 +3650,7 @@ static void atm_aca_ring_config_init(str
+@@ -3569,7 +3569,7 @@ static void atm_aca_ring_config_init(str
  static int atm_ring_init(struct atm_priv *priv)
  {
  	atm_aca_ring_config_init(priv);
@@ -305,7 +305,7 @@
  }
  
  static int atm_init(struct tc_priv *tcpriv, u32 ep_id)
-@@ -4020,7 +4020,7 @@ void atm_tc_unload(void)
+@@ -3939,7 +3939,7 @@ void atm_tc_unload(void)
  	/* unregister device */
  	if (priv->tc_priv->tc_ops.dev_unreg != NULL)
  		priv->tc_priv->tc_ops.dev_unreg(NULL,
diff --git a/package/kernel/lantiq/vrx518_tc/patches/204-dcdp-atm_tc-fix-compilation-warning.patch b/package/kernel/lantiq/vrx518_tc/patches/204-dcdp-atm_tc-fix-compilation-warning.patch
index bf2d82e2b552a1..1b70a663cdd54a 100644
--- a/package/kernel/lantiq/vrx518_tc/patches/204-dcdp-atm_tc-fix-compilation-warning.patch
+++ b/package/kernel/lantiq/vrx518_tc/patches/204-dcdp-atm_tc-fix-compilation-warning.patch
@@ -1,6 +1,6 @@
 --- a/dcdp/atm_tc.c
 +++ b/dcdp/atm_tc.c
-@@ -746,7 +746,8 @@ static void atm_aca_init(struct atm_priv
+@@ -688,7 +688,8 @@ static void atm_aca_init(struct atm_priv
  		ACA_TXOUT_EN | ACA_RXIN_EN | ACA_RXOUT_EN, 1);
  }
  
@@ -10,7 +10,7 @@
  {
  	struct tm nowtm;
  	char tmbuf[64];
-@@ -765,7 +766,8 @@ static int print_datetime(char *buffer,
+@@ -707,7 +708,8 @@ static int print_datetime(char *buffer,
  			nowtm.tm_hour,
  			nowtm.tm_min,
  			nowtm.tm_sec);
@@ -20,7 +20,7 @@
  
  	return 0;
  }
-@@ -967,7 +969,7 @@ void show_atm_pvc(struct seq_file *seq,
+@@ -909,7 +911,7 @@ void show_atm_pvc(struct seq_file *seq,
  	char buf[64];
  
  	seq_printf(seq, "\tNet device: %s\n", pvc->dev->name);
diff --git a/package/kernel/lantiq/vrx518_tc/patches/206-dcdp-ptm_tc-allow-larger-mtu-to-support-rfc4638.patch b/package/kernel/lantiq/vrx518_tc/patches/206-dcdp-ptm_tc-allow-larger-mtu-to-support-rfc4638.patch
new file mode 100644
index 00000000000000..35a709e9fa1ee2
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_tc/patches/206-dcdp-ptm_tc-allow-larger-mtu-to-support-rfc4638.patch
@@ -0,0 +1,34 @@
+From 3983dc1674fec43beb8ce9d9bfdd6302fef86eae Mon Sep 17 00:00:00 2001
+From: Andrew MacIntyre <andymac@pcug.org.au>
+Date: Mon, 4 Nov 2024 22:41:25 +1100
+Subject: [PATCH] vrx518_tc: allow larger MTU to support RFC4638
+
+vrx518_tc currently sets the interface maximum MTU to the ethernet default
+of 1500 bytes by default via ether_setup() called from ptm_setup().
+
+To support 1508 byte baby jumbo frames (RFC4638) for PPPoE connections
+over VDSL links as already supported by the VR9 ltq_ptm driver ([1], [2])
+set the interface maximum MTU to MAX_MTU.
+
+MAX_MTU is defined in dcdp/inc/tc_common.h to 2002 bytes and this value is
+used in ptm_change_mtu() and elsewhere as the maximum MTU, however this is
+short circuited by checks against the interface maximum MTU.
+
+[1]: https://forum.openwrt.org/t/fritzbox-7530-and-rfc4638-baby-jumbo-frames/181327
+[2]: https://git.openwrt.org/?p=openwrt/openwrt.git;a=commit;h=8a2a20e71e2909f84dab47e51dfda9e292a6c1ae
+
+Signed-off-by: Andrew MacIntyre <andymac@pcug.org.au>
+---
+ dcdp/ptm_tc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/dcdp/ptm_tc.c	2023-12-17 16:11:22.503500398 +1100
++++ b/dcdp/ptm_tc.c	2024-01-26 16:48:49.881623474 +1100
+@@ -657,6 +657,7 @@ static void ptm_setup(struct net_device
+ 	ether_setup(dev);
+ 	dev->watchdog_timeo = 10 * HZ;
+ 	dev->netdev_ops = &g_ptm_netdev_ops;
++	dev->max_mtu = MAX_MTU;
+ }
+ 
+ static int ptm_dev_init(struct tc_priv *tc_priv, u32 id,
diff --git a/package/kernel/lantiq/vrx518_tc/patches/207-dcdp-atm_tc-fix-crash-on-subif_reg-absence.patch b/package/kernel/lantiq/vrx518_tc/patches/207-dcdp-atm_tc-fix-crash-on-subif_reg-absence.patch
new file mode 100644
index 00000000000000..f268c0908cb28a
--- /dev/null
+++ b/package/kernel/lantiq/vrx518_tc/patches/207-dcdp-atm_tc-fix-crash-on-subif_reg-absence.patch
@@ -0,0 +1,75 @@
+From: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+Date: Fri, 10 Jan 2025 00:57:27 +0000
+Subject: [PATCH] vrx518_tc: atm_tc: fix crash on subif_reg absence
+
+VRX518 (sw_plat) platform does not provid the subif_reg/subif_unreg ops
+in the same time ATM TC layer unconditionally calls them, what leads to
+the kernel crash on the atm_hook_mpoa_setup hook invocation from the ATM
+stack:
+
+  vrx518_tc:mpoa_setup_sync : sync: conn: 0, vpi: 0, vci: 35, mpoa_type: 0, mpoa_mode: 0
+  Unable to handle kernel NULL pointer dereference at virtual address 00000000
+
+Subif registration is optional and PTM TC do this only when the
+corresponding ops are defined. Do the same for ATM TC and call
+subif_reg/subif_unreg only if they are not NULL.
+
+While at it, move subif related data preparation under the 'if' block
+in order to group and isolate that aux code.
+
+Run tested with FRITZ!Box 7530.
+
+Signed-off-by: Sergey Ryazanov <ryazanov.s.a@gmail.com>
+---
+--- a/dcdp/atm_tc.c
++++ b/dcdp/atm_tc.c
+@@ -1158,8 +1158,9 @@ static void ppe_close(struct atm_vcc *vc
+ 		validate_oam_htu_entry(priv, 0);
+ 	spin_unlock_bh(&priv->atm_lock);
+ 
+-	priv->tc_priv->tc_ops.subif_unreg(dev, (!dev) ? dev_name : dev->name,
+-					priv->conn[cid].subif_id, 0);
++	if (priv->tc_priv->tc_ops.subif_unreg)
++		priv->tc_priv->tc_ops.subif_unreg(dev, (!dev) ? dev_name : dev->name,
++						  priv->conn[cid].subif_id, 0);
+ 				
+ 	memset(conn, 0, sizeof(*conn));
+ 
+@@ -2710,24 +2711,26 @@ static void mpoa_setup_sync(struct atm_p
+ 	struct wtx_queue_config_t tx_qcfg;
+ 	struct uni_cell_header *cell_header;
+ 	struct atm_vcc *vcc;
+-	struct net_device *dev;
+-	char dev_name[32];
+ 
+ 	tc_dbg(priv->tc_priv, MSG_INIT,
+ 		"sync: conn: %d, vpi: %d, vci: %d, mpoa_type: %d, mpoa_mode: %d\n",
+ 		conn, priv->conn[conn].vcc->vpi, priv->conn[conn].vcc->vci,
+ 		priv->conn[conn].mpoa_type, priv->conn[conn].mpoa_mode);
+ 
+-	dev = priv->conn[conn].dev;
++	if (priv->tc_priv->tc_ops.subif_reg) {
++		struct net_device *dev;
++		char dev_name[32];
++
++		dev = priv->conn[conn].dev;
++		if (!dev)
++			sprintf(dev_name, "atm_%d%d",
++				priv->conn[conn].vcc->vpi, priv->conn[conn].vcc->vci);
+ 
+-	if (!dev)
+-		sprintf(dev_name, "atm_%d%d",
+-			priv->conn[conn].vcc->vpi, priv->conn[conn].vcc->vci);
+-
+-	priv->tc_priv->tc_ops.subif_reg(dev, (!dev) ? dev_name : dev->name,
+-				&priv->conn[conn].subif_id, 0);
+-	tc_dbg(priv->tc_priv, MSG_INIT,
+-		"conn[%d]subif_id[%x]", conn, priv->conn[conn].subif_id);
++		priv->tc_priv->tc_ops.subif_reg(dev, !dev ? dev_name : dev->name,
++						&priv->conn[conn].subif_id, 0);
++		tc_dbg(priv->tc_priv, MSG_INIT,
++		       "conn[%d]subif_id[%x]", conn, priv->conn[conn].subif_id);
++	}
+ 	vcc = priv->conn[conn].vcc;
+ 
+ 	/*  set htu entry   */
diff --git a/package/kernel/linux/modules/can.mk b/package/kernel/linux/modules/can.mk
index c86d02d8deeab0..1a4c81cc31c53c 100644
--- a/package/kernel/linux/modules/can.mk
+++ b/package/kernel/linux/modules/can.mk
@@ -245,6 +245,25 @@ endef
 $(eval $(call KernelPackage,can-usb-esd))
 
 
+define KernelPackage/can-usb-gs
+  TITLE:=Geschwister Schneider UG interfaces
+  KCONFIG:=CONFIG_CAN_GS_USB
+  FILES:= \
+	$(LINUX_DIR)/drivers/net/can/usb/gs_usb.ko
+  AUTOLOAD:=$(call AutoProbe,gs_usb)
+  $(call AddDepends/can,+kmod-usb-core)
+endef
+
+define KernelPackage/can-usb-gsr/description
+  This driver supports the Geschwister Schneider and
+  bytewerk.org candleLight compatible
+  (https://github.com/candle-usb/candleLight_fw) USB/CAN
+  interfaces.
+endef
+
+$(eval $(call KernelPackage,can-usb-gs))
+
+
 define KernelPackage/can-usb-kvaser
   TITLE:=Kvaser CAN/USB interface
   KCONFIG:=CONFIG_CAN_KVASER_USB
diff --git a/package/kernel/linux/modules/crypto.mk b/package/kernel/linux/modules/crypto.mk
index ce221635470302..78c97121764685 100644
--- a/package/kernel/linux/modules/crypto.mk
+++ b/package/kernel/linux/modules/crypto.mk
@@ -249,6 +249,15 @@ endef
 
 $(eval $(call KernelPackage,crypto-echainiv))
 
+define KernelPackage/crypto-engine
+  TITLE:=Crypto engine
+  KCONFIG:=CONFIG_CRYPTO_ENGINE
+  FILES:=$(LINUX_DIR)/crypto/crypto_engine.ko
+  AUTOLOAD:=$(call AutoLoad,09,crypto_engine)
+  $(call AddDepends/crypto, +kmod-crypto-rsa +kmod-crypto-kpp)
+endef
+
+$(eval $(call KernelPackage,crypto-engine))
 
 define KernelPackage/crypto-essiv
   TITLE:=ESSIV support for block encryption
@@ -357,6 +366,26 @@ endef
 $(eval $(call KernelPackage,crypto-hmac))
 
 
+define KernelPackage/crypto-hw-atmel
+  TITLE:=Microchip / Atmel ECC/SHA/RNG hw accelerator
+  DEPENDS:=+kmod-i2c-core +kmod-crypto-ecdh +kmod-crypto-sha1 \
+	+kmod-crypto-sha256 +kmod-lib-crc16 +kmod-random-core
+  KCONFIG:= \
+	CONFIG_CRYPTO_HW=y \
+	CONFIG_CRYPTO_DEV_ATMEL_I2C \
+	CONFIG_CRYPTO_DEV_ATMEL_ECC \
+	CONFIG_CRYPTO_DEV_ATMEL_SHA204A
+  FILES:= \
+	$(LINUX_DIR)/drivers/crypto/atmel-i2c.ko \
+	$(LINUX_DIR)/drivers/crypto/atmel-ecc.ko \
+	$(LINUX_DIR)/drivers/crypto/atmel-sha204a.ko
+  AUTOLOAD:=$(call AutoLoad,09,atmel-i2c atmel-ecc atmel-sha204a)
+  $(call AddDepends/crypto)
+endef
+
+$(eval $(call KernelPackage,crypto-hw-atmel))
+
+
 define KernelPackage/crypto-hw-ccp
   TITLE:=AMD Cryptographic Coprocessor
   DEPENDS:= \
diff --git a/package/kernel/linux/modules/i2c.mk b/package/kernel/linux/modules/i2c.mk
index 3aaf560ea908db..70bdaf22ab5f7a 100644
--- a/package/kernel/linux/modules/i2c.mk
+++ b/package/kernel/linux/modules/i2c.mk
@@ -116,17 +116,35 @@ I2C_DWPCI_MODULES:= \
 
 define KernelPackage/i2c-designware-pci
   $(call i2c_defaults,$(I2C_DWPCI_MODULES),59)
-  TITLE:=Synopsys DesignWare PCI
+  TITLE:=Synopsys DesignWare I2C PCI
   DEPENDS:=@PCI_SUPPORT +kmod-i2c-designware-core +kmod-i2c-ccgs-ucsi
 endef
 
 define KernelPackage/i2c-designware-pci/description
- Support for Synopsys DesignWare I2C controller. Only master mode is supported.
+ Support for Synopsys DesignWare I2C PCI controller. Only master mode is
+ supported.
 endef
 
 $(eval $(call KernelPackage,i2c-designware-pci))
 
 
+I2C_DWPLAT_MODULES:= \
+  CONFIG_I2C_DESIGNWARE_PLATFORM:drivers/i2c/busses/i2c-designware-platform
+
+define KernelPackage/i2c-designware-platform
+  $(call i2c_defaults,$(I2C_DWPLAT_MODULES),59)
+  TITLE:=Synopsys DesignWare I2C Platform
+  DEPENDS:=+kmod-i2c-designware-core
+endef
+
+define KernelPackage/i2c-designware-platform/description
+ Support for Synopsys DesignWare I2C Platform controller. Only master mode
+ is supported.
+endef
+
+$(eval $(call KernelPackage,i2c-designware-platform))
+
+
 I2C_GPIO_MODULES:= \
   CONFIG_I2C_GPIO:drivers/i2c/busses/i2c-gpio
 
diff --git a/package/kernel/linux/modules/iio.mk b/package/kernel/linux/modules/iio.mk
index e46544b79cc65c..e98a6830da0342 100644
--- a/package/kernel/linux/modules/iio.mk
+++ b/package/kernel/linux/modules/iio.mk
@@ -46,6 +46,38 @@ endef
 $(eval $(call KernelPackage,iio-kfifo-buf))
 
 
+define KernelPackage/industrialio-hw-consumer
+  TITLE:=Provides a bonding way to an other device in hardware
+  KCONFIG:=CONFIG_IIO_BUFFER_HW_CONSUMER
+  FILES:=$(LINUX_DIR)/drivers/iio/buffer/industrialio-hw-consumer.ko
+  AUTOLOAD:=$(call AutoLoad,55,industrialio-hw-consumer)
+  $(call AddDepends/iio,+kmod-iio-kfifo-buf)
+endef
+
+define KernelPackage/industrialio-hw-consumer/description
+ Provides a way to bonding when an IIO device has a direct connection
+ to another device in hardware. In this case buffers for data transfers
+ are handled by hardware.
+endef
+
+$(eval $(call KernelPackage,industrialio-hw-consumer))
+
+
+define KernelPackage/industrialio-buffer-cb
+  TITLE:=Provides callback buffer used for push in-kernel interfaces
+  KCONFIG:=CONFIG_IIO_BUFFER_CB
+  FILES:=$(LINUX_DIR)/drivers/iio/buffer/industrialio-buffer-cb.ko
+  AUTOLOAD:=$(call AutoLoad,55,industrialio-triggered-buffer-cb)
+  $(call AddDepends/iio)
+endef
+
+define KernelPackage/industrialio-buffer-cb/description
+ Should be selected by any drivers that do in-kernel push usage.
+endef
+
+$(eval $(call KernelPackage,industrialio-buffer-cb))
+
+
 define KernelPackage/industrialio-triggered-buffer
   TITLE:=Provides helper functions for setting up triggered buffers.
   DEPENDS:=+kmod-iio-kfifo-buf
diff --git a/package/kernel/linux/modules/leds.mk b/package/kernel/linux/modules/leds.mk
index 8b24cb0ef88e94..a555e6bd7a23b5 100644
--- a/package/kernel/linux/modules/leds.mk
+++ b/package/kernel/linux/modules/leds.mk
@@ -147,6 +147,24 @@ endef
 $(eval $(call KernelPackage,leds-apu))
 
 
+define KernelPackage/leds-ktd202x
+  SUBMENU:=LED modules
+  TITLE:=LED support for KTD202x Chips
+  DEPENDS:=+kmod-i2c-core +kmod-regmap-i2c
+  KCONFIG:=CONFIG_LEDS_KTD202X
+  FILES:= $(LINUX_DIR)/drivers/leds/rgb/leds-ktd202x.ko
+  AUTOLOAD:=$(call AutoProbe,leds-ktd202x,1)
+endef
+
+define KernelPackage/leds-ktd202x/description
+  This option enables support for the Kinetic KTD2026/KTD2027
+  RGB/White LED driver found in different BQ mobile phones.
+  It is a 3 or 4 channel LED driver programmed via an I2C interface.
+endef
+
+$(eval $(call KernelPackage,leds-ktd202x))
+
+
 define KernelPackage/leds-mlxcpld
   SUBMENU:=$(LEDS_MENU)
   TITLE:=LED support for the Mellanox boards
@@ -281,6 +299,23 @@ endef
 $(eval $(call KernelPackage,leds-lp55xx-common))
 
 
+define KernelPackage/leds-lp5523
+  SUBMENU:=$(LEDS_MENU)
+  TITLE:=LED driver for LP5523/LP55231 controllers
+  DEPENDS:=+kmod-i2c-core +kmod-leds-lp55xx-common
+  KCONFIG:=CONFIG_LEDS_LP5523
+  FILES:=$(LINUX_DIR)/drivers/leds/leds-lp5523.ko
+  AUTOLOAD:=$(call AutoLoad,60,leds-lp5523,1)
+endef
+
+define KernelPackage/leds-lp5523/description
+ This option enables support for Texas Instruments LP5523/LP55231
+ LED controllers.
+endef
+
+$(eval $(call KernelPackage,leds-lp5523))
+
+
 define KernelPackage/leds-lp5562
   SUBMENU:=$(LEDS_MENU)
   TITLE:=LED driver for LP5562 controllers
diff --git a/package/kernel/linux/modules/netdevices.mk b/package/kernel/linux/modules/netdevices.mk
index cd24fb3ecbc996..c60a9479788f4e 100644
--- a/package/kernel/linux/modules/netdevices.mk
+++ b/package/kernel/linux/modules/netdevices.mk
@@ -447,9 +447,10 @@ $(eval $(call KernelPackage,phy-micrel))
 define KernelPackage/phy-realtek
    SUBMENU:=$(NETWORK_DEVICES_MENU)
    TITLE:=Realtek Ethernet PHY driver
-   KCONFIG:=CONFIG_REALTEK_PHY
-   DEPENDS:=+kmod-libphy
-   FILES:=$(LINUX_DIR)/drivers/net/phy/realtek.ko
+   KCONFIG:=CONFIG_REALTEK_PHY \
+    CONFIG_REALTEK_PHY_HWMON=y
+   DEPENDS:=+kmod-libphy +kmod-hwmon-core
+   FILES:=$(LINUX_DIR)/drivers/net/phy/realtek/realtek.ko
    AUTOLOAD:=$(call AutoLoad,18,realtek,1)
 endef
 
@@ -575,6 +576,23 @@ endef
 
 $(eval $(call KernelPackage,dsa-b53-mdio))
 
+define KernelPackage/dsa-mv88e6060
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Marvell MV88E6060 DSA Switch
+  DEPENDS:=+kmod-dsa +kmod-phy-marvell
+  KCONFIG:=CONFIG_NET_DSA_TAG_TRAILER \
+  CONFIG_NET_DSA_MV88E6060
+  FILES:= \
+  $(LINUX_DIR)/drivers/net/dsa/mv88e6060.ko \
+  $(LINUX_DIR)/net/dsa/tag_trailer.ko
+  AUTOLOAD:=$(call AutoLoad,41,mv88e6060,1)
+endef
+
+define KernelPackage/dsa-mv88e6060/description
+  Kernel modules for MV88E6060 DSA switches
+endef
+
+$(eval $(call KernelPackage,dsa-mv88e6060))
 
 define KernelPackage/dsa-tag-dsa
   SUBMENU:=$(NETWORK_DEVICES_MENU)
@@ -958,7 +976,7 @@ define KernelPackage/r8169
     CONFIG_R8169 \
     CONFIG_R8169_LEDS=y
   FILES:=$(LINUX_DIR)/drivers/net/ethernet/realtek/r8169.ko
-  AUTOLOAD:=$(call AutoProbe,r8169)
+  AUTOLOAD:=$(call AutoProbe,r8169,1)
 endef
 
 define KernelPackage/r8169/description
@@ -1080,7 +1098,6 @@ define KernelPackage/ixgbe
   TITLE:=Intel(R) 82598/82599 PCI-Express 10 Gigabit Ethernet support
   DEPENDS:=@PCI_SUPPORT +kmod-mdio +kmod-ptp +kmod-hwmon-core +kmod-libphy +kmod-mdio-devres
   KCONFIG:=CONFIG_IXGBE \
-    CONFIG_IXGBE_VXLAN=n \
     CONFIG_IXGBE_HWMON=y \
     CONFIG_IXGBE_DCA=n
   FILES:=$(LINUX_DIR)/drivers/net/ethernet/intel/ixgbe/ixgbe.ko
@@ -1099,7 +1116,6 @@ define KernelPackage/ixgbevf
   TITLE:=Intel(R) 82599 Virtual Function Ethernet support
   DEPENDS:=@PCI_SUPPORT +kmod-ixgbe
   KCONFIG:=CONFIG_IXGBEVF \
-    CONFIG_IXGBE_VXLAN=n \
     CONFIG_IXGBE_HWMON=y \
     CONFIG_IXGBE_DCA=n
   FILES:=$(LINUX_DIR)/drivers/net/ethernet/intel/ixgbevf/ixgbevf.ko
@@ -1116,10 +1132,8 @@ $(eval $(call KernelPackage,ixgbevf))
 define KernelPackage/i40e
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Intel(R) Ethernet Controller XL710 Family support
-  DEPENDS:=@PCI_SUPPORT +kmod-mdio +kmod-ptp +kmod-hwmon-core +kmod-libphy
+  DEPENDS:=@PCI_SUPPORT +kmod-ptp
   KCONFIG:=CONFIG_I40E \
-    CONFIG_I40E_VXLAN=n \
-    CONFIG_I40E_HWMON=y \
     CONFIG_I40E_DCA=n
   FILES:=$(LINUX_DIR)/drivers/net/ethernet/intel/i40e/i40e.ko
   AUTOLOAD:=$(call AutoProbe,i40e)
@@ -1525,6 +1539,28 @@ endef
 
 $(eval $(call KernelPackage,bnx2x))
 
+define KernelPackage/bnxt-en
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Broadcom NetXtreme-C/E network driver
+  DEPENDS:=@PCI_SUPPORT +kmod-hwmon-core +kmod-lib-crc32c +kmod-mdio +kmod-ptp
+  FILES:=$(LINUX_DIR)/drivers/net/ethernet/broadcom/bnxt/bnxt_en.ko
+  KCONFIG:= \
+	  CONFIG_BNXT \
+	  CONFIG_BNXT_SRIOV=y \
+	  CONFIG_BNXT_FLOWER_OFFLOAD=y \
+	  CONFIG_BNXT_DCB=n \
+	  CONFIG_BNXT_HWMON=y
+  AUTOLOAD:=$(call AutoProbe,bnxt_en)
+endef
+
+define KernelPackage/bnxt-en/description
+  Supports Broadcom NetXtreme-C/E based Ethernet NICs including:
+  * BCM573xx
+  * BCM574xx
+endef
+
+$(eval $(call KernelPackage,bnxt-en))
+
 define KernelPackage/be2net
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Broadcom Emulex OneConnect 10Gbps NIC
@@ -1807,6 +1843,23 @@ endef
 
 $(eval $(call KernelPackage,igc))
 
+
+define KernelPackage/hinic
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Huawei Intelligent PCIE Network Interface Card support
+  DEPENDS:=@PCI_SUPPORT @TARGET_x86||TARGET_armsr_armv8
+  FILES:=$(LINUX_DIR)/drivers/net/ethernet/huawei/hinic/hinic.ko
+  KCONFIG:=CONFIG_HINIC
+  AUTOLOAD:=$(call AutoProbe,hinic)
+endef
+
+define KernelPackage/hinic/description
+  Kernel module for HiNIC PCIE Ethernet cards
+endef
+
+$(eval $(call KernelPackage,hinic))
+
+
 define KernelPackage/sfc
   SUBMENU:=$(NETWORK_DEVICES_MENU)
   TITLE:=Solarflare SFC9000/SFC9100/EF100-family support
@@ -1973,3 +2026,19 @@ define KernelPackage/amazon-ena/description
 endef
 
 $(eval $(call KernelPackage,amazon-ena))
+
+define KernelPackage/enc28j60
+  SUBMENU:=$(NETWORK_DEVICES_MENU)
+  TITLE:=Microchip ENC28J60 SPI Ethernet driver
+  KCONFIG:=\
+    CONFIG_ENC28J60 \
+    CONFIG_ENC28J60_WRITEVERIFY=n
+  FILES:=$(LINUX_DIR)/drivers/net/ethernet/microchip/enc28j60.ko
+  AUTOLOAD:=$(call AutoProbe,enc28j60)
+endef
+
+define KernelPackage/enc28j60/description
+  Kernel module for Microchip ENC28J60 SPI Ethernet controller
+endef
+
+$(eval $(call KernelPackage,enc28j60))
diff --git a/package/kernel/linux/modules/netfilter.mk b/package/kernel/linux/modules/netfilter.mk
index cf66bd8cd8c7ee..96531b1e0803a7 100644
--- a/package/kernel/linux/modules/netfilter.mk
+++ b/package/kernel/linux/modules/netfilter.mk
@@ -1048,6 +1048,40 @@ endef
 $(eval $(call KernelPackage,nfnetlink-queue))
 
 
+define KernelPackage/nfnetlink-cthelper
+  TITLE:=Netfilter User space conntrack helpers
+  FILES:=$(LINUX_DIR)/net/netfilter/nfnetlink_cthelper.ko
+  KCONFIG:=CONFIG_NF_CT_NETLINK_HELPER
+  AUTOLOAD:=$(call AutoProbe,nfnetlink_cthelper)
+  $(call AddDepends/nfnetlink,+kmod-nfnetlink-queue +kmod-nf-conntrack-netlink)
+endef
+
+define KernelPackage/nfnetlink-cthelper/description
+ Kernel modules support for a netlink-based connection tracking
+ userspace helpers interface
+endef
+
+$(eval $(call KernelPackage,nfnetlink-cthelper))
+
+
+define KernelPackage/nfnetlink-cttimeout
+  TITLE:=Netfilter conntrack expectation timeout
+  FILES:=$(LINUX_DIR)/net/netfilter/nfnetlink_cttimeout.ko
+  KCONFIG:=CONFIG_NF_CT_NETLINK_TIMEOUT
+  AUTOLOAD:=$(call AutoProbe,nfnetlink_cttimeout)
+  $(call AddDepends/nfnetlink,+kmod-nf-conntrack @KERNEL_NF_CONNTRACK_TIMEOUT)
+endef
+
+define KernelPackage/nfnetlink-cttimeout/description
+ Kernel modules support for a netlink-based connection tracking
+ userspace timeout interface
+
+ Requires CONFIG_NF_CONNTRACK_TIMEOUT (only enabled for non-small flash devices)
+endef
+
+$(eval $(call KernelPackage,nfnetlink-cttimeout))
+
+
 define KernelPackage/nf-conntrack-netlink
   TITLE:=Connection tracking netlink interface
   FILES:=$(LINUX_DIR)/net/netfilter/nf_conntrack_netlink.ko
diff --git a/package/kernel/linux/modules/netsupport.mk b/package/kernel/linux/modules/netsupport.mk
index 9f349d34ee229b..06ef82328091bd 100644
--- a/package/kernel/linux/modules/netsupport.mk
+++ b/package/kernel/linux/modules/netsupport.mk
@@ -42,6 +42,24 @@ endef
 $(eval $(call KernelPackage,atmtcp))
 
 
+define KernelPackage/appletalk
+  SUBMENU:=$(NETWORK_SUPPORT_MENU)
+  TITLE:=Appletalk protocol support
+  KCONFIG:= \
+        CONFIG_ATALK \
+        CONFIG_DEV_APPLETALK \
+        CONFIG_IPDDP=n
+  FILES:=$(LINUX_DIR)/net/appletalk/appletalk.ko
+  AUTOLOAD:=$(call AutoLoad,40,appletalk)
+endef
+
+define KernelPackage/appletalk/description
+  Kernel module for AppleTalk protocol.
+endef
+
+$(eval $(call KernelPackage,appletalk))
+
+
 define KernelPackage/bonding
   SUBMENU:=$(NETWORK_SUPPORT_MENU)
   TITLE:=Ethernet bonding driver
@@ -1008,7 +1026,7 @@ endef
 $(eval $(call KernelPackage,bpf-test))
 
 
-SCHED_MODULES_EXTRA = sch_codel sch_gred sch_multiq sch_sfq sch_teql sch_fq act_pedit act_simple act_skbmod act_csum em_cmp em_nbyte em_meta em_text
+SCHED_MODULES_EXTRA = sch_codel sch_gred sch_multiq sch_sfq sch_teql sch_fq sch_ets act_pedit act_simple act_skbmod act_csum em_cmp em_nbyte em_meta em_text
 SCHED_FILES_EXTRA = $(foreach mod,$(SCHED_MODULES_EXTRA),$(LINUX_DIR)/net/sched/$(mod).ko)
 
 define KernelPackage/sched
@@ -1022,6 +1040,7 @@ define KernelPackage/sched
 	CONFIG_NET_SCH_SFQ \
 	CONFIG_NET_SCH_TEQL \
 	CONFIG_NET_SCH_FQ \
+	CONFIG_NET_SCH_ETS \
 	CONFIG_NET_ACT_PEDIT \
 	CONFIG_NET_ACT_SIMP \
 	CONFIG_NET_ACT_SKBMOD \
diff --git a/package/kernel/linux/modules/other.mk b/package/kernel/linux/modules/other.mk
index bbebcf37ec1adb..7b64985fd69e7d 100644
--- a/package/kernel/linux/modules/other.mk
+++ b/package/kernel/linux/modules/other.mk
@@ -961,6 +961,7 @@ define KernelPackage/thermal
 	CONFIG_THERMAL=y \
 	CONFIG_THERMAL_OF=y \
 	CONFIG_CPU_THERMAL=y \
+	CONFIG_DEVFREQ_THERMAL=n \
 	CONFIG_THERMAL_DEFAULT_GOV_STEP_WISE=y \
 	CONFIG_THERMAL_DEFAULT_GOV_FAIR_SHARE=n \
 	CONFIG_THERMAL_DEFAULT_GOV_USER_SPACE=n \
diff --git a/package/kernel/linux/modules/sound.mk b/package/kernel/linux/modules/sound.mk
index 623f65ac59add1..f3e44e01eee82d 100644
--- a/package/kernel/linux/modules/sound.mk
+++ b/package/kernel/linux/modules/sound.mk
@@ -314,6 +314,17 @@ endef
 $(eval $(call KernelPackage,sound-soc-spdif))
 
 
+define KernelPackage/sound-soc-dmic
+  TITLE:=Generic Digital Microphone CODEC
+  KCONFIG:=CONFIG_SND_SOC_DMIC
+  FILES:=$(LINUX_DIR)/sound/soc/codecs/snd-soc-dmic.ko
+  AUTOLOAD:=$(call AutoProbe,snd-soc-dmic)
+  $(call AddDepends/sound,+kmod-sound-soc-core)
+endef
+
+$(eval $(call KernelPackage,sound-soc-dmic))
+
+
 define KernelPackage/pcspkr
   DEPENDS:=@TARGET_x86 +kmod-input-core
   TITLE:=PC speaker support
diff --git a/package/kernel/linux/modules/spi.mk b/package/kernel/linux/modules/spi.mk
index 78a1c8a03283b2..5e8ab03b1800c0 100644
--- a/package/kernel/linux/modules/spi.mk
+++ b/package/kernel/linux/modules/spi.mk
@@ -73,3 +73,41 @@ define KernelPackage/spi-dev/description
 endef
 
 $(eval $(call KernelPackage,spi-dev))
+
+
+define KernelPackage/spi-dw
+  SUBMENU:=$(SPI_MENU)
+  TITLE:=DesignWare SPI controller driver (core)
+  KCONFIG:=\
+    CONFIG_SPI=y \
+    CONFIG_SPI_DESIGNWARE \
+    CONFIG_SPI_DYNAMIC=y \
+    CONFIG_SPI_MASTER=y
+  FILES:=\
+    $(LINUX_DIR)/drivers/spi/spi-dw.ko
+  AUTOLOAD:=$(call AutoProbe,spi-dw)
+endef
+
+define KernelPackage/spi-dw/description
+ This package contains the DesignWare SPI core driver.
+endef
+
+$(eval $(call KernelPackage,spi-dw))
+
+
+define KernelPackage/spi-dw-mmio
+  SUBMENU:=$(SPI_MENU)
+  TITLE:=DesignWare SPI controller driver (MMIO)
+  DEPENDS:=+kmod-spi-dw
+  KCONFIG:=\
+    CONFIG_SPI_DW_MMIO
+  FILES:=\
+    $(LINUX_DIR)/drivers/spi/spi-dw-mmio.ko
+  AUTOLOAD:=$(call AutoProbe,spi-dw-mmio)
+endef
+
+define KernelPackage/spi-dw-mmio/description
+ This package contains the DesignWare SPI MMIO driver.
+endef
+
+$(eval $(call KernelPackage,spi-dw-mmio))
diff --git a/package/kernel/linux/modules/usb.mk b/package/kernel/linux/modules/usb.mk
index 458c8c4ba68f86..481d2be59a201e 100644
--- a/package/kernel/linux/modules/usb.mk
+++ b/package/kernel/linux/modules/usb.mk
@@ -519,6 +519,23 @@ endef
 $(eval $(call KernelPackage,usb-dwc3))
 
 
+define KernelPackage/usb-dwc3-octeon
+  TITLE:=DWC3 Cavium Octeon USB driver
+  DEPENDS:=@TARGET_octeon +kmod-usb-dwc3
+  KCONFIG:= CONFIG_USB_DWC3_OCTEON
+  FILES:= $(LINUX_DIR)/drivers/usb/dwc3/dwc3-octeon.ko
+  AUTOLOAD:=$(call AutoProbe,dwc3-octeon,1)
+  $(call AddDepends/usb)
+endef
+
+define KernelPackage/usb-dwc3-octeon/description
+  This driver adds support for Cavium Octeon platforms with DesignWare
+  Core USB3 IP.
+endef
+
+$(eval $(call KernelPackage,usb-dwc3-octeon))
+
+
 define KernelPackage/usb-dwc3-qcom
   TITLE:=DWC3 Qualcomm USB driver
   DEPENDS:=@(TARGET_ipq40xx||TARGET_ipq806x||TARGET_qualcommax) +kmod-usb-dwc3
@@ -576,6 +593,7 @@ define KernelPackage/usb-audio
 	CONFIG_SND_USB_AUDIO
   $(call AddDepends/usb)
   $(call AddDepends/sound)
+  DEPENDS+=+kmod-media-controller
   FILES:= \
 	$(LINUX_DIR)/sound/usb/snd-usbmidi-lib.ko \
 	$(LINUX_DIR)/sound/usb/snd-usb-audio.ko
@@ -1719,7 +1737,7 @@ $(eval $(call KernelPackage,usbip-server))
 
 define KernelPackage/usb-chipidea
   TITLE:=Host and device support for Chipidea controllers
-  DEPENDS:=+USB_GADGET_SUPPORT:kmod-usb-gadget @TARGET_ath79 +kmod-usb-ehci +kmod-usb-phy-nop +kmod-usb-roles
+  DEPENDS:=+USB_GADGET_SUPPORT:kmod-usb-gadget @TARGET_ath79 +kmod-usb-ehci +kmod-usb-phy-nop +kmod-usb-roles +kmod-phy-ath79-usb
   KCONFIG:= \
 	CONFIG_EXTCON \
 	CONFIG_USB_CHIPIDEA \
diff --git a/package/kernel/linux/modules/video.mk b/package/kernel/linux/modules/video.mk
index 52fc55bbadd07b..9bb030bf57fd0d 100644
--- a/package/kernel/linux/modules/video.mk
+++ b/package/kernel/linux/modules/video.mk
@@ -12,6 +12,28 @@ V4L2_DIR=v4l2-core
 V4L2_USB_DIR=usb
 V4L2_MEM2MEM_DIR=platform
 
+#
+# Media
+#
+define KernelPackage/media-controller
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Media Controller API
+  KCONFIG:= \
+	CONFIG_MEDIA_SUPPORT \
+	CONFIG_MEDIA_CONTROLLER=y
+  FILES:= \
+	$(LINUX_DIR)/drivers/media/mc/mc.ko
+  AUTOLOAD:=$(call AutoProbe,mc)
+endef
+
+define KernelPackage/media-controller/description
+ Kernel modules for media controller API used to query media devices
+ internal topology and configure it dynamically.
+endef
+
+$(eval $(call KernelPackage,media-controller))
+
+
 #
 # Video Display
 #
@@ -311,6 +333,38 @@ endef
 
 $(eval $(call KernelPackage,drm-exec))
 
+define KernelPackage/drm-dma-helper
+  SUBMENU:=$(VIDEO_MENU)
+  HIDDEN:=1
+  TITLE:=GEM DMA helper functions
+  DEPENDS:=@DISPLAY_SUPPORT +kmod-drm-kms-helper
+  KCONFIG:=CONFIG_DRM_GEM_DMA_HELPER
+  FILES:=$(LINUX_DIR)/drivers/gpu/drm/drm_dma_helper.ko
+  AUTOLOAD:=$(call AutoProbe,drm_dma_helper)
+endef
+
+define KernelPackage/drm-dma-helper/description
+  GEM DMA helper functions.
+endef
+
+$(eval $(call KernelPackage,drm-dma-helper))
+
+define KernelPackage/drm-mipi-dbi
+  SUBMENU:=$(VIDEO_MENU)
+  HIDDEN:=1
+  TITLE:=MIPI DBI helpers
+  DEPENDS:=@DISPLAY_SUPPORT +kmod-backlight +kmod-drm-kms-helper
+  KCONFIG:=CONFIG_DRM_MIPI_DBI
+  FILES:=$(LINUX_DIR)/drivers/gpu/drm/drm_mipi_dbi.ko
+  AUTOLOAD:=$(call AutoProbe,drm_mipi_dbi)
+endef
+
+define KernelPackage/drm-mipi-dbi/description
+  MIPI Display Bus Interface (DBI) LCD controller support.
+endef
+
+$(eval $(call KernelPackage,drm-mipi-dbi))
+
 define KernelPackage/drm-ttm
   SUBMENU:=$(VIDEO_MENU)
   TITLE:=GPU memory management subsystem
@@ -406,6 +460,49 @@ endef
 
 $(eval $(call KernelPackage,drm-amdgpu))
 
+define KernelPackage/drm-i915
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Intel i915 DRM support
+  DEPENDS:=@(TARGET_x86_64||TARGET_x86_generic||TARGET_x86_legacy) \
+	@DISPLAY_SUPPORT +kmod-backlight +kmod-drm-ttm \
+	+kmod-drm-ttm-helper +kmod-drm-kms-helper +kmod-i2c-algo-bit +i915-firmware-dmc \
+	+kmod-drm-display-helper +kmod-drm-buddy +kmod-acpi-video \
+	+kmod-drm-exec +kmod-drm-suballoc-helper
+  KCONFIG:=CONFIG_DRM_I915 \
+	CONFIG_DRM_I915_CAPTURE_ERROR=y \
+	CONFIG_DRM_I915_COMPRESS_ERROR=y \
+	CONFIG_DRM_I915_DEBUG=n \
+	CONFIG_DRM_I915_DEBUG_GUC=n \
+	CONFIG_DRM_I915_DEBUG_MMIO=n \
+	CONFIG_DRM_I915_DEBUG_RUNTIME_PM=n \
+	CONFIG_DRM_I915_DEBUG_VBLANK_EVADE=n \
+	CONFIG_DRM_I915_FENCE_TIMEOUT=10000 \
+	CONFIG_DRM_I915_FORCE_PROBE="" \
+	CONFIG_DRM_I915_HEARTBEAT_INTERVAL=2500 \
+	CONFIG_DRM_I915_LOW_LEVEL_TRACEPOINTS=n \
+	CONFIG_DRM_I915_MAX_REQUEST_BUSYWAIT=8000 \
+	CONFIG_DRM_I915_PREEMPT_TIMEOUT=640 \
+	CONFIG_DRM_I915_PREEMPT_TIMEOUT_COMPUTE=7500 \
+	CONFIG_DRM_I915_REQUEST_TIMEOUT=20000 \
+	CONFIG_DRM_I915_SELFTEST=n \
+	CONFIG_DRM_I915_STOP_TIMEOUT=100 \
+	CONFIG_DRM_I915_SW_FENCE_CHECK_DAG=n \
+	CONFIG_DRM_I915_SW_FENCE_DEBUG_OBJECTS=n \
+	CONFIG_DRM_I915_TIMESLICE_DURATION=1 \
+	CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND=250 \
+	CONFIG_DRM_I915_USERPTR=y \
+	CONFIG_DRM_I915_WERROR=n \
+	CONFIG_FB_INTEL=n
+  FILES:=$(LINUX_DIR)/drivers/gpu/drm/i915/i915.ko
+  AUTOLOAD:=$(call AutoProbe,i915)
+endef
+
+define KernelPackage/drm-i915/description
+  Direct Rendering Manager (DRM) support for Intel GPU
+endef
+
+$(eval $(call KernelPackage,drm-i915))
+
 
 define KernelPackage/drm-imx
   SUBMENU:=$(VIDEO_MENU)
@@ -484,6 +581,24 @@ endef
 
 $(eval $(call KernelPackage,drm-imx-ldb))
 
+define KernelPackage/drm-panel-mipi-dbi
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=Generic MIPI DBI LCD panel
+  DEPENDS:=+kmod-drm-mipi-dbi +kmod-drm-dma-helper
+  KCONFIG:=CONFIG_DRM_PANEL_MIPI_DBI \
+	CONFIG_DRM_FBDEV_EMULATION=y \
+	CONFIG_DRM_FBDEV_OVERALLOC=100
+  FILES:= \
+	$(LINUX_DIR)/drivers/gpu/drm/tiny/panel-mipi-dbi.ko
+  AUTOLOAD:=$(call AutoProbe,panel-mipi-dbi)
+endef
+
+define KernelPackage/drm-panel-mipi-dbi/description
+  Generic driver for MIPI Alliance Display Bus Interface
+endef
+
+$(eval $(call KernelPackage,drm-panel-mipi-dbi))
+
 define KernelPackage/drm-radeon
   SUBMENU:=$(VIDEO_MENU)
   TITLE:=Radeon DRM support
@@ -508,9 +623,8 @@ $(eval $(call KernelPackage,drm-radeon))
 define KernelPackage/video-core
   SUBMENU:=$(VIDEO_MENU)
   TITLE=Video4Linux support
-  DEPENDS:=+PACKAGE_kmod-i2c-core:kmod-i2c-core
+  DEPENDS:=+PACKAGE_kmod-i2c-core:kmod-i2c-core +kmod-media-controller
   KCONFIG:= \
-	CONFIG_MEDIA_SUPPORT \
 	CONFIG_MEDIA_CAMERA_SUPPORT=y \
 	CONFIG_VIDEO_DEV \
 	CONFIG_V4L_PLATFORM_DRIVERS=y \
@@ -566,6 +680,25 @@ endef
 
 $(eval $(call KernelPackage,video-videobuf2))
 
+define KernelPackage/video-async
+  TITLE:=V4L2 ASYNC support
+  KCONFIG:=CONFIG_V4L2_ASYNC
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_DIR)/v4l2-async.ko
+  $(call AddDepends/video)
+  AUTOLOAD:=$(call AutoProbe,v4l2-async)
+endef
+
+$(eval $(call KernelPackage,video-async))
+
+define KernelPackage/video-fwnode
+  TITLE:=V4L2 FWNODE support
+  KCONFIG:=CONFIG_V4L2_FWNODE
+  FILES:=$(LINUX_DIR)/drivers/media/$(V4L2_DIR)/v4l2-fwnode.ko
+  $(call AddDepends/video,+kmod-video-async)
+  AUTOLOAD:=$(call AutoProbe,v4l2-fwnode)
+endef
+
+$(eval $(call KernelPackage,video-fwnode))
 
 define KernelPackage/video-cpia2
   TITLE:=CPIA2 video driver
diff --git a/package/kernel/mac80211/Makefile b/package/kernel/mac80211/Makefile
index 22cd0e97b41770..c93f177aecf86d 100644
--- a/package/kernel/mac80211/Makefile
+++ b/package/kernel/mac80211/Makefile
@@ -10,13 +10,13 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=mac80211
 
-PKG_VERSION:=6.11.2
-PKG_RELEASE:=1
+PKG_VERSION:=6.12.44
+PKG_RELEASE:=2
 PKG_LICENSE:=GPL-2.0-only
 PKG_LICENSE_FILES:=COPYING
 
 PKG_SOURCE_URL:=http://mirror2.openwrt.org/sources/
-PKG_HASH:=700ea5abef8dde9e3c6df2acd32ff443da735d773d56db9a80269e2237549b34
+PKG_HASH:=85a9f92ddba3bf2970a089e7af576c1135217c387205f4481ea9131c0c45c509
 
 PKG_SOURCE:=backports-$(PKG_VERSION).tar.xz
 PKG_BUILD_DIR:=$(KERNEL_BUILD_DIR)/$(if $(BUILD_VARIANT),$(PKG_NAME)-$(BUILD_VARIANT)/)backports-$(PKG_VERSION)
diff --git a/package/kernel/mac80211/broadcom.mk b/package/kernel/mac80211/broadcom.mk
index a6f42cd19af21b..444d705ab31bfc 100644
--- a/package/kernel/mac80211/broadcom.mk
+++ b/package/kernel/mac80211/broadcom.mk
@@ -437,6 +437,7 @@ define KernelPackage/brcmfmac/config
 		default y if TARGET_starfive
 		default y if TARGET_rockchip
 		default y if TARGET_sunxi
+		default y if TARGET_stm32
 		default n
 		help
 		  Enable support for cards attached to an SDIO bus.
diff --git a/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch b/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
index 895e2ff8d8de6a..8c3d8108aa7447 100644
--- a/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
+++ b/package/kernel/mac80211/patches/ath/404-regd_no_assoc_hints.patch
@@ -1,6 +1,6 @@
 --- a/net/wireless/reg.c
 +++ b/net/wireless/reg.c
-@@ -3364,6 +3364,8 @@ void regulatory_hint_country_ie(struct w
+@@ -3367,6 +3367,8 @@ void regulatory_hint_country_ie(struct w
  	enum environment_cap env = ENVIRON_ANY;
  	struct regulatory_request *request = NULL, *lr;
  
@@ -9,7 +9,7 @@
  	/* IE len must be evenly divisible by 2 */
  	if (country_ie_len & 0x01)
  		return;
-@@ -3615,6 +3617,7 @@ static bool is_wiphy_all_set_reg_flag(en
+@@ -3618,6 +3620,7 @@ static bool is_wiphy_all_set_reg_flag(en
  
  void regulatory_hint_disconnect(void)
  {
diff --git a/package/kernel/mac80211/patches/ath/431-add_platform_eeprom_support_to_ath5k.patch b/package/kernel/mac80211/patches/ath/431-add_platform_eeprom_support_to_ath5k.patch
index c762aa6d643fc6..abadadf856c731 100644
--- a/package/kernel/mac80211/patches/ath/431-add_platform_eeprom_support_to_ath5k.patch
+++ b/package/kernel/mac80211/patches/ath/431-add_platform_eeprom_support_to_ath5k.patch
@@ -8,7 +8,7 @@
  #include "../ath.h"
  #include "ath5k.h"
  #include "debug.h"
-@@ -71,7 +72,7 @@ static void ath5k_pci_read_cachesize(str
+@@ -73,7 +74,7 @@ static void ath5k_pci_read_cachesize(str
  }
  
  /*
@@ -17,7 +17,7 @@
   */
  static bool
  ath5k_pci_eeprom_read(struct ath_common *common, u32 offset, u16 *data)
-@@ -79,6 +80,19 @@ ath5k_pci_eeprom_read(struct ath_common
+@@ -81,6 +82,19 @@ ath5k_pci_eeprom_read(struct ath_common
  	struct ath5k_hw *ah = common->ah;
  	u32 status, timeout;
  
@@ -37,7 +37,7 @@
  	/*
  	 * Initialize EEPROM access
  	 */
-@@ -122,6 +136,16 @@ static int ath5k_pci_eeprom_read_mac(str
+@@ -124,6 +138,16 @@ static int ath5k_pci_eeprom_read_mac(str
  	u16 data;
  	int octet;
  
diff --git a/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
index a7e11679a3196d..df0a0a028e7fe8 100644
--- a/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/ath10k/921-ath10k_init_devices_synchronously.patch
@@ -14,7 +14,7 @@ Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
 
 --- a/drivers/net/wireless/ath/ath10k/core.c
 +++ b/drivers/net/wireless/ath/ath10k/core.c
-@@ -3539,6 +3539,16 @@ int ath10k_core_register(struct ath10k *
+@@ -3577,6 +3577,16 @@ int ath10k_core_register(struct ath10k *
  
  	queue_work(ar->workqueue, &ar->register_work);
  
diff --git a/package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch b/package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch
index b13bc3349820a5..c71123a8fee74b 100644
--- a/package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch
+++ b/package/kernel/mac80211/patches/ath10k/930-ath10k_add_tpt_led_trigger.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -9919,6 +9919,21 @@ static int ath10k_mac_init_rd(struct ath
+@@ -9924,6 +9924,21 @@ static int ath10k_mac_init_rd(struct ath
  	return 0;
  }
  
@@ -22,7 +22,7 @@
  int ath10k_mac_register(struct ath10k *ar)
  {
  	static const u32 cipher_suites[] = {
-@@ -10281,6 +10296,12 @@ int ath10k_mac_register(struct ath10k *a
+@@ -10286,6 +10301,12 @@ int ath10k_mac_register(struct ath10k *a
  
  	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
  
diff --git a/package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch b/package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch
index fc41f5f151163b..be2ccfd0bf799c 100644
--- a/package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch
+++ b/package/kernel/mac80211/patches/ath10k/975-ath10k-use-tpt-trigger-by-default.patch
@@ -16,7 +16,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
 
 --- a/drivers/net/wireless/ath/ath10k/core.h
 +++ b/drivers/net/wireless/ath/ath10k/core.h
-@@ -1315,6 +1315,10 @@ struct ath10k {
+@@ -1320,6 +1320,10 @@ struct ath10k {
  	s32 tx_power_2g_limit;
  	s32 tx_power_5g_limit;
  
@@ -40,7 +40,7 @@ Signed-off-by: Mathias Kresin <dev@kresin.me>
  	if (ret)
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -10297,7 +10297,7 @@ int ath10k_mac_register(struct ath10k *a
+@@ -10302,7 +10302,7 @@ int ath10k_mac_register(struct ath10k *a
  	ar->hw->weight_multiplier = ATH10K_AIRTIME_WEIGHT_MULTIPLIER;
  
  #ifdef CPTCFG_MAC80211_LEDS
diff --git a/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch b/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch
index beec6a95eafe74..b62e3c09a0da5f 100644
--- a/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch
+++ b/package/kernel/mac80211/patches/ath10k/984-ath10k-Try-to-get-mac-address-from-dts.patch
@@ -26,7 +26,7 @@ Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
  #include <linux/property.h>
  #include <linux/dmi.h>
  #include <linux/ctype.h>
-@@ -3411,6 +3412,8 @@ static int ath10k_core_probe_fw(struct a
+@@ -3449,6 +3450,8 @@ static int ath10k_core_probe_fw(struct a
  
  	device_get_mac_address(ar->dev, ar->mac_addr);
  
diff --git a/package/kernel/mac80211/patches/ath10k/988-ath10k-always-use-mac80211-loss-detection.patch b/package/kernel/mac80211/patches/ath10k/988-ath10k-always-use-mac80211-loss-detection.patch
index b9cdae7e1f9303..f7387595a95078 100644
--- a/package/kernel/mac80211/patches/ath10k/988-ath10k-always-use-mac80211-loss-detection.patch
+++ b/package/kernel/mac80211/patches/ath10k/988-ath10k-always-use-mac80211-loss-detection.patch
@@ -18,7 +18,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/drivers/net/wireless/ath/ath10k/mac.c
 +++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -10089,7 +10089,6 @@ int ath10k_mac_register(struct ath10k *a
+@@ -10094,7 +10094,6 @@ int ath10k_mac_register(struct ath10k *a
  	ieee80211_hw_set(ar->hw, CHANCTX_STA_CSA);
  	ieee80211_hw_set(ar->hw, QUEUE_CONTROL);
  	ieee80211_hw_set(ar->hw, SUPPORTS_TX_FRAG);
diff --git a/package/kernel/mac80211/patches/ath11k/903-ath11k-support-setting-FW-memory-mode-via-DT.patch b/package/kernel/mac80211/patches/ath11k/903-ath11k-support-setting-FW-memory-mode-via-DT.patch
index 1250147e2bda61..e747738b818fd9 100644
--- a/package/kernel/mac80211/patches/ath11k/903-ath11k-support-setting-FW-memory-mode-via-DT.patch
+++ b/package/kernel/mac80211/patches/ath11k/903-ath11k-support-setting-FW-memory-mode-via-DT.patch
@@ -31,7 +31,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
  	{
  		.hw_rev = ATH11K_HW_IPQ8074,
  		.name = "ipq8074 hw2.0",
-@@ -2147,7 +2147,8 @@ static void ath11k_core_reset(struct wor
+@@ -2200,7 +2200,8 @@ static void ath11k_core_reset(struct wor
  static int ath11k_init_hw_params(struct ath11k_base *ab)
  {
  	const struct ath11k_hw_params *hw_params = NULL;
@@ -41,7 +41,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
  
  	for (i = 0; i < ARRAY_SIZE(ath11k_hw_params); i++) {
  		hw_params = &ath11k_hw_params[i];
-@@ -2163,7 +2164,31 @@ static int ath11k_init_hw_params(struct
+@@ -2216,7 +2217,31 @@ static int ath11k_init_hw_params(struct
  
  	ab->hw_params = *hw_params;
  
diff --git a/package/kernel/mac80211/patches/ath11k/940-ath11k-Revert-clear-the-keys-properly-when-DISABLE_K.patch b/package/kernel/mac80211/patches/ath11k/940-ath11k-Revert-clear-the-keys-properly-when-DISABLE_K.patch
new file mode 100644
index 00000000000000..ec2dc222b66053
--- /dev/null
+++ b/package/kernel/mac80211/patches/ath11k/940-ath11k-Revert-clear-the-keys-properly-when-DISABLE_K.patch
@@ -0,0 +1,48 @@
+From 52393e2ae12f18fb1a60578c24c46ebab292ddb6 Mon Sep 17 00:00:00 2001
+From: Rameshkumar Sundaram <quic_ramess@quicinc.com>
+Date: Mon, 28 Mar 2022 13:21:04 +0530
+Subject: [PATCH] ath11k: Revert: clear the keys properly when DISABLE_KEY
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Reverting the Upstream clear key change added as a part of
+436a4e886598 ("ath11k: clear the keys properly
+when DISABLE_KEY")
+This change exposed a race in WLAN Firmware where target asserts
+are seen frequently due FW not synchronizing ath11k host’s clear
+key commands(CIPHER changes to NONE) with frames in TX queue.
+Hence reverting this change untill FW fixes to synchronize
+ath11k host’s clear key command are available.
+
+Signed-off-by: Rameshkumar Sundaram <quic_ramess@quicinc.com>
+---
+ drivers/net/wireless/ath/ath11k/mac.c | 4 +++-
+ drivers/net/wireless/ath/ath11k/wmi.c | 3 +--
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ath/ath11k/mac.c
++++ b/drivers/net/wireless/ath/ath11k/mac.c
+@@ -4222,7 +4222,9 @@ static int ath11k_install_key(struct ath
+ 		return 0;
+ 
+ 	if (cmd == DISABLE_KEY) {
+-		arg.key_cipher = WMI_CIPHER_NONE;
++		/* TODO: Check if FW expects  value other than NONE for del */
++		/* arg.key_cipher = WMI_CIPHER_NONE; */
++		arg.key_len = 0;
+ 		arg.key_data = NULL;
+ 		goto install;
+ 	}
+--- a/drivers/net/wireless/ath/ath11k/wmi.c
++++ b/drivers/net/wireless/ath/ath11k/wmi.c
+@@ -1854,8 +1854,7 @@ int ath11k_wmi_vdev_install_key(struct a
+ 	tlv = (struct wmi_tlv *)(skb->data + sizeof(*cmd));
+ 	tlv->header = FIELD_PREP(WMI_TLV_TAG, WMI_TAG_ARRAY_BYTE) |
+ 		      FIELD_PREP(WMI_TLV_LEN, key_len_aligned);
+-	if (arg->key_data)
+-		memcpy(tlv->value, (u8 *)arg->key_data, key_len_aligned);
++	memcpy(tlv->value, (u8 *)arg->key_data, key_len_aligned);
+ 
+ 	ret = ath11k_wmi_cmd_send(wmi, skb, WMI_VDEV_INSTALL_KEY_CMDID);
+ 	if (ret) {
diff --git a/package/kernel/mac80211/patches/ath12k/001-wifi-ath12k-add-11d-scan-offload-support-and-handle-country-code-for-WCN7850.patch b/package/kernel/mac80211/patches/ath12k/001-wifi-ath12k-add-11d-scan-offload-support-and-handle-country-code-for-WCN7850.patch
index d370db104713a0..b265fcdeab1288 100644
--- a/package/kernel/mac80211/patches/ath12k/001-wifi-ath12k-add-11d-scan-offload-support-and-handle-country-code-for-WCN7850.patch
+++ b/package/kernel/mac80211/patches/ath12k/001-wifi-ath12k-add-11d-scan-offload-support-and-handle-country-code-for-WCN7850.patch
@@ -121,7 +121,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  };
  
  static __le32 ath12k_wmi_tlv_hdr(u32 cmd, u32 len)
-@@ -2363,7 +2365,10 @@ int ath12k_wmi_send_scan_start_cmd(struc
+@@ -2374,7 +2376,10 @@ int ath12k_wmi_send_scan_start_cmd(struc
  	cmd->scan_id = cpu_to_le32(arg->scan_id);
  	cmd->scan_req_id = cpu_to_le32(arg->scan_req_id);
  	cmd->vdev_id = cpu_to_le32(arg->vdev_id);
@@ -133,7 +133,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  	cmd->notify_scan_events = cpu_to_le32(arg->notify_scan_events);
  
  	ath12k_wmi_copy_scan_event_cntrl_flags(cmd, arg);
-@@ -3083,6 +3088,110 @@ out:
+@@ -3094,6 +3099,110 @@ out:
  	return ret;
  }
  
@@ -244,7 +244,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  int
  ath12k_wmi_send_twt_enable_cmd(struct ath12k *ar, u32 pdev_id)
  {
-@@ -5668,6 +5777,50 @@ static void ath12k_wmi_op_ep_tx_credits(
+@@ -5714,6 +5823,50 @@ static void ath12k_wmi_op_ep_tx_credits(
  	wake_up(&ab->wmi_ab.tx_credits_wq);
  }
  
@@ -295,7 +295,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  static void ath12k_wmi_htc_tx_complete(struct ath12k_base *ab,
  				       struct sk_buff *skb)
  {
-@@ -7269,6 +7422,9 @@ static void ath12k_wmi_op_rx(struct ath1
+@@ -7317,6 +7470,9 @@ static void ath12k_wmi_op_rx(struct ath1
  	case WMI_GTK_OFFLOAD_STATUS_EVENTID:
  		ath12k_wmi_gtk_offload_status_event(ab, skb);
  		break;
@@ -307,7 +307,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  		ath12k_dbg(ab, ATH12K_DBG_WMI, "Unknown eventid: 0x%x\n", id);
 --- a/drivers/net/wireless/ath/ath12k/wmi.h
 +++ b/drivers/net/wireless/ath/ath12k/wmi.h
-@@ -3859,6 +3859,28 @@ struct wmi_init_country_cmd {
+@@ -3860,6 +3860,28 @@ struct wmi_init_country_cmd {
  	} cc_info;
  } __packed;
  
@@ -337,8 +337,8 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  	__le32 tlv_header;
  	__le32 vdev_id;
 @@ -3944,6 +3966,16 @@ struct ath12k_wmi_eht_rate_set_params {
+ #define REG_ALPHA2_LEN 2
  #define MAX_6G_REG_RULES 5
- #define REG_US_5G_NUM_REG_RULES 4
  
 +struct wmi_set_current_country_arg {
 +	u8 alpha2[REG_ALPHA2_LEN];
@@ -373,7 +373,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  				 struct ath12k_wmi_rx_reorder_queue_remove_arg *arg);
 --- a/drivers/net/wireless/ath/ath12k/core.c
 +++ b/drivers/net/wireless/ath/ath12k/core.c
-@@ -1014,6 +1014,7 @@ void ath12k_core_halt(struct ath12k *ar)
+@@ -1017,6 +1017,7 @@ void ath12k_core_halt(struct ath12k *ar)
  	cancel_delayed_work_sync(&ar->scan.timeout);
  	cancel_work_sync(&ar->regd_update_work);
  	cancel_work_sync(&ab->rfkill_work);
@@ -381,7 +381,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  
  	rcu_assign_pointer(ab->pdevs_active[ar->pdev_idx], NULL);
  	synchronize_rcu();
-@@ -1021,6 +1022,34 @@ void ath12k_core_halt(struct ath12k *ar)
+@@ -1029,6 +1030,34 @@ void ath12k_core_halt(struct ath12k *ar)
  	idr_init(&ar->txmgmt_idr);
  }
  
@@ -416,7 +416,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  static void ath12k_core_pre_reconfigure_recovery(struct ath12k_base *ab)
  {
  	struct ath12k *ar;
-@@ -1045,8 +1074,10 @@ static void ath12k_core_pre_reconfigure_
+@@ -1053,8 +1082,10 @@ static void ath12k_core_pre_reconfigure_
  			ar = &ah->radio[j];
  
  			ath12k_mac_drain_tx(ar);
@@ -428,7 +428,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  			complete(&ar->scan.on_channel);
  			complete(&ar->peer_assoc_done);
  			complete(&ar->peer_delete_done);
-@@ -1312,6 +1343,7 @@ struct ath12k_base *ath12k_core_alloc(st
+@@ -1320,6 +1351,7 @@ struct ath12k_base *ath12k_core_alloc(st
  	INIT_WORK(&ab->restart_work, ath12k_core_restart);
  	INIT_WORK(&ab->reset_work, ath12k_core_reset);
  	INIT_WORK(&ab->rfkill_work, ath12k_rfkill_work);
@@ -438,7 +438,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  	init_completion(&ab->htc_suspend);
 --- a/drivers/net/wireless/ath/ath12k/core.h
 +++ b/drivers/net/wireless/ath/ath12k/core.h
-@@ -199,6 +199,12 @@ enum ath12k_scan_state {
+@@ -200,6 +200,12 @@ enum ath12k_scan_state {
  	ATH12K_SCAN_ABORTING,
  };
  
@@ -451,7 +451,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  enum ath12k_dev_flags {
  	ATH12K_CAC_RUNNING,
  	ATH12K_FLAG_CRASH_FLUSH,
-@@ -313,6 +319,8 @@ struct ath12k_vif_iter {
+@@ -320,6 +326,8 @@ struct ath12k_vif_iter {
  #define ATH12K_RX_RATE_TABLE_11AX_NUM	576
  #define ATH12K_RX_RATE_TABLE_NUM 320
  
@@ -460,7 +460,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  struct ath12k_rx_peer_rate_stats {
  	u64 ht_mcs_count[HAL_RX_MAX_MCS_HT + 1];
  	u64 vht_mcs_count[HAL_RX_MAX_MCS_VHT + 1];
-@@ -648,6 +656,13 @@ struct ath12k {
+@@ -655,6 +663,13 @@ struct ath12k {
  	u32 freq_low;
  	u32 freq_high;
  
@@ -474,7 +474,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  	bool nlo_enabled;
  };
  
-@@ -880,6 +895,8 @@ struct ath12k_base {
+@@ -887,6 +902,8 @@ struct ath12k_base {
  	/* continuous recovery fail count */
  	atomic_t fail_cont_count;
  	unsigned long reset_fail_timeout;
@@ -485,7 +485,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  		u32 fw_crash_counter;
 --- a/drivers/net/wireless/ath/ath12k/mac.c
 +++ b/drivers/net/wireless/ath/ath12k/mac.c
-@@ -2947,6 +2947,11 @@ static void ath12k_bss_assoc(struct ath1
+@@ -2949,6 +2949,11 @@ static void ath12k_bss_assoc(struct ath1
  	if (ret)
  		ath12k_warn(ar->ab, "failed to set vdev %i OBSS PD parameters: %d\n",
  			    arvif->vdev_id, ret);
@@ -497,7 +497,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  }
  
  static void ath12k_bss_disassoc(struct ath12k *ar,
-@@ -3522,7 +3527,7 @@ void __ath12k_mac_scan_finish(struct ath
+@@ -3524,7 +3529,7 @@ void __ath12k_mac_scan_finish(struct ath
  		ar->scan_channel = NULL;
  		ar->scan.roc_freq = 0;
  		cancel_delayed_work(&ar->scan.timeout);
@@ -506,9 +506,9 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  		break;
  	}
  }
-@@ -3783,7 +3788,12 @@ scan:
+@@ -3790,7 +3795,12 @@ scan:
  
- 	ret = ath12k_start_scan(ar, &arg);
+ 	ret = ath12k_start_scan(ar, arg);
  	if (ret) {
 -		ath12k_warn(ar->ab, "failed to start hw scan: %d\n", ret);
 +		if (ret == -EBUSY)
@@ -520,7 +520,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  		spin_lock_bh(&ar->data_lock);
  		ar->scan.state = ATH12K_SCAN_IDLE;
  		spin_unlock_bh(&ar->data_lock);
-@@ -3802,6 +3812,11 @@ exit:
+@@ -3810,6 +3820,11 @@ exit:
  
  	mutex_unlock(&ar->conf_mutex);
  
@@ -532,7 +532,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  	return ret;
  }
  
-@@ -5986,7 +6001,7 @@ static int ath12k_mac_start(struct ath12
+@@ -5998,7 +6013,7 @@ static int ath12k_mac_start(struct ath12
  
  	/* TODO: Do we need to enable ANI? */
  
@@ -541,7 +541,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  
  	ar->num_started_vdevs = 0;
  	ar->num_created_vdevs = 0;
-@@ -6166,6 +6181,9 @@ static void ath12k_mac_stop(struct ath12
+@@ -6178,6 +6193,9 @@ static void ath12k_mac_stop(struct ath12
  	cancel_delayed_work_sync(&ar->scan.timeout);
  	cancel_work_sync(&ar->regd_update_work);
  	cancel_work_sync(&ar->ab->rfkill_work);
@@ -551,7 +551,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  
  	spin_lock_bh(&ar->data_lock);
  	list_for_each_entry_safe(ppdu_stats, tmp, &ar->ppdu_stats_info, list) {
-@@ -6412,6 +6430,117 @@ static void ath12k_mac_op_update_vif_off
+@@ -6424,6 +6442,117 @@ static void ath12k_mac_op_update_vif_off
  	ath12k_mac_update_vif_offload(arvif);
  }
  
@@ -669,7 +669,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  static int ath12k_mac_vdev_create(struct ath12k *ar, struct ieee80211_vif *vif)
  {
  	struct ath12k_hw *ah = ar->ah;
-@@ -6526,6 +6655,7 @@ static int ath12k_mac_vdev_create(struct
+@@ -6538,6 +6667,7 @@ static int ath12k_mac_vdev_create(struct
  				    arvif->vdev_id, ret);
  			goto err_peer_del;
  		}
@@ -677,7 +677,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  		break;
  	case WMI_VDEV_TYPE_STA:
  		param_id = WMI_STA_PS_PARAM_RX_WAKE_POLICY;
-@@ -6564,6 +6694,13 @@ static int ath12k_mac_vdev_create(struct
+@@ -6576,6 +6706,13 @@ static int ath12k_mac_vdev_create(struct
  				    arvif->vdev_id, ret);
  			goto err_peer_del;
  		}
@@ -691,7 +691,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  		break;
  	default:
  		break;
-@@ -6904,6 +7041,11 @@ static void ath12k_mac_op_remove_interfa
+@@ -6916,6 +7053,11 @@ static void ath12k_mac_op_remove_interfa
  	ath12k_dbg(ab, ATH12K_DBG_MAC, "mac remove interface (vdev %d)\n",
  		   arvif->vdev_id);
  
@@ -703,7 +703,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  	if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
  		ret = ath12k_peer_delete(ar, arvif->vdev_id, vif->addr);
  		if (ret)
-@@ -7744,6 +7886,14 @@ ath12k_mac_op_unassign_vif_chanctx(struc
+@@ -7756,6 +7898,14 @@ ath12k_mac_op_unassign_vif_chanctx(struc
  	    ar->num_started_vdevs == 1 && ar->monitor_vdev_created)
  		ath12k_mac_monitor_stop(ar);
  
@@ -718,7 +718,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  	mutex_unlock(&ar->conf_mutex);
  }
  
-@@ -8282,6 +8432,14 @@ ath12k_mac_op_reconfig_complete(struct i
+@@ -8294,6 +8444,14 @@ ath12k_mac_op_reconfig_complete(struct i
  		ath12k_warn(ar->ab, "pdev %d successfully recovered\n",
  			    ar->pdev->pdev_id);
  
@@ -733,7 +733,7 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  		if (ab->is_reset) {
  			recovery_count = atomic_inc_return(&ab->recovery_count);
  
-@@ -9331,6 +9489,9 @@ static void ath12k_mac_setup(struct ath1
+@@ -9344,6 +9502,9 @@ static void ath12k_mac_setup(struct ath1
  
  	INIT_WORK(&ar->wmi_mgmt_tx_work, ath12k_mgmt_over_wmi_tx_work);
  	skb_queue_head_init(&ar->wmi_mgmt_tx_queue);
@@ -888,36 +888,36 @@ Acked-by: Jeff Johnson <quic_jjohnson@quicinc.com>
  #endif
 --- a/drivers/net/wireless/ath/ath12k/hw.c
 +++ b/drivers/net/wireless/ath/ath12k/hw.c
-@@ -926,6 +926,7 @@ static const struct ath12k_hw_params ath
- 		.supports_dynamic_smps_6ghz = true,
- 
+@@ -961,6 +961,7 @@ static const struct ath12k_hw_params ath
  		.iova_mask = 0,
+ 
+ 		.supports_aspm = false,
 +		.current_cc_support = false,
  	},
  	{
  		.name = "wcn7850 hw2.0",
-@@ -1004,6 +1005,7 @@ static const struct ath12k_hw_params ath
- 		.supports_dynamic_smps_6ghz = false,
- 
+@@ -1041,6 +1042,7 @@ static const struct ath12k_hw_params ath
  		.iova_mask = ATH12K_PCIE_MAX_PAYLOAD_SIZE - 1,
+ 
+ 		.supports_aspm = true,
 +		.current_cc_support = true,
  	},
  	{
  		.name = "qcn9274 hw2.0",
-@@ -1078,6 +1080,7 @@ static const struct ath12k_hw_params ath
- 		.supports_dynamic_smps_6ghz = true,
- 
+@@ -1117,6 +1119,7 @@ static const struct ath12k_hw_params ath
  		.iova_mask = 0,
+ 
+ 		.supports_aspm = false,
 +		.current_cc_support = false,
  	},
  };
  
 --- a/drivers/net/wireless/ath/ath12k/hw.h
 +++ b/drivers/net/wireless/ath/ath12k/hw.h
-@@ -189,6 +189,7 @@ struct ath12k_hw_params {
- 	bool tcl_ring_retry:1;
+@@ -190,6 +190,7 @@ struct ath12k_hw_params {
  	bool reoq_lut_support:1;
  	bool supports_shadow_regs:1;
+ 	bool supports_aspm:1;
 +	bool current_cc_support:1;
  
  	u32 num_tcl_banks;
diff --git a/package/kernel/mac80211/patches/ath5k/432-ath5k_add_pciids.patch b/package/kernel/mac80211/patches/ath5k/432-ath5k_add_pciids.patch
deleted file mode 100644
index bd0e6707a5513b..00000000000000
--- a/package/kernel/mac80211/patches/ath5k/432-ath5k_add_pciids.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/drivers/net/wireless/ath/ath5k/pci.c
-+++ b/drivers/net/wireless/ath/ath5k/pci.c
-@@ -47,6 +47,8 @@ static const struct pci_device_id ath5k_
- 	{ PCI_VDEVICE(ATHEROS, 0x001b) }, /* 5413 Eagle */
- 	{ PCI_VDEVICE(ATHEROS, 0x001c) }, /* PCI-E cards */
- 	{ PCI_VDEVICE(ATHEROS, 0x001d) }, /* 2417 Nala */
-+	{ PCI_VDEVICE(ATHEROS, 0xff16) }, /* 2413,2414 sx76x on lantiq_danube */
-+	{ PCI_VDEVICE(ATHEROS, 0xff1a) }, /* 2417 arv45xx on lantiq_danube */
- 	{ PCI_VDEVICE(ATHEROS, 0xff1b) }, /* AR5BXB63 */
- 	{ 0 }
- };
diff --git a/package/kernel/mac80211/patches/ath9k/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch b/package/kernel/mac80211/patches/ath9k/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
index 385eea0116df2f..9016da963b35f1 100644
--- a/package/kernel/mac80211/patches/ath9k/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
+++ b/package/kernel/mac80211/patches/ath9k/356-Revert-ath9k-interpret-requested-txpower-in-EIRP-dom.patch
@@ -8,7 +8,7 @@ This reverts commit 71f5137bf010c6faffab50c0ec15374c59c4a411.
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2977,7 +2977,8 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2975,7 +2975,8 @@ void ath9k_hw_apply_txpower(struct ath_h
  {
  	struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
  	struct ieee80211_channel *channel;
@@ -18,7 +18,7 @@ This reverts commit 71f5137bf010c6faffab50c0ec15374c59c4a411.
  	u16 ctl = NO_CTL;
  
  	if (!chan)
-@@ -2989,9 +2990,14 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2987,9 +2988,14 @@ void ath9k_hw_apply_txpower(struct ath_h
  	channel = chan->chan;
  	chan_pwr = min_t(int, channel->max_power * 2, MAX_COMBINED_POWER);
  	new_pwr = min_t(int, chan_pwr, reg->power_limit);
diff --git a/package/kernel/mac80211/patches/ath9k/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch b/package/kernel/mac80211/patches/ath9k/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
index 0c3edc1260ff90..5e5f3e4f10242e 100644
--- a/package/kernel/mac80211/patches/ath9k/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
+++ b/package/kernel/mac80211/patches/ath9k/365-ath9k-adjust-tx-power-reduction-for-US-regulatory-do.patch
@@ -11,7 +11,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/wireless/ath/ath9k/hw.c
 +++ b/drivers/net/wireless/ath/ath9k/hw.c
-@@ -2996,6 +2996,10 @@ void ath9k_hw_apply_txpower(struct ath_h
+@@ -2994,6 +2994,10 @@ void ath9k_hw_apply_txpower(struct ath_h
  	if (ant_gain > max_gain)
  		ant_reduction = ant_gain - max_gain;
  
diff --git a/package/kernel/mac80211/patches/ath9k/410-ath9k_allow_adhoc_and_ap.patch b/package/kernel/mac80211/patches/ath9k/410-ath9k_allow_adhoc_and_ap.patch
index b2f2763e8e16d9..3144f8291af82c 100644
--- a/package/kernel/mac80211/patches/ath9k/410-ath9k_allow_adhoc_and_ap.patch
+++ b/package/kernel/mac80211/patches/ath9k/410-ath9k_allow_adhoc_and_ap.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -882,6 +882,7 @@ static const struct ieee80211_iface_limi
+@@ -884,6 +884,7 @@ static const struct ieee80211_iface_limi
  				 BIT(NL80211_IFTYPE_AP) },
  	{ .max = 1,	.types = BIT(NL80211_IFTYPE_P2P_CLIENT) |
  				 BIT(NL80211_IFTYPE_P2P_GO) },
diff --git a/package/kernel/mac80211/patches/ath9k/450-ath9k-enabled-MFP-capability-unconditionally.patch b/package/kernel/mac80211/patches/ath9k/450-ath9k-enabled-MFP-capability-unconditionally.patch
index f424ca530be860..50ba45c2a82549 100644
--- a/package/kernel/mac80211/patches/ath9k/450-ath9k-enabled-MFP-capability-unconditionally.patch
+++ b/package/kernel/mac80211/patches/ath9k/450-ath9k-enabled-MFP-capability-unconditionally.patch
@@ -14,7 +14,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -963,6 +963,7 @@ static void ath9k_set_hw_capab(struct at
+@@ -965,6 +965,7 @@ static void ath9k_set_hw_capab(struct at
  	ieee80211_hw_set(hw, HOST_BROADCAST_PS_BUFFERING);
  	ieee80211_hw_set(hw, SUPPORT_FAST_XMIT);
  	ieee80211_hw_set(hw, SUPPORTS_CLONED_SKBS);
@@ -22,7 +22,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  
  	if (ath9k_ps_enable)
  		ieee80211_hw_set(hw, SUPPORTS_PS);
-@@ -975,9 +976,6 @@ static void ath9k_set_hw_capab(struct at
+@@ -977,9 +978,6 @@ static void ath9k_set_hw_capab(struct at
  				IEEE80211_RADIOTAP_MCS_HAVE_STBC;
  	}
  
diff --git a/package/kernel/mac80211/patches/ath9k/501-ath9k_ahb_init.patch b/package/kernel/mac80211/patches/ath9k/501-ath9k_ahb_init.patch
index 740ddc39dc3d03..f4d17f5f57e329 100644
--- a/package/kernel/mac80211/patches/ath9k/501-ath9k_ahb_init.patch
+++ b/package/kernel/mac80211/patches/ath9k/501-ath9k_ahb_init.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1178,25 +1178,25 @@ static int __init ath9k_init(void)
+@@ -1180,25 +1180,25 @@ static int __init ath9k_init(void)
  {
  	int error;
  
diff --git a/package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch b/package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch
index 87d18626da3779..b96f60cde68307 100644
--- a/package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch
+++ b/package/kernel/mac80211/patches/ath9k/512-ath9k_channelbw_debugfs.patch
@@ -181,7 +181,7 @@
  	hw->max_listen_interval = 1;
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -733,6 +733,7 @@ static int ath9k_init_softc(u16 devid, s
+@@ -735,6 +735,7 @@ static int ath9k_init_softc(u16 devid, s
  	if (!ath9k_is_chanctx_enabled())
  		sc->cur_chan->hw_queue_base = 0;
  
diff --git a/package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch b/package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch
index 4bb27d558cc43c..e0b1bf21bee986 100644
--- a/package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch
+++ b/package/kernel/mac80211/patches/ath9k/530-ath9k_extra_leds.patch
@@ -181,7 +181,7 @@
  
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -1089,7 +1089,7 @@ int ath9k_init_device(u16 devid, struct
+@@ -1091,7 +1091,7 @@ int ath9k_init_device(u16 devid, struct
  
  #ifdef CPTCFG_MAC80211_LEDS
  	/* must be initialized before ieee80211_register_hw */
diff --git a/package/kernel/mac80211/patches/ath9k/543-ath9k_entropy_from_adc.patch b/package/kernel/mac80211/patches/ath9k/543-ath9k_entropy_from_adc.patch
index 0fedc712701afe..8967d59a408a0f 100644
--- a/package/kernel/mac80211/patches/ath9k/543-ath9k_entropy_from_adc.patch
+++ b/package/kernel/mac80211/patches/ath9k/543-ath9k_entropy_from_adc.patch
@@ -55,7 +55,7 @@
  	ops->spectral_scan_config = ar9003_hw_spectral_scan_config;
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -871,7 +871,8 @@ static void ath9k_init_txpower_limits(st
+@@ -873,7 +873,8 @@ static void ath9k_init_txpower_limits(st
  	if (ah->caps.hw_caps & ATH9K_HW_CAP_5GHZ)
  		ath9k_init_band_txpower(sc, NL80211_BAND_5GHZ);
  
@@ -65,7 +65,7 @@
  }
  
  static const struct ieee80211_iface_limit if_limits[] = {
-@@ -1049,6 +1050,18 @@ static void ath9k_set_hw_capab(struct at
+@@ -1051,6 +1052,18 @@ static void ath9k_set_hw_capab(struct at
  	wiphy_ext_feature_set(hw->wiphy, NL80211_EXT_FEATURE_CAN_REPLACE_PTK0);
  }
  
@@ -84,7 +84,7 @@
  int ath9k_init_device(u16 devid, struct ath_softc *sc,
  		    const struct ath_bus_ops *bus_ops)
  {
-@@ -1096,6 +1109,8 @@ int ath9k_init_device(u16 devid, struct
+@@ -1098,6 +1111,8 @@ int ath9k_init_device(u16 devid, struct
  
  	wiphy_read_of_freq_limits(hw->wiphy);
  
diff --git a/package/kernel/mac80211/patches/ath9k/553-ath9k_of_gpio_mask.patch b/package/kernel/mac80211/patches/ath9k/553-ath9k_of_gpio_mask.patch
index 752a4980a40b43..2f9f6d5bd2d865 100644
--- a/package/kernel/mac80211/patches/ath9k/553-ath9k_of_gpio_mask.patch
+++ b/package/kernel/mac80211/patches/ath9k/553-ath9k_of_gpio_mask.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath9k/init.c
 +++ b/drivers/net/wireless/ath/ath9k/init.c
-@@ -696,6 +696,12 @@ static int ath9k_of_init(struct ath_soft
+@@ -698,6 +698,12 @@ static int ath9k_of_init(struct ath_soft
  	return 0;
  }
  
@@ -13,7 +13,7 @@
  static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
  			    const struct ath_bus_ops *bus_ops)
  {
-@@ -804,6 +810,9 @@ static int ath9k_init_softc(u16 devid, s
+@@ -806,6 +812,9 @@ static int ath9k_init_softc(u16 devid, s
  	if (ret)
  		goto err_hw;
  
diff --git a/package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch b/package/kernel/mac80211/patches/brcm/860-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
similarity index 100%
rename from package/kernel/mac80211/patches/brcm/861-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
rename to package/kernel/mac80211/patches/brcm/860-brcmfmac-workaround-bug-with-some-inconsistent-BSSes.patch
diff --git a/package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch b/package/kernel/mac80211/patches/brcm/861-brcmfmac-add-in-driver-tables-with-country-codes.patch
similarity index 95%
rename from package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
rename to package/kernel/mac80211/patches/brcm/861-brcmfmac-add-in-driver-tables-with-country-codes.patch
index 25f0d254c0da64..1f0609e3488887 100644
--- a/package/kernel/mac80211/patches/brcm/863-brcmfmac-add-in-driver-tables-with-country-codes.patch
+++ b/package/kernel/mac80211/patches/brcm/861-brcmfmac-add-in-driver-tables-with-country-codes.patch
@@ -49,9 +49,9 @@ Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  void brcmf_of_probe(struct device *dev, enum brcmf_bus_type bus_type,
  		    struct brcmf_mp_device *settings)
  {
-@@ -114,6 +144,8 @@ void brcmf_of_probe(struct device *dev,
- 		of_node_put(root);
+@@ -113,6 +143,8 @@ void brcmf_of_probe(struct device *dev,
  	}
+ 	of_node_put(root);
  
 +	brcmf_of_probe_cc(dev, settings);
 +
diff --git a/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch b/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch
deleted file mode 100644
index 3472ff6afc6be1..00000000000000
--- a/package/kernel/mac80211/patches/brcm/862-brcmfmac-Disable-power-management.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 66ae1b1750720a33e29792a177b1e696f4f005fb Mon Sep 17 00:00:00 2001
-From: Phil Elwell <phil@raspberrypi.org>
-Date: Wed, 9 Mar 2016 17:25:59 +0000
-Subject: [PATCH] brcmfmac: Disable power management
-
-Disable wireless power saving in the brcmfmac WLAN driver. This is a
-temporary measure until the connectivity loss resulting from power
-saving is resolved.
-
-Signed-off-by: Phil Elwell <phil@raspberrypi.org>
----
- drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -3314,6 +3314,10 @@ brcmf_cfg80211_set_power_mgmt(struct wip
- 	 * preference in cfg struct to apply this to
- 	 * FW later while initializing the dongle
- 	 */
-+#if defined(CONFIG_ARCH_BCM2835)
-+	brcmf_dbg(INFO, "power management disabled\n");
-+	enabled = false;
-+#endif
- 	cfg->pwr_save = enabled;
- 	if (!check_vif_up(ifp->vif)) {
- 
diff --git a/package/kernel/mac80211/patches/brcm/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch b/package/kernel/mac80211/patches/brcm/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
deleted file mode 100644
index fe79c40c11cb88..00000000000000
--- a/package/kernel/mac80211/patches/brcm/864-brcmfmac-do-not-use-internal-roaming-engine-by-default.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-brcmfmac: do not use internal roaming engine by default
-
-Some evidence of curing disconnects with this disabled, so make it a default.
-Can be overridden with module parameter roamoff=0
-See: http://projectable.me/optimize-my-pi-wi-fi/
-
-Signed-off-by: Phil Elwell <phil@raspberrypi.org>
----
-
---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
-@@ -59,7 +59,11 @@ static int brcmf_fcmode;
- module_param_named(fcmode, brcmf_fcmode, int, 0);
- MODULE_PARM_DESC(fcmode, "Mode of firmware signalled flow control");
- 
-+#if defined(CONFIG_ARCH_BCM2835)
-+static int brcmf_roamoff = 1;
-+#else
- static int brcmf_roamoff;
-+#endif
- module_param_named(roamoff, brcmf_roamoff, int, 0400);
- MODULE_PARM_DESC(roamoff, "Do not use internal roaming engine");
- 
diff --git a/package/kernel/mac80211/patches/brcm/870-01-rpi-6.12-brcmfmac-adds-support-for-BCM43341-wifi.patch b/package/kernel/mac80211/patches/brcm/870-01-rpi-6.12-brcmfmac-adds-support-for-BCM43341-wifi.patch
new file mode 100644
index 00000000000000..23526c936552f3
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/870-01-rpi-6.12-brcmfmac-adds-support-for-BCM43341-wifi.patch
@@ -0,0 +1,29 @@
+From 88759af56f126e6e151f07fa9efc7447079fca9d Mon Sep 17 00:00:00 2001
+From: Cheong2K <cheong@redbear.cc>
+Date: Fri, 26 Feb 2016 18:20:10 +0800
+Subject: [PATCH] brcmfmac: adds support for BCM43341 wifi
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.org>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c     | 3 ++-
+ 3 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -609,6 +609,7 @@ BRCMF_FW_DEF(4329, "brcmfmac4329-sdio");
+ BRCMF_FW_DEF(4330, "brcmfmac4330-sdio");
+ BRCMF_FW_DEF(4334, "brcmfmac4334-sdio");
+ BRCMF_FW_DEF(43340, "brcmfmac43340-sdio");
++BRCMF_FW_DEF(43341, "brcmfmac43341-sdio");
+ BRCMF_FW_DEF(4335, "brcmfmac4335-sdio");
+ BRCMF_FW_DEF(43362, "brcmfmac43362-sdio");
+ BRCMF_FW_DEF(4339, "brcmfmac4339-sdio");
+@@ -641,7 +642,7 @@ static const struct brcmf_firmware_mappi
+ 	BRCMF_FW_ENTRY(BRCM_CC_4330_CHIP_ID, 0xFFFFFFFF, 4330),
+ 	BRCMF_FW_ENTRY(BRCM_CC_4334_CHIP_ID, 0xFFFFFFFF, 4334),
+ 	BRCMF_FW_ENTRY(BRCM_CC_43340_CHIP_ID, 0xFFFFFFFF, 43340),
+-	BRCMF_FW_ENTRY(BRCM_CC_43341_CHIP_ID, 0xFFFFFFFF, 43340),
++	BRCMF_FW_ENTRY(BRCM_CC_43341_CHIP_ID, 0xFFFFFFFF, 43341),
+ 	BRCMF_FW_ENTRY(BRCM_CC_4335_CHIP_ID, 0xFFFFFFFF, 4335),
+ 	BRCMF_FW_ENTRY(BRCM_CC_43362_CHIP_ID, 0xFFFFFFFE, 43362),
+ 	BRCMF_FW_ENTRY(BRCM_CC_4339_CHIP_ID, 0xFFFFFFFF, 4339),
diff --git a/package/kernel/mac80211/patches/brcm/870-02-rpi-6.12-brcmfmac-Prefer-a-ccode-from-OTP-over-nvram-file.patch b/package/kernel/mac80211/patches/brcm/870-02-rpi-6.12-brcmfmac-Prefer-a-ccode-from-OTP-over-nvram-file.patch
new file mode 100644
index 00000000000000..9a7f9eb266409d
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/870-02-rpi-6.12-brcmfmac-Prefer-a-ccode-from-OTP-over-nvram-file.patch
@@ -0,0 +1,130 @@
+From 3ac592da09acb47b728ef320e9fecde55c8e0824 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 26 Jun 2020 11:51:05 +0100
+Subject: [PATCH] brcmfmac: Prefer a ccode from OTP over nvram file
+
+Allow the nvram file to set a default ccode (regulatory domain) without
+overriding one set in OTP.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 39 +++++++++++++------
+ .../broadcom/brcm80211/brcmfmac/firmware.c    | 21 +++++++++-
+ 2 files changed, 47 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -9,6 +9,7 @@
+ #include <linux/etherdevice.h>
+ #include <linux/module.h>
+ #include <linux/vmalloc.h>
++#include <linux/ctype.h>
+ #include <net/cfg80211.h>
+ #include <net/netlink.h>
+ #include <uapi/linux/if_arp.h>
+@@ -8212,31 +8213,45 @@ static void brcmf_cfg80211_reg_notifier(
+ 	struct brcmf_if *ifp = brcmf_get_ifp(cfg->pub, 0);
+ 	struct brcmf_pub *drvr = cfg->pub;
+ 	struct brcmf_fil_country_le ccreq;
++	char *alpha2;
+ 	s32 err;
+ 	int i;
+ 
+-	/* The country code gets set to "00" by default at boot, ignore */
+-	if (req->alpha2[0] == '0' && req->alpha2[1] == '0')
++	err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
++	if (err) {
++		bphy_err(drvr, "Country code iovar returned err = %d\n", err);
+ 		return;
++	}
++
++	/* The country code gets set to "00" by default at boot - substitute
++	 * any saved ccode from the nvram file unless there is a valid code
++	 * already set.
++	 */
++	alpha2 = req->alpha2;
++	if (alpha2[0] == '0' && alpha2[1] == '0') {
++		extern char saved_ccode[2];
++
++		if ((isupper(ccreq.country_abbrev[0]) &&
++		     isupper(ccreq.country_abbrev[1])) ||
++		    !saved_ccode[0])
++			return;
++		alpha2 = saved_ccode;
++		pr_debug("brcmfmac: substituting saved ccode %c%c\n",
++			 alpha2[0], alpha2[1]);
++	}
+ 
+ 	/* ignore non-ISO3166 country codes */
+ 	for (i = 0; i < 2; i++)
+-		if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') {
++		if (alpha2[i] < 'A' || alpha2[i] > 'Z') {
+ 			bphy_err(drvr, "not an ISO3166 code (0x%02x 0x%02x)\n",
+-				 req->alpha2[0], req->alpha2[1]);
++				 alpha2[0], alpha2[1]);
+ 			return;
+ 		}
+ 
+ 	brcmf_dbg(TRACE, "Enter: initiator=%d, alpha=%c%c\n", req->initiator,
+-		  req->alpha2[0], req->alpha2[1]);
+-
+-	err = brcmf_fil_iovar_data_get(ifp, "country", &ccreq, sizeof(ccreq));
+-	if (err) {
+-		bphy_err(drvr, "Country code iovar returned err = %d\n", err);
+-		return;
+-	}
++		  alpha2[0], alpha2[1]);
+ 
+-	err = brcmf_translate_country_code(ifp->drvr, req->alpha2, &ccreq);
++	err = brcmf_translate_country_code(ifp->drvr, alpha2, &ccreq);
+ 	if (err)
+ 		return;
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c
+@@ -10,6 +10,7 @@
+ #include <linux/firmware.h>
+ #include <linux/module.h>
+ #include <linux/bcm47xx_nvram.h>
++#include <linux/ctype.h>
+ 
+ #include "debug.h"
+ #include "firmware.h"
+@@ -32,6 +33,8 @@ enum nvram_parser_state {
+ 	END
+ };
+ 
++char saved_ccode[2] = {};
++
+ /**
+  * struct nvram_parser - internal info for parser.
+  *
+@@ -562,11 +565,27 @@ static int brcmf_fw_request_nvram_done(c
+ 			goto fail;
+ 	}
+ 
+-	if (data)
++	if (data) {
++		char *ccode = strnstr((char *)data, "ccode=", data_len);
++		/* Ensure this is a whole token */
++		if (ccode && ((void *)ccode == (void *)data || isspace(ccode[-1]))) {
++			/* Comment out the line */
++			ccode[0] = '#';
++			ccode += 6;
++			if (isupper(ccode[0]) && isupper(ccode[1]) &&
++			    isspace(ccode[2])) {
++				pr_debug("brcmfmac: intercepting ccode=%c%c\n",
++					 ccode[0], ccode[1]);
++				saved_ccode[0] = ccode[0];
++				saved_ccode[1] = ccode[1];
++			}
++		};
++
+ 		nvram = brcmf_fw_nvram_strip(data, data_len, &nvram_length,
+ 					     fwctx->req->domain_nr,
+ 					     fwctx->req->bus_nr,
+ 					     fwctx->dev);
++	}
+ 
+ 	if (free_bcm47xx_nvram)
+ 		bcm47xx_nvram_release_contents(data);
diff --git a/package/kernel/mac80211/patches/brcm/870-03-rpi-6.12-brcmfmac-Increase-power-saving-delay-to-2s.patch b/package/kernel/mac80211/patches/brcm/870-03-rpi-6.12-brcmfmac-Increase-power-saving-delay-to-2s.patch
new file mode 100644
index 00000000000000..f197e890265998
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/870-03-rpi-6.12-brcmfmac-Increase-power-saving-delay-to-2s.patch
@@ -0,0 +1,24 @@
+From 12722e472a963598a88011dd4b6805ed0a0e318f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 3 Feb 2020 09:32:22 +0000
+Subject: [PATCH] brcmfmac: Increase power saving delay to 2s
+
+Increase the delay before entering the lower power state to 2 seconds
+(the maximum allowed) in order to reduce the packet latencies,
+particularly for inbound packets.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -3338,6 +3338,7 @@ brcmf_cfg80211_set_power_mgmt(struct wip
+ 			bphy_err(drvr, "error (%d)\n", err);
+ 	}
+ 
++	timeout = 2000; /* 2000ms - the maximum */
+ 	err = brcmf_fil_iovar_int_set(ifp, "pm2_sleep_ret",
+ 				min_t(u32, timeout, BRCMF_PS_MAX_TIMEOUT_MS));
+ 	if (err)
diff --git a/package/kernel/mac80211/patches/brcm/870-04-rpi-6.12-brcmfmac-non-upstream-support-DS1-exit-firmware-re-download.patch b/package/kernel/mac80211/patches/brcm/870-04-rpi-6.12-brcmfmac-non-upstream-support-DS1-exit-firmware-re-download.patch
new file mode 100644
index 00000000000000..e02149a7a056a2
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/870-04-rpi-6.12-brcmfmac-non-upstream-support-DS1-exit-firmware-re-download.patch
@@ -0,0 +1,721 @@
+From e7400640cafcf6bd84049308feb5aeabecf55b46 Mon Sep 17 00:00:00 2001
+From: Praveen Babu C <pucn@cypress.com>
+Date: Tue, 9 Jan 2018 11:33:10 +0530
+Subject: [PATCH] non-upstream: support DS1 exit firmware re-download
+
+In deep sleep mode (DS1) ARM is off and once exit trigger comes than
+mailbox Interrupt comes to host and whole reinitiation should be done
+in the ARM to start TX/RX.
+
+Also fix below issus for DS1 exit:
+1. Sent Tx Control frame only after firmware redownload complete (check
+F2 Ready before sending Tx Control frame to Firmware)
+2. intermittent High DS1 TX Exit latency time (almost 3sec) ==> This is
+fixed by skipping host Mailbox interrupt Multiple times (ulp state
+mechanism)
+3. RX GlOM save/restore in Firmware
+4. Add ULP event enable & event_msgs_ext iovar configuration in FMAC
+5. Add ULP_EVENT_RECV state machine for sbwad support
+6. Support 2 Byte Shared memory read for DS1 Exit HUDI implementation
+
+Signed-off-by: Praveen Babu C <pucn@cypress.com>
+Signed-off-by: Naveen Gupta <nagu@cypress.com>
+[Merge from 4.14.77 to 5.4.18; set BRCMF_SDIO_MAX_ACCESS_ERRORS to 20]
+Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
+JIRA: SWWLAN-135583
+JIRA: SWWLAN-136577
+---
+ .../broadcom/brcm80211/brcmfmac/bus.h         |   2 +-
+ .../broadcom/brcm80211/brcmfmac/common.c      |  39 +++
+ .../broadcom/brcm80211/brcmfmac/core.c        |  13 +-
+ .../broadcom/brcm80211/brcmfmac/debug.h       |   1 +
+ .../broadcom/brcm80211/brcmfmac/fweh.h        |  31 ++-
+ .../broadcom/brcm80211/brcmfmac/pcie.c        |   2 +-
+ .../broadcom/brcm80211/brcmfmac/sdio.c        | 260 +++++++++++++++++-
+ .../broadcom/brcm80211/brcmfmac/sdio.h        | 110 ++++++++
+ .../broadcom/brcm80211/brcmfmac/usb.c         |   4 +-
+ .../broadcom/brcm80211/include/chipcommon.h   |   2 +
+ 10 files changed, 448 insertions(+), 16 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bus.h
+@@ -298,7 +298,7 @@ void brcmf_rx_event(struct device *dev,
+ 
+ int brcmf_alloc(struct device *dev, struct brcmf_mp_device *settings);
+ /* Indication from bus module regarding presence/insertion of dongle. */
+-int brcmf_attach(struct device *dev);
++int brcmf_attach(struct device *dev, bool start_bus);
+ /* Indication from bus module regarding removal/absence of dongle */
+ void brcmf_detach(struct device *dev);
+ void brcmf_free(struct device *dev);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c
+@@ -20,6 +20,8 @@
+ #include "of.h"
+ #include "firmware.h"
+ #include "chip.h"
++#include "fweh.h"
++#include <brcm_hw_ids.h>
+ 
+ MODULE_AUTHOR("Broadcom Corporation");
+ MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
+@@ -274,6 +276,8 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 	char *clmver;
+ 	char *ptr;
+ 	s32 err;
++	struct eventmsgs_ext *eventmask_msg = NULL;
++	u8 msglen;
+ 
+ 	if (is_valid_ether_addr(ifp->mac_addr)) {
+ 		/* set mac address */
+@@ -433,6 +437,41 @@ int brcmf_c_preinit_dcmds(struct brcmf_i
+ 		goto done;
+ 	}
+ 
++	/* Enable event_msg_ext specific to 43012 chip */
++	if (bus->chip == CY_CC_43012_CHIP_ID) {
++		/* Program event_msg_ext to support event larger than 128 */
++		msglen = (roundup(BRCMF_E_LAST, NBBY) / NBBY) +
++				  EVENTMSGS_EXT_STRUCT_SIZE;
++		/* Allocate buffer for eventmask_msg */
++		eventmask_msg = kzalloc(msglen, GFP_KERNEL);
++		if (!eventmask_msg) {
++			err = -ENOMEM;
++			goto done;
++		}
++
++		/* Read the current programmed event_msgs_ext */
++		eventmask_msg->ver = EVENTMSGS_VER;
++		eventmask_msg->len = roundup(BRCMF_E_LAST, NBBY) / NBBY;
++		err = brcmf_fil_iovar_data_get(ifp, "event_msgs_ext",
++					       eventmask_msg,
++					       msglen);
++
++		/* Enable ULP event */
++		brcmf_dbg(EVENT, "enable event ULP\n");
++		setbit(eventmask_msg->mask, BRCMF_E_ULP);
++
++		/* Write updated Event mask */
++		eventmask_msg->ver = EVENTMSGS_VER;
++		eventmask_msg->command = EVENTMSGS_SET_MASK;
++		eventmask_msg->len = (roundup(BRCMF_E_LAST, NBBY) / NBBY);
++
++		err = brcmf_fil_iovar_data_set(ifp, "event_msgs_ext",
++					       eventmask_msg, msglen);
++		if (err) {
++			brcmf_err("Set event_msgs_ext error (%d)\n", err);
++			goto done;
++		}
++	}
+ 	/* Setup default scan channel time */
+ 	err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_SCAN_CHANNEL_TIME,
+ 				    BRCMF_DEFAULT_SCAN_CHANNEL_TIME);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
+@@ -1322,7 +1322,7 @@ int brcmf_alloc(struct device *dev, stru
+ 	return 0;
+ }
+ 
+-int brcmf_attach(struct device *dev)
++int brcmf_attach(struct device *dev, bool start_bus)
+ {
+ 	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+ 	struct brcmf_pub *drvr = bus_if->drvr;
+@@ -1363,10 +1363,13 @@ int brcmf_attach(struct device *dev)
+ 	brcmf_fweh_register(drvr, BRCMF_E_PSM_WATCHDOG,
+ 			    brcmf_psm_watchdog_notify);
+ 
+-	ret = brcmf_bus_started(drvr, drvr->ops);
+-	if (ret != 0) {
+-		bphy_err(drvr, "dongle is not responding: err=%d\n", ret);
+-		goto fail;
++	if (start_bus) {
++		ret = brcmf_bus_started(drvr, drvr->ops);
++		if (ret != 0) {
++			bphy_err(drvr, "dongle is not responding: err=%d\n",
++				 ret);
++			goto fail;
++		}
+ 	}
+ 
+ 	return 0;
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/debug.h
+@@ -29,6 +29,7 @@
+ #define BRCMF_MSGBUF_VAL	0x00040000
+ #define BRCMF_PCIE_VAL		0x00080000
+ #define BRCMF_FWCON_VAL		0x00100000
++#define BRCMF_ULP_VAL		0x00200000
+ 
+ /* set default print format */
+ #undef pr_fmt
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.h
+@@ -94,7 +94,8 @@ struct brcmf_cfg80211_info;
+ 	BRCMF_ENUM_DEF(FIFO_CREDIT_MAP, 74) \
+ 	BRCMF_ENUM_DEF(ACTION_FRAME_RX, 75) \
+ 	BRCMF_ENUM_DEF(TDLS_PEER_EVENT, 92) \
+-	BRCMF_ENUM_DEF(BCMC_CREDIT_SUPPORT, 127)
++	BRCMF_ENUM_DEF(BCMC_CREDIT_SUPPORT, 127) \
++	BRCMF_ENUM_DEF(ULP, 146)
+ 
+ #define BRCMF_ENUM_DEF(id, val) \
+ 	BRCMF_E_##id = (val),
+@@ -102,6 +103,12 @@ struct brcmf_cfg80211_info;
+ /* firmware event codes sent by the dongle */
+ enum brcmf_fweh_event_code {
+ 	BRCMF_FWEH_EVENT_ENUM_DEFLIST
++
++	/* this determines event mask length which must match
++	 * minimum length check in device firmware so it is
++	 * hard-coded here.
++	 */
++	BRCMF_E_LAST
+ };
+ #undef BRCMF_ENUM_DEF
+ 
+@@ -280,6 +287,28 @@ struct brcmf_if_event {
+ 	u8 role;
+ };
+ 
++enum event_msgs_ext_command {
++	EVENTMSGS_NONE		=	0,
++	EVENTMSGS_SET_BIT	=	1,
++	EVENTMSGS_RESET_BIT	=	2,
++	EVENTMSGS_SET_MASK	=	3
++};
++
++#define EVENTMSGS_VER 1
++#define EVENTMSGS_EXT_STRUCT_SIZE	offsetof(struct eventmsgs_ext, mask[0])
++
++/* len-	for SET it would be mask size from the application to the firmware */
++/*		for GET it would be actual firmware mask size */
++/* maxgetsize -	is only used for GET. indicate max mask size that the */
++/*				application can read from the firmware */
++struct eventmsgs_ext {
++	u8	ver;
++	u8	command;
++	u8	len;
++	u8	maxgetsize;
++	u8	mask[1];
++};
++
+ typedef int (*brcmf_fweh_handler_t)(struct brcmf_if *ifp,
+ 				    const struct brcmf_event_msg *evtmsg,
+ 				    void *data);
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c
+@@ -2207,7 +2207,7 @@ static void brcmf_pcie_setup(struct devi
+ 
+ 	init_waitqueue_head(&devinfo->mbdata_resp_wait);
+ 
+-	ret = brcmf_attach(&devinfo->pdev->dev);
++	ret = brcmf_attach(&devinfo->pdev->dev, true);
+ 	if (ret)
+ 		goto fail;
+ 
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -35,9 +35,12 @@
+ #include "core.h"
+ #include "common.h"
+ #include "bcdc.h"
++#include "debug.h"
++#include "fwil.h"
+ 
+ #define DCMD_RESP_TIMEOUT	msecs_to_jiffies(2500)
+ #define CTL_DONE_TIMEOUT	msecs_to_jiffies(2500)
++#define ULP_HUDI_PROC_DONE_TIME	msecs_to_jiffies(2500)
+ 
+ /* watermark expressed in number of words */
+ #define DEFAULT_F2_WATERMARK    0x8
+@@ -325,7 +328,16 @@ struct rte_console {
+ 
+ #define KSO_WAIT_US 50
+ #define MAX_KSO_ATTEMPTS (PMU_MAX_TRANSITION_DLY/KSO_WAIT_US)
+-#define BRCMF_SDIO_MAX_ACCESS_ERRORS	5
++#define BRCMF_SDIO_MAX_ACCESS_ERRORS	20
++
++static void brcmf_sdio_firmware_callback(struct device *dev, int err,
++					 struct brcmf_fw_request *fwreq);
++static struct brcmf_fw_request *
++	brcmf_sdio_prepare_fw_request(struct brcmf_sdio *bus);
++static int brcmf_sdio_f2_ready(struct brcmf_sdio *bus);
++static int brcmf_ulp_event_notify(struct brcmf_if *ifp,
++				  const struct brcmf_event_msg *evtmsg,
++				  void *data);
+ 
+ #ifdef DEBUG
+ /* Device console log buffer state */
+@@ -1105,7 +1117,7 @@ static void brcmf_sdio_get_console_addr(
+ }
+ #endif /* DEBUG */
+ 
+-static u32 brcmf_sdio_hostmail(struct brcmf_sdio *bus)
++static u32 brcmf_sdio_hostmail(struct brcmf_sdio *bus, u32 *hmbd)
+ {
+ 	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
+ 	struct brcmf_core *core = bus->sdio_core;
+@@ -1194,6 +1206,9 @@ static u32 brcmf_sdio_hostmail(struct br
+ 			 HMB_DATA_FCDATA_MASK | HMB_DATA_VERSION_MASK))
+ 		brcmf_err("Unknown mailbox data content: 0x%02x\n",
+ 			  hmb_data);
++	/* Populate hmb_data if argument is passed for DS1 check later */
++	if (hmbd)
++		*hmbd = hmb_data;
+ 
+ 	return intstatus;
+ }
+@@ -2580,6 +2595,182 @@ static int brcmf_sdio_intr_rstatus(struc
+ 	return ret;
+ }
+ 
++/* This Function is used to retrieve important
++ * details from dongle related to ULP mode Mostly
++ * values/SHM details that will be vary depending
++ * on the firmware branches
++ */
++static void
++brcmf_sdio_ulp_preinit(struct device *dev)
++{
++	struct brcmf_bus *bus_if = dev_get_drvdata(dev);
++	struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
++	struct brcmf_if *ifp = bus_if->drvr->iflist[0];
++
++	brcmf_dbg(ULP, "Enter\n");
++
++	/* Query ulp_sdioctrl iovar to get the ULP related SHM offsets */
++	brcmf_fil_iovar_data_get(ifp, "ulp_sdioctrl",
++				 &sdiodev->fmac_ulp.ulp_shm_offset,
++				 sizeof(sdiodev->fmac_ulp.ulp_shm_offset));
++
++	sdiodev->ulp = false;
++
++	brcmf_dbg(ULP, "m_ulp_ctrl_sdio[%x] m_ulp_wakeevt_ind [%x]\n",
++		  M_DS1_CTRL_SDIO(sdiodev->fmac_ulp),
++		  M_WAKEEVENT_IND(sdiodev->fmac_ulp));
++	brcmf_dbg(ULP, "m_ulp_wakeind [%x]\n",
++		  M_ULP_WAKE_IND(sdiodev->fmac_ulp));
++}
++
++/* Reinitialize ARM because In DS1 mode ARM got off */
++static int
++brcmf_sdio_ulp_reinit_fw(struct brcmf_sdio *bus)
++{
++	struct brcmf_sdio_dev *sdiodev = bus->sdiodev;
++	struct brcmf_fw_request *fwreq;
++	int err = 0;
++
++	/* After firmware redownload tx/rx seq are reset accordingly
++	 * these values are reset on FMAC side tx_max is initially set to 4,
++	 * which later is updated by FW.
++	 */
++	bus->tx_seq = 0;
++	bus->rx_seq = 0;
++	bus->tx_max = 4;
++
++	fwreq = brcmf_sdio_prepare_fw_request(bus);
++	if (!fwreq)
++		return -ENOMEM;
++
++	err = brcmf_fw_get_firmwares(sdiodev->dev, fwreq,
++				     brcmf_sdio_firmware_callback);
++	if (err != 0) {
++		brcmf_err("async firmware request failed: %d\n", err);
++		kfree(fwreq);
++	}
++
++	return err;
++}
++
++/* Check if device is in DS1 mode and handshake with ULP UCODE */
++static bool
++brcmf_sdio_ulp_pre_redownload_check(struct brcmf_sdio *bus, u32 hmb_data)
++{
++	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
++	int err = 0;
++	u32 value = 0;
++	u32 val32, ulp_wake_ind, wowl_wake_ind;
++	int reg_addr;
++	unsigned long timeout;
++	struct brcmf_ulp *fmac_ulp = &bus->sdiodev->fmac_ulp;
++	int i = 0;
++
++	/* If any host mail box data is present, ignore DS1 exit sequence */
++	if (hmb_data)
++		return false;
++	/* Skip if DS1 Exit is already in progress
++	 * This can happen if firmware download is taking more time
++	 */
++	if (fmac_ulp->ulp_state == FMAC_ULP_TRIGGERED)
++		return false;
++
++	value = brcmf_sdiod_func0_rb(sdiod, SDIO_CCCR_IOEx, &err);
++
++	if (value == SDIO_FUNC_ENABLE_1) {
++		brcmf_dbg(ULP, "GOT THE INTERRUPT FROM UCODE\n");
++		sdiod->ulp = true;
++		fmac_ulp->ulp_state = FMAC_ULP_TRIGGERED;
++		ulp_wake_ind = D11SHM_RDW(sdiod,
++					  M_ULP_WAKE_IND(sdiod->fmac_ulp),
++					  &err);
++		wowl_wake_ind = D11SHM_RDW(sdiod,
++					   M_WAKEEVENT_IND(sdiod->fmac_ulp),
++					   &err);
++
++		brcmf_dbg(ULP, "wowl_wake_ind: 0x%08x, ulp_wake_ind: 0x%08x state %s\n",
++			  wowl_wake_ind, ulp_wake_ind, (fmac_ulp->ulp_state) ?
++			  "DS1 Exit Triggered" : "IDLE State");
++
++		if (wowl_wake_ind || ulp_wake_ind) {
++			/* RX wake Don't do anything.
++			 * Just bail out and re-download firmware.
++			 */
++			 /* Print out PHY TX error block when bit 9 set */
++			if ((ulp_wake_ind & C_DS1_PHY_TXERR) &&
++			    M_DS1_PHYTX_ERR_BLK(sdiod->fmac_ulp)) {
++				brcmf_err("Dump PHY TX Error SHM Locations\n");
++				for (i = 0; i < PHYTX_ERR_BLK_SIZE; i++) {
++					pr_err("0x%x",
++					       D11SHM_RDW(sdiod,
++					       (M_DS1_PHYTX_ERR_BLK(sdiod->fmac_ulp) +
++						(i * 2)), &err));
++				}
++				brcmf_err("\n");
++			}
++		} else {
++			/* TX wake negotiate with MAC */
++			brcmf_dbg(ULP, "M_DS1_CTRL_SDIO: 0x%08x\n",
++				  (u32)D11SHM_RDW(sdiod,
++				  M_DS1_CTRL_SDIO(sdiod->fmac_ulp),
++				  &err));
++			val32 = D11SHM_RD(sdiod,
++					  M_DS1_CTRL_SDIO(sdiod->fmac_ulp),
++					  &err);
++			D11SHM_WR(sdiod, M_DS1_CTRL_SDIO(sdiod->fmac_ulp),
++				  val32, (C_DS1_CTRL_SDIO_DS1_EXIT |
++				  C_DS1_CTRL_REQ_VALID), &err);
++			val32 = D11REG_RD(sdiod, D11_MACCONTROL_REG, &err);
++			val32 = val32 | D11_MACCONTROL_REG_WAKE;
++			D11REG_WR(sdiod, D11_MACCONTROL_REG, val32, &err);
++
++			/* Poll for PROC_DONE to be set by ucode */
++			value = D11SHM_RDW(sdiod,
++					   M_DS1_CTRL_SDIO(sdiod->fmac_ulp),
++					   &err);
++			/* Wait here (polling) for C_DS1_CTRL_PROC_DONE */
++			timeout = jiffies + ULP_HUDI_PROC_DONE_TIME;
++			while (!(value & C_DS1_CTRL_PROC_DONE)) {
++				value = D11SHM_RDW(sdiod,
++						   M_DS1_CTRL_SDIO(sdiod->fmac_ulp),
++						   &err);
++				if (time_after(jiffies, timeout))
++					break;
++				usleep_range(1000, 2000);
++			}
++			brcmf_dbg(ULP, "M_DS1_CTRL_SDIO: 0x%08x\n",
++				  (u32)D11SHM_RDW(sdiod,
++				  M_DS1_CTRL_SDIO(sdiod->fmac_ulp), &err));
++			value = D11SHM_RDW(sdiod,
++					   M_DS1_CTRL_SDIO(sdiod->fmac_ulp),
++					   &err);
++			if (!(value & C_DS1_CTRL_PROC_DONE)) {
++				brcmf_err("Timeout Failed to enter DS1 Exit state!\n");
++				return false;
++			}
++		}
++
++		ulp_wake_ind = D11SHM_RDW(sdiod,
++					  M_ULP_WAKE_IND(sdiod->fmac_ulp),
++					  &err);
++		wowl_wake_ind = D11SHM_RDW(sdiod,
++					   M_WAKEEVENT_IND(sdiod->fmac_ulp),
++					   &err);
++		brcmf_dbg(ULP, "wowl_wake_ind: 0x%08x, ulp_wake_ind: 0x%08x\n",
++			  wowl_wake_ind, ulp_wake_ind);
++		reg_addr = CORE_CC_REG(
++			  brcmf_chip_get_pmu(bus->ci)->base, min_res_mask);
++		brcmf_sdiod_writel(sdiod, reg_addr,
++				   DEFAULT_43012_MIN_RES_MASK, &err);
++		if (err)
++			brcmf_err("min_res_mask failed\n");
++
++		return true;
++	}
++
++	return false;
++}
++
+ static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
+ {
+ 	struct brcmf_sdio_dev *sdiod = bus->sdiodev;
+@@ -2651,8 +2842,11 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 
+ 	/* Handle host mailbox indication */
+ 	if (intstatus & I_HMB_HOST_INT) {
++		u32 hmb_data = 0;
+ 		intstatus &= ~I_HMB_HOST_INT;
+-		intstatus |= brcmf_sdio_hostmail(bus);
++		intstatus |= brcmf_sdio_hostmail(bus, &hmb_data);
++		if (brcmf_sdio_ulp_pre_redownload_check(bus, hmb_data))
++			brcmf_sdio_ulp_reinit_fw(bus);
+ 	}
+ 
+ 	sdio_release_host(bus->sdiodev->func1);
+@@ -2697,7 +2891,7 @@ static void brcmf_sdio_dpc(struct brcmf_
+ 	brcmf_sdio_clrintr(bus);
+ 
+ 	if (bus->ctrl_frame_stat && (bus->clkstate == CLK_AVAIL) &&
+-	    txctl_ok(bus)) {
++	    txctl_ok(bus) && brcmf_sdio_f2_ready(bus)) {
+ 		sdio_claim_host(bus->sdiodev->func1);
+ 		if (bus->ctrl_frame_stat) {
+ 			err = brcmf_sdio_tx_ctrlframe(bus,  bus->ctrl_frame_buf,
+@@ -3567,6 +3761,10 @@ static int brcmf_sdio_bus_preinit(struct
+ 	if (err < 0)
+ 		goto done;
+ 
++	/* initialize SHM address from firmware for DS1 */
++	if (!bus->sdiodev->ulp)
++		brcmf_sdio_ulp_preinit(dev);
++
+ 	bus->tx_hdrlen = SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN;
+ 	if (sdiodev->sg_support) {
+ 		bus->txglom = false;
+@@ -4215,7 +4413,7 @@ static void brcmf_sdio_firmware_callback
+ 	u8 saveclk, bpreq;
+ 	u8 devctl;
+ 
+-	brcmf_dbg(TRACE, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
++	brcmf_dbg(ULP, "Enter: dev=%s, err=%d\n", dev_name(dev), err);
+ 
+ 	if (err)
+ 		goto fail;
+@@ -4392,12 +4590,25 @@ static void brcmf_sdio_firmware_callback
+ 	}
+ 
+ 	/* Attach to the common layer, reserve hdr space */
+-	err = brcmf_attach(sdiod->dev);
++	err = brcmf_attach(sdiod->dev, !bus->sdiodev->ulp);
+ 	if (err != 0) {
+ 		brcmf_err("brcmf_attach failed\n");
+ 		goto free;
+ 	}
+ 
++	/* Register for ULP events */
++	if (sdiod->func1->device == SDIO_DEVICE_ID_BROADCOM_CYPRESS_43012)
++		brcmf_fweh_register(bus_if->drvr, BRCMF_E_ULP,
++				    brcmf_ulp_event_notify);
++
++	if (bus->sdiodev->ulp) {
++		/* For ULP, after firmware redownload complete
++		 * set ULP state to IDLE
++		 */
++		if (bus->sdiodev->fmac_ulp.ulp_state == FMAC_ULP_TRIGGERED)
++			bus->sdiodev->fmac_ulp.ulp_state = FMAC_ULP_IDLE;
++	}
++
+ 	/* ready */
+ 	return;
+ 
+@@ -4640,3 +4851,40 @@ int brcmf_sdio_sleep(struct brcmf_sdio *
+ 
+ 	return ret;
+ }
++
++/* Check F2 Ready bit before sending data to Firmware */
++static int
++brcmf_sdio_f2_ready(struct brcmf_sdio *bus)
++{
++	int ret = -1;
++	int iordy_status = 0;
++
++	sdio_claim_host(bus->sdiodev->func1);
++	/* Read the status of IOR2 */
++	iordy_status = brcmf_sdiod_func0_rb(bus->sdiodev, SDIO_CCCR_IORx, NULL);
++
++	sdio_release_host(bus->sdiodev->func1);
++	ret = iordy_status & SDIO_FUNC_ENABLE_2;
++	return ret;
++}
++
++static int brcmf_ulp_event_notify(struct brcmf_if *ifp,
++				  const struct brcmf_event_msg *evtmsg,
++				  void *data)
++{
++	int err = 0;
++	struct brcmf_bus *bus_if = ifp->drvr->bus_if;
++	struct brcmf_sdio_dev *sdiodev;
++	struct brcmf_sdio *bus;
++	struct brcmf_ulp_event *ulp_event = (struct brcmf_ulp_event *)data;
++
++	sdiodev = bus_if->bus_priv.sdio;
++	bus = sdiodev->bus;
++
++	brcmf_dbg(ULP, "Chip went to DS1 state : action %d\n",
++		  ulp_event->ulp_dongle_action);
++	if (ulp_event->ulp_dongle_action == FMAC_ULP_ENTRY)
++		bus->sdiodev->fmac_ulp.ulp_state = FMAC_ULP_ENTRY_RECV;
++
++	return err;
++}
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.h
+@@ -165,6 +165,35 @@ struct brcmf_sdreg {
+ struct brcmf_sdio;
+ struct brcmf_sdiod_freezer;
+ 
++/* ULP SHM Offsets info */
++struct ulp_shm_info {
++	u32 m_ulp_ctrl_sdio;
++	u32 m_ulp_wakeevt_ind;
++	u32 m_ulp_wakeind;
++	u32 m_ulp_phytxblk;
++};
++
++/* FMAC ULP state machine */
++#define FMAC_ULP_IDLE		(0)
++#define FMAC_ULP_ENTRY_RECV		(1)
++#define FMAC_ULP_TRIGGERED		(2)
++
++/* BRCMF_E_ULP event data */
++#define FMAC_ULP_EVENT_VERSION		1
++#define FMAC_ULP_DISABLE_CONSOLE		1 /* Disable console */
++#define FMAC_ULP_UCODE_DOWNLOAD		2 /* Download ULP ucode file */
++#define FMAC_ULP_ENTRY		3 /* Inform ulp entry to Host */
++
++struct brcmf_ulp {
++	uint ulp_state;
++	struct ulp_shm_info ulp_shm_offset;
++};
++
++struct brcmf_ulp_event {
++	u16 version;
++	u16 ulp_dongle_action;
++};
++
+ struct brcmf_sdio_dev {
+ 	struct sdio_func *func1;
+ 	struct sdio_func *func2;
+@@ -193,6 +222,8 @@ struct brcmf_sdio_dev {
+ 	enum brcmf_sdiod_state state;
+ 	struct brcmf_sdiod_freezer *freezer;
+ 	const struct firmware *clm_fw;
++	struct brcmf_ulp fmac_ulp;
++	bool ulp;
+ };
+ 
+ /* sdio core registers */
+@@ -367,4 +398,83 @@ void brcmf_sdio_wowl_config(struct devic
+ int brcmf_sdio_sleep(struct brcmf_sdio *bus, bool sleep);
+ void brcmf_sdio_trigger_dpc(struct brcmf_sdio *bus);
+ 
++/* SHM offsets */
++#define M_DS1_CTRL_SDIO(ptr)	((ptr).ulp_shm_offset.m_ulp_ctrl_sdio)
++#define M_WAKEEVENT_IND(ptr)	((ptr).ulp_shm_offset.m_ulp_wakeevt_ind)
++#define M_ULP_WAKE_IND(ptr)		((ptr).ulp_shm_offset.m_ulp_wakeind)
++#define M_DS1_PHYTX_ERR_BLK(ptr)	((ptr).ulp_shm_offset.m_ulp_phytxblk)
++
++#define D11_BASE_ADDR			0x18001000
++#define D11_AXI_BASE_ADDR		0xE8000000
++#define D11_SHM_BASE_ADDR		(D11_AXI_BASE_ADDR + 0x4000)
++
++#define D11REG_ADDR(offset)	(D11_BASE_ADDR + (offset))
++#define D11IHR_ADDR(offset)	(D11_AXI_BASE_ADDR + 0x400 + (2 * (offset)))
++#define D11SHM_ADDR(offset)	(D11_SHM_BASE_ADDR + (offset))
++
++/* MacControl register */
++#define D11_MACCONTROL_REG			D11REG_ADDR(0x120)
++#define D11_MACCONTROL_REG_WAKE		0x4000000
++
++/* HUDI Sequence SHM bits */
++#define	C_DS1_CTRL_SDIO_DS1_SLEEP		0x1
++#define	C_DS1_CTRL_SDIO_MAC_ON			0x2
++#define	C_DS1_CTRL_SDIO_RADIO_PHY_ON	0x4
++#define	C_DS1_CTRL_SDIO_DS1_EXIT		0x8
++#define	C_DS1_CTRL_PROC_DONE			0x100
++#define	C_DS1_CTRL_REQ_VALID			0x200
++
++/* M_ULP_WAKEIND bits */
++#define	C_WATCHDOG_EXPIRY	BIT(0)
++#define	C_FCBS_ERROR		BIT(1)
++#define	C_RETX_FAILURE		BIT(2)
++#define	C_HOST_WAKEUP		BIT(3)
++#define	C_INVALID_FCBS_BLOCK	BIT(4)
++#define	C_HUDI_DS1_EXIT		BIT(5)
++#define	C_LOB_SLEEP		BIT(6)
++#define	C_DS1_PHY_TXERR		BIT(9)
++#define	C_DS1_WAKE_TIMER	BIT(10)
++
++#define PHYTX_ERR_BLK_SIZE		18
++#define D11SHM_FIRST2BYTE_MASK		0xFFFF0000
++#define D11SHM_SECOND2BYTE_MASK		0x0000FFFF
++#define D11SHM_2BYTE_SHIFT		16
++
++#define D11SHM_RD(sdh, offset, ret) \
++	brcmf_sdiod_readl(sdh, D11SHM_ADDR(offset), ret)
++
++/* SHM Read is motified based on SHM 4 byte alignment as SHM size is 2 bytes and
++ * 2 byte is currently not working on FMAC
++ * If SHM address is not 4 byte aligned, then right shift by 16
++ * otherwise, mask the first two MSB bytes
++ * Suppose data in address 7260 is 0x440002 and it is 4 byte aligned
++ * Correct SHM value is 0x2 for this SHM offset and next SHM value is 0x44
++ */
++#define D11SHM_RDW(sdh, offset, ret) \
++	((offset % 4) ? \
++		(brcmf_sdiod_readl(sdh, D11SHM_ADDR(offset), ret) \
++		>> D11SHM_2BYTE_SHIFT) : \
++		(brcmf_sdiod_readl(sdh, D11SHM_ADDR(offset), ret) \
++		& D11SHM_SECOND2BYTE_MASK))
++
++/* SHM is of size 2 bytes, 4 bytes write will overwrite other SHM's
++ * First read 4 bytes and then clear the required two bytes based on
++ * 4 byte alignment, then update the required value and write the
++ * 4 byte value now
++ */
++#define D11SHM_WR(sdh, offset, val, mask, ret) \
++	do { \
++		if ((offset) % 4) \
++			val = (val & D11SHM_SECOND2BYTE_MASK) | \
++				((mask) << D11SHM_2BYTE_SHIFT); \
++		else \
++			val = (mask) | (val & D11SHM_FIRST2BYTE_MASK); \
++		brcmf_sdiod_writel(sdh, D11SHM_ADDR(offset), val, ret); \
++	} while (0)
++#define D11REG_WR(sdh, addr, val, ret) \
++	brcmf_sdiod_writel(sdh, addr, val, ret)
++
++#define D11REG_RD(sdh, addr, ret) \
++	brcmf_sdiod_readl(sdh, addr, ret)
++
+ #endif /* BRCMFMAC_SDIO_H */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
+@@ -1202,7 +1202,7 @@ static void brcmf_usb_probe_phase2(struc
+ 		goto error;
+ 
+ 	/* Attach to the common driver interface */
+-	ret = brcmf_attach(devinfo->dev);
++	ret = brcmf_attach(devinfo->dev, true);
+ 	if (ret)
+ 		goto error;
+ 
+@@ -1279,7 +1279,7 @@ static int brcmf_usb_probe_cb(struct brc
+ 		ret = brcmf_alloc(devinfo->dev, devinfo->settings);
+ 		if (ret)
+ 			goto fail;
+-		ret = brcmf_attach(devinfo->dev);
++		ret = brcmf_attach(devinfo->dev, true);
+ 		if (ret)
+ 			goto fail;
+ 		/* we are done */
+--- a/drivers/net/wireless/broadcom/brcm80211/include/chipcommon.h
++++ b/drivers/net/wireless/broadcom/brcm80211/include/chipcommon.h
+@@ -308,4 +308,6 @@ struct chipcregs {
+ */
+ #define PMU_MAX_TRANSITION_DLY	15000
+ 
++#define DEFAULT_43012_MIN_RES_MASK 0x0f8bfe77
++
+ #endif				/* _SBCHIPC_H */
diff --git a/package/kernel/mac80211/patches/brcm/870-05-rpi-6.12-brcmfmac-Fix-interoperating-DPP-and-other-encryption.patch b/package/kernel/mac80211/patches/brcm/870-05-rpi-6.12-brcmfmac-Fix-interoperating-DPP-and-other-encryption.patch
new file mode 100644
index 00000000000000..080ce2bb865709
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/870-05-rpi-6.12-brcmfmac-Fix-interoperating-DPP-and-other-encryption.patch
@@ -0,0 +1,129 @@
+From 4c1d4af0ac83705828dd11fded409163a87ea515 Mon Sep 17 00:00:00 2001
+From: Kurt Lee <kurt.lee@cypress.com>
+Date: Thu, 20 Aug 2020 03:07:02 -0500
+Subject: [PATCH] brcmfmac: Fix interoperating DPP and other encryption network
+ access
+
+1. If firmware supports 4-way handshake offload but not supports DPP
+4-way offload, when user first connects encryption network, driver will
+set "sup_wpa 1" to firmware, but it will further result in DPP
+connection failure since firmware won't send EAPOL frame to host.
+
+2. Fix DPP AP mode handling action frames.
+
+3. For some firmware without fwsup support, the join procedure will be
+skipped due to "sup_wpa" iovar returning not-support. Check the fwsup
+feature before do such iovar.
+
+Signed-off-by: Kurt Lee <kurt.lee@cypress.com>
+Signed-off-by: Double Lo <double.lo@cypress.com>
+Signed-off-by: Chi-hsien Lin <chi-hsien.lin@cypress.com>
+---
+ .../broadcom/brcm80211/brcmfmac/cfg80211.c    | 67 ++++++++++---------
+ .../broadcom/brcm80211/brcmfmac/p2p.c         |  5 ++
+ 2 files changed, 42 insertions(+), 30 deletions(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+@@ -2491,43 +2491,50 @@ brcmf_cfg80211_connect(struct wiphy *wip
+ 		goto done;
+ 	}
+ 
+-	if (sme->crypto.psk &&
+-	    profile->use_fwsup != BRCMF_PROFILE_FWSUP_SAE) {
+-		if (WARN_ON(profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE)) {
+-			err = -EINVAL;
+-			goto done;
++	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_FWSUP)) {
++		if (sme->crypto.psk) {
++			if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_SAE) {
++				if (WARN_ON(profile->use_fwsup !=
++					BRCMF_PROFILE_FWSUP_NONE)) {
++					err = -EINVAL;
++					goto done;
++				}
++				brcmf_dbg(INFO, "using PSK offload\n");
++				profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
++			}
++		} else {
++			profile->use_fwsup = BRCMF_PROFILE_FWSUP_NONE;
+ 		}
+-		brcmf_dbg(INFO, "using PSK offload\n");
+-		profile->use_fwsup = BRCMF_PROFILE_FWSUP_PSK;
+-	}
+ 
+-	if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
+-		/* enable firmware supplicant for this interface */
+-		err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
+-		if (err < 0) {
+-			bphy_err(drvr, "failed to enable fw supplicant\n");
+-			goto done;
++		if (profile->use_fwsup != BRCMF_PROFILE_FWSUP_NONE) {
++			/* enable firmware supplicant for this interface */
++			err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 1);
++			if (err < 0) {
++				bphy_err(drvr, "failed to enable fw supplicant\n");
++				goto done;
++			}
++		} else {
++			err = brcmf_fil_iovar_int_set(ifp, "sup_wpa", 0);
+ 		}
+-	}
+ 
+-	if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK)
+-		err = brcmf_set_pmk(ifp, sme->crypto.psk,
+-				    BRCMF_WSEC_MAX_PSK_LEN);
+-	else if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE) {
+-		/* clean up user-space RSNE */
+-		err = brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0);
+-		if (err) {
+-			bphy_err(drvr, "failed to clean up user-space RSNE\n");
+-			goto done;
+-		}
+-		err = brcmf_fwvid_set_sae_password(ifp, &sme->crypto);
+-		if (!err && sme->crypto.psk)
++		if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_PSK) {
+ 			err = brcmf_set_pmk(ifp, sme->crypto.psk,
+ 					    BRCMF_WSEC_MAX_PSK_LEN);
++		} else if (profile->use_fwsup == BRCMF_PROFILE_FWSUP_SAE) {
++			/* clean up user-space RSNE */
++			err = brcmf_fil_iovar_data_set(ifp, "wpaie", NULL, 0);
++			if (err) {
++				bphy_err(drvr, "failed to clean up user-space RSNE\n");
++				goto done;
++			}
++			err = brcmf_fwvid_set_sae_password(ifp, &sme->crypto);
++			if (!err && sme->crypto.psk)
++				err = brcmf_set_pmk(ifp, sme->crypto.psk,
++						    BRCMF_WSEC_MAX_PSK_LEN);
++		}
++		if (err)
++			goto done;
+ 	}
+-	if (err)
+-		goto done;
+-
+ 	/* Join with specific BSSID and cached SSID
+ 	 * If SSID is zero join based on BSSID only
+ 	 */
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+@@ -1281,6 +1281,10 @@ static s32 brcmf_p2p_abort_action_frame(
+ 	brcmf_dbg(TRACE, "Enter\n");
+ 
+ 	vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
++
++	if (!vif)
++		vif = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif;
++
+ 	err = brcmf_fil_bsscfg_data_set(vif->ifp, "actframe_abort", &int_val,
+ 					sizeof(s32));
+ 	if (err)
+@@ -1826,6 +1830,7 @@ bool brcmf_p2p_send_action_frame(struct
+ 	/* validate channel and p2p ies */
+ 	if (config_af_params.search_channel &&
+ 	    IS_P2P_SOCIAL_CHANNEL(le32_to_cpu(af_params->channel)) &&
++	    p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif &&
+ 	    p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif->saved_ie.probe_req_ie_len) {
+ 		afx_hdl = &p2p->afx_hdl;
+ 		afx_hdl->peer_listen_chan = le32_to_cpu(af_params->channel);
diff --git a/package/kernel/mac80211/patches/brcm/870-06-rpi-6.12-brcmfmac-Include-modinfo-for-43456-CLM-blob.patch b/package/kernel/mac80211/patches/brcm/870-06-rpi-6.12-brcmfmac-Include-modinfo-for-43456-CLM-blob.patch
new file mode 100644
index 00000000000000..f90406fa9ae488
--- /dev/null
+++ b/package/kernel/mac80211/patches/brcm/870-06-rpi-6.12-brcmfmac-Include-modinfo-for-43456-CLM-blob.patch
@@ -0,0 +1,26 @@
+From 0ff7f575b657b3fdfbd6902b68a28548208f4d36 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 8 May 2025 16:55:27 +0100
+Subject: [PATCH] wifi: brcmfmac: Include modinfo for 43456 CLM blob
+
+Listing firmware files in the brcmfmac modinfo helps with e.g. initramfs
+creation.
+
+See: https://github.com/raspberrypi/linux/issues/6828
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -631,7 +631,7 @@ BRCMF_FW_CLM_DEF(43430A1, "brcmfmac43430
+ BRCMF_FW_DEF(43430B0, "brcmfmac43430b0-sdio");
+ BRCMF_FW_CLM_DEF(43439, "brcmfmac43439-sdio");
+ BRCMF_FW_CLM_DEF(43455, "brcmfmac43455-sdio");
+-BRCMF_FW_DEF(43456, "brcmfmac43456-sdio");
++BRCMF_FW_CLM_DEF(43456, "brcmfmac43456-sdio");
+ BRCMF_FW_CLM_DEF(4354, "brcmfmac4354-sdio");
+ BRCMF_FW_CLM_DEF(4356, "brcmfmac4356-sdio");
+ BRCMF_FW_DEF(4359, "brcmfmac4359-sdio");
diff --git a/package/kernel/mac80211/patches/brcm/865-brcmfmac-disable-dump_survey-on-bcm2835.patch b/package/kernel/mac80211/patches/brcm/871-brcmfmac-disable-dump_survey-on-bcm2835.patch
similarity index 87%
rename from package/kernel/mac80211/patches/brcm/865-brcmfmac-disable-dump_survey-on-bcm2835.patch
rename to package/kernel/mac80211/patches/brcm/871-brcmfmac-disable-dump_survey-on-bcm2835.patch
index 275f0aa166e48a..0dd0d11c18a96a 100644
--- a/package/kernel/mac80211/patches/brcm/865-brcmfmac-disable-dump_survey-on-bcm2835.patch
+++ b/package/kernel/mac80211/patches/brcm/871-brcmfmac-disable-dump_survey-on-bcm2835.patch
@@ -9,7 +9,7 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
-@@ -7986,6 +7986,7 @@ static s32 brcmf_translate_country_code(
+@@ -7991,6 +7991,7 @@ static s32 brcmf_translate_country_code(
  	return 0;
  }
  
@@ -17,7 +17,7 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
  static int
  brcmf_parse_dump_obss(char *buf, struct brcmf_dump_survey *survey)
  {
-@@ -8208,6 +8209,7 @@ exit:
+@@ -8213,6 +8214,7 @@ exit:
  		brcmf_set_mpc(ifp, 1);
  	return err;
  }
@@ -25,7 +25,7 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
  
  static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy,
  					struct regulatory_request *req)
-@@ -8360,8 +8362,10 @@ struct brcmf_cfg80211_info *brcmf_cfg802
+@@ -8379,8 +8381,10 @@ struct brcmf_cfg80211_info *brcmf_cfg802
  	if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_WOWL_GTK))
  		ops->set_rekey_data = brcmf_cfg80211_set_rekey_data;
  #endif
diff --git a/package/kernel/mac80211/patches/build/070-remove-broken-wext-select.patch b/package/kernel/mac80211/patches/build/070-remove-broken-wext-select.patch
deleted file mode 100644
index 121b7faad93795..00000000000000
--- a/package/kernel/mac80211/patches/build/070-remove-broken-wext-select.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- a/drivers/staging/rtl8723bs/Kconfig
-+++ b/drivers/staging/rtl8723bs/Kconfig
-@@ -5,7 +5,6 @@ config RTL8723BS
- 	depends on m
- 	depends on WLAN && MMC && CFG80211
- 	depends on m
--	select CFG80211_WEXT
- 	depends on CRYPTO
- 	select BPAUTO_CRYPTO_LIB_ARC4
- 	help
diff --git a/package/kernel/mac80211/patches/build/120-headers_version_fix.patch b/package/kernel/mac80211/patches/build/120-headers_version_fix.patch
deleted file mode 100644
index 29f500a4d069b4..00000000000000
--- a/package/kernel/mac80211/patches/build/120-headers_version_fix.patch
+++ /dev/null
@@ -1,14 +0,0 @@
---- a/backport-include/net/dropreason.h
-+++ b/backport-include/net/dropreason.h
-@@ -3,10 +3,9 @@
- 
- #include <linux/version.h>
- 
-+#include <net/dropreason-core.h>
- #if LINUX_VERSION_IS_GEQ(6,0,0)
- #include_next <net/dropreason.h>
--#else
--#include <net/dropreason-core.h>
- #endif
- 
- #if LINUX_VERSION_IS_LESS(6,4,0)
diff --git a/package/kernel/mac80211/patches/build/140-trace_backport.patch b/package/kernel/mac80211/patches/build/140-trace_backport.patch
index 00ee47e1a46392..8b77b7e83d9f0b 100644
--- a/package/kernel/mac80211/patches/build/140-trace_backport.patch
+++ b/package/kernel/mac80211/patches/build/140-trace_backport.patch
@@ -1,6 +1,6 @@
 --- a/drivers/bus/mhi/host/trace.h
 +++ b/drivers/bus/mhi/host/trace.h
-@@ -103,7 +103,7 @@ TRACE_EVENT(mhi_gen_tre,
+@@ -104,7 +104,7 @@ TRACE_EVENT(mhi_gen_tre,
  	),
  
  	TP_fast_assign(
@@ -8,8 +8,8 @@
 +		__assign_str(name, mhi_cntrl->mhi_dev->name);
  		__entry->ch_num = mhi_chan->chan;
  		__entry->wp = mhi_tre;
- 		__entry->tre_ptr = mhi_tre->ptr;
-@@ -131,7 +131,7 @@ TRACE_EVENT(mhi_intvec_states,
+ 		__entry->tre_ptr = le64_to_cpu(mhi_tre->ptr);
+@@ -132,7 +132,7 @@ TRACE_EVENT(mhi_intvec_states,
  	),
  
  	TP_fast_assign(
@@ -18,7 +18,7 @@
  		__entry->local_ee = mhi_cntrl->ee;
  		__entry->state = mhi_cntrl->dev_state;
  		__entry->dev_ee = dev_ee;
-@@ -158,7 +158,7 @@ TRACE_EVENT(mhi_tryset_pm_state,
+@@ -159,7 +159,7 @@ TRACE_EVENT(mhi_tryset_pm_state,
  	),
  
  	TP_fast_assign(
@@ -27,16 +27,16 @@
  		if (pm_state)
  			pm_state = __fls(pm_state);
  		__entry->pm_state = pm_state;
-@@ -184,7 +184,7 @@ DECLARE_EVENT_CLASS(mhi_process_event_ri
+@@ -185,7 +185,7 @@ DECLARE_EVENT_CLASS(mhi_process_event_ri
  	),
  
  	TP_fast_assign(
 -		__assign_str(name);
 +		__assign_str(name, mhi_cntrl->mhi_dev->name);
  		__entry->rp = rp;
- 		__entry->ptr = rp->ptr;
- 		__entry->dword0 = rp->dword[0];
-@@ -226,7 +226,7 @@ DECLARE_EVENT_CLASS(mhi_update_channel_s
+ 		__entry->ptr = le64_to_cpu(rp->ptr);
+ 		__entry->dword0 = le32_to_cpu(rp->dword[0]);
+@@ -227,7 +227,7 @@ DECLARE_EVENT_CLASS(mhi_update_channel_s
  	),
  
  	TP_fast_assign(
@@ -45,7 +45,7 @@
  		__entry->ch_num = mhi_chan->chan;
  		__entry->state = state;
  		__entry->reason = reason;
-@@ -265,7 +265,7 @@ TRACE_EVENT(mhi_pm_st_transition,
+@@ -266,7 +266,7 @@ TRACE_EVENT(mhi_pm_st_transition,
  	),
  
  	TP_fast_assign(
diff --git a/package/kernel/mac80211/patches/build/150-ath_iommu_paging_domain_revert.patch b/package/kernel/mac80211/patches/build/150-ath_iommu_paging_domain_revert.patch
index 2c5235e49f1a38..f5ef0c629c286d 100644
--- a/package/kernel/mac80211/patches/build/150-ath_iommu_paging_domain_revert.patch
+++ b/package/kernel/mac80211/patches/build/150-ath_iommu_paging_domain_revert.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/ath/ath10k/snoc.c
 +++ b/drivers/net/wireless/ath/ath10k/snoc.c
-@@ -1635,10 +1635,10 @@ static int ath10k_fw_init(struct ath10k
+@@ -1637,10 +1637,10 @@ static int ath10k_fw_init(struct ath10k
  
  	ar_snoc->fw.dev = &pdev->dev;
  
diff --git a/package/kernel/mac80211/patches/build/210-wireless_netns_local_backport.patch b/package/kernel/mac80211/patches/build/210-wireless_netns_local_backport.patch
new file mode 100644
index 00000000000000..9a467c43b168b8
--- /dev/null
+++ b/package/kernel/mac80211/patches/build/210-wireless_netns_local_backport.patch
@@ -0,0 +1,44 @@
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -165,11 +165,15 @@ int cfg80211_switch_netns(struct cfg8021
+ 	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
+ 		if (!wdev->netdev)
+ 			continue;
++#if LINUX_VERSION_IS_GEQ(6,12,0)
+ 		wdev->netdev->netns_local = false;
++#endif
+ 		err = dev_change_net_namespace(wdev->netdev, net, "wlan%d");
+ 		if (err)
+ 			break;
++#if LINUX_VERSION_IS_GEQ(6,12,0)
+ 		wdev->netdev->netns_local = true;
++#endif
+ 	}
+ 
+ 	if (err) {
+@@ -181,11 +185,15 @@ int cfg80211_switch_netns(struct cfg8021
+ 						     list) {
+ 			if (!wdev->netdev)
+ 				continue;
++#if LINUX_VERSION_IS_GEQ(6,12,0)
+ 			wdev->netdev->netns_local = false;
++#endif
+ 			err = dev_change_net_namespace(wdev->netdev, net,
+ 							"wlan%d");
+ 			WARN_ON(err);
++#if LINUX_VERSION_IS_GEQ(6,12,0)
+ 			wdev->netdev->netns_local = true;
++#endif
+ 		}
+ 
+ 		return err;
+@@ -1525,7 +1533,9 @@ static int cfg80211_netdev_notifier_call
+ 		SET_NETDEV_DEVTYPE(dev, &wiphy_type);
+ 		wdev->netdev = dev;
+ 		/* can only change netns with wiphy */
++#if LINUX_VERSION_IS_GEQ(6,12,0)
+ 		dev->netns_local = true;
++#endif
+ 
+ 		cfg80211_init_wdev(wdev);
+ 		break;
diff --git a/package/kernel/mac80211/patches/build/230-brcmfmac_usb_driver_backport.patch b/package/kernel/mac80211/patches/build/220-brcmfmac_usb_driver_backport.patch
similarity index 84%
rename from package/kernel/mac80211/patches/build/230-brcmfmac_usb_driver_backport.patch
rename to package/kernel/mac80211/patches/build/220-brcmfmac_usb_driver_backport.patch
index 25dab46905428b..185b71f1ff05ef 100644
--- a/package/kernel/mac80211/patches/build/230-brcmfmac_usb_driver_backport.patch
+++ b/package/kernel/mac80211/patches/build/220-brcmfmac_usb_driver_backport.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c
-@@ -1574,7 +1574,11 @@ static int brcmf_usb_reset_device(struct
+@@ -1576,7 +1576,11 @@ static int brcmf_usb_reset_device(struct
  
  void brcmf_usb_exit(void)
  {
diff --git a/package/kernel/mac80211/patches/build/235-fix-init_vqs-build-error-on-kernel-6.6.patch b/package/kernel/mac80211/patches/build/230-fix-init_vqs-build-error-on-kernel-6.6.patch
similarity index 87%
rename from package/kernel/mac80211/patches/build/235-fix-init_vqs-build-error-on-kernel-6.6.patch
rename to package/kernel/mac80211/patches/build/230-fix-init_vqs-build-error-on-kernel-6.6.patch
index 4b0fe6003f6692..229deee9e8c7c9 100644
--- a/package/kernel/mac80211/patches/build/235-fix-init_vqs-build-error-on-kernel-6.6.patch
+++ b/package/kernel/mac80211/patches/build/230-fix-init_vqs-build-error-on-kernel-6.6.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/virtual/mac80211_hwsim.c
 +++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
-@@ -6629,6 +6629,7 @@ static void hwsim_virtio_rx_done(struct
+@@ -6636,6 +6636,7 @@ static void hwsim_virtio_rx_done(struct
  
  static int init_vqs(struct virtio_device *vdev)
  {
@@ -8,7 +8,7 @@
  	struct virtqueue_info vqs_info[HWSIM_NUM_VQS] = {
  		[HWSIM_VQ_TX] = { "tx", hwsim_virtio_tx_done },
  		[HWSIM_VQ_RX] = { "rx", hwsim_virtio_rx_done },
-@@ -6636,6 +6637,19 @@ static int init_vqs(struct virtio_device
+@@ -6643,6 +6644,19 @@ static int init_vqs(struct virtio_device
  
  	return virtio_find_vqs(vdev, HWSIM_NUM_VQS,
  			       hwsim_vqs, vqs_info, NULL);
diff --git a/package/kernel/mac80211/patches/build/300-backports-handle-genlmsg_multicast_allns-upstream-ba.patch b/package/kernel/mac80211/patches/build/300-backports-handle-genlmsg_multicast_allns-upstream-ba.patch
new file mode 100644
index 00000000000000..523b5c67f42de5
--- /dev/null
+++ b/package/kernel/mac80211/patches/build/300-backports-handle-genlmsg_multicast_allns-upstream-ba.patch
@@ -0,0 +1,121 @@
+From 8dc94a59cfad70ec3a808add56718255eee39ab2 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Sat, 29 Mar 2025 12:50:55 +0100
+Subject: [PATCH] backports: handle genlmsg_multicast_allns upstream backport
+ changes
+
+Better handle genlmsg_multicast_allns upstream backport changes that
+dropped a flag to the function middle version. Use a backport function
+if backports project is tried to be built on older kernel version.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+---
+ backport-include/net/genetlink.h | 11 +++++
+ compat/Makefile                  |  3 +-
+ compat/backport-genetlink.c      | 60 +++++++++++++++++++++++
+ 3 files changed, 73 insertions(+), 1 deletion(-)
+
+--- a/backport-include/net/genetlink.h
++++ b/backport-include/net/genetlink.h
+@@ -172,4 +172,15 @@ static inline int genlmsg_parse(const st
+ }
+ #endif /* LINUX_VERSION_IS_LESS(5,2,0) */
+ 
++#if LINUX_VERSION_IN_RANGE(5,15,0,5,15,169) || \
++    LINUX_VERSION_IN_RANGE(6,1,0,6,1,115) || \
++    LINUX_VERSION_IN_RANGE(6,6,0,6,6,58)
++#define genlmsg_multicast_allns LINUX_BACKPORT(genlmsg_multicast_allns)
++int backport_genlmsg_multicast_allns(const struct genl_family *family,
++				     struct sk_buff *skb, u32 portid,
++				     unsigned int group);
++#endif /* LINUX_VERSION_IN_RANGE(5,15,0,5,15,169) ||
++	  LINUX_VERSION_IN_RANGE(6,1,0,6,1,115) ||
++	  LINUX_VERSION_IN_RANGE(6,6,0,6,6,58) */
++
+ #endif /* __BACKPORT_NET_GENETLINK_H */
+--- a/compat/Makefile
++++ b/compat/Makefile
+@@ -16,7 +16,8 @@ compat-$(CPTCFG_KERNEL_5_9) += backport-
+ compat-$(CPTCFG_KERNEL_5_10) += backport-5.10.o
+ compat-$(CPTCFG_KERNEL_5_11) += backport-5.11.o
+ compat-$(CPTCFG_KERNEL_5_13) += backport-5.13.o
+-compat-$(CPTCFG_KERNEL_5_15) += backport-5.15.o
++compat-$(CPTCFG_KERNEL_5_15) += backport-5.15.o backport-genetlink.o
++compat-$(CPTCFG_KERNEL_6_1) += backport-genetlink.o
+ compat-$(CPTCFG_KERNEL_6_4) += backport-6.4.o
+ compat-$(CPTCFG_KERNEL_6_11) += backport-6.11.o
+ 
+--- a/compat/backport-genetlink.c
++++ b/compat/backport-genetlink.c
+@@ -17,6 +17,7 @@
+ #include <net/netlink.h>
+ #include <net/sock.h>
+ 
++#if LINUX_VERSION_IS_LESS(5,2,0)
+ static const struct genl_family *find_family_real_ops(const struct genl_ops **ops)
+ {
+ 	const struct genl_family *family;
+@@ -249,3 +250,63 @@ int backport_genlmsg_multicast_allns(con
+ 	return genlmsg_mcast(skb, portid, group);
+ }
+ EXPORT_SYMBOL_GPL(backport_genlmsg_multicast_allns);
++#endif /* LINUX_VERSION_IS_LESS(5,2,0) */
++
++#if LINUX_VERSION_IN_RANGE(5,15,0,5,15,169) || \
++    LINUX_VERSION_IN_RANGE(6,1,0,6,1,115) || \
++    LINUX_VERSION_IN_RANGE(6,6,0,6,6,58)
++static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group)
++{
++	struct sk_buff *tmp;
++	struct net *net, *prev = NULL;
++	bool delivered = false;
++	int err;
++
++	rcu_read_lock();
++	for_each_net_rcu(net) {
++		if (prev) {
++			tmp = skb_clone(skb, GFP_ATOMIC);
++			if (!tmp) {
++				err = -ENOMEM;
++				goto error;
++			}
++			err = nlmsg_multicast(prev->genl_sock, tmp,
++					      portid, group, GFP_ATOMIC);
++			if (!err)
++				delivered = true;
++			else if (err != -ESRCH)
++				goto error;
++		}
++
++		prev = net;
++	}
++	err = nlmsg_multicast(prev->genl_sock, skb, portid, group, GFP_ATOMIC);
++
++	rcu_read_unlock();
++
++	if (!err)
++		delivered = true;
++	else if (err != -ESRCH)
++		return err;
++	return delivered ? 0 : -ESRCH;
++ error:
++	rcu_read_unlock();
++
++	kfree_skb(skb);
++	return err;
++}
++
++int backport_genlmsg_multicast_allns(const struct genl_family *family,
++				     struct sk_buff *skb, u32 portid,
++				     unsigned int group)
++{
++	if (WARN_ON_ONCE(group >= family->n_mcgrps))
++		return -EINVAL;
++
++	group = family->mcgrp_offset + group;
++	return genlmsg_mcast(skb, portid, group);
++}
++EXPORT_SYMBOL_GPL(backport_genlmsg_multicast_allns);
++#endif /* LINUX_VERSION_IN_RANGE(5,15,0,5,15,169) ||
++	  LINUX_VERSION_IN_RANGE(6,1,0,6,1,115) ||
++	  LINUX_VERSION_IN_RANGE(6,6,0,6,6,58) */
diff --git a/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch b/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
index c3324f4289f8af..7baab80d245254 100644
--- a/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
+++ b/package/kernel/mac80211/patches/mwl/700-mwl8k-missing-pci-id-for-WNR854T.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/mwl8k.c
 +++ b/drivers/net/wireless/marvell/mwl8k.c
-@@ -5709,6 +5709,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
+@@ -5716,6 +5716,7 @@ MODULE_FIRMWARE("mwl8k/fmimage_8366.fw")
  MODULE_FIRMWARE(MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API));
  
  static const struct pci_device_id mwl8k_pci_id_table[] = {
diff --git a/package/kernel/mac80211/patches/mwl/900-mwifiex-increase-the-global-limit-up-to-4-SSID.patch b/package/kernel/mac80211/patches/mwl/900-mwifiex-increase-the-global-limit-up-to-4-SSID.patch
index caa139a2c6eae9..484b37bfcc53d5 100644
--- a/package/kernel/mac80211/patches/mwl/900-mwifiex-increase-the-global-limit-up-to-4-SSID.patch
+++ b/package/kernel/mac80211/patches/mwl/900-mwifiex-increase-the-global-limit-up-to-4-SSID.patch
@@ -30,7 +30,7 @@ the card-specific structure.
  
  #define MWIFIEX_DMA_ALIGN_SZ	    64
  #define MWIFIEX_RX_HEADROOM	    64
-@@ -100,7 +100,7 @@
+@@ -123,7 +123,7 @@
  #define MWIFIEX_RATE_INDEX_OFDM0   4
  
  #define MWIFIEX_MAX_STA_NUM		3
diff --git a/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch b/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
index 062b0600d0c8d4..d021b1e40b9b15 100644
--- a/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
+++ b/package/kernel/mac80211/patches/mwl/940-mwl8k_init_devices_synchronously.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/wireless/marvell/mwl8k.c
 +++ b/drivers/net/wireless/marvell/mwl8k.c
-@@ -6295,6 +6295,8 @@ static int mwl8k_probe(struct pci_dev *p
+@@ -6302,6 +6302,8 @@ static int mwl8k_probe(struct pci_dev *p
  
  	priv->running_bsses = 0;
  
@@ -9,7 +9,7 @@
  	return rc;
  
  err_stop_firmware:
-@@ -6328,8 +6330,6 @@ static void mwl8k_remove(struct pci_dev
+@@ -6335,8 +6337,6 @@ static void mwl8k_remove(struct pci_dev
  		return;
  	priv = hw->priv;
  
diff --git a/package/kernel/mac80211/patches/mwl/950-mwifiex-Print-stringified-name-of-command-in-error-l.patch b/package/kernel/mac80211/patches/mwl/950-mwifiex-Print-stringified-name-of-command-in-error-l.patch
index a7ecabde8296a6..93a213265c641c 100644
--- a/package/kernel/mac80211/patches/mwl/950-mwifiex-Print-stringified-name-of-command-in-error-l.patch
+++ b/package/kernel/mac80211/patches/mwl/950-mwifiex-Print-stringified-name-of-command-in-error-l.patch
@@ -116,7 +116,7 @@ Signed-off-by: Pali Rohár <pali@kernel.org>
  		mwifiex_recycle_cmd_node(adapter, cmd_node);
  		queue_work(adapter->workqueue, &adapter->main_work);
  		return -1;
-@@ -653,8 +732,8 @@ int mwifiex_send_cmd(struct mwifiex_priv
+@@ -655,8 +734,8 @@ int mwifiex_send_cmd(struct mwifiex_priv
  	/* Return error, since the command preparation failed */
  	if (ret) {
  		mwifiex_dbg(adapter, ERROR,
@@ -127,7 +127,7 @@ Signed-off-by: Pali Rohár <pali@kernel.org>
  		mwifiex_insert_cmd_to_free_q(adapter, cmd_node);
  		return -1;
  	}
-@@ -902,8 +981,9 @@ int mwifiex_process_cmdresp(struct mwifi
+@@ -904,8 +983,9 @@ int mwifiex_process_cmdresp(struct mwifi
  	if (adapter->hw_status == MWIFIEX_HW_STATUS_INITIALIZING) {
  		if (ret) {
  			mwifiex_dbg(adapter, ERROR,
@@ -139,7 +139,7 @@ Signed-off-by: Pali Rohár <pali@kernel.org>
  			mwifiex_init_fw_complete(adapter);
  			return -1;
  		} else if (adapter->last_init_cmd == cmdresp_no)
-@@ -1265,8 +1345,8 @@ mwifiex_process_sleep_confirm_resp(struc
+@@ -1287,8 +1367,8 @@ mwifiex_process_sleep_confirm_resp(struc
  
  	if (command != HostCmd_CMD_802_11_PS_MODE_ENH) {
  		mwifiex_dbg(adapter, ERROR,
@@ -152,7 +152,7 @@ Signed-off-by: Pali Rohár <pali@kernel.org>
  
 --- a/drivers/net/wireless/marvell/mwifiex/main.h
 +++ b/drivers/net/wireless/marvell/mwifiex/main.h
-@@ -1084,6 +1084,8 @@ void mwifiex_cancel_all_pending_cmd(stru
+@@ -1100,6 +1100,8 @@ void mwifiex_cancel_all_pending_cmd(stru
  void mwifiex_cancel_pending_scan_cmd(struct mwifiex_adapter *adapter);
  void mwifiex_cancel_scan(struct mwifiex_adapter *adapter);
  
@@ -177,7 +177,7 @@ Signed-off-by: Pali Rohár <pali@kernel.org>
  		adapter->cmd_wait_q.status = -1;
 --- a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
 +++ b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
-@@ -802,7 +802,8 @@ int mwifiex_uap_prepare_cmd(struct mwifi
+@@ -964,7 +964,8 @@ int mwifiex_uap_prepare_cmd(struct mwifi
  		break;
  	default:
  		mwifiex_dbg(priv->adapter, ERROR,
diff --git a/package/kernel/mac80211/patches/rt2x00/602-01-wifi-rt2x00-Add-support-for-loading-EEPROM-from-user.patch b/package/kernel/mac80211/patches/rt2x00/602-01-wifi-rt2x00-Add-support-for-loading-EEPROM-from-user.patch
index b6b1e0da96382d..f3c8ddd4f6533d 100644
--- a/package/kernel/mac80211/patches/rt2x00/602-01-wifi-rt2x00-Add-support-for-loading-EEPROM-from-user.patch
+++ b/package/kernel/mac80211/patches/rt2x00/602-01-wifi-rt2x00-Add-support-for-loading-EEPROM-from-user.patch
@@ -151,7 +151,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 +	}
 +
 +	if (!ee_name)
-+		return 0;
++		return -ENOENT;
 +
 +	rt2x00_info(rt2x00dev, "Loading EEPROM data from '%s'.\n", ee_name);
 +
diff --git a/package/kernel/mac80211/patches/rt2x00/603-wifi-rt2x00-Add-support-for-loading-EEPROM-from-devicetree-embedded-data.patch b/package/kernel/mac80211/patches/rt2x00/603-wifi-rt2x00-Add-support-for-loading-EEPROM-from-devicetree-embedded-data.patch
new file mode 100644
index 00000000000000..0ef946a6cb78b5
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/603-wifi-rt2x00-Add-support-for-loading-EEPROM-from-devicetree-embedded-data.patch
@@ -0,0 +1,76 @@
+From adf957124a115bdf3e4728e1ea8c70a632648cf0 Mon Sep 17 00:00:00 2001
+From: Coia Prant <coiaprant@gmail.com>
+Date: Fri, 14 Feb 2025 15:49:55 +0800
+Subject: [PATCH] wifi: rt2x00: Add support for loading EEPROM from devicetree
+ embedded data
+
+This patch allows rt2x00 to load eeprom from devicetree embedded data.
+
+Example:
+
+/* load eeprom from embedded data 'eeprom-data' */
+&wmac {
+	ralink,eeprom-data = <0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff>;
+};
+
+Signed-off-by: Coia Prant <coiaprant@gmail.com>
+---
+ .../net/wireless/ralink/rt2x00/rt2x00eeprom.c | 25 +++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
+@@ -33,6 +33,27 @@ static void rt2800lib_eeprom_swap(struct
+ 		rt2x00dev->eeprom[i] = swab16(rt2x00dev->eeprom[i]);
+ }
+ 
++static int rt2800lib_read_eeprom_data(struct rt2x00_dev *rt2x00dev)
++{
++	struct device_node *np = rt2x00dev->dev->of_node;
++	unsigned int len = rt2x00dev->ops->eeprom_size;
++	const void *data;
++	int size;
++
++	data = of_get_property(np, "ralink,eeprom-data", &size);
++	if (!data)
++		return -ENOENT;
++
++	if (size != len) {
++		dev_err(rt2x00dev->dev, "invalid eeprom size, required: 0x%04x\n", len);
++		return -EINVAL;
++	}
++
++	memcpy(rt2x00dev->eeprom, data, size);
++
++	return 0;
++}
++
+ #if IS_ENABLED(CONFIG_MTD)
+ static int rt2800lib_read_eeprom_mtd(struct rt2x00_dev *rt2x00dev)
+ {
+@@ -193,6 +214,10 @@ int rt2x00lib_read_eeprom(struct rt2x00_
+ {
+ 	int ret;
+ 
++	ret = rt2800lib_read_eeprom_data(rt2x00dev);
++	if (!ret)
++		return 0;
++
+ #if IS_ENABLED(CONFIG_MTD)
+ 	ret = rt2800lib_read_eeprom_mtd(rt2x00dev);
+ 	if (!ret)
diff --git a/package/kernel/mac80211/patches/rt2x00/620-01-rt2x00-respect-rt2800-hardware-TX-queue-index.patch b/package/kernel/mac80211/patches/rt2x00/620-01-rt2x00-respect-rt2800-hardware-TX-queue-index.patch
new file mode 100644
index 00000000000000..e2c75979dfec2a
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/620-01-rt2x00-respect-rt2800-hardware-TX-queue-index.patch
@@ -0,0 +1,257 @@
+From 654653e718f6c55c6f29fd94cc8152a92c8166ac Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Tue, 24 Dec 2024 08:36:32 +0800
+Subject: [PATCH 1/2] rt2x00: respect the rt2800 hardware TX queue index
+
+The Ralink TX queue register index is different from the Linux
+IEEE80211 queue id definition. Their conversion table is as follows:
+
+Queue   IEEE80211   Ralink
+AC_VO      0          3
+AC_VI      1          2
+AC_BE      2          0
+AC_BK      3          1
+
+The TX queues are still functioning properly under the current
+configuration. I don't have evidence, but I believe there should
+be some differences in the internal hardware implementation of
+different TX queues, e.g. interrupt priority. so it's better to
+respect the queue index defined by the Ralink when we construct
+the TX rings and descriptors.
+
+And the more important thing is that we are using the wrong queue
+index to calculate the register offset and mask in .conf_tx(),
+which resulted in writing incorrect AIFSN, CWMAX, CWMIN and TXOP
+values for all TX queues. This patch introduces a index conversion
+table to fix these parameters.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800.h   | 24 ++++++------
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 20 +++++++---
+ .../net/wireless/ralink/rt2x00/rt2800mmio.c   | 38 ++++++++++---------
+ .../net/wireless/ralink/rt2x00/rt2x00queue.h  | 20 ++++++++++
+ 4 files changed, 67 insertions(+), 35 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800.h
+@@ -379,10 +379,10 @@
+ 
+ /*
+  * WMM_AIFSN_CFG: Aifsn for each EDCA AC
+- * AIFSN0: AC_VO
+- * AIFSN1: AC_VI
+- * AIFSN2: AC_BE
+- * AIFSN3: AC_BK
++ * AIFSN0: AC_BE
++ * AIFSN1: AC_BK
++ * AIFSN2: AC_VI
++ * AIFSN3: AC_VO
+  */
+ #define WMM_AIFSN_CFG			0x0214
+ #define WMM_AIFSN_CFG_AIFSN0		FIELD32(0x0000000f)
+@@ -392,10 +392,10 @@
+ 
+ /*
+  * WMM_CWMIN_CSR: CWmin for each EDCA AC
+- * CWMIN0: AC_VO
+- * CWMIN1: AC_VI
+- * CWMIN2: AC_BE
+- * CWMIN3: AC_BK
++ * CWMIN0: AC_BE
++ * CWMIN1: AC_BK
++ * CWMIN2: AC_VI
++ * CWMIN3: AC_VO
+  */
+ #define WMM_CWMIN_CFG			0x0218
+ #define WMM_CWMIN_CFG_CWMIN0		FIELD32(0x0000000f)
+@@ -405,10 +405,10 @@
+ 
+ /*
+  * WMM_CWMAX_CSR: CWmax for each EDCA AC
+- * CWMAX0: AC_VO
+- * CWMAX1: AC_VI
+- * CWMAX2: AC_BE
+- * CWMAX3: AC_BK
++ * CWMAX0: AC_BE
++ * CWMAX1: AC_BK
++ * CWMAX2: AC_VI
++ * CWMAX3: AC_VO
+  */
+ #define WMM_CWMAX_CFG			0x021c
+ #define WMM_CWMAX_CFG_CWMAX0		FIELD32(0x0000000f)
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -835,7 +835,8 @@ void rt2800_write_tx_data(struct queue_e
+ 			   txdesc->key_idx : txdesc->u.ht.wcid);
+ 	rt2x00_set_field32(&word, TXWI_W1_MPDU_TOTAL_BYTE_COUNT,
+ 			   txdesc->length);
+-	rt2x00_set_field32(&word, TXWI_W1_PACKETID_QUEUE, entry->queue->qid);
++	rt2x00_set_field32(&word, TXWI_W1_PACKETID_QUEUE,
++			   rt2x00_ac_to_hwq(entry->queue->qid));
+ 	rt2x00_set_field32(&word, TXWI_W1_PACKETID_ENTRY, (entry->entry_idx % 3) + 1);
+ 	rt2x00_desc_write(txwi, 1, word);
+ 
+@@ -1125,6 +1126,12 @@ void rt2800_txdone(struct rt2x00_dev *rt
+ 	u32 reg;
+ 	u8 qid;
+ 	bool match;
++	static const u8 rt2ac[] = {
++		IEEE80211_AC_BE,
++		IEEE80211_AC_BK,
++		IEEE80211_AC_VI,
++		IEEE80211_AC_VO,
++	};
+ 
+ 	while (quota-- > 0 && kfifo_get(&rt2x00dev->txstatus_fifo, &reg)) {
+ 		/*
+@@ -1132,6 +1139,8 @@ void rt2800_txdone(struct rt2x00_dev *rt
+ 		 * guaranteed to be one of the TX QIDs .
+ 		 */
+ 		qid = rt2x00_get_field32(reg, TX_STA_FIFO_PID_QUEUE);
++		/* Convert Ralink hardware queue index to IEEE80211 queue id. */
++		qid = rt2ac[qid];
+ 		queue = rt2x00queue_get_tx_queue(rt2x00dev, qid);
+ 
+ 		if (unlikely(rt2x00queue_empty(queue))) {
+@@ -12188,8 +12197,9 @@ int rt2800_conf_tx(struct ieee80211_hw *
+ 	queue = rt2x00queue_get_tx_queue(rt2x00dev, queue_idx);
+ 
+ 	/* Update WMM TXOP register */
+-	offset = WMM_TXOP0_CFG + (sizeof(u32) * (!!(queue_idx & 2)));
+-	field.bit_offset = (queue_idx & 1) * 16;
++	offset = WMM_TXOP0_CFG +
++		 (sizeof(u32) * (!!(rt2x00_ac_to_hwq(queue_idx) & 2)));
++	field.bit_offset = (rt2x00_ac_to_hwq(queue_idx) & 1) * 16;
+ 	field.bit_mask = 0xffff << field.bit_offset;
+ 
+ 	reg = rt2800_register_read(rt2x00dev, offset);
+@@ -12197,7 +12207,7 @@ int rt2800_conf_tx(struct ieee80211_hw *
+ 	rt2800_register_write(rt2x00dev, offset, reg);
+ 
+ 	/* Update WMM registers */
+-	field.bit_offset = queue_idx * 4;
++	field.bit_offset = rt2x00_ac_to_hwq(queue_idx) * 4;
+ 	field.bit_mask = 0xf << field.bit_offset;
+ 
+ 	reg = rt2800_register_read(rt2x00dev, WMM_AIFSN_CFG);
+@@ -12213,7 +12223,7 @@ int rt2800_conf_tx(struct ieee80211_hw *
+ 	rt2800_register_write(rt2x00dev, WMM_CWMAX_CFG, reg);
+ 
+ 	/* Update EDCA registers */
+-	offset = EDCA_AC0_CFG + (sizeof(u32) * queue_idx);
++	offset = EDCA_AC0_CFG + (sizeof(u32) * rt2x00_ac_to_hwq(queue_idx));
+ 
+ 	reg = rt2800_register_read(rt2x00dev, offset);
+ 	rt2x00_set_field32(&reg, EDCA_AC0_CFG_TX_OP, queue->txop);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800mmio.c
+@@ -35,7 +35,7 @@ unsigned int rt2800mmio_get_dma_done(str
+ 	case QID_AC_VI:
+ 	case QID_AC_BE:
+ 	case QID_AC_BK:
+-		qid = queue->qid;
++		qid = rt2x00_ac_to_hwq(queue->qid);
+ 		idx = rt2x00mmio_register_read(rt2x00dev, TX_DTX_IDX(qid));
+ 		break;
+ 	case QID_MGMT:
+@@ -456,6 +456,7 @@ void rt2800mmio_kick_queue(struct data_q
+ {
+ 	struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
+ 	struct queue_entry *entry;
++	u8 qid;
+ 
+ 	switch (queue->qid) {
+ 	case QID_AC_VO:
+@@ -464,7 +465,8 @@ void rt2800mmio_kick_queue(struct data_q
+ 	case QID_AC_BK:
+ 		WARN_ON_ONCE(rt2x00queue_empty(queue));
+ 		entry = rt2x00queue_get_entry(queue, Q_INDEX);
+-		rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX(queue->qid),
++		qid = rt2x00_ac_to_hwq(queue->qid);
++		rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX(qid),
+ 					  entry->entry_idx);
+ 		hrtimer_start(&rt2x00dev->txstatus_timer,
+ 			      TXSTATUS_TIMEOUT, HRTIMER_MODE_REL);
+@@ -666,36 +668,36 @@ int rt2800mmio_init_queues(struct rt2x00
+ 	 * Initialize registers.
+ 	 */
+ 	entry_priv = rt2x00dev->tx[0].entries[0].priv_data;
+-	rt2x00mmio_register_write(rt2x00dev, TX_BASE_PTR0,
++	rt2x00mmio_register_write(rt2x00dev, TX_BASE_PTR3,
+ 				  entry_priv->desc_dma);
+-	rt2x00mmio_register_write(rt2x00dev, TX_MAX_CNT0,
++	rt2x00mmio_register_write(rt2x00dev, TX_MAX_CNT3,
+ 				  rt2x00dev->tx[0].limit);
+-	rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX0, 0);
+-	rt2x00mmio_register_write(rt2x00dev, TX_DTX_IDX0, 0);
++	rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX3, 0);
++	rt2x00mmio_register_write(rt2x00dev, TX_DTX_IDX3, 0);
+ 
+ 	entry_priv = rt2x00dev->tx[1].entries[0].priv_data;
+-	rt2x00mmio_register_write(rt2x00dev, TX_BASE_PTR1,
++	rt2x00mmio_register_write(rt2x00dev, TX_BASE_PTR2,
+ 				  entry_priv->desc_dma);
+-	rt2x00mmio_register_write(rt2x00dev, TX_MAX_CNT1,
++	rt2x00mmio_register_write(rt2x00dev, TX_MAX_CNT2,
+ 				  rt2x00dev->tx[1].limit);
+-	rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX1, 0);
+-	rt2x00mmio_register_write(rt2x00dev, TX_DTX_IDX1, 0);
++	rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX2, 0);
++	rt2x00mmio_register_write(rt2x00dev, TX_DTX_IDX2, 0);
+ 
+ 	entry_priv = rt2x00dev->tx[2].entries[0].priv_data;
+-	rt2x00mmio_register_write(rt2x00dev, TX_BASE_PTR2,
++	rt2x00mmio_register_write(rt2x00dev, TX_BASE_PTR0,
+ 				  entry_priv->desc_dma);
+-	rt2x00mmio_register_write(rt2x00dev, TX_MAX_CNT2,
++	rt2x00mmio_register_write(rt2x00dev, TX_MAX_CNT0,
+ 				  rt2x00dev->tx[2].limit);
+-	rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX2, 0);
+-	rt2x00mmio_register_write(rt2x00dev, TX_DTX_IDX2, 0);
++	rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX0, 0);
++	rt2x00mmio_register_write(rt2x00dev, TX_DTX_IDX0, 0);
+ 
+ 	entry_priv = rt2x00dev->tx[3].entries[0].priv_data;
+-	rt2x00mmio_register_write(rt2x00dev, TX_BASE_PTR3,
++	rt2x00mmio_register_write(rt2x00dev, TX_BASE_PTR1,
+ 				  entry_priv->desc_dma);
+-	rt2x00mmio_register_write(rt2x00dev, TX_MAX_CNT3,
++	rt2x00mmio_register_write(rt2x00dev, TX_MAX_CNT1,
+ 				  rt2x00dev->tx[3].limit);
+-	rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX3, 0);
+-	rt2x00mmio_register_write(rt2x00dev, TX_DTX_IDX3, 0);
++	rt2x00mmio_register_write(rt2x00dev, TX_CTX_IDX1, 0);
++	rt2x00mmio_register_write(rt2x00dev, TX_DTX_IDX1, 0);
+ 
+ 	rt2x00mmio_register_write(rt2x00dev, TX_BASE_PTR4, 0);
+ 	rt2x00mmio_register_write(rt2x00dev, TX_MAX_CNT4, 0);
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.h
+@@ -57,6 +57,26 @@ enum data_queue_qid {
+ };
+ 
+ /**
++ * rt2x00_ac_to_hwq - Convert IEEE80211 queue id to Ralink hardware
++ * queue register index.
++ * @ac: TX queue id.
++ */
++static inline u8 rt2x00_ac_to_hwq(enum data_queue_qid ac)
++{
++	static const u8 ralink_queue_map[] = {
++		[IEEE80211_AC_BE] = 0,
++		[IEEE80211_AC_BK] = 1,
++		[IEEE80211_AC_VI] = 2,
++		[IEEE80211_AC_VO] = 3,
++	};
++
++	if (unlikely(ac >= IEEE80211_NUM_ACS))
++		return ac;
++
++	return ralink_queue_map[ac];
++}
++
++/**
+  * enum skb_frame_desc_flags: Flags for &struct skb_frame_desc
+  *
+  * @SKBDESC_DMA_MAPPED_RX: &skb_dma field has been mapped for RX
diff --git a/package/kernel/mac80211/patches/rt2x00/620-02-rt2x00-increase-the-watchdog-sampling-frequency.patch b/package/kernel/mac80211/patches/rt2x00/620-02-rt2x00-increase-the-watchdog-sampling-frequency.patch
new file mode 100644
index 00000000000000..c60d2ad54a93fe
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/620-02-rt2x00-increase-the-watchdog-sampling-frequency.patch
@@ -0,0 +1,74 @@
+From aec50d1a30349759de0ac535f54c3441bf7ebef7 Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Sun, 22 Dec 2024 17:06:59 +0800
+Subject: [PATCH 2/2] rt2x00: increase the watchdog sampling frequency
+
+Increase the sampling frequency of the watchdog when the hung
+counter reaches the threshold to avoid some unnecessary resets.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 45 +++++++++++++------
+ 1 file changed, 32 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -1320,26 +1320,45 @@ static bool rt2800_watchdog_hung(struct
+ 	return true;
+ }
+ 
++static inline bool check_dma_busy_rx(u32 reg_cfg, u32 reg_int)
++{
++	return (rt2x00_get_field32(reg_cfg, WPDMA_GLO_CFG_RX_DMA_BUSY) &&
++		rt2x00_get_field32(reg_int, INT_SOURCE_CSR_RX_COHERENT));
++}
++
++static inline bool check_dma_busy_tx(u32 reg_cfg, u32 reg_int)
++{
++	return (rt2x00_get_field32(reg_cfg, WPDMA_GLO_CFG_TX_DMA_BUSY) &&
++		rt2x00_get_field32(reg_int, INT_SOURCE_CSR_TX_COHERENT));
++}
++
+ static bool rt2800_watchdog_dma_busy(struct rt2x00_dev *rt2x00dev)
+ {
+ 	bool busy_rx, busy_tx;
+ 	u32 reg_cfg = rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG);
+ 	u32 reg_int = rt2800_register_read(rt2x00dev, INT_SOURCE_CSR);
+ 
+-	if (rt2x00_get_field32(reg_cfg, WPDMA_GLO_CFG_RX_DMA_BUSY) &&
+-	    rt2x00_get_field32(reg_int, INT_SOURCE_CSR_RX_COHERENT))
+-		rt2x00dev->rxdma_busy++;
+-	else
+-		rt2x00dev->rxdma_busy = 0;
+-
+-	if (rt2x00_get_field32(reg_cfg, WPDMA_GLO_CFG_TX_DMA_BUSY) &&
+-	    rt2x00_get_field32(reg_int, INT_SOURCE_CSR_TX_COHERENT))
+-		rt2x00dev->txdma_busy++;
+-	else
+-		rt2x00dev->txdma_busy = 0;
++	rt2x00dev->rxdma_busy = check_dma_busy_rx(reg_cfg, reg_int) ?
++				rt2x00dev->rxdma_busy + 1 : 0;
++	rt2x00dev->txdma_busy = check_dma_busy_tx(reg_cfg, reg_int) ?
++				rt2x00dev->txdma_busy + 1 : 0;
++
++	if (rt2x00dev->rxdma_busy > 25 || rt2x00dev->txdma_busy > 25) {
++		int cnt;
++		for (cnt = 0; cnt < 10; cnt++) {
++			msleep(5);
++			reg_cfg = rt2800_register_read(rt2x00dev, WPDMA_GLO_CFG);
++			reg_int = rt2800_register_read(rt2x00dev, INT_SOURCE_CSR);
++
++			if (!check_dma_busy_rx(reg_cfg, reg_int))
++				rt2x00dev->rxdma_busy = 0;
++			if (!check_dma_busy_tx(reg_cfg, reg_int))
++				rt2x00dev->txdma_busy = 0;
++		}
++	}
+ 
+-	busy_rx = rt2x00dev->rxdma_busy > 30;
+-	busy_tx = rt2x00dev->txdma_busy > 30;
++	busy_rx = rt2x00dev->rxdma_busy > 40;
++	busy_tx = rt2x00dev->txdma_busy > 40;
+ 
+ 	if (!busy_rx && !busy_tx)
+ 		return false;
diff --git a/package/kernel/mac80211/patches/rt2x00/621-01-rt2x00-always-calibrate-MT7620-when-switching-channe.patch b/package/kernel/mac80211/patches/rt2x00/621-01-rt2x00-always-calibrate-MT7620-when-switching-channe.patch
new file mode 100644
index 00000000000000..e66fbd43694cae
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/621-01-rt2x00-always-calibrate-MT7620-when-switching-channe.patch
@@ -0,0 +1,77 @@
+From 2c5aad0f9990724cce48e0a53b66bc0438e4603d Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Sun, 22 Dec 2024 17:06:59 +0800
+Subject: [PATCH 1/4] rt2x00: always calibrate MT7620 when switching channel
+
+Perform calibration work after each channel switching operation.
+This should help improve the rx/tx signal strength for MT7620.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 24 ++++++++++++++-----
+ 1 file changed, 18 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -5704,6 +5704,9 @@ static void rt2800_config_ps(struct rt2x
+ 	}
+ }
+ 
++static void rt2800_calibration_rt6352_stage1(struct rt2x00_dev *rt2x00dev);
++static void rt2800_calibration_rt6352_stage2(struct rt2x00_dev *rt2x00dev);
++
+ void rt2800_config(struct rt2x00_dev *rt2x00dev,
+ 		   struct rt2x00lib_conf *libconf,
+ 		   const unsigned int flags)
+@@ -5718,10 +5721,18 @@ void rt2800_config(struct rt2x00_dev *rt
+ 		 */
+ 		rt2800_update_survey(rt2x00dev);
+ 
++		if (rt2x00_rt(rt2x00dev, RT6352) &&
++		    !test_bit(DEVICE_STATE_SCANNING, &rt2x00dev->flags))
++			rt2800_calibration_rt6352_stage1(rt2x00dev);
++
+ 		rt2800_config_channel(rt2x00dev, libconf->conf,
+ 				      &libconf->rf, &libconf->channel);
+ 		rt2800_config_txpower(rt2x00dev, libconf->conf->chandef.chan,
+ 				      libconf->conf->power_level);
++
++		if (rt2x00_rt(rt2x00dev, RT6352) &&
++		    !test_bit(DEVICE_STATE_SCANNING, &rt2x00dev->flags))
++			rt2800_calibration_rt6352_stage2(rt2x00dev);
+ 	}
+ 	if (flags & IEEE80211_CONF_CHANGE_POWER)
+ 		rt2800_config_txpower(rt2x00dev, libconf->conf->chandef.chan,
+@@ -10427,15 +10438,19 @@ static void rt2800_restore_rf_bbp_rt6352
+ 	}
+ }
+ 
+-static void rt2800_calibration_rt6352(struct rt2x00_dev *rt2x00dev)
++static void rt2800_calibration_rt6352_stage1(struct rt2x00_dev *rt2x00dev)
+ {
+-	u32 reg;
+-
+ 	if (rt2x00_has_cap_external_pa(rt2x00dev) ||
+ 	    rt2x00_has_cap_external_lna_bg(rt2x00dev))
+ 		rt2800_restore_rf_bbp_rt6352(rt2x00dev);
+ 
+ 	rt2800_r_calibration(rt2x00dev);
++}
++
++static void rt2800_calibration_rt6352_stage2(struct rt2x00_dev *rt2x00dev)
++{
++	u32 reg;
++
+ 	rt2800_rf_self_txdc_cal(rt2x00dev);
+ 	rt2800_rxdcoc_calibration(rt2x00dev);
+ 	rt2800_bw_filter_calibration(rt2x00dev, true);
+@@ -10766,9 +10781,6 @@ static void rt2800_init_rfcsr_6352(struc
+ 
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
+ 	rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
+-
+-	/* Do calibration and init PA/LNA */
+-	rt2800_calibration_rt6352(rt2x00dev);
+ }
+ 
+ static void rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
diff --git a/package/kernel/mac80211/patches/rt2x00/621-02-rt2x00-rework-link-tuner-for-MT7620.patch b/package/kernel/mac80211/patches/rt2x00/621-02-rt2x00-rework-link-tuner-for-MT7620.patch
new file mode 100644
index 00000000000000..f7e7a8e5ffad9a
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/621-02-rt2x00-rework-link-tuner-for-MT7620.patch
@@ -0,0 +1,48 @@
+From aaa57924324c1ee77afa5e3effc95cc86158ddcc Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Sun, 22 Dec 2024 17:06:59 +0800
+Subject: [PATCH 2/4] rt2x00: rework link tuner for MT7620
+
+Correct the VGC gain value for MT7620 and only do gain calibration
+for supported devices.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -5561,6 +5561,9 @@ static void rt2800_config_txpower(struct
+ 
+ void rt2800_gain_calibration(struct rt2x00_dev *rt2x00dev)
+ {
++	if (rt2x00_rt(rt2x00dev, RT6352))
++		return;
++
+ 	rt2800_config_txpower(rt2x00dev, rt2x00dev->hw->conf.chandef.chan,
+ 			      rt2x00dev->tx_power);
+ }
+@@ -5773,9 +5776,10 @@ static u8 rt2800_get_default_vgc(struct
+ 		    rt2x00_rt(rt2x00dev, RT3593) ||
+ 		    rt2x00_rt(rt2x00dev, RT5390) ||
+ 		    rt2x00_rt(rt2x00dev, RT5392) ||
+-		    rt2x00_rt(rt2x00dev, RT5592) ||
+-		    rt2x00_rt(rt2x00dev, RT6352))
++		    rt2x00_rt(rt2x00dev, RT5592))
+ 			vgc = 0x1c + (2 * rt2x00dev->lna_gain);
++		else if(rt2x00_rt(rt2x00dev, RT6352))
++			vgc = 0x04 + (2 * rt2x00dev->lna_gain);
+ 		else
+ 			vgc = 0x2e + rt2x00dev->lna_gain;
+ 	} else { /* 5GHZ band */
+@@ -5828,7 +5832,8 @@ void rt2800_link_tuner(struct rt2x00_dev
+ {
+ 	u8 vgc;
+ 
+-	if (rt2x00_rt_rev(rt2x00dev, RT2860, REV_RT2860C))
++	if (rt2x00_rt_rev(rt2x00dev, RT2860, REV_RT2860C) ||
++	    rt2x00_rt(rt2x00dev, RT6352))
+ 		return;
+ 
+ 	/* When RSSI is better than a certain threshold, increase VGC
diff --git a/package/kernel/mac80211/patches/rt2x00/621-03-rt2x00-correct-MT7620-SDM-mode-register-value.patch b/package/kernel/mac80211/patches/rt2x00/621-03-rt2x00-correct-MT7620-SDM-mode-register-value.patch
new file mode 100644
index 00000000000000..7c376df197a011
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/621-03-rt2x00-correct-MT7620-SDM-mode-register-value.patch
@@ -0,0 +1,25 @@
+From b672507ca9f06bb17213036b16bc4f5c5bc65357 Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Sun, 22 Dec 2024 17:06:59 +0800
+Subject: [PATCH 3/4] rt2x00: correct MT7620 SDM mode register value
+
+rt2x00_set_field8() is a mask writing function. If we want to set
+the BIT(7) for the SDM mode register here, we only need to fill "4"
+in the mask.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -3848,7 +3848,7 @@ static void rt2800_config_channel_rf7620
+ 
+ 	/* Default: XO=20MHz , SDM mode */
+ 	rfcsr = rt2800_rfcsr_read(rt2x00dev, 16);
+-	rt2x00_set_field8(&rfcsr, RFCSR16_SDM_MODE_MT7620, 0x80);
++	rt2x00_set_field8(&rfcsr, RFCSR16_SDM_MODE_MT7620, 4);
+ 	rt2800_rfcsr_write(rt2x00dev, 16, rfcsr);
+ 
+ 	rfcsr = rt2800_rfcsr_read(rt2x00dev, 21);
diff --git a/package/kernel/mac80211/patches/rt2x00/621-04-rt2x00-fix-register-operation-on-RXIQ-calibration.patch b/package/kernel/mac80211/patches/rt2x00/621-04-rt2x00-fix-register-operation-on-RXIQ-calibration.patch
new file mode 100644
index 00000000000000..aa6f9c437c6447
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/621-04-rt2x00-fix-register-operation-on-RXIQ-calibration.patch
@@ -0,0 +1,60 @@
+From 2585ada646e4dcf152ab813a24d667e6903105f4 Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Sun, 22 Dec 2024 17:06:59 +0800
+Subject: [PATCH 4/4] rt2x00: fix register operation on RXIQ calibration
+
+In rt2800_rxiq_calibration(), some variables are overwritten
+before being used. Based on the values of the relevant registers
+in other functions, I believe the correct operation should be
+bit mask writing.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ drivers/net/wireless/ralink/rt2x00/rt2800lib.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -8846,7 +8846,7 @@ static void rt2800_rxiq_calibration(stru
+ 		rt2x00_warn(rt2x00dev, "Timeout waiting for MAC status in RXIQ calibration\n");
+ 
+ 	bbpval = bbp4 & (~0x18);
+-	bbpval = bbp4 | 0x00;
++	bbpval = bbpval | 0x00;
+ 	rt2800_bbp_write(rt2x00dev, 4, bbpval);
+ 
+ 	bbpval = rt2800_bbp_read(rt2x00dev, 21);
+@@ -8928,13 +8928,13 @@ static void rt2800_rxiq_calibration(stru
+ 	for (ch_idx = 0; ch_idx < 2; ch_idx = ch_idx + 1) {
+ 		if (ch_idx == 0) {
+ 			rfval = rfb0r1 & (~0x3);
+-			rfval = rfb0r1 | 0x1;
++			rfval = rfval | 0x1;
+ 			rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, rfval);
+ 			rfval = rfb0r2 & (~0x33);
+-			rfval = rfb0r2 | 0x11;
++			rfval = rfval | 0x11;
+ 			rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, rfval);
+ 			rfval = rfb0r42 & (~0x50);
+-			rfval = rfb0r42 | 0x10;
++			rfval = rfval | 0x10;
+ 			rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfval);
+ 
+ 			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00001006);
+@@ -8947,13 +8947,13 @@ static void rt2800_rxiq_calibration(stru
+ 			rt2800_bbp_dcoc_write(rt2x00dev, 1, 0x00);
+ 		} else {
+ 			rfval = rfb0r1 & (~0x3);
+-			rfval = rfb0r1 | 0x2;
++			rfval = rfval | 0x2;
+ 			rt2800_rfcsr_write_bank(rt2x00dev, 0, 1, rfval);
+ 			rfval = rfb0r2 & (~0x33);
+-			rfval = rfb0r2 | 0x22;
++			rfval = rfval | 0x22;
+ 			rt2800_rfcsr_write_bank(rt2x00dev, 0, 2, rfval);
+ 			rfval = rfb0r42 & (~0x50);
+-			rfval = rfb0r42 | 0x40;
++			rfval = rfval | 0x40;
+ 			rt2800_rfcsr_write_bank(rt2x00dev, 0, 42, rfval);
+ 
+ 			rt2800_register_write(rt2x00dev, RF_CONTROL0, 0x00002006);
diff --git a/package/kernel/mac80211/patches/rt2x00/622-01-rt2x00-fix-RFCSR-register-init-values-for-RT5592.patch b/package/kernel/mac80211/patches/rt2x00/622-01-rt2x00-fix-RFCSR-register-init-values-for-RT5592.patch
new file mode 100644
index 00000000000000..15d1601eef1f8d
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/622-01-rt2x00-fix-RFCSR-register-init-values-for-RT5592.patch
@@ -0,0 +1,230 @@
+From b48887d5de9921d0ff9e88068e3cd555a383d702 Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Sun, 22 Dec 2024 17:06:59 +0800
+Subject: [PATCH 1/2] rt2x00: fix RFCSR register init values for RT5592
+
+Based on Raink proprietary driver 2.7.1.5, correct the initial
+values of some RFCSR registers for RT5592.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 122 ++++++++----------
+ 1 file changed, 53 insertions(+), 69 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -3576,9 +3576,8 @@ static void rt2800_config_channel_rf55xx
+ 
+ 		/* TODO RF27 <- tssi */
+ 
+-		rfcsr = rf->channel <= 10 ? 0x07 : 0x06;
+-		rt2800_rfcsr_write(rt2x00dev, 23, rfcsr);
+-		rt2800_rfcsr_write(rt2x00dev, 59, rfcsr);
++		rt2800_rfcsr_write(rt2x00dev, 23, rf->channel <= 10 ? 0x08 : 0x07);
++		rt2800_rfcsr_write(rt2x00dev, 59, rf->channel <= 4 ? 0x06 : 0x04);
+ 
+ 		if (is_11b) {
+ 			/* CCK */
+@@ -3599,7 +3598,7 @@ static void rt2800_config_channel_rf55xx
+ 		power_bound = POWER_BOUND;
+ 		ep_reg = 0x2;
+ 	} else {
+-		rt2800_rfcsr_write(rt2x00dev, 10, 0x97);
++		rt2800_rfcsr_write(rt2x00dev, 10, 0x95);
+ 		/* FIMXE: RF11 overwrite */
+ 		rt2800_rfcsr_write(rt2x00dev, 11, 0x40);
+ 		rt2800_rfcsr_write(rt2x00dev, 25, 0xBF);
+@@ -3608,13 +3607,15 @@ static void rt2800_config_channel_rf55xx
+ 		rt2800_rfcsr_write(rt2x00dev, 37, 0x04);
+ 		rt2800_rfcsr_write(rt2x00dev, 38, 0x85);
+ 		rt2800_rfcsr_write(rt2x00dev, 40, 0x42);
+-		rt2800_rfcsr_write(rt2x00dev, 41, 0xBB);
++		rt2800_rfcsr_write(rt2x00dev, 41, 0xAB);
+ 		rt2800_rfcsr_write(rt2x00dev, 42, 0xD7);
+-		rt2800_rfcsr_write(rt2x00dev, 45, 0x41);
++		rt2800_rfcsr_write(rt2x00dev, 45, 0x01);
+ 		rt2800_rfcsr_write(rt2x00dev, 48, 0x00);
+ 		rt2800_rfcsr_write(rt2x00dev, 57, 0x77);
++		rt2800_rfcsr_write(rt2x00dev, 58, 0x19);
+ 		rt2800_rfcsr_write(rt2x00dev, 60, 0x05);
+ 		rt2800_rfcsr_write(rt2x00dev, 61, 0x01);
++		rt2800_rfcsr_write(rt2x00dev, 62, 0x19);
+ 
+ 		/* TODO RF27 <- tssi */
+ 
+@@ -3623,82 +3624,59 @@ static void rt2800_config_channel_rf55xx
+ 			rt2800_rfcsr_write(rt2x00dev, 12, 0x2E);
+ 			rt2800_rfcsr_write(rt2x00dev, 13, 0x22);
+ 			rt2800_rfcsr_write(rt2x00dev, 22, 0x60);
+-			rt2800_rfcsr_write(rt2x00dev, 23, 0x7F);
+-			if (rf->channel <= 50)
+-				rt2800_rfcsr_write(rt2x00dev, 24, 0x09);
+-			else if (rf->channel >= 52)
+-				rt2800_rfcsr_write(rt2x00dev, 24, 0x07);
++			rt2800_rfcsr_write(rt2x00dev, 23, 0x7E);
++			rt2800_rfcsr_write(rt2x00dev, 24, 0x07);
+ 			rt2800_rfcsr_write(rt2x00dev, 39, 0x1C);
+ 			rt2800_rfcsr_write(rt2x00dev, 43, 0x5B);
+-			rt2800_rfcsr_write(rt2x00dev, 44, 0X40);
+ 			rt2800_rfcsr_write(rt2x00dev, 46, 0X00);
+-			rt2800_rfcsr_write(rt2x00dev, 51, 0xFE);
+-			rt2800_rfcsr_write(rt2x00dev, 52, 0x0C);
+-			rt2800_rfcsr_write(rt2x00dev, 54, 0xF8);
++			rt2800_rfcsr_write(rt2x00dev, 51, 0xFD);
++			rt2800_rfcsr_write(rt2x00dev, 52, 0x0E);
++			rt2800_rfcsr_write(rt2x00dev, 55, 0x04);
++			rt2800_rfcsr_write(rt2x00dev, 56, 0xBB);
++			rt2800_rfcsr_write(rt2x00dev, 59, 0x7C);
++
+ 			if (rf->channel <= 50) {
+-				rt2800_rfcsr_write(rt2x00dev, 55, 0x06),
+-				rt2800_rfcsr_write(rt2x00dev, 56, 0xD3);
++				rt2800_rfcsr_write(rt2x00dev, 44, 0X32);
++				rt2800_rfcsr_write(rt2x00dev, 54, 0xF9);
+ 			} else if (rf->channel >= 52) {
+-				rt2800_rfcsr_write(rt2x00dev, 55, 0x04);
+-				rt2800_rfcsr_write(rt2x00dev, 56, 0xBB);
++				rt2800_rfcsr_write(rt2x00dev, 44, 0X2A);
++				rt2800_rfcsr_write(rt2x00dev, 54, 0xF8);
+ 			}
+-
+-			rt2800_rfcsr_write(rt2x00dev, 58, 0x15);
+-			rt2800_rfcsr_write(rt2x00dev, 59, 0x7F);
+-			rt2800_rfcsr_write(rt2x00dev, 62, 0x15);
+-
+ 		} else if (rf->channel >= 100 && rf->channel <= 165) {
+-
+ 			rt2800_rfcsr_write(rt2x00dev, 12, 0x0E);
+ 			rt2800_rfcsr_write(rt2x00dev, 13, 0x42);
+ 			rt2800_rfcsr_write(rt2x00dev, 22, 0x40);
+-			if (rf->channel <= 153) {
+-				rt2800_rfcsr_write(rt2x00dev, 23, 0x3C);
+-				rt2800_rfcsr_write(rt2x00dev, 24, 0x06);
+-			} else if (rf->channel >= 155) {
+-				rt2800_rfcsr_write(rt2x00dev, 23, 0x38);
+-				rt2800_rfcsr_write(rt2x00dev, 24, 0x05);
+-			}
++			rt2800_rfcsr_write(rt2x00dev, 52, 0x06);
++			rt2800_rfcsr_write(rt2x00dev, 55, 0x01);
++
+ 			if (rf->channel <= 138) {
++				rt2800_rfcsr_write(rt2x00dev, 23, 0x7C);
+ 				rt2800_rfcsr_write(rt2x00dev, 39, 0x1A);
+ 				rt2800_rfcsr_write(rt2x00dev, 43, 0x3B);
+-				rt2800_rfcsr_write(rt2x00dev, 44, 0x20);
+ 				rt2800_rfcsr_write(rt2x00dev, 46, 0x18);
+-			} else if (rf->channel >= 140) {
++			} else {
++				rt2800_rfcsr_write(rt2x00dev, 23, 0x78);
+ 				rt2800_rfcsr_write(rt2x00dev, 39, 0x18);
+ 				rt2800_rfcsr_write(rt2x00dev, 43, 0x1B);
+-				rt2800_rfcsr_write(rt2x00dev, 44, 0x10);
+ 				rt2800_rfcsr_write(rt2x00dev, 46, 0X08);
+ 			}
+-			if (rf->channel <= 124)
+-				rt2800_rfcsr_write(rt2x00dev, 51, 0xFC);
+-			else if (rf->channel >= 126)
+-				rt2800_rfcsr_write(rt2x00dev, 51, 0xEC);
+-			if (rf->channel <= 138)
+-				rt2800_rfcsr_write(rt2x00dev, 52, 0x06);
+-			else if (rf->channel >= 140)
+-				rt2800_rfcsr_write(rt2x00dev, 52, 0x06);
+-			rt2800_rfcsr_write(rt2x00dev, 54, 0xEB);
+-			if (rf->channel <= 138)
+-				rt2800_rfcsr_write(rt2x00dev, 55, 0x01);
+-			else if (rf->channel >= 140)
+-				rt2800_rfcsr_write(rt2x00dev, 55, 0x00);
+-			if (rf->channel <= 128)
+-				rt2800_rfcsr_write(rt2x00dev, 56, 0xBB);
+-			else if (rf->channel >= 130)
+-				rt2800_rfcsr_write(rt2x00dev, 56, 0xAB);
+-			if (rf->channel <= 116)
+-				rt2800_rfcsr_write(rt2x00dev, 58, 0x1D);
+-			else if (rf->channel >= 118)
+-				rt2800_rfcsr_write(rt2x00dev, 58, 0x15);
+-			if (rf->channel <= 138)
+-				rt2800_rfcsr_write(rt2x00dev, 59, 0x3F);
+-			else if (rf->channel >= 140)
+-				rt2800_rfcsr_write(rt2x00dev, 59, 0x7C);
+-			if (rf->channel <= 116)
+-				rt2800_rfcsr_write(rt2x00dev, 62, 0x1D);
+-			else if (rf->channel >= 118)
+-				rt2800_rfcsr_write(rt2x00dev, 62, 0x15);
++
++			if (rf->channel <= 114) {
++				rt2800_rfcsr_write(rt2x00dev, 24, 0x02);
++				rt2800_rfcsr_write(rt2x00dev, 44, 0x1A);
++				rt2800_rfcsr_write(rt2x00dev, 54, 0xEA);
++				rt2800_rfcsr_write(rt2x00dev, 56, 0xB3);
++			} else {
++				rt2800_rfcsr_write(rt2x00dev, 24, 0x03);
++				rt2800_rfcsr_write(rt2x00dev, 44, 0x0A);
++				rt2800_rfcsr_write(rt2x00dev, 54, 0xF9);
++				rt2800_rfcsr_write(rt2x00dev, 56, 0x9B);
++			}
++
++			rt2800_rfcsr_write(rt2x00dev, 51, rf->channel <= 124 ? 0xFC : 0xEC);
++			rt2800_rfcsr_write(rt2x00dev, 58, rf->channel <= 116 ? 0x1D : 0x15);
++			rfcsr = (rf->channel >= 116 && rf->channel <= 138) ? 0x7E : 0x7C;
++			rt2800_rfcsr_write(rt2x00dev, 59, rfcsr);
+ 		}
+ 
+ 		power_bound = POWER_BOUND_5G;
+@@ -3710,7 +3688,7 @@ static void rt2800_config_channel_rf55xx
+ 		rt2x00_set_field8(&rfcsr, RFCSR49_TX, power_bound);
+ 	else
+ 		rt2x00_set_field8(&rfcsr, RFCSR49_TX, info->default_power1);
+-	if (is_type_ep)
++	if (!is_type_ep)
+ 		rt2x00_set_field8(&rfcsr, RFCSR49_EP, ep_reg);
+ 	rt2800_rfcsr_write(rt2x00dev, 49, rfcsr);
+ 
+@@ -3719,7 +3697,7 @@ static void rt2800_config_channel_rf55xx
+ 		rt2x00_set_field8(&rfcsr, RFCSR50_TX, power_bound);
+ 	else
+ 		rt2x00_set_field8(&rfcsr, RFCSR50_TX, info->default_power2);
+-	if (is_type_ep)
++	if (!is_type_ep)
+ 		rt2x00_set_field8(&rfcsr, RFCSR50_EP, ep_reg);
+ 	rt2800_rfcsr_write(rt2x00dev, 50, rfcsr);
+ 
+@@ -3740,7 +3718,6 @@ static void rt2800_config_channel_rf55xx
+ 	rt2x00_set_field8(&rfcsr, RFCSR1_RX2_PD, 0);
+ 
+ 	rt2800_rfcsr_write(rt2x00dev, 1, rfcsr);
+-	rt2800_rfcsr_write(rt2x00dev, 6, 0xe4);
+ 
+ 	if (conf_is_ht40(conf))
+ 		rt2800_rfcsr_write(rt2x00dev, 30, 0x16);
+@@ -8505,12 +8482,15 @@ static void rt2800_init_rfcsr_5392(struc
+ 
+ static void rt2800_init_rfcsr_5592(struct rt2x00_dev *rt2x00dev)
+ {
++	u16 eeprom;
++
+ 	rt2800_rf_init_calibration(rt2x00dev, 30);
+ 
+ 	rt2800_rfcsr_write(rt2x00dev, 1, 0x3F);
++	rt2800_rfcsr_write(rt2x00dev, 2, 0x80);
+ 	rt2800_rfcsr_write(rt2x00dev, 3, 0x08);
+ 	rt2800_rfcsr_write(rt2x00dev, 5, 0x10);
+-	rt2800_rfcsr_write(rt2x00dev, 6, 0xE4);
++	rt2800_rfcsr_write(rt2x00dev, 6, 0xE0);
+ 	rt2800_rfcsr_write(rt2x00dev, 7, 0x00);
+ 	rt2800_rfcsr_write(rt2x00dev, 14, 0x00);
+ 	rt2800_rfcsr_write(rt2x00dev, 15, 0x00);
+@@ -8526,9 +8506,13 @@ static void rt2800_init_rfcsr_5592(struc
+ 	rt2800_rfcsr_write(rt2x00dev, 34, 0x07);
+ 	rt2800_rfcsr_write(rt2x00dev, 35, 0x12);
+ 	rt2800_rfcsr_write(rt2x00dev, 47, 0x0C);
+-	rt2800_rfcsr_write(rt2x00dev, 53, 0x22);
++	rt2800_rfcsr_write(rt2x00dev, 53, 0x44);
+ 	rt2800_rfcsr_write(rt2x00dev, 63, 0x07);
+ 
++	eeprom = rt2800_eeprom_read(rt2x00dev, EEPROM_NIC_CONF2);
++	if (!rt2x00_get_field16(eeprom, EEPROM_NIC_CONF2_CRYSTAL))
++		rt2800_rfcsr_write(rt2x00dev, 6, 0xE4);
++
+ 	rt2800_rfcsr_write(rt2x00dev, 2, 0x80);
+ 	msleep(1);
+ 
diff --git a/package/kernel/mac80211/patches/rt2x00/622-02-rt2x00-fix-BBP-register-init-values-for-RT5592.patch b/package/kernel/mac80211/patches/rt2x00/622-02-rt2x00-fix-BBP-register-init-values-for-RT5592.patch
new file mode 100644
index 00000000000000..19d1951b7b51d8
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/622-02-rt2x00-fix-BBP-register-init-values-for-RT5592.patch
@@ -0,0 +1,119 @@
+From 1847d817df5585f9d957d16ed2a56ceb41cf6df7 Mon Sep 17 00:00:00 2001
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Sun, 22 Dec 2024 17:06:59 +0800
+Subject: [PATCH 2/2] rt2x00: fix BBP register init values for RT5592
+
+Based on Raink proprietary driver 2.7.1.5, correct the initial
+values of some BBP registers for RT5592.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ .../net/wireless/ralink/rt2x00/rt2800lib.c    | 32 +++++++++----------
+ 1 file changed, 15 insertions(+), 17 deletions(-)
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
+@@ -3746,6 +3746,7 @@ static void rt2800_config_channel_rf55xx
+ 	rt2800_bbp_write(rt2x00dev, 80, (rf->channel <= 14) ? 0x0E : 0x08);
+ 	rt2800_bbp_write(rt2x00dev, 81, (rf->channel <= 14) ? 0x3A : 0x38);
+ 	rt2800_bbp_write(rt2x00dev, 82, (rf->channel <= 14) ? 0x62 : 0x92);
++	rt2800_bbp_write(rt2x00dev, 95, (rf->channel <= 14) ? 0x9A : 0x1A);
+ 
+ 	/* GLRT band configuration */
+ 	rt2800_bbp_write(rt2x00dev, 195, 128);
+@@ -3758,7 +3759,7 @@ static void rt2800_config_channel_rf55xx
+ 	rt2800_bbp_write(rt2x00dev, 196, (rf->channel <= 14) ? 0x32 : 0x20);
+ 	rt2800_bbp_write(rt2x00dev, 195, 133);
+ 	rt2800_bbp_write(rt2x00dev, 196, (rf->channel <= 14) ? 0x28 : 0x7F);
+-	rt2800_bbp_write(rt2x00dev, 195, 124);
++	rt2800_bbp_write(rt2x00dev, 195, 134);
+ 	rt2800_bbp_write(rt2x00dev, 196, (rf->channel <= 14) ? 0x19 : 0x7F);
+ }
+ 
+@@ -4304,7 +4305,8 @@ static void rt2800_config_channel(struct
+ 		rt2800_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
+ 		rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
+ 		rt2800_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
+-		if (rt2x00_rt(rt2x00dev, RT6352))
++		if (rt2x00_rt(rt2x00dev, RT5592) ||
++		    rt2x00_rt(rt2x00dev, RT6352))
+ 			rt2800_bbp_write(rt2x00dev, 86, 0x38);
+ 		else
+ 			rt2800_bbp_write(rt2x00dev, 86, 0);
+@@ -4313,6 +4315,7 @@ static void rt2800_config_channel(struct
+ 	if (rf->channel <= 14) {
+ 		if (!rt2x00_rt(rt2x00dev, RT5390) &&
+ 		    !rt2x00_rt(rt2x00dev, RT5392) &&
++		    !rt2x00_rt(rt2x00dev, RT5592) &&
+ 		    !rt2x00_rt(rt2x00dev, RT6352)) {
+ 			if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
+ 				rt2800_bbp_write(rt2x00dev, 82, 0x62);
+@@ -4336,17 +4339,20 @@ static void rt2800_config_channel(struct
+ 		else if (rt2x00_rt(rt2x00dev, RT3593) ||
+ 			 rt2x00_rt(rt2x00dev, RT3883))
+ 			rt2800_bbp_write(rt2x00dev, 82, 0x82);
+-		else if (!rt2x00_rt(rt2x00dev, RT6352))
++		else if (!rt2x00_rt(rt2x00dev, RT5592) &&
++			 !rt2x00_rt(rt2x00dev, RT6352))
+ 			rt2800_bbp_write(rt2x00dev, 82, 0xf2);
+ 
+ 		if (rt2x00_rt(rt2x00dev, RT3593) ||
+ 		    rt2x00_rt(rt2x00dev, RT3883))
+ 			rt2800_bbp_write(rt2x00dev, 83, 0x9a);
+ 
+-		if (rt2x00_has_cap_external_lna_a(rt2x00dev))
+-			rt2800_bbp_write(rt2x00dev, 75, 0x46);
+-		else
+-			rt2800_bbp_write(rt2x00dev, 75, 0x50);
++		if (!rt2x00_rt(rt2x00dev, RT5592)) {
++			if (rt2x00_has_cap_external_lna_a(rt2x00dev))
++				rt2800_bbp_write(rt2x00dev, 75, 0x46);
++			else
++				rt2800_bbp_write(rt2x00dev, 75, 0x50);
++		}
+ 	}
+ 
+ 	reg = rt2800_register_read(rt2x00dev, TX_BAND_CFG);
+@@ -5783,12 +5789,10 @@ static inline void rt2800_set_vgc(struct
+ 		if (rt2x00_rt(rt2x00dev, RT3572) ||
+ 		    rt2x00_rt(rt2x00dev, RT3593) ||
+ 		    rt2x00_rt(rt2x00dev, RT3883) ||
++		    rt2x00_rt(rt2x00dev, RT5592) ||
+ 		    rt2x00_rt(rt2x00dev, RT6352)) {
+ 			rt2800_bbp_write_with_rx_chain(rt2x00dev, 66,
+ 						       vgc_level);
+-		} else if (rt2x00_rt(rt2x00dev, RT5592)) {
+-			rt2800_bbp_write(rt2x00dev, 83, qual->rssi > -65 ? 0x4a : 0x7a);
+-			rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, vgc_level);
+ 		} else {
+ 			rt2800_bbp_write(rt2x00dev, 66, vgc_level);
+ 		}
+@@ -7016,7 +7020,6 @@ static void rt2800_init_bbp_5592(struct
+ 	rt2800_bbp_write(rt2x00dev, 88, 0x90);
+ 	rt2800_bbp_write(rt2x00dev, 91, 0x04);
+ 	rt2800_bbp_write(rt2x00dev, 92, 0x02);
+-	rt2800_bbp_write(rt2x00dev, 95, 0x9a);
+ 	rt2800_bbp_write(rt2x00dev, 98, 0x12);
+ 	rt2800_bbp_write(rt2x00dev, 103, 0xC0);
+ 	rt2800_bbp_write(rt2x00dev, 104, 0x92);
+@@ -7027,6 +7030,7 @@ static void rt2800_init_bbp_5592(struct
+ 	rt2800_bbp_write(rt2x00dev, 134, 0xD0);
+ 	rt2800_bbp_write(rt2x00dev, 135, 0xF6);
+ 	rt2800_bbp_write(rt2x00dev, 137, 0x0F);
++	rt2800_bbp_write(rt2x00dev, 148, 0x84);
+ 
+ 	/* Initialize GLRT (Generalized Likehood Radio Test) */
+ 	rt2800_init_bbp_5592_glrt(rt2x00dev);
+@@ -7051,12 +7055,6 @@ static void rt2800_init_bbp_5592(struct
+ 		rt2x00_set_field8(&value, BBP254_BIT7, 1);
+ 		rt2800_bbp_write(rt2x00dev, 254, value);
+ 	}
+-
+-	rt2800_init_freq_calibration(rt2x00dev);
+-
+-	rt2800_bbp_write(rt2x00dev, 84, 0x19);
+-	if (rt2x00_rt_rev_gte(rt2x00dev, RT5592, REV_RT5592C))
+-		rt2800_bbp_write(rt2x00dev, 103, 0xc0);
+ }
+ 
+ static void rt2800_init_bbp_6352(struct rt2x00_dev *rt2x00dev)
diff --git a/package/kernel/mac80211/patches/rt2x00/994-rt2x00-import-support-for-external-LNA-on-MT7620.patch b/package/kernel/mac80211/patches/rt2x00/994-rt2x00-import-support-for-external-LNA-on-MT7620.patch
index bb3f8197020b81..88a72fd03ec31b 100644
--- a/package/kernel/mac80211/patches/rt2x00/994-rt2x00-import-support-for-external-LNA-on-MT7620.patch
+++ b/package/kernel/mac80211/patches/rt2x00/994-rt2x00-import-support-for-external-LNA-on-MT7620.patch
@@ -52,9 +52,9 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  static const unsigned int rt2800_eeprom_map[EEPROM_WORD_COUNT] = {
  	[EEPROM_CHIP_ID]		= 0x0000,
  	[EEPROM_VERSION]		= 0x0001,
-@@ -10404,8 +10422,10 @@ static void rt2800_calibration_rt6352(st
- 	u32 reg;
- 
+@@ -10428,8 +10446,10 @@ static void rt2800_restore_rf_bbp_rt6352
+ static void rt2800_calibration_rt6352_stage1(struct rt2x00_dev *rt2x00dev)
+ {
  	if (rt2x00_has_cap_external_pa(rt2x00dev) ||
 -	    rt2x00_has_cap_external_lna_bg(rt2x00dev))
 +	    rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
@@ -63,8 +63,8 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 +	}
  
  	rt2800_r_calibration(rt2x00dev);
- 	rt2800_rf_self_txdc_cal(rt2x00dev);
-@@ -10423,6 +10443,8 @@ static void rt2800_calibration_rt6352(st
+ }
+@@ -10453,6 +10473,8 @@ static void rt2800_calibration_rt6352_st
  	    !rt2x00_has_cap_external_lna_bg(rt2x00dev))
  		return;
  
diff --git a/package/kernel/mac80211/patches/rt2x00/996-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch b/package/kernel/mac80211/patches/rt2x00/996-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch
index 4c07a105906957..eb0237a389381e 100644
--- a/package/kernel/mac80211/patches/rt2x00/996-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch
+++ b/package/kernel/mac80211/patches/rt2x00/996-rt2x00-mt7620-differentiate-based-on-SoC-CHIP_VER.patch
@@ -14,13 +14,13 @@
   */
 --- a/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2800lib.c
-@@ -3836,14 +3836,16 @@ static void rt2800_config_channel_rf7620
+@@ -3842,14 +3842,16 @@ static void rt2800_config_channel_rf7620
  	rt2x00_set_field8(&rfcsr, RFCSR19_K, rf->rf4);
  	rt2800_rfcsr_write(rt2x00dev, 19, rfcsr);
  
 -	/* Default: XO=20MHz , SDM mode */
 -	rfcsr = rt2800_rfcsr_read(rt2x00dev, 16);
--	rt2x00_set_field8(&rfcsr, RFCSR16_SDM_MODE_MT7620, 0x80);
+-	rt2x00_set_field8(&rfcsr, RFCSR16_SDM_MODE_MT7620, 4);
 -	rt2800_rfcsr_write(rt2x00dev, 16, rfcsr);
 -
 -	rfcsr = rt2800_rfcsr_read(rt2x00dev, 21);
@@ -29,7 +29,7 @@
 +	if (rt2800_hw_get_chipver(rt2x00dev) > 1) {
 +		/* Default: XO=20MHz , SDM mode */
 +		rfcsr = rt2800_rfcsr_read(rt2x00dev, 16);
-+		rt2x00_set_field8(&rfcsr, RFCSR16_SDM_MODE_MT7620, 0x80);
++		rt2x00_set_field8(&rfcsr, RFCSR16_SDM_MODE_MT7620, 4);
 +		rt2800_rfcsr_write(rt2x00dev, 16, rfcsr);
 +
 +		rfcsr = rt2800_rfcsr_read(rt2x00dev, 21);
@@ -39,7 +39,7 @@
  
  	rfcsr = rt2800_rfcsr_read(rt2x00dev, 1);
  	rt2x00_set_field8(&rfcsr, RFCSR1_TX2_EN_MT7620,
-@@ -3877,18 +3879,23 @@ static void rt2800_config_channel_rf7620
+@@ -3883,18 +3885,23 @@ static void rt2800_config_channel_rf7620
  		rt2800_rfcsr_write_dccal(rt2x00dev, 59, 0x20);
  	}
  
@@ -73,7 +73,7 @@
  
  	if (!test_bit(DEVICE_STATE_SCANNING, &rt2x00dev->flags)) {
  		if (conf_is_ht40(conf)) {
-@@ -4002,25 +4009,29 @@ static void rt2800_config_alc_rt6352(str
+@@ -4008,25 +4015,29 @@ static void rt2800_config_alc_rt6352(str
  	if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev, MAC_STATUS_CFG_BBP_RF_BUSY)))
  		rt2x00_warn(rt2x00dev, "RF busy while configuring ALC\n");
  
@@ -121,7 +121,7 @@
  	rt2800_register_write(rt2x00dev, MAC_SYS_CTRL, mac_sys_ctrl);
  
  	rt2800_vco_calibration(rt2x00dev);
-@@ -4513,7 +4524,8 @@ static void rt2800_config_channel(struct
+@@ -4524,7 +4535,8 @@ static void rt2800_config_channel(struct
  	if (rt2x00_rt(rt2x00dev, RT6352)) {
  		/* BBP for GLRT BW */
  		bbp = conf_is_ht40(conf) ?
@@ -131,7 +131,7 @@
  		      0x15 : 0x1a;
  		rt2800_bbp_glrt_write(rt2x00dev, 141, bbp);
  
-@@ -6017,18 +6029,33 @@ static int rt2800_init_registers(struct
+@@ -6042,18 +6054,34 @@ static int rt2800_init_registers(struct
  	} else if (rt2x00_rt(rt2x00dev, RT5350)) {
  		rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
  	} else if (rt2x00_rt(rt2x00dev, RT6352)) {
@@ -162,7 +162,8 @@
 +			rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000401);
 +			rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x000C0001);
 +			rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
-+			rt2800_register_write(rt2x00dev, TX_ALC_VGA3, 0x00000000);
++			rt2800_register_write(rt2x00dev, TX_PIN_CFG, 0x00150f0f);
++			rt2800_register_write(rt2x00dev, TX_ALC_VGA3, 0x06060606);
 +			rt2800_register_write(rt2x00dev, TX0_BB_GAIN_ATTEN, 0x0);
 +			rt2800_register_write(rt2x00dev, TX1_BB_GAIN_ATTEN, 0x0);
 +			rt2800_register_write(rt2x00dev, TX0_RF_GAIN_ATTEN,
@@ -177,7 +178,7 @@
  		reg = rt2800_register_read(rt2x00dev, TX_ALC_CFG_1);
  		rt2x00_set_field32(&reg, TX_ALC_CFG_1_ROS_BUSY_EN, 0);
  		rt2800_register_write(rt2x00dev, TX_ALC_CFG_1, reg);
-@@ -7141,14 +7168,16 @@ static void rt2800_init_bbp_6352(struct
+@@ -7160,14 +7188,16 @@ static void rt2800_init_bbp_6352(struct
  	rt2800_bbp_write(rt2x00dev, 188, 0x00);
  	rt2800_bbp_write(rt2x00dev, 189, 0x00);
  
@@ -202,7 +203,7 @@
  
  	/* BBP for G band GLRT function (BBP_128 ~ BBP_221) */
  	rt2800_bbp_glrt_write(rt2x00dev, 0, 0x00);
-@@ -10378,6 +10407,9 @@ static void rt2800_restore_rf_bbp_rt6352
+@@ -10404,6 +10434,9 @@ static void rt2800_restore_rf_bbp_rt6352
  		rt2800_register_write(rt2x00dev, RF_BYPASS3, 0x0);
  	}
  
@@ -212,7 +213,7 @@
  	if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
  		rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x16);
  		rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x23);
-@@ -10455,6 +10487,9 @@ static void rt2800_calibration_rt6352(st
+@@ -10485,6 +10518,9 @@ static void rt2800_calibration_rt6352_st
  		rt2800_register_write(rt2x00dev, RF_BYPASS3, reg);
  	}
  
@@ -222,7 +223,7 @@
  	if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
  		rt2800_rfcsr_write_chanreg(rt2x00dev, 14, 0x66);
  		rt2800_rfcsr_write_chanreg(rt2x00dev, 17, 0x20);
-@@ -10545,31 +10580,36 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -10575,31 +10611,36 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rfcsr_write(rt2x00dev, 42, 0x5B);
  	rt2800_rfcsr_write(rt2x00dev, 43, 0x00);
  
@@ -284,7 +285,7 @@
  
  	/* Initialize RF channel register to default value */
  	rt2800_rfcsr_write_chanreg(rt2x00dev, 0, 0x03);
-@@ -10635,63 +10675,71 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -10665,63 +10706,71 @@ static void rt2800_init_rfcsr_6352(struc
  
  	rt2800_rfcsr_write_bank(rt2x00dev, 6, 45, 0xC5);
  
@@ -411,7 +412,7 @@
  
  	/* Initialize RF DC calibration register to default value */
  	rt2800_rfcsr_write_dccal(rt2x00dev, 0, 0x47);
-@@ -10754,12 +10802,17 @@ static void rt2800_init_rfcsr_6352(struc
+@@ -10784,12 +10833,17 @@ static void rt2800_init_rfcsr_6352(struc
  	rt2800_rfcsr_write_dccal(rt2x00dev, 62, 0x00);
  	rt2800_rfcsr_write_dccal(rt2x00dev, 63, 0x00);
  
@@ -431,6 +432,6 @@
 +		rt2800_rfcsr_write_dccal(rt2x00dev, 5, 0x00);
 +		rt2800_rfcsr_write_dccal(rt2x00dev, 17, 0x7C);
 +	}
+ }
  
- 	/* Do calibration and init PA/LNA */
- 	rt2800_calibration_rt6352(rt2x00dev);
+ static void rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
diff --git a/package/kernel/mac80211/patches/rt2x00/997-rt2x00-use-remove_new.patch b/package/kernel/mac80211/patches/rt2x00/997-rt2x00-use-remove_new.patch
new file mode 100644
index 00000000000000..f857301e6f3d7e
--- /dev/null
+++ b/package/kernel/mac80211/patches/rt2x00/997-rt2x00-use-remove_new.patch
@@ -0,0 +1,26 @@
+Switch rt2800soc from .remove to .remove_new callback
+
+The rt2x00soc_remove() function was converted to the new .remove API.
+Kernel 6.6 still uses the old .remove API, switch to .remove_new.
+
+rt2800soc was switched in upstream commit:
+https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-6.12.y&id=06c566371f8afd582b9080f2d076509a4c78ae60
+
+This fixes the following build problem:
+```
+/drivers/net/wireless/ralink/rt2x00/rt2800soc.c:276:27: error: initialization of 'int (*)(struct platform_device *)' from incompatible pointer type 'void (*)(struct platform_device *)' [-Werror=incompatible-pointer-types]
+  276 |         .remove         = rt2x00soc_remove,
+      |                           ^~~~~~~~~~~~~~~~
+```
+
+--- a/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2800soc.c
+@@ -273,7 +273,7 @@ static struct platform_driver rt2800soc_
+ 		.of_match_table	= rt2880_wmac_match,
+ 	},
+ 	.probe		= rt2800soc_probe,
+-	.remove		= rt2x00soc_remove,
++	.remove_new	= rt2x00soc_remove,
+ 	.suspend	= rt2x00soc_suspend,
+ 	.resume		= rt2x00soc_resume,
+ };
diff --git a/package/kernel/mac80211/patches/rtl/017-v6.13-wifi-rtw88-Constify-some-arrays-and-structs.patch b/package/kernel/mac80211/patches/rtl/017-v6.13-wifi-rtw88-Constify-some-arrays-and-structs.patch
new file mode 100644
index 00000000000000..04b5d4cd79402e
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/017-v6.13-wifi-rtw88-Constify-some-arrays-and-structs.patch
@@ -0,0 +1,374 @@
+From 140403599b74839b0a57c5397b7e8579e5332364 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 18 Sep 2024 01:53:55 +0300
+Subject: [PATCH] wifi: rtw88: Constify some arrays and structs
+
+These are never modified, so make them const:
+
+card_enable_flow_8703b
+card_disable_flow_8703b
+rtw8703b_ops
+
+rtw8723d_ops
+card_enable_flow_8723d
+card_disable_flow_8723d
+
+trans_carddis_to_cardemu_8821c
+trans_cardemu_to_act_8821c
+trans_act_to_cardemu_8821c
+trans_cardemu_to_carddis_8821c
+card_enable_flow_8821c
+card_disable_flow_8821c
+rtw8821c_dig
+page_table_8821c
+rqpn_table_8821c
+prioq_addrs_8821c
+rtw8821c_ops
+
+card_enable_flow_8822b
+card_disable_flow_8822b
+prioq_addrs_8822b
+rtw8822b_ops
+rtw8822b_edcca_th
+
+card_enable_flow_8822c
+card_disable_flow_8822c
+prioq_addrs_8822c
+rtw8822c_ops
+rtw8822c_edcca_th
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/dae7994f-3491-40de-b537-ebf68df084bb@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/fw.c       |  2 +-
+ drivers/net/wireless/realtek/rtw88/mac.c      |  4 ++--
+ drivers/net/wireless/realtek/rtw88/main.h     |  8 +++----
+ drivers/net/wireless/realtek/rtw88/phy.c      |  2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8703b.c |  6 ++---
+ drivers/net/wireless/realtek/rtw88/rtw8723d.c |  6 ++---
+ drivers/net/wireless/realtek/rtw88/rtw8821c.c | 22 +++++++++----------
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c | 10 ++++-----
+ drivers/net/wireless/realtek/rtw88/rtw8822c.c | 10 ++++-----
+ 9 files changed, 35 insertions(+), 35 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/fw.c
++++ b/drivers/net/wireless/realtek/rtw88/fw.c
+@@ -267,7 +267,7 @@ static void rtw_fw_scan_result(struct rt
+ static void rtw_fw_adaptivity_result(struct rtw_dev *rtwdev, u8 *payload,
+ 				     u8 length)
+ {
+-	struct rtw_hw_reg_offset *edcca_th = rtwdev->chip->edcca_th;
++	const struct rtw_hw_reg_offset *edcca_th = rtwdev->chip->edcca_th;
+ 	struct rtw_c2h_adaptivity *result = (struct rtw_c2h_adaptivity *)payload;
+ 
+ 	rtw_dbg(rtwdev, RTW_DBG_ADAPTIVITY,
+--- a/drivers/net/wireless/realtek/rtw88/mac.c
++++ b/drivers/net/wireless/realtek/rtw88/mac.c
+@@ -228,7 +228,7 @@ static int rtw_sub_pwr_seq_parser(struct
+ }
+ 
+ static int rtw_pwr_seq_parser(struct rtw_dev *rtwdev,
+-			      const struct rtw_pwr_seq_cmd **cmd_seq)
++			      const struct rtw_pwr_seq_cmd * const *cmd_seq)
+ {
+ 	u8 cut_mask;
+ 	u8 intf_mask;
+@@ -271,7 +271,7 @@ static int rtw_pwr_seq_parser(struct rtw
+ static int rtw_mac_power_switch(struct rtw_dev *rtwdev, bool pwr_on)
+ {
+ 	const struct rtw_chip_info *chip = rtwdev->chip;
+-	const struct rtw_pwr_seq_cmd **pwr_seq;
++	const struct rtw_pwr_seq_cmd * const *pwr_seq;
+ 	u32 imr = 0;
+ 	u8 rpwm;
+ 	bool cur_pwr;
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -1167,7 +1167,7 @@ enum rtw_fwcd_item {
+ 
+ /* hardware configuration for each IC */
+ struct rtw_chip_info {
+-	struct rtw_chip_ops *ops;
++	const struct rtw_chip_ops *ops;
+ 	u8 id;
+ 
+ 	const char *fw_name;
+@@ -1209,8 +1209,8 @@ struct rtw_chip_info {
+ 
+ 	/* init values */
+ 	u8 sys_func_en;
+-	const struct rtw_pwr_seq_cmd **pwr_on_seq;
+-	const struct rtw_pwr_seq_cmd **pwr_off_seq;
++	const struct rtw_pwr_seq_cmd * const *pwr_on_seq;
++	const struct rtw_pwr_seq_cmd * const *pwr_off_seq;
+ 	const struct rtw_rqpn *rqpn_table;
+ 	const struct rtw_prioq_addrs *prioq_addrs;
+ 	const struct rtw_page_table *page_table;
+@@ -1242,7 +1242,7 @@ struct rtw_chip_info {
+ 	u8 bfer_su_max_num;
+ 	u8 bfer_mu_max_num;
+ 
+-	struct rtw_hw_reg_offset *edcca_th;
++	const struct rtw_hw_reg_offset *edcca_th;
+ 	s8 l2h_th_ini_cs;
+ 	s8 l2h_th_ini_ad;
+ 
+--- a/drivers/net/wireless/realtek/rtw88/phy.c
++++ b/drivers/net/wireless/realtek/rtw88/phy.c
+@@ -123,7 +123,7 @@ static void rtw_phy_cck_pd_init(struct r
+ 
+ void rtw_phy_set_edcca_th(struct rtw_dev *rtwdev, u8 l2h, u8 h2l)
+ {
+-	struct rtw_hw_reg_offset *edcca_th = rtwdev->chip->edcca_th;
++	const struct rtw_hw_reg_offset *edcca_th = rtwdev->chip->edcca_th;
+ 
+ 	rtw_write32_mask(rtwdev,
+ 			 edcca_th[EDCCA_TH_L2H_IDX].hw_reg.addr,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8703b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8703b.c
+@@ -481,14 +481,14 @@ static const struct rtw_pwr_seq_cmd tran
+ 	{TRANS_SEQ_END},
+ };
+ 
+-static const struct rtw_pwr_seq_cmd *card_enable_flow_8703b[] = {
++static const struct rtw_pwr_seq_cmd * const card_enable_flow_8703b[] = {
+ 	trans_pre_enable_8703b,
+ 	trans_carddis_to_cardemu_8703b,
+ 	trans_cardemu_to_act_8703b,
+ 	NULL
+ };
+ 
+-static const struct rtw_pwr_seq_cmd *card_disable_flow_8703b[] = {
++static const struct rtw_pwr_seq_cmd * const card_disable_flow_8703b[] = {
+ 	trans_act_to_lps_8703b,
+ 	trans_act_to_reset_mcu_8703b,
+ 	trans_act_to_cardemu_8703b,
+@@ -1941,7 +1941,7 @@ static const struct coex_tdma_para tdma_
+ 	{ {0x61, 0x08, 0x03, 0x11, 0x11} },
+ };
+ 
+-static struct rtw_chip_ops rtw8703b_ops = {
++static const struct rtw_chip_ops rtw8703b_ops = {
+ 	.mac_init		= rtw8723x_mac_init,
+ 	.dump_fw_crash		= NULL,
+ 	.shutdown		= NULL,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8723d.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8723d.c
+@@ -1430,7 +1430,7 @@ static void rtw8723d_pwr_track(struct rt
+ 	dm_info->pwr_trk_triggered = false;
+ }
+ 
+-static struct rtw_chip_ops rtw8723d_ops = {
++static const struct rtw_chip_ops rtw8723d_ops = {
+ 	.phy_set_param		= rtw8723d_phy_set_param,
+ 	.read_efuse		= rtw8723x_read_efuse,
+ 	.query_rx_desc		= rtw8723d_query_rx_desc,
+@@ -1788,7 +1788,7 @@ static const struct rtw_pwr_seq_cmd tran
+ 	 RTW_PWR_CMD_END, 0, 0},
+ };
+ 
+-static const struct rtw_pwr_seq_cmd *card_enable_flow_8723d[] = {
++static const struct rtw_pwr_seq_cmd * const card_enable_flow_8723d[] = {
+ 	trans_carddis_to_cardemu_8723d,
+ 	trans_cardemu_to_act_8723d,
+ 	NULL
+@@ -2004,7 +2004,7 @@ static const struct rtw_pwr_seq_cmd tran
+ 	 RTW_PWR_CMD_END, 0, 0},
+ };
+ 
+-static const struct rtw_pwr_seq_cmd *card_disable_flow_8723d[] = {
++static const struct rtw_pwr_seq_cmd * const card_disable_flow_8723d[] = {
+ 	trans_act_to_lps_8723d,
+ 	trans_act_to_pre_carddis_8723d,
+ 	trans_act_to_cardemu_8723d,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+@@ -1254,7 +1254,7 @@ static void rtw8821c_fill_txdesc_checksu
+ 	fill_txdesc_checksum_common(txdesc, 16);
+ }
+ 
+-static struct rtw_pwr_seq_cmd trans_carddis_to_cardemu_8821c[] = {
++static const struct rtw_pwr_seq_cmd trans_carddis_to_cardemu_8821c[] = {
+ 	{0x0086,
+ 	 RTW_PWR_CUT_ALL_MSK,
+ 	 RTW_PWR_INTF_SDIO_MSK,
+@@ -1292,7 +1292,7 @@ static struct rtw_pwr_seq_cmd trans_card
+ 	 RTW_PWR_CMD_END, 0, 0},
+ };
+ 
+-static struct rtw_pwr_seq_cmd trans_cardemu_to_act_8821c[] = {
++static const struct rtw_pwr_seq_cmd trans_cardemu_to_act_8821c[] = {
+ 	{0x0020,
+ 	 RTW_PWR_CUT_ALL_MSK,
+ 	 RTW_PWR_INTF_USB_MSK | RTW_PWR_INTF_SDIO_MSK,
+@@ -1396,7 +1396,7 @@ static struct rtw_pwr_seq_cmd trans_card
+ 	 RTW_PWR_CMD_END, 0, 0},
+ };
+ 
+-static struct rtw_pwr_seq_cmd trans_act_to_cardemu_8821c[] = {
++static const struct rtw_pwr_seq_cmd trans_act_to_cardemu_8821c[] = {
+ 	{0x0093,
+ 	 RTW_PWR_CUT_ALL_MSK,
+ 	 RTW_PWR_INTF_ALL_MSK,
+@@ -1454,7 +1454,7 @@ static struct rtw_pwr_seq_cmd trans_act_
+ 	 RTW_PWR_CMD_END, 0, 0},
+ };
+ 
+-static struct rtw_pwr_seq_cmd trans_cardemu_to_carddis_8821c[] = {
++static const struct rtw_pwr_seq_cmd trans_cardemu_to_carddis_8821c[] = {
+ 	{0x0007,
+ 	 RTW_PWR_CUT_ALL_MSK,
+ 	 RTW_PWR_INTF_USB_MSK | RTW_PWR_INTF_SDIO_MSK,
+@@ -1567,13 +1567,13 @@ static struct rtw_pwr_seq_cmd trans_card
+ 	 RTW_PWR_CMD_END, 0, 0},
+ };
+ 
+-static const struct rtw_pwr_seq_cmd *card_enable_flow_8821c[] = {
++static const struct rtw_pwr_seq_cmd * const card_enable_flow_8821c[] = {
+ 	trans_carddis_to_cardemu_8821c,
+ 	trans_cardemu_to_act_8821c,
+ 	NULL
+ };
+ 
+-static const struct rtw_pwr_seq_cmd *card_disable_flow_8821c[] = {
++static const struct rtw_pwr_seq_cmd * const card_disable_flow_8821c[] = {
+ 	trans_act_to_cardemu_8821c,
+ 	trans_cardemu_to_carddis_8821c,
+ 	NULL
+@@ -1629,7 +1629,7 @@ static const struct rtw_rfe_def rtw8821c
+ 	[6] = RTW_DEF_RFE(8821c, 0, 0),
+ };
+ 
+-static struct rtw_hw_reg rtw8821c_dig[] = {
++static const struct rtw_hw_reg rtw8821c_dig[] = {
+ 	[0] = { .addr = 0xc50, .mask = 0x7f },
+ };
+ 
+@@ -1639,7 +1639,7 @@ static const struct rtw_ltecoex_addr rtw
+ 	.rdata = LTECOEX_READ_DATA,
+ };
+ 
+-static struct rtw_page_table page_table_8821c[] = {
++static const struct rtw_page_table page_table_8821c[] = {
+ 	/* not sure what [0] stands for */
+ 	{16, 16, 16, 14, 1},
+ 	{16, 16, 16, 14, 1},
+@@ -1648,7 +1648,7 @@ static struct rtw_page_table page_table_
+ 	{16, 16, 16, 14, 1},
+ };
+ 
+-static struct rtw_rqpn rqpn_table_8821c[] = {
++static const struct rtw_rqpn rqpn_table_8821c[] = {
+ 	/* not sure what [0] stands for */
+ 	{RTW_DMA_MAPPING_NORMAL, RTW_DMA_MAPPING_NORMAL,
+ 	 RTW_DMA_MAPPING_LOW, RTW_DMA_MAPPING_LOW,
+@@ -1667,7 +1667,7 @@ static struct rtw_rqpn rqpn_table_8821c[
+ 	 RTW_DMA_MAPPING_EXTRA, RTW_DMA_MAPPING_HIGH},
+ };
+ 
+-static struct rtw_prioq_addrs prioq_addrs_8821c = {
++static const struct rtw_prioq_addrs prioq_addrs_8821c = {
+ 	.prio[RTW_DMA_MAPPING_EXTRA] = {
+ 		.rsvd = REG_FIFOPAGE_INFO_4, .avail = REG_FIFOPAGE_INFO_4 + 2,
+ 	},
+@@ -1683,7 +1683,7 @@ static struct rtw_prioq_addrs prioq_addr
+ 	.wsize = true,
+ };
+ 
+-static struct rtw_chip_ops rtw8821c_ops = {
++static const struct rtw_chip_ops rtw8821c_ops = {
+ 	.phy_set_param		= rtw8821c_phy_set_param,
+ 	.read_efuse		= rtw8821c_read_efuse,
+ 	.query_rx_desc		= rtw8821c_query_rx_desc,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -1980,13 +1980,13 @@ static const struct rtw_pwr_seq_cmd tran
+ 	 RTW_PWR_CMD_END, 0, 0},
+ };
+ 
+-static const struct rtw_pwr_seq_cmd *card_enable_flow_8822b[] = {
++static const struct rtw_pwr_seq_cmd * const card_enable_flow_8822b[] = {
+ 	trans_carddis_to_cardemu_8822b,
+ 	trans_cardemu_to_act_8822b,
+ 	NULL
+ };
+ 
+-static const struct rtw_pwr_seq_cmd *card_disable_flow_8822b[] = {
++static const struct rtw_pwr_seq_cmd * const card_disable_flow_8822b[] = {
+ 	trans_act_to_cardemu_8822b,
+ 	trans_cardemu_to_carddis_8822b,
+ 	NULL
+@@ -2158,7 +2158,7 @@ static const struct rtw_rqpn rqpn_table_
+ 	 RTW_DMA_MAPPING_EXTRA, RTW_DMA_MAPPING_HIGH},
+ };
+ 
+-static struct rtw_prioq_addrs prioq_addrs_8822b = {
++static const struct rtw_prioq_addrs prioq_addrs_8822b = {
+ 	.prio[RTW_DMA_MAPPING_EXTRA] = {
+ 		.rsvd = REG_FIFOPAGE_INFO_4, .avail = REG_FIFOPAGE_INFO_4 + 2,
+ 	},
+@@ -2174,7 +2174,7 @@ static struct rtw_prioq_addrs prioq_addr
+ 	.wsize = true,
+ };
+ 
+-static struct rtw_chip_ops rtw8822b_ops = {
++static const struct rtw_chip_ops rtw8822b_ops = {
+ 	.phy_set_param		= rtw8822b_phy_set_param,
+ 	.read_efuse		= rtw8822b_read_efuse,
+ 	.query_rx_desc		= rtw8822b_query_rx_desc,
+@@ -2523,7 +2523,7 @@ static const struct rtw_reg_domain coex_
+ 	{0xc50,  MASKBYTE0, RTW_REG_DOMAIN_MAC8},
+ };
+ 
+-static struct rtw_hw_reg_offset rtw8822b_edcca_th[] = {
++static const struct rtw_hw_reg_offset rtw8822b_edcca_th[] = {
+ 	[EDCCA_TH_L2H_IDX] = {{.addr = 0x8a4, .mask = MASKBYTE0}, .offset = 0},
+ 	[EDCCA_TH_H2L_IDX] = {{.addr = 0x8a4, .mask = MASKBYTE1}, .offset = 0},
+ };
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
+@@ -4875,13 +4875,13 @@ static const struct rtw_pwr_seq_cmd tran
+ 	 RTW_PWR_CMD_END, 0, 0},
+ };
+ 
+-static const struct rtw_pwr_seq_cmd *card_enable_flow_8822c[] = {
++static const struct rtw_pwr_seq_cmd * const card_enable_flow_8822c[] = {
+ 	trans_carddis_to_cardemu_8822c,
+ 	trans_cardemu_to_act_8822c,
+ 	NULL
+ };
+ 
+-static const struct rtw_pwr_seq_cmd *card_disable_flow_8822c[] = {
++static const struct rtw_pwr_seq_cmd * const card_disable_flow_8822c[] = {
+ 	trans_act_to_cardemu_8822c,
+ 	trans_cardemu_to_carddis_8822c,
+ 	NULL
+@@ -4973,7 +4973,7 @@ static const struct rtw_rqpn rqpn_table_
+ 	 RTW_DMA_MAPPING_EXTRA, RTW_DMA_MAPPING_HIGH},
+ };
+ 
+-static struct rtw_prioq_addrs prioq_addrs_8822c = {
++static const struct rtw_prioq_addrs prioq_addrs_8822c = {
+ 	.prio[RTW_DMA_MAPPING_EXTRA] = {
+ 		.rsvd = REG_FIFOPAGE_INFO_4, .avail = REG_FIFOPAGE_INFO_4 + 2,
+ 	},
+@@ -4989,7 +4989,7 @@ static struct rtw_prioq_addrs prioq_addr
+ 	.wsize = true,
+ };
+ 
+-static struct rtw_chip_ops rtw8822c_ops = {
++static const struct rtw_chip_ops rtw8822c_ops = {
+ 	.phy_set_param		= rtw8822c_phy_set_param,
+ 	.read_efuse		= rtw8822c_read_efuse,
+ 	.query_rx_desc		= rtw8822c_query_rx_desc,
+@@ -5302,7 +5302,7 @@ static const struct rtw_pwr_track_tbl rt
+ 	.pwrtrk_2g_ccka_p = rtw8822c_pwrtrk_2g_cck_a_p,
+ };
+ 
+-static struct rtw_hw_reg_offset rtw8822c_edcca_th[] = {
++static const struct rtw_hw_reg_offset rtw8822c_edcca_th[] = {
+ 	[EDCCA_TH_L2H_IDX] = {
+ 		{.addr = 0x84c, .mask = MASKBYTE2}, .offset = 0x80
+ 	},
diff --git a/package/kernel/mac80211/patches/rtl/019-v6.13-wifi-rtw88-Parse-the-RX-descriptor-with-a-single-fun.patch b/package/kernel/mac80211/patches/rtl/019-v6.13-wifi-rtw88-Parse-the-RX-descriptor-with-a-single-fun.patch
new file mode 100644
index 00000000000000..4c6966a3c6c09f
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/019-v6.13-wifi-rtw88-Parse-the-RX-descriptor-with-a-single-fun.patch
@@ -0,0 +1,560 @@
+From bbb6f9be7f99464d5ab7e2f321fa728d33eeec9a Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Fri, 20 Sep 2024 22:27:30 +0300
+Subject: [PATCH] wifi: rtw88: Parse the RX descriptor with a single function
+
+rtw8703b_query_rx_desc(), rtw8723d_query_rx_desc(),
+rtw8821c_query_rx_desc(), rtw8822b_query_rx_desc(), and
+rtw8822c_query_rx_desc() are almost identical, so replace them all with
+a single function, rtw_rx_query_rx_desc().
+
+Also, access the RX descriptor using a struct with __le32 members and
+le32_get_bits().
+
+Tested with RTL8811CU, RTL8811AU, and RTL8812AU.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Tested-by: Ping-Ke Shih <pkshih@realtek.com> # RTL8723DE and RTL8822CE
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/913f1747-38fc-4409-85a4-57bb9cee506b@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/main.h     |  5 +-
+ drivers/net/wireless/realtek/rtw88/pci.c      |  2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8703b.c | 56 +--------------
+ drivers/net/wireless/realtek/rtw88/rtw8723d.c | 43 +-----------
+ drivers/net/wireless/realtek/rtw88/rtw8821c.c | 43 +-----------
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c | 43 +-----------
+ drivers/net/wireless/realtek/rtw88/rtw8822c.c | 44 +-----------
+ drivers/net/wireless/realtek/rtw88/rx.c       | 70 +++++++++++++++++--
+ drivers/net/wireless/realtek/rtw88/rx.h       | 64 ++++++++---------
+ drivers/net/wireless/realtek/rtw88/sdio.c     |  3 +-
+ drivers/net/wireless/realtek/rtw88/usb.c      |  4 +-
+ 11 files changed, 106 insertions(+), 271 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -848,9 +848,8 @@ struct rtw_chip_ops {
+ 	void (*phy_set_param)(struct rtw_dev *rtwdev);
+ 	void (*set_channel)(struct rtw_dev *rtwdev, u8 channel,
+ 			    u8 bandwidth, u8 primary_chan_idx);
+-	void (*query_rx_desc)(struct rtw_dev *rtwdev, u8 *rx_desc,
+-			      struct rtw_rx_pkt_stat *pkt_stat,
+-			      struct ieee80211_rx_status *rx_status);
++	void (*query_phy_status)(struct rtw_dev *rtwdev, u8 *phy_status,
++				 struct rtw_rx_pkt_stat *pkt_stat);
+ 	u32 (*read_rf)(struct rtw_dev *rtwdev, enum rtw_rf_path rf_path,
+ 		       u32 addr, u32 mask);
+ 	bool (*write_rf)(struct rtw_dev *rtwdev, enum rtw_rf_path rf_path,
+--- a/drivers/net/wireless/realtek/rtw88/pci.c
++++ b/drivers/net/wireless/realtek/rtw88/pci.c
+@@ -1066,7 +1066,7 @@ static u32 rtw_pci_rx_napi(struct rtw_de
+ 		dma_sync_single_for_cpu(rtwdev->dev, dma, RTK_PCI_RX_BUF_SIZE,
+ 					DMA_FROM_DEVICE);
+ 		rx_desc = skb->data;
+-		chip->ops->query_rx_desc(rtwdev, rx_desc, &pkt_stat, &rx_status);
++		rtw_rx_query_rx_desc(rtwdev, rx_desc, &pkt_stat, &rx_status);
+ 
+ 		/* offset from rx_desc to payload */
+ 		pkt_offset = pkt_desc_sz + pkt_stat.drv_info_sz +
+--- a/drivers/net/wireless/realtek/rtw88/rtw8703b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8703b.c
+@@ -29,9 +29,6 @@
+ #define TBTT_PROHIBIT_HOLD_TIME 0x80
+ #define TBTT_PROHIBIT_HOLD_TIME_STOP_BCN 0x64
+ 
+-/* raw pkt_stat->drv_info_sz is in unit of 8-bytes */
+-#define RX_DRV_INFO_SZ_UNIT_8703B 8
+-
+ #define TRANS_SEQ_END			\
+ 	0xFFFF,				\
+ 	RTW_PWR_CUT_ALL_MSK,		\
+@@ -1032,57 +1029,6 @@ static void query_phy_status(struct rtw_
+ 		query_phy_status_ofdm(rtwdev, phy_status, pkt_stat);
+ }
+ 
+-static void rtw8703b_query_rx_desc(struct rtw_dev *rtwdev, u8 *rx_desc,
+-				   struct rtw_rx_pkt_stat *pkt_stat,
+-				   struct ieee80211_rx_status *rx_status)
+-{
+-	struct ieee80211_hdr *hdr;
+-	u32 desc_sz = rtwdev->chip->rx_pkt_desc_sz;
+-	u8 *phy_status = NULL;
+-
+-	memset(pkt_stat, 0, sizeof(*pkt_stat));
+-
+-	pkt_stat->phy_status = GET_RX_DESC_PHYST(rx_desc);
+-	pkt_stat->icv_err = GET_RX_DESC_ICV_ERR(rx_desc);
+-	pkt_stat->crc_err = GET_RX_DESC_CRC32(rx_desc);
+-	pkt_stat->decrypted = !GET_RX_DESC_SWDEC(rx_desc) &&
+-			      GET_RX_DESC_ENC_TYPE(rx_desc) != RX_DESC_ENC_NONE;
+-	pkt_stat->is_c2h = GET_RX_DESC_C2H(rx_desc);
+-	pkt_stat->pkt_len = GET_RX_DESC_PKT_LEN(rx_desc);
+-	pkt_stat->drv_info_sz = GET_RX_DESC_DRV_INFO_SIZE(rx_desc);
+-	pkt_stat->shift = GET_RX_DESC_SHIFT(rx_desc);
+-	pkt_stat->rate = GET_RX_DESC_RX_RATE(rx_desc);
+-	pkt_stat->cam_id = GET_RX_DESC_MACID(rx_desc);
+-	pkt_stat->ppdu_cnt = 0;
+-	pkt_stat->tsf_low = GET_RX_DESC_TSFL(rx_desc);
+-
+-	pkt_stat->drv_info_sz *= RX_DRV_INFO_SZ_UNIT_8703B;
+-
+-	if (pkt_stat->is_c2h)
+-		return;
+-
+-	hdr = (struct ieee80211_hdr *)(rx_desc + desc_sz + pkt_stat->shift +
+-				       pkt_stat->drv_info_sz);
+-
+-	pkt_stat->bw = GET_RX_DESC_BW(rx_desc);
+-
+-	if (pkt_stat->phy_status) {
+-		phy_status = rx_desc + desc_sz + pkt_stat->shift;
+-		query_phy_status(rtwdev, phy_status, pkt_stat);
+-	}
+-
+-	rtw_rx_fill_rx_status(rtwdev, pkt_stat, hdr, rx_status, phy_status);
+-
+-	/* Rtl8723cs driver checks for size < 14 or size > 8192 and
+-	 * simply drops the packet. Maybe this should go into
+-	 * rtw_rx_fill_rx_status()?
+-	 */
+-	if (pkt_stat->pkt_len == 0) {
+-		rx_status->flag |= RX_FLAG_NO_PSDU;
+-		rtw_dbg(rtwdev, RTW_DBG_RX, "zero length packet");
+-	}
+-}
+-
+ #define ADDA_ON_VAL_8703B 0x03c00014
+ 
+ static
+@@ -1948,7 +1894,7 @@ static const struct rtw_chip_ops rtw8703
+ 	.read_efuse		= rtw8703b_read_efuse,
+ 	.phy_set_param		= rtw8703b_phy_set_param,
+ 	.set_channel		= rtw8703b_set_channel,
+-	.query_rx_desc		= rtw8703b_query_rx_desc,
++	.query_phy_status	= query_phy_status,
+ 	.read_rf		= rtw_phy_read_rf_sipi,
+ 	.write_rf		= rtw_phy_write_rf_reg_sipi,
+ 	.set_tx_power_index	= rtw8723x_set_tx_power_index,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8723d.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8723d.c
+@@ -227,47 +227,6 @@ static void query_phy_status(struct rtw_
+ 	}
+ }
+ 
+-static void rtw8723d_query_rx_desc(struct rtw_dev *rtwdev, u8 *rx_desc,
+-				   struct rtw_rx_pkt_stat *pkt_stat,
+-				   struct ieee80211_rx_status *rx_status)
+-{
+-	struct ieee80211_hdr *hdr;
+-	u32 desc_sz = rtwdev->chip->rx_pkt_desc_sz;
+-	u8 *phy_status = NULL;
+-
+-	memset(pkt_stat, 0, sizeof(*pkt_stat));
+-
+-	pkt_stat->phy_status = GET_RX_DESC_PHYST(rx_desc);
+-	pkt_stat->icv_err = GET_RX_DESC_ICV_ERR(rx_desc);
+-	pkt_stat->crc_err = GET_RX_DESC_CRC32(rx_desc);
+-	pkt_stat->decrypted = !GET_RX_DESC_SWDEC(rx_desc) &&
+-			      GET_RX_DESC_ENC_TYPE(rx_desc) != RX_DESC_ENC_NONE;
+-	pkt_stat->is_c2h = GET_RX_DESC_C2H(rx_desc);
+-	pkt_stat->pkt_len = GET_RX_DESC_PKT_LEN(rx_desc);
+-	pkt_stat->drv_info_sz = GET_RX_DESC_DRV_INFO_SIZE(rx_desc);
+-	pkt_stat->shift = GET_RX_DESC_SHIFT(rx_desc);
+-	pkt_stat->rate = GET_RX_DESC_RX_RATE(rx_desc);
+-	pkt_stat->cam_id = GET_RX_DESC_MACID(rx_desc);
+-	pkt_stat->ppdu_cnt = 0;
+-	pkt_stat->tsf_low = GET_RX_DESC_TSFL(rx_desc);
+-
+-	/* drv_info_sz is in unit of 8-bytes */
+-	pkt_stat->drv_info_sz *= 8;
+-
+-	/* c2h cmd pkt's rx/phy status is not interested */
+-	if (pkt_stat->is_c2h)
+-		return;
+-
+-	hdr = (struct ieee80211_hdr *)(rx_desc + desc_sz + pkt_stat->shift +
+-				       pkt_stat->drv_info_sz);
+-	if (pkt_stat->phy_status) {
+-		phy_status = rx_desc + desc_sz + pkt_stat->shift;
+-		query_phy_status(rtwdev, phy_status, pkt_stat);
+-	}
+-
+-	rtw_rx_fill_rx_status(rtwdev, pkt_stat, hdr, rx_status, phy_status);
+-}
+-
+ static bool rtw8723d_check_spur_ov_thres(struct rtw_dev *rtwdev,
+ 					 u8 channel, u32 thres)
+ {
+@@ -1433,7 +1392,7 @@ static void rtw8723d_pwr_track(struct rt
+ static const struct rtw_chip_ops rtw8723d_ops = {
+ 	.phy_set_param		= rtw8723d_phy_set_param,
+ 	.read_efuse		= rtw8723x_read_efuse,
+-	.query_rx_desc		= rtw8723d_query_rx_desc,
++	.query_phy_status	= query_phy_status,
+ 	.set_channel		= rtw8723d_set_channel,
+ 	.mac_init		= rtw8723x_mac_init,
+ 	.shutdown		= rtw8723d_shutdown,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+@@ -679,47 +679,6 @@ static void query_phy_status(struct rtw_
+ 	}
+ }
+ 
+-static void rtw8821c_query_rx_desc(struct rtw_dev *rtwdev, u8 *rx_desc,
+-				   struct rtw_rx_pkt_stat *pkt_stat,
+-				   struct ieee80211_rx_status *rx_status)
+-{
+-	struct ieee80211_hdr *hdr;
+-	u32 desc_sz = rtwdev->chip->rx_pkt_desc_sz;
+-	u8 *phy_status = NULL;
+-
+-	memset(pkt_stat, 0, sizeof(*pkt_stat));
+-
+-	pkt_stat->phy_status = GET_RX_DESC_PHYST(rx_desc);
+-	pkt_stat->icv_err = GET_RX_DESC_ICV_ERR(rx_desc);
+-	pkt_stat->crc_err = GET_RX_DESC_CRC32(rx_desc);
+-	pkt_stat->decrypted = !GET_RX_DESC_SWDEC(rx_desc) &&
+-			      GET_RX_DESC_ENC_TYPE(rx_desc) != RX_DESC_ENC_NONE;
+-	pkt_stat->is_c2h = GET_RX_DESC_C2H(rx_desc);
+-	pkt_stat->pkt_len = GET_RX_DESC_PKT_LEN(rx_desc);
+-	pkt_stat->drv_info_sz = GET_RX_DESC_DRV_INFO_SIZE(rx_desc);
+-	pkt_stat->shift = GET_RX_DESC_SHIFT(rx_desc);
+-	pkt_stat->rate = GET_RX_DESC_RX_RATE(rx_desc);
+-	pkt_stat->cam_id = GET_RX_DESC_MACID(rx_desc);
+-	pkt_stat->ppdu_cnt = GET_RX_DESC_PPDU_CNT(rx_desc);
+-	pkt_stat->tsf_low = GET_RX_DESC_TSFL(rx_desc);
+-
+-	/* drv_info_sz is in unit of 8-bytes */
+-	pkt_stat->drv_info_sz *= 8;
+-
+-	/* c2h cmd pkt's rx/phy status is not interested */
+-	if (pkt_stat->is_c2h)
+-		return;
+-
+-	hdr = (struct ieee80211_hdr *)(rx_desc + desc_sz + pkt_stat->shift +
+-				       pkt_stat->drv_info_sz);
+-	if (pkt_stat->phy_status) {
+-		phy_status = rx_desc + desc_sz + pkt_stat->shift;
+-		query_phy_status(rtwdev, phy_status, pkt_stat);
+-	}
+-
+-	rtw_rx_fill_rx_status(rtwdev, pkt_stat, hdr, rx_status, phy_status);
+-}
+-
+ static void
+ rtw8821c_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path, u8 rs)
+ {
+@@ -1686,7 +1645,7 @@ static const struct rtw_prioq_addrs prio
+ static const struct rtw_chip_ops rtw8821c_ops = {
+ 	.phy_set_param		= rtw8821c_phy_set_param,
+ 	.read_efuse		= rtw8821c_read_efuse,
+-	.query_rx_desc		= rtw8821c_query_rx_desc,
++	.query_phy_status	= query_phy_status,
+ 	.set_channel		= rtw8821c_set_channel,
+ 	.mac_init		= rtw8821c_mac_init,
+ 	.read_rf		= rtw_phy_read_rf,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -934,47 +934,6 @@ static void query_phy_status(struct rtw_
+ 	}
+ }
+ 
+-static void rtw8822b_query_rx_desc(struct rtw_dev *rtwdev, u8 *rx_desc,
+-				   struct rtw_rx_pkt_stat *pkt_stat,
+-				   struct ieee80211_rx_status *rx_status)
+-{
+-	struct ieee80211_hdr *hdr;
+-	u32 desc_sz = rtwdev->chip->rx_pkt_desc_sz;
+-	u8 *phy_status = NULL;
+-
+-	memset(pkt_stat, 0, sizeof(*pkt_stat));
+-
+-	pkt_stat->phy_status = GET_RX_DESC_PHYST(rx_desc);
+-	pkt_stat->icv_err = GET_RX_DESC_ICV_ERR(rx_desc);
+-	pkt_stat->crc_err = GET_RX_DESC_CRC32(rx_desc);
+-	pkt_stat->decrypted = !GET_RX_DESC_SWDEC(rx_desc) &&
+-			      GET_RX_DESC_ENC_TYPE(rx_desc) != RX_DESC_ENC_NONE;
+-	pkt_stat->is_c2h = GET_RX_DESC_C2H(rx_desc);
+-	pkt_stat->pkt_len = GET_RX_DESC_PKT_LEN(rx_desc);
+-	pkt_stat->drv_info_sz = GET_RX_DESC_DRV_INFO_SIZE(rx_desc);
+-	pkt_stat->shift = GET_RX_DESC_SHIFT(rx_desc);
+-	pkt_stat->rate = GET_RX_DESC_RX_RATE(rx_desc);
+-	pkt_stat->cam_id = GET_RX_DESC_MACID(rx_desc);
+-	pkt_stat->ppdu_cnt = GET_RX_DESC_PPDU_CNT(rx_desc);
+-	pkt_stat->tsf_low = GET_RX_DESC_TSFL(rx_desc);
+-
+-	/* drv_info_sz is in unit of 8-bytes */
+-	pkt_stat->drv_info_sz *= 8;
+-
+-	/* c2h cmd pkt's rx/phy status is not interested */
+-	if (pkt_stat->is_c2h)
+-		return;
+-
+-	hdr = (struct ieee80211_hdr *)(rx_desc + desc_sz + pkt_stat->shift +
+-				       pkt_stat->drv_info_sz);
+-	if (pkt_stat->phy_status) {
+-		phy_status = rx_desc + desc_sz + pkt_stat->shift;
+-		query_phy_status(rtwdev, phy_status, pkt_stat);
+-	}
+-
+-	rtw_rx_fill_rx_status(rtwdev, pkt_stat, hdr, rx_status, phy_status);
+-}
+-
+ static void
+ rtw8822b_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path,
+ 				    u8 rs, u32 *phy_pwr_idx)
+@@ -2177,7 +2136,7 @@ static const struct rtw_prioq_addrs prio
+ static const struct rtw_chip_ops rtw8822b_ops = {
+ 	.phy_set_param		= rtw8822b_phy_set_param,
+ 	.read_efuse		= rtw8822b_read_efuse,
+-	.query_rx_desc		= rtw8822b_query_rx_desc,
++	.query_phy_status	= query_phy_status,
+ 	.set_channel		= rtw8822b_set_channel,
+ 	.mac_init		= rtw8822b_mac_init,
+ 	.read_rf		= rtw_phy_read_rf,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
+@@ -2690,48 +2690,6 @@ static void query_phy_status(struct rtw_
+ 	}
+ }
+ 
+-static void rtw8822c_query_rx_desc(struct rtw_dev *rtwdev, u8 *rx_desc,
+-				   struct rtw_rx_pkt_stat *pkt_stat,
+-				   struct ieee80211_rx_status *rx_status)
+-{
+-	struct ieee80211_hdr *hdr;
+-	u32 desc_sz = rtwdev->chip->rx_pkt_desc_sz;
+-	u8 *phy_status = NULL;
+-
+-	memset(pkt_stat, 0, sizeof(*pkt_stat));
+-
+-	pkt_stat->phy_status = GET_RX_DESC_PHYST(rx_desc);
+-	pkt_stat->icv_err = GET_RX_DESC_ICV_ERR(rx_desc);
+-	pkt_stat->crc_err = GET_RX_DESC_CRC32(rx_desc);
+-	pkt_stat->decrypted = !GET_RX_DESC_SWDEC(rx_desc) &&
+-			      GET_RX_DESC_ENC_TYPE(rx_desc) != RX_DESC_ENC_NONE;
+-	pkt_stat->is_c2h = GET_RX_DESC_C2H(rx_desc);
+-	pkt_stat->pkt_len = GET_RX_DESC_PKT_LEN(rx_desc);
+-	pkt_stat->drv_info_sz = GET_RX_DESC_DRV_INFO_SIZE(rx_desc);
+-	pkt_stat->shift = GET_RX_DESC_SHIFT(rx_desc);
+-	pkt_stat->rate = GET_RX_DESC_RX_RATE(rx_desc);
+-	pkt_stat->cam_id = GET_RX_DESC_MACID(rx_desc);
+-	pkt_stat->ppdu_cnt = GET_RX_DESC_PPDU_CNT(rx_desc);
+-	pkt_stat->tsf_low = GET_RX_DESC_TSFL(rx_desc);
+-
+-	/* drv_info_sz is in unit of 8-bytes */
+-	pkt_stat->drv_info_sz *= 8;
+-
+-	/* c2h cmd pkt's rx/phy status is not interested */
+-	if (pkt_stat->is_c2h)
+-		return;
+-
+-	hdr = (struct ieee80211_hdr *)(rx_desc + desc_sz + pkt_stat->shift +
+-				       pkt_stat->drv_info_sz);
+-	pkt_stat->hdr = hdr;
+-	if (pkt_stat->phy_status) {
+-		phy_status = rx_desc + desc_sz + pkt_stat->shift;
+-		query_phy_status(rtwdev, phy_status, pkt_stat);
+-	}
+-
+-	rtw_rx_fill_rx_status(rtwdev, pkt_stat, hdr, rx_status, phy_status);
+-}
+-
+ static void
+ rtw8822c_set_write_tx_power_ref(struct rtw_dev *rtwdev, u8 *tx_pwr_ref_cck,
+ 				u8 *tx_pwr_ref_ofdm)
+@@ -4992,7 +4950,7 @@ static const struct rtw_prioq_addrs prio
+ static const struct rtw_chip_ops rtw8822c_ops = {
+ 	.phy_set_param		= rtw8822c_phy_set_param,
+ 	.read_efuse		= rtw8822c_read_efuse,
+-	.query_rx_desc		= rtw8822c_query_rx_desc,
++	.query_phy_status	= query_phy_status,
+ 	.set_channel		= rtw8822c_set_channel,
+ 	.mac_init		= rtw8822c_mac_init,
+ 	.dump_fw_crash		= rtw8822c_dump_fw_crash,
+--- a/drivers/net/wireless/realtek/rtw88/rx.c
++++ b/drivers/net/wireless/realtek/rtw88/rx.c
+@@ -187,11 +187,10 @@ fill_rx_status:
+ }
+ EXPORT_SYMBOL(rtw_update_rx_freq_from_ie);
+ 
+-void rtw_rx_fill_rx_status(struct rtw_dev *rtwdev,
+-			   struct rtw_rx_pkt_stat *pkt_stat,
+-			   struct ieee80211_hdr *hdr,
+-			   struct ieee80211_rx_status *rx_status,
+-			   u8 *phy_status)
++static void rtw_rx_fill_rx_status(struct rtw_dev *rtwdev,
++				  struct rtw_rx_pkt_stat *pkt_stat,
++				  struct ieee80211_hdr *hdr,
++				  struct ieee80211_rx_status *rx_status)
+ {
+ 	struct ieee80211_hw *hw = rtwdev->hw;
+ 	u8 path;
+@@ -242,5 +241,64 @@ void rtw_rx_fill_rx_status(struct rtw_de
+ 	}
+ 
+ 	rtw_rx_addr_match(rtwdev, pkt_stat, hdr);
++
++	/* Rtl8723cs driver checks for size < 14 or size > 8192 and
++	 * simply drops the packet.
++	 */
++	if (rtwdev->chip->id == RTW_CHIP_TYPE_8703B && pkt_stat->pkt_len == 0) {
++		rx_status->flag |= RX_FLAG_NO_PSDU;
++		rtw_dbg(rtwdev, RTW_DBG_RX, "zero length packet");
++	}
++}
++
++void rtw_rx_query_rx_desc(struct rtw_dev *rtwdev, void *rx_desc8,
++			  struct rtw_rx_pkt_stat *pkt_stat,
++			  struct ieee80211_rx_status *rx_status)
++{
++	u32 desc_sz = rtwdev->chip->rx_pkt_desc_sz;
++	struct rtw_rx_desc *rx_desc = rx_desc8;
++	struct ieee80211_hdr *hdr;
++	u32 enc_type, swdec;
++	void *phy_status;
++
++	memset(pkt_stat, 0, sizeof(*pkt_stat));
++
++	pkt_stat->pkt_len = le32_get_bits(rx_desc->w0, RTW_RX_DESC_W0_PKT_LEN);
++	pkt_stat->crc_err = le32_get_bits(rx_desc->w0, RTW_RX_DESC_W0_CRC32);
++	pkt_stat->icv_err = le32_get_bits(rx_desc->w0, RTW_RX_DESC_W0_ICV_ERR);
++	pkt_stat->drv_info_sz = le32_get_bits(rx_desc->w0,
++					      RTW_RX_DESC_W0_DRV_INFO_SIZE);
++	enc_type = le32_get_bits(rx_desc->w0, RTW_RX_DESC_W0_ENC_TYPE);
++	pkt_stat->shift = le32_get_bits(rx_desc->w0, RTW_RX_DESC_W0_SHIFT);
++	pkt_stat->phy_status = le32_get_bits(rx_desc->w0, RTW_RX_DESC_W0_PHYST);
++	swdec = le32_get_bits(rx_desc->w0, RTW_RX_DESC_W0_SWDEC);
++	pkt_stat->decrypted = !swdec && enc_type != RX_DESC_ENC_NONE;
++
++	pkt_stat->cam_id = le32_get_bits(rx_desc->w1, RTW_RX_DESC_W1_MACID);
++
++	pkt_stat->is_c2h = le32_get_bits(rx_desc->w2, RTW_RX_DESC_W2_C2H);
++	pkt_stat->ppdu_cnt = le32_get_bits(rx_desc->w2, RTW_RX_DESC_W2_PPDU_CNT);
++
++	pkt_stat->rate = le32_get_bits(rx_desc->w3, RTW_RX_DESC_W3_RX_RATE);
++
++	pkt_stat->bw = le32_get_bits(rx_desc->w4, RTW_RX_DESC_W4_BW);
++
++	pkt_stat->tsf_low = le32_get_bits(rx_desc->w5, RTW_RX_DESC_W5_TSFL);
++
++	/* drv_info_sz is in unit of 8-bytes */
++	pkt_stat->drv_info_sz *= 8;
++
++	/* c2h cmd pkt's rx/phy status is not interested */
++	if (pkt_stat->is_c2h)
++		return;
++
++	phy_status = rx_desc8 + desc_sz + pkt_stat->shift;
++	hdr = phy_status + pkt_stat->drv_info_sz;
++	pkt_stat->hdr = hdr;
++
++	if (pkt_stat->phy_status)
++		rtwdev->chip->ops->query_phy_status(rtwdev, phy_status, pkt_stat);
++
++	rtw_rx_fill_rx_status(rtwdev, pkt_stat, hdr, rx_status);
+ }
+-EXPORT_SYMBOL(rtw_rx_fill_rx_status);
++EXPORT_SYMBOL(rtw_rx_query_rx_desc);
+--- a/drivers/net/wireless/realtek/rtw88/rx.h
++++ b/drivers/net/wireless/realtek/rtw88/rx.h
+@@ -14,42 +14,40 @@ enum rtw_rx_desc_enc {
+ 	RX_DESC_ENC_WEP104	= 5,
+ };
+ 
+-#define GET_RX_DESC_PHYST(rxdesc)                                              \
+-	le32_get_bits(*((__le32 *)(rxdesc) + 0x00), BIT(26))
+-#define GET_RX_DESC_ICV_ERR(rxdesc)                                            \
+-	le32_get_bits(*((__le32 *)(rxdesc) + 0x00), BIT(15))
+-#define GET_RX_DESC_CRC32(rxdesc)                                              \
+-	le32_get_bits(*((__le32 *)(rxdesc) + 0x00), BIT(14))
+-#define GET_RX_DESC_SWDEC(rxdesc)                                              \
+-	le32_get_bits(*((__le32 *)(rxdesc) + 0x00), BIT(27))
+-#define GET_RX_DESC_C2H(rxdesc)                                                \
+-	le32_get_bits(*((__le32 *)(rxdesc) + 0x02), BIT(28))
+-#define GET_RX_DESC_PKT_LEN(rxdesc)                                            \
+-	le32_get_bits(*((__le32 *)(rxdesc) + 0x00), GENMASK(13, 0))
+-#define GET_RX_DESC_DRV_INFO_SIZE(rxdesc)                                      \
+-	le32_get_bits(*((__le32 *)(rxdesc) + 0x00), GENMASK(19, 16))
+-#define GET_RX_DESC_SHIFT(rxdesc)                                              \
+-	le32_get_bits(*((__le32 *)(rxdesc) + 0x00), GENMASK(25, 24))
+-#define GET_RX_DESC_ENC_TYPE(rxdesc)                                           \
+-	le32_get_bits(*((__le32 *)(rxdesc) + 0x00), GENMASK(22, 20))
+-#define GET_RX_DESC_RX_RATE(rxdesc)                                            \
+-	le32_get_bits(*((__le32 *)(rxdesc) + 0x03), GENMASK(6, 0))
+-#define GET_RX_DESC_MACID(rxdesc)                                              \
+-	le32_get_bits(*((__le32 *)(rxdesc) + 0x01), GENMASK(6, 0))
+-#define GET_RX_DESC_PPDU_CNT(rxdesc)                                           \
+-	le32_get_bits(*((__le32 *)(rxdesc) + 0x02), GENMASK(30, 29))
+-#define GET_RX_DESC_TSFL(rxdesc)                                               \
+-	le32_get_bits(*((__le32 *)(rxdesc) + 0x05), GENMASK(31, 0))
+-#define GET_RX_DESC_BW(rxdesc)                                                 \
+-	(le32_get_bits(*((__le32 *)(rxdesc) + 0x04), GENMASK(5, 4)))
++struct rtw_rx_desc {
++	__le32 w0;
++	__le32 w1;
++	__le32 w2;
++	__le32 w3;
++	__le32 w4;
++	__le32 w5;
++} __packed;
++
++#define RTW_RX_DESC_W0_PKT_LEN		GENMASK(13, 0)
++#define RTW_RX_DESC_W0_CRC32		BIT(14)
++#define RTW_RX_DESC_W0_ICV_ERR		BIT(15)
++#define RTW_RX_DESC_W0_DRV_INFO_SIZE	GENMASK(19, 16)
++#define RTW_RX_DESC_W0_ENC_TYPE		GENMASK(22, 20)
++#define RTW_RX_DESC_W0_SHIFT		GENMASK(25, 24)
++#define RTW_RX_DESC_W0_PHYST		BIT(26)
++#define RTW_RX_DESC_W0_SWDEC		BIT(27)
++
++#define RTW_RX_DESC_W1_MACID		GENMASK(6, 0)
++
++#define RTW_RX_DESC_W2_C2H		BIT(28)
++#define RTW_RX_DESC_W2_PPDU_CNT		GENMASK(30, 29)
++
++#define RTW_RX_DESC_W3_RX_RATE		GENMASK(6, 0)
++
++#define RTW_RX_DESC_W4_BW		GENMASK(5, 4)
++
++#define RTW_RX_DESC_W5_TSFL		GENMASK(31, 0)
+ 
+ void rtw_rx_stats(struct rtw_dev *rtwdev, struct ieee80211_vif *vif,
+ 		  struct sk_buff *skb);
+-void rtw_rx_fill_rx_status(struct rtw_dev *rtwdev,
+-			   struct rtw_rx_pkt_stat *pkt_stat,
+-			   struct ieee80211_hdr *hdr,
+-			   struct ieee80211_rx_status *rx_status,
+-			   u8 *phy_status);
++void rtw_rx_query_rx_desc(struct rtw_dev *rtwdev, void *rx_desc8,
++			  struct rtw_rx_pkt_stat *pkt_stat,
++			  struct ieee80211_rx_status *rx_status);
+ void rtw_update_rx_freq_from_ie(struct rtw_dev *rtwdev, struct sk_buff *skb,
+ 				struct ieee80211_rx_status *rx_status,
+ 				struct rtw_rx_pkt_stat *pkt_stat);
+--- a/drivers/net/wireless/realtek/rtw88/sdio.c
++++ b/drivers/net/wireless/realtek/rtw88/sdio.c
+@@ -979,8 +979,7 @@ static void rtw_sdio_rxfifo_recv(struct
+ 
+ 	while (true) {
+ 		rx_desc = skb->data;
+-		chip->ops->query_rx_desc(rtwdev, rx_desc, &pkt_stat,
+-					 &rx_status);
++		rtw_rx_query_rx_desc(rtwdev, rx_desc, &pkt_stat, &rx_status);
+ 		pkt_offset = pkt_desc_sz + pkt_stat.drv_info_sz +
+ 			     pkt_stat.shift;
+ 
+--- a/drivers/net/wireless/realtek/rtw88/usb.c
++++ b/drivers/net/wireless/realtek/rtw88/usb.c
+@@ -625,8 +625,8 @@ static void rtw_usb_rx_handler(struct wo
+ 
+ 		do {
+ 			rx_desc = skb->data;
+-			chip->ops->query_rx_desc(rtwdev, rx_desc, &pkt_stat,
+-						 &rx_status);
++			rtw_rx_query_rx_desc(rtwdev, rx_desc, &pkt_stat,
++					     &rx_status);
+ 			pkt_offset = pkt_desc_sz + pkt_stat.drv_info_sz +
+ 				     pkt_stat.shift;
+ 
diff --git a/package/kernel/mac80211/patches/rtl/022-v6.13-wifi-rtw88-Refactor-looping-in-rtw_phy_store_tx_powe.patch b/package/kernel/mac80211/patches/rtl/022-v6.13-wifi-rtw88-Refactor-looping-in-rtw_phy_store_tx_powe.patch
new file mode 100644
index 00000000000000..4f019617d4799f
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/022-v6.13-wifi-rtw88-Refactor-looping-in-rtw_phy_store_tx_powe.patch
@@ -0,0 +1,34 @@
+From 7846f0b63562f4db45f712cc7dab091985baf07b Mon Sep 17 00:00:00 2001
+From: Mohammed Anees <pvmohammedanees2003@gmail.com>
+Date: Thu, 17 Oct 2024 13:36:38 +0530
+Subject: [PATCH] wifi: rtw88: Refactor looping in
+ rtw_phy_store_tx_power_by_rate
+
+The previous implementation included an unnecessary else
+condition paired with a continue statement. Since a check
+is already performed to determine if the band is either
+2G or 5G, the else condition will never be triggered.
+We can remove this check.
+
+Signed-off-by: Mohammed Anees <pvmohammedanees2003@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241017080638.13074-1-pvmohammedanees2003@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/phy.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/phy.c
++++ b/drivers/net/wireless/realtek/rtw88/phy.c
+@@ -1470,10 +1470,8 @@ static void rtw_phy_store_tx_power_by_ra
+ 		rate = rates[i];
+ 		if (band == PHY_BAND_2G)
+ 			hal->tx_pwr_by_rate_offset_2g[rfpath][rate] = offset;
+-		else if (band == PHY_BAND_5G)
+-			hal->tx_pwr_by_rate_offset_5g[rfpath][rate] = offset;
+ 		else
+-			continue;
++			hal->tx_pwr_by_rate_offset_5g[rfpath][rate] = offset;
+ 	}
+ }
+ 
diff --git a/package/kernel/mac80211/patches/rtl/023-v6.13-wifi-rtw88-Report-the-signal-strength-only-if-it-s-k.patch b/package/kernel/mac80211/patches/rtl/023-v6.13-wifi-rtw88-Report-the-signal-strength-only-if-it-s-k.patch
new file mode 100644
index 00000000000000..accbf2b484f7f1
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/023-v6.13-wifi-rtw88-Report-the-signal-strength-only-if-it-s-k.patch
@@ -0,0 +1,39 @@
+From 47f754b3f838205f3b25c4839f74801d180995bf Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Tue, 22 Oct 2024 20:20:26 +0300
+Subject: [PATCH] wifi: rtw88: Report the signal strength only if it's known
+
+RTL8811CU doesn't report the signal strength for many (any?) data
+frames. When the signal strength is not known, set
+RX_FLAG_NO_SIGNAL_VAL in order to avoid reporting a signal
+strength of 0.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Acked-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/f7e1e448-2c9b-498f-b8b1-a14dd967d7d3@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/rx.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/rx.c
++++ b/drivers/net/wireless/realtek/rtw88/rx.c
+@@ -234,10 +234,14 @@ static void rtw_rx_fill_rx_status(struct
+ 	else
+ 		rx_status->bw = RATE_INFO_BW_20;
+ 
+-	rx_status->signal = pkt_stat->signal_power;
+-	for (path = 0; path < rtwdev->hal.rf_path_num; path++) {
+-		rx_status->chains |= BIT(path);
+-		rx_status->chain_signal[path] = pkt_stat->rx_power[path];
++	if (pkt_stat->phy_status) {
++		rx_status->signal = pkt_stat->signal_power;
++		for (path = 0; path < rtwdev->hal.rf_path_num; path++) {
++			rx_status->chains |= BIT(path);
++			rx_status->chain_signal[path] = pkt_stat->rx_power[path];
++		}
++	} else {
++		rx_status->flag |= RX_FLAG_NO_SIGNAL_VAL;
+ 	}
+ 
+ 	rtw_rx_addr_match(rtwdev, pkt_stat, hdr);
diff --git a/package/kernel/mac80211/patches/rtl/024-v6.13-wifi-rtw88-Add-some-definitions-for-RTL8821AU-RTL881.patch b/package/kernel/mac80211/patches/rtl/024-v6.13-wifi-rtw88-Add-some-definitions-for-RTL8821AU-RTL881.patch
new file mode 100644
index 00000000000000..8d63717c59ff93
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/024-v6.13-wifi-rtw88-Add-some-definitions-for-RTL8821AU-RTL881.patch
@@ -0,0 +1,490 @@
+From d12722830ea4f562e91586927ec21b64d0369544 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 23 Oct 2024 17:00:59 +0300
+Subject: [PATCH] wifi: rtw88: Add some definitions for RTL8821AU/RTL8812AU
+
+Add 8821A and 8812A chip type enums.
+
+Add cck_high_power member to struct rtw_hal. This will be used to
+calculate the RX signal strength of RTL8812AU.
+
+Add various register definitions which will be used by the new drivers.
+
+Move some existing register definitions from rtw8821c.h and rtw8822b.h.
+They were duplicated in those headers and will also be used by the new
+drivers.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/9279a9cd-6f86-4dc3-a095-7c36cb9b9d06@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/main.h     |   3 +
+ drivers/net/wireless/realtek/rtw88/reg.h      | 174 ++++++++++++++++++
+ drivers/net/wireless/realtek/rtw88/rtw8821c.h |  24 ---
+ drivers/net/wireless/realtek/rtw88/rtw8822b.h |  12 --
+ 4 files changed, 177 insertions(+), 36 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -189,6 +189,8 @@ enum rtw_chip_type {
+ 	RTW_CHIP_TYPE_8723D,
+ 	RTW_CHIP_TYPE_8821C,
+ 	RTW_CHIP_TYPE_8703B,
++	RTW_CHIP_TYPE_8821A,
++	RTW_CHIP_TYPE_8812A,
+ };
+ 
+ enum rtw_tx_queue_type {
+@@ -1934,6 +1936,7 @@ struct rtw_hal {
+ 	u32 antenna_rx;
+ 	u8 bfee_sts_cap;
+ 	bool txrx_1ss;
++	bool cck_high_power;
+ 
+ 	/* protect tx power section */
+ 	struct mutex tx_power_mutex;
+--- a/drivers/net/wireless/realtek/rtw88/reg.h
++++ b/drivers/net/wireless/realtek/rtw88/reg.h
+@@ -9,6 +9,7 @@
+ #define BIT_FEN_EN_25_1		BIT(13)
+ #define BIT_FEN_ELDR		BIT(12)
+ #define BIT_FEN_CPUEN		BIT(2)
++#define BIT_FEN_USBA		BIT(2)
+ #define BIT_FEN_BB_GLB_RST	BIT(1)
+ #define BIT_FEN_BB_RSTB		BIT(0)
+ #define BIT_R_DIS_PRST		BIT(6)
+@@ -16,6 +17,10 @@
+ #define REG_SYS_PW_CTRL		0x0004
+ #define BIT_PFM_WOWL		BIT(3)
+ #define BIT_APFM_OFFMAC		BIT(9)
++#define REG_APS_FSMCO		0x0004
++#define APS_FSMCO_MAC_ENABLE	BIT(8)
++#define APS_FSMCO_MAC_OFF	BIT(9)
++#define APS_FSMCO_HW_POWERDOWN	BIT(15)
+ #define REG_SYS_CLK_CTRL	0x0008
+ #define BIT_CPU_CLK_EN		BIT(14)
+ 
+@@ -58,6 +63,8 @@
+ #define BIT_SHIFT_LDO25_VOLTAGE	4
+ #define BIT_LDO25_EN		BIT(7)
+ 
++#define REG_ACLK_MON		0x3e
++
+ #define REG_GPIO_MUXCFG		0x0040
+ #define BIT_FSPI_EN		BIT(19)
+ #define BIT_EN_SIC		BIT(12)
+@@ -90,6 +97,8 @@
+ #define BIT_USB_SUS_DIS		BIT(8)
+ #define BIT_SDIO_PAD_E5		BIT(18)
+ 
++#define REG_RF_B_CTRL		0x76
++
+ #define REG_AFE_CTRL_4		0x0078
+ #define BIT_CK320M_AFE_EN	BIT(4)
+ #define BIT_EN_SYN		BIT(15)
+@@ -135,6 +144,11 @@
+ #define REG_PMC_DBG_CTRL1	0xa8
+ #define BITS_PMC_BT_IQK_STS	GENMASK(22, 21)
+ 
++#define REG_HIMR0		0xb0
++#define REG_HISR0		0xb4
++#define REG_HIMR1		0xb8
++#define REG_HISR1		0xbc
++
+ #define REG_PAD_CTRL2		0x00C4
+ #define BIT_RSM_EN_V1		BIT(16)
+ #define BIT_NO_PDN_CHIPOFF_V1	BIT(17)
+@@ -186,6 +200,15 @@
+ #define MAC_TRX_ENABLE	(BIT_HCI_TXDMA_EN | BIT_HCI_RXDMA_EN | BIT_TXDMA_EN | \
+ 			BIT_RXDMA_EN | BIT_PROTOCOL_EN | BIT_SCHEDULE_EN | \
+ 			BIT_MACTXEN | BIT_MACRXEN)
++#define REG_PBP			0x104
++#define PBP_RX_MASK		0x0f
++#define PBP_TX_MASK		0xf0
++#define PBP_64			0x0
++#define PBP_128			0x1
++#define PBP_256			0x2
++#define PBP_512			0x3
++#define PBP_1024		0x4
++
+ #define BIT_SHIFT_TXDMA_VOQ_MAP	4
+ #define BIT_MASK_TXDMA_VOQ_MAP	0x3
+ #define BIT_TXDMA_VOQ_MAP(x)                                                   \
+@@ -257,6 +280,8 @@
+ #define REG_HMEBOX1		0x01D4
+ #define REG_HMEBOX2		0x01D8
+ #define REG_HMEBOX3		0x01DC
++#define REG_LLT_INIT		0x01E0
++#define BIT_LLT_WRITE_ACCESS	BIT(30)
+ #define REG_HMEBOX0_EX		0x01F0
+ #define REG_HMEBOX1_EX		0x01F4
+ #define REG_HMEBOX2_EX		0x01F8
+@@ -299,6 +324,7 @@
+ 
+ #define REG_AUTO_LLT		0x0224
+ #define BIT_AUTO_INIT_LLT	BIT(16)
++#define REG_DWBCN1_CTRL		0x0228
+ #define REG_RQPN_CTRL_1		0x0228
+ #define REG_RQPN_CTRL_2		0x022C
+ #define BIT_LD_RQPN		BIT(31)
+@@ -330,6 +356,7 @@
+ #define BIT_DMA_BURST_SIZE_1024	0
+ 
+ #define REG_RXPKTNUM		0x02B0
++#define REG_EARLY_MODE_CONTROL	0x02BC
+ 
+ #define REG_INT_MIG		0x0304
+ #define REG_HCI_MIX_CFG		0x03FC
+@@ -337,6 +364,7 @@
+ 
+ #define REG_BCNQ_INFO		0x0418
+ #define BIT_MGQ_CPU_EMPTY	BIT(24)
++#define REG_TXPKT_EMPTY		0x041A
+ #define REG_FWHW_TXQ_CTRL	0x0420
+ #define BIT_EN_BCNQ_DL		BIT(22)
+ #define BIT_EN_WR_FREE_TAIL	BIT(20)
+@@ -363,10 +391,12 @@
+ #define REG_AMPDU_MAX_TIME_V1	0x0455
+ #define REG_BCNQ1_BDNY_V1	0x0456
+ #define REG_AMPDU_MAX_TIME	0x0456
++#define REG_AMPDU_MAX_LENGTH	0x0458
+ #define REG_WMAC_LBK_BF_HD	0x045D
+ #define REG_TX_HANG_CTRL	0x045E
+ #define BIT_EN_GNT_BT_AWAKE	BIT(3)
+ #define BIT_EN_EOF_V1		BIT(2)
++#define REG_FAST_EDCA_CTRL	0x0460
+ #define REG_DATA_SC		0x0483
+ #define REG_ARFR2_V1		0x048C
+ #define REG_ARFRH2_V1		0x0490
+@@ -391,6 +421,8 @@
+ #define REG_PRECNT_CTRL		0x04E5
+ #define BIT_BTCCA_CTRL		(BIT(0) | BIT(1))
+ #define BIT_EN_PRECNT		BIT(11)
++#define REG_TX_RPT_CTRL		0x04EC
++#define REG_TX_RPT_TIME		0x04F0
+ #define REG_DUMMY_PAGE4_V1	0x04FC
+ 
+ #define REG_EDCA_VO_PARAM	0x0500
+@@ -401,6 +433,7 @@
+ #define BIT_MASK_CWMAX		GENMASK(15, 12)
+ #define BIT_MASK_CWMIN		GENMASK(11, 8)
+ #define BIT_MASK_AIFS		GENMASK(7, 0)
++#define REG_BCNTCFG		0x0510
+ #define REG_PIFS		0x0512
+ #define REG_SIFS		0x0514
+ #define BIT_SHIFT_SIFS_OFDM_CTX	8
+@@ -527,6 +560,8 @@
+ #define REG_BT_COEX_V2		0x0762
+ #define BIT_GNT_BT_POLARITY	BIT(12)
+ #define BIT_LTE_COEX_EN		BIT(7)
++#define REG_GNT_BT		0x0765
++#define BIT_PTA_SW_CTL		GENMASK(4, 3)
+ #define REG_BT_COEX_ENH_INTR_CTRL	0x76E
+ #define BIT_R_GRANTALL_WLMASK	BIT(3)
+ #define BIT_STATIS_BT_EN	BIT(2)
+@@ -544,14 +579,43 @@
+ #define REG_FPGA0_RFMOD		0x0800
+ #define BIT_CCKEN		BIT(24)
+ #define BIT_OFDMEN		BIT(25)
++#define REG_CCK_RPT_FORMAT	0x0804
++#define BIT_CCK_RPT_FORMAT	BIT(16)
++#define REG_RXPSEL		0x0808
++#define BIT_RX_PSEL_RST		(BIT(28) | BIT(29))
++#define REG_TXPSEL		0x080C
+ #define REG_RX_GAIN_EN		0x081c
++#define REG_CCASEL		0x082C
++#define REG_PDMFTH		0x0830
++#define REG_BWINDICATION	0x0834
++#define REG_CCA2ND		0x0838
++#define REG_L1PKTH		0x0848
++#define REG_CLKTRK		0x0860
++#define REG_ADCCLK		0x08AC
++#define REG_HSSI_READ		0x08B0
++#define REG_FPGA0_XCD_RF_PARA	0x08B4
++#define REG_RX_MCS_LIMIT	0x08BC
++#define REG_ADC160		0x08C4
++#define REG_ANTSEL_SW		0x0900
++#define REG_DAC_RSTB		0x090c
++#define REG_SINGLE_TONE_CONT_TX	0x0914
+ 
+ #define REG_RFE_CTRL_E		0x0974
+ #define REG_2ND_CCA_CTRL	0x0976
++#define REG_IQK_COM00		0x0978
++#define REG_IQK_COM32		0x097c
++#define REG_IQK_COM64		0x0980
++#define REG_IQK_COM96		0x0984
++
++#define REG_FAS			0x09a4
++#define REG_RXSB		0x0a00
++#define REG_CCK_RX		0x0a04
++#define REG_CCK_PD_TH		0x0a0a
+ 
+ #define REG_CCK0_FAREPORT	0xa2c
+ #define BIT_CCK0_2RX		BIT(18)
+ #define BIT_CCK0_MRC		BIT(22)
++#define REG_FA_CCK		0x0a5c
+ 
+ #define REG_DIS_DPD		0x0a70
+ #define DIS_DPD_MASK		GENMASK(9, 0)
+@@ -567,13 +631,109 @@
+ #define DIS_DPD_RATEVHT2SS_MCS1	BIT(9)
+ #define DIS_DPD_RATEALL		GENMASK(9, 0)
+ 
++#define REG_CNTRST		0x0b58
++
++#define REG_3WIRE_SWA		0x0c00
++#define REG_RX_IQC_AB_A		0x0c10
++#define REG_TXSCALE_A		0x0c1c
++#define BB_SWING_MASK		GENMASK(31, 21)
++#define REG_TX_AGC_A_CCK_11_CCK_1		0xc20
++#define REG_TX_AGC_A_OFDM18_OFDM6		0xc24
++#define REG_TX_AGC_A_OFDM54_OFDM24		0xc28
++#define REG_TX_AGC_A_MCS3_MCS0			0xc2c
++#define REG_TX_AGC_A_MCS7_MCS4			0xc30
++#define REG_TX_AGC_A_MCS11_MCS8			0xc34
++#define REG_TX_AGC_A_MCS15_MCS12		0xc38
++#define REG_TX_AGC_A_NSS1_INDEX3_NSS1_INDEX0	0xc3c
++#define REG_TX_AGC_A_NSS1_INDEX7_NSS1_INDEX4	0xc40
++#define REG_TX_AGC_A_NSS2_INDEX1_NSS1_INDEX8	0xc44
++#define REG_TX_AGC_A_NSS2_INDEX5_NSS2_INDEX2	0xc48
++#define REG_TX_AGC_A_NSS2_INDEX9_NSS2_INDEX6	0xc4c
++#define REG_RXIGI_A		0x0c50
++#define REG_TX_PWR_TRAINING_A	0x0c54
++#define REG_CK_MONHA		0x0c5c
++#define REG_AFE_PWR1_A		0x0c60
++#define REG_AFE_PWR2_A		0x0c64
++#define REG_RX_WAIT_CCA_TX_CCK_RFON_A	0x0c68
++#define REG_OFDM0_XA_TX_IQ_IMBALANCE	0x0c80
++#define REG_OFDM0_A_TX_AFE	0x0c84
++#define REG_OFDM0_XB_TX_IQ_IMBALANCE	0x0c88
++#define REG_TSSI_TRK_SW		0x0c8c
++#define REG_LSSI_WRITE_A	0x0c90
++#define REG_PREDISTA		0x0c90
++#define REG_TXAGCIDX		0x0c94
++
++#define REG_RFE_PINMUX_A	0x0cb0
++#define REG_RFE_INV_A		0x0cb4
+ #define REG_RFE_CTRL8		0x0cb4
+ #define BIT_MASK_RFE_SEL89	GENMASK(7, 0)
++#define PTA_CTRL_PIN		0x66
++#define DPDT_CTRL_PIN		0x77
++#define RFE_INV_MASK		0x3ff00000
++#define REG_RFECTL_A		0x0cb8
+ #define REG_RFE_INV8		0x0cbd
+ #define BIT_MASK_RFE_INV89	GENMASK(1, 0)
+ #define REG_RFE_INV16		0x0cbe
+ #define BIT_RFE_BUF_EN		BIT(3)
+ 
++#define REG_IQK_DPD_CFG		0x0cc4
++#define REG_CFG_PMPD		0x0cc8
++#define REG_IQC_Y		0x0ccc
++#define REG_IQC_X		0x0cd4
++#define REG_INTPO_SETA		0x0ce8
++
++#define REG_IQKA_END		0x0d00
++#define REG_PI_READ_A		0x0d04
++#define REG_SI_READ_A		0x0d08
++#define REG_IQKB_END		0x0d40
++#define REG_PI_READ_B		0x0d44
++#define REG_SI_READ_B		0x0d48
++
++#define REG_3WIRE_SWB		0x0e00
++#define REG_RX_IQC_AB_B		0x0e10
++#define REG_TXSCALE_B		0x0e1c
++#define REG_TX_AGC_B_CCK_11_CCK_1		0xe20
++#define REG_TX_AGC_B_OFDM18_OFDM6		0xe24
++#define REG_TX_AGC_B_OFDM54_OFDM24		0xe28
++#define REG_TX_AGC_B_MCS3_MCS0			0xe2c
++#define REG_TX_AGC_B_MCS7_MCS4			0xe30
++#define REG_TX_AGC_B_MCS11_MCS8			0xe34
++#define REG_TX_AGC_B_MCS15_MCS12		0xe38
++#define REG_TX_AGC_B_NSS1_INDEX3_NSS1_INDEX0	0xe3c
++#define REG_TX_AGC_B_NSS1_INDEX7_NSS1_INDEX4	0xe40
++#define REG_TX_AGC_B_NSS2_INDEX1_NSS1_INDEX8	0xe44
++#define REG_TX_AGC_B_NSS2_INDEX5_NSS2_INDEX2	0xe48
++#define REG_TX_AGC_B_NSS2_INDEX9_NSS2_INDEX6	0xe4c
++#define REG_RXIGI_B		0x0e50
++#define REG_TX_PWR_TRAINING_B	0x0e54
++#define REG_CK_MONHB		0x0e5c
++#define REG_AFE_PWR1_B		0x0e60
++#define REG_AFE_PWR2_B		0x0e64
++#define REG_RX_WAIT_CCA_TX_CCK_RFON_B	0x0e68
++#define REG_TXTONEB		0x0e80
++#define REG_RXTONEB		0x0e84
++#define REG_TXPITMB		0x0e88
++#define REG_RXPITMB		0x0e8c
++#define REG_LSSI_WRITE_B	0x0e90
++#define REG_PREDISTB		0x0e90
++#define REG_INIDLYB		0x0e94
++#define REG_RFE_PINMUX_B	0x0eb0
++#define REG_RFE_INV_B		0x0eb4
++#define REG_RFECTL_B		0x0eb8
++#define REG_BPBDB		0x0ec4
++#define REG_PHYTXONB		0x0ec8
++#define REG_IQKYB		0x0ecc
++#define REG_IQKXB		0x0ed4
++#define REG_INTPO_SETB		0x0ee8
++
++#define REG_CRC_CCK		0x0f04
++#define REG_CCA_OFDM		0x0f08
++#define REG_CRC_VHT		0x0f0c
++#define REG_CRC_HT		0x0f10
++#define REG_CRC_OFDM		0x0f14
++#define REG_FA_OFDM		0x0f48
++#define REG_CCA_CCK		0x0fcc
++
+ #define REG_ANAPARSW_MAC_0	0x1010
+ #define BIT_CF_L_V2		GENMASK(29, 28)
+ 
+@@ -710,6 +870,10 @@
+ 
+ #define REG_IGN_GNTBT4	0x4160
+ 
++#define REG_USB_MOD	0xf008
++#define REG_USB3_RXITV	0xf050
++#define REG_USB_HRPWM	0xfe58
++
+ #define RF_MODE		0x00
+ #define RF_MODOPT	0x01
+ #define RF_WLINT	0x01
+@@ -717,7 +881,13 @@
+ #define RF_DTXLOK	0x08
+ #define RF_CFGCH	0x18
+ #define BIT_BAND	GENMASK(18, 16)
++#define RF18_BAND_MASK	(BIT(16) | BIT(9) | BIT(8))
++#define RF18_CHANNEL_MASK	(MASKBYTE0)
++#define RF18_RFSI_MASK	(BIT(18) | BIT(17))
+ #define RF_RCK		0x1d
++#define RF_MODE_TABLE_ADDR	0x30
++#define RF_MODE_TABLE_DATA0	0x31
++#define RF_MODE_TABLE_DATA1	0x32
+ #define RF_LUTWA	0x33
+ #define RF_LUTWD1	0x3e
+ #define RF_LUTWD0	0x3f
+@@ -726,10 +896,14 @@
+ #define RF_T_METER	0x42
+ #define RF_BSPAD	0x54
+ #define RF_GAINTX	0x56
++#define RF_TXMOD	0x58
+ #define RF_TXATANK	0x64
++#define RF_TXA_PREPAD	0x65
+ #define RF_TRXIQ	0x66
+ #define RF_RXIQGEN	0x8d
++#define RF_RXBB2	0x8f
+ #define RF_SYN_PFD	0xb0
++#define RF_LCK		0xb4
+ #define RF_XTALX2	0xb8
+ #define RF_SYN_CTRL	0xbb
+ #define RF_MALSEL	0xbe
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.h
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.h
+@@ -215,19 +215,10 @@ extern const struct rtw_chip_info rtw882
+ #define BIT_FEN_EN	BIT(26)
+ #define REG_INIRTS_RATE_SEL 0x0480
+ #define REG_HTSTFWT	0x800
+-#define REG_RXPSEL	0x808
+-#define BIT_RX_PSEL_RST		(BIT(28) | BIT(29))
+-#define REG_TXPSEL	0x80c
+ #define REG_RXCCAMSK	0x814
+-#define REG_CCASEL	0x82c
+-#define REG_PDMFTH	0x830
+-#define REG_CCA2ND	0x838
+ #define REG_L1WT	0x83c
+ #define REG_L1PKWT	0x840
+ #define REG_MRC		0x850
+-#define REG_CLKTRK	0x860
+-#define REG_ADCCLK	0x8ac
+-#define REG_ADC160	0x8c4
+ #define REG_ADC40	0x8c8
+ #define REG_CHFIR	0x8f0
+ #define REG_CDDTXP	0x93c
+@@ -235,14 +226,11 @@ extern const struct rtw_chip_info rtw882
+ #define REG_ACBB0	0x948
+ #define REG_ACBBRXFIR	0x94c
+ #define REG_ACGG2TBL	0x958
+-#define REG_FAS		0x9a4
+-#define REG_RXSB	0xa00
+ #define REG_ADCINI	0xa04
+ #define REG_PWRTH	0xa08
+ #define REG_CCA_FLTR	0xa20
+ #define REG_TXSF2	0xa24
+ #define REG_TXSF6	0xa28
+-#define REG_FA_CCK	0xa5c
+ #define REG_RXDESC	0xa2c
+ #define REG_ENTXCCK	0xa80
+ #define BTG_LNA		0xfc84
+@@ -253,12 +241,8 @@ extern const struct rtw_chip_info rtw882
+ #define REG_PWRTH2	0xaa8
+ #define REG_CSRATIO	0xaaa
+ #define REG_TXFILTER	0xaac
+-#define REG_CNTRST	0xb58
+ #define REG_AGCTR_A	0xc08
+-#define REG_TXSCALE_A	0xc1c
+ #define REG_TXDFIR	0xc20
+-#define REG_RXIGI_A	0xc50
+-#define REG_TXAGCIDX	0xc94
+ #define REG_TRSW	0xca0
+ #define REG_RFESEL0	0xcb0
+ #define REG_RFESEL8	0xcb4
+@@ -270,14 +254,6 @@ extern const struct rtw_chip_info rtw882
+ #define B_WLA_SWITCH	BIT(23)
+ #define REG_RFEINV	0xcbc
+ #define REG_AGCTR_B	0xe08
+-#define REG_RXIGI_B	0xe50
+-#define REG_CRC_CCK	0xf04
+-#define REG_CRC_OFDM	0xf14
+-#define REG_CRC_HT	0xf10
+-#define REG_CRC_VHT	0xf0c
+-#define REG_CCA_OFDM	0xf08
+-#define REG_FA_OFDM	0xf48
+-#define REG_CCA_CCK	0xfcc
+ #define REG_DMEM_CTRL	0x1080
+ #define BIT_WL_RST	BIT(16)
+ #define REG_ANTWT	0x1904
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.h
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.h
+@@ -152,21 +152,12 @@ _rtw_write32s_mask(struct rtw_dev *rtwde
+ #define RTW8822B_EDCCA_MAX	0x7f
+ #define RTW8822B_EDCCA_SRC_DEF	1
+ #define REG_HTSTFWT	0x800
+-#define REG_RXPSEL	0x808
+-#define BIT_RX_PSEL_RST		(BIT(28) | BIT(29))
+-#define REG_TXPSEL	0x80c
+ #define REG_RXCCAMSK	0x814
+-#define REG_CCASEL	0x82c
+-#define REG_PDMFTH	0x830
+-#define REG_CCA2ND	0x838
+ #define REG_L1WT	0x83c
+ #define REG_L1PKWT	0x840
+ #define REG_MRC		0x850
+-#define REG_CLKTRK	0x860
+ #define REG_EDCCA_POW_MA	0x8a0
+ #define BIT_MA_LEVEL	GENMASK(1, 0)
+-#define REG_ADCCLK	0x8ac
+-#define REG_ADC160	0x8c4
+ #define REG_ADC40	0x8c8
+ #define REG_EDCCA_DECISION	0x8dc
+ #define BIT_EDCCA_OPTION	BIT(5)
+@@ -177,7 +168,6 @@ _rtw_write32s_mask(struct rtw_dev *rtwde
+ #define REG_ACBB0	0x948
+ #define REG_ACBBRXFIR	0x94c
+ #define REG_ACGG2TBL	0x958
+-#define REG_RXSB	0xa00
+ #define REG_ADCINI	0xa04
+ #define REG_TXSF2	0xa24
+ #define REG_TXSF6	0xa28
+@@ -185,14 +175,12 @@ _rtw_write32s_mask(struct rtw_dev *rtwde
+ #define REG_ENTXCCK	0xa80
+ #define REG_AGCTR_A	0xc08
+ #define REG_TXDFIR	0xc20
+-#define REG_RXIGI_A	0xc50
+ #define REG_TRSW	0xca0
+ #define REG_RFESEL0	0xcb0
+ #define REG_RFESEL8	0xcb4
+ #define REG_RFECTL	0xcb8
+ #define REG_RFEINV	0xcbc
+ #define REG_AGCTR_B	0xe08
+-#define REG_RXIGI_B	0xe50
+ #define REG_ANTWT	0x1904
+ #define REG_IQKFAILMSK	0x1bf0
+ 
diff --git a/package/kernel/mac80211/patches/rtl/025-v6.13-wifi-rtw88-Dump-the-HW-features-only-for-some-chips.patch b/package/kernel/mac80211/patches/rtl/025-v6.13-wifi-rtw88-Dump-the-HW-features-only-for-some-chips.patch
new file mode 100644
index 00000000000000..7c949ef79caa79
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/025-v6.13-wifi-rtw88-Dump-the-HW-features-only-for-some-chips.patch
@@ -0,0 +1,93 @@
+From 87341ca1eac9a3bac23bd41f6e24f3c93b77452f Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 23 Oct 2024 17:02:05 +0300
+Subject: [PATCH] wifi: rtw88: Dump the HW features only for some chips
+
+RTL8821AU and RTL8812AU don't support this. They hit the "failed to read
+hw feature report" error.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/8becd851-8760-4480-8e8c-c4869ce72507@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/main.c     | 3 +++
+ drivers/net/wireless/realtek/rtw88/main.h     | 1 +
+ drivers/net/wireless/realtek/rtw88/rtw8703b.c | 1 +
+ drivers/net/wireless/realtek/rtw88/rtw8723d.c | 1 +
+ drivers/net/wireless/realtek/rtw88/rtw8821c.c | 1 +
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c | 1 +
+ drivers/net/wireless/realtek/rtw88/rtw8822c.c | 1 +
+ 7 files changed, 9 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -1907,6 +1907,9 @@ static int rtw_dump_hw_feature(struct rt
+ 	u8 bw;
+ 	int i;
+ 
++	if (!rtwdev->chip->hw_feature_report)
++		return 0;
++
+ 	id = rtw_read8(rtwdev, REG_C2HEVT);
+ 	if (id != C2H_HW_FEATURE_REPORT) {
+ 		rtw_err(rtwdev, "failed to read hw feature report\n");
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -1200,6 +1200,7 @@ struct rtw_chip_info {
+ 	const struct rtw_fwcd_segs *fwcd_segs;
+ 
+ 	u8 usb_tx_agg_desc_num;
++	bool hw_feature_report;
+ 
+ 	u8 default_1ss_tx_path;
+ 
+--- a/drivers/net/wireless/realtek/rtw88/rtw8703b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8703b.c
+@@ -1960,6 +1960,7 @@ const struct rtw_chip_info rtw8703b_hw_s
+ 	.max_power_index = 0x3f,
+ 	.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
+ 	.usb_tx_agg_desc_num = 1, /* Not sure if this chip has USB interface */
++	.hw_feature_report = true,
+ 
+ 	.path_div_supported = false,
+ 	.ht_supported = true,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8723d.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8723d.c
+@@ -2131,6 +2131,7 @@ const struct rtw_chip_info rtw8723d_hw_s
+ 	.page_size = TX_PAGE_SIZE,
+ 	.dig_min = 0x20,
+ 	.usb_tx_agg_desc_num = 1,
++	.hw_feature_report = true,
+ 	.ht_supported = true,
+ 	.vht_supported = false,
+ 	.lps_deep_mode_supported = 0,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+@@ -1968,6 +1968,7 @@ const struct rtw_chip_info rtw8821c_hw_s
+ 	.page_size = TX_PAGE_SIZE,
+ 	.dig_min = 0x1c,
+ 	.usb_tx_agg_desc_num = 3,
++	.hw_feature_report = true,
+ 	.ht_supported = true,
+ 	.vht_supported = true,
+ 	.lps_deep_mode_supported = BIT(LPS_DEEP_MODE_LCLK),
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -2511,6 +2511,7 @@ const struct rtw_chip_info rtw8822b_hw_s
+ 	.page_size = TX_PAGE_SIZE,
+ 	.dig_min = 0x1c,
+ 	.usb_tx_agg_desc_num = 3,
++	.hw_feature_report = true,
+ 	.ht_supported = true,
+ 	.vht_supported = true,
+ 	.lps_deep_mode_supported = BIT(LPS_DEEP_MODE_LCLK),
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
+@@ -5330,6 +5330,7 @@ const struct rtw_chip_info rtw8822c_hw_s
+ 	.page_size = TX_PAGE_SIZE,
+ 	.dig_min = 0x20,
+ 	.usb_tx_agg_desc_num = 3,
++	.hw_feature_report = true,
+ 	.default_1ss_tx_path = BB_PATH_A,
+ 	.path_div_supported = true,
+ 	.ht_supported = true,
diff --git a/package/kernel/mac80211/patches/rtl/026-v6.13-wifi-rtw88-Allow-different-C2H-RA-report-sizes.patch b/package/kernel/mac80211/patches/rtl/026-v6.13-wifi-rtw88-Allow-different-C2H-RA-report-sizes.patch
new file mode 100644
index 00000000000000..fb69a06d64e586
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/026-v6.13-wifi-rtw88-Allow-different-C2H-RA-report-sizes.patch
@@ -0,0 +1,175 @@
+From d9018f4373517d4560ce2ebf12684f77f5fbdad6 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 23 Oct 2024 17:06:14 +0300
+Subject: [PATCH] wifi: rtw88: Allow different C2H RA report sizes
+
+The RTL8821AU and RTL8812AU have smaller RA report size, only 4 bytes.
+Avoid the "invalid ra report c2h length" error.
+
+Also, use a struct and u8_get_bits() to access the RA report C2H.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/c3e73c3a-fb2f-4013-9f06-d5274211e282@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/fw.c       | 21 +++++++++++++------
+ drivers/net/wireless/realtek/rtw88/fw.h       | 17 +++++++++++----
+ drivers/net/wireless/realtek/rtw88/main.h     |  1 +
+ drivers/net/wireless/realtek/rtw88/rtw8703b.c |  1 +
+ drivers/net/wireless/realtek/rtw88/rtw8723d.c |  1 +
+ drivers/net/wireless/realtek/rtw88/rtw8821c.c |  1 +
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c |  1 +
+ drivers/net/wireless/realtek/rtw88/rtw8822c.c |  1 +
+ 8 files changed, 34 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/fw.c
++++ b/drivers/net/wireless/realtek/rtw88/fw.c
+@@ -139,25 +139,30 @@ static u16 get_max_amsdu_len(u32 bit_rat
+ struct rtw_fw_iter_ra_data {
+ 	struct rtw_dev *rtwdev;
+ 	u8 *payload;
++	u8 length;
+ };
+ 
+ static void rtw_fw_ra_report_iter(void *data, struct ieee80211_sta *sta)
+ {
+ 	struct rtw_fw_iter_ra_data *ra_data = data;
++	struct rtw_c2h_ra_rpt *ra_rpt = (struct rtw_c2h_ra_rpt *)ra_data->payload;
+ 	struct rtw_sta_info *si = (struct rtw_sta_info *)sta->drv_priv;
+ 	u8 mac_id, rate, sgi, bw;
+ 	u8 mcs, nss;
+ 	u32 bit_rate;
+ 
+-	mac_id = GET_RA_REPORT_MACID(ra_data->payload);
++	mac_id = ra_rpt->mac_id;
+ 	if (si->mac_id != mac_id)
+ 		return;
+ 
+ 	si->ra_report.txrate.flags = 0;
+ 
+-	rate = GET_RA_REPORT_RATE(ra_data->payload);
+-	sgi = GET_RA_REPORT_SGI(ra_data->payload);
+-	bw = GET_RA_REPORT_BW(ra_data->payload);
++	rate = u8_get_bits(ra_rpt->rate_sgi, RTW_C2H_RA_RPT_RATE);
++	sgi = u8_get_bits(ra_rpt->rate_sgi, RTW_C2H_RA_RPT_SGI);
++	if (ra_data->length >= offsetofend(typeof(*ra_rpt), bw))
++		bw = ra_rpt->bw;
++	else
++		bw = si->bw_mode;
+ 
+ 	if (rate < DESC_RATEMCS0) {
+ 		si->ra_report.txrate.legacy = rtw_desc_to_bitrate(rate);
+@@ -197,14 +202,18 @@ legacy:
+ static void rtw_fw_ra_report_handle(struct rtw_dev *rtwdev, u8 *payload,
+ 				    u8 length)
+ {
++	struct rtw_c2h_ra_rpt *ra_rpt = (struct rtw_c2h_ra_rpt *)payload;
+ 	struct rtw_fw_iter_ra_data ra_data;
+ 
+-	if (WARN(length < 7, "invalid ra report c2h length\n"))
++	if (WARN(length < rtwdev->chip->c2h_ra_report_size,
++		 "invalid ra report c2h length %d\n", length))
+ 		return;
+ 
+-	rtwdev->dm_info.tx_rate = GET_RA_REPORT_RATE(payload);
++	rtwdev->dm_info.tx_rate = u8_get_bits(ra_rpt->rate_sgi,
++					      RTW_C2H_RA_RPT_RATE);
+ 	ra_data.rtwdev = rtwdev;
+ 	ra_data.payload = payload;
++	ra_data.length = length;
+ 	rtw_iterate_stas_atomic(rtwdev, rtw_fw_ra_report_iter, &ra_data);
+ }
+ 
+--- a/drivers/net/wireless/realtek/rtw88/fw.h
++++ b/drivers/net/wireless/realtek/rtw88/fw.h
+@@ -85,6 +85,19 @@ struct rtw_c2h_adaptivity {
+ 	u8 option;
+ } __packed;
+ 
++struct rtw_c2h_ra_rpt {
++	u8 rate_sgi;
++	u8 mac_id;
++	u8 byte2;
++	u8 status;
++	u8 byte4;
++	u8 ra_ratio;
++	u8 bw;
++} __packed;
++
++#define RTW_C2H_RA_RPT_RATE	GENMASK(6, 0)
++#define RTW_C2H_RA_RPT_SGI	BIT(7)
++
+ struct rtw_h2c_register {
+ 	u32 w0;
+ 	u32 w1;
+@@ -364,10 +377,6 @@ struct rtw_fw_hdr_legacy {
+ #define GET_CHAN_SWITCH_CENTRAL_CH(c2h_payload)	(c2h_payload[2])
+ #define GET_CHAN_SWITCH_ID(c2h_payload)		(c2h_payload[3])
+ #define GET_CHAN_SWITCH_STATUS(c2h_payload)	(c2h_payload[4])
+-#define GET_RA_REPORT_RATE(c2h_payload)		(c2h_payload[0] & 0x7f)
+-#define GET_RA_REPORT_SGI(c2h_payload)		((c2h_payload[0] & 0x80) >> 7)
+-#define GET_RA_REPORT_BW(c2h_payload)		(c2h_payload[6])
+-#define GET_RA_REPORT_MACID(c2h_payload)	(c2h_payload[1])
+ 
+ #define GET_BCN_FILTER_NOTIFY_TYPE(c2h_payload)	(c2h_payload[1] & 0xf)
+ #define GET_BCN_FILTER_NOTIFY_EVENT(c2h_payload)	(c2h_payload[1] & 0x10)
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -1201,6 +1201,7 @@ struct rtw_chip_info {
+ 
+ 	u8 usb_tx_agg_desc_num;
+ 	bool hw_feature_report;
++	u8 c2h_ra_report_size;
+ 
+ 	u8 default_1ss_tx_path;
+ 
+--- a/drivers/net/wireless/realtek/rtw88/rtw8703b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8703b.c
+@@ -1961,6 +1961,7 @@ const struct rtw_chip_info rtw8703b_hw_s
+ 	.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
+ 	.usb_tx_agg_desc_num = 1, /* Not sure if this chip has USB interface */
+ 	.hw_feature_report = true,
++	.c2h_ra_report_size = 7,
+ 
+ 	.path_div_supported = false,
+ 	.ht_supported = true,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8723d.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8723d.c
+@@ -2132,6 +2132,7 @@ const struct rtw_chip_info rtw8723d_hw_s
+ 	.dig_min = 0x20,
+ 	.usb_tx_agg_desc_num = 1,
+ 	.hw_feature_report = true,
++	.c2h_ra_report_size = 7,
+ 	.ht_supported = true,
+ 	.vht_supported = false,
+ 	.lps_deep_mode_supported = 0,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+@@ -1969,6 +1969,7 @@ const struct rtw_chip_info rtw8821c_hw_s
+ 	.dig_min = 0x1c,
+ 	.usb_tx_agg_desc_num = 3,
+ 	.hw_feature_report = true,
++	.c2h_ra_report_size = 7,
+ 	.ht_supported = true,
+ 	.vht_supported = true,
+ 	.lps_deep_mode_supported = BIT(LPS_DEEP_MODE_LCLK),
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -2512,6 +2512,7 @@ const struct rtw_chip_info rtw8822b_hw_s
+ 	.dig_min = 0x1c,
+ 	.usb_tx_agg_desc_num = 3,
+ 	.hw_feature_report = true,
++	.c2h_ra_report_size = 7,
+ 	.ht_supported = true,
+ 	.vht_supported = true,
+ 	.lps_deep_mode_supported = BIT(LPS_DEEP_MODE_LCLK),
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
+@@ -5331,6 +5331,7 @@ const struct rtw_chip_info rtw8822c_hw_s
+ 	.dig_min = 0x20,
+ 	.usb_tx_agg_desc_num = 3,
+ 	.hw_feature_report = true,
++	.c2h_ra_report_size = 7,
+ 	.default_1ss_tx_path = BB_PATH_A,
+ 	.path_div_supported = true,
+ 	.ht_supported = true,
diff --git a/package/kernel/mac80211/patches/rtl/027-v6.13-wifi-rtw88-Extend-the-init-table-parsing-for-RTL8812.patch b/package/kernel/mac80211/patches/rtl/027-v6.13-wifi-rtw88-Extend-the-init-table-parsing-for-RTL8812.patch
new file mode 100644
index 00000000000000..aec2e6aaecf6a7
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/027-v6.13-wifi-rtw88-Extend-the-init-table-parsing-for-RTL8812.patch
@@ -0,0 +1,165 @@
+From 95a772e30b60e7954d03f3372268722475aa303f Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 23 Oct 2024 17:08:24 +0300
+Subject: [PATCH] wifi: rtw88: Extend the init table parsing for RTL8812AU
+
+The chips supported so far only use the first condition, and so the
+parsing code ignores the second condition. RTL8812AU's init tables use
+the second condition also. Make the parsing code check it.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/1bee6b74-6eab-44a3-9f40-794ca006c72d@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/main.h | 15 ++++++
+ drivers/net/wireless/realtek/rtw88/phy.c  | 62 ++++++++++++++++++++---
+ 2 files changed, 69 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -1835,6 +1835,20 @@ struct rtw_phy_cond {
+ 	#define BRANCH_ENDIF	3
+ };
+ 
++struct rtw_phy_cond2 {
++#ifdef __LITTLE_ENDIAN
++	u8 type_glna;
++	u8 type_gpa;
++	u8 type_alna;
++	u8 type_apa;
++#else
++	u8 type_apa;
++	u8 type_alna;
++	u8 type_gpa;
++	u8 type_glna;
++#endif
++};
++
+ struct rtw_fifo_conf {
+ 	/* tx fifo information */
+ 	u16 rsvd_boundary;
+@@ -1916,6 +1930,7 @@ struct rtw_hal {
+ 	u8 oem_id;
+ 	u8 pkg_type;
+ 	struct rtw_phy_cond phy_cond;
++	struct rtw_phy_cond2 phy_cond2;
+ 	bool rfe_btg;
+ 
+ 	u8 ps_mode;
+--- a/drivers/net/wireless/realtek/rtw88/phy.c
++++ b/drivers/net/wireless/realtek/rtw88/phy.c
+@@ -18,7 +18,10 @@ struct phy_cfg_pair {
+ };
+ 
+ union phy_table_tile {
+-	struct rtw_phy_cond cond;
++	struct {
++		struct rtw_phy_cond cond;
++		struct rtw_phy_cond2 cond2;
++	} __packed;
+ 	struct phy_cfg_pair cfg;
+ };
+ 
+@@ -1041,7 +1044,8 @@ void rtw_phy_setup_phy_cond(struct rtw_d
+ {
+ 	struct rtw_hal *hal = &rtwdev->hal;
+ 	struct rtw_efuse *efuse = &rtwdev->efuse;
+-	struct rtw_phy_cond cond = {0};
++	struct rtw_phy_cond cond = {};
++	struct rtw_phy_cond2 cond2 = {};
+ 
+ 	cond.cut = hal->cut_version ? hal->cut_version : 15;
+ 	cond.pkg = pkg ? pkg : 15;
+@@ -1061,15 +1065,34 @@ void rtw_phy_setup_phy_cond(struct rtw_d
+ 		break;
+ 	}
+ 
++	if (rtwdev->chip->id == RTW_CHIP_TYPE_8812A ||
++	    rtwdev->chip->id == RTW_CHIP_TYPE_8821A) {
++		cond.rfe = 0;
++		cond.rfe |= efuse->ext_lna_2g;
++		cond.rfe |= efuse->ext_pa_2g  << 1;
++		cond.rfe |= efuse->ext_lna_5g << 2;
++		cond.rfe |= efuse->ext_pa_5g  << 3;
++		cond.rfe |= efuse->btcoex     << 4;
++
++		cond2.type_alna = efuse->alna_type;
++		cond2.type_glna = efuse->glna_type;
++		cond2.type_apa = efuse->apa_type;
++		cond2.type_gpa = efuse->gpa_type;
++	}
++
+ 	hal->phy_cond = cond;
++	hal->phy_cond2 = cond2;
+ 
+-	rtw_dbg(rtwdev, RTW_DBG_PHY, "phy cond=0x%08x\n", *((u32 *)&hal->phy_cond));
++	rtw_dbg(rtwdev, RTW_DBG_PHY, "phy cond=0x%08x cond2=0x%08x\n",
++		*((u32 *)&hal->phy_cond), *((u32 *)&hal->phy_cond2));
+ }
+ 
+-static bool check_positive(struct rtw_dev *rtwdev, struct rtw_phy_cond cond)
++static bool check_positive(struct rtw_dev *rtwdev, struct rtw_phy_cond cond,
++			   struct rtw_phy_cond2 cond2)
+ {
+ 	struct rtw_hal *hal = &rtwdev->hal;
+ 	struct rtw_phy_cond drv_cond = hal->phy_cond;
++	struct rtw_phy_cond2 drv_cond2 = hal->phy_cond2;
+ 
+ 	if (cond.cut && cond.cut != drv_cond.cut)
+ 		return false;
+@@ -1080,8 +1103,29 @@ static bool check_positive(struct rtw_de
+ 	if (cond.intf && cond.intf != drv_cond.intf)
+ 		return false;
+ 
+-	if (cond.rfe != drv_cond.rfe)
+-		return false;
++	if (rtwdev->chip->id == RTW_CHIP_TYPE_8812A ||
++	    rtwdev->chip->id == RTW_CHIP_TYPE_8821A) {
++		if (!(cond.rfe & 0x0f))
++			return true;
++
++		if ((cond.rfe & drv_cond.rfe) != cond.rfe)
++			return false;
++
++		if ((cond.rfe & BIT(0)) && cond2.type_glna != drv_cond2.type_glna)
++			return false;
++
++		if ((cond.rfe & BIT(1)) && cond2.type_gpa != drv_cond2.type_gpa)
++			return false;
++
++		if ((cond.rfe & BIT(2)) && cond2.type_alna != drv_cond2.type_alna)
++			return false;
++
++		if ((cond.rfe & BIT(3)) && cond2.type_apa != drv_cond2.type_apa)
++			return false;
++	} else {
++		if (cond.rfe != drv_cond.rfe)
++			return false;
++	}
+ 
+ 	return true;
+ }
+@@ -1090,7 +1134,8 @@ void rtw_parse_tbl_phy_cond(struct rtw_d
+ {
+ 	const union phy_table_tile *p = tbl->data;
+ 	const union phy_table_tile *end = p + tbl->size / 2;
+-	struct rtw_phy_cond pos_cond = {0};
++	struct rtw_phy_cond pos_cond = {};
++	struct rtw_phy_cond2 pos_cond2 = {};
+ 	bool is_matched = true, is_skipped = false;
+ 
+ 	BUILD_BUG_ON(sizeof(union phy_table_tile) != sizeof(struct phy_cfg_pair));
+@@ -1109,11 +1154,12 @@ void rtw_parse_tbl_phy_cond(struct rtw_d
+ 			case BRANCH_ELIF:
+ 			default:
+ 				pos_cond = p->cond;
++				pos_cond2 = p->cond2;
+ 				break;
+ 			}
+ 		} else if (p->cond.neg) {
+ 			if (!is_skipped) {
+-				if (check_positive(rtwdev, pos_cond)) {
++				if (check_positive(rtwdev, pos_cond, pos_cond2)) {
+ 					is_matched = true;
+ 					is_skipped = true;
+ 				} else {
diff --git a/package/kernel/mac80211/patches/rtl/028-v6.13-wifi-rtw88-Allow-rtw_chip_info.ltecoex_addr-to-be-NU.patch b/package/kernel/mac80211/patches/rtl/028-v6.13-wifi-rtw88-Allow-rtw_chip_info.ltecoex_addr-to-be-NU.patch
new file mode 100644
index 00000000000000..5486fb2d25e099
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/028-v6.13-wifi-rtw88-Allow-rtw_chip_info.ltecoex_addr-to-be-NU.patch
@@ -0,0 +1,58 @@
+From 7c5bbeba7c36575a3a57ef4be775b2f3fb68c3f9 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 23 Oct 2024 17:09:04 +0300
+Subject: [PATCH] wifi: rtw88: Allow rtw_chip_info.ltecoex_addr to be NULL
+
+RTL8821A doesn't have this. Trying to use it results in error messages,
+so don't try if ltecoex_addr is NULL.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/d1004817-1760-41d1-9136-3d799757c444@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/coex.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/coex.c
++++ b/drivers/net/wireless/realtek/rtw88/coex.c
+@@ -950,12 +950,18 @@ static void rtw_coex_coex_ctrl_owner(str
+ 
+ static void rtw_coex_set_gnt_bt(struct rtw_dev *rtwdev, u8 state)
+ {
++	if (!rtwdev->chip->ltecoex_addr)
++		return;
++
+ 	rtw_coex_write_indirect_reg(rtwdev, LTE_COEX_CTRL, 0xc000, state);
+ 	rtw_coex_write_indirect_reg(rtwdev, LTE_COEX_CTRL, 0x0c00, state);
+ }
+ 
+ static void rtw_coex_set_gnt_wl(struct rtw_dev *rtwdev, u8 state)
+ {
++	if (!rtwdev->chip->ltecoex_addr)
++		return;
++
+ 	rtw_coex_write_indirect_reg(rtwdev, LTE_COEX_CTRL, 0x3000, state);
+ 	rtw_coex_write_indirect_reg(rtwdev, LTE_COEX_CTRL, 0x0300, state);
+ }
+@@ -3904,7 +3910,7 @@ void rtw_coex_display_coex_info(struct r
+ 	u8 sys_lte;
+ 	u16 score_board_WB, score_board_BW;
+ 	u32 wl_reg_6c0, wl_reg_6c4, wl_reg_6c8, wl_reg_778, wl_reg_6cc;
+-	u32 lte_coex, bt_coex;
++	u32 lte_coex = 0, bt_coex = 0;
+ 	int i;
+ 
+ 	score_board_BW = rtw_coex_read_scbd(rtwdev);
+@@ -3916,8 +3922,10 @@ void rtw_coex_display_coex_info(struct r
+ 	wl_reg_778 = rtw_read8(rtwdev, REG_BT_STAT_CTRL);
+ 
+ 	sys_lte = rtw_read8(rtwdev, 0x73);
+-	lte_coex = rtw_coex_read_indirect_reg(rtwdev, 0x38);
+-	bt_coex = rtw_coex_read_indirect_reg(rtwdev, 0x54);
++	if (rtwdev->chip->ltecoex_addr) {
++		lte_coex = rtw_coex_read_indirect_reg(rtwdev, 0x38);
++		bt_coex = rtw_coex_read_indirect_reg(rtwdev, 0x54);
++	}
+ 
+ 	if (!coex_stat->wl_under_ips &&
+ 	    (!coex_stat->wl_under_lps || coex_stat->wl_force_lps_ctrl) &&
diff --git a/package/kernel/mac80211/patches/rtl/029-v6.13-wifi-rtw88-Let-each-driver-control-the-power-on-off-.patch b/package/kernel/mac80211/patches/rtl/029-v6.13-wifi-rtw88-Let-each-driver-control-the-power-on-off-.patch
new file mode 100644
index 00000000000000..5e9aee9bde400f
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/029-v6.13-wifi-rtw88-Let-each-driver-control-the-power-on-off-.patch
@@ -0,0 +1,274 @@
+From fbb5e1b3637a720c83c91a7b1476ab0429bfc747 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 23 Oct 2024 17:09:47 +0300
+Subject: [PATCH] wifi: rtw88: Let each driver control the power on/off process
+
+RTL8821AU and RTL8812AU have to do some things differently, so let
+them have full control.
+
+The other chips use the same functions as before.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/98ab839f-9100-44ae-9551-9af743a4aa3a@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/coex.c     |  3 +++
+ drivers/net/wireless/realtek/rtw88/mac.c      | 11 +++++++----
+ drivers/net/wireless/realtek/rtw88/mac.h      |  3 +++
+ drivers/net/wireless/realtek/rtw88/main.c     | 13 ++++++++-----
+ drivers/net/wireless/realtek/rtw88/main.h     |  5 +++++
+ drivers/net/wireless/realtek/rtw88/rtw8703b.c |  2 ++
+ drivers/net/wireless/realtek/rtw88/rtw8723d.c |  2 ++
+ drivers/net/wireless/realtek/rtw88/rtw8821c.c |  2 ++
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c |  2 ++
+ drivers/net/wireless/realtek/rtw88/rtw8822c.c |  2 ++
+ 10 files changed, 36 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/coex.c
++++ b/drivers/net/wireless/realtek/rtw88/coex.c
+@@ -2753,16 +2753,19 @@ void rtw_coex_power_on_setting(struct rt
+ 	rtw_write8(rtwdev, 0xff1a, 0x0);
+ 	rtw_coex_set_gnt_debug(rtwdev);
+ }
++EXPORT_SYMBOL(rtw_coex_power_on_setting);
+ 
+ void rtw_coex_power_off_setting(struct rtw_dev *rtwdev)
+ {
+ 	rtw_write16(rtwdev, REG_WIFI_BT_INFO, BIT_BT_INT_EN);
+ }
++EXPORT_SYMBOL(rtw_coex_power_off_setting);
+ 
+ void rtw_coex_init_hw_config(struct rtw_dev *rtwdev, bool wifi_only)
+ {
+ 	__rtw_coex_init_hw_config(rtwdev, wifi_only);
+ }
++EXPORT_SYMBOL(rtw_coex_init_hw_config);
+ 
+ void rtw_coex_ips_notify(struct rtw_dev *rtwdev, u8 type)
+ {
+--- a/drivers/net/wireless/realtek/rtw88/mac.c
++++ b/drivers/net/wireless/realtek/rtw88/mac.c
+@@ -227,8 +227,8 @@ static int rtw_sub_pwr_seq_parser(struct
+ 	return 0;
+ }
+ 
+-static int rtw_pwr_seq_parser(struct rtw_dev *rtwdev,
+-			      const struct rtw_pwr_seq_cmd * const *cmd_seq)
++int rtw_pwr_seq_parser(struct rtw_dev *rtwdev,
++		       const struct rtw_pwr_seq_cmd * const *cmd_seq)
+ {
+ 	u8 cut_mask;
+ 	u8 intf_mask;
+@@ -267,6 +267,7 @@ static int rtw_pwr_seq_parser(struct rtw
+ 
+ 	return 0;
+ }
++EXPORT_SYMBOL(rtw_pwr_seq_parser);
+ 
+ static int rtw_mac_power_switch(struct rtw_dev *rtwdev, bool pwr_on)
+ {
+@@ -999,6 +1000,7 @@ int rtw_download_firmware(struct rtw_dev
+ 
+ 	return 0;
+ }
++EXPORT_SYMBOL(rtw_download_firmware);
+ 
+ static u32 get_priority_queues(struct rtw_dev *rtwdev, u32 queues)
+ {
+@@ -1132,7 +1134,7 @@ static int txdma_queue_mapping(struct rt
+ 	return 0;
+ }
+ 
+-static int set_trx_fifo_info(struct rtw_dev *rtwdev)
++int rtw_set_trx_fifo_info(struct rtw_dev *rtwdev)
+ {
+ 	const struct rtw_chip_info *chip = rtwdev->chip;
+ 	struct rtw_fifo_conf *fifo = &rtwdev->fifo;
+@@ -1184,6 +1186,7 @@ static int set_trx_fifo_info(struct rtw_
+ 
+ 	return 0;
+ }
++EXPORT_SYMBOL(rtw_set_trx_fifo_info);
+ 
+ static int __priority_queue_cfg(struct rtw_dev *rtwdev,
+ 				const struct rtw_page_table *pg_tbl,
+@@ -1261,7 +1264,7 @@ static int priority_queue_cfg(struct rtw
+ 	u16 pubq_num;
+ 	int ret;
+ 
+-	ret = set_trx_fifo_info(rtwdev);
++	ret = rtw_set_trx_fifo_info(rtwdev);
+ 	if (ret)
+ 		return ret;
+ 
+--- a/drivers/net/wireless/realtek/rtw88/mac.h
++++ b/drivers/net/wireless/realtek/rtw88/mac.h
+@@ -30,6 +30,8 @@
+ 
+ void rtw_set_channel_mac(struct rtw_dev *rtwdev, u8 channel, u8 bw,
+ 			 u8 primary_ch_idx);
++int rtw_pwr_seq_parser(struct rtw_dev *rtwdev,
++		       const struct rtw_pwr_seq_cmd * const *cmd_seq);
+ int rtw_mac_power_on(struct rtw_dev *rtwdev);
+ void rtw_mac_power_off(struct rtw_dev *rtwdev);
+ void rtw_write_firmware_page(struct rtw_dev *rtwdev, u32 page,
+@@ -37,6 +39,7 @@ void rtw_write_firmware_page(struct rtw_
+ int rtw_download_firmware(struct rtw_dev *rtwdev, struct rtw_fw_state *fw);
+ int rtw_mac_init(struct rtw_dev *rtwdev);
+ void rtw_mac_flush_queues(struct rtw_dev *rtwdev, u32 queues, bool drop);
++int rtw_set_trx_fifo_info(struct rtw_dev *rtwdev);
+ int rtw_ddma_to_fw_fifo(struct rtw_dev *rtwdev, u32 ocp_src, u32 size);
+ 
+ static inline void rtw_mac_flush_all_queues(struct rtw_dev *rtwdev, bool drop)
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -1309,7 +1309,7 @@ void rtw_update_sta_info(struct rtw_dev
+ 	rtw_fw_send_ra_info(rtwdev, si, reset_ra_mask);
+ }
+ 
+-static int rtw_wait_firmware_completion(struct rtw_dev *rtwdev)
++int rtw_wait_firmware_completion(struct rtw_dev *rtwdev)
+ {
+ 	const struct rtw_chip_info *chip = rtwdev->chip;
+ 	struct rtw_fw_state *fw;
+@@ -1329,6 +1329,7 @@ static int rtw_wait_firmware_completion(
+ 
+ 	return ret;
+ }
++EXPORT_SYMBOL(rtw_wait_firmware_completion);
+ 
+ static enum rtw_lps_deep_mode rtw_update_lps_deep_mode(struct rtw_dev *rtwdev,
+ 						       struct rtw_fw_state *fw)
+@@ -1350,7 +1351,7 @@ static enum rtw_lps_deep_mode rtw_update
+ 	return LPS_DEEP_MODE_NONE;
+ }
+ 
+-static int rtw_power_on(struct rtw_dev *rtwdev)
++int rtw_power_on(struct rtw_dev *rtwdev)
+ {
+ 	const struct rtw_chip_info *chip = rtwdev->chip;
+ 	struct rtw_fw_state *fw = &rtwdev->fw;
+@@ -1413,6 +1414,7 @@ err_off:
+ err:
+ 	return ret;
+ }
++EXPORT_SYMBOL(rtw_power_on);
+ 
+ void rtw_core_fw_scan_notify(struct rtw_dev *rtwdev, bool start)
+ {
+@@ -1485,7 +1487,7 @@ int rtw_core_start(struct rtw_dev *rtwde
+ {
+ 	int ret;
+ 
+-	ret = rtw_power_on(rtwdev);
++	ret = rtwdev->chip->ops->power_on(rtwdev);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -1505,12 +1507,13 @@ int rtw_core_start(struct rtw_dev *rtwde
+ 	return 0;
+ }
+ 
+-static void rtw_power_off(struct rtw_dev *rtwdev)
++void rtw_power_off(struct rtw_dev *rtwdev)
+ {
+ 	rtw_hci_stop(rtwdev);
+ 	rtw_coex_power_off_setting(rtwdev);
+ 	rtw_mac_power_off(rtwdev);
+ }
++EXPORT_SYMBOL(rtw_power_off);
+ 
+ void rtw_core_stop(struct rtw_dev *rtwdev)
+ {
+@@ -1535,7 +1538,7 @@ void rtw_core_stop(struct rtw_dev *rtwde
+ 
+ 	mutex_lock(&rtwdev->mutex);
+ 
+-	rtw_power_off(rtwdev);
++	rtwdev->chip->ops->power_off(rtwdev);
+ }
+ 
+ static void rtw_init_ht_cap(struct rtw_dev *rtwdev,
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -843,6 +843,8 @@ struct rtw_regd {
+ };
+ 
+ struct rtw_chip_ops {
++	int (*power_on)(struct rtw_dev *rtwdev);
++	void (*power_off)(struct rtw_dev *rtwdev);
+ 	int (*mac_init)(struct rtw_dev *rtwdev);
+ 	int (*dump_fw_crash)(struct rtw_dev *rtwdev);
+ 	void (*shutdown)(struct rtw_dev *rtwdev);
+@@ -2209,6 +2211,7 @@ void rtw_core_scan_start(struct rtw_dev
+ void rtw_core_scan_complete(struct rtw_dev *rtwdev, struct ieee80211_vif *vif,
+ 			    bool hw_scan);
+ int rtw_core_start(struct rtw_dev *rtwdev);
++void rtw_power_off(struct rtw_dev *rtwdev);
+ void rtw_core_stop(struct rtw_dev *rtwdev);
+ int rtw_chip_info_setup(struct rtw_dev *rtwdev);
+ int rtw_core_init(struct rtw_dev *rtwdev);
+@@ -2223,6 +2226,8 @@ int rtw_sta_add(struct rtw_dev *rtwdev,
+ void rtw_sta_remove(struct rtw_dev *rtwdev, struct ieee80211_sta *sta,
+ 		    bool fw_exist);
+ void rtw_fw_recovery(struct rtw_dev *rtwdev);
++int rtw_wait_firmware_completion(struct rtw_dev *rtwdev);
++int rtw_power_on(struct rtw_dev *rtwdev);
+ void rtw_core_fw_scan_notify(struct rtw_dev *rtwdev, bool start);
+ int rtw_dump_fw(struct rtw_dev *rtwdev, const u32 ocp_src, u32 size,
+ 		u32 fwcd_item);
+--- a/drivers/net/wireless/realtek/rtw88/rtw8703b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8703b.c
+@@ -1888,6 +1888,8 @@ static const struct coex_tdma_para tdma_
+ };
+ 
+ static const struct rtw_chip_ops rtw8703b_ops = {
++	.power_on		= rtw_power_on,
++	.power_off		= rtw_power_off,
+ 	.mac_init		= rtw8723x_mac_init,
+ 	.dump_fw_crash		= NULL,
+ 	.shutdown		= NULL,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8723d.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8723d.c
+@@ -1390,6 +1390,8 @@ static void rtw8723d_pwr_track(struct rt
+ }
+ 
+ static const struct rtw_chip_ops rtw8723d_ops = {
++	.power_on		= rtw_power_on,
++	.power_off		= rtw_power_off,
+ 	.phy_set_param		= rtw8723d_phy_set_param,
+ 	.read_efuse		= rtw8723x_read_efuse,
+ 	.query_phy_status	= query_phy_status,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+@@ -1643,6 +1643,8 @@ static const struct rtw_prioq_addrs prio
+ };
+ 
+ static const struct rtw_chip_ops rtw8821c_ops = {
++	.power_on		= rtw_power_on,
++	.power_off		= rtw_power_off,
+ 	.phy_set_param		= rtw8821c_phy_set_param,
+ 	.read_efuse		= rtw8821c_read_efuse,
+ 	.query_phy_status	= query_phy_status,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -2134,6 +2134,8 @@ static const struct rtw_prioq_addrs prio
+ };
+ 
+ static const struct rtw_chip_ops rtw8822b_ops = {
++	.power_on		= rtw_power_on,
++	.power_off		= rtw_power_off,
+ 	.phy_set_param		= rtw8822b_phy_set_param,
+ 	.read_efuse		= rtw8822b_read_efuse,
+ 	.query_phy_status	= query_phy_status,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
+@@ -4948,6 +4948,8 @@ static const struct rtw_prioq_addrs prio
+ };
+ 
+ static const struct rtw_chip_ops rtw8822c_ops = {
++	.power_on		= rtw_power_on,
++	.power_off		= rtw_power_off,
+ 	.phy_set_param		= rtw8822c_phy_set_param,
+ 	.read_efuse		= rtw8822c_read_efuse,
+ 	.query_phy_status	= query_phy_status,
diff --git a/package/kernel/mac80211/patches/rtl/030-v6.13-wifi-rtw88-Enable-data-rate-fallback-for-older-chips.patch b/package/kernel/mac80211/patches/rtl/030-v6.13-wifi-rtw88-Enable-data-rate-fallback-for-older-chips.patch
new file mode 100644
index 00000000000000..9c3bf29321142a
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/030-v6.13-wifi-rtw88-Enable-data-rate-fallback-for-older-chips.patch
@@ -0,0 +1,194 @@
+From c7706b1173c77185a2ef40c7d1811021566563f3 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 23 Oct 2024 17:10:32 +0300
+Subject: [PATCH] wifi: rtw88: Enable data rate fallback for older chips
+
+RTL8811AU fails to perform the 4-way handshake when the AP is too far
+because it transmits the EAPOL frames at MCS9 and when that doesn't
+work it retries 48 times with the same rate, to no avail.
+
+Retrying 48 times with the same rate seems pointless. Set the
+appropriate field in the TX descriptor to allow it to use lower rates
+when retrying.
+
+Set it for RTL8723D and RTL8703B because they interpret this field the
+same way as RTL8811A.
+
+The newer RTL8822C, RTL8822B, RTL8821C seem to interpret this field in
+the TX descriptor differently, so leave it alone for those chips.
+
+Tested with RTL8811AU and RTL8723DU.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/2b3e3e6f-541b-4a3b-8ca3-65b267e6a95a@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/fw.c       | 2 +-
+ drivers/net/wireless/realtek/rtw88/main.h     | 1 +
+ drivers/net/wireless/realtek/rtw88/pci.c      | 2 +-
+ drivers/net/wireless/realtek/rtw88/rtw8703b.c | 1 +
+ drivers/net/wireless/realtek/rtw88/rtw8723d.c | 1 +
+ drivers/net/wireless/realtek/rtw88/rtw8821c.c | 1 +
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c | 1 +
+ drivers/net/wireless/realtek/rtw88/rtw8822c.c | 1 +
+ drivers/net/wireless/realtek/rtw88/sdio.c     | 2 +-
+ drivers/net/wireless/realtek/rtw88/tx.c       | 6 +++++-
+ drivers/net/wireless/realtek/rtw88/tx.h       | 4 +++-
+ drivers/net/wireless/realtek/rtw88/usb.c      | 4 ++--
+ 12 files changed, 19 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/fw.c
++++ b/drivers/net/wireless/realtek/rtw88/fw.c
+@@ -1290,7 +1290,7 @@ static void rtw_fill_rsvd_page_desc(stru
+ 	rtw_tx_rsvd_page_pkt_info_update(rtwdev, &pkt_info, skb, type);
+ 	pkt_desc = skb_push(skb, chip->tx_pkt_desc_sz);
+ 	memset(pkt_desc, 0, chip->tx_pkt_desc_sz);
+-	rtw_tx_fill_tx_desc(&pkt_info, skb);
++	rtw_tx_fill_tx_desc(rtwdev, &pkt_info, skb);
+ }
+ 
+ static inline u8 rtw_len_to_page(unsigned int len, u8 page_size)
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -1204,6 +1204,7 @@ struct rtw_chip_info {
+ 	u8 usb_tx_agg_desc_num;
+ 	bool hw_feature_report;
+ 	u8 c2h_ra_report_size;
++	bool old_datarate_fb_limit;
+ 
+ 	u8 default_1ss_tx_path;
+ 
+--- a/drivers/net/wireless/realtek/rtw88/pci.c
++++ b/drivers/net/wireless/realtek/rtw88/pci.c
+@@ -825,7 +825,7 @@ static int rtw_pci_tx_write_data(struct
+ 	pkt_desc = skb_push(skb, chip->tx_pkt_desc_sz);
+ 	memset(pkt_desc, 0, tx_pkt_desc_sz);
+ 	pkt_info->qsel = rtw_pci_get_tx_qsel(skb, queue);
+-	rtw_tx_fill_tx_desc(pkt_info, skb);
++	rtw_tx_fill_tx_desc(rtwdev, pkt_info, skb);
+ 	dma = dma_map_single(&rtwpci->pdev->dev, skb->data, skb->len,
+ 			     DMA_TO_DEVICE);
+ 	if (dma_mapping_error(&rtwpci->pdev->dev, dma))
+--- a/drivers/net/wireless/realtek/rtw88/rtw8703b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8703b.c
+@@ -1964,6 +1964,7 @@ const struct rtw_chip_info rtw8703b_hw_s
+ 	.usb_tx_agg_desc_num = 1, /* Not sure if this chip has USB interface */
+ 	.hw_feature_report = true,
+ 	.c2h_ra_report_size = 7,
++	.old_datarate_fb_limit = true,
+ 
+ 	.path_div_supported = false,
+ 	.ht_supported = true,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8723d.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8723d.c
+@@ -2135,6 +2135,7 @@ const struct rtw_chip_info rtw8723d_hw_s
+ 	.usb_tx_agg_desc_num = 1,
+ 	.hw_feature_report = true,
+ 	.c2h_ra_report_size = 7,
++	.old_datarate_fb_limit = true,
+ 	.ht_supported = true,
+ 	.vht_supported = false,
+ 	.lps_deep_mode_supported = 0,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+@@ -1972,6 +1972,7 @@ const struct rtw_chip_info rtw8821c_hw_s
+ 	.usb_tx_agg_desc_num = 3,
+ 	.hw_feature_report = true,
+ 	.c2h_ra_report_size = 7,
++	.old_datarate_fb_limit = false,
+ 	.ht_supported = true,
+ 	.vht_supported = true,
+ 	.lps_deep_mode_supported = BIT(LPS_DEEP_MODE_LCLK),
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -2515,6 +2515,7 @@ const struct rtw_chip_info rtw8822b_hw_s
+ 	.usb_tx_agg_desc_num = 3,
+ 	.hw_feature_report = true,
+ 	.c2h_ra_report_size = 7,
++	.old_datarate_fb_limit = false,
+ 	.ht_supported = true,
+ 	.vht_supported = true,
+ 	.lps_deep_mode_supported = BIT(LPS_DEEP_MODE_LCLK),
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
+@@ -5334,6 +5334,7 @@ const struct rtw_chip_info rtw8822c_hw_s
+ 	.usb_tx_agg_desc_num = 3,
+ 	.hw_feature_report = true,
+ 	.c2h_ra_report_size = 7,
++	.old_datarate_fb_limit = false,
+ 	.default_1ss_tx_path = BB_PATH_A,
+ 	.path_div_supported = true,
+ 	.ht_supported = true,
+--- a/drivers/net/wireless/realtek/rtw88/sdio.c
++++ b/drivers/net/wireless/realtek/rtw88/sdio.c
+@@ -862,7 +862,7 @@ static void rtw_sdio_tx_skb_prepare(stru
+ 
+ 	pkt_info->qsel = rtw_sdio_get_tx_qsel(rtwdev, skb, queue);
+ 
+-	rtw_tx_fill_tx_desc(pkt_info, skb);
++	rtw_tx_fill_tx_desc(rtwdev, pkt_info, skb);
+ 	rtw_tx_fill_txdesc_checksum(rtwdev, pkt_info, pkt_desc);
+ }
+ 
+--- a/drivers/net/wireless/realtek/rtw88/tx.c
++++ b/drivers/net/wireless/realtek/rtw88/tx.c
+@@ -32,7 +32,8 @@ void rtw_tx_stats(struct rtw_dev *rtwdev
+ 	}
+ }
+ 
+-void rtw_tx_fill_tx_desc(struct rtw_tx_pkt_info *pkt_info, struct sk_buff *skb)
++void rtw_tx_fill_tx_desc(struct rtw_dev *rtwdev,
++			 struct rtw_tx_pkt_info *pkt_info, struct sk_buff *skb)
+ {
+ 	struct rtw_tx_desc *tx_desc = (struct rtw_tx_desc *)skb->data;
+ 	bool more_data = false;
+@@ -67,6 +68,9 @@ void rtw_tx_fill_tx_desc(struct rtw_tx_p
+ 
+ 	tx_desc->w4 = le32_encode_bits(pkt_info->rate, RTW_TX_DESC_W4_DATARATE);
+ 
++	if (rtwdev->chip->old_datarate_fb_limit)
++		tx_desc->w4 |= le32_encode_bits(0x1f, RTW_TX_DESC_W4_DATARATE_FB_LIMIT);
++
+ 	tx_desc->w5 = le32_encode_bits(pkt_info->short_gi, RTW_TX_DESC_W5_DATA_SHORT) |
+ 		      le32_encode_bits(pkt_info->bw, RTW_TX_DESC_W5_DATA_BW) |
+ 		      le32_encode_bits(pkt_info->ldpc, RTW_TX_DESC_W5_DATA_LDPC) |
+--- a/drivers/net/wireless/realtek/rtw88/tx.h
++++ b/drivers/net/wireless/realtek/rtw88/tx.h
+@@ -44,6 +44,7 @@ struct rtw_tx_desc {
+ #define RTW_TX_DESC_W3_NAVUSEHDR BIT(15)
+ #define RTW_TX_DESC_W3_MAX_AGG_NUM GENMASK(21, 17)
+ #define RTW_TX_DESC_W4_DATARATE GENMASK(6, 0)
++#define RTW_TX_DESC_W4_DATARATE_FB_LIMIT GENMASK(12, 8)
+ #define RTW_TX_DESC_W4_RTSRATE GENMASK(28, 24)
+ #define RTW_TX_DESC_W5_DATA_SHORT BIT(4)
+ #define RTW_TX_DESC_W5_DATA_BW GENMASK(6, 5)
+@@ -94,7 +95,8 @@ void rtw_tx_pkt_info_update(struct rtw_d
+ 			    struct rtw_tx_pkt_info *pkt_info,
+ 			    struct ieee80211_sta *sta,
+ 			    struct sk_buff *skb);
+-void rtw_tx_fill_tx_desc(struct rtw_tx_pkt_info *pkt_info, struct sk_buff *skb);
++void rtw_tx_fill_tx_desc(struct rtw_dev *rtwdev,
++			 struct rtw_tx_pkt_info *pkt_info, struct sk_buff *skb);
+ void rtw_tx_report_enqueue(struct rtw_dev *rtwdev, struct sk_buff *skb, u8 sn);
+ void rtw_tx_report_handle(struct rtw_dev *rtwdev, struct sk_buff *skb, int src);
+ void rtw_tx_rsvd_page_pkt_info_update(struct rtw_dev *rtwdev,
+--- a/drivers/net/wireless/realtek/rtw88/usb.c
++++ b/drivers/net/wireless/realtek/rtw88/usb.c
+@@ -512,7 +512,7 @@ static int rtw_usb_write_data(struct rtw
+ 	skb_put_data(skb, buf, size);
+ 	skb_push(skb, chip->tx_pkt_desc_sz);
+ 	memset(skb->data, 0, chip->tx_pkt_desc_sz);
+-	rtw_tx_fill_tx_desc(pkt_info, skb);
++	rtw_tx_fill_tx_desc(rtwdev, pkt_info, skb);
+ 	rtw_tx_fill_txdesc_checksum(rtwdev, pkt_info, skb->data);
+ 
+ 	ret = rtw_usb_write_port(rtwdev, qsel, skb,
+@@ -579,7 +579,7 @@ static int rtw_usb_tx_write(struct rtw_d
+ 	pkt_desc = skb_push(skb, chip->tx_pkt_desc_sz);
+ 	memset(pkt_desc, 0, chip->tx_pkt_desc_sz);
+ 	ep = qsel_to_ep(rtwusb, pkt_info->qsel);
+-	rtw_tx_fill_tx_desc(pkt_info, skb);
++	rtw_tx_fill_tx_desc(rtwdev, pkt_info, skb);
+ 	rtw_tx_fill_txdesc_checksum(rtwdev, pkt_info, skb->data);
+ 	tx_data = rtw_usb_get_tx_data(skb);
+ 	tx_data->sn = pkt_info->sn;
diff --git a/package/kernel/mac80211/patches/rtl/031-v6.13-wifi-rtw88-Make-txagc_remnant_ofdm-an-array.patch b/package/kernel/mac80211/patches/rtl/031-v6.13-wifi-rtw88-Make-txagc_remnant_ofdm-an-array.patch
new file mode 100644
index 00000000000000..10fc773b47fe5c
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/031-v6.13-wifi-rtw88-Make-txagc_remnant_ofdm-an-array.patch
@@ -0,0 +1,85 @@
+From abb0f19492ba6289ffba6ec1057c0426240958af Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 23 Oct 2024 17:10:54 +0300
+Subject: [PATCH] wifi: rtw88: Make txagc_remnant_ofdm an array
+
+txagc_remnant_ofdm member of struct rtw_dm_info should be different for
+each RF path, so make it an array of size RTW_RF_PATH_MAX (4).
+
+Until now all the chips using this had only one RF path, but RTL8812AU
+has two, and RTL8814AU has four.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/68571ba9-e504-4b2d-bfa1-62f468753649@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/main.h     | 2 +-
+ drivers/net/wireless/realtek/rtw88/phy.c      | 4 ++--
+ drivers/net/wireless/realtek/rtw88/rtw8703b.c | 4 ++--
+ drivers/net/wireless/realtek/rtw88/rtw8723d.c | 4 ++--
+ 4 files changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -1715,7 +1715,7 @@ struct rtw_dm_info {
+ 	bool pwr_trk_init_trigger;
+ 	struct ewma_thermal avg_thermal[RTW_RF_PATH_MAX];
+ 	s8 txagc_remnant_cck;
+-	s8 txagc_remnant_ofdm;
++	s8 txagc_remnant_ofdm[RTW_RF_PATH_MAX];
+ 	u8 rx_cck_agc_report_type;
+ 
+ 	/* backup dack results for each path and I/Q */
+--- a/drivers/net/wireless/realtek/rtw88/phy.c
++++ b/drivers/net/wireless/realtek/rtw88/phy.c
+@@ -2169,8 +2169,8 @@ void rtw_get_tx_power_params(struct rtw_
+ 
+ 	*limit = rtw_phy_get_tx_power_limit(rtwdev, band, bw, path,
+ 					    rate, ch, regd);
+-	*remnant = (rate <= DESC_RATE11M ? dm_info->txagc_remnant_cck :
+-		    dm_info->txagc_remnant_ofdm);
++	*remnant = rate <= DESC_RATE11M ? dm_info->txagc_remnant_cck :
++					  dm_info->txagc_remnant_ofdm[path];
+ 	*sar = rtw_phy_get_tx_power_sar(rtwdev, hal->sar_band, path, rate);
+ }
+ 
+--- a/drivers/net/wireless/realtek/rtw88/rtw8703b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8703b.c
+@@ -637,7 +637,7 @@ static void rtw8703b_pwrtrack_init(struc
+ 	dm_info->pwr_trk_init_trigger = true;
+ 	dm_info->thermal_meter_k = rtwdev->efuse.thermal_meter_k;
+ 	dm_info->txagc_remnant_cck = 0;
+-	dm_info->txagc_remnant_ofdm = 0;
++	dm_info->txagc_remnant_ofdm[RF_PATH_A] = 0;
+ }
+ 
+ static void rtw8703b_phy_set_param(struct rtw_dev *rtwdev)
+@@ -1589,7 +1589,7 @@ static void rtw8703b_pwrtrack_set_ofdm_p
+ {
+ 	struct rtw_dm_info *dm_info = &rtwdev->dm_info;
+ 
+-	dm_info->txagc_remnant_ofdm = txagc_idx;
++	dm_info->txagc_remnant_ofdm[RF_PATH_A] = txagc_idx;
+ 
+ 	/* Only path A is calibrated for rtl8703b */
+ 	rtw8703b_set_iqk_matrix(rtwdev, swing_idx, RF_PATH_A);
+--- a/drivers/net/wireless/realtek/rtw88/rtw8723d.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8723d.c
+@@ -79,7 +79,7 @@ static void rtw8723d_pwrtrack_init(struc
+ 	dm_info->pwr_trk_init_trigger = true;
+ 	dm_info->thermal_meter_k = rtwdev->efuse.thermal_meter_k;
+ 	dm_info->txagc_remnant_cck = 0;
+-	dm_info->txagc_remnant_ofdm = 0;
++	dm_info->txagc_remnant_ofdm[RF_PATH_A] = 0;
+ }
+ 
+ static void rtw8723d_phy_set_param(struct rtw_dev *rtwdev)
+@@ -1265,7 +1265,7 @@ static void rtw8723d_pwrtrack_set_ofdm_p
+ {
+ 	struct rtw_dm_info *dm_info = &rtwdev->dm_info;
+ 
+-	dm_info->txagc_remnant_ofdm = txagc_idx;
++	dm_info->txagc_remnant_ofdm[RF_PATH_A] = txagc_idx;
+ 
+ 	rtw8723d_set_iqk_matrix(rtwdev, swing_idx, RF_PATH_A);
+ 	rtw8723d_set_iqk_matrix(rtwdev, swing_idx, RF_PATH_B);
diff --git a/package/kernel/mac80211/patches/rtl/032-v6.13-wifi-rtw88-Support-TX-page-sizes-bigger-than-128.patch b/package/kernel/mac80211/patches/rtl/032-v6.13-wifi-rtw88-Support-TX-page-sizes-bigger-than-128.patch
new file mode 100644
index 00000000000000..c2c57cac9ffb76
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/032-v6.13-wifi-rtw88-Support-TX-page-sizes-bigger-than-128.patch
@@ -0,0 +1,115 @@
+From 82a617413e8545775ec03a1970809ac5f549ef32 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 23 Oct 2024 17:12:06 +0300
+Subject: [PATCH] wifi: rtw88: Support TX page sizes bigger than 128
+
+All the chips supported so far have a TX page size of 128 bytes.
+
+Change the type of the page_size member of struct rtw_chip_info from u8
+to u16 in order to support RTL8821AU (page size of 256 bytes) and
+RTL8812AU (page size of 512 bytes). Also change the types of several
+related variables and function parameters from u8 to u16.
+
+The TX page size is used, among other things, to construct the beacon,
+null data, QOS null data, and PS poll templates which are uploaded to
+the chip's reserved page. Each template needs to be aligned on a
+multiple of the TX page size. Power saving can't work if the TX page
+size is wrong.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/acdefbb1-3daf-4349-9e03-9472754d5f1e@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/debug.c |  2 +-
+ drivers/net/wireless/realtek/rtw88/fw.c    | 21 +++++++++++----------
+ drivers/net/wireless/realtek/rtw88/mac.c   |  2 +-
+ drivers/net/wireless/realtek/rtw88/main.h  |  2 +-
+ 4 files changed, 14 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/debug.c
++++ b/drivers/net/wireless/realtek/rtw88/debug.c
+@@ -308,7 +308,7 @@ static int rtw_debugfs_get_rsvd_page(str
+ {
+ 	struct rtw_debugfs_priv *debugfs_priv = m->private;
+ 	struct rtw_dev *rtwdev = debugfs_priv->rtwdev;
+-	u8 page_size = rtwdev->chip->page_size;
++	u16 page_size = rtwdev->chip->page_size;
+ 	u32 buf_size = debugfs_priv->rsvd_page.page_num * page_size;
+ 	u32 offset = debugfs_priv->rsvd_page.page_offset * page_size;
+ 	u8 *buf;
+--- a/drivers/net/wireless/realtek/rtw88/fw.c
++++ b/drivers/net/wireless/realtek/rtw88/fw.c
+@@ -1293,13 +1293,13 @@ static void rtw_fill_rsvd_page_desc(stru
+ 	rtw_tx_fill_tx_desc(rtwdev, &pkt_info, skb);
+ }
+ 
+-static inline u8 rtw_len_to_page(unsigned int len, u8 page_size)
++static inline u8 rtw_len_to_page(unsigned int len, u16 page_size)
+ {
+ 	return DIV_ROUND_UP(len, page_size);
+ }
+ 
+-static void rtw_rsvd_page_list_to_buf(struct rtw_dev *rtwdev, u8 page_size,
+-				      u8 page_margin, u32 page, u8 *buf,
++static void rtw_rsvd_page_list_to_buf(struct rtw_dev *rtwdev, u16 page_size,
++				      u16 page_margin, u32 page, u8 *buf,
+ 				      struct rtw_rsvd_page *rsvd_pkt)
+ {
+ 	struct sk_buff *skb = rsvd_pkt->skb;
+@@ -1601,13 +1601,13 @@ static int  __rtw_build_rsvd_page_from_v
+ 
+ static u8 *rtw_build_rsvd_page(struct rtw_dev *rtwdev, u32 *size)
+ {
+-	struct ieee80211_hw *hw = rtwdev->hw;
+ 	const struct rtw_chip_info *chip = rtwdev->chip;
+-	struct sk_buff *iter;
++	struct ieee80211_hw *hw = rtwdev->hw;
+ 	struct rtw_rsvd_page *rsvd_pkt;
+-	u32 page = 0;
++	struct sk_buff *iter;
++	u16 page_size, page_margin, tx_desc_sz;
+ 	u8 total_page = 0;
+-	u8 page_size, page_margin, tx_desc_sz;
++	u32 page = 0;
+ 	u8 *buf;
+ 	int ret;
+ 
+@@ -2013,12 +2013,13 @@ static int _rtw_hw_scan_update_probe_req
+ {
+ 	const struct rtw_chip_info *chip = rtwdev->chip;
+ 	struct sk_buff *skb, *tmp;
+-	u8 page_offset = 1, *buf, page_size = chip->page_size;
+ 	u16 pg_addr = rtwdev->fifo.rsvd_h2c_info_addr, loc;
+-	u16 buf_offset = page_size * page_offset;
+ 	u8 tx_desc_sz = chip->tx_pkt_desc_sz;
+-	u8 page_cnt, pages;
++	u16 page_size = chip->page_size;
++	u8 page_offset = 1, *buf;
++	u16 buf_offset = page_size * page_offset;
+ 	unsigned int pkt_len;
++	u8 page_cnt, pages;
+ 	int ret;
+ 
+ 	if (rtw_fw_feature_ext_check(&rtwdev->fw, FW_FEATURE_EXT_OLD_PAGE_NUM))
+--- a/drivers/net/wireless/realtek/rtw88/mac.c
++++ b/drivers/net/wireless/realtek/rtw88/mac.c
+@@ -1143,7 +1143,7 @@ int rtw_set_trx_fifo_info(struct rtw_dev
+ 
+ 	/* config rsvd page num */
+ 	fifo->rsvd_drv_pg_num = chip->rsvd_drv_pg_num;
+-	fifo->txff_pg_num = chip->txff_size >> 7;
++	fifo->txff_pg_num = chip->txff_size / chip->page_size;
+ 	if (rtw_chip_wcpu_11n(rtwdev))
+ 		fifo->rsvd_pg_num = fifo->rsvd_drv_pg_num;
+ 	else
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -1187,7 +1187,7 @@ struct rtw_chip_info {
+ 	u32 fw_rxff_size;
+ 	u16 rsvd_drv_pg_num;
+ 	u8 band;
+-	u8 page_size;
++	u16 page_size;
+ 	u8 csi_buf_pg_num;
+ 	u8 dig_max;
+ 	u8 dig_min;
diff --git a/package/kernel/mac80211/patches/rtl/033-v6.13-wifi-rtw88-Move-pwr_track_tbl-to-struct-rtw_rfe_def.patch b/package/kernel/mac80211/patches/rtl/033-v6.13-wifi-rtw88-Move-pwr_track_tbl-to-struct-rtw_rfe_def.patch
new file mode 100644
index 00000000000000..09bf846a6d60a0
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/033-v6.13-wifi-rtw88-Move-pwr_track_tbl-to-struct-rtw_rfe_def.patch
@@ -0,0 +1,297 @@
+From 67d915604e6993ff627ac001983a2de63ff71b13 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 23 Oct 2024 17:12:39 +0300
+Subject: [PATCH] wifi: rtw88: Move pwr_track_tbl to struct rtw_rfe_def
+
+RTL8812AU uses one set of TX power tracking tables for RFE 3, and
+another set for everything else.
+
+Move pwr_track_tbl from struct rtw_chip_info to struct rtw_rfe_def in
+order to load the right set of tables for each RFE (RF front end) type.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/904d0ab1-c046-40cd-a3a3-d4fdcf663c9d@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/main.h     |  8 ++++---
+ drivers/net/wireless/realtek/rtw88/phy.c      |  3 ++-
+ drivers/net/wireless/realtek/rtw88/rtw8703b.c | 12 +++++-----
+ drivers/net/wireless/realtek/rtw88/rtw8723d.c | 12 +++++-----
+ drivers/net/wireless/realtek/rtw88/rtw8723x.c |  3 ++-
+ drivers/net/wireless/realtek/rtw88/rtw8821c.c | 17 +++++++-------
+ drivers/net/wireless/realtek/rtw88/rtw8822b.c | 15 ++++++------
+ drivers/net/wireless/realtek/rtw88/rtw8822c.c | 23 +++++++++----------
+ 8 files changed, 47 insertions(+), 46 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -1099,17 +1099,20 @@ enum rtw_rfe_fem {
+ struct rtw_rfe_def {
+ 	const struct rtw_table *phy_pg_tbl;
+ 	const struct rtw_table *txpwr_lmt_tbl;
++	const struct rtw_pwr_track_tbl *pwr_track_tbl;
+ 	const struct rtw_table *agc_btg_tbl;
+ };
+ 
+-#define RTW_DEF_RFE(chip, bb_pg, pwrlmt) {				  \
++#define RTW_DEF_RFE(chip, bb_pg, pwrlmt, track) {				  \
+ 	.phy_pg_tbl = &rtw ## chip ## _bb_pg_type ## bb_pg ## _tbl,	  \
+ 	.txpwr_lmt_tbl = &rtw ## chip ## _txpwr_lmt_type ## pwrlmt ## _tbl, \
++	.pwr_track_tbl = &rtw ## chip ## _pwr_track_type ## track ## _tbl, \
+ 	}
+ 
+-#define RTW_DEF_RFE_EXT(chip, bb_pg, pwrlmt, btg) {			  \
++#define RTW_DEF_RFE_EXT(chip, bb_pg, pwrlmt, track, btg) {			  \
+ 	.phy_pg_tbl = &rtw ## chip ## _bb_pg_type ## bb_pg ## _tbl,	  \
+ 	.txpwr_lmt_tbl = &rtw ## chip ## _txpwr_lmt_type ## pwrlmt ## _tbl, \
++	.pwr_track_tbl = &rtw ## chip ## _pwr_track_type ## track ## _tbl, \
+ 	.agc_btg_tbl = &rtw ## chip ## _agc_btg_type ## btg ## _tbl, \
+ 	}
+ 
+@@ -1243,7 +1246,6 @@ struct rtw_chip_info {
+ 	u16 dpd_ratemask;
+ 	u8 iqk_threshold;
+ 	u8 lck_threshold;
+-	const struct rtw_pwr_track_tbl *pwr_track_tbl;
+ 
+ 	u8 bfer_su_max_num;
+ 	u8 bfer_mu_max_num;
+--- a/drivers/net/wireless/realtek/rtw88/phy.c
++++ b/drivers/net/wireless/realtek/rtw88/phy.c
+@@ -2384,7 +2384,8 @@ void rtw_phy_init_tx_power(struct rtw_de
+ void rtw_phy_config_swing_table(struct rtw_dev *rtwdev,
+ 				struct rtw_swing_table *swing_table)
+ {
+-	const struct rtw_pwr_track_tbl *tbl = rtwdev->chip->pwr_track_tbl;
++	const struct rtw_rfe_def *rfe_def = rtw_get_rfe_def(rtwdev);
++	const struct rtw_pwr_track_tbl *tbl = rfe_def->pwr_track_tbl;
+ 	u8 channel = rtwdev->hal.current_channel;
+ 
+ 	if (IS_CH_2G_BAND(channel)) {
+--- a/drivers/net/wireless/realtek/rtw88/rtw8703b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8703b.c
+@@ -493,11 +493,6 @@ static const struct rtw_pwr_seq_cmd * co
+ 	NULL
+ };
+ 
+-static const struct rtw_rfe_def rtw8703b_rfe_defs[] = {
+-	[0] = { .phy_pg_tbl	= &rtw8703b_bb_pg_tbl,
+-		.txpwr_lmt_tbl	= &rtw8703b_txpwr_lmt_tbl,},
+-};
+-
+ static const struct rtw_page_table page_table_8703b[] = {
+ 	{12, 2, 2, 0, 1},
+ 	{12, 2, 2, 0, 1},
+@@ -1818,6 +1813,12 @@ static const struct rtw_pwr_track_tbl rt
+ 	.pwrtrk_xtal_p = rtw8703b_pwrtrk_xtal_p,
+ };
+ 
++static const struct rtw_rfe_def rtw8703b_rfe_defs[] = {
++	[0] = { .phy_pg_tbl	= &rtw8703b_bb_pg_tbl,
++		.txpwr_lmt_tbl	= &rtw8703b_txpwr_lmt_tbl,
++		.pwr_track_tbl	= &rtw8703b_rtw_pwr_track_tbl, },
++};
++
+ /* Shared-Antenna Coex Table */
+ static const struct coex_table_para table_sant_8703b[] = {
+ 	{0xffffffff, 0xffffffff}, /* case-0 */
+@@ -1997,7 +1998,6 @@ const struct rtw_chip_info rtw8703b_hw_s
+ 	.rfe_defs_size = ARRAY_SIZE(rtw8703b_rfe_defs),
+ 
+ 	.iqk_threshold = 8,
+-	.pwr_track_tbl = &rtw8703b_rtw_pwr_track_tbl,
+ 
+ 	/* WOWLAN firmware exists, but not implemented yet */
+ 	.wow_fw_name = "rtw88/rtw8703b_wow_fw.bin",
+--- a/drivers/net/wireless/realtek/rtw88/rtw8723d.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8723d.c
+@@ -2020,11 +2020,6 @@ static const struct rtw_intf_phy_para_ta
+ 	.n_gen1_para	= ARRAY_SIZE(pcie_gen1_param_8723d),
+ };
+ 
+-static const struct rtw_rfe_def rtw8723d_rfe_defs[] = {
+-	[0] = { .phy_pg_tbl	= &rtw8723d_bb_pg_tbl,
+-		.txpwr_lmt_tbl	= &rtw8723d_txpwr_lmt_tbl,},
+-};
+-
+ static const u8 rtw8723d_pwrtrk_2gb_n[] = {
+ 	0, 0, 1, 1, 1, 2, 2, 3, 4, 4, 4, 4, 5, 5, 5,
+ 	6, 6, 7, 7, 8, 8, 8, 9, 9, 9, 10, 10, 10, 10, 10
+@@ -2088,6 +2083,12 @@ static const struct rtw_pwr_track_tbl rt
+ 	.pwrtrk_xtal_n = rtw8723d_pwrtrk_xtal_n,
+ };
+ 
++static const struct rtw_rfe_def rtw8723d_rfe_defs[] = {
++	[0] = { .phy_pg_tbl	= &rtw8723d_bb_pg_tbl,
++		.txpwr_lmt_tbl	= &rtw8723d_txpwr_lmt_tbl,
++		.pwr_track_tbl	= &rtw8723d_rtw_pwr_track_tbl, },
++};
++
+ static const struct rtw_reg_domain coex_info_hw_regs_8723d[] = {
+ 	{0x948, MASKDWORD, RTW_REG_DOMAIN_MAC32},
+ 	{0x67, BIT(7), RTW_REG_DOMAIN_MAC8},
+@@ -2159,7 +2160,6 @@ const struct rtw_chip_info rtw8723d_hw_s
+ 	.rfe_defs = rtw8723d_rfe_defs,
+ 	.rfe_defs_size = ARRAY_SIZE(rtw8723d_rfe_defs),
+ 	.rx_ldpc = false,
+-	.pwr_track_tbl = &rtw8723d_rtw_pwr_track_tbl,
+ 	.iqk_threshold = 8,
+ 	.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
+ 	.max_scan_ie_len = IEEE80211_MAX_DATA_LEN,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8723x.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8723x.c
+@@ -595,7 +595,8 @@ void __rtw8723x_pwrtrack_set_xtal(struct
+ 				  u8 delta)
+ {
+ 	struct rtw_dm_info *dm_info = &rtwdev->dm_info;
+-	const struct rtw_pwr_track_tbl *tbl = rtwdev->chip->pwr_track_tbl;
++	const struct rtw_rfe_def *rfe_def = rtw_get_rfe_def(rtwdev);
++	const struct rtw_pwr_track_tbl *tbl = rfe_def->pwr_track_tbl;
+ 	const s8 *pwrtrk_xtal;
+ 	s8 xtal_cap;
+ 
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821c.c
+@@ -1581,13 +1581,6 @@ static const struct rtw_intf_phy_para_ta
+ 	.n_gen2_para	= ARRAY_SIZE(pcie_gen2_param_8821c),
+ };
+ 
+-static const struct rtw_rfe_def rtw8821c_rfe_defs[] = {
+-	[0] = RTW_DEF_RFE(8821c, 0, 0),
+-	[2] = RTW_DEF_RFE_EXT(8821c, 0, 0, 2),
+-	[4] = RTW_DEF_RFE_EXT(8821c, 0, 0, 2),
+-	[6] = RTW_DEF_RFE(8821c, 0, 0),
+-};
+-
+ static const struct rtw_hw_reg rtw8821c_dig[] = {
+ 	[0] = { .addr = 0xc50, .mask = 0x7f },
+ };
+@@ -1899,7 +1892,7 @@ static const u8 rtw8821c_pwrtrk_2g_cck_a
+ 	5, 6, 6, 7, 7, 7, 8, 8, 9, 9, 9, 9, 9, 9
+ };
+ 
+-static const struct rtw_pwr_track_tbl rtw8821c_rtw_pwr_track_tbl = {
++static const struct rtw_pwr_track_tbl rtw8821c_pwr_track_type0_tbl = {
+ 	.pwrtrk_5gb_n[0] = rtw8821c_pwrtrk_5gb_n[0],
+ 	.pwrtrk_5gb_n[1] = rtw8821c_pwrtrk_5gb_n[1],
+ 	.pwrtrk_5gb_n[2] = rtw8821c_pwrtrk_5gb_n[2],
+@@ -1922,6 +1915,13 @@ static const struct rtw_pwr_track_tbl rt
+ 	.pwrtrk_2g_ccka_p = rtw8821c_pwrtrk_2g_cck_a_p,
+ };
+ 
++static const struct rtw_rfe_def rtw8821c_rfe_defs[] = {
++	[0] = RTW_DEF_RFE(8821c, 0, 0, 0),
++	[2] = RTW_DEF_RFE_EXT(8821c, 0, 0, 0, 2),
++	[4] = RTW_DEF_RFE_EXT(8821c, 0, 0, 0, 2),
++	[6] = RTW_DEF_RFE(8821c, 0, 0, 0),
++};
++
+ static const struct rtw_reg_domain coex_info_hw_regs_8821c[] = {
+ 	{0xCB0, MASKDWORD, RTW_REG_DOMAIN_MAC32},
+ 	{0xCB4, MASKDWORD, RTW_REG_DOMAIN_MAC32},
+@@ -1994,7 +1994,6 @@ const struct rtw_chip_info rtw8821c_hw_s
+ 	.rfe_defs = rtw8821c_rfe_defs,
+ 	.rfe_defs_size = ARRAY_SIZE(rtw8821c_rfe_defs),
+ 	.rx_ldpc = false,
+-	.pwr_track_tbl = &rtw8821c_rtw_pwr_track_tbl,
+ 	.iqk_threshold = 8,
+ 	.bfer_su_max_num = 2,
+ 	.bfer_mu_max_num = 1,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822b.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822b.c
+@@ -2074,12 +2074,6 @@ static const struct rtw_intf_phy_para_ta
+ 	.n_gen2_para	= ARRAY_SIZE(pcie_gen2_param_8822b),
+ };
+ 
+-static const struct rtw_rfe_def rtw8822b_rfe_defs[] = {
+-	[2] = RTW_DEF_RFE(8822b, 2, 2),
+-	[3] = RTW_DEF_RFE(8822b, 3, 0),
+-	[5] = RTW_DEF_RFE(8822b, 5, 5),
+-};
+-
+ static const struct rtw_hw_reg rtw8822b_dig[] = {
+ 	[0] = { .addr = 0xc50, .mask = 0x7f },
+ 	[1] = { .addr = 0xe50, .mask = 0x7f },
+@@ -2434,7 +2428,7 @@ static const u8 rtw8822b_pwrtrk_2g_cck_a
+ 	10, 11, 11, 12, 12, 13, 13, 14, 14, 15
+ };
+ 
+-static const struct rtw_pwr_track_tbl rtw8822b_rtw_pwr_track_tbl = {
++static const struct rtw_pwr_track_tbl rtw8822b_pwr_track_type0_tbl = {
+ 	.pwrtrk_5gb_n[RTW_PWR_TRK_5G_1] = rtw8822b_pwrtrk_5gb_n[RTW_PWR_TRK_5G_1],
+ 	.pwrtrk_5gb_n[RTW_PWR_TRK_5G_2] = rtw8822b_pwrtrk_5gb_n[RTW_PWR_TRK_5G_2],
+ 	.pwrtrk_5gb_n[RTW_PWR_TRK_5G_3] = rtw8822b_pwrtrk_5gb_n[RTW_PWR_TRK_5G_3],
+@@ -2457,6 +2451,12 @@ static const struct rtw_pwr_track_tbl rt
+ 	.pwrtrk_2g_ccka_p = rtw8822b_pwrtrk_2g_cck_a_p,
+ };
+ 
++static const struct rtw_rfe_def rtw8822b_rfe_defs[] = {
++	[2] = RTW_DEF_RFE(8822b, 2, 2, 0),
++	[3] = RTW_DEF_RFE(8822b, 3, 0, 0),
++	[5] = RTW_DEF_RFE(8822b, 5, 5, 0),
++};
++
+ static const struct rtw_reg_domain coex_info_hw_regs_8822b[] = {
+ 	{0xcb0, MASKDWORD, RTW_REG_DOMAIN_MAC32},
+ 	{0xcb4, MASKDWORD, RTW_REG_DOMAIN_MAC32},
+@@ -2537,7 +2537,6 @@ const struct rtw_chip_info rtw8822b_hw_s
+ 	.rf_tbl = {&rtw8822b_rf_a_tbl, &rtw8822b_rf_b_tbl},
+ 	.rfe_defs = rtw8822b_rfe_defs,
+ 	.rfe_defs_size = ARRAY_SIZE(rtw8822b_rfe_defs),
+-	.pwr_track_tbl = &rtw8822b_rtw_pwr_track_tbl,
+ 	.iqk_threshold = 8,
+ 	.bfer_su_max_num = 2,
+ 	.bfer_mu_max_num = 1,
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c
+@@ -4884,16 +4884,6 @@ static const struct rtw_intf_phy_para_ta
+ 	.n_gen2_para	= ARRAY_SIZE(pcie_gen2_param_8822c),
+ };
+ 
+-static const struct rtw_rfe_def rtw8822c_rfe_defs[] = {
+-	[0] = RTW_DEF_RFE(8822c, 0, 0),
+-	[1] = RTW_DEF_RFE(8822c, 0, 0),
+-	[2] = RTW_DEF_RFE(8822c, 0, 0),
+-	[3] = RTW_DEF_RFE(8822c, 0, 0),
+-	[4] = RTW_DEF_RFE(8822c, 0, 0),
+-	[5] = RTW_DEF_RFE(8822c, 0, 5),
+-	[6] = RTW_DEF_RFE(8822c, 0, 0),
+-};
+-
+ static const struct rtw_hw_reg rtw8822c_dig[] = {
+ 	[0] = { .addr = 0x1d70, .mask = 0x7f },
+ 	[1] = { .addr = 0x1d70, .mask = 0x7f00 },
+@@ -5239,7 +5229,7 @@ static const u8 rtw8822c_pwrtrk_2g_cck_a
+ 	18, 18, 19, 20, 21, 22, 23, 24, 24, 25
+ };
+ 
+-static const struct rtw_pwr_track_tbl rtw8822c_rtw_pwr_track_tbl = {
++static const struct rtw_pwr_track_tbl rtw8822c_pwr_track_type0_tbl = {
+ 	.pwrtrk_5gb_n[RTW_PWR_TRK_5G_1] = rtw8822c_pwrtrk_5gb_n[RTW_PWR_TRK_5G_1],
+ 	.pwrtrk_5gb_n[RTW_PWR_TRK_5G_2] = rtw8822c_pwrtrk_5gb_n[RTW_PWR_TRK_5G_2],
+ 	.pwrtrk_5gb_n[RTW_PWR_TRK_5G_3] = rtw8822c_pwrtrk_5gb_n[RTW_PWR_TRK_5G_3],
+@@ -5262,6 +5252,16 @@ static const struct rtw_pwr_track_tbl rt
+ 	.pwrtrk_2g_ccka_p = rtw8822c_pwrtrk_2g_cck_a_p,
+ };
+ 
++static const struct rtw_rfe_def rtw8822c_rfe_defs[] = {
++	[0] = RTW_DEF_RFE(8822c, 0, 0, 0),
++	[1] = RTW_DEF_RFE(8822c, 0, 0, 0),
++	[2] = RTW_DEF_RFE(8822c, 0, 0, 0),
++	[3] = RTW_DEF_RFE(8822c, 0, 0, 0),
++	[4] = RTW_DEF_RFE(8822c, 0, 0, 0),
++	[5] = RTW_DEF_RFE(8822c, 0, 5, 0),
++	[6] = RTW_DEF_RFE(8822c, 0, 0, 0),
++};
++
+ static const struct rtw_hw_reg_offset rtw8822c_edcca_th[] = {
+ 	[EDCCA_TH_L2H_IDX] = {
+ 		{.addr = 0x84c, .mask = MASKBYTE2}, .offset = 0x80
+@@ -5361,7 +5361,6 @@ const struct rtw_chip_info rtw8822c_hw_s
+ 	.rfe_defs_size = ARRAY_SIZE(rtw8822c_rfe_defs),
+ 	.en_dis_dpd = true,
+ 	.dpd_ratemask = DIS_DPD_RATEALL,
+-	.pwr_track_tbl = &rtw8822c_rtw_pwr_track_tbl,
+ 	.iqk_threshold = 8,
+ 	.lck_threshold = 8,
+ 	.bfer_su_max_num = 2,
diff --git a/package/kernel/mac80211/patches/rtl/034-v6.13-wifi-rtw88-usb-Set-pkt_info.ls-for-the-reserved-page.patch b/package/kernel/mac80211/patches/rtl/034-v6.13-wifi-rtw88-usb-Set-pkt_info.ls-for-the-reserved-page.patch
new file mode 100644
index 00000000000000..2a8d15dfae5951
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/034-v6.13-wifi-rtw88-usb-Set-pkt_info.ls-for-the-reserved-page.patch
@@ -0,0 +1,27 @@
+From 85bf3041a0ea40a60b5295749268e179f056546a Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 23 Oct 2024 17:13:10 +0300
+Subject: [PATCH] wifi: rtw88: usb: Set pkt_info.ls for the reserved page
+
+"ls" meaning "last segment". Without this RTL8812AU can't upload the
+reserved page in USB 2 mode. (Somehow it's fine in USB 3 mode.)
+
+Also tested with RTL8822CU, RTL8812BU, RTL8811CU, RTL8723DU, RTL8811AU.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/e443f5d9-4b53-4f64-985c-64313ec80bef@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/usb.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/usb.c
++++ b/drivers/net/wireless/realtek/rtw88/usb.c
+@@ -532,6 +532,7 @@ static int rtw_usb_write_data_rsvd_page(
+ 	pkt_info.tx_pkt_size = size;
+ 	pkt_info.qsel = TX_DESC_QSEL_BEACON;
+ 	pkt_info.offset = chip->tx_pkt_desc_sz;
++	pkt_info.ls = true;
+ 
+ 	return rtw_usb_write_data(rtwdev, &pkt_info, buf);
+ }
diff --git a/package/kernel/mac80211/patches/rtl/035-v6.13-wifi-rtw88-Detect-beacon-loss-with-chips-other-than-.patch b/package/kernel/mac80211/patches/rtl/035-v6.13-wifi-rtw88-Detect-beacon-loss-with-chips-other-than-.patch
new file mode 100644
index 00000000000000..de64f33e43e5b4
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/035-v6.13-wifi-rtw88-Detect-beacon-loss-with-chips-other-than-.patch
@@ -0,0 +1,63 @@
+From 57289d30cd2ae315ab9b28213d63d1dbf8570cf3 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 23 Oct 2024 17:13:45 +0300
+Subject: [PATCH] wifi: rtw88: Detect beacon loss with chips other than 8822c
+
+The driver is supposed to avoid entering LPS (power saving) when there
+is beacon loss, but only RTL8822C detects the beacon loss (because it
+has beacon filtering in the firmware).
+
+Detect beacon loss with the other chips by checking if we received less
+than half the expected number of beacons in the last 2-second interval.
+
+This gets rid of the occasional "failed to get tx report from firmware"
+warnings with RTL8821AU. It may also avoid some disconnections.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/f52b2fcf-bf94-48bc-89bd-e55ebc3a2f2d@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/main.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -202,6 +202,21 @@ static void rtw_vif_watch_dog_iter(void
+ 	rtwvif->stats.rx_cnt = 0;
+ }
+ 
++static void rtw_sw_beacon_loss_check(struct rtw_dev *rtwdev,
++				     struct rtw_vif *rtwvif, int received_beacons)
++{
++	int watchdog_delay = 2000000 / 1024; /* TU */
++	int beacon_int, expected_beacons;
++
++	if (rtw_fw_feature_check(&rtwdev->fw, FW_FEATURE_BCN_FILTER) || !rtwvif)
++		return;
++
++	beacon_int = rtwvif_to_vif(rtwvif)->bss_conf.beacon_int;
++	expected_beacons = DIV_ROUND_UP(watchdog_delay, beacon_int);
++
++	rtwdev->beacon_loss = received_beacons < expected_beacons / 2;
++}
++
+ /* process TX/RX statistics periodically for hardware,
+  * the information helps hardware to enhance performance
+  */
+@@ -212,6 +227,7 @@ static void rtw_watch_dog_work(struct wo
+ 	struct rtw_traffic_stats *stats = &rtwdev->stats;
+ 	struct rtw_watch_dog_iter_data data = {};
+ 	bool busy_traffic = test_bit(RTW_FLAG_BUSY_TRAFFIC, rtwdev->flags);
++	int received_beacons = rtwdev->dm_info.cur_pkt_count.num_bcn_pkt;
+ 	u32 tx_unicast_mbps, rx_unicast_mbps;
+ 	bool ps_active;
+ 
+@@ -270,6 +286,8 @@ static void rtw_watch_dog_work(struct wo
+ 	 */
+ 	rtw_iterate_vifs(rtwdev, rtw_vif_watch_dog_iter, &data);
+ 
++	rtw_sw_beacon_loss_check(rtwdev, data.rtwvif, received_beacons);
++
+ 	/* fw supports only one station associated to enter lps, if there are
+ 	 * more than two stations associated to the AP, then we can not enter
+ 	 * lps, because fw does not handle the overlapped beacon interval
diff --git a/package/kernel/mac80211/patches/rtl/036-v6.13-wifi-rtw88-coex-Support-chips-without-a-scoreboard.patch b/package/kernel/mac80211/patches/rtl/036-v6.13-wifi-rtw88-coex-Support-chips-without-a-scoreboard.patch
new file mode 100644
index 00000000000000..b2fb04fd31c325
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/036-v6.13-wifi-rtw88-coex-Support-chips-without-a-scoreboard.patch
@@ -0,0 +1,66 @@
+From b19840afc05121293ae59f017cb9924814eb5d77 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 23 Oct 2024 17:14:12 +0300
+Subject: [PATCH] wifi: rtw88: coex: Support chips without a scoreboard
+
+All the chips currently supported have a "scoreboard": the chip keeps
+track of certain things related to bluetooth, for example, whether
+bluetooth is active. The information can be read from register 0xaa.
+
+RTL8821AU doesn't have this. Implement bluetooth activity detection in
+rtw_coex_monitor_bt_enable() based on the bluetooth TX/RX counters.
+
+This is mostly important for RTL8811AU, the version of RTL8821AU without
+bluetooth. Without this change, the driver thinks bluetooth is active
+and the wifi speeds are low.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/5058f23d-2086-42cd-82ad-eef31a348467@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/coex.c | 18 ++++++++++++++++++
+ drivers/net/wireless/realtek/rtw88/main.h |  1 +
+ 2 files changed, 19 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/coex.c
++++ b/drivers/net/wireless/realtek/rtw88/coex.c
+@@ -494,11 +494,29 @@ static void rtw_coex_monitor_bt_enable(s
+ 	struct rtw_coex_stat *coex_stat = &coex->stat;
+ 	struct rtw_coex_dm *coex_dm = &coex->dm;
+ 	bool bt_disabled = false;
++	bool bt_active = true;
+ 	u16 score_board;
+ 
+ 	if (chip->scbd_support) {
+ 		score_board = rtw_coex_read_scbd(rtwdev);
+ 		bt_disabled = !(score_board & COEX_SCBD_ONOFF);
++	} else {
++		if (coex_stat->hi_pri_tx == 0 && coex_stat->hi_pri_rx == 0 &&
++		    coex_stat->lo_pri_tx == 0 && coex_stat->lo_pri_rx == 0)
++			bt_active = false;
++
++		if (coex_stat->hi_pri_tx == 0xffff && coex_stat->hi_pri_rx == 0xffff &&
++		    coex_stat->lo_pri_tx == 0xffff && coex_stat->lo_pri_rx == 0xffff)
++			bt_active = false;
++
++		if (bt_active) {
++			coex_stat->bt_disable_cnt = 0;
++			bt_disabled = false;
++		} else {
++			coex_stat->bt_disable_cnt++;
++			if (coex_stat->bt_disable_cnt >= 10)
++				bt_disabled = true;
++		}
+ 	}
+ 
+ 	if (coex_stat->bt_disabled != bt_disabled) {
+--- a/drivers/net/wireless/realtek/rtw88/main.h
++++ b/drivers/net/wireless/realtek/rtw88/main.h
+@@ -1494,6 +1494,7 @@ struct rtw_coex_stat {
+ 	u8 bt_hid_slot;
+ 	u8 bt_a2dp_bitpool;
+ 	u8 bt_iqk_state;
++	u8 bt_disable_cnt;
+ 
+ 	u16 wl_beacon_interval;
+ 	u8 wl_noisy_level;
diff --git a/package/kernel/mac80211/patches/rtl/037-v6.13-wifi-rtw88-8821a-Regularly-ask-for-BT-info-updates.patch b/package/kernel/mac80211/patches/rtl/037-v6.13-wifi-rtw88-8821a-Regularly-ask-for-BT-info-updates.patch
new file mode 100644
index 00000000000000..e0e840f0fadfeb
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/037-v6.13-wifi-rtw88-8821a-Regularly-ask-for-BT-info-updates.patch
@@ -0,0 +1,67 @@
+From bfcee5ee924fc5f706d20f5dc31586ca47912304 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 23 Oct 2024 17:14:45 +0300
+Subject: [PATCH] wifi: rtw88: 8821a: Regularly ask for BT info updates
+
+The RTL8821AU firmware sends C2H_BT_INFO by itself when bluetooth
+headphones are connected, but not when they are disconnected. This leads
+to the coexistence code still using the A2DP algorithm long after the
+headphones are disconnected, which means the wifi speeds are much lower
+than they should be. Work around this by asking for updates every two
+seconds if the chip is RTL8821AU.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/358acdd2-6aae-46c1-9c66-fcce4e700b96@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/coex.c |  2 +-
+ drivers/net/wireless/realtek/rtw88/coex.h | 11 +++++++++++
+ drivers/net/wireless/realtek/rtw88/main.c |  1 +
+ 3 files changed, 13 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/coex.c
++++ b/drivers/net/wireless/realtek/rtw88/coex.c
+@@ -446,7 +446,7 @@ static void rtw_coex_check_rfk(struct rt
+ 	}
+ }
+ 
+-static void rtw_coex_query_bt_info(struct rtw_dev *rtwdev)
++void rtw_coex_query_bt_info(struct rtw_dev *rtwdev)
+ {
+ 	struct rtw_coex *coex = &rtwdev->coex;
+ 	struct rtw_coex_stat *coex_stat = &coex->stat;
+--- a/drivers/net/wireless/realtek/rtw88/coex.h
++++ b/drivers/net/wireless/realtek/rtw88/coex.h
+@@ -384,6 +384,7 @@ u32 rtw_coex_read_indirect_reg(struct rt
+ void rtw_coex_write_indirect_reg(struct rtw_dev *rtwdev, u16 addr,
+ 				 u32 mask, u32 val);
+ void rtw_coex_write_scbd(struct rtw_dev *rtwdev, u16 bitpos, bool set);
++void rtw_coex_query_bt_info(struct rtw_dev *rtwdev);
+ 
+ void rtw_coex_bt_relink_work(struct work_struct *work);
+ void rtw_coex_bt_reenable_work(struct work_struct *work);
+@@ -419,4 +420,14 @@ static inline bool rtw_coex_disabled(str
+ 	return coex_stat->bt_disabled;
+ }
+ 
++static inline void rtw_coex_active_query_bt_info(struct rtw_dev *rtwdev)
++{
++	/* The RTL8821AU firmware doesn't send C2H_BT_INFO by itself
++	 * when bluetooth headphones are disconnected, so we have to
++	 * ask for it regularly.
++	 */
++	if (rtwdev->chip->id == RTW_CHIP_TYPE_8821A && rtwdev->efuse.btcoex)
++		rtw_coex_query_bt_info(rtwdev);
++}
++
+ #endif
+--- a/drivers/net/wireless/realtek/rtw88/main.c
++++ b/drivers/net/wireless/realtek/rtw88/main.c
+@@ -274,6 +274,7 @@ static void rtw_watch_dog_work(struct wo
+ 	rtw_leave_lps(rtwdev);
+ 	rtw_coex_wl_status_check(rtwdev);
+ 	rtw_coex_query_bt_hid_list(rtwdev);
++	rtw_coex_active_query_bt_info(rtwdev);
+ 
+ 	rtw_phy_dynamic_mechanism(rtwdev);
+ 
diff --git a/package/kernel/mac80211/patches/rtl/038-v6.13-wifi-rtw88-8812a-Mitigate-beacon-loss.patch b/package/kernel/mac80211/patches/rtl/038-v6.13-wifi-rtw88-8812a-Mitigate-beacon-loss.patch
new file mode 100644
index 00000000000000..f862f80460df36
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/038-v6.13-wifi-rtw88-8812a-Mitigate-beacon-loss.patch
@@ -0,0 +1,37 @@
+From f9e0189cbc2d6447dde392944c769546cdf48140 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 23 Oct 2024 17:15:13 +0300
+Subject: [PATCH] wifi: rtw88: 8812a: Mitigate beacon loss
+
+The RTL8812AU has a reception problem, maybe only in the 5 GHz band.
+Sometimes, in some positions, it stops receiving anything even though
+the distance to the AP is only ~3 meters and there are no obstacles.
+Moving it a few centimeters fixes it.
+
+Switch the initial gain to maximum coverage when there is beacon loss.
+This only helps sometimes. This is similar to what the official driver
+does.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/203f5043-4fe1-4f35-8b8f-d3b6f44e1fd9@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/phy.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/phy.c
++++ b/drivers/net/wireless/realtek/rtw88/phy.c
+@@ -530,6 +530,13 @@ static void rtw_phy_dig(struct rtw_dev *
+ 	 */
+ 	rtw_phy_dig_recorder(dm_info, cur_igi, fa_cnt);
+ 
++	/* Mitigate beacon loss and connectivity issues, mainly (only?)
++	 * in the 5 GHz band
++	 */
++	if (rtwdev->chip->id == RTW_CHIP_TYPE_8812A && rtwdev->beacon_loss &&
++	    linked && dm_info->total_fa_cnt < DIG_PERF_FA_TH_EXTRA_HIGH)
++		cur_igi = DIG_CVRG_MIN;
++
+ 	if (cur_igi != pre_igi)
+ 		rtw_phy_dig_write(rtwdev, cur_igi);
+ }
diff --git a/package/kernel/mac80211/patches/rtl/039-v6.13-wifi-rtw88-Add-rtw8812a_table.-c-h.patch b/package/kernel/mac80211/patches/rtl/039-v6.13-wifi-rtw88-Add-rtw8812a_table.-c-h.patch
new file mode 100644
index 00000000000000..59a04b4d16b579
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/039-v6.13-wifi-rtw88-Add-rtw8812a_table.-c-h.patch
@@ -0,0 +1,2862 @@
+From 528f902ecc0eb8fb766bde519421255729623dd8 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 30 Oct 2024 20:24:33 +0200
+Subject: [PATCH] wifi: rtw88: Add rtw8812a_table.{c,h}
+
+These contain various arrays for initialising RTL8812AU. Also TX power
+limits.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/086f476c-e832-4867-963c-a64a63252fd6@gmail.com
+---
+ .../wireless/realtek/rtw88/rtw8812a_table.c   | 2812 +++++++++++++++++
+ .../wireless/realtek/rtw88/rtw8812a_table.h   |   26 +
+ 2 files changed, 2838 insertions(+)
+ create mode 100644 drivers/net/wireless/realtek/rtw88/rtw8812a_table.c
+ create mode 100644 drivers/net/wireless/realtek/rtw88/rtw8812a_table.h
+
+--- /dev/null
++++ b/drivers/net/wireless/realtek/rtw88/rtw8812a_table.c
+@@ -0,0 +1,2812 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
++/* Copyright(c) 2024  Realtek Corporation
++ */
++
++#include "main.h"
++#include "phy.h"
++#include "rtw8812a_table.h"
++
++static const u32 rtw8812a_mac[] = {
++	0x010, 0x0000000C,
++	0x80000200,	0x00000000,	0x40000000,	0x00000000,
++	0x011, 0x00000066,
++	0xA0000000,	0x00000000,
++	0x011, 0x0000005A,
++	0xB0000000,	0x00000000,
++	0x025, 0x0000000F,
++	0x072, 0x00000000,
++	0x420, 0x00000080,
++	0x428, 0x0000000A,
++	0x429, 0x00000010,
++	0x430, 0x00000000,
++	0x431, 0x00000000,
++	0x432, 0x00000000,
++	0x433, 0x00000001,
++	0x434, 0x00000002,
++	0x435, 0x00000003,
++	0x436, 0x00000005,
++	0x437, 0x00000007,
++	0x438, 0x00000000,
++	0x439, 0x00000000,
++	0x43A, 0x00000000,
++	0x43B, 0x00000001,
++	0x43C, 0x00000002,
++	0x43D, 0x00000003,
++	0x43E, 0x00000005,
++	0x43F, 0x00000007,
++	0x440, 0x0000005D,
++	0x441, 0x00000001,
++	0x442, 0x00000000,
++	0x444, 0x00000010,
++	0x445, 0x00000000,
++	0x446, 0x00000000,
++	0x447, 0x00000000,
++	0x448, 0x00000000,
++	0x449, 0x000000F0,
++	0x44A, 0x0000000F,
++	0x44B, 0x0000003E,
++	0x44C, 0x00000010,
++	0x44D, 0x00000000,
++	0x44E, 0x00000000,
++	0x44F, 0x00000000,
++	0x450, 0x00000000,
++	0x451, 0x000000F0,
++	0x452, 0x0000000F,
++	0x453, 0x00000000,
++	0x45B, 0x00000080,
++	0x460, 0x00000066,
++	0x461, 0x00000066,
++	0x4C8, 0x000000FF,
++	0x4C9, 0x00000008,
++	0x4CC, 0x000000FF,
++	0x4CD, 0x000000FF,
++	0x4CE, 0x00000001,
++	0x500, 0x00000026,
++	0x501, 0x000000A2,
++	0x502, 0x0000002F,
++	0x503, 0x00000000,
++	0x504, 0x00000028,
++	0x505, 0x000000A3,
++	0x506, 0x0000005E,
++	0x507, 0x00000000,
++	0x508, 0x0000002B,
++	0x509, 0x000000A4,
++	0x50A, 0x0000005E,
++	0x50B, 0x00000000,
++	0x50C, 0x0000004F,
++	0x50D, 0x000000A4,
++	0x50E, 0x00000000,
++	0x50F, 0x00000000,
++	0x512, 0x0000001C,
++	0x514, 0x0000000A,
++	0x516, 0x0000000A,
++	0x525, 0x0000004F,
++	0x550, 0x00000010,
++	0x551, 0x00000010,
++	0x559, 0x00000002,
++	0x55C, 0x00000050,
++	0x55D, 0x000000FF,
++	0x604, 0x00000009,
++	0x605, 0x00000030,
++	0x607, 0x00000003,
++	0x608, 0x0000000E,
++	0x609, 0x0000002A,
++	0x620, 0x000000FF,
++	0x621, 0x000000FF,
++	0x622, 0x000000FF,
++	0x623, 0x000000FF,
++	0x624, 0x000000FF,
++	0x625, 0x000000FF,
++	0x626, 0x000000FF,
++	0x627, 0x000000FF,
++	0x638, 0x00000050,
++	0x63C, 0x0000000A,
++	0x63D, 0x0000000A,
++	0x63E, 0x0000000E,
++	0x63F, 0x0000000E,
++	0x640, 0x00000080,
++	0x642, 0x00000040,
++	0x643, 0x00000000,
++	0x652, 0x000000C8,
++	0x66E, 0x00000005,
++	0x700, 0x00000021,
++	0x701, 0x00000043,
++	0x702, 0x00000065,
++	0x703, 0x00000087,
++	0x708, 0x00000021,
++	0x709, 0x00000043,
++	0x70A, 0x00000065,
++	0x70B, 0x00000087,
++	0x718, 0x00000040,
++};
++
++RTW_DECL_TABLE_PHY_COND(rtw8812a_mac, rtw_phy_cfg_mac);
++
++static const u32 rtw8812a_agc[] = {
++	0x80000001,	0x00000000,	0x40000000,	0x00000000,
++	0x81C, 0xFC000001,
++	0x81C, 0xFB020001,
++	0x81C, 0xFA040001,
++	0x81C, 0xF9060001,
++	0x81C, 0xF8080001,
++	0x81C, 0xF70A0001,
++	0x81C, 0xF60C0001,
++	0x81C, 0xF50E0001,
++	0x81C, 0xF4100001,
++	0x81C, 0xF3120001,
++	0x81C, 0xF2140001,
++	0x81C, 0xF1160001,
++	0x81C, 0xF0180001,
++	0x81C, 0xEF1A0001,
++	0x81C, 0xEE1C0001,
++	0x81C, 0xED1E0001,
++	0x81C, 0xEC200001,
++	0x81C, 0xEB220001,
++	0x81C, 0xEA240001,
++	0x81C, 0xCD260001,
++	0x81C, 0xCC280001,
++	0x81C, 0xCB2A0001,
++	0x81C, 0xCA2C0001,
++	0x81C, 0xC92E0001,
++	0x81C, 0xC8300001,
++	0x81C, 0xA6320001,
++	0x81C, 0xA5340001,
++	0x81C, 0xA4360001,
++	0x81C, 0xA3380001,
++	0x81C, 0xA23A0001,
++	0x81C, 0x883C0001,
++	0x81C, 0x873E0001,
++	0x81C, 0x86400001,
++	0x81C, 0x85420001,
++	0x81C, 0x84440001,
++	0x81C, 0x83460001,
++	0x81C, 0x82480001,
++	0x81C, 0x814A0001,
++	0x81C, 0x484C0001,
++	0x81C, 0x474E0001,
++	0x81C, 0x46500001,
++	0x81C, 0x45520001,
++	0x81C, 0x44540001,
++	0x81C, 0x43560001,
++	0x81C, 0x42580001,
++	0x81C, 0x415A0001,
++	0x81C, 0x255C0001,
++	0x81C, 0x245E0001,
++	0x81C, 0x23600001,
++	0x81C, 0x22620001,
++	0x81C, 0x21640001,
++	0x81C, 0x21660001,
++	0x81C, 0x21680001,
++	0x81C, 0x216A0001,
++	0x81C, 0x216C0001,
++	0x81C, 0x216E0001,
++	0x81C, 0x21700001,
++	0x81C, 0x21720001,
++	0x81C, 0x21740001,
++	0x81C, 0x21760001,
++	0x81C, 0x21780001,
++	0x81C, 0x217A0001,
++	0x81C, 0x217C0001,
++	0x81C, 0x217E0001,
++	0x90000001,	0x00000005,	0x40000000,	0x00000000,
++	0x81C, 0xF9000001,
++	0x81C, 0xF8020001,
++	0x81C, 0xF7040001,
++	0x81C, 0xF6060001,
++	0x81C, 0xF5080001,
++	0x81C, 0xF40A0001,
++	0x81C, 0xF30C0001,
++	0x81C, 0xF20E0001,
++	0x81C, 0xF1100001,
++	0x81C, 0xF0120001,
++	0x81C, 0xEF140001,
++	0x81C, 0xEE160001,
++	0x81C, 0xED180001,
++	0x81C, 0xEC1A0001,
++	0x81C, 0xEB1C0001,
++	0x81C, 0xEA1E0001,
++	0x81C, 0xCD200001,
++	0x81C, 0xCC220001,
++	0x81C, 0xCB240001,
++	0x81C, 0xCA260001,
++	0x81C, 0xC9280001,
++	0x81C, 0xC82A0001,
++	0x81C, 0xC72C0001,
++	0x81C, 0xC62E0001,
++	0x81C, 0xA5300001,
++	0x81C, 0xA4320001,
++	0x81C, 0xA3340001,
++	0x81C, 0xA2360001,
++	0x81C, 0x88380001,
++	0x81C, 0x873A0001,
++	0x81C, 0x863C0001,
++	0x81C, 0x853E0001,
++	0x81C, 0x84400001,
++	0x81C, 0x83420001,
++	0x81C, 0x82440001,
++	0x81C, 0x81460001,
++	0x81C, 0x48480001,
++	0x81C, 0x474A0001,
++	0x81C, 0x464C0001,
++	0x81C, 0x454E0001,
++	0x81C, 0x44500001,
++	0x81C, 0x43520001,
++	0x81C, 0x42540001,
++	0x81C, 0x41560001,
++	0x81C, 0x25580001,
++	0x81C, 0x245A0001,
++	0x81C, 0x235C0001,
++	0x81C, 0x225E0001,
++	0x81C, 0x21600001,
++	0x81C, 0x21620001,
++	0x81C, 0x21640001,
++	0x81C, 0x21660001,
++	0x81C, 0x21680001,
++	0x81C, 0x216A0001,
++	0x81C, 0x236C0001,
++	0x81C, 0x226E0001,
++	0x81C, 0x21700001,
++	0x81C, 0x21720001,
++	0x81C, 0x21740001,
++	0x81C, 0x21760001,
++	0x81C, 0x21780001,
++	0x81C, 0x217A0001,
++	0x81C, 0x217C0001,
++	0x81C, 0x217E0001,
++	0xA0000000,	0x00000000,
++	0x81C, 0xFF000001,
++	0x81C, 0xFF020001,
++	0x81C, 0xFF040001,
++	0x81C, 0xFF060001,
++	0x81C, 0xFF080001,
++	0x81C, 0xFE0A0001,
++	0x81C, 0xFD0C0001,
++	0x81C, 0xFC0E0001,
++	0x81C, 0xFB100001,
++	0x81C, 0xFA120001,
++	0x81C, 0xF9140001,
++	0x81C, 0xF8160001,
++	0x81C, 0xF7180001,
++	0x81C, 0xF61A0001,
++	0x81C, 0xF51C0001,
++	0x81C, 0xF41E0001,
++	0x81C, 0xF3200001,
++	0x81C, 0xF2220001,
++	0x81C, 0xF1240001,
++	0x81C, 0xF0260001,
++	0x81C, 0xEF280001,
++	0x81C, 0xEE2A0001,
++	0x81C, 0xED2C0001,
++	0x81C, 0xEC2E0001,
++	0x81C, 0xEB300001,
++	0x81C, 0xEA320001,
++	0x81C, 0xE9340001,
++	0x81C, 0xE8360001,
++	0x81C, 0xE7380001,
++	0x81C, 0xE63A0001,
++	0x81C, 0xE53C0001,
++	0x81C, 0xC73E0001,
++	0x81C, 0xC6400001,
++	0x81C, 0xC5420001,
++	0x81C, 0xC4440001,
++	0x81C, 0xC3460001,
++	0x81C, 0xC2480001,
++	0x81C, 0xC14A0001,
++	0x81C, 0xA74C0001,
++	0x81C, 0xA64E0001,
++	0x81C, 0xA5500001,
++	0x81C, 0xA4520001,
++	0x81C, 0xA3540001,
++	0x81C, 0xA2560001,
++	0x81C, 0xA1580001,
++	0x81C, 0x675A0001,
++	0x81C, 0x665C0001,
++	0x81C, 0x655E0001,
++	0x81C, 0x64600001,
++	0x81C, 0x63620001,
++	0x81C, 0x48640001,
++	0x81C, 0x47660001,
++	0x81C, 0x46680001,
++	0x81C, 0x456A0001,
++	0x81C, 0x446C0001,
++	0x81C, 0x436E0001,
++	0x81C, 0x42700001,
++	0x81C, 0x41720001,
++	0x81C, 0x41740001,
++	0x81C, 0x41760001,
++	0x81C, 0x41780001,
++	0x81C, 0x417A0001,
++	0x81C, 0x417C0001,
++	0x81C, 0x417E0001,
++	0xB0000000,	0x00000000,
++	0x80000004,	0x00000000,	0x40000000,	0x00000000,
++	0x81C, 0xFC800001,
++	0x81C, 0xFB820001,
++	0x81C, 0xFA840001,
++	0x81C, 0xF9860001,
++	0x81C, 0xF8880001,
++	0x81C, 0xF78A0001,
++	0x81C, 0xF68C0001,
++	0x81C, 0xF58E0001,
++	0x81C, 0xF4900001,
++	0x81C, 0xF3920001,
++	0x81C, 0xF2940001,
++	0x81C, 0xF1960001,
++	0x81C, 0xF0980001,
++	0x81C, 0xEF9A0001,
++	0x81C, 0xEE9C0001,
++	0x81C, 0xED9E0001,
++	0x81C, 0xECA00001,
++	0x81C, 0xEBA20001,
++	0x81C, 0xEAA40001,
++	0x81C, 0xE9A60001,
++	0x81C, 0xE8A80001,
++	0x81C, 0xE7AA0001,
++	0x81C, 0xE6AC0001,
++	0x81C, 0xE5AE0001,
++	0x81C, 0xE4B00001,
++	0x81C, 0xE3B20001,
++	0x81C, 0xA8B40001,
++	0x81C, 0xA7B60001,
++	0x81C, 0xA6B80001,
++	0x81C, 0xA5BA0001,
++	0x81C, 0xA4BC0001,
++	0x81C, 0xA3BE0001,
++	0x81C, 0xA2C00001,
++	0x81C, 0xA1C20001,
++	0x81C, 0x68C40001,
++	0x81C, 0x67C60001,
++	0x81C, 0x66C80001,
++	0x81C, 0x65CA0001,
++	0x81C, 0x64CC0001,
++	0x81C, 0x47CE0001,
++	0x81C, 0x46D00001,
++	0x81C, 0x45D20001,
++	0x81C, 0x44D40001,
++	0x81C, 0x43D60001,
++	0x81C, 0x42D80001,
++	0x81C, 0x08DA0001,
++	0x81C, 0x07DC0001,
++	0x81C, 0x06DE0001,
++	0x81C, 0x05E00001,
++	0x81C, 0x04E20001,
++	0x81C, 0x03E40001,
++	0x81C, 0x02E60001,
++	0x81C, 0x01E80001,
++	0x81C, 0x01EA0001,
++	0x81C, 0x01EC0001,
++	0x81C, 0x01EE0001,
++	0x81C, 0x01F00001,
++	0x81C, 0x01F20001,
++	0x81C, 0x01F40001,
++	0x81C, 0x01F60001,
++	0x81C, 0x01F80001,
++	0x81C, 0x01FA0001,
++	0x81C, 0x01FC0001,
++	0x81C, 0x01FE0001,
++	0xA0000000,	0x00000000,
++	0x81C, 0xFF800001,
++	0x81C, 0xFF820001,
++	0x81C, 0xFF840001,
++	0x81C, 0xFE860001,
++	0x81C, 0xFD880001,
++	0x81C, 0xFC8A0001,
++	0x81C, 0xFB8C0001,
++	0x81C, 0xFA8E0001,
++	0x81C, 0xF9900001,
++	0x81C, 0xF8920001,
++	0x81C, 0xF7940001,
++	0x81C, 0xF6960001,
++	0x81C, 0xF5980001,
++	0x81C, 0xF49A0001,
++	0x81C, 0xF39C0001,
++	0x81C, 0xF29E0001,
++	0x81C, 0xF1A00001,
++	0x81C, 0xF0A20001,
++	0x81C, 0xEFA40001,
++	0x81C, 0xEEA60001,
++	0x81C, 0xEDA80001,
++	0x81C, 0xECAA0001,
++	0x81C, 0xEBAC0001,
++	0x81C, 0xEAAE0001,
++	0x81C, 0xE9B00001,
++	0x81C, 0xE8B20001,
++	0x81C, 0xE7B40001,
++	0x81C, 0xE6B60001,
++	0x81C, 0xE5B80001,
++	0x81C, 0xE4BA0001,
++	0x81C, 0xE3BC0001,
++	0x81C, 0xA8BE0001,
++	0x81C, 0xA7C00001,
++	0x81C, 0xA6C20001,
++	0x81C, 0xA5C40001,
++	0x81C, 0xA4C60001,
++	0x81C, 0xA3C80001,
++	0x81C, 0xA2CA0001,
++	0x81C, 0xA1CC0001,
++	0x81C, 0x68CE0001,
++	0x81C, 0x67D00001,
++	0x81C, 0x66D20001,
++	0x81C, 0x65D40001,
++	0x81C, 0x64D60001,
++	0x81C, 0x47D80001,
++	0x81C, 0x46DA0001,
++	0x81C, 0x45DC0001,
++	0x81C, 0x44DE0001,
++	0x81C, 0x43E00001,
++	0x81C, 0x42E20001,
++	0x81C, 0x08E40001,
++	0x81C, 0x07E60001,
++	0x81C, 0x06E80001,
++	0x81C, 0x05EA0001,
++	0x81C, 0x04EC0001,
++	0x81C, 0x03EE0001,
++	0x81C, 0x02F00001,
++	0x81C, 0x01F20001,
++	0x81C, 0x01F40001,
++	0x81C, 0x01F60001,
++	0x81C, 0x01F80001,
++	0x81C, 0x01FA0001,
++	0x81C, 0x01FC0001,
++	0x81C, 0x01FE0001,
++	0xB0000000,	0x00000000,
++	0xC50, 0x00000022,
++	0xC50, 0x00000020,
++	0xE50, 0x00000022,
++	0xE50, 0x00000020,
++};
++
++RTW_DECL_TABLE_PHY_COND(rtw8812a_agc, rtw_phy_cfg_agc);
++
++static const u32 rtw8812a_agc_diff_lb[] = {
++	0x80000004,	0x00000000,	0x40000000,	0x00000000,
++	0x81C, 0x47CE0001,
++	0x81C, 0x46D00001,
++	0x81C, 0x45D20001,
++	0x81C, 0x44D40001,
++	0x81C, 0x43D60001,
++	0x81C, 0x42D80001,
++	0x81C, 0x08DA0001,
++	0x81C, 0x07DC0001,
++	0x81C, 0x06DE0001,
++	0x81C, 0x05E00001,
++	0x81C, 0x04E20001,
++	0x81C, 0x03E40001,
++	0x81C, 0x02E60001,
++	0xA0000000,	0x00000000,
++	0x81C, 0x47D80001,
++	0x81C, 0x46DA0001,
++	0x81C, 0x45DC0001,
++	0x81C, 0x44DE0001,
++	0x81C, 0x43E00001,
++	0x81C, 0x42E20001,
++	0x81C, 0x08E40001,
++	0x81C, 0x07E60001,
++	0x81C, 0x06E80001,
++	0x81C, 0x05EA0001,
++	0x81C, 0x04EC0001,
++	0x81C, 0x03EE0001,
++	0x81C, 0x02F00001,
++	0xB0000000,	0x00000000,
++};
++
++RTW_DECL_TABLE_PHY_COND(rtw8812a_agc_diff_lb, rtw_phy_cfg_agc);
++
++static const u32 rtw8812a_agc_diff_hb[] = {
++	0x80000004,	0x00000000,	0x40000000,	0x00000000,
++	0x81C, 0x45CE0001,
++	0x81C, 0x44D00001,
++	0x81C, 0x43D20001,
++	0x81C, 0x42D40001,
++	0x81C, 0x08D60001,
++	0x81C, 0x07D80001,
++	0x81C, 0x06DA0001,
++	0x81C, 0x05DC0001,
++	0x81C, 0x04DE0001,
++	0x81C, 0x03E00001,
++	0x81C, 0x02E20001,
++	0x81C, 0x01E40001,
++	0x81C, 0x01E60001,
++	0xA0000000,	0x00000000,
++	0x81C, 0x45D80001,
++	0x81C, 0x44DA0001,
++	0x81C, 0x43DC0001,
++	0x81C, 0x42DE0001,
++	0x81C, 0x08E00001,
++	0x81C, 0x07E20001,
++	0x81C, 0x06E40001,
++	0x81C, 0x05E60001,
++	0x81C, 0x04E80001,
++	0x81C, 0x03EA0001,
++	0x81C, 0x02EC0001,
++	0x81C, 0x01EE0001,
++	0x81C, 0x01F00001,
++	0xB0000000,	0x00000000,
++};
++
++RTW_DECL_TABLE_PHY_COND(rtw8812a_agc_diff_hb, rtw_phy_cfg_agc);
++
++static const u32 rtw8812a_bb[] = {
++	0x800, 0x8020D010,
++	0x804, 0x080112E0,
++	0x808, 0x0E028233,
++	0x80C, 0x12131113,
++	0x810, 0x20101263,
++	0x814, 0x020C3D10,
++	0x818, 0x03A00385,
++	0x820, 0x00000000,
++	0x824, 0x00030FE0,
++	0x828, 0x00000000,
++	0x82C, 0x002083DD,
++	0x830, 0x2EAAEEB8,
++	0x834, 0x0037A706,
++	0x838, 0x06C89B44,
++	0x83C, 0x0000095B,
++	0x840, 0xC0000001,
++	0x844, 0x40003CDE,
++	0x848, 0x6210FF8B,
++	0x84C, 0x6CFDFFB8,
++	0x850, 0x28874706,
++	0x854, 0x0001520C,
++	0x858, 0x8060E000,
++	0x85C, 0x74210168,
++	0x860, 0x6929C321,
++	0x864, 0x79727432,
++	0x868, 0x8CA7A314,
++	0x86C, 0x338C2878,
++	0x870, 0x03333333,
++	0x874, 0x31602C2E,
++	0x878, 0x00003152,
++	0x87C, 0x000FC000,
++	0x8A0, 0x00000013,
++	0x8A4, 0x7F7F7F7F,
++	0x8A8, 0xA202033E,
++	0x8AC, 0x0FF0FA0A,
++	0x8B0, 0x00000600,
++	0x8B4, 0x000FC080,
++	0x8B8, 0x6C10D7FF,
++	0x8BC, 0x4CA520A3,
++	0x8C0, 0x27F00020,
++	0x8C4, 0x00000000,
++	0x8C8, 0x00012D69,
++	0x8CC, 0x08248492,
++	0x8D0, 0x0000B800,
++	0x8DC, 0x00000000,
++	0x8D4, 0x940008A0,
++	0x8D8, 0x290B5612,
++	0x8F8, 0x400002C0,
++	0x8FC, 0x00000000,
++	0x900, 0x00000701,
++	0x90C, 0x00000000,
++	0x910, 0x0000FC00,
++	0x914, 0x00000404,
++	0x918, 0x1C1028C0,
++	0x91C, 0x64B11A1C,
++	0x920, 0xE0767233,
++	0x924, 0x055AA500,
++	0x928, 0x00000004,
++	0x92C, 0xFFFE0000,
++	0x930, 0xFFFFFFFE,
++	0x934, 0x001FFFFF,
++	0x960, 0x00000000,
++	0x964, 0x00000000,
++	0x968, 0x00000000,
++	0x96C, 0x00000000,
++	0x970, 0x801FFFFF,
++	0x978, 0x00000000,
++	0x97C, 0x00000000,
++	0x980, 0x00000000,
++	0x984, 0x00000000,
++	0x988, 0x00000000,
++	0x990, 0x27100000,
++	0x994, 0xFFFF0100,
++	0x998, 0xFFFFFF5C,
++	0x99C, 0xFFFFFFFF,
++	0x9A0, 0x000000FF,
++	0x9A4, 0x00080080,
++	0x9A8, 0x00000000,
++	0x9AC, 0x00000000,
++	0x9B0, 0x81081008,
++	0x9B4, 0x00000000,
++	0x9B8, 0x01081008,
++	0x9BC, 0x01081008,
++	0x9D0, 0x00000000,
++	0x9D4, 0x00000000,
++	0x9D8, 0x00000000,
++	0x9DC, 0x00000000,
++	0x9E4, 0x00000003,
++	0x9E8, 0x000002D5,
++	0xA00, 0x00D047C8,
++	0xA04, 0x01FF000C,
++	0xA08, 0x8C838300,
++	0xA0C, 0x2E7F000F,
++	0xA10, 0x9500BB78,
++	0xA14, 0x11144028,
++	0xA18, 0x00881117,
++	0xA1C, 0x89140F00,
++	0xA20, 0x1A1B0000,
++	0xA24, 0x090E1217,
++	0xA28, 0x00000305,
++	0xA2C, 0x00900000,
++	0xA70, 0x101FFF00,
++	0xA74, 0x00000008,
++	0xA78, 0x00000900,
++	0xA7C, 0x225B0606,
++	0xA80, 0x218075B2,
++	0xA84, 0x001F8C80,
++	0xB00, 0x03100000,
++	0xB04, 0x0000B000,
++	0xB08, 0xAE0201EB,
++	0xB0C, 0x01003207,
++	0xB10, 0x00009807,
++	0xB14, 0x01000000,
++	0xB18, 0x00000002,
++	0xB1C, 0x00000002,
++	0xB20, 0x0000001F,
++	0xB24, 0x03020100,
++	0xB28, 0x07060504,
++	0xB2C, 0x0B0A0908,
++	0xB30, 0x0F0E0D0C,
++	0xB34, 0x13121110,
++	0xB38, 0x17161514,
++	0xB3C, 0x0000003A,
++	0xB40, 0x00000000,
++	0xB44, 0x00000000,
++	0xB48, 0x13000032,
++	0xB4C, 0x48080000,
++	0xB50, 0x00000000,
++	0xB54, 0x00000000,
++	0xB58, 0x00000000,
++	0xB5C, 0x00000000,
++	0xC00, 0x00000007,
++	0xC04, 0x00042020,
++	0xC08, 0x80410231,
++	0xC0C, 0x00000000,
++	0xC10, 0x00000100,
++	0xC14, 0x01000000,
++	0xC1C, 0x40000003,
++	0xC20, 0x12121212,
++	0xC24, 0x12121212,
++	0xC28, 0x12121212,
++	0xC2C, 0x12121212,
++	0xC30, 0x12121212,
++	0xC34, 0x12121212,
++	0xC38, 0x12121212,
++	0xC3C, 0x12121212,
++	0xC40, 0x12121212,
++	0xC44, 0x12121212,
++	0xC48, 0x12121212,
++	0xC4C, 0x12121212,
++	0xC50, 0x00000020,
++	0xC54, 0x0008121C,
++	0xC58, 0x30000C1C,
++	0xC5C, 0x00000058,
++	0xC60, 0x34344443,
++	0xC64, 0x07003333,
++	0x80000008,	0x00000000,	0x40000000,	0x00000000,
++	0xC68, 0x59791979,
++	0x90000008,	0x05000000,	0x40000000,	0x00000000,
++	0xC68, 0x59791979,
++	0x90000002,	0x00000000,	0x40000000,	0x00000000,
++	0xC68, 0x59791979,
++	0x90000004,	0x00000000,	0x40000000,	0x00000000,
++	0xC68, 0x59791979,
++	0x90000001,	0x00000000,	0x40000000,	0x00000000,
++	0xC68, 0x59791979,
++	0x90000001,	0x00000005,	0x40000000,	0x00000000,
++	0xC68, 0x59791979,
++	0xA0000000,	0x00000000,
++	0xC68, 0x59799979,
++	0xB0000000,	0x00000000,
++	0xC6C, 0x59795979,
++	0xC70, 0x19795979,
++	0xC74, 0x19795979,
++	0xC78, 0x19791979,
++	0xC7C, 0x19791979,
++	0xC80, 0x19791979,
++	0xC84, 0x19791979,
++	0xC94, 0x0100005C,
++	0xC98, 0x00000000,
++	0xC9C, 0x00000000,
++	0xCA0, 0x00000029,
++	0xCA4, 0x08040201,
++	0xCA8, 0x80402010,
++	0xCB0, 0x77547777,
++	0xCB4, 0x00000077,
++	0xCB8, 0x00508242,
++	0xE00, 0x00000007,
++	0xE04, 0x00042020,
++	0xE08, 0x80410231,
++	0xE0C, 0x00000000,
++	0xE10, 0x00000100,
++	0xE14, 0x01000000,
++	0xE1C, 0x40000003,
++	0xE20, 0x12121212,
++	0xE24, 0x12121212,
++	0xE28, 0x12121212,
++	0xE2C, 0x12121212,
++	0xE30, 0x12121212,
++	0xE34, 0x12121212,
++	0xE38, 0x12121212,
++	0xE3C, 0x12121212,
++	0xE40, 0x12121212,
++	0xE44, 0x12121212,
++	0xE48, 0x12121212,
++	0xE4C, 0x12121212,
++	0xE50, 0x00000020,
++	0xE54, 0x0008121C,
++	0xE58, 0x30000C1C,
++	0xE5C, 0x00000058,
++	0xE60, 0x34344443,
++	0xE64, 0x07003333,
++	0xE68, 0x59791979,
++	0xE6C, 0x59795979,
++	0xE70, 0x19795979,
++	0xE74, 0x19795979,
++	0xE78, 0x19791979,
++	0xE7C, 0x19791979,
++	0xE80, 0x19791979,
++	0xE84, 0x19791979,
++	0xE94, 0x0100005C,
++	0xE98, 0x00000000,
++	0xE9C, 0x00000000,
++	0xEA0, 0x00000029,
++	0xEA4, 0x08040201,
++	0xEA8, 0x80402010,
++	0xEB0, 0x77547777,
++	0xEB4, 0x00000077,
++	0xEB8, 0x00508242,
++};
++
++RTW_DECL_TABLE_PHY_COND(rtw8812a_bb, rtw_phy_cfg_bb);
++
++static const struct rtw_phy_pg_cfg_pair rtw8812a_bb_pg[] = {
++	{ 0, 0, 0, 0x00000c20, 0xffffffff, 0x34363840, },
++	{ 0, 0, 0, 0x00000c24, 0xffffffff, 0x42424444, },
++	{ 0, 0, 0, 0x00000c28, 0xffffffff, 0x30323638, },
++	{ 0, 0, 0, 0x00000c2c, 0xffffffff, 0x40424444, },
++	{ 0, 0, 0, 0x00000c30, 0xffffffff, 0x28303236, },
++	{ 0, 0, 1, 0x00000c34, 0xffffffff, 0x38404242, },
++	{ 0, 0, 1, 0x00000c38, 0xffffffff, 0x26283034, },
++	{ 0, 0, 0, 0x00000c3c, 0xffffffff, 0x40424444, },
++	{ 0, 0, 0, 0x00000c40, 0xffffffff, 0x28303236, },
++	{ 0, 0, 0, 0x00000c44, 0xffffffff, 0x42422426, },
++	{ 0, 0, 1, 0x00000c48, 0xffffffff, 0x30343840, },
++	{ 0, 0, 1, 0x00000c4c, 0xffffffff, 0x22242628, },
++	{ 0, 1, 0, 0x00000e20, 0xffffffff, 0x34363840, },
++	{ 0, 1, 0, 0x00000e24, 0xffffffff, 0x42424444, },
++	{ 0, 1, 0, 0x00000e28, 0xffffffff, 0x30323638, },
++	{ 0, 1, 0, 0x00000e2c, 0xffffffff, 0x40424444, },
++	{ 0, 1, 0, 0x00000e30, 0xffffffff, 0x28303236, },
++	{ 0, 1, 1, 0x00000e34, 0xffffffff, 0x38404242, },
++	{ 0, 1, 1, 0x00000e38, 0xffffffff, 0x26283034, },
++	{ 0, 1, 0, 0x00000e3c, 0xffffffff, 0x40424444, },
++	{ 0, 1, 0, 0x00000e40, 0xffffffff, 0x28303236, },
++	{ 0, 1, 0, 0x00000e44, 0xffffffff, 0x42422426, },
++	{ 0, 1, 1, 0x00000e48, 0xffffffff, 0x30343840, },
++	{ 0, 1, 1, 0x00000e4c, 0xffffffff, 0x22242628, },
++	{ 1, 0, 0, 0x00000c24, 0xffffffff, 0x42424444, },
++	{ 1, 0, 0, 0x00000c28, 0xffffffff, 0x30323640, },
++	{ 1, 0, 0, 0x00000c2c, 0xffffffff, 0x40424444, },
++	{ 1, 0, 0, 0x00000c30, 0xffffffff, 0x28303236, },
++	{ 1, 0, 1, 0x00000c34, 0xffffffff, 0x38404242, },
++	{ 1, 0, 1, 0x00000c38, 0xffffffff, 0x26283034, },
++	{ 1, 0, 0, 0x00000c3c, 0xffffffff, 0x40424444, },
++	{ 1, 0, 0, 0x00000c40, 0xffffffff, 0x28303236, },
++	{ 1, 0, 0, 0x00000c44, 0xffffffff, 0x42422426, },
++	{ 1, 0, 1, 0x00000c48, 0xffffffff, 0x30343840, },
++	{ 1, 0, 1, 0x00000c4c, 0xffffffff, 0x22242628, },
++	{ 1, 1, 0, 0x00000e24, 0xffffffff, 0x42424444, },
++	{ 1, 1, 0, 0x00000e28, 0xffffffff, 0x30323640, },
++	{ 1, 1, 0, 0x00000e2c, 0xffffffff, 0x40424444, },
++	{ 1, 1, 0, 0x00000e30, 0xffffffff, 0x28303236, },
++	{ 1, 1, 1, 0x00000e34, 0xffffffff, 0x38404242, },
++	{ 1, 1, 1, 0x00000e38, 0xffffffff, 0x26283034, },
++	{ 1, 1, 0, 0x00000e3c, 0xffffffff, 0x40424444, },
++	{ 1, 1, 0, 0x00000e40, 0xffffffff, 0x28303236, },
++	{ 1, 1, 0, 0x00000e44, 0xffffffff, 0x42422426, },
++	{ 1, 1, 1, 0x00000e48, 0xffffffff, 0x30343840, },
++	{ 1, 1, 1, 0x00000e4c, 0xffffffff, 0x22242628, },
++};
++
++RTW_DECL_TABLE_BB_PG(rtw8812a_bb_pg);
++
++static const struct rtw_phy_pg_cfg_pair rtw8812a_bb_pg_rfe3[] = {
++	{ 0, 0, 0, 0x00000c20, 0xffffffff, 0x34343434, },
++	{ 0, 0, 0, 0x00000c24, 0xffffffff, 0x32323232, },
++	{ 0, 0, 0, 0x00000c28, 0xffffffff, 0x28303232, },
++	{ 0, 0, 0, 0x00000c2c, 0xffffffff, 0x32323232, },
++	{ 0, 0, 0, 0x00000c30, 0xffffffff, 0x28303232, },
++	{ 0, 0, 1, 0x00000c34, 0xffffffff, 0x32323232, },
++	{ 0, 0, 1, 0x00000c38, 0xffffffff, 0x26283032, },
++	{ 0, 0, 0, 0x00000c3c, 0xffffffff, 0x32323232, },
++	{ 0, 0, 0, 0x00000c40, 0xffffffff, 0x28303232, },
++	{ 0, 0, 0, 0x00000c44, 0xffffffff, 0x32322426, },
++	{ 0, 0, 1, 0x00000c48, 0xffffffff, 0x32323232, },
++	{ 0, 0, 1, 0x00000c4c, 0xffffffff, 0x24262830, },
++	{ 0, 1, 0, 0x00000e20, 0xffffffff, 0x34343434, },
++	{ 0, 1, 0, 0x00000e24, 0xffffffff, 0x32323232, },
++	{ 0, 1, 0, 0x00000e28, 0xffffffff, 0x28303232, },
++	{ 0, 1, 0, 0x00000e2c, 0xffffffff, 0x32323232, },
++	{ 0, 1, 0, 0x00000e30, 0xffffffff, 0x28303232, },
++	{ 0, 1, 1, 0x00000e34, 0xffffffff, 0x32323232, },
++	{ 0, 1, 1, 0x00000e38, 0xffffffff, 0x26283032, },
++	{ 0, 1, 0, 0x00000e3c, 0xffffffff, 0x32323232, },
++	{ 0, 1, 0, 0x00000e40, 0xffffffff, 0x28303232, },
++	{ 0, 1, 0, 0x00000e44, 0xffffffff, 0x32322426, },
++	{ 0, 1, 1, 0x00000e48, 0xffffffff, 0x32323232, },
++	{ 0, 1, 1, 0x00000e4c, 0xffffffff, 0x24262830, },
++	{ 1, 0, 0, 0x00000c24, 0xffffffff, 0x32323232, },
++	{ 1, 0, 0, 0x00000c28, 0xffffffff, 0x28303232, },
++	{ 1, 0, 0, 0x00000c2c, 0xffffffff, 0x32323232, },
++	{ 1, 0, 0, 0x00000c30, 0xffffffff, 0x24262830, },
++	{ 1, 0, 1, 0x00000c34, 0xffffffff, 0x32323232, },
++	{ 1, 0, 1, 0x00000c38, 0xffffffff, 0x24262830, },
++	{ 1, 0, 0, 0x00000c3c, 0xffffffff, 0x32323232, },
++	{ 1, 0, 0, 0x00000c40, 0xffffffff, 0x24262830, },
++	{ 1, 0, 0, 0x00000c44, 0xffffffff, 0x32322222, },
++	{ 1, 0, 1, 0x00000c48, 0xffffffff, 0x28303232, },
++	{ 1, 0, 1, 0x00000c4c, 0xffffffff, 0x22222426, },
++	{ 1, 1, 0, 0x00000e24, 0xffffffff, 0x32323232, },
++	{ 1, 1, 0, 0x00000e28, 0xffffffff, 0x28303232, },
++	{ 1, 1, 0, 0x00000e2c, 0xffffffff, 0x32323232, },
++	{ 1, 1, 0, 0x00000e30, 0xffffffff, 0x24262830, },
++	{ 1, 1, 1, 0x00000e34, 0xffffffff, 0x32323232, },
++	{ 1, 1, 1, 0x00000e38, 0xffffffff, 0x24262830, },
++	{ 1, 1, 0, 0x00000e3c, 0xffffffff, 0x32323232, },
++	{ 1, 1, 0, 0x00000e40, 0xffffffff, 0x24262830, },
++	{ 1, 1, 0, 0x00000e44, 0xffffffff, 0x32322222, },
++	{ 1, 1, 1, 0x00000e48, 0xffffffff, 0x28303232, },
++	{ 1, 1, 1, 0x00000e4c, 0xffffffff, 0x22222426, },
++};
++
++RTW_DECL_TABLE_BB_PG(rtw8812a_bb_pg_rfe3);
++
++static const u32 rtw8812a_rf_a[] = {
++	0x000, 0x00010000,
++	0x018, 0x0001712A,
++	0x056, 0x00051CF2,
++	0x066, 0x00040000,
++	0x01E, 0x00080000,
++	0x089, 0x00000080,
++	0x80000001,	0x00000000,	0x40000000,	0x00000000,
++	0x086, 0x00014B3A,
++	0x90000001,	0x00000005,	0x40000000,	0x00000000,
++	0x086, 0x00014B3A,
++	0xA0000000,	0x00000000,
++	0x086, 0x00014B38,
++	0xB0000000,	0x00000000,
++	0x80000004,	0x00000000,	0x40000000,	0x00000000,
++	0x08B, 0x00080180,
++	0xA0000000,	0x00000000,
++	0x08B, 0x00087180,
++	0xB0000000,	0x00000000,
++	0x0B1, 0x0001FC1A,
++	0x0B3, 0x000F0810,
++	0x0B4, 0x0001A78D,
++	0x0BA, 0x00086180,
++	0x018, 0x00000006,
++	0x0EF, 0x00002000,
++	0x80000001,	0x00000000,	0x40000000,	0x00000000,
++	0x03B, 0x0003F218,
++	0x03B, 0x00030A58,
++	0x03B, 0x0002FA58,
++	0x03B, 0x00022590,
++	0x03B, 0x0001FA50,
++	0x03B, 0x00010248,
++	0x03B, 0x00008240,
++	0x90000001,	0x00000005,	0x40000000,	0x00000000,
++	0x03B, 0x0003F218,
++	0x03B, 0x00030A58,
++	0x03B, 0x0002FA58,
++	0x03B, 0x00022590,
++	0x03B, 0x0001FA50,
++	0x03B, 0x00010248,
++	0x03B, 0x00008240,
++	0xA0000000,	0x00000000,
++	0x03B, 0x00038A58,
++	0x03B, 0x00037A58,
++	0x03B, 0x0002A590,
++	0x03B, 0x00027A50,
++	0x03B, 0x00018248,
++	0x03B, 0x00010240,
++	0x03B, 0x00008240,
++	0xB0000000,	0x00000000,
++	0x0EF, 0x00000100,
++	0x80000002,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0000A4EE,
++	0x034, 0x00009076,
++	0x034, 0x00008073,
++	0x034, 0x00007070,
++	0x034, 0x0000606D,
++	0x034, 0x0000506A,
++	0x034, 0x00004049,
++	0x034, 0x00003046,
++	0x034, 0x00002028,
++	0x034, 0x00001025,
++	0x034, 0x00000022,
++	0xA0000000,	0x00000000,
++	0x034, 0x0000ADF4,
++	0x034, 0x00009DF1,
++	0x034, 0x00008DEE,
++	0x034, 0x00007DEB,
++	0x034, 0x00006DE8,
++	0x034, 0x00005DE5,
++	0x034, 0x00004DE2,
++	0x034, 0x00003CE6,
++	0x034, 0x000024E7,
++	0x034, 0x000014E4,
++	0x034, 0x000004E1,
++	0xB0000000,	0x00000000,
++	0x0EF, 0x00000000,
++	0x0EF, 0x000020A2,
++	0x0DF, 0x00000080,
++	0x035, 0x00000192,
++	0x035, 0x00008192,
++	0x035, 0x00010192,
++	0x036, 0x00000024,
++	0x036, 0x00008024,
++	0x036, 0x00010024,
++	0x036, 0x00018024,
++	0x0EF, 0x00000000,
++	0x051, 0x00000C21,
++	0x052, 0x000006D9,
++	0x053, 0x000FC649,
++	0x054, 0x0000017E,
++	0x0EF, 0x00000002,
++	0x008, 0x00008400,
++	0x018, 0x0001712A,
++	0x0EF, 0x00001000,
++	0x03A, 0x00000080,
++	0x03B, 0x0003A02C,
++	0x03C, 0x00004000,
++	0x03A, 0x00000400,
++	0x03B, 0x0003202C,
++	0x03C, 0x00010000,
++	0x03A, 0x000000A0,
++	0x03B, 0x0002B064,
++	0x03C, 0x00004000,
++	0x03A, 0x000000D8,
++	0x03B, 0x00023070,
++	0x03C, 0x00004000,
++	0x03A, 0x00000468,
++	0x03B, 0x0001B870,
++	0x03C, 0x00010000,
++	0x03A, 0x00000098,
++	0x03B, 0x00012085,
++	0x03C, 0x000E4000,
++	0x03A, 0x00000418,
++	0x03B, 0x0000A080,
++	0x03C, 0x000F0000,
++	0x03A, 0x00000418,
++	0x03B, 0x00002080,
++	0x03C, 0x00010000,
++	0x03A, 0x00000080,
++	0x03B, 0x0007A02C,
++	0x03C, 0x00004000,
++	0x03A, 0x00000400,
++	0x03B, 0x0007202C,
++	0x03C, 0x00010000,
++	0x03A, 0x000000A0,
++	0x03B, 0x0006B064,
++	0x03C, 0x00004000,
++	0x03A, 0x000000D8,
++	0x03B, 0x00063070,
++	0x03C, 0x00004000,
++	0x03A, 0x00000468,
++	0x03B, 0x0005B870,
++	0x03C, 0x00010000,
++	0x03A, 0x00000098,
++	0x03B, 0x00052085,
++	0x03C, 0x000E4000,
++	0x03A, 0x00000418,
++	0x03B, 0x0004A080,
++	0x03C, 0x000F0000,
++	0x03A, 0x00000418,
++	0x03B, 0x00042080,
++	0x03C, 0x00010000,
++	0x03A, 0x00000080,
++	0x03B, 0x000BA02C,
++	0x03C, 0x00004000,
++	0x03A, 0x00000400,
++	0x03B, 0x000B202C,
++	0x03C, 0x00010000,
++	0x03A, 0x000000A0,
++	0x03B, 0x000AB064,
++	0x03C, 0x00004000,
++	0x03A, 0x000000D8,
++	0x03B, 0x000A3070,
++	0x03C, 0x00004000,
++	0x03A, 0x00000468,
++	0x03B, 0x0009B870,
++	0x03C, 0x00010000,
++	0x03A, 0x00000098,
++	0x03B, 0x00092085,
++	0x03C, 0x000E4000,
++	0x03A, 0x00000418,
++	0x03B, 0x0008A080,
++	0x03C, 0x000F0000,
++	0x03A, 0x00000418,
++	0x03B, 0x00082080,
++	0x03C, 0x00010000,
++	0x0EF, 0x00001100,
++	0x80000008,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0004A0B2,
++	0x034, 0x000490AF,
++	0x034, 0x00048070,
++	0x034, 0x0004706D,
++	0x034, 0x00046050,
++	0x034, 0x0004504D,
++	0x034, 0x0004404A,
++	0x034, 0x00043047,
++	0x034, 0x0004200A,
++	0x034, 0x00041007,
++	0x034, 0x00040004,
++	0x90000008,	0x05000000,	0x40000000,	0x00000000,
++	0x034, 0x0004A0B2,
++	0x034, 0x000490AF,
++	0x034, 0x00048070,
++	0x034, 0x0004706D,
++	0x034, 0x0004604D,
++	0x034, 0x0004504A,
++	0x034, 0x00044047,
++	0x034, 0x00043044,
++	0x034, 0x00042007,
++	0x034, 0x00041004,
++	0x034, 0x00040001,
++	0xA0000000,	0x00000000,
++	0x034, 0x0004ADF5,
++	0x034, 0x00049DF2,
++	0x034, 0x00048DEF,
++	0x034, 0x00047DEC,
++	0x034, 0x00046DE9,
++	0x034, 0x00045DE6,
++	0x034, 0x00044DE3,
++	0x034, 0x000438C8,
++	0x034, 0x000428C5,
++	0x034, 0x000418C2,
++	0x034, 0x000408C0,
++	0xB0000000,	0x00000000,
++	0x80000008,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0002A0B2,
++	0x034, 0x000290AF,
++	0x034, 0x00028070,
++	0x034, 0x0002706D,
++	0x034, 0x00026050,
++	0x034, 0x0002504D,
++	0x034, 0x0002404A,
++	0x034, 0x00023047,
++	0x034, 0x0002200A,
++	0x034, 0x00021007,
++	0x034, 0x00020004,
++	0x90000008,	0x05000000,	0x40000000,	0x00000000,
++	0x034, 0x0002A0B4,
++	0x034, 0x000290B1,
++	0x034, 0x00028072,
++	0x034, 0x0002706F,
++	0x034, 0x0002604F,
++	0x034, 0x0002504C,
++	0x034, 0x00024049,
++	0x034, 0x00023046,
++	0x034, 0x00022009,
++	0x034, 0x00021006,
++	0x034, 0x00020003,
++	0xA0000000,	0x00000000,
++	0x034, 0x0002ADF5,
++	0x034, 0x00029DF2,
++	0x034, 0x00028DEF,
++	0x034, 0x00027DEC,
++	0x034, 0x00026DE9,
++	0x034, 0x00025DE6,
++	0x034, 0x00024DE3,
++	0x034, 0x000238C8,
++	0x034, 0x000228C5,
++	0x034, 0x000218C2,
++	0x034, 0x000208C0,
++	0xB0000000,	0x00000000,
++	0x80000008,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0000A0B2,
++	0x034, 0x000090AF,
++	0x034, 0x00008070,
++	0x034, 0x0000706D,
++	0x034, 0x00006050,
++	0x034, 0x0000504D,
++	0x034, 0x0000404A,
++	0x034, 0x00003047,
++	0x034, 0x0000200A,
++	0x034, 0x00001007,
++	0x034, 0x00000004,
++	0x90000008,	0x05000000,	0x40000000,	0x00000000,
++	0x034, 0x0000A0B2,
++	0x034, 0x000090AF,
++	0x034, 0x00008070,
++	0x034, 0x0000706D,
++	0x034, 0x0000604D,
++	0x034, 0x0000504A,
++	0x034, 0x00004047,
++	0x034, 0x00003044,
++	0x034, 0x00002007,
++	0x034, 0x00001004,
++	0x034, 0x00000001,
++	0xA0000000,	0x00000000,
++	0x034, 0x0000AFF7,
++	0x034, 0x00009DF7,
++	0x034, 0x00008DF4,
++	0x034, 0x00007DF1,
++	0x034, 0x00006DEE,
++	0x034, 0x00005DEB,
++	0x034, 0x00004DE8,
++	0x034, 0x000038CC,
++	0x034, 0x000028C9,
++	0x034, 0x000018C6,
++	0x034, 0x000008C3,
++	0xB0000000,	0x00000000,
++	0x0EF, 0x00000000,
++	0x80000008,	0x00000000,	0x40000000,	0x00000000,
++	0x018, 0x0001712A,
++	0x0EF, 0x00000040,
++	0x035, 0x000001D4,
++	0x035, 0x000081D4,
++	0x035, 0x000101D4,
++	0x035, 0x000201B4,
++	0x035, 0x000281B4,
++	0x035, 0x000301B4,
++	0x035, 0x000401B4,
++	0x035, 0x000481B4,
++	0x035, 0x000501B4,
++	0x90000008,	0x05000000,	0x40000000,	0x00000000,
++	0x018, 0x0001712A,
++	0x0EF, 0x00000040,
++	0x035, 0x000001D4,
++	0x035, 0x000081D4,
++	0x035, 0x000101D4,
++	0x035, 0x000201B4,
++	0x035, 0x000281B4,
++	0x035, 0x000301B4,
++	0x035, 0x000401B4,
++	0x035, 0x000481B4,
++	0x035, 0x000501B4,
++	0xA0000000,	0x00000000,
++	0x018, 0x0001712A,
++	0x0EF, 0x00000040,
++	0x035, 0x00000188,
++	0x035, 0x00008147,
++	0x035, 0x00010147,
++	0x035, 0x000201D7,
++	0x035, 0x000281D7,
++	0x035, 0x000301D7,
++	0x035, 0x000401D8,
++	0x035, 0x000481D8,
++	0x035, 0x000501D8,
++	0xB0000000,	0x00000000,
++	0x0EF, 0x00000000,
++	0x80000008,	0x00000000,	0x40000000,	0x00000000,
++	0x018, 0x0001712A,
++	0x0EF, 0x00000010,
++	0x036, 0x00004BFB,
++	0x036, 0x0000CBFB,
++	0x036, 0x00014BFB,
++	0x036, 0x0001CBFB,
++	0x036, 0x00024F4B,
++	0x036, 0x0002CF4B,
++	0x036, 0x00034F4B,
++	0x036, 0x0003CF4B,
++	0x036, 0x00044F4B,
++	0x036, 0x0004CF4B,
++	0x036, 0x00054F4B,
++	0x036, 0x0005CF4B,
++	0x90000008,	0x05000000,	0x40000000,	0x00000000,
++	0x018, 0x0001712A,
++	0x0EF, 0x00000010,
++	0x036, 0x00004BFB,
++	0x036, 0x0000CBFB,
++	0x036, 0x00014BFB,
++	0x036, 0x0001CBFB,
++	0x036, 0x00024F4B,
++	0x036, 0x0002CF4B,
++	0x036, 0x00034F4B,
++	0x036, 0x0003CF4B,
++	0x036, 0x00044F4B,
++	0x036, 0x0004CF4B,
++	0x036, 0x00054F4B,
++	0x036, 0x0005CF4B,
++	0xA0000000,	0x00000000,
++	0x018, 0x0001712A,
++	0x0EF, 0x00000010,
++	0x036, 0x00084EB4,
++	0x036, 0x0008CC35,
++	0x036, 0x00094C35,
++	0x036, 0x0009CC35,
++	0x036, 0x000A4C35,
++	0x036, 0x000ACC35,
++	0x036, 0x000B4C35,
++	0x036, 0x000BCC35,
++	0x036, 0x000C4C34,
++	0x036, 0x000CCC35,
++	0x036, 0x000D4C35,
++	0x036, 0x000DCC35,
++	0xB0000000,	0x00000000,
++	0x0EF, 0x00000000,
++	0x0EF, 0x00000008,
++	0x80000008,	0x00000000,	0x40000000,	0x00000000,
++	0x03C, 0x000002CC,
++	0x03C, 0x00000522,
++	0x03C, 0x00000902,
++	0x90000008,	0x05000000,	0x40000000,	0x00000000,
++	0x03C, 0x000002CC,
++	0x03C, 0x00000522,
++	0x03C, 0x00000902,
++	0xA0000000,	0x00000000,
++	0x03C, 0x000002A8,
++	0x03C, 0x000005A2,
++	0x03C, 0x00000880,
++	0xB0000000,	0x00000000,
++	0x0EF, 0x00000000,
++	0x018, 0x0001712A,
++	0x0EF, 0x00000002,
++	0x0DF, 0x00000080,
++	0x01F, 0x00000064,
++	0x80000008,	0x00000000,	0x40000000,	0x00000000,
++	0x061, 0x000FDD43,
++	0x062, 0x00038F4B,
++	0x063, 0x00032117,
++	0x064, 0x000194AC,
++	0x065, 0x000931D1,
++	0x90000008,	0x05000000,	0x40000000,	0x00000000,
++	0x061, 0x000FDD43,
++	0x062, 0x00038F4B,
++	0x063, 0x00032117,
++	0x064, 0x000194AC,
++	0x065, 0x000931D2,
++	0xA0000000,	0x00000000,
++	0x061, 0x000E5D53,
++	0x062, 0x00038FCD,
++	0x063, 0x000114EB,
++	0x064, 0x000196AC,
++	0x065, 0x000911D7,
++	0xB0000000,	0x00000000,
++	0x008, 0x00008400,
++	0x01C, 0x000739D2,
++	0x0B4, 0x0001E78D,
++	0x018, 0x0001F12A,
++	0xFFE, 0x00000000,
++	0xFFE, 0x00000000,
++	0xFFE, 0x00000000,
++	0xFFE, 0x00000000,
++	0x0B4, 0x0001A78D,
++	0x018, 0x0001712A,
++};
++
++RTW_DECL_TABLE_RF_RADIO(rtw8812a_rf_a, A);
++
++static const u32 rtw8812a_rf_b[] = {
++	0x056, 0x00051CF2,
++	0x066, 0x00040000,
++	0x089, 0x00000080,
++	0x80000001,	0x00000000,	0x40000000,	0x00000000,
++	0x086, 0x00014B3A,
++	0x90000001,	0x00000005,	0x40000000,	0x00000000,
++	0x086, 0x00014B3A,
++	0xA0000000,	0x00000000,
++	0x086, 0x00014B38,
++	0xB0000000,	0x00000000,
++	0x80000004,	0x00000000,	0x40000000,	0x00000000,
++	0x08B, 0x00080180,
++	0xA0000000,	0x00000000,
++	0x08B, 0x00087180,
++	0xB0000000,	0x00000000,
++	0x018, 0x00000006,
++	0x0EF, 0x00002000,
++	0x80000001,	0x00000000,	0x40000000,	0x00000000,
++	0x03B, 0x0003F218,
++	0x03B, 0x00030A58,
++	0x03B, 0x0002FA58,
++	0x03B, 0x00022590,
++	0x03B, 0x0001FA50,
++	0x03B, 0x00010248,
++	0x03B, 0x00008240,
++	0x90000001,	0x00000005,	0x40000000,	0x00000000,
++	0x03B, 0x0003F218,
++	0x03B, 0x00030A58,
++	0x03B, 0x0002FA58,
++	0x03B, 0x00022590,
++	0x03B, 0x0001FA50,
++	0x03B, 0x00010248,
++	0x03B, 0x00008240,
++	0xA0000000,	0x00000000,
++	0x03B, 0x00038A58,
++	0x03B, 0x00037A58,
++	0x03B, 0x0002A590,
++	0x03B, 0x00027A50,
++	0x03B, 0x00018248,
++	0x03B, 0x00010240,
++	0x03B, 0x00008240,
++	0xB0000000,	0x00000000,
++	0x0EF, 0x00000100,
++	0x80000002,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0000A4EE,
++	0x034, 0x00009076,
++	0x034, 0x00008073,
++	0x034, 0x00007070,
++	0x034, 0x0000606D,
++	0x034, 0x0000506A,
++	0x034, 0x00004049,
++	0x034, 0x00003046,
++	0x034, 0x00002028,
++	0x034, 0x00001025,
++	0x034, 0x00000022,
++	0xA0000000,	0x00000000,
++	0x034, 0x0000ADF4,
++	0x034, 0x00009DF1,
++	0x034, 0x00008DEE,
++	0x034, 0x00007DEB,
++	0x034, 0x00006DE8,
++	0x034, 0x00005DE5,
++	0x034, 0x00004DE2,
++	0x034, 0x00003CE6,
++	0x034, 0x000024E7,
++	0x034, 0x000014E4,
++	0x034, 0x000004E1,
++	0xB0000000,	0x00000000,
++	0x0EF, 0x00000000,
++	0x0EF, 0x000020A2,
++	0x0DF, 0x00000080,
++	0x035, 0x00000192,
++	0x035, 0x00008192,
++	0x035, 0x00010192,
++	0x036, 0x00000024,
++	0x036, 0x00008024,
++	0x036, 0x00010024,
++	0x036, 0x00018024,
++	0x0EF, 0x00000000,
++	0x051, 0x00000C21,
++	0x052, 0x000006D9,
++	0x053, 0x000FC649,
++	0x054, 0x0000017E,
++	0x0EF, 0x00000002,
++	0x008, 0x00008400,
++	0x018, 0x0001712A,
++	0x0EF, 0x00001000,
++	0x03A, 0x00000080,
++	0x03B, 0x0003A02C,
++	0x03C, 0x00004000,
++	0x03A, 0x00000400,
++	0x03B, 0x0003202C,
++	0x03C, 0x00010000,
++	0x03A, 0x000000A0,
++	0x03B, 0x0002B064,
++	0x03C, 0x00004000,
++	0x03A, 0x000000D8,
++	0x03B, 0x00023070,
++	0x03C, 0x00004000,
++	0x03A, 0x00000468,
++	0x03B, 0x0001B870,
++	0x03C, 0x00010000,
++	0x03A, 0x00000098,
++	0x03B, 0x00012085,
++	0x03C, 0x000E4000,
++	0x03A, 0x00000418,
++	0x03B, 0x0000A080,
++	0x03C, 0x000F0000,
++	0x03A, 0x00000418,
++	0x03B, 0x00002080,
++	0x03C, 0x00010000,
++	0x03A, 0x00000080,
++	0x03B, 0x0007A02C,
++	0x03C, 0x00004000,
++	0x03A, 0x00000400,
++	0x03B, 0x0007202C,
++	0x03C, 0x00010000,
++	0x03A, 0x000000A0,
++	0x03B, 0x0006B064,
++	0x03C, 0x00004000,
++	0x03A, 0x000000D8,
++	0x03B, 0x00063070,
++	0x03C, 0x00004000,
++	0x03A, 0x00000468,
++	0x03B, 0x0005B870,
++	0x03C, 0x00010000,
++	0x03A, 0x00000098,
++	0x03B, 0x00052085,
++	0x03C, 0x000E4000,
++	0x03A, 0x00000418,
++	0x03B, 0x0004A080,
++	0x03C, 0x000F0000,
++	0x03A, 0x00000418,
++	0x03B, 0x00042080,
++	0x03C, 0x00010000,
++	0x03A, 0x00000080,
++	0x03B, 0x000BA02C,
++	0x03C, 0x00004000,
++	0x03A, 0x00000400,
++	0x03B, 0x000B202C,
++	0x03C, 0x00010000,
++	0x03A, 0x000000A0,
++	0x03B, 0x000AB064,
++	0x03C, 0x00004000,
++	0x03A, 0x000000D8,
++	0x03B, 0x000A3070,
++	0x03C, 0x00004000,
++	0x03A, 0x00000468,
++	0x03B, 0x0009B870,
++	0x03C, 0x00010000,
++	0x03A, 0x00000098,
++	0x03B, 0x00092085,
++	0x03C, 0x000E4000,
++	0x03A, 0x00000418,
++	0x03B, 0x0008A080,
++	0x03C, 0x000F0000,
++	0x03A, 0x00000418,
++	0x03B, 0x00082080,
++	0x03C, 0x00010000,
++	0x0EF, 0x00001100,
++	0x80000008,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0004A0B2,
++	0x034, 0x000490AF,
++	0x034, 0x00048070,
++	0x034, 0x0004706D,
++	0x034, 0x00046050,
++	0x034, 0x0004504D,
++	0x034, 0x0004404A,
++	0x034, 0x00043047,
++	0x034, 0x0004200A,
++	0x034, 0x00041007,
++	0x034, 0x00040004,
++	0x90000008,	0x05000000,	0x40000000,	0x00000000,
++	0x034, 0x0004A0B1,
++	0x034, 0x000490AE,
++	0x034, 0x0004806F,
++	0x034, 0x0004706C,
++	0x034, 0x0004604C,
++	0x034, 0x00045049,
++	0x034, 0x00044046,
++	0x034, 0x00043043,
++	0x034, 0x00042006,
++	0x034, 0x00041003,
++	0x034, 0x00040000,
++	0xA0000000,	0x00000000,
++	0x034, 0x0004ADF5,
++	0x034, 0x00049DF2,
++	0x034, 0x00048DEF,
++	0x034, 0x00047DEC,
++	0x034, 0x00046DE9,
++	0x034, 0x00045DE6,
++	0x034, 0x00044DE3,
++	0x034, 0x000438C8,
++	0x034, 0x000428C5,
++	0x034, 0x000418C2,
++	0x034, 0x000408C0,
++	0xB0000000,	0x00000000,
++	0x80000008,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0002A0B2,
++	0x034, 0x000290AF,
++	0x034, 0x00028070,
++	0x034, 0x0002706D,
++	0x034, 0x00026050,
++	0x034, 0x0002504D,
++	0x034, 0x0002404A,
++	0x034, 0x00023047,
++	0x034, 0x0002200A,
++	0x034, 0x00021007,
++	0x034, 0x00020004,
++	0x90000008,	0x05000000,	0x40000000,	0x00000000,
++	0x034, 0x0002A0B3,
++	0x034, 0x000290B0,
++	0x034, 0x00028071,
++	0x034, 0x0002706E,
++	0x034, 0x0002604E,
++	0x034, 0x0002504B,
++	0x034, 0x00024048,
++	0x034, 0x00023045,
++	0x034, 0x00022008,
++	0x034, 0x00021005,
++	0x034, 0x00020002,
++	0xA0000000,	0x00000000,
++	0x034, 0x0002ADF5,
++	0x034, 0x00029DF2,
++	0x034, 0x00028DEF,
++	0x034, 0x00027DEC,
++	0x034, 0x00026DE9,
++	0x034, 0x00025DE6,
++	0x034, 0x00024DE3,
++	0x034, 0x000238C8,
++	0x034, 0x000228C5,
++	0x034, 0x000218C2,
++	0x034, 0x000208C0,
++	0xB0000000,	0x00000000,
++	0x80000008,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0000A0B2,
++	0x034, 0x000090AF,
++	0x034, 0x00008070,
++	0x034, 0x0000706D,
++	0x034, 0x00006050,
++	0x034, 0x0000504D,
++	0x034, 0x0000404A,
++	0x034, 0x00003047,
++	0x034, 0x0000200A,
++	0x034, 0x00001007,
++	0x034, 0x00000004,
++	0x90000008,	0x05000000,	0x40000000,	0x00000000,
++	0x034, 0x0000A0B3,
++	0x034, 0x000090B0,
++	0x034, 0x00008070,
++	0x034, 0x0000706D,
++	0x034, 0x0000604D,
++	0x034, 0x0000504A,
++	0x034, 0x00004047,
++	0x034, 0x00003044,
++	0x034, 0x00002007,
++	0x034, 0x00001004,
++	0x034, 0x00000001,
++	0xA0000000,	0x00000000,
++	0x034, 0x0000AFF7,
++	0x034, 0x00009DF7,
++	0x034, 0x00008DF4,
++	0x034, 0x00007DF1,
++	0x034, 0x00006DEE,
++	0x034, 0x00005DEB,
++	0x034, 0x00004DE8,
++	0x034, 0x000038CC,
++	0x034, 0x000028C9,
++	0x034, 0x000018C6,
++	0x034, 0x000008C3,
++	0xB0000000,	0x00000000,
++	0x0EF, 0x00000000,
++	0x80000008,	0x00000000,	0x40000000,	0x00000000,
++	0x018, 0x0001712A,
++	0x0EF, 0x00000040,
++	0x035, 0x000001C5,
++	0x035, 0x000081C5,
++	0x035, 0x000101C5,
++	0x035, 0x00020174,
++	0x035, 0x00028174,
++	0x035, 0x00030174,
++	0x035, 0x00040185,
++	0x035, 0x00048185,
++	0x035, 0x00050185,
++	0x0EF, 0x00000000,
++	0x90000008,	0x05000000,	0x40000000,	0x00000000,
++	0x018, 0x0001712A,
++	0x0EF, 0x00000040,
++	0x035, 0x000001C5,
++	0x035, 0x000081C5,
++	0x035, 0x000101C5,
++	0x035, 0x00020174,
++	0x035, 0x00028174,
++	0x035, 0x00030174,
++	0x035, 0x00040185,
++	0x035, 0x00048185,
++	0x035, 0x00050185,
++	0x0EF, 0x00000000,
++	0xA0000000,	0x00000000,
++	0x018, 0x0001712A,
++	0x0EF, 0x00000040,
++	0x035, 0x00000188,
++	0x035, 0x00008147,
++	0x035, 0x00010147,
++	0x035, 0x000201D7,
++	0x035, 0x000281D7,
++	0x035, 0x000301D7,
++	0x035, 0x000401D8,
++	0x035, 0x000481D8,
++	0x035, 0x000501D8,
++	0x0EF, 0x00000000,
++	0xB0000000,	0x00000000,
++	0x80000008,	0x00000000,	0x40000000,	0x00000000,
++	0x018, 0x0001712A,
++	0x0EF, 0x00000010,
++	0x036, 0x00005B8B,
++	0x036, 0x0000DB8B,
++	0x036, 0x00015B8B,
++	0x036, 0x0001DB8B,
++	0x036, 0x000262DB,
++	0x036, 0x0002E2DB,
++	0x036, 0x000362DB,
++	0x036, 0x0003E2DB,
++	0x036, 0x0004553B,
++	0x036, 0x0004D53B,
++	0x036, 0x0005553B,
++	0x036, 0x0005D53B,
++	0x90000008,	0x05000000,	0x40000000,	0x00000000,
++	0x018, 0x0001712A,
++	0x0EF, 0x00000010,
++	0x036, 0x00005B8B,
++	0x036, 0x0000DB8B,
++	0x036, 0x00015B8B,
++	0x036, 0x0001DB8B,
++	0x036, 0x000262DB,
++	0x036, 0x0002E2DB,
++	0x036, 0x000362DB,
++	0x036, 0x0003E2DB,
++	0x036, 0x0004553B,
++	0x036, 0x0004D53B,
++	0x036, 0x0005553B,
++	0x036, 0x0005D53B,
++	0xA0000000,	0x00000000,
++	0x018, 0x0001712A,
++	0x0EF, 0x00000010,
++	0x036, 0x00084EB4,
++	0x036, 0x0008CC35,
++	0x036, 0x00094C35,
++	0x036, 0x0009CC35,
++	0x036, 0x000A4C35,
++	0x036, 0x000ACC35,
++	0x036, 0x000B4C35,
++	0x036, 0x000BCC35,
++	0x036, 0x000C4C34,
++	0x036, 0x000CCC35,
++	0x036, 0x000D4C35,
++	0x036, 0x000DCC35,
++	0xB0000000,	0x00000000,
++	0x0EF, 0x00000000,
++	0x0EF, 0x00000008,
++	0x80000008,	0x00000000,	0x40000000,	0x00000000,
++	0x03C, 0x000002DC,
++	0x03C, 0x00000524,
++	0x03C, 0x00000902,
++	0x90000008,	0x05000000,	0x40000000,	0x00000000,
++	0x03C, 0x000002DC,
++	0x03C, 0x00000524,
++	0x03C, 0x00000902,
++	0xA0000000,	0x00000000,
++	0x03C, 0x000002A8,
++	0x03C, 0x000005A2,
++	0x03C, 0x00000880,
++	0xB0000000,	0x00000000,
++	0x0EF, 0x00000000,
++	0x018, 0x0001712A,
++	0x0EF, 0x00000002,
++	0x0DF, 0x00000080,
++	0x80000008,	0x00000000,	0x40000000,	0x00000000,
++	0x061, 0x000EAC43,
++	0x062, 0x00038F47,
++	0x063, 0x00031157,
++	0x064, 0x0001C4AC,
++	0x065, 0x000931D1,
++	0x90000008,	0x05000000,	0x40000000,	0x00000000,
++	0x061, 0x000EAC43,
++	0x062, 0x00038F47,
++	0x063, 0x00031157,
++	0x064, 0x0001C4AC,
++	0x065, 0x000931D2,
++	0x90000002,	0x00000000,	0x40000000,	0x00000000,
++	0x061, 0x000EAC43,
++	0x062, 0x00038F47,
++	0x063, 0x00031157,
++	0x064, 0x0001C4AC,
++	0x065, 0x000931D1,
++	0xA0000000,	0x00000000,
++	0x061, 0x000E5D53,
++	0x062, 0x00038FCD,
++	0x063, 0x000114EB,
++	0x064, 0x000196AC,
++	0x065, 0x000911D7,
++	0xB0000000,	0x00000000,
++	0x008, 0x00008400,
++};
++
++RTW_DECL_TABLE_RF_RADIO(rtw8812a_rf_b, B);
++
++static const struct rtw_txpwr_lmt_cfg_pair rtw8812a_txpwr_lmt[] = {
++	{ 0, 0, 0, 0, 1, 36, },
++	{ 2, 0, 0, 0, 1, 32, },
++	{ 1, 0, 0, 0, 1, 32, },
++	{ 0, 0, 0, 0, 2, 36, },
++	{ 2, 0, 0, 0, 2, 32, },
++	{ 1, 0, 0, 0, 2, 32, },
++	{ 0, 0, 0, 0, 3, 36, },
++	{ 2, 0, 0, 0, 3, 32, },
++	{ 1, 0, 0, 0, 3, 32, },
++	{ 0, 0, 0, 0, 4, 36, },
++	{ 2, 0, 0, 0, 4, 32, },
++	{ 1, 0, 0, 0, 4, 32, },
++	{ 0, 0, 0, 0, 5, 36, },
++	{ 2, 0, 0, 0, 5, 32, },
++	{ 1, 0, 0, 0, 5, 32, },
++	{ 0, 0, 0, 0, 6, 36, },
++	{ 2, 0, 0, 0, 6, 32, },
++	{ 1, 0, 0, 0, 6, 32, },
++	{ 0, 0, 0, 0, 7, 36, },
++	{ 2, 0, 0, 0, 7, 32, },
++	{ 1, 0, 0, 0, 7, 32, },
++	{ 0, 0, 0, 0, 8, 36, },
++	{ 2, 0, 0, 0, 8, 32, },
++	{ 1, 0, 0, 0, 8, 32, },
++	{ 0, 0, 0, 0, 9, 36, },
++	{ 2, 0, 0, 0, 9, 32, },
++	{ 1, 0, 0, 0, 9, 32, },
++	{ 0, 0, 0, 0, 10, 36, },
++	{ 2, 0, 0, 0, 10, 32, },
++	{ 1, 0, 0, 0, 10, 32, },
++	{ 0, 0, 0, 0, 11, 36, },
++	{ 2, 0, 0, 0, 11, 32, },
++	{ 1, 0, 0, 0, 11, 32, },
++	{ 0, 0, 0, 0, 12, 63, },
++	{ 2, 0, 0, 0, 12, 32, },
++	{ 1, 0, 0, 0, 12, 32, },
++	{ 0, 0, 0, 0, 13, 63, },
++	{ 2, 0, 0, 0, 13, 32, },
++	{ 1, 0, 0, 0, 13, 32, },
++	{ 0, 0, 0, 0, 14, 63, },
++	{ 2, 0, 0, 0, 14, 63, },
++	{ 1, 0, 0, 0, 14, 32, },
++	{ 0, 0, 0, 1, 1, 34, },
++	{ 2, 0, 0, 1, 1, 32, },
++	{ 1, 0, 0, 1, 1, 32, },
++	{ 0, 0, 0, 1, 2, 36, },
++	{ 2, 0, 0, 1, 2, 32, },
++	{ 1, 0, 0, 1, 2, 32, },
++	{ 0, 0, 0, 1, 3, 36, },
++	{ 2, 0, 0, 1, 3, 32, },
++	{ 1, 0, 0, 1, 3, 32, },
++	{ 0, 0, 0, 1, 4, 36, },
++	{ 2, 0, 0, 1, 4, 32, },
++	{ 1, 0, 0, 1, 4, 32, },
++	{ 0, 0, 0, 1, 5, 36, },
++	{ 2, 0, 0, 1, 5, 32, },
++	{ 1, 0, 0, 1, 5, 32, },
++	{ 0, 0, 0, 1, 6, 36, },
++	{ 2, 0, 0, 1, 6, 32, },
++	{ 1, 0, 0, 1, 6, 32, },
++	{ 0, 0, 0, 1, 7, 36, },
++	{ 2, 0, 0, 1, 7, 32, },
++	{ 1, 0, 0, 1, 7, 32, },
++	{ 0, 0, 0, 1, 8, 36, },
++	{ 2, 0, 0, 1, 8, 32, },
++	{ 1, 0, 0, 1, 8, 32, },
++	{ 0, 0, 0, 1, 9, 36, },
++	{ 2, 0, 0, 1, 9, 32, },
++	{ 1, 0, 0, 1, 9, 32, },
++	{ 0, 0, 0, 1, 10, 36, },
++	{ 2, 0, 0, 1, 10, 32, },
++	{ 1, 0, 0, 1, 10, 32, },
++	{ 0, 0, 0, 1, 11, 32, },
++	{ 2, 0, 0, 1, 11, 32, },
++	{ 1, 0, 0, 1, 11, 32, },
++	{ 0, 0, 0, 1, 12, 63, },
++	{ 2, 0, 0, 1, 12, 32, },
++	{ 1, 0, 0, 1, 12, 32, },
++	{ 0, 0, 0, 1, 13, 63, },
++	{ 2, 0, 0, 1, 13, 32, },
++	{ 1, 0, 0, 1, 13, 32, },
++	{ 0, 0, 0, 1, 14, 63, },
++	{ 2, 0, 0, 1, 14, 63, },
++	{ 1, 0, 0, 1, 14, 63, },
++	{ 0, 0, 0, 2, 1, 34, },
++	{ 2, 0, 0, 2, 1, 32, },
++	{ 1, 0, 0, 2, 1, 32, },
++	{ 0, 0, 0, 2, 2, 36, },
++	{ 2, 0, 0, 2, 2, 32, },
++	{ 1, 0, 0, 2, 2, 32, },
++	{ 0, 0, 0, 2, 3, 36, },
++	{ 2, 0, 0, 2, 3, 32, },
++	{ 1, 0, 0, 2, 3, 32, },
++	{ 0, 0, 0, 2, 4, 36, },
++	{ 2, 0, 0, 2, 4, 32, },
++	{ 1, 0, 0, 2, 4, 32, },
++	{ 0, 0, 0, 2, 5, 36, },
++	{ 2, 0, 0, 2, 5, 32, },
++	{ 1, 0, 0, 2, 5, 32, },
++	{ 0, 0, 0, 2, 6, 36, },
++	{ 2, 0, 0, 2, 6, 32, },
++	{ 1, 0, 0, 2, 6, 32, },
++	{ 0, 0, 0, 2, 7, 36, },
++	{ 2, 0, 0, 2, 7, 32, },
++	{ 1, 0, 0, 2, 7, 32, },
++	{ 0, 0, 0, 2, 8, 36, },
++	{ 2, 0, 0, 2, 8, 32, },
++	{ 1, 0, 0, 2, 8, 32, },
++	{ 0, 0, 0, 2, 9, 36, },
++	{ 2, 0, 0, 2, 9, 32, },
++	{ 1, 0, 0, 2, 9, 32, },
++	{ 0, 0, 0, 2, 10, 36, },
++	{ 2, 0, 0, 2, 10, 32, },
++	{ 1, 0, 0, 2, 10, 32, },
++	{ 0, 0, 0, 2, 11, 32, },
++	{ 2, 0, 0, 2, 11, 32, },
++	{ 1, 0, 0, 2, 11, 32, },
++	{ 0, 0, 0, 2, 12, 63, },
++	{ 2, 0, 0, 2, 12, 32, },
++	{ 1, 0, 0, 2, 12, 32, },
++	{ 0, 0, 0, 2, 13, 63, },
++	{ 2, 0, 0, 2, 13, 32, },
++	{ 1, 0, 0, 2, 13, 32, },
++	{ 0, 0, 0, 2, 14, 63, },
++	{ 2, 0, 0, 2, 14, 63, },
++	{ 1, 0, 0, 2, 14, 63, },
++	{ 0, 0, 0, 3, 1, 32, },
++	{ 2, 0, 0, 3, 1, 32, },
++	{ 1, 0, 0, 3, 1, 32, },
++	{ 0, 0, 0, 3, 2, 34, },
++	{ 2, 0, 0, 3, 2, 32, },
++	{ 1, 0, 0, 3, 2, 32, },
++	{ 0, 0, 0, 3, 3, 34, },
++	{ 2, 0, 0, 3, 3, 32, },
++	{ 1, 0, 0, 3, 3, 32, },
++	{ 0, 0, 0, 3, 4, 34, },
++	{ 2, 0, 0, 3, 4, 32, },
++	{ 1, 0, 0, 3, 4, 32, },
++	{ 0, 0, 0, 3, 5, 34, },
++	{ 2, 0, 0, 3, 5, 32, },
++	{ 1, 0, 0, 3, 5, 32, },
++	{ 0, 0, 0, 3, 6, 34, },
++	{ 2, 0, 0, 3, 6, 32, },
++	{ 1, 0, 0, 3, 6, 32, },
++	{ 0, 0, 0, 3, 7, 34, },
++	{ 2, 0, 0, 3, 7, 32, },
++	{ 1, 0, 0, 3, 7, 32, },
++	{ 0, 0, 0, 3, 8, 34, },
++	{ 2, 0, 0, 3, 8, 32, },
++	{ 1, 0, 0, 3, 8, 32, },
++	{ 0, 0, 0, 3, 9, 34, },
++	{ 2, 0, 0, 3, 9, 32, },
++	{ 1, 0, 0, 3, 9, 32, },
++	{ 0, 0, 0, 3, 10, 34, },
++	{ 2, 0, 0, 3, 10, 32, },
++	{ 1, 0, 0, 3, 10, 32, },
++	{ 0, 0, 0, 3, 11, 30, },
++	{ 2, 0, 0, 3, 11, 32, },
++	{ 1, 0, 0, 3, 11, 32, },
++	{ 0, 0, 0, 3, 12, 63, },
++	{ 2, 0, 0, 3, 12, 32, },
++	{ 1, 0, 0, 3, 12, 32, },
++	{ 0, 0, 0, 3, 13, 63, },
++	{ 2, 0, 0, 3, 13, 32, },
++	{ 1, 0, 0, 3, 13, 32, },
++	{ 0, 0, 0, 3, 14, 63, },
++	{ 2, 0, 0, 3, 14, 63, },
++	{ 1, 0, 0, 3, 14, 63, },
++	{ 0, 0, 1, 2, 1, 63, },
++	{ 2, 0, 1, 2, 1, 63, },
++	{ 1, 0, 1, 2, 1, 63, },
++	{ 0, 0, 1, 2, 2, 63, },
++	{ 2, 0, 1, 2, 2, 63, },
++	{ 1, 0, 1, 2, 2, 63, },
++	{ 0, 0, 1, 2, 3, 32, },
++	{ 2, 0, 1, 2, 3, 32, },
++	{ 1, 0, 1, 2, 3, 32, },
++	{ 0, 0, 1, 2, 4, 36, },
++	{ 2, 0, 1, 2, 4, 32, },
++	{ 1, 0, 1, 2, 4, 32, },
++	{ 0, 0, 1, 2, 5, 36, },
++	{ 2, 0, 1, 2, 5, 32, },
++	{ 1, 0, 1, 2, 5, 32, },
++	{ 0, 0, 1, 2, 6, 36, },
++	{ 2, 0, 1, 2, 6, 32, },
++	{ 1, 0, 1, 2, 6, 32, },
++	{ 0, 0, 1, 2, 7, 36, },
++	{ 2, 0, 1, 2, 7, 32, },
++	{ 1, 0, 1, 2, 7, 32, },
++	{ 0, 0, 1, 2, 8, 36, },
++	{ 2, 0, 1, 2, 8, 32, },
++	{ 1, 0, 1, 2, 8, 32, },
++	{ 0, 0, 1, 2, 9, 36, },
++	{ 2, 0, 1, 2, 9, 32, },
++	{ 1, 0, 1, 2, 9, 32, },
++	{ 0, 0, 1, 2, 10, 36, },
++	{ 2, 0, 1, 2, 10, 32, },
++	{ 1, 0, 1, 2, 10, 32, },
++	{ 0, 0, 1, 2, 11, 32, },
++	{ 2, 0, 1, 2, 11, 32, },
++	{ 1, 0, 1, 2, 11, 32, },
++	{ 0, 0, 1, 2, 12, 63, },
++	{ 2, 0, 1, 2, 12, 32, },
++	{ 1, 0, 1, 2, 12, 32, },
++	{ 0, 0, 1, 2, 13, 63, },
++	{ 2, 0, 1, 2, 13, 32, },
++	{ 1, 0, 1, 2, 13, 32, },
++	{ 0, 0, 1, 2, 14, 63, },
++	{ 2, 0, 1, 2, 14, 63, },
++	{ 1, 0, 1, 2, 14, 63, },
++	{ 0, 0, 1, 3, 1, 63, },
++	{ 2, 0, 1, 3, 1, 63, },
++	{ 1, 0, 1, 3, 1, 63, },
++	{ 0, 0, 1, 3, 2, 63, },
++	{ 2, 0, 1, 3, 2, 63, },
++	{ 1, 0, 1, 3, 2, 63, },
++	{ 0, 0, 1, 3, 3, 30, },
++	{ 2, 0, 1, 3, 3, 30, },
++	{ 1, 0, 1, 3, 3, 30, },
++	{ 0, 0, 1, 3, 4, 34, },
++	{ 2, 0, 1, 3, 4, 30, },
++	{ 1, 0, 1, 3, 4, 30, },
++	{ 0, 0, 1, 3, 5, 34, },
++	{ 2, 0, 1, 3, 5, 30, },
++	{ 1, 0, 1, 3, 5, 30, },
++	{ 0, 0, 1, 3, 6, 34, },
++	{ 2, 0, 1, 3, 6, 30, },
++	{ 1, 0, 1, 3, 6, 30, },
++	{ 0, 0, 1, 3, 7, 34, },
++	{ 2, 0, 1, 3, 7, 30, },
++	{ 1, 0, 1, 3, 7, 30, },
++	{ 0, 0, 1, 3, 8, 34, },
++	{ 2, 0, 1, 3, 8, 30, },
++	{ 1, 0, 1, 3, 8, 30, },
++	{ 0, 0, 1, 3, 9, 34, },
++	{ 2, 0, 1, 3, 9, 30, },
++	{ 1, 0, 1, 3, 9, 30, },
++	{ 0, 0, 1, 3, 10, 34, },
++	{ 2, 0, 1, 3, 10, 30, },
++	{ 1, 0, 1, 3, 10, 30, },
++	{ 0, 0, 1, 3, 11, 30, },
++	{ 2, 0, 1, 3, 11, 30, },
++	{ 1, 0, 1, 3, 11, 30, },
++	{ 0, 0, 1, 3, 12, 63, },
++	{ 2, 0, 1, 3, 12, 32, },
++	{ 1, 0, 1, 3, 12, 32, },
++	{ 0, 0, 1, 3, 13, 63, },
++	{ 2, 0, 1, 3, 13, 32, },
++	{ 1, 0, 1, 3, 13, 32, },
++	{ 0, 0, 1, 3, 14, 63, },
++	{ 2, 0, 1, 3, 14, 63, },
++	{ 1, 0, 1, 3, 14, 63, },
++	{ 0, 1, 0, 1, 36, 30, },
++	{ 2, 1, 0, 1, 36, 32, },
++	{ 1, 1, 0, 1, 36, 32, },
++	{ 0, 1, 0, 1, 40, 30, },
++	{ 2, 1, 0, 1, 40, 32, },
++	{ 1, 1, 0, 1, 40, 32, },
++	{ 0, 1, 0, 1, 44, 30, },
++	{ 2, 1, 0, 1, 44, 32, },
++	{ 1, 1, 0, 1, 44, 32, },
++	{ 0, 1, 0, 1, 48, 30, },
++	{ 2, 1, 0, 1, 48, 32, },
++	{ 1, 1, 0, 1, 48, 32, },
++	{ 0, 1, 0, 1, 52, 36, },
++	{ 2, 1, 0, 1, 52, 32, },
++	{ 1, 1, 0, 1, 52, 32, },
++	{ 0, 1, 0, 1, 56, 34, },
++	{ 2, 1, 0, 1, 56, 32, },
++	{ 1, 1, 0, 1, 56, 32, },
++	{ 0, 1, 0, 1, 60, 32, },
++	{ 2, 1, 0, 1, 60, 32, },
++	{ 1, 1, 0, 1, 60, 32, },
++	{ 0, 1, 0, 1, 64, 28, },
++	{ 2, 1, 0, 1, 64, 32, },
++	{ 1, 1, 0, 1, 64, 32, },
++	{ 0, 1, 0, 1, 100, 30, },
++	{ 2, 1, 0, 1, 100, 32, },
++	{ 1, 1, 0, 1, 100, 32, },
++	{ 0, 1, 0, 1, 104, 30, },
++	{ 2, 1, 0, 1, 104, 32, },
++	{ 1, 1, 0, 1, 104, 32, },
++	{ 0, 1, 0, 1, 108, 32, },
++	{ 2, 1, 0, 1, 108, 32, },
++	{ 1, 1, 0, 1, 108, 32, },
++	{ 0, 1, 0, 1, 112, 34, },
++	{ 2, 1, 0, 1, 112, 32, },
++	{ 1, 1, 0, 1, 112, 32, },
++	{ 0, 1, 0, 1, 116, 34, },
++	{ 2, 1, 0, 1, 116, 32, },
++	{ 1, 1, 0, 1, 116, 32, },
++	{ 0, 1, 0, 1, 120, 36, },
++	{ 2, 1, 0, 1, 120, 32, },
++	{ 1, 1, 0, 1, 120, 32, },
++	{ 0, 1, 0, 1, 124, 34, },
++	{ 2, 1, 0, 1, 124, 32, },
++	{ 1, 1, 0, 1, 124, 32, },
++	{ 0, 1, 0, 1, 128, 32, },
++	{ 2, 1, 0, 1, 128, 32, },
++	{ 1, 1, 0, 1, 128, 32, },
++	{ 0, 1, 0, 1, 132, 30, },
++	{ 2, 1, 0, 1, 132, 32, },
++	{ 1, 1, 0, 1, 132, 32, },
++	{ 0, 1, 0, 1, 136, 30, },
++	{ 2, 1, 0, 1, 136, 32, },
++	{ 1, 1, 0, 1, 136, 32, },
++	{ 0, 1, 0, 1, 140, 28, },
++	{ 2, 1, 0, 1, 140, 32, },
++	{ 1, 1, 0, 1, 140, 32, },
++	{ 0, 1, 0, 1, 149, 36, },
++	{ 2, 1, 0, 1, 149, 32, },
++	{ 1, 1, 0, 1, 149, 63, },
++	{ 0, 1, 0, 1, 153, 36, },
++	{ 2, 1, 0, 1, 153, 32, },
++	{ 1, 1, 0, 1, 153, 63, },
++	{ 0, 1, 0, 1, 157, 36, },
++	{ 2, 1, 0, 1, 157, 32, },
++	{ 1, 1, 0, 1, 157, 63, },
++	{ 0, 1, 0, 1, 161, 36, },
++	{ 2, 1, 0, 1, 161, 32, },
++	{ 1, 1, 0, 1, 161, 63, },
++	{ 0, 1, 0, 1, 165, 36, },
++	{ 2, 1, 0, 1, 165, 32, },
++	{ 1, 1, 0, 1, 165, 63, },
++	{ 0, 1, 0, 2, 36, 30, },
++	{ 2, 1, 0, 2, 36, 32, },
++	{ 1, 1, 0, 2, 36, 32, },
++	{ 0, 1, 0, 2, 40, 30, },
++	{ 2, 1, 0, 2, 40, 32, },
++	{ 1, 1, 0, 2, 40, 32, },
++	{ 0, 1, 0, 2, 44, 30, },
++	{ 2, 1, 0, 2, 44, 32, },
++	{ 1, 1, 0, 2, 44, 32, },
++	{ 0, 1, 0, 2, 48, 30, },
++	{ 2, 1, 0, 2, 48, 32, },
++	{ 1, 1, 0, 2, 48, 32, },
++	{ 0, 1, 0, 2, 52, 36, },
++	{ 2, 1, 0, 2, 52, 32, },
++	{ 1, 1, 0, 2, 52, 32, },
++	{ 0, 1, 0, 2, 56, 34, },
++	{ 2, 1, 0, 2, 56, 32, },
++	{ 1, 1, 0, 2, 56, 32, },
++	{ 0, 1, 0, 2, 60, 32, },
++	{ 2, 1, 0, 2, 60, 32, },
++	{ 1, 1, 0, 2, 60, 32, },
++	{ 0, 1, 0, 2, 64, 28, },
++	{ 2, 1, 0, 2, 64, 32, },
++	{ 1, 1, 0, 2, 64, 32, },
++	{ 0, 1, 0, 2, 100, 30, },
++	{ 2, 1, 0, 2, 100, 32, },
++	{ 1, 1, 0, 2, 100, 32, },
++	{ 0, 1, 0, 2, 104, 30, },
++	{ 2, 1, 0, 2, 104, 32, },
++	{ 1, 1, 0, 2, 104, 32, },
++	{ 0, 1, 0, 2, 108, 32, },
++	{ 2, 1, 0, 2, 108, 32, },
++	{ 1, 1, 0, 2, 108, 32, },
++	{ 0, 1, 0, 2, 112, 34, },
++	{ 2, 1, 0, 2, 112, 32, },
++	{ 1, 1, 0, 2, 112, 32, },
++	{ 0, 1, 0, 2, 116, 34, },
++	{ 2, 1, 0, 2, 116, 32, },
++	{ 1, 1, 0, 2, 116, 32, },
++	{ 0, 1, 0, 2, 120, 36, },
++	{ 2, 1, 0, 2, 120, 32, },
++	{ 1, 1, 0, 2, 120, 32, },
++	{ 0, 1, 0, 2, 124, 34, },
++	{ 2, 1, 0, 2, 124, 32, },
++	{ 1, 1, 0, 2, 124, 32, },
++	{ 0, 1, 0, 2, 128, 32, },
++	{ 2, 1, 0, 2, 128, 32, },
++	{ 1, 1, 0, 2, 128, 32, },
++	{ 0, 1, 0, 2, 132, 30, },
++	{ 2, 1, 0, 2, 132, 32, },
++	{ 1, 1, 0, 2, 132, 32, },
++	{ 0, 1, 0, 2, 136, 30, },
++	{ 2, 1, 0, 2, 136, 32, },
++	{ 1, 1, 0, 2, 136, 32, },
++	{ 0, 1, 0, 2, 140, 28, },
++	{ 2, 1, 0, 2, 140, 32, },
++	{ 1, 1, 0, 2, 140, 32, },
++	{ 0, 1, 0, 2, 149, 36, },
++	{ 2, 1, 0, 2, 149, 32, },
++	{ 1, 1, 0, 2, 149, 63, },
++	{ 0, 1, 0, 2, 153, 36, },
++	{ 2, 1, 0, 2, 153, 32, },
++	{ 1, 1, 0, 2, 153, 63, },
++	{ 0, 1, 0, 2, 157, 36, },
++	{ 2, 1, 0, 2, 157, 32, },
++	{ 1, 1, 0, 2, 157, 63, },
++	{ 0, 1, 0, 2, 161, 36, },
++	{ 2, 1, 0, 2, 161, 32, },
++	{ 1, 1, 0, 2, 161, 63, },
++	{ 0, 1, 0, 2, 165, 36, },
++	{ 2, 1, 0, 2, 165, 32, },
++	{ 1, 1, 0, 2, 165, 63, },
++	{ 0, 1, 0, 3, 36, 28, },
++	{ 2, 1, 0, 3, 36, 30, },
++	{ 1, 1, 0, 3, 36, 30, },
++	{ 0, 1, 0, 3, 40, 28, },
++	{ 2, 1, 0, 3, 40, 30, },
++	{ 1, 1, 0, 3, 40, 30, },
++	{ 0, 1, 0, 3, 44, 28, },
++	{ 2, 1, 0, 3, 44, 30, },
++	{ 1, 1, 0, 3, 44, 30, },
++	{ 0, 1, 0, 3, 48, 28, },
++	{ 2, 1, 0, 3, 48, 30, },
++	{ 1, 1, 0, 3, 48, 30, },
++	{ 0, 1, 0, 3, 52, 34, },
++	{ 2, 1, 0, 3, 52, 30, },
++	{ 1, 1, 0, 3, 52, 30, },
++	{ 0, 1, 0, 3, 56, 32, },
++	{ 2, 1, 0, 3, 56, 30, },
++	{ 1, 1, 0, 3, 56, 30, },
++	{ 0, 1, 0, 3, 60, 30, },
++	{ 2, 1, 0, 3, 60, 30, },
++	{ 1, 1, 0, 3, 60, 30, },
++	{ 0, 1, 0, 3, 64, 26, },
++	{ 2, 1, 0, 3, 64, 30, },
++	{ 1, 1, 0, 3, 64, 30, },
++	{ 0, 1, 0, 3, 100, 28, },
++	{ 2, 1, 0, 3, 100, 30, },
++	{ 1, 1, 0, 3, 100, 30, },
++	{ 0, 1, 0, 3, 104, 28, },
++	{ 2, 1, 0, 3, 104, 30, },
++	{ 1, 1, 0, 3, 104, 30, },
++	{ 0, 1, 0, 3, 108, 30, },
++	{ 2, 1, 0, 3, 108, 30, },
++	{ 1, 1, 0, 3, 108, 30, },
++	{ 0, 1, 0, 3, 112, 32, },
++	{ 2, 1, 0, 3, 112, 30, },
++	{ 1, 1, 0, 3, 112, 30, },
++	{ 0, 1, 0, 3, 116, 32, },
++	{ 2, 1, 0, 3, 116, 30, },
++	{ 1, 1, 0, 3, 116, 30, },
++	{ 0, 1, 0, 3, 120, 34, },
++	{ 2, 1, 0, 3, 120, 30, },
++	{ 1, 1, 0, 3, 120, 30, },
++	{ 0, 1, 0, 3, 124, 32, },
++	{ 2, 1, 0, 3, 124, 30, },
++	{ 1, 1, 0, 3, 124, 30, },
++	{ 0, 1, 0, 3, 128, 30, },
++	{ 2, 1, 0, 3, 128, 30, },
++	{ 1, 1, 0, 3, 128, 30, },
++	{ 0, 1, 0, 3, 132, 28, },
++	{ 2, 1, 0, 3, 132, 30, },
++	{ 1, 1, 0, 3, 132, 30, },
++	{ 0, 1, 0, 3, 136, 28, },
++	{ 2, 1, 0, 3, 136, 30, },
++	{ 1, 1, 0, 3, 136, 30, },
++	{ 0, 1, 0, 3, 140, 26, },
++	{ 2, 1, 0, 3, 140, 30, },
++	{ 1, 1, 0, 3, 140, 30, },
++	{ 0, 1, 0, 3, 149, 34, },
++	{ 2, 1, 0, 3, 149, 30, },
++	{ 1, 1, 0, 3, 149, 63, },
++	{ 0, 1, 0, 3, 153, 34, },
++	{ 2, 1, 0, 3, 153, 30, },
++	{ 1, 1, 0, 3, 153, 63, },
++	{ 0, 1, 0, 3, 157, 34, },
++	{ 2, 1, 0, 3, 157, 30, },
++	{ 1, 1, 0, 3, 157, 63, },
++	{ 0, 1, 0, 3, 161, 34, },
++	{ 2, 1, 0, 3, 161, 30, },
++	{ 1, 1, 0, 3, 161, 63, },
++	{ 0, 1, 0, 3, 165, 34, },
++	{ 2, 1, 0, 3, 165, 30, },
++	{ 1, 1, 0, 3, 165, 63, },
++	{ 0, 1, 1, 2, 38, 30, },
++	{ 2, 1, 1, 2, 38, 32, },
++	{ 1, 1, 1, 2, 38, 32, },
++	{ 0, 1, 1, 2, 46, 30, },
++	{ 2, 1, 1, 2, 46, 32, },
++	{ 1, 1, 1, 2, 46, 32, },
++	{ 0, 1, 1, 2, 54, 32, },
++	{ 2, 1, 1, 2, 54, 32, },
++	{ 1, 1, 1, 2, 54, 32, },
++	{ 0, 1, 1, 2, 62, 32, },
++	{ 2, 1, 1, 2, 62, 32, },
++	{ 1, 1, 1, 2, 62, 32, },
++	{ 0, 1, 1, 2, 102, 28, },
++	{ 2, 1, 1, 2, 102, 32, },
++	{ 1, 1, 1, 2, 102, 32, },
++	{ 0, 1, 1, 2, 110, 32, },
++	{ 2, 1, 1, 2, 110, 32, },
++	{ 1, 1, 1, 2, 110, 32, },
++	{ 0, 1, 1, 2, 118, 36, },
++	{ 2, 1, 1, 2, 118, 32, },
++	{ 1, 1, 1, 2, 118, 32, },
++	{ 0, 1, 1, 2, 126, 34, },
++	{ 2, 1, 1, 2, 126, 32, },
++	{ 1, 1, 1, 2, 126, 32, },
++	{ 0, 1, 1, 2, 134, 32, },
++	{ 2, 1, 1, 2, 134, 32, },
++	{ 1, 1, 1, 2, 134, 32, },
++	{ 0, 1, 1, 2, 151, 36, },
++	{ 2, 1, 1, 2, 151, 32, },
++	{ 1, 1, 1, 2, 151, 63, },
++	{ 0, 1, 1, 2, 159, 36, },
++	{ 2, 1, 1, 2, 159, 32, },
++	{ 1, 1, 1, 2, 159, 63, },
++	{ 0, 1, 1, 3, 38, 28, },
++	{ 2, 1, 1, 3, 38, 30, },
++	{ 1, 1, 1, 3, 38, 30, },
++	{ 0, 1, 1, 3, 46, 28, },
++	{ 2, 1, 1, 3, 46, 30, },
++	{ 1, 1, 1, 3, 46, 30, },
++	{ 0, 1, 1, 3, 54, 30, },
++	{ 2, 1, 1, 3, 54, 30, },
++	{ 1, 1, 1, 3, 54, 30, },
++	{ 0, 1, 1, 3, 62, 30, },
++	{ 2, 1, 1, 3, 62, 30, },
++	{ 1, 1, 1, 3, 62, 30, },
++	{ 0, 1, 1, 3, 102, 26, },
++	{ 2, 1, 1, 3, 102, 30, },
++	{ 1, 1, 1, 3, 102, 30, },
++	{ 0, 1, 1, 3, 110, 30, },
++	{ 2, 1, 1, 3, 110, 30, },
++	{ 1, 1, 1, 3, 110, 30, },
++	{ 0, 1, 1, 3, 118, 34, },
++	{ 2, 1, 1, 3, 118, 30, },
++	{ 1, 1, 1, 3, 118, 30, },
++	{ 0, 1, 1, 3, 126, 32, },
++	{ 2, 1, 1, 3, 126, 30, },
++	{ 1, 1, 1, 3, 126, 30, },
++	{ 0, 1, 1, 3, 134, 30, },
++	{ 2, 1, 1, 3, 134, 30, },
++	{ 1, 1, 1, 3, 134, 30, },
++	{ 0, 1, 1, 3, 151, 34, },
++	{ 2, 1, 1, 3, 151, 30, },
++	{ 1, 1, 1, 3, 151, 63, },
++	{ 0, 1, 1, 3, 159, 34, },
++	{ 2, 1, 1, 3, 159, 30, },
++	{ 1, 1, 1, 3, 159, 63, },
++	{ 0, 1, 2, 4, 42, 30, },
++	{ 2, 1, 2, 4, 42, 32, },
++	{ 1, 1, 2, 4, 42, 32, },
++	{ 0, 1, 2, 4, 58, 28, },
++	{ 2, 1, 2, 4, 58, 32, },
++	{ 1, 1, 2, 4, 58, 32, },
++	{ 0, 1, 2, 4, 106, 30, },
++	{ 2, 1, 2, 4, 106, 32, },
++	{ 1, 1, 2, 4, 106, 32, },
++	{ 0, 1, 2, 4, 122, 34, },
++	{ 2, 1, 2, 4, 122, 32, },
++	{ 1, 1, 2, 4, 122, 32, },
++	{ 0, 1, 2, 4, 155, 36, },
++	{ 2, 1, 2, 4, 155, 32, },
++	{ 1, 1, 2, 4, 155, 63, },
++	{ 0, 1, 2, 5, 42, 28, },
++	{ 2, 1, 2, 5, 42, 30, },
++	{ 1, 1, 2, 5, 42, 30, },
++	{ 0, 1, 2, 5, 58, 26, },
++	{ 2, 1, 2, 5, 58, 30, },
++	{ 1, 1, 2, 5, 58, 30, },
++	{ 0, 1, 2, 5, 106, 28, },
++	{ 2, 1, 2, 5, 106, 30, },
++	{ 1, 1, 2, 5, 106, 30, },
++	{ 0, 1, 2, 5, 122, 32, },
++	{ 2, 1, 2, 5, 122, 30, },
++	{ 1, 1, 2, 5, 122, 30, },
++	{ 0, 1, 2, 5, 155, 34, },
++	{ 2, 1, 2, 5, 155, 30, },
++	{ 1, 1, 2, 5, 155, 63, },
++};
++
++RTW_DECL_TABLE_TXPWR_LMT(rtw8812a_txpwr_lmt);
++
++static const struct rtw_pwr_seq_cmd trans_carddis_to_cardemu_8812a[] = {
++	{0x0012,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(0), BIT(0)},
++	{0x0014,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0x80, 0},
++	{0x0015,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0x01, 0},
++	{0x0023,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0x10, 0},
++	{0x0046,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0x00},
++	{0x0043,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0x00},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_PCI_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(2), 0},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(3), 0},
++	{0x0003,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(2), BIT(2)},
++	{0x0301,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_PCI_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0},
++	{0x0024,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(1), BIT(1)},
++	{0x0028,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(3), BIT(3)},
++	{0xFFFF,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 0,
++	 RTW_PWR_CMD_END, 0, 0},
++};
++
++static const struct rtw_pwr_seq_cmd trans_cardemu_to_act_8812a[] = {
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(2), 0},
++	{0x0006,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_POLLING, BIT(1), BIT(1)},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_PCI_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(7), 0},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(3), 0},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(0), BIT(0)},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_POLLING, BIT(0), 0},
++	{0x0024,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(1), 0},
++	{0x0028,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(3), 0},
++	{0xFFFF,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 0,
++	 RTW_PWR_CMD_END, 0, 0},
++};
++
++static const struct rtw_pwr_seq_cmd trans_act_to_lps_8812a[] = {
++	{0x0301,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_PCI_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0xFF},
++	{0x0522,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0x7F},
++	{0x05F8,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_POLLING, 0xFF, 0},
++	{0x05F9,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_POLLING, 0xFF, 0},
++	{0x05FA,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_POLLING, 0xFF, 0},
++	{0x05FB,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_POLLING, 0xFF, 0},
++	{0x0c00,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0x04},
++	{0x0e00,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0x04},
++	{0x0002,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(0), 0},
++	{0x0002,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_DELAY, 0, RTW_PWR_DELAY_US},
++	{0x0002,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(1), 0},
++	{0x0100,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0x03},
++	{0x0101,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(1), 0},
++	{0x0553,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(5), BIT(5)},
++	{0xFFFF,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 0,
++	 RTW_PWR_CMD_END, 0, 0},
++};
++
++static const struct rtw_pwr_seq_cmd trans_act_to_cardemu_8812a[] = {
++	{0x0c00,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0x04},
++	{0x0e00,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0x04},
++	{0x0002,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(0), 0},
++	{0x0002,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_DELAY, 0, RTW_PWR_DELAY_US},
++	{0x0002,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_PCI_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(1), 0},
++	{0x0007,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0x2A},
++	{0x0008,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0x02, 0},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(1), BIT(1)},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_POLLING, BIT(1), 0},
++	{0xFFFF,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 0,
++	 RTW_PWR_CMD_END, 0, 0},
++};
++
++static const struct rtw_pwr_seq_cmd trans_cardemu_to_carddis_8812a[] = {
++	{0x0003,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(2), 0},
++	{0x0080,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0x05},
++	{0x0042,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xF0, 0xcc},
++	{0x0042,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_PCI_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xF0, 0xEC},
++	{0x0043,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0x07},
++	{0x0045,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0x00},
++	{0x0046,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0xff},
++	{0x0047,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0},
++	{0x0014,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0x80, BIT(7)},
++	{0x0015,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0x01, BIT(0)},
++	{0x0012,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0x01, 0},
++	{0x0023,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0x10, BIT(4)},
++	{0x0008,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0x02, 0},
++	{0x0007,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0x20},
++	{0x001f,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(1), 0},
++	{0x0076,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(1), 0},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(3), BIT(3)},
++	{0xFFFF,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 0,
++	 RTW_PWR_CMD_END, 0, 0},
++};
++
++const struct rtw_pwr_seq_cmd * const card_enable_flow_8812a[] = {
++	trans_carddis_to_cardemu_8812a,
++	trans_cardemu_to_act_8812a,
++	NULL
++};
++
++const struct rtw_pwr_seq_cmd * const enter_lps_flow_8812a[] = {
++	trans_act_to_lps_8812a,
++	NULL
++};
++
++const struct rtw_pwr_seq_cmd * const card_disable_flow_8812a[] = {
++	trans_act_to_cardemu_8812a,
++	trans_cardemu_to_carddis_8812a,
++	NULL
++};
++
++static const u8 rtw8812a_pwrtrk_5gb_n[][RTW_PWR_TRK_TBL_SZ] = {
++	{0, 1, 1, 2, 2, 3, 4, 5, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12,
++	 12, 13, 13, 14, 14, 14, 14, 14, 14},
++	{0, 1, 1, 2, 2, 3, 4, 4, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12,
++	 12, 13, 13, 14, 14, 14, 14, 14, 14},
++	{0, 1, 1, 2, 2, 3, 4, 5, 6, 6, 7, 8, 8, 9, 10, 10, 11, 11, 12, 12, 13,
++	 13, 14, 14, 15, 16, 16, 16, 16, 16},
++};
++
++static const u8 rtw8812a_pwrtrk_5gb_p[][RTW_PWR_TRK_TBL_SZ] = {
++	{0, 1, 1, 2, 2, 3, 3, 4, 5, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 11,
++	 11, 11, 11, 11, 11, 11, 11, 11, 11},
++	{0, 1, 1, 2, 3, 3, 4, 5, 5, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 11,
++	 11, 11, 11, 11, 11, 11, 11, 11, 11},
++	{0, 1, 1, 2, 3, 3, 4, 5, 6, 7, 7, 8, 8, 9, 9, 10, 11, 11, 11, 11, 11,
++	 11, 11, 11, 11, 11, 11, 11, 11, 11},
++};
++
++static const u8 rtw8812a_pwrtrk_5ga_n[][RTW_PWR_TRK_TBL_SZ] = {
++	{0, 1, 1, 2, 2, 3, 4, 5, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12,
++	 12, 13, 13, 14, 15, 15, 15, 15, 15},
++	{0, 1, 1, 2, 2, 3, 4, 5, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12,
++	 12, 13, 13, 14, 15, 15, 15, 15, 15},
++	{0, 1, 1, 2, 2, 3, 4, 5, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12,
++	 12, 13, 13, 14, 15, 15, 15, 15, 15},
++};
++
++static const u8 rtw8812a_pwrtrk_5ga_p[][RTW_PWR_TRK_TBL_SZ] = {
++	{0, 1, 1, 2, 2, 3, 4, 5, 6, 7, 7, 8, 8, 9, 10, 11, 11, 11, 11, 11, 11,
++	 11, 11, 11, 11, 11, 11, 11, 11, 11},
++	{0, 1, 1, 2, 3, 3, 4, 5, 6, 7, 7, 8, 8, 9, 10, 11, 11, 11, 11, 11, 11,
++	 11, 11, 11, 11, 11, 11, 11, 11, 11},
++	{0, 1, 1, 2, 3, 3, 4, 5, 6, 7, 7, 8, 8, 9, 10, 11, 11, 12, 12, 11, 11,
++	 11, 11, 11, 11, 11, 11, 11, 11, 11},
++};
++
++static const u8 rtw8812a_pwrtrk_2gb_n[] = {
++	0, 1, 1, 2, 2, 2, 3, 3, 3, 4, 4, 5, 5, 5, 6, 6,
++	7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 11, 11, 11, 11
++};
++
++static const u8 rtw8812a_pwrtrk_2gb_p[] = {
++	0, 1, 1, 2, 2, 2, 3, 3, 3, 4, 4, 4, 5, 5, 5, 6,
++	6, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7
++};
++
++static const u8 rtw8812a_pwrtrk_2ga_n[] = {
++	0, 1, 1, 2, 2, 2, 3, 3, 3, 4, 4, 4, 5, 5, 5, 6,
++	6, 6, 7, 7, 7, 8, 8, 9, 10, 10, 10, 10, 10, 10
++};
++
++static const u8 rtw8812a_pwrtrk_2ga_p[] = {
++	0, 1, 1, 2, 2, 2, 3, 3, 3, 4, 4, 4, 5, 5, 5, 6,
++	6, 6, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7
++};
++
++static const u8 rtw8812a_pwrtrk_2g_cck_b_n[] = {
++	0, 1, 1, 2, 2, 2, 3, 3, 3, 4, 4, 5, 5, 5, 6, 6,
++	7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 11, 11, 11, 11
++};
++
++static const u8 rtw8812a_pwrtrk_2g_cck_b_p[] = {
++	0, 1, 1, 2, 2, 2, 3, 3, 3, 4, 4, 4, 5, 5, 5, 6,
++	6, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7
++};
++
++static const u8 rtw8812a_pwrtrk_2g_cck_a_n[] = {
++	0, 1, 1, 2, 2, 2, 3, 3, 3, 4, 4, 4, 5, 5, 5, 6,
++	6, 6, 7, 7, 7, 8, 8, 9, 10, 10, 10, 10, 10, 10
++};
++
++static const u8 rtw8812a_pwrtrk_2g_cck_a_p[] = {
++	0, 1, 1, 2, 2, 2, 3, 3, 3, 4, 4, 4, 5, 5, 5, 6,
++	6, 6, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7, 7
++};
++
++const struct rtw_pwr_track_tbl rtw8812a_rtw_pwr_track_tbl = {
++	.pwrtrk_5gb_n[0] = rtw8812a_pwrtrk_5gb_n[0],
++	.pwrtrk_5gb_n[1] = rtw8812a_pwrtrk_5gb_n[1],
++	.pwrtrk_5gb_n[2] = rtw8812a_pwrtrk_5gb_n[2],
++	.pwrtrk_5gb_p[0] = rtw8812a_pwrtrk_5gb_p[0],
++	.pwrtrk_5gb_p[1] = rtw8812a_pwrtrk_5gb_p[1],
++	.pwrtrk_5gb_p[2] = rtw8812a_pwrtrk_5gb_p[2],
++	.pwrtrk_5ga_n[0] = rtw8812a_pwrtrk_5ga_n[0],
++	.pwrtrk_5ga_n[1] = rtw8812a_pwrtrk_5ga_n[1],
++	.pwrtrk_5ga_n[2] = rtw8812a_pwrtrk_5ga_n[2],
++	.pwrtrk_5ga_p[0] = rtw8812a_pwrtrk_5ga_p[0],
++	.pwrtrk_5ga_p[1] = rtw8812a_pwrtrk_5ga_p[1],
++	.pwrtrk_5ga_p[2] = rtw8812a_pwrtrk_5ga_p[2],
++	.pwrtrk_2gb_n = rtw8812a_pwrtrk_2gb_n,
++	.pwrtrk_2gb_p = rtw8812a_pwrtrk_2gb_p,
++	.pwrtrk_2ga_n = rtw8812a_pwrtrk_2ga_n,
++	.pwrtrk_2ga_p = rtw8812a_pwrtrk_2ga_p,
++	.pwrtrk_2g_cckb_n = rtw8812a_pwrtrk_2g_cck_b_n,
++	.pwrtrk_2g_cckb_p = rtw8812a_pwrtrk_2g_cck_b_p,
++	.pwrtrk_2g_ccka_n = rtw8812a_pwrtrk_2g_cck_a_n,
++	.pwrtrk_2g_ccka_p = rtw8812a_pwrtrk_2g_cck_a_p,
++};
++
++static const u8 rtw8812a_pwrtrk_rfe3_5gb_n[][RTW_PWR_TRK_TBL_SZ] = {
++	{0, 1, 1, 2, 3, 3, 4, 5, 5, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 12, 13,
++	 13, 14, 15, 16, 16, 17, 17, 18, 18},
++	{0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 6, 7, 8, 8, 9, 9, 10, 10, 11, 11, 11,
++	 12, 14, 13, 13, 14, 14, 14, 15, 15},
++	{0, 1, 1, 2, 2, 3, 4, 5, 6, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12,
++	 12, 13, 13, 14, 14, 15, 15, 16, 16},
++};
++
++static const u8 rtw8812a_pwrtrk_rfe3_5gb_p[][RTW_PWR_TRK_TBL_SZ] = {
++	{0, 1, 1, 2, 3, 3, 4, 5, 6, 7, 7, 8, 9, 9, 10, 10, 11, 11, 11, 11, 11,
++	 11, 11, 11, 11, 11, 11, 11, 11, 11},
++	{0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 6, 7, 8, 8, 9, 9, 10, 10, 11, 11, 11,
++	 11, 11, 11, 11, 11, 11, 11, 11, 11},
++	{0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 6, 6, 7, 7, 8, 9, 10, 10, 11, 11, 11,
++	 11, 11, 11, 11, 11, 11, 11, 11, 11},
++};
++
++static const u8 rtw8812a_pwrtrk_rfe3_5ga_n[][RTW_PWR_TRK_TBL_SZ] = {
++	{0, 1, 1, 2, 3, 3, 4, 5, 5, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 12,
++	 13, 14, 15, 16, 16, 17, 17, 18, 18},
++	{0, 1, 1, 2, 3, 3, 4, 4, 5, 6, 6, 7, 7, 8, 9, 9, 10, 10, 11, 11, 12,
++	 12, 13, 13, 14, 15, 16, 16, 17, 17},
++	{0, 1, 1, 2, 3, 3, 4, 4, 5, 6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 12, 13,
++	 13, 14, 14, 15, 15, 16, 17, 18, 18},
++};
++
++static const u8 rtw8812a_pwrtrk_rfe3_5ga_p[][RTW_PWR_TRK_TBL_SZ] = {
++	{0, 1, 1, 2, 2, 3, 4, 5, 6, 7, 7, 8, 9, 9, 10, 10, 11, 11, 11, 11, 11,
++	 11, 11, 11, 11, 11, 11, 11, 11, 11},
++	{0, 1, 2, 3, 4, 4, 5, 5, 6, 7, 7, 8, 9, 9, 10, 11, 11, 11, 11, 11, 11,
++	 11, 11, 11, 11, 11, 11, 11, 11, 11},
++	{0, 1, 2, 3, 4, 4, 5, 5, 6, 7, 7, 8, 9, 9, 10, 11, 11, 11, 11, 11, 11,
++	 11, 11, 11, 11, 11, 11, 11, 11, 11},
++};
++
++static const u8 rtw8812a_pwrtrk_rfe3_2gb_n[] = {
++	0, 1, 1, 2, 2, 3, 3, 4, 4, 4, 5, 5, 6, 6, 6, 7,
++	7, 7, 8, 8, 9, 9, 10, 11, 12, 12, 13, 14, 15, 15
++};
++
++static const u8 rtw8812a_pwrtrk_rfe3_2gb_p[] = {
++	0, 1, 1, 2, 2, 2, 2, 3, 3, 3, 4, 4, 5, 5, 5, 6,
++	6, 7, 7, 8, 9, 10, 10, 10, 10, 11, 11, 11, 11, 11
++};
++
++static const u8 rtw8812a_pwrtrk_rfe3_2ga_n[] = {
++	0, 1, 1, 2, 2, 3, 4, 5, 6, 6, 6, 7, 7, 8, 8, 9,
++	10, 10, 11, 11, 12, 12, 13, 13, 13, 13, 14, 14, 15, 15
++};
++
++static const u8 rtw8812a_pwrtrk_rfe3_2ga_p[] = {
++	0, 0, 1, 1, 1, 2, 2, 3, 3, 4, 4, 4, 5, 5, 5, 6,
++	6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 11, 11, 11
++};
++
++static const u8 rtw8812a_pwrtrk_rfe3_2g_cck_b_n[] = {
++	0, 1, 1, 2, 2, 3, 3, 4, 4, 4, 5, 5, 6, 6, 6, 7,
++	7, 7, 8, 8, 9, 9, 10, 11, 12, 12, 13, 14, 15, 15
++};
++
++static const u8 rtw8812a_pwrtrk_rfe3_2g_cck_b_p[] = {
++	0, 1, 1, 2, 2, 2, 2, 3, 3, 3, 4, 4, 5, 5, 5, 6,
++	6, 7, 7, 8, 9, 10, 10, 10, 10, 11, 11, 11, 11, 11
++};
++
++static const u8 rtw8812a_pwrtrk_rfe3_2g_cck_a_n[] = {
++	0, 1, 1, 2, 2, 3, 4, 5, 6, 6, 6, 7, 7, 8, 8, 9,
++	10, 10, 11, 11, 12, 12, 13, 13, 13, 13, 14, 14, 15, 15
++};
++
++static const u8 rtw8812a_pwrtrk_rfe3_2g_cck_a_p[] = {
++	0, 0, 1, 1, 1, 2, 2, 3, 3, 4, 4, 4, 5, 5, 5, 6,
++	6, 7, 7, 8, 8, 9, 9, 10, 10, 11, 11, 11, 11, 11
++};
++
++const struct rtw_pwr_track_tbl rtw8812a_rtw_pwr_track_rfe3_tbl = {
++	.pwrtrk_5gb_n[0] = rtw8812a_pwrtrk_rfe3_5gb_n[0],
++	.pwrtrk_5gb_n[1] = rtw8812a_pwrtrk_rfe3_5gb_n[1],
++	.pwrtrk_5gb_n[2] = rtw8812a_pwrtrk_rfe3_5gb_n[2],
++	.pwrtrk_5gb_p[0] = rtw8812a_pwrtrk_rfe3_5gb_p[0],
++	.pwrtrk_5gb_p[1] = rtw8812a_pwrtrk_rfe3_5gb_p[1],
++	.pwrtrk_5gb_p[2] = rtw8812a_pwrtrk_rfe3_5gb_p[2],
++	.pwrtrk_5ga_n[0] = rtw8812a_pwrtrk_rfe3_5ga_n[0],
++	.pwrtrk_5ga_n[1] = rtw8812a_pwrtrk_rfe3_5ga_n[1],
++	.pwrtrk_5ga_n[2] = rtw8812a_pwrtrk_rfe3_5ga_n[2],
++	.pwrtrk_5ga_p[0] = rtw8812a_pwrtrk_rfe3_5ga_p[0],
++	.pwrtrk_5ga_p[1] = rtw8812a_pwrtrk_rfe3_5ga_p[1],
++	.pwrtrk_5ga_p[2] = rtw8812a_pwrtrk_rfe3_5ga_p[2],
++	.pwrtrk_2gb_n = rtw8812a_pwrtrk_rfe3_2gb_n,
++	.pwrtrk_2gb_p = rtw8812a_pwrtrk_rfe3_2gb_p,
++	.pwrtrk_2ga_n = rtw8812a_pwrtrk_rfe3_2ga_n,
++	.pwrtrk_2ga_p = rtw8812a_pwrtrk_rfe3_2ga_p,
++	.pwrtrk_2g_cckb_n = rtw8812a_pwrtrk_rfe3_2g_cck_b_n,
++	.pwrtrk_2g_cckb_p = rtw8812a_pwrtrk_rfe3_2g_cck_b_p,
++	.pwrtrk_2g_ccka_n = rtw8812a_pwrtrk_rfe3_2g_cck_a_n,
++	.pwrtrk_2g_ccka_p = rtw8812a_pwrtrk_rfe3_2g_cck_a_p,
++};
+--- /dev/null
++++ b/drivers/net/wireless/realtek/rtw88/rtw8812a_table.h
+@@ -0,0 +1,26 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
++/* Copyright(c) 2024  Realtek Corporation
++ */
++
++#ifndef __RTW8812A_TABLE_H__
++#define __RTW8812A_TABLE_H__
++
++extern const struct rtw_table rtw8812a_mac_tbl;
++extern const struct rtw_table rtw8812a_agc_tbl;
++extern const struct rtw_table rtw8812a_agc_diff_lb_tbl;
++extern const struct rtw_table rtw8812a_agc_diff_hb_tbl;
++extern const struct rtw_table rtw8812a_bb_tbl;
++extern const struct rtw_table rtw8812a_bb_pg_tbl;
++extern const struct rtw_table rtw8812a_bb_pg_rfe3_tbl;
++extern const struct rtw_table rtw8812a_rf_a_tbl;
++extern const struct rtw_table rtw8812a_rf_b_tbl;
++extern const struct rtw_table rtw8812a_txpwr_lmt_tbl;
++
++extern const struct rtw_pwr_seq_cmd * const card_enable_flow_8812a[];
++extern const struct rtw_pwr_seq_cmd * const enter_lps_flow_8812a[];
++extern const struct rtw_pwr_seq_cmd * const card_disable_flow_8812a[];
++
++extern const struct rtw_pwr_track_tbl rtw8812a_rtw_pwr_track_tbl;
++extern const struct rtw_pwr_track_tbl rtw8812a_rtw_pwr_track_rfe3_tbl;
++
++#endif
diff --git a/package/kernel/mac80211/patches/rtl/040-v6.13-wifi-rtw88-Add-rtw8821a_table.-c-h.patch b/package/kernel/mac80211/patches/rtl/040-v6.13-wifi-rtw88-Add-rtw8821a_table.-c-h.patch
new file mode 100644
index 00000000000000..e8ceaba61ea06e
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/040-v6.13-wifi-rtw88-Add-rtw8821a_table.-c-h.patch
@@ -0,0 +1,2395 @@
+From 4b81da5cd2b4c7231272216639bacecc818d8b51 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 30 Oct 2024 20:25:16 +0200
+Subject: [PATCH] wifi: rtw88: Add rtw8821a_table.{c,h}
+
+These contain various arrays for initialising RTL8821AU. Also TX power
+limits.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/087c7260-fcc3-4e22-886b-ac477cad9198@gmail.com
+---
+ .../wireless/realtek/rtw88/rtw8821a_table.c   | 2350 +++++++++++++++++
+ .../wireless/realtek/rtw88/rtw8821a_table.h   |   21 +
+ 2 files changed, 2371 insertions(+)
+ create mode 100644 drivers/net/wireless/realtek/rtw88/rtw8821a_table.c
+ create mode 100644 drivers/net/wireless/realtek/rtw88/rtw8821a_table.h
+
+--- /dev/null
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821a_table.c
+@@ -0,0 +1,2350 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
++/* Copyright(c) 2024  Realtek Corporation
++ */
++
++#include "main.h"
++#include "phy.h"
++#include "rtw8821a_table.h"
++
++static const u32 rtw8821a_mac[] = {
++	0x421, 0x0000000F,
++	0x428, 0x0000000A,
++	0x429, 0x00000010,
++	0x430, 0x00000000,
++	0x431, 0x00000000,
++	0x432, 0x00000000,
++	0x433, 0x00000001,
++	0x434, 0x00000004,
++	0x435, 0x00000005,
++	0x436, 0x00000007,
++	0x437, 0x00000008,
++	0x43C, 0x00000004,
++	0x43D, 0x00000005,
++	0x43E, 0x00000007,
++	0x43F, 0x00000008,
++	0x440, 0x0000005D,
++	0x441, 0x00000001,
++	0x442, 0x00000000,
++	0x444, 0x00000010,
++	0x445, 0x00000000,
++	0x446, 0x00000000,
++	0x447, 0x00000000,
++	0x448, 0x00000000,
++	0x449, 0x000000F0,
++	0x44A, 0x0000000F,
++	0x44B, 0x0000003E,
++	0x44C, 0x00000010,
++	0x44D, 0x00000000,
++	0x44E, 0x00000000,
++	0x44F, 0x00000000,
++	0x450, 0x00000000,
++	0x451, 0x000000F0,
++	0x452, 0x0000000F,
++	0x453, 0x00000000,
++	0x456, 0x0000005E,
++	0x460, 0x00000066,
++	0x461, 0x00000066,
++	0x4C8, 0x0000003F,
++	0x4C9, 0x000000FF,
++	0x4CC, 0x000000FF,
++	0x4CD, 0x000000FF,
++	0x4CE, 0x00000001,
++	0x500, 0x00000026,
++	0x501, 0x000000A2,
++	0x502, 0x0000002F,
++	0x503, 0x00000000,
++	0x504, 0x00000028,
++	0x505, 0x000000A3,
++	0x506, 0x0000005E,
++	0x507, 0x00000000,
++	0x508, 0x0000002B,
++	0x509, 0x000000A4,
++	0x50A, 0x0000005E,
++	0x50B, 0x00000000,
++	0x50C, 0x0000004F,
++	0x50D, 0x000000A4,
++	0x50E, 0x00000000,
++	0x50F, 0x00000000,
++	0x512, 0x0000001C,
++	0x514, 0x0000000A,
++	0x516, 0x0000000A,
++	0x525, 0x0000004F,
++	0x550, 0x00000010,
++	0x551, 0x00000010,
++	0x559, 0x00000002,
++	0x55C, 0x00000050,
++	0x55D, 0x000000FF,
++	0x605, 0x00000030,
++	0x607, 0x00000007,
++	0x608, 0x0000000E,
++	0x609, 0x0000002A,
++	0x620, 0x000000FF,
++	0x621, 0x000000FF,
++	0x622, 0x000000FF,
++	0x623, 0x000000FF,
++	0x624, 0x000000FF,
++	0x625, 0x000000FF,
++	0x626, 0x000000FF,
++	0x627, 0x000000FF,
++	0x638, 0x00000050,
++	0x63C, 0x0000000A,
++	0x63D, 0x0000000A,
++	0x63E, 0x0000000E,
++	0x63F, 0x0000000E,
++	0x640, 0x00000040,
++	0x642, 0x00000040,
++	0x643, 0x00000000,
++	0x652, 0x000000C8,
++	0x66E, 0x00000005,
++	0x700, 0x00000021,
++	0x701, 0x00000043,
++	0x702, 0x00000065,
++	0x703, 0x00000087,
++	0x708, 0x00000021,
++	0x709, 0x00000043,
++	0x70A, 0x00000065,
++	0x70B, 0x00000087,
++	0x718, 0x00000040,
++};
++
++RTW_DECL_TABLE_PHY_COND(rtw8821a_mac, rtw_phy_cfg_mac);
++
++static const u32 rtw8821a_agc[] = {
++	0x81C, 0xBF000001,
++	0x81C, 0xBF020001,
++	0x81C, 0xBF040001,
++	0x81C, 0xBF060001,
++	0x81C, 0xBE080001,
++	0x81C, 0xBD0A0001,
++	0x81C, 0xBC0C0001,
++	0x81C, 0xBA0E0001,
++	0x81C, 0xB9100001,
++	0x81C, 0xB8120001,
++	0x81C, 0xB7140001,
++	0x81C, 0xB6160001,
++	0x81C, 0xB5180001,
++	0x81C, 0xB41A0001,
++	0x81C, 0xB31C0001,
++	0x81C, 0xB21E0001,
++	0x81C, 0xB1200001,
++	0x81C, 0xB0220001,
++	0x81C, 0xAF240001,
++	0x81C, 0xAE260001,
++	0x81C, 0xAD280001,
++	0x81C, 0xAC2A0001,
++	0x81C, 0xAB2C0001,
++	0x81C, 0xAA2E0001,
++	0x81C, 0xA9300001,
++	0x81C, 0xA8320001,
++	0x81C, 0xA7340001,
++	0x81C, 0xA6360001,
++	0x81C, 0xA5380001,
++	0x81C, 0xA43A0001,
++	0x81C, 0x683C0001,
++	0x81C, 0x673E0001,
++	0x81C, 0x66400001,
++	0x81C, 0x65420001,
++	0x81C, 0x64440001,
++	0x81C, 0x63460001,
++	0x81C, 0x62480001,
++	0x81C, 0x614A0001,
++	0x81C, 0x474C0001,
++	0x81C, 0x464E0001,
++	0x81C, 0x45500001,
++	0x81C, 0x44520001,
++	0x81C, 0x43540001,
++	0x81C, 0x42560001,
++	0x81C, 0x41580001,
++	0x81C, 0x285A0001,
++	0x81C, 0x275C0001,
++	0x81C, 0x265E0001,
++	0x81C, 0x25600001,
++	0x81C, 0x24620001,
++	0x81C, 0x0A640001,
++	0x81C, 0x09660001,
++	0x81C, 0x08680001,
++	0x81C, 0x076A0001,
++	0x81C, 0x066C0001,
++	0x81C, 0x056E0001,
++	0x81C, 0x04700001,
++	0x81C, 0x03720001,
++	0x81C, 0x02740001,
++	0x81C, 0x01760001,
++	0x81C, 0x01780001,
++	0x81C, 0x017A0001,
++	0x81C, 0x017C0001,
++	0x81C, 0x017E0001,
++	0x8000020c,	0x00000000,	0x40000000,	0x00000000,
++	0x81C, 0xFB000101,
++	0x81C, 0xFA020101,
++	0x81C, 0xF9040101,
++	0x81C, 0xF8060101,
++	0x81C, 0xF7080101,
++	0x81C, 0xF60A0101,
++	0x81C, 0xF50C0101,
++	0x81C, 0xF40E0101,
++	0x81C, 0xF3100101,
++	0x81C, 0xF2120101,
++	0x81C, 0xF1140101,
++	0x81C, 0xF0160101,
++	0x81C, 0xEF180101,
++	0x81C, 0xEE1A0101,
++	0x81C, 0xED1C0101,
++	0x81C, 0xEC1E0101,
++	0x81C, 0xEB200101,
++	0x81C, 0xEA220101,
++	0x81C, 0xE9240101,
++	0x81C, 0xE8260101,
++	0x81C, 0xE7280101,
++	0x81C, 0xE62A0101,
++	0x81C, 0xE52C0101,
++	0x81C, 0xE42E0101,
++	0x81C, 0xE3300101,
++	0x81C, 0xA5320101,
++	0x81C, 0xA4340101,
++	0x81C, 0xA3360101,
++	0x81C, 0x87380101,
++	0x81C, 0x863A0101,
++	0x81C, 0x853C0101,
++	0x81C, 0x843E0101,
++	0x81C, 0x69400101,
++	0x81C, 0x68420101,
++	0x81C, 0x67440101,
++	0x81C, 0x66460101,
++	0x81C, 0x49480101,
++	0x81C, 0x484A0101,
++	0x81C, 0x474C0101,
++	0x81C, 0x2A4E0101,
++	0x81C, 0x29500101,
++	0x81C, 0x28520101,
++	0x81C, 0x27540101,
++	0x81C, 0x26560101,
++	0x81C, 0x25580101,
++	0x81C, 0x245A0101,
++	0x81C, 0x235C0101,
++	0x81C, 0x055E0101,
++	0x81C, 0x04600101,
++	0x81C, 0x03620101,
++	0x81C, 0x02640101,
++	0x81C, 0x01660101,
++	0x81C, 0x01680101,
++	0x81C, 0x016A0101,
++	0x81C, 0x016C0101,
++	0x81C, 0x016E0101,
++	0x81C, 0x01700101,
++	0x81C, 0x01720101,
++	0x9000040c,	0x00000000,	0x40000000,	0x00000000,
++	0x81C, 0xFB000101,
++	0x81C, 0xFA020101,
++	0x81C, 0xF9040101,
++	0x81C, 0xF8060101,
++	0x81C, 0xF7080101,
++	0x81C, 0xF60A0101,
++	0x81C, 0xF50C0101,
++	0x81C, 0xF40E0101,
++	0x81C, 0xF3100101,
++	0x81C, 0xF2120101,
++	0x81C, 0xF1140101,
++	0x81C, 0xF0160101,
++	0x81C, 0xEF180101,
++	0x81C, 0xEE1A0101,
++	0x81C, 0xED1C0101,
++	0x81C, 0xEC1E0101,
++	0x81C, 0xEB200101,
++	0x81C, 0xEA220101,
++	0x81C, 0xE9240101,
++	0x81C, 0xE8260101,
++	0x81C, 0xE7280101,
++	0x81C, 0xE62A0101,
++	0x81C, 0xE52C0101,
++	0x81C, 0xE42E0101,
++	0x81C, 0xE3300101,
++	0x81C, 0xA5320101,
++	0x81C, 0xA4340101,
++	0x81C, 0xA3360101,
++	0x81C, 0x87380101,
++	0x81C, 0x863A0101,
++	0x81C, 0x853C0101,
++	0x81C, 0x843E0101,
++	0x81C, 0x69400101,
++	0x81C, 0x68420101,
++	0x81C, 0x67440101,
++	0x81C, 0x66460101,
++	0x81C, 0x49480101,
++	0x81C, 0x484A0101,
++	0x81C, 0x474C0101,
++	0x81C, 0x2A4E0101,
++	0x81C, 0x29500101,
++	0x81C, 0x28520101,
++	0x81C, 0x27540101,
++	0x81C, 0x26560101,
++	0x81C, 0x25580101,
++	0x81C, 0x245A0101,
++	0x81C, 0x235C0101,
++	0x81C, 0x055E0101,
++	0x81C, 0x04600101,
++	0x81C, 0x03620101,
++	0x81C, 0x02640101,
++	0x81C, 0x01660101,
++	0x81C, 0x01680101,
++	0x81C, 0x016A0101,
++	0x81C, 0x016C0101,
++	0x81C, 0x016E0101,
++	0x81C, 0x01700101,
++	0x81C, 0x01720101,
++	0xA0000000,	0x00000000,
++	0x81C, 0xFF000101,
++	0x81C, 0xFF020101,
++	0x81C, 0xFE040101,
++	0x81C, 0xFD060101,
++	0x81C, 0xFC080101,
++	0x81C, 0xFD0A0101,
++	0x81C, 0xFC0C0101,
++	0x81C, 0xFB0E0101,
++	0x81C, 0xFA100101,
++	0x81C, 0xF9120101,
++	0x81C, 0xF8140101,
++	0x81C, 0xF7160101,
++	0x81C, 0xF6180101,
++	0x81C, 0xF51A0101,
++	0x81C, 0xF41C0101,
++	0x81C, 0xF31E0101,
++	0x81C, 0xF2200101,
++	0x81C, 0xF1220101,
++	0x81C, 0xF0240101,
++	0x81C, 0xEF260101,
++	0x81C, 0xEE280101,
++	0x81C, 0xED2A0101,
++	0x81C, 0xEC2C0101,
++	0x81C, 0xEB2E0101,
++	0x81C, 0xEA300101,
++	0x81C, 0xE9320101,
++	0x81C, 0xE8340101,
++	0x81C, 0xE7360101,
++	0x81C, 0xE6380101,
++	0x81C, 0xE53A0101,
++	0x81C, 0xE43C0101,
++	0x81C, 0xE33E0101,
++	0x81C, 0xA5400101,
++	0x81C, 0xA4420101,
++	0x81C, 0xA3440101,
++	0x81C, 0x87460101,
++	0x81C, 0x86480101,
++	0x81C, 0x854A0101,
++	0x81C, 0x844C0101,
++	0x81C, 0x694E0101,
++	0x81C, 0x68500101,
++	0x81C, 0x67520101,
++	0x81C, 0x66540101,
++	0x81C, 0x49560101,
++	0x81C, 0x48580101,
++	0x81C, 0x475A0101,
++	0x81C, 0x2A5C0101,
++	0x81C, 0x295E0101,
++	0x81C, 0x28600101,
++	0x81C, 0x27620101,
++	0x81C, 0x26640101,
++	0x81C, 0x25660101,
++	0x81C, 0x24680101,
++	0x81C, 0x236A0101,
++	0x81C, 0x056C0101,
++	0x81C, 0x046E0101,
++	0x81C, 0x03700101,
++	0x81C, 0x02720101,
++	0xB0000000,	0x00000000,
++	0x81C, 0x01740101,
++	0x81C, 0x01760101,
++	0x81C, 0x01780101,
++	0x81C, 0x017A0101,
++	0x81C, 0x017C0101,
++	0x81C, 0x017E0101,
++	0xC50, 0x00000022,
++	0xC50, 0x00000020,
++};
++
++RTW_DECL_TABLE_PHY_COND(rtw8821a_agc, rtw_phy_cfg_agc);
++
++static const u32 rtw8821a_bb[] = {
++	0x800, 0x0020D090,
++	0x804, 0x080112E0,
++	0x808, 0x0E028211,
++	0x80C, 0x92131111,
++	0x810, 0x20101261,
++	0x814, 0x020C3D10,
++	0x818, 0x03A00385,
++	0x820, 0x00000000,
++	0x824, 0x00030FE0,
++	0x828, 0x00000000,
++	0x82C, 0x002081DD,
++	0x830, 0x2AAAEEC8,
++	0x834, 0x0037A706,
++	0x838, 0x06489B44,
++	0x83C, 0x0000095B,
++	0x840, 0xC0000001,
++	0x844, 0x40003CDE,
++	0x848, 0x62103F8B,
++	0x84C, 0x6CFDFFB8,
++	0x850, 0x28874706,
++	0x854, 0x0001520C,
++	0x858, 0x8060E000,
++	0x85C, 0x74210168,
++	0x860, 0x6929C321,
++	0x864, 0x79727432,
++	0x868, 0x8CA7A314,
++	0x86C, 0x888C2878,
++	0x870, 0x08888888,
++	0x874, 0x31612C2E,
++	0x878, 0x00000152,
++	0x87C, 0x000FD000,
++	0x8A0, 0x00000013,
++	0x8A4, 0x7F7F7F7F,
++	0x8A8, 0xA2000338,
++	0x8AC, 0x0FF0FA0A,
++	0x8B4, 0x000FC080,
++	0x8B8, 0x6C10D7FF,
++	0x8BC, 0x0CA52090,
++	0x8C0, 0x1BF00020,
++	0x8C4, 0x00000000,
++	0x8C8, 0x00013169,
++	0x8CC, 0x08248492,
++	0x8D4, 0x940008A0,
++	0x8D8, 0x290B5612,
++	0x8F8, 0x400002C0,
++	0x8FC, 0x00000000,
++	0x900, 0x00000700,
++	0x90C, 0x00000000,
++	0x910, 0x0000FC00,
++	0x914, 0x00000404,
++	0x918, 0x1C1028C0,
++	0x91C, 0x64B11A1C,
++	0x920, 0xE0767233,
++	0x924, 0x055AA500,
++	0x928, 0x00000004,
++	0x92C, 0xFFFE0000,
++	0x930, 0xFFFFFFFE,
++	0x934, 0x001FFFFF,
++	0x960, 0x00000000,
++	0x964, 0x00000000,
++	0x968, 0x00000000,
++	0x96C, 0x00000000,
++	0x970, 0x801FFFFF,
++	0x974, 0x000003FF,
++	0x978, 0x00000000,
++	0x97C, 0x00000000,
++	0x980, 0x00000000,
++	0x984, 0x00000000,
++	0x988, 0x00000000,
++	0x990, 0x27100000,
++	0x994, 0xFFFF0100,
++	0x998, 0xFFFFFF5C,
++	0x99C, 0xFFFFFFFF,
++	0x9A0, 0x000000FF,
++	0x9A4, 0x00480080,
++	0x9A8, 0x00000000,
++	0x9AC, 0x00000000,
++	0x9B0, 0x81081008,
++	0x9B4, 0x01081008,
++	0x9B8, 0x01081008,
++	0x9BC, 0x01081008,
++	0x9D0, 0x00000000,
++	0x9D4, 0x00000000,
++	0x9D8, 0x00000000,
++	0x9DC, 0x00000000,
++	0x9E0, 0x00005D00,
++	0x9E4, 0x00000003,
++	0x9E8, 0x00000001,
++	0xA00, 0x00D047C8,
++	0xA04, 0x01FF800C,
++	0xA08, 0x8C8A8300,
++	0xA0C, 0x2E68000F,
++	0xA10, 0x9500BB78,
++	0xA14, 0x11144028,
++	0xA18, 0x00881117,
++	0xA1C, 0x89140F00,
++	0xA20, 0x1A1B0000,
++	0xA24, 0x090E1317,
++	0xA28, 0x00000204,
++	0xA2C, 0x00900000,
++	0xA70, 0x101FFF00,
++	0xA74, 0x00000008,
++	0xA78, 0x00000900,
++	0xA7C, 0x225B0606,
++	0xA80, 0x21805490,
++	0xA84, 0x001F0000,
++	0XB00, 0x03100040,
++	0XB04, 0x0000B000,
++	0XB08, 0xAE0201EB,
++	0XB0C, 0x01003207,
++	0XB10, 0x00009807,
++	0XB14, 0x01000000,
++	0XB18, 0x00000002,
++	0XB1C, 0x00000002,
++	0XB20, 0x0000001F,
++	0XB24, 0x03020100,
++	0XB28, 0x07060504,
++	0XB2C, 0x0B0A0908,
++	0XB30, 0x0F0E0D0C,
++	0XB34, 0x13121110,
++	0XB38, 0x17161514,
++	0XB3C, 0x0000003A,
++	0XB40, 0x00000000,
++	0XB44, 0x00000000,
++	0XB48, 0x13000032,
++	0XB4C, 0x48080000,
++	0XB50, 0x00000000,
++	0XB54, 0x00000000,
++	0XB58, 0x00000000,
++	0XB5C, 0x00000000,
++	0xC00, 0x00000007,
++	0xC04, 0x00042020,
++	0xC08, 0x80410231,
++	0xC0C, 0x00000000,
++	0xC10, 0x00000100,
++	0xC14, 0x01000000,
++	0xC1C, 0x40000003,
++	0xC20, 0x2C2C2C2C,
++	0xC24, 0x30303030,
++	0xC28, 0x30303030,
++	0xC2C, 0x2C2C2C2C,
++	0xC30, 0x2C2C2C2C,
++	0xC34, 0x2C2C2C2C,
++	0xC38, 0x2C2C2C2C,
++	0xC3C, 0x2A2A2A2A,
++	0xC40, 0x2A2A2A2A,
++	0xC44, 0x2A2A2A2A,
++	0xC48, 0x2A2A2A2A,
++	0xC4C, 0x2A2A2A2A,
++	0xC50, 0x00000020,
++	0xC54, 0x001C1208,
++	0xC58, 0x30000C1C,
++	0xC5C, 0x00000058,
++	0xC60, 0x34344443,
++	0xC64, 0x07003333,
++	0xC68, 0x19791979,
++	0xC6C, 0x19791979,
++	0xC70, 0x19791979,
++	0xC74, 0x19791979,
++	0xC78, 0x19791979,
++	0xC7C, 0x19791979,
++	0xC80, 0x19791979,
++	0xC84, 0x19791979,
++	0xC94, 0x0100005C,
++	0xC98, 0x00000000,
++	0xC9C, 0x00000000,
++	0xCA0, 0x00000029,
++	0xCA4, 0x08040201,
++	0xCA8, 0x80402010,
++	0xCB0, 0x77775747,
++	0xCB4, 0x10000077,
++	0xCB8, 0x00508240,
++};
++
++RTW_DECL_TABLE_PHY_COND(rtw8821a_bb, rtw_phy_cfg_bb);
++
++static const struct rtw_phy_pg_cfg_pair rtw8821a_bb_pg[] = {
++	{ 0, 0, 0, 0x00000c20, 0xffffffff, 0x32343638, },
++	{ 0, 0, 0, 0x00000c24, 0xffffffff, 0x36363838, },
++	{ 0, 0, 0, 0x00000c28, 0xffffffff, 0x28303234, },
++	{ 0, 0, 0, 0x00000c2c, 0xffffffff, 0x34363838, },
++	{ 0, 0, 0, 0x00000c30, 0xffffffff, 0x26283032, },
++	{ 0, 0, 0, 0x00000c3c, 0xffffffff, 0x32343636, },
++	{ 0, 0, 0, 0x00000c40, 0xffffffff, 0x24262830, },
++	{ 0, 0, 0, 0x00000c44, 0x0000ffff, 0x00002022, },
++	{ 1, 0, 0, 0x00000c24, 0xffffffff, 0x34343636, },
++	{ 1, 0, 0, 0x00000c28, 0xffffffff, 0x26283032, },
++	{ 1, 0, 0, 0x00000c2c, 0xffffffff, 0x32343636, },
++	{ 1, 0, 0, 0x00000c30, 0xffffffff, 0x24262830, },
++	{ 1, 0, 0, 0x00000c3c, 0xffffffff, 0x32343636, },
++	{ 1, 0, 0, 0x00000c40, 0xffffffff, 0x24262830, },
++	{ 1, 0, 0, 0x00000c44, 0x0000ffff, 0x00002022, },
++};
++
++RTW_DECL_TABLE_BB_PG(rtw8821a_bb_pg);
++
++static const u32 rtw8821a_rf_a[] = {
++	0x018, 0x0001712A,
++	0x056, 0x00051CF2,
++	0x066, 0x00040000,
++	0x000, 0x00010000,
++	0x01E, 0x00080000,
++	0x082, 0x00000830,
++	0x083, 0x00021800,
++	0x084, 0x00028000,
++	0x085, 0x00048000,
++	0x80000111,	0x00000000,	0x40000000,	0x00000000,
++	0x086, 0x0009483A,
++	0xA0000000,	0x00000000,
++	0x086, 0x00094838,
++	0xB0000000,	0x00000000,
++	0x087, 0x00044980,
++	0x088, 0x00048000,
++	0x089, 0x0000D480,
++	0x08A, 0x00042240,
++	0x08B, 0x000F0380,
++	0x08C, 0x00090000,
++	0x08D, 0x00022852,
++	0x08E, 0x00065540,
++	0x08F, 0x00088001,
++	0x0EF, 0x00020000,
++	0x03E, 0x00000380,
++	0x03F, 0x00090018,
++	0x03E, 0x00020380,
++	0x03F, 0x000A0018,
++	0x03E, 0x00040308,
++	0x03F, 0x000A0018,
++	0x03E, 0x00060018,
++	0x03F, 0x000A0018,
++	0x0EF, 0x00000000,
++	0x018, 0x0001712A,
++	0x089, 0x00000080,
++	0x08B, 0x00080180,
++	0x0EF, 0x00001000,
++	0x03A, 0x00000244,
++	0x03B, 0x00038027,
++	0x03C, 0x00082000,
++	0x03A, 0x00000244,
++	0x03B, 0x00030113,
++	0x03C, 0x00082000,
++	0x03A, 0x0000014C,
++	0x03B, 0x00028027,
++	0x03C, 0x00082000,
++	0x03A, 0x000000CC,
++	0x03B, 0x00027027,
++	0x03C, 0x00042000,
++	0x03A, 0x0000014C,
++	0x03B, 0x0001F913,
++	0x03C, 0x00042000,
++	0x03A, 0x0000010C,
++	0x03B, 0x00017F10,
++	0x03C, 0x00012000,
++	0x03A, 0x000000D0,
++	0x03B, 0x00008027,
++	0x03C, 0x000CA000,
++	0x03A, 0x00000244,
++	0x03B, 0x00078027,
++	0x03C, 0x00082000,
++	0x03A, 0x00000244,
++	0x03B, 0x00070113,
++	0x03C, 0x00082000,
++	0x03A, 0x0000014C,
++	0x03B, 0x00068027,
++	0x03C, 0x00082000,
++	0x03A, 0x000000CC,
++	0x03B, 0x00067027,
++	0x03C, 0x00042000,
++	0x03A, 0x0000014C,
++	0x03B, 0x0005F913,
++	0x03C, 0x00042000,
++	0x03A, 0x0000010C,
++	0x03B, 0x00057F10,
++	0x03C, 0x00012000,
++	0x03A, 0x000000D0,
++	0x03B, 0x00048027,
++	0x03C, 0x000CA000,
++	0x03A, 0x00000244,
++	0x03B, 0x000B8027,
++	0x03C, 0x00082000,
++	0x03A, 0x00000244,
++	0x03B, 0x000B0113,
++	0x03C, 0x00082000,
++	0x03A, 0x0000014C,
++	0x03B, 0x000A8027,
++	0x03C, 0x00082000,
++	0x03A, 0x000000CC,
++	0x03B, 0x000A7027,
++	0x03C, 0x00042000,
++	0x03A, 0x0000014C,
++	0x03B, 0x0009F913,
++	0x03C, 0x00042000,
++	0x03A, 0x0000010C,
++	0x03B, 0x00097F10,
++	0x03C, 0x00012000,
++	0x03A, 0x000000D0,
++	0x03B, 0x00088027,
++	0x03C, 0x000CA000,
++	0x0EF, 0x00000000,
++	0x0EF, 0x00001100,
++	0x80000111,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0004ADF3,
++	0x034, 0x00049DF0,
++	0x90000110,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0004ADF3,
++	0x034, 0x00049DF0,
++	0x90000210,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0004ADF5,
++	0x034, 0x00049DF2,
++	0x9000020c,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0004A0F3,
++	0x034, 0x000490B1,
++	0x9000040c,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0004A0F3,
++	0x034, 0x000490B1,
++	0x90000200,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0004ADF5,
++	0x034, 0x00049DF2,
++	0x90000410,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0004ADF3,
++	0x034, 0x00049DF0,
++	0xA0000000,	0x00000000,
++	0x034, 0x0004ADF7,
++	0x034, 0x00049DF3,
++	0xB0000000,	0x00000000,
++	0x80000111,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x00048DED,
++	0x034, 0x00047DEA,
++	0x034, 0x00046DE7,
++	0x034, 0x00045CE9,
++	0x034, 0x00044CE6,
++	0x034, 0x000438C6,
++	0x034, 0x00042886,
++	0x034, 0x00041486,
++	0x034, 0x00040447,
++	0x90000110,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x00048DED,
++	0x034, 0x00047DEA,
++	0x034, 0x00046DE7,
++	0x034, 0x00045CE9,
++	0x034, 0x00044CE6,
++	0x034, 0x000438C6,
++	0x034, 0x00042886,
++	0x034, 0x00041486,
++	0x034, 0x00040447,
++	0x9000020c,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x000480AE,
++	0x034, 0x000470AB,
++	0x034, 0x0004608B,
++	0x034, 0x00045069,
++	0x034, 0x00044048,
++	0x034, 0x00043045,
++	0x034, 0x00042026,
++	0x034, 0x00041023,
++	0x034, 0x00040002,
++	0x9000040c,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x000480AE,
++	0x034, 0x000470AB,
++	0x034, 0x0004608B,
++	0x034, 0x00045069,
++	0x034, 0x00044048,
++	0x034, 0x00043045,
++	0x034, 0x00042026,
++	0x034, 0x00041023,
++	0x034, 0x00040002,
++	0x90000410,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x00048DED,
++	0x034, 0x00047DEA,
++	0x034, 0x00046DE7,
++	0x034, 0x00045CE9,
++	0x034, 0x00044CE6,
++	0x034, 0x000438C6,
++	0x034, 0x00042886,
++	0x034, 0x00041486,
++	0x034, 0x00040447,
++	0xA0000000,	0x00000000,
++	0x034, 0x00048DEF,
++	0x034, 0x00047DEC,
++	0x034, 0x00046DE9,
++	0x034, 0x00045CCB,
++	0x034, 0x0004488D,
++	0x034, 0x0004348D,
++	0x034, 0x0004248A,
++	0x034, 0x0004108D,
++	0x034, 0x0004008A,
++	0xB0000000,	0x00000000,
++	0x80000210,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0002ADF4,
++	0x9000020c,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0002A0F3,
++	0x9000040c,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0002A0F3,
++	0x90000200,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0002ADF4,
++	0xA0000000,	0x00000000,
++	0x034, 0x0002ADF7,
++	0xB0000000,	0x00000000,
++	0x80000111,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x00029DF4,
++	0x90000110,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x00029DF4,
++	0x90000210,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x00029DF1,
++	0x9000020c,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x000290F0,
++	0x9000040c,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x000290F0,
++	0x90000200,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x00029DF1,
++	0x90000410,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x00029DF4,
++	0xA0000000,	0x00000000,
++	0x034, 0x00029DF2,
++	0xB0000000,	0x00000000,
++	0x80000111,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x00028DF1,
++	0x034, 0x00027DEE,
++	0x034, 0x00026DEB,
++	0x034, 0x00025CEC,
++	0x034, 0x00024CE9,
++	0x034, 0x000238CA,
++	0x034, 0x00022889,
++	0x034, 0x00021489,
++	0x034, 0x0002044A,
++	0x90000110,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x00028DF1,
++	0x034, 0x00027DEE,
++	0x034, 0x00026DEB,
++	0x034, 0x00025CEC,
++	0x034, 0x00024CE9,
++	0x034, 0x000238CA,
++	0x034, 0x00022889,
++	0x034, 0x00021489,
++	0x034, 0x0002044A,
++	0x9000020c,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x000280AF,
++	0x034, 0x000270AC,
++	0x034, 0x0002608B,
++	0x034, 0x00025069,
++	0x034, 0x00024048,
++	0x034, 0x00023045,
++	0x034, 0x00022026,
++	0x034, 0x00021023,
++	0x034, 0x00020002,
++	0x9000040c,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x000280AF,
++	0x034, 0x000270AC,
++	0x034, 0x0002608B,
++	0x034, 0x00025069,
++	0x034, 0x00024048,
++	0x034, 0x00023045,
++	0x034, 0x00022026,
++	0x034, 0x00021023,
++	0x034, 0x00020002,
++	0x90000410,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x00028DF1,
++	0x034, 0x00027DEE,
++	0x034, 0x00026DEB,
++	0x034, 0x00025CEC,
++	0x034, 0x00024CE9,
++	0x034, 0x000238CA,
++	0x034, 0x00022889,
++	0x034, 0x00021489,
++	0x034, 0x0002044A,
++	0xA0000000,	0x00000000,
++	0x034, 0x00028DEE,
++	0x034, 0x00027DEB,
++	0x034, 0x00026CCD,
++	0x034, 0x00025CCA,
++	0x034, 0x0002488C,
++	0x034, 0x0002384C,
++	0x034, 0x00022849,
++	0x034, 0x00021449,
++	0x034, 0x0002004D,
++	0xB0000000,	0x00000000,
++	0x8000020c,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0000A0D7,
++	0x034, 0x000090D3,
++	0x034, 0x000080B1,
++	0x034, 0x000070AE,
++	0x9000040c,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0000A0D7,
++	0x034, 0x000090D3,
++	0x034, 0x000080B1,
++	0x034, 0x000070AE,
++	0xA0000000,	0x00000000,
++	0x034, 0x0000ADF7,
++	0x034, 0x00009DF4,
++	0x034, 0x00008DF1,
++	0x034, 0x00007DEE,
++	0xB0000000,	0x00000000,
++	0x80000111,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x00006DEB,
++	0x034, 0x00005CEC,
++	0x034, 0x00004CE9,
++	0x034, 0x000038CA,
++	0x034, 0x00002889,
++	0x034, 0x00001489,
++	0x034, 0x0000044A,
++	0x90000110,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x00006DEB,
++	0x034, 0x00005CEC,
++	0x034, 0x00004CE9,
++	0x034, 0x000038CA,
++	0x034, 0x00002889,
++	0x034, 0x00001489,
++	0x034, 0x0000044A,
++	0x9000020c,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0000608D,
++	0x034, 0x0000506B,
++	0x034, 0x0000404A,
++	0x034, 0x00003047,
++	0x034, 0x00002044,
++	0x034, 0x00001025,
++	0x034, 0x00000004,
++	0x9000040c,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x0000608D,
++	0x034, 0x0000506B,
++	0x034, 0x0000404A,
++	0x034, 0x00003047,
++	0x034, 0x00002044,
++	0x034, 0x00001025,
++	0x034, 0x00000004,
++	0x90000410,	0x00000000,	0x40000000,	0x00000000,
++	0x034, 0x00006DEB,
++	0x034, 0x00005CEC,
++	0x034, 0x00004CE9,
++	0x034, 0x000038CA,
++	0x034, 0x00002889,
++	0x034, 0x00001489,
++	0x034, 0x0000044A,
++	0xA0000000,	0x00000000,
++	0x034, 0x00006DCD,
++	0x034, 0x00005CCD,
++	0x034, 0x00004CCA,
++	0x034, 0x0000388C,
++	0x034, 0x00002888,
++	0x034, 0x00001488,
++	0x034, 0x00000486,
++	0xB0000000,	0x00000000,
++	0x0EF, 0x00000000,
++	0x018, 0x0001712A,
++	0x0EF, 0x00000040,
++	0x80000111,	0x00000000,	0x40000000,	0x00000000,
++	0x035, 0x00000187,
++	0x035, 0x00008187,
++	0x035, 0x00010187,
++	0x035, 0x00020188,
++	0x035, 0x00028188,
++	0x035, 0x00030188,
++	0x035, 0x00040188,
++	0x035, 0x00048188,
++	0x035, 0x00050188,
++	0x90000110,	0x00000000,	0x40000000,	0x00000000,
++	0x035, 0x00000187,
++	0x035, 0x00008187,
++	0x035, 0x00010187,
++	0x035, 0x00020188,
++	0x035, 0x00028188,
++	0x035, 0x00030188,
++	0x035, 0x00040188,
++	0x035, 0x00048188,
++	0x035, 0x00050188,
++	0x90000210,	0x00000000,	0x40000000,	0x00000000,
++	0x035, 0x00000128,
++	0x035, 0x00008128,
++	0x035, 0x00010128,
++	0x035, 0x000201C8,
++	0x035, 0x000281C8,
++	0x035, 0x000301C8,
++	0x035, 0x000401C8,
++	0x035, 0x000481C8,
++	0x035, 0x000501C8,
++	0x9000040c,	0x00000000,	0x40000000,	0x00000000,
++	0x035, 0x00000145,
++	0x035, 0x00008145,
++	0x035, 0x00010145,
++	0x035, 0x00020196,
++	0x035, 0x00028196,
++	0x035, 0x00030196,
++	0x035, 0x000401C7,
++	0x035, 0x000481C7,
++	0x035, 0x000501C7,
++	0x90000200,	0x00000000,	0x40000000,	0x00000000,
++	0x035, 0x00000128,
++	0x035, 0x00008128,
++	0x035, 0x00010128,
++	0x035, 0x000201C8,
++	0x035, 0x000281C8,
++	0x035, 0x000301C8,
++	0x035, 0x000401C8,
++	0x035, 0x000481C8,
++	0x035, 0x000501C8,
++	0x90000410,	0x00000000,	0x40000000,	0x00000000,
++	0x035, 0x00000187,
++	0x035, 0x00008187,
++	0x035, 0x00010187,
++	0x035, 0x00020188,
++	0x035, 0x00028188,
++	0x035, 0x00030188,
++	0x035, 0x00040188,
++	0x035, 0x00048188,
++	0x035, 0x00050188,
++	0xA0000000,	0x00000000,
++	0x035, 0x00000145,
++	0x035, 0x00008145,
++	0x035, 0x00010145,
++	0x035, 0x00020196,
++	0x035, 0x00028196,
++	0x035, 0x00030196,
++	0x035, 0x000401C7,
++	0x035, 0x000481C7,
++	0x035, 0x000501C7,
++	0xB0000000,	0x00000000,
++	0x0EF, 0x00000000,
++	0x018, 0x0001712A,
++	0x0EF, 0x00000010,
++	0x80000111,	0x00000000,	0x40000000,	0x00000000,
++	0x036, 0x00085733,
++	0x036, 0x0008D733,
++	0x036, 0x00095733,
++	0x036, 0x0009D733,
++	0x036, 0x000A64B4,
++	0x036, 0x000AE4B4,
++	0x036, 0x000B64B4,
++	0x036, 0x000BE4B4,
++	0x036, 0x000C64B4,
++	0x036, 0x000CE4B4,
++	0x036, 0x000D64B4,
++	0x036, 0x000DE4B4,
++	0x90000110,	0x00000000,	0x40000000,	0x00000000,
++	0x036, 0x00085733,
++	0x036, 0x0008D733,
++	0x036, 0x00095733,
++	0x036, 0x0009D733,
++	0x036, 0x000A64B4,
++	0x036, 0x000AE4B4,
++	0x036, 0x000B64B4,
++	0x036, 0x000BE4B4,
++	0x036, 0x000C64B4,
++	0x036, 0x000CE4B4,
++	0x036, 0x000D64B4,
++	0x036, 0x000DE4B4,
++	0x90000210,	0x00000000,	0x40000000,	0x00000000,
++	0x036, 0x000063B5,
++	0x036, 0x0000E3B5,
++	0x036, 0x000163B5,
++	0x036, 0x0001E3B5,
++	0x036, 0x000263B5,
++	0x036, 0x0002E3B5,
++	0x036, 0x000363B5,
++	0x036, 0x0003E3B5,
++	0x036, 0x000463B5,
++	0x036, 0x0004E3B5,
++	0x036, 0x000563B5,
++	0x036, 0x0005E3B5,
++	0x9000040c,	0x00000000,	0x40000000,	0x00000000,
++	0x036, 0x000056B3,
++	0x036, 0x0000D6B3,
++	0x036, 0x000156B3,
++	0x036, 0x0001D6B3,
++	0x036, 0x00026634,
++	0x036, 0x0002E634,
++	0x036, 0x00036634,
++	0x036, 0x0003E634,
++	0x036, 0x000467B4,
++	0x036, 0x0004E7B4,
++	0x036, 0x000567B4,
++	0x036, 0x0005E7B4,
++	0x90000200,	0x00000000,	0x40000000,	0x00000000,
++	0x036, 0x000063B5,
++	0x036, 0x0000E3B5,
++	0x036, 0x000163B5,
++	0x036, 0x0001E3B5,
++	0x036, 0x000263B5,
++	0x036, 0x0002E3B5,
++	0x036, 0x000363B5,
++	0x036, 0x0003E3B5,
++	0x036, 0x000463B5,
++	0x036, 0x0004E3B5,
++	0x036, 0x000563B5,
++	0x036, 0x0005E3B5,
++	0x90000410,	0x00000000,	0x40000000,	0x00000000,
++	0x036, 0x00085733,
++	0x036, 0x0008D733,
++	0x036, 0x00095733,
++	0x036, 0x0009D733,
++	0x036, 0x000A64B4,
++	0x036, 0x000AE4B4,
++	0x036, 0x000B64B4,
++	0x036, 0x000BE4B4,
++	0x036, 0x000C64B4,
++	0x036, 0x000CE4B4,
++	0x036, 0x000D64B4,
++	0x036, 0x000DE4B4,
++	0xA0000000,	0x00000000,
++	0x036, 0x000056B3,
++	0x036, 0x0000D6B3,
++	0x036, 0x000156B3,
++	0x036, 0x0001D6B3,
++	0x036, 0x00026634,
++	0x036, 0x0002E634,
++	0x036, 0x00036634,
++	0x036, 0x0003E634,
++	0x036, 0x000467B4,
++	0x036, 0x0004E7B4,
++	0x036, 0x000567B4,
++	0x036, 0x0005E7B4,
++	0xB0000000,	0x00000000,
++	0x0EF, 0x00000000,
++	0x0EF, 0x00000008,
++	0x80000111,	0x00000000,	0x40000000,	0x00000000,
++	0x03C, 0x000001C8,
++	0x03C, 0x00000492,
++	0x90000110,	0x00000000,	0x40000000,	0x00000000,
++	0x03C, 0x000001C8,
++	0x03C, 0x00000492,
++	0x90000210,	0x00000000,	0x40000000,	0x00000000,
++	0x03C, 0x000001B6,
++	0x03C, 0x00000492,
++	0x9000040c,	0x00000000,	0x40000000,	0x00000000,
++	0x03C, 0x0000022A,
++	0x03C, 0x00000594,
++	0x90000200,	0x00000000,	0x40000000,	0x00000000,
++	0x03C, 0x000001B6,
++	0x03C, 0x00000492,
++	0x90000410,	0x00000000,	0x40000000,	0x00000000,
++	0x03C, 0x000001C8,
++	0x03C, 0x00000492,
++	0xA0000000,	0x00000000,
++	0x03C, 0x0000022A,
++	0x03C, 0x00000594,
++	0xB0000000,	0x00000000,
++	0x80000111,	0x00000000,	0x40000000,	0x00000000,
++	0x03C, 0x00000800,
++	0x90000110,	0x00000000,	0x40000000,	0x00000000,
++	0x03C, 0x00000800,
++	0x90000210,	0x00000000,	0x40000000,	0x00000000,
++	0x03C, 0x00000800,
++	0x9000020c,	0x00000000,	0x40000000,	0x00000000,
++	0x03C, 0x00000820,
++	0x9000040c,	0x00000000,	0x40000000,	0x00000000,
++	0x03C, 0x00000820,
++	0x90000200,	0x00000000,	0x40000000,	0x00000000,
++	0x03C, 0x00000800,
++	0x90000410,	0x00000000,	0x40000000,	0x00000000,
++	0x03C, 0x00000800,
++	0xA0000000,	0x00000000,
++	0x03C, 0x00000900,
++	0xB0000000,	0x00000000,
++	0x0EF, 0x00000000,
++	0x018, 0x0001712A,
++	0x0EF, 0x00000002,
++	0x80000111,	0x00000000,	0x40000000,	0x00000000,
++	0x008, 0x0004E400,
++	0x90000110,	0x00000000,	0x40000000,	0x00000000,
++	0x008, 0x0004E400,
++	0x90000210,	0x00000000,	0x40000000,	0x00000000,
++	0x008, 0x00002000,
++	0x9000020c,	0x00000000,	0x40000000,	0x00000000,
++	0x008, 0x00002000,
++	0x9000040c,	0x00000000,	0x40000000,	0x00000000,
++	0x008, 0x00002000,
++	0x90000200,	0x00000000,	0x40000000,	0x00000000,
++	0x008, 0x00002000,
++	0x90000410,	0x00000000,	0x40000000,	0x00000000,
++	0x008, 0x0004E400,
++	0xA0000000,	0x00000000,
++	0x008, 0x00002000,
++	0xB0000000,	0x00000000,
++	0x0EF, 0x00000000,
++	0x0DF, 0x000000C0,
++	0x01F, 0x00000064,
++	0x80000111,	0x00000000,	0x40000000,	0x00000000,
++	0x058, 0x000A7284,
++	0x059, 0x000600EC,
++	0x90000110,	0x00000000,	0x40000000,	0x00000000,
++	0x058, 0x000A7284,
++	0x059, 0x000600EC,
++	0x9000020c,	0x00000000,	0x40000000,	0x00000000,
++	0x058, 0x00081184,
++	0x059, 0x0006016C,
++	0x9000040c,	0x00000000,	0x40000000,	0x00000000,
++	0x058, 0x00081184,
++	0x059, 0x0006016C,
++	0x90000200,	0x00000000,	0x40000000,	0x00000000,
++	0x058, 0x00081184,
++	0x059, 0x0006016C,
++	0x90000410,	0x00000000,	0x40000000,	0x00000000,
++	0x058, 0x000A7284,
++	0x059, 0x000600EC,
++	0xA0000000,	0x00000000,
++	0x058, 0x00081184,
++	0x059, 0x0006016C,
++	0xB0000000,	0x00000000,
++	0x80000111,	0x00000000,	0x40000000,	0x00000000,
++	0x061, 0x000E8D73,
++	0x062, 0x00093FC5,
++	0x90000110,	0x00000000,	0x40000000,	0x00000000,
++	0x061, 0x000E8D73,
++	0x062, 0x00093FC5,
++	0x90000210,	0x00000000,	0x40000000,	0x00000000,
++	0x061, 0x000EFD83,
++	0x062, 0x00093FCC,
++	0x9000040c,	0x00000000,	0x40000000,	0x00000000,
++	0x061, 0x000EAD53,
++	0x062, 0x00093BC4,
++	0x90000200,	0x00000000,	0x40000000,	0x00000000,
++	0x061, 0x000EFD83,
++	0x062, 0x00093FCC,
++	0x90000410,	0x00000000,	0x40000000,	0x00000000,
++	0x061, 0x000E8D73,
++	0x062, 0x00093FC5,
++	0xA0000000,	0x00000000,
++	0x061, 0x000EAD53,
++	0x062, 0x00093BC4,
++	0xB0000000,	0x00000000,
++	0x80000111,	0x00000000,	0x40000000,	0x00000000,
++	0x063, 0x000110E9,
++	0x90000110,	0x00000000,	0x40000000,	0x00000000,
++	0x063, 0x000110E9,
++	0x90000210,	0x00000000,	0x40000000,	0x00000000,
++	0x063, 0x000110EB,
++	0x9000020c,	0x00000000,	0x40000000,	0x00000000,
++	0x063, 0x000110E9,
++	0x9000040c,	0x00000000,	0x40000000,	0x00000000,
++	0x063, 0x000110E9,
++	0x90000200,	0x00000000,	0x40000000,	0x00000000,
++	0x063, 0x000110EB,
++	0x90000410,	0x00000000,	0x40000000,	0x00000000,
++	0x063, 0x000110E9,
++	0xA0000000,	0x00000000,
++	0x063, 0x000714E9,
++	0xB0000000,	0x00000000,
++	0x80000111,	0x00000000,	0x40000000,	0x00000000,
++	0x064, 0x0001C27C,
++	0x90000110,	0x00000000,	0x40000000,	0x00000000,
++	0x064, 0x0001C27C,
++	0x90000210,	0x00000000,	0x40000000,	0x00000000,
++	0x064, 0x0001C27C,
++	0x9000040c,	0x00000000,	0x40000000,	0x00000000,
++	0x064, 0x0001C67C,
++	0x90000200,	0x00000000,	0x40000000,	0x00000000,
++	0x064, 0x0001C27C,
++	0x90000410,	0x00000000,	0x40000000,	0x00000000,
++	0x064, 0x0001C27C,
++	0xA0000000,	0x00000000,
++	0x064, 0x0001C67C,
++	0xB0000000,	0x00000000,
++	0x80000111,	0x00000000,	0x40000000,	0x00000000,
++	0x065, 0x00091016,
++	0x90000110,	0x00000000,	0x40000000,	0x00000000,
++	0x065, 0x00091016,
++	0x90000210,	0x00000000,	0x40000000,	0x00000000,
++	0x065, 0x00093016,
++	0x9000020c,	0x00000000,	0x40000000,	0x00000000,
++	0x065, 0x00093015,
++	0x9000040c,	0x00000000,	0x40000000,	0x00000000,
++	0x065, 0x00093015,
++	0x90000200,	0x00000000,	0x40000000,	0x00000000,
++	0x065, 0x00093016,
++	0xA0000000,	0x00000000,
++	0x065, 0x00091016,
++	0xB0000000,	0x00000000,
++	0x018, 0x00000006,
++	0x0EF, 0x00002000,
++	0x03B, 0x0003824B,
++	0x03B, 0x0003024B,
++	0x03B, 0x0002844B,
++	0x03B, 0x00020F4B,
++	0x03B, 0x00018F4B,
++	0x03B, 0x000104B2,
++	0x03B, 0x00008049,
++	0x03B, 0x00000148,
++	0x03B, 0x0007824B,
++	0x03B, 0x0007024B,
++	0x03B, 0x0006824B,
++	0x03B, 0x00060F4B,
++	0x03B, 0x00058F4B,
++	0x03B, 0x000504B2,
++	0x03B, 0x00048049,
++	0x03B, 0x00040148,
++	0x0EF, 0x00000000,
++	0x0EF, 0x00000100,
++	0x034, 0x0000ADF3,
++	0x034, 0x00009DF0,
++	0x034, 0x00008D70,
++	0x034, 0x00007D6D,
++	0x034, 0x00006CEE,
++	0x034, 0x00005CCC,
++	0x034, 0x000044EC,
++	0x034, 0x000034AC,
++	0x034, 0x0000246D,
++	0x034, 0x0000106F,
++	0x034, 0x0000006C,
++	0x0EF, 0x00000000,
++	0x0ED, 0x00000010,
++	0x044, 0x0000ADF2,
++	0x044, 0x00009DEF,
++	0x044, 0x00008DEC,
++	0x044, 0x00007DE9,
++	0x044, 0x00006CEC,
++	0x044, 0x00005CE9,
++	0x044, 0x000044EC,
++	0x044, 0x000034E9,
++	0x044, 0x0000246C,
++	0x044, 0x00001469,
++	0x044, 0x0000006C,
++	0x0ED, 0x00000000,
++	0x0ED, 0x00000001,
++	0x040, 0x00038DA7,
++	0x040, 0x000300C2,
++	0x040, 0x000288E2,
++	0x040, 0x000200B8,
++	0x040, 0x000188A5,
++	0x040, 0x00010FBC,
++	0x040, 0x00008F71,
++	0x040, 0x00000240,
++	0x0ED, 0x00000000,
++	0x0EF, 0x000020A2,
++	0x0DF, 0x00000080,
++	0x035, 0x00000120,
++	0x035, 0x00008120,
++	0x035, 0x00010120,
++	0x036, 0x00000085,
++	0x036, 0x00008085,
++	0x036, 0x00010085,
++	0x036, 0x00018085,
++	0x0EF, 0x00000000,
++	0x051, 0x00000C31,
++	0x052, 0x00000622,
++	0x053, 0x000FC70B,
++	0x054, 0x0000017E,
++	0x056, 0x00051DF3,
++	0x051, 0x00000C01,
++	0x052, 0x000006D6,
++	0x053, 0x000FC649,
++	0x070, 0x00049661,
++	0x071, 0x0007843E,
++	0x072, 0x00000382,
++	0x074, 0x00051400,
++	0x035, 0x00000160,
++	0x035, 0x00008160,
++	0x035, 0x00010160,
++	0x036, 0x00000124,
++	0x036, 0x00008124,
++	0x036, 0x00010124,
++	0x036, 0x00018124,
++	0x0ED, 0x0000000C,
++	0x045, 0x00000140,
++	0x045, 0x00008140,
++	0x045, 0x00010140,
++	0x046, 0x00000124,
++	0x046, 0x00008124,
++	0x046, 0x00010124,
++	0x046, 0x00018124,
++	0x0DF, 0x00000088,
++	0x0B3, 0x000F0E18,
++	0x0B4, 0x0001214C,
++	0x0B7, 0x0003000C,
++	0x01C, 0x000539D2,
++	0x0C4, 0x000AFE00,
++	0x018, 0x0001F12A,
++	0xFFE, 0x00000000,
++	0xFFE, 0x00000000,
++	0x018, 0x0001712A,
++};
++
++RTW_DECL_TABLE_RF_RADIO(rtw8821a_rf_a, A);
++
++static const struct rtw_txpwr_lmt_cfg_pair rtw8821a_txpwr_lmt[] = {
++	{ 0, 0, 0, 0, 1, 32, },
++	{ 2, 0, 0, 0, 1, 28, },
++	{ 1, 0, 0, 0, 1, 32, },
++	{ 0, 0, 0, 0, 2, 32, },
++	{ 2, 0, 0, 0, 2, 28, },
++	{ 1, 0, 0, 0, 2, 32, },
++	{ 0, 0, 0, 0, 3, 36, },
++	{ 2, 0, 0, 0, 3, 28, },
++	{ 1, 0, 0, 0, 3, 32, },
++	{ 0, 0, 0, 0, 4, 36, },
++	{ 2, 0, 0, 0, 4, 28, },
++	{ 1, 0, 0, 0, 4, 32, },
++	{ 0, 0, 0, 0, 5, 36, },
++	{ 2, 0, 0, 0, 5, 28, },
++	{ 1, 0, 0, 0, 5, 32, },
++	{ 0, 0, 0, 0, 6, 36, },
++	{ 2, 0, 0, 0, 6, 28, },
++	{ 1, 0, 0, 0, 6, 32, },
++	{ 0, 0, 0, 0, 7, 36, },
++	{ 2, 0, 0, 0, 7, 28, },
++	{ 1, 0, 0, 0, 7, 32, },
++	{ 0, 0, 0, 0, 8, 36, },
++	{ 2, 0, 0, 0, 8, 28, },
++	{ 1, 0, 0, 0, 8, 32, },
++	{ 0, 0, 0, 0, 9, 32, },
++	{ 2, 0, 0, 0, 9, 28, },
++	{ 1, 0, 0, 0, 9, 32, },
++	{ 0, 0, 0, 0, 10, 32, },
++	{ 2, 0, 0, 0, 10, 28, },
++	{ 1, 0, 0, 0, 10, 32, },
++	{ 0, 0, 0, 0, 11, 32, },
++	{ 2, 0, 0, 0, 11, 28, },
++	{ 1, 0, 0, 0, 11, 32, },
++	{ 0, 0, 0, 0, 12, 28, },
++	{ 2, 0, 0, 0, 12, 28, },
++	{ 1, 0, 0, 0, 12, 32, },
++	{ 0, 0, 0, 0, 13, 26, },
++	{ 2, 0, 0, 0, 13, 28, },
++	{ 1, 0, 0, 0, 13, 32, },
++	{ 0, 0, 0, 0, 14, 63, },
++	{ 2, 0, 0, 0, 14, 63, },
++	{ 1, 0, 0, 0, 14, 32, },
++	{ 0, 0, 0, 1, 1, 30, },
++	{ 2, 0, 0, 1, 1, 30, },
++	{ 1, 0, 0, 1, 1, 32, },
++	{ 0, 0, 0, 1, 2, 30, },
++	{ 2, 0, 0, 1, 2, 32, },
++	{ 1, 0, 0, 1, 2, 32, },
++	{ 0, 0, 0, 1, 3, 32, },
++	{ 2, 0, 0, 1, 3, 32, },
++	{ 1, 0, 0, 1, 3, 32, },
++	{ 0, 0, 0, 1, 4, 32, },
++	{ 2, 0, 0, 1, 4, 32, },
++	{ 1, 0, 0, 1, 4, 32, },
++	{ 0, 0, 0, 1, 5, 32, },
++	{ 2, 0, 0, 1, 5, 32, },
++	{ 1, 0, 0, 1, 5, 32, },
++	{ 0, 0, 0, 1, 6, 32, },
++	{ 2, 0, 0, 1, 6, 32, },
++	{ 1, 0, 0, 1, 6, 32, },
++	{ 0, 0, 0, 1, 7, 32, },
++	{ 2, 0, 0, 1, 7, 32, },
++	{ 1, 0, 0, 1, 7, 32, },
++	{ 0, 0, 0, 1, 8, 32, },
++	{ 2, 0, 0, 1, 8, 32, },
++	{ 1, 0, 0, 1, 8, 32, },
++	{ 0, 0, 0, 1, 9, 30, },
++	{ 2, 0, 0, 1, 9, 32, },
++	{ 1, 0, 0, 1, 9, 32, },
++	{ 0, 0, 0, 1, 10, 30, },
++	{ 2, 0, 0, 1, 10, 32, },
++	{ 1, 0, 0, 1, 10, 32, },
++	{ 0, 0, 0, 1, 11, 30, },
++	{ 2, 0, 0, 1, 11, 32, },
++	{ 1, 0, 0, 1, 11, 32, },
++	{ 0, 0, 0, 1, 12, 26, },
++	{ 2, 0, 0, 1, 12, 32, },
++	{ 1, 0, 0, 1, 12, 32, },
++	{ 0, 0, 0, 1, 13, 24, },
++	{ 2, 0, 0, 1, 13, 30, },
++	{ 1, 0, 0, 1, 13, 32, },
++	{ 0, 0, 0, 1, 14, 63, },
++	{ 2, 0, 0, 1, 14, 63, },
++	{ 1, 0, 0, 1, 14, 63, },
++	{ 0, 0, 0, 2, 1, 26, },
++	{ 2, 0, 0, 2, 1, 26, },
++	{ 1, 0, 0, 2, 1, 32, },
++	{ 0, 0, 0, 2, 2, 26, },
++	{ 2, 0, 0, 2, 2, 32, },
++	{ 1, 0, 0, 2, 2, 32, },
++	{ 0, 0, 0, 2, 3, 32, },
++	{ 2, 0, 0, 2, 3, 32, },
++	{ 1, 0, 0, 2, 3, 32, },
++	{ 0, 0, 0, 2, 4, 32, },
++	{ 2, 0, 0, 2, 4, 32, },
++	{ 1, 0, 0, 2, 4, 32, },
++	{ 0, 0, 0, 2, 5, 32, },
++	{ 2, 0, 0, 2, 5, 32, },
++	{ 1, 0, 0, 2, 5, 32, },
++	{ 0, 0, 0, 2, 6, 32, },
++	{ 2, 0, 0, 2, 6, 32, },
++	{ 1, 0, 0, 2, 6, 32, },
++	{ 0, 0, 0, 2, 7, 32, },
++	{ 2, 0, 0, 2, 7, 32, },
++	{ 1, 0, 0, 2, 7, 32, },
++	{ 0, 0, 0, 2, 8, 32, },
++	{ 2, 0, 0, 2, 8, 32, },
++	{ 1, 0, 0, 2, 8, 32, },
++	{ 0, 0, 0, 2, 9, 26, },
++	{ 2, 0, 0, 2, 9, 32, },
++	{ 1, 0, 0, 2, 9, 32, },
++	{ 0, 0, 0, 2, 10, 26, },
++	{ 2, 0, 0, 2, 10, 32, },
++	{ 1, 0, 0, 2, 10, 32, },
++	{ 0, 0, 0, 2, 11, 26, },
++	{ 2, 0, 0, 2, 11, 32, },
++	{ 1, 0, 0, 2, 11, 32, },
++	{ 0, 0, 0, 2, 12, 26, },
++	{ 2, 0, 0, 2, 12, 32, },
++	{ 1, 0, 0, 2, 12, 32, },
++	{ 0, 0, 0, 2, 13, 24, },
++	{ 2, 0, 0, 2, 13, 26, },
++	{ 1, 0, 0, 2, 13, 32, },
++	{ 0, 0, 0, 2, 14, 63, },
++	{ 2, 0, 0, 2, 14, 63, },
++	{ 1, 0, 0, 2, 14, 63, },
++	{ 0, 0, 0, 3, 1, 30, },
++	{ 2, 0, 0, 3, 1, 32, },
++	{ 1, 0, 0, 3, 1, 32, },
++	{ 0, 0, 0, 3, 2, 32, },
++	{ 2, 0, 0, 3, 2, 32, },
++	{ 1, 0, 0, 3, 2, 32, },
++	{ 0, 0, 0, 3, 3, 32, },
++	{ 2, 0, 0, 3, 3, 32, },
++	{ 1, 0, 0, 3, 3, 32, },
++	{ 0, 0, 0, 3, 4, 32, },
++	{ 2, 0, 0, 3, 4, 32, },
++	{ 1, 0, 0, 3, 4, 32, },
++	{ 0, 0, 0, 3, 5, 32, },
++	{ 2, 0, 0, 3, 5, 32, },
++	{ 1, 0, 0, 3, 5, 32, },
++	{ 0, 0, 0, 3, 6, 32, },
++	{ 2, 0, 0, 3, 6, 32, },
++	{ 1, 0, 0, 3, 6, 32, },
++	{ 0, 0, 0, 3, 7, 32, },
++	{ 2, 0, 0, 3, 7, 32, },
++	{ 1, 0, 0, 3, 7, 32, },
++	{ 0, 0, 0, 3, 8, 32, },
++	{ 2, 0, 0, 3, 8, 32, },
++	{ 1, 0, 0, 3, 8, 32, },
++	{ 0, 0, 0, 3, 9, 32, },
++	{ 2, 0, 0, 3, 9, 32, },
++	{ 1, 0, 0, 3, 9, 32, },
++	{ 0, 0, 0, 3, 10, 32, },
++	{ 2, 0, 0, 3, 10, 32, },
++	{ 1, 0, 0, 3, 10, 32, },
++	{ 0, 0, 0, 3, 11, 30, },
++	{ 2, 0, 0, 3, 11, 32, },
++	{ 1, 0, 0, 3, 11, 32, },
++	{ 0, 0, 0, 3, 12, 63, },
++	{ 2, 0, 0, 3, 12, 32, },
++	{ 1, 0, 0, 3, 12, 32, },
++	{ 0, 0, 0, 3, 13, 63, },
++	{ 2, 0, 0, 3, 13, 32, },
++	{ 1, 0, 0, 3, 13, 32, },
++	{ 0, 0, 0, 3, 14, 63, },
++	{ 2, 0, 0, 3, 14, 63, },
++	{ 1, 0, 0, 3, 14, 63, },
++	{ 0, 0, 1, 2, 1, 63, },
++	{ 2, 0, 1, 2, 1, 63, },
++	{ 1, 0, 1, 2, 1, 63, },
++	{ 0, 0, 1, 2, 2, 63, },
++	{ 2, 0, 1, 2, 2, 63, },
++	{ 1, 0, 1, 2, 2, 63, },
++	{ 0, 0, 1, 2, 3, 26, },
++	{ 2, 0, 1, 2, 3, 26, },
++	{ 1, 0, 1, 2, 3, 32, },
++	{ 0, 0, 1, 2, 4, 26, },
++	{ 2, 0, 1, 2, 4, 32, },
++	{ 1, 0, 1, 2, 4, 32, },
++	{ 0, 0, 1, 2, 5, 26, },
++	{ 2, 0, 1, 2, 5, 32, },
++	{ 1, 0, 1, 2, 5, 32, },
++	{ 0, 0, 1, 2, 6, 32, },
++	{ 2, 0, 1, 2, 6, 32, },
++	{ 1, 0, 1, 2, 6, 32, },
++	{ 0, 0, 1, 2, 7, 32, },
++	{ 2, 0, 1, 2, 7, 32, },
++	{ 1, 0, 1, 2, 7, 32, },
++	{ 0, 0, 1, 2, 8, 32, },
++	{ 2, 0, 1, 2, 8, 32, },
++	{ 1, 0, 1, 2, 8, 32, },
++	{ 0, 0, 1, 2, 9, 26, },
++	{ 2, 0, 1, 2, 9, 32, },
++	{ 1, 0, 1, 2, 9, 32, },
++	{ 0, 0, 1, 2, 10, 24, },
++	{ 2, 0, 1, 2, 10, 32, },
++	{ 1, 0, 1, 2, 10, 32, },
++	{ 0, 0, 1, 2, 11, 22, },
++	{ 2, 0, 1, 2, 11, 26, },
++	{ 1, 0, 1, 2, 11, 32, },
++	{ 0, 0, 1, 2, 12, 63, },
++	{ 2, 0, 1, 2, 12, 63, },
++	{ 1, 0, 1, 2, 12, 63, },
++	{ 0, 0, 1, 2, 13, 63, },
++	{ 2, 0, 1, 2, 13, 63, },
++	{ 1, 0, 1, 2, 13, 63, },
++	{ 0, 0, 1, 2, 14, 63, },
++	{ 2, 0, 1, 2, 14, 63, },
++	{ 1, 0, 1, 2, 14, 63, },
++	{ 0, 0, 1, 3, 1, 63, },
++	{ 2, 0, 1, 3, 1, 63, },
++	{ 1, 0, 1, 3, 1, 63, },
++	{ 0, 0, 1, 3, 2, 63, },
++	{ 2, 0, 1, 3, 2, 63, },
++	{ 1, 0, 1, 3, 2, 63, },
++	{ 0, 0, 1, 3, 3, 30, },
++	{ 2, 0, 1, 3, 3, 30, },
++	{ 1, 0, 1, 3, 3, 30, },
++	{ 0, 0, 1, 3, 4, 32, },
++	{ 2, 0, 1, 3, 4, 30, },
++	{ 1, 0, 1, 3, 4, 30, },
++	{ 0, 0, 1, 3, 5, 32, },
++	{ 2, 0, 1, 3, 5, 30, },
++	{ 1, 0, 1, 3, 5, 30, },
++	{ 0, 0, 1, 3, 6, 32, },
++	{ 2, 0, 1, 3, 6, 30, },
++	{ 1, 0, 1, 3, 6, 30, },
++	{ 0, 0, 1, 3, 7, 32, },
++	{ 2, 0, 1, 3, 7, 30, },
++	{ 1, 0, 1, 3, 7, 30, },
++	{ 0, 0, 1, 3, 8, 32, },
++	{ 2, 0, 1, 3, 8, 30, },
++	{ 1, 0, 1, 3, 8, 30, },
++	{ 0, 0, 1, 3, 9, 32, },
++	{ 2, 0, 1, 3, 9, 30, },
++	{ 1, 0, 1, 3, 9, 30, },
++	{ 0, 0, 1, 3, 10, 32, },
++	{ 2, 0, 1, 3, 10, 30, },
++	{ 1, 0, 1, 3, 10, 30, },
++	{ 0, 0, 1, 3, 11, 30, },
++	{ 2, 0, 1, 3, 11, 30, },
++	{ 1, 0, 1, 3, 11, 30, },
++	{ 0, 0, 1, 3, 12, 63, },
++	{ 2, 0, 1, 3, 12, 32, },
++	{ 1, 0, 1, 3, 12, 32, },
++	{ 0, 0, 1, 3, 13, 63, },
++	{ 2, 0, 1, 3, 13, 32, },
++	{ 1, 0, 1, 3, 13, 32, },
++	{ 0, 0, 1, 3, 14, 63, },
++	{ 2, 0, 1, 3, 14, 63, },
++	{ 1, 0, 1, 3, 14, 63, },
++	{ 0, 1, 0, 1, 36, 32, },
++	{ 2, 1, 0, 1, 36, 30, },
++	{ 1, 1, 0, 1, 36, 30, },
++	{ 0, 1, 0, 1, 40, 32, },
++	{ 2, 1, 0, 1, 40, 30, },
++	{ 1, 1, 0, 1, 40, 30, },
++	{ 0, 1, 0, 1, 44, 32, },
++	{ 2, 1, 0, 1, 44, 30, },
++	{ 1, 1, 0, 1, 44, 30, },
++	{ 0, 1, 0, 1, 48, 32, },
++	{ 2, 1, 0, 1, 48, 30, },
++	{ 1, 1, 0, 1, 48, 30, },
++	{ 0, 1, 0, 1, 52, 32, },
++	{ 2, 1, 0, 1, 52, 30, },
++	{ 1, 1, 0, 1, 52, 30, },
++	{ 0, 1, 0, 1, 56, 32, },
++	{ 2, 1, 0, 1, 56, 30, },
++	{ 1, 1, 0, 1, 56, 30, },
++	{ 0, 1, 0, 1, 60, 32, },
++	{ 2, 1, 0, 1, 60, 30, },
++	{ 1, 1, 0, 1, 60, 30, },
++	{ 0, 1, 0, 1, 64, 32, },
++	{ 2, 1, 0, 1, 64, 30, },
++	{ 1, 1, 0, 1, 64, 30, },
++	{ 0, 1, 0, 1, 100, 32, },
++	{ 2, 1, 0, 1, 100, 30, },
++	{ 1, 1, 0, 1, 100, 30, },
++	{ 0, 1, 0, 1, 104, 32, },
++	{ 2, 1, 0, 1, 104, 30, },
++	{ 1, 1, 0, 1, 104, 30, },
++	{ 0, 1, 0, 1, 108, 32, },
++	{ 2, 1, 0, 1, 108, 30, },
++	{ 1, 1, 0, 1, 108, 30, },
++	{ 0, 1, 0, 1, 112, 32, },
++	{ 2, 1, 0, 1, 112, 30, },
++	{ 1, 1, 0, 1, 112, 30, },
++	{ 0, 1, 0, 1, 116, 32, },
++	{ 2, 1, 0, 1, 116, 30, },
++	{ 1, 1, 0, 1, 116, 30, },
++	{ 0, 1, 0, 1, 120, 32, },
++	{ 2, 1, 0, 1, 120, 30, },
++	{ 1, 1, 0, 1, 120, 30, },
++	{ 0, 1, 0, 1, 124, 32, },
++	{ 2, 1, 0, 1, 124, 30, },
++	{ 1, 1, 0, 1, 124, 30, },
++	{ 0, 1, 0, 1, 128, 32, },
++	{ 2, 1, 0, 1, 128, 30, },
++	{ 1, 1, 0, 1, 128, 30, },
++	{ 0, 1, 0, 1, 132, 32, },
++	{ 2, 1, 0, 1, 132, 30, },
++	{ 1, 1, 0, 1, 132, 30, },
++	{ 0, 1, 0, 1, 136, 32, },
++	{ 2, 1, 0, 1, 136, 30, },
++	{ 1, 1, 0, 1, 136, 30, },
++	{ 0, 1, 0, 1, 140, 32, },
++	{ 2, 1, 0, 1, 140, 30, },
++	{ 1, 1, 0, 1, 140, 30, },
++	{ 0, 1, 0, 1, 149, 32, },
++	{ 2, 1, 0, 1, 149, 30, },
++	{ 1, 1, 0, 1, 149, 63, },
++	{ 0, 1, 0, 1, 153, 32, },
++	{ 2, 1, 0, 1, 153, 30, },
++	{ 1, 1, 0, 1, 153, 63, },
++	{ 0, 1, 0, 1, 157, 32, },
++	{ 2, 1, 0, 1, 157, 30, },
++	{ 1, 1, 0, 1, 157, 63, },
++	{ 0, 1, 0, 1, 161, 32, },
++	{ 2, 1, 0, 1, 161, 30, },
++	{ 1, 1, 0, 1, 161, 63, },
++	{ 0, 1, 0, 1, 165, 32, },
++	{ 2, 1, 0, 1, 165, 30, },
++	{ 1, 1, 0, 1, 165, 63, },
++	{ 0, 1, 0, 2, 36, 32, },
++	{ 2, 1, 0, 2, 36, 30, },
++	{ 1, 1, 0, 2, 36, 30, },
++	{ 0, 1, 0, 2, 40, 32, },
++	{ 2, 1, 0, 2, 40, 30, },
++	{ 1, 1, 0, 2, 40, 30, },
++	{ 0, 1, 0, 2, 44, 32, },
++	{ 2, 1, 0, 2, 44, 30, },
++	{ 1, 1, 0, 2, 44, 30, },
++	{ 0, 1, 0, 2, 48, 32, },
++	{ 2, 1, 0, 2, 48, 30, },
++	{ 1, 1, 0, 2, 48, 30, },
++	{ 0, 1, 0, 2, 52, 32, },
++	{ 2, 1, 0, 2, 52, 30, },
++	{ 1, 1, 0, 2, 52, 30, },
++	{ 0, 1, 0, 2, 56, 32, },
++	{ 2, 1, 0, 2, 56, 30, },
++	{ 1, 1, 0, 2, 56, 30, },
++	{ 0, 1, 0, 2, 60, 32, },
++	{ 2, 1, 0, 2, 60, 30, },
++	{ 1, 1, 0, 2, 60, 30, },
++	{ 0, 1, 0, 2, 64, 32, },
++	{ 2, 1, 0, 2, 64, 30, },
++	{ 1, 1, 0, 2, 64, 30, },
++	{ 0, 1, 0, 2, 100, 32, },
++	{ 2, 1, 0, 2, 100, 30, },
++	{ 1, 1, 0, 2, 100, 30, },
++	{ 0, 1, 0, 2, 104, 32, },
++	{ 2, 1, 0, 2, 104, 30, },
++	{ 1, 1, 0, 2, 104, 30, },
++	{ 0, 1, 0, 2, 108, 32, },
++	{ 2, 1, 0, 2, 108, 30, },
++	{ 1, 1, 0, 2, 108, 30, },
++	{ 0, 1, 0, 2, 112, 32, },
++	{ 2, 1, 0, 2, 112, 30, },
++	{ 1, 1, 0, 2, 112, 30, },
++	{ 0, 1, 0, 2, 116, 32, },
++	{ 2, 1, 0, 2, 116, 30, },
++	{ 1, 1, 0, 2, 116, 30, },
++	{ 0, 1, 0, 2, 120, 32, },
++	{ 2, 1, 0, 2, 120, 30, },
++	{ 1, 1, 0, 2, 120, 30, },
++	{ 0, 1, 0, 2, 124, 32, },
++	{ 2, 1, 0, 2, 124, 30, },
++	{ 1, 1, 0, 2, 124, 30, },
++	{ 0, 1, 0, 2, 128, 32, },
++	{ 2, 1, 0, 2, 128, 30, },
++	{ 1, 1, 0, 2, 128, 30, },
++	{ 0, 1, 0, 2, 132, 32, },
++	{ 2, 1, 0, 2, 132, 30, },
++	{ 1, 1, 0, 2, 132, 30, },
++	{ 0, 1, 0, 2, 136, 32, },
++	{ 2, 1, 0, 2, 136, 30, },
++	{ 1, 1, 0, 2, 136, 30, },
++	{ 0, 1, 0, 2, 140, 32, },
++	{ 2, 1, 0, 2, 140, 30, },
++	{ 1, 1, 0, 2, 140, 30, },
++	{ 0, 1, 0, 2, 149, 32, },
++	{ 2, 1, 0, 2, 149, 30, },
++	{ 1, 1, 0, 2, 149, 63, },
++	{ 0, 1, 0, 2, 153, 32, },
++	{ 2, 1, 0, 2, 153, 30, },
++	{ 1, 1, 0, 2, 153, 63, },
++	{ 0, 1, 0, 2, 157, 32, },
++	{ 2, 1, 0, 2, 157, 30, },
++	{ 1, 1, 0, 2, 157, 63, },
++	{ 0, 1, 0, 2, 161, 32, },
++	{ 2, 1, 0, 2, 161, 30, },
++	{ 1, 1, 0, 2, 161, 63, },
++	{ 0, 1, 0, 2, 165, 32, },
++	{ 2, 1, 0, 2, 165, 30, },
++	{ 1, 1, 0, 2, 165, 63, },
++	{ 0, 1, 0, 3, 36, 28, },
++	{ 2, 1, 0, 3, 36, 30, },
++	{ 1, 1, 0, 3, 36, 30, },
++	{ 0, 1, 0, 3, 40, 28, },
++	{ 2, 1, 0, 3, 40, 30, },
++	{ 1, 1, 0, 3, 40, 30, },
++	{ 0, 1, 0, 3, 44, 28, },
++	{ 2, 1, 0, 3, 44, 30, },
++	{ 1, 1, 0, 3, 44, 30, },
++	{ 0, 1, 0, 3, 48, 28, },
++	{ 2, 1, 0, 3, 48, 30, },
++	{ 1, 1, 0, 3, 48, 30, },
++	{ 0, 1, 0, 3, 52, 34, },
++	{ 2, 1, 0, 3, 52, 30, },
++	{ 1, 1, 0, 3, 52, 30, },
++	{ 0, 1, 0, 3, 56, 32, },
++	{ 2, 1, 0, 3, 56, 30, },
++	{ 1, 1, 0, 3, 56, 30, },
++	{ 0, 1, 0, 3, 60, 30, },
++	{ 2, 1, 0, 3, 60, 30, },
++	{ 1, 1, 0, 3, 60, 30, },
++	{ 0, 1, 0, 3, 64, 26, },
++	{ 2, 1, 0, 3, 64, 30, },
++	{ 1, 1, 0, 3, 64, 30, },
++	{ 0, 1, 0, 3, 100, 28, },
++	{ 2, 1, 0, 3, 100, 30, },
++	{ 1, 1, 0, 3, 100, 30, },
++	{ 0, 1, 0, 3, 104, 28, },
++	{ 2, 1, 0, 3, 104, 30, },
++	{ 1, 1, 0, 3, 104, 30, },
++	{ 0, 1, 0, 3, 108, 30, },
++	{ 2, 1, 0, 3, 108, 30, },
++	{ 1, 1, 0, 3, 108, 30, },
++	{ 0, 1, 0, 3, 112, 32, },
++	{ 2, 1, 0, 3, 112, 30, },
++	{ 1, 1, 0, 3, 112, 30, },
++	{ 0, 1, 0, 3, 116, 32, },
++	{ 2, 1, 0, 3, 116, 30, },
++	{ 1, 1, 0, 3, 116, 30, },
++	{ 0, 1, 0, 3, 120, 34, },
++	{ 2, 1, 0, 3, 120, 30, },
++	{ 1, 1, 0, 3, 120, 30, },
++	{ 0, 1, 0, 3, 124, 32, },
++	{ 2, 1, 0, 3, 124, 30, },
++	{ 1, 1, 0, 3, 124, 30, },
++	{ 0, 1, 0, 3, 128, 30, },
++	{ 2, 1, 0, 3, 128, 30, },
++	{ 1, 1, 0, 3, 128, 30, },
++	{ 0, 1, 0, 3, 132, 28, },
++	{ 2, 1, 0, 3, 132, 30, },
++	{ 1, 1, 0, 3, 132, 30, },
++	{ 0, 1, 0, 3, 136, 28, },
++	{ 2, 1, 0, 3, 136, 30, },
++	{ 1, 1, 0, 3, 136, 30, },
++	{ 0, 1, 0, 3, 140, 26, },
++	{ 2, 1, 0, 3, 140, 30, },
++	{ 1, 1, 0, 3, 140, 30, },
++	{ 0, 1, 0, 3, 149, 34, },
++	{ 2, 1, 0, 3, 149, 30, },
++	{ 1, 1, 0, 3, 149, 63, },
++	{ 0, 1, 0, 3, 153, 34, },
++	{ 2, 1, 0, 3, 153, 30, },
++	{ 1, 1, 0, 3, 153, 63, },
++	{ 0, 1, 0, 3, 157, 34, },
++	{ 2, 1, 0, 3, 157, 30, },
++	{ 1, 1, 0, 3, 157, 63, },
++	{ 0, 1, 0, 3, 161, 34, },
++	{ 2, 1, 0, 3, 161, 30, },
++	{ 1, 1, 0, 3, 161, 63, },
++	{ 0, 1, 0, 3, 165, 34, },
++	{ 2, 1, 0, 3, 165, 30, },
++	{ 1, 1, 0, 3, 165, 63, },
++	{ 0, 1, 1, 2, 38, 26, },
++	{ 2, 1, 1, 2, 38, 30, },
++	{ 1, 1, 1, 2, 38, 30, },
++	{ 0, 1, 1, 2, 46, 32, },
++	{ 2, 1, 1, 2, 46, 30, },
++	{ 1, 1, 1, 2, 46, 30, },
++	{ 0, 1, 1, 2, 54, 32, },
++	{ 2, 1, 1, 2, 54, 30, },
++	{ 1, 1, 1, 2, 54, 30, },
++	{ 0, 1, 1, 2, 62, 24, },
++	{ 2, 1, 1, 2, 62, 30, },
++	{ 1, 1, 1, 2, 62, 30, },
++	{ 0, 1, 1, 2, 102, 24, },
++	{ 2, 1, 1, 2, 102, 30, },
++	{ 1, 1, 1, 2, 102, 30, },
++	{ 0, 1, 1, 2, 110, 32, },
++	{ 2, 1, 1, 2, 110, 30, },
++	{ 1, 1, 1, 2, 110, 30, },
++	{ 0, 1, 1, 2, 118, 32, },
++	{ 2, 1, 1, 2, 118, 30, },
++	{ 1, 1, 1, 2, 118, 30, },
++	{ 0, 1, 1, 2, 126, 32, },
++	{ 2, 1, 1, 2, 126, 30, },
++	{ 1, 1, 1, 2, 126, 30, },
++	{ 0, 1, 1, 2, 134, 32, },
++	{ 2, 1, 1, 2, 134, 30, },
++	{ 1, 1, 1, 2, 134, 30, },
++	{ 0, 1, 1, 2, 151, 30, },
++	{ 2, 1, 1, 2, 151, 30, },
++	{ 1, 1, 1, 2, 151, 63, },
++	{ 0, 1, 1, 2, 159, 32, },
++	{ 2, 1, 1, 2, 159, 30, },
++	{ 1, 1, 1, 2, 159, 63, },
++	{ 0, 1, 1, 3, 38, 28, },
++	{ 2, 1, 1, 3, 38, 30, },
++	{ 1, 1, 1, 3, 38, 30, },
++	{ 0, 1, 1, 3, 46, 28, },
++	{ 2, 1, 1, 3, 46, 30, },
++	{ 1, 1, 1, 3, 46, 30, },
++	{ 0, 1, 1, 3, 54, 30, },
++	{ 2, 1, 1, 3, 54, 30, },
++	{ 1, 1, 1, 3, 54, 30, },
++	{ 0, 1, 1, 3, 62, 30, },
++	{ 2, 1, 1, 3, 62, 30, },
++	{ 1, 1, 1, 3, 62, 30, },
++	{ 0, 1, 1, 3, 102, 26, },
++	{ 2, 1, 1, 3, 102, 30, },
++	{ 1, 1, 1, 3, 102, 30, },
++	{ 0, 1, 1, 3, 110, 30, },
++	{ 2, 1, 1, 3, 110, 30, },
++	{ 1, 1, 1, 3, 110, 30, },
++	{ 0, 1, 1, 3, 118, 34, },
++	{ 2, 1, 1, 3, 118, 30, },
++	{ 1, 1, 1, 3, 118, 30, },
++	{ 0, 1, 1, 3, 126, 32, },
++	{ 2, 1, 1, 3, 126, 30, },
++	{ 1, 1, 1, 3, 126, 30, },
++	{ 0, 1, 1, 3, 134, 30, },
++	{ 2, 1, 1, 3, 134, 30, },
++	{ 1, 1, 1, 3, 134, 30, },
++	{ 0, 1, 1, 3, 151, 34, },
++	{ 2, 1, 1, 3, 151, 30, },
++	{ 1, 1, 1, 3, 151, 63, },
++	{ 0, 1, 1, 3, 159, 34, },
++	{ 2, 1, 1, 3, 159, 30, },
++	{ 1, 1, 1, 3, 159, 63, },
++	{ 0, 1, 2, 4, 42, 22, },
++	{ 2, 1, 2, 4, 42, 30, },
++	{ 1, 1, 2, 4, 42, 30, },
++	{ 0, 1, 2, 4, 58, 20, },
++	{ 2, 1, 2, 4, 58, 30, },
++	{ 1, 1, 2, 4, 58, 30, },
++	{ 0, 1, 2, 4, 106, 20, },
++	{ 2, 1, 2, 4, 106, 30, },
++	{ 1, 1, 2, 4, 106, 30, },
++	{ 0, 1, 2, 4, 122, 20, },
++	{ 2, 1, 2, 4, 122, 30, },
++	{ 1, 1, 2, 4, 122, 30, },
++	{ 0, 1, 2, 4, 155, 28, },
++	{ 2, 1, 2, 4, 155, 30, },
++	{ 1, 1, 2, 4, 155, 63, },
++	{ 0, 1, 2, 5, 42, 28, },
++	{ 2, 1, 2, 5, 42, 30, },
++	{ 1, 1, 2, 5, 42, 30, },
++	{ 0, 1, 2, 5, 58, 26, },
++	{ 2, 1, 2, 5, 58, 30, },
++	{ 1, 1, 2, 5, 58, 30, },
++	{ 0, 1, 2, 5, 106, 28, },
++	{ 2, 1, 2, 5, 106, 30, },
++	{ 1, 1, 2, 5, 106, 30, },
++	{ 0, 1, 2, 5, 122, 32, },
++	{ 2, 1, 2, 5, 122, 30, },
++	{ 1, 1, 2, 5, 122, 30, },
++	{ 0, 1, 2, 5, 155, 34, },
++	{ 2, 1, 2, 5, 155, 30, },
++	{ 1, 1, 2, 5, 155, 63, },
++};
++
++RTW_DECL_TABLE_TXPWR_LMT(rtw8821a_txpwr_lmt);
++
++static const struct rtw_pwr_seq_cmd trans_carddis_to_cardemu_8821a[] = {
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(3) | BIT(7), 0},
++	{0x0086,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_SDIO_MSK,
++	 RTW_PWR_ADDR_SDIO,
++	 RTW_PWR_CMD_WRITE, BIT(0), 0},
++	{0x0086,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_SDIO_MSK,
++	 RTW_PWR_ADDR_SDIO,
++	 RTW_PWR_CMD_POLLING, BIT(1), BIT(1)},
++	{0x004A,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(0), 0},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(3) | BIT(4), 0},
++	{0x0023,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_SDIO_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(4), 0},
++	{0x0301,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_PCI_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0},
++	{0xFFFF,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 0,
++	 RTW_PWR_CMD_END, 0, 0},
++};
++
++static const struct rtw_pwr_seq_cmd trans_cardemu_to_act_8821a[] = {
++	{0x0020,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK | RTW_PWR_INTF_SDIO_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(0), BIT(0)},
++	{0x0067,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK | RTW_PWR_INTF_SDIO_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(4), 0},
++	{0x0001,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK | RTW_PWR_INTF_SDIO_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_DELAY, 1, RTW_PWR_DELAY_MS},
++	{0x0000,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK | RTW_PWR_INTF_SDIO_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(5), 0},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(4) | BIT(3) | BIT(2), 0},
++	{0x0075,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_PCI_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(0), BIT(0)},
++	{0x0006,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_POLLING, BIT(1), BIT(1)},
++	{0x0075,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_PCI_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(0), 0},
++	{0x0006,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(0), BIT(0)},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(7), 0},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(4) | BIT(3), 0},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(0), BIT(0)},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_POLLING, BIT(0), 0},
++	{0x004F,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(0), BIT(0)},
++	{0x0067,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(5) | BIT(4), BIT(5) | BIT(4)},
++	{0x0025,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(6), 0},
++	{0x0049,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(1), BIT(1)},
++	{0x0063,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(1), BIT(1)},
++	{0x0062,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(1), 0},
++	{0x0058,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(0), BIT(0)},
++	{0x005A,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(1), BIT(1)},
++	{0x002E,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0x82},
++	{0x0010,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(6), BIT(6)},
++	{0xFFFF,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 0,
++	 RTW_PWR_CMD_END, 0, 0},
++};
++
++static const struct rtw_pwr_seq_cmd trans_act_to_lps_8821a[] = {
++	{0x0301,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_PCI_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0xFF},
++	{0x0522,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0xFF},
++	{0x05F8,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_POLLING, 0xFF, 0},
++	{0x05F9,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_POLLING, 0xFF, 0},
++	{0x05FA,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_POLLING, 0xFF, 0},
++	{0x05FB,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_POLLING, 0xFF, 0},
++	{0x0002,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(0), 0},
++	{0x0002,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_DELAY, 0, RTW_PWR_DELAY_US},
++	{0x0002,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(1), 0},
++	{0x0100,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0x03},
++	{0x0101,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(1), 0},
++	{0x0093,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_SDIO_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0x00},
++	{0x0553,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(5), BIT(5)},
++	{0xFFFF,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 0,
++	 RTW_PWR_CMD_END, 0, 0},
++};
++
++static const struct rtw_pwr_seq_cmd trans_act_to_cardemu_8821a[] = {
++	{0x001F,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0},
++	{0x004F,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(0), 0},
++	{0x0049,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(1), 0},
++	{0x0006,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(0), BIT(0)},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(1), BIT(1)},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_POLLING, BIT(1), 0},
++	{0x0000,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK | RTW_PWR_INTF_SDIO_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(5), BIT(5)},
++	{0x0020,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK | RTW_PWR_INTF_SDIO_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(0), 0},
++	{0xFFFF,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 0,
++	 RTW_PWR_CMD_END, 0, 0},
++};
++
++static const struct rtw_pwr_seq_cmd trans_cardemu_to_carddis_8821a[] = {
++	{0x0007,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_SDIO_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, 0xFF, 0x20},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK | RTW_PWR_INTF_SDIO_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(3) | BIT(4), BIT(3)},
++	{0x0005,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_PCI_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(2), BIT(2)},
++	{0x004A,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_USB_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(0), 1},
++	{0x0023,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_SDIO_MSK,
++	 RTW_PWR_ADDR_MAC,
++	 RTW_PWR_CMD_WRITE, BIT(4), BIT(4)},
++	{0x0086,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_SDIO_MSK,
++	 RTW_PWR_ADDR_SDIO,
++	 RTW_PWR_CMD_WRITE, BIT(0), BIT(0)},
++	{0x0086,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_SDIO_MSK,
++	 RTW_PWR_ADDR_SDIO,
++	 RTW_PWR_CMD_POLLING, BIT(1), 0},
++	{0xFFFF,
++	 RTW_PWR_CUT_ALL_MSK,
++	 RTW_PWR_INTF_ALL_MSK,
++	 0,
++	 RTW_PWR_CMD_END, 0, 0},
++};
++
++const struct rtw_pwr_seq_cmd * const card_enable_flow_8821a[] = {
++	trans_carddis_to_cardemu_8821a,
++	trans_cardemu_to_act_8821a,
++	NULL
++};
++
++const struct rtw_pwr_seq_cmd * const enter_lps_flow_8821a[] = {
++	trans_act_to_lps_8821a,
++	NULL
++};
++
++const struct rtw_pwr_seq_cmd * const card_disable_flow_8821a[] = {
++	trans_act_to_cardemu_8821a,
++	trans_cardemu_to_carddis_8821a,
++	NULL
++};
++
++static const u8 rtw8821a_pwrtrk_5gb_n[][RTW_PWR_TRK_TBL_SZ] = {
++	{0, 0, 1, 2, 3, 3, 4, 5, 6, 6, 7, 8, 9, 9, 10, 11, 12, 12, 13, 14, 15,
++	 15, 16, 16, 16, 16, 16, 16, 16, 16},
++	{0, 0, 1, 2, 3, 3, 4, 5, 6, 6, 7, 8, 9, 9, 10, 11, 12, 12, 13, 14, 15,
++	 15, 16, 16, 16, 16, 16, 16, 16, 16},
++	{0, 0, 1, 2, 3, 3, 4, 5, 6, 6, 7, 8, 9, 9, 10, 11, 12, 12, 13, 14, 15,
++	 15, 16, 16, 16, 16, 16, 16, 16, 16},
++};
++
++static const u8 rtw8821a_pwrtrk_5gb_p[][RTW_PWR_TRK_TBL_SZ] = {
++	{0, 0, 1, 2, 3, 3, 4, 5, 6, 6, 7, 8, 9, 9, 10, 11, 12, 12, 13, 14, 15,
++	 15, 16, 16, 16, 16, 16, 16, 16, 16},
++	{0, 0, 1, 2, 3, 3, 4, 5, 6, 6, 7, 8, 9, 9, 10, 11, 12, 12, 13, 14, 15,
++	 15, 16, 16, 16, 16, 16, 16, 16, 16},
++	{0, 0, 1, 2, 3, 3, 4, 5, 6, 6, 7, 8, 9, 9, 10, 11, 12, 12, 13, 14, 15,
++	 15, 16, 16, 16, 16, 16, 16, 16, 16},
++};
++
++static const u8 rtw8821a_pwrtrk_5ga_n[][RTW_PWR_TRK_TBL_SZ] = {
++	{0, 0, 1, 2, 3, 3, 4, 5, 6, 6, 7, 8, 9, 9, 10, 11, 12, 12, 13, 14, 15,
++	 15, 16, 16, 16, 16, 16, 16, 16, 16},
++	{0, 0, 1, 2, 3, 3, 4, 5, 6, 6, 7, 8, 9, 9, 10, 11, 12, 12, 13, 14, 15,
++	 15, 16, 16, 16, 16, 16, 16, 16, 16},
++	{0, 0, 1, 2, 3, 3, 4, 5, 6, 6, 7, 8, 9, 9, 10, 11, 12, 12, 13, 14, 15,
++	 15, 16, 16, 16, 16, 16, 16, 16, 16},
++};
++
++static const u8 rtw8821a_pwrtrk_5ga_p[][RTW_PWR_TRK_TBL_SZ] = {
++	{0, 0, 1, 2, 3, 3, 4, 5, 6, 6, 7, 8, 9, 9, 10, 11, 12, 12, 13, 14, 15,
++	 15, 16, 16, 16, 16, 16, 16, 16, 16},
++	{0, 0, 1, 2, 3, 3, 4, 5, 6, 6, 7, 8, 9, 9, 10, 11, 12, 12, 13, 14, 15,
++	 15, 16, 16, 16, 16, 16, 16, 16, 16},
++	{0, 0, 1, 2, 3, 3, 4, 5, 6, 6, 7, 8, 9, 9, 10, 11, 12, 12, 13, 14, 15,
++	 15, 16, 16, 16, 16, 16, 16, 16, 16},
++};
++
++static const u8 rtw8821a_pwrtrk_2gb_n[] = {
++	0, 1, 1, 2, 2, 2, 3, 3, 3, 4, 4, 4, 5, 5, 5, 6,
++	6, 6, 7, 7, 7, 8, 8, 8, 9, 9, 9, 10, 10, 10
++};
++
++static const u8 rtw8821a_pwrtrk_2gb_p[] = {
++	0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7,
++	8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 12, 12, 12, 12
++};
++
++static const u8 rtw8821a_pwrtrk_2ga_n[] = {
++	0, 1, 1, 2, 2, 2, 3, 3, 3, 4, 4, 4, 5, 5, 5, 6,
++	6, 6, 7, 7, 7, 8, 8, 8, 9, 9, 9, 10, 10, 10
++};
++
++static const u8 rtw8821a_pwrtrk_2ga_p[] = {
++	0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7,
++	8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 12, 12, 12, 12
++};
++
++static const u8 rtw8821a_pwrtrk_2g_cck_b_n[] = {
++	0, 1, 1, 2, 2, 2, 3, 3, 3, 4, 4, 4, 5, 5, 5, 6,
++	6, 6, 7, 7, 7, 8, 8, 8, 9, 9, 9, 10, 10, 10
++};
++
++static const u8 rtw8821a_pwrtrk_2g_cck_b_p[] = {
++	0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7,
++	8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 12, 12, 12, 12
++};
++
++static const u8 rtw8821a_pwrtrk_2g_cck_a_n[] = {
++	0, 1, 1, 2, 2, 2, 3, 3, 3, 4, 4, 4, 5, 5, 5, 6,
++	6, 6, 7, 7, 7, 8, 8, 8, 9, 9, 9, 10, 10, 10
++};
++
++static const u8 rtw8821a_pwrtrk_2g_cck_a_p[] = {
++	0, 0, 1, 1, 2, 2, 3, 3, 4, 4, 5, 5, 6, 6, 7, 7,
++	8, 8, 9, 9, 10, 10, 11, 11, 12, 12, 12, 12, 12, 12
++};
++
++const struct rtw_pwr_track_tbl rtw8821a_rtw_pwr_track_tbl = {
++	.pwrtrk_5gb_n[0] = rtw8821a_pwrtrk_5gb_n[0],
++	.pwrtrk_5gb_n[1] = rtw8821a_pwrtrk_5gb_n[1],
++	.pwrtrk_5gb_n[2] = rtw8821a_pwrtrk_5gb_n[2],
++	.pwrtrk_5gb_p[0] = rtw8821a_pwrtrk_5gb_p[0],
++	.pwrtrk_5gb_p[1] = rtw8821a_pwrtrk_5gb_p[1],
++	.pwrtrk_5gb_p[2] = rtw8821a_pwrtrk_5gb_p[2],
++	.pwrtrk_5ga_n[0] = rtw8821a_pwrtrk_5ga_n[0],
++	.pwrtrk_5ga_n[1] = rtw8821a_pwrtrk_5ga_n[1],
++	.pwrtrk_5ga_n[2] = rtw8821a_pwrtrk_5ga_n[2],
++	.pwrtrk_5ga_p[0] = rtw8821a_pwrtrk_5ga_p[0],
++	.pwrtrk_5ga_p[1] = rtw8821a_pwrtrk_5ga_p[1],
++	.pwrtrk_5ga_p[2] = rtw8821a_pwrtrk_5ga_p[2],
++	.pwrtrk_2gb_n = rtw8821a_pwrtrk_2gb_n,
++	.pwrtrk_2gb_p = rtw8821a_pwrtrk_2gb_p,
++	.pwrtrk_2ga_n = rtw8821a_pwrtrk_2ga_n,
++	.pwrtrk_2ga_p = rtw8821a_pwrtrk_2ga_p,
++	.pwrtrk_2g_cckb_n = rtw8821a_pwrtrk_2g_cck_b_n,
++	.pwrtrk_2g_cckb_p = rtw8821a_pwrtrk_2g_cck_b_p,
++	.pwrtrk_2g_ccka_n = rtw8821a_pwrtrk_2g_cck_a_n,
++	.pwrtrk_2g_ccka_p = rtw8821a_pwrtrk_2g_cck_a_p,
++};
+--- /dev/null
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821a_table.h
+@@ -0,0 +1,21 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
++/* Copyright(c) 2024  Realtek Corporation
++ */
++
++#ifndef __RTW8821A_TABLE_H__
++#define __RTW8821A_TABLE_H__
++
++extern const struct rtw_table rtw8821a_mac_tbl;
++extern const struct rtw_table rtw8821a_agc_tbl;
++extern const struct rtw_table rtw8821a_bb_tbl;
++extern const struct rtw_table rtw8821a_bb_pg_tbl;
++extern const struct rtw_table rtw8821a_rf_a_tbl;
++extern const struct rtw_table rtw8821a_txpwr_lmt_tbl;
++
++extern const struct rtw_pwr_seq_cmd * const card_enable_flow_8821a[];
++extern const struct rtw_pwr_seq_cmd * const enter_lps_flow_8821a[];
++extern const struct rtw_pwr_seq_cmd * const card_disable_flow_8821a[];
++
++extern const struct rtw_pwr_track_tbl rtw8821a_rtw_pwr_track_tbl;
++
++#endif
diff --git a/package/kernel/mac80211/patches/rtl/041-v6.13-wifi-rtw88-Add-rtw88xxa.-c-h.patch b/package/kernel/mac80211/patches/rtl/041-v6.13-wifi-rtw88-Add-rtw88xxa.-c-h.patch
new file mode 100644
index 00000000000000..79e1deebf795ac
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/041-v6.13-wifi-rtw88-Add-rtw88xxa.-c-h.patch
@@ -0,0 +1,2187 @@
+From b870b9d31c9e4e6b20c410e1e017f8c87d4c2ae0 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 30 Oct 2024 20:27:39 +0200
+Subject: [PATCH] wifi: rtw88: Add rtw88xxa.{c,h}
+
+These contain code shared by both RTL8821AU and RTL8812AU chips.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/b8590382-a954-412d-a96b-63e360b97acc@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/rtw88xxa.c | 1989 +++++++++++++++++
+ drivers/net/wireless/realtek/rtw88/rtw88xxa.h |  175 ++
+ 2 files changed, 2164 insertions(+)
+ create mode 100644 drivers/net/wireless/realtek/rtw88/rtw88xxa.c
+ create mode 100644 drivers/net/wireless/realtek/rtw88/rtw88xxa.h
+
+--- /dev/null
++++ b/drivers/net/wireless/realtek/rtw88/rtw88xxa.c
+@@ -0,0 +1,1989 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
++/* Copyright(c) 2024  Realtek Corporation
++ */
++
++#include <linux/usb.h>
++#include "main.h"
++#include "coex.h"
++#include "phy.h"
++#include "rtw88xxa.h"
++#include "mac.h"
++#include "reg.h"
++#include "sec.h"
++#include "debug.h"
++#include "bf.h"
++#include "efuse.h"
++#include "usb.h"
++
++void rtw88xxa_efuse_grant(struct rtw_dev *rtwdev, bool on)
++{
++	if (on) {
++		rtw_write8(rtwdev, REG_EFUSE_ACCESS, EFUSE_ACCESS_ON);
++
++		rtw_write16_set(rtwdev, REG_SYS_FUNC_EN, BIT_FEN_ELDR);
++		rtw_write16_set(rtwdev, REG_SYS_CLKR,
++				BIT_LOADER_CLK_EN | BIT_ANA8M);
++	} else {
++		rtw_write8(rtwdev, REG_EFUSE_ACCESS, EFUSE_ACCESS_OFF);
++	}
++}
++EXPORT_SYMBOL(rtw88xxa_efuse_grant);
++
++static void rtw8812a_read_amplifier_type(struct rtw_dev *rtwdev)
++{
++	struct rtw_efuse *efuse = &rtwdev->efuse;
++
++	efuse->ext_pa_2g = (efuse->pa_type_2g & BIT(5)) &&
++			   (efuse->pa_type_2g & BIT(4));
++	efuse->ext_lna_2g = (efuse->lna_type_2g & BIT(7)) &&
++			    (efuse->lna_type_2g & BIT(3));
++
++	efuse->ext_pa_5g = (efuse->pa_type_5g & BIT(1)) &&
++			   (efuse->pa_type_5g & BIT(0));
++	efuse->ext_lna_5g = (efuse->lna_type_5g & BIT(7)) &&
++			    (efuse->lna_type_5g & BIT(3));
++
++	/* For rtw_phy_cond2: */
++	if (efuse->ext_pa_2g) {
++		u8 ext_type_pa_2g_a = u8_get_bits(efuse->lna_type_2g, BIT(2));
++		u8 ext_type_pa_2g_b = u8_get_bits(efuse->lna_type_2g, BIT(6));
++
++		efuse->gpa_type = (ext_type_pa_2g_b << 2) | ext_type_pa_2g_a;
++	}
++
++	if (efuse->ext_pa_5g) {
++		u8 ext_type_pa_5g_a = u8_get_bits(efuse->lna_type_5g, BIT(2));
++		u8 ext_type_pa_5g_b = u8_get_bits(efuse->lna_type_5g, BIT(6));
++
++		efuse->apa_type = (ext_type_pa_5g_b << 2) | ext_type_pa_5g_a;
++	}
++
++	if (efuse->ext_lna_2g) {
++		u8 ext_type_lna_2g_a = u8_get_bits(efuse->lna_type_2g,
++						   BIT(1) | BIT(0));
++		u8 ext_type_lna_2g_b = u8_get_bits(efuse->lna_type_2g,
++						   BIT(5) | BIT(4));
++
++		efuse->glna_type = (ext_type_lna_2g_b << 2) | ext_type_lna_2g_a;
++	}
++
++	if (efuse->ext_lna_5g) {
++		u8 ext_type_lna_5g_a = u8_get_bits(efuse->lna_type_5g,
++						   BIT(1) | BIT(0));
++		u8 ext_type_lna_5g_b = u8_get_bits(efuse->lna_type_5g,
++						   BIT(5) | BIT(4));
++
++		efuse->alna_type = (ext_type_lna_5g_b << 2) | ext_type_lna_5g_a;
++	}
++}
++
++static void rtw8812a_read_rfe_type(struct rtw_dev *rtwdev,
++				   struct rtw88xxa_efuse *map)
++{
++	struct rtw_efuse *efuse = &rtwdev->efuse;
++
++	if (map->rfe_option == 0xff) {
++		if (rtwdev->hci.type == RTW_HCI_TYPE_USB)
++			efuse->rfe_option = 0;
++		else if (rtwdev->hci.type == RTW_HCI_TYPE_PCIE)
++			efuse->rfe_option = 2;
++		else
++			efuse->rfe_option = 4;
++	} else if (map->rfe_option & BIT(7)) {
++		if (efuse->ext_lna_5g) {
++			if (efuse->ext_pa_5g) {
++				if (efuse->ext_lna_2g && efuse->ext_pa_2g)
++					efuse->rfe_option = 3;
++				else
++					efuse->rfe_option = 0;
++			} else {
++				efuse->rfe_option = 2;
++			}
++		} else {
++			efuse->rfe_option = 4;
++		}
++	} else {
++		efuse->rfe_option = map->rfe_option & 0x3f;
++
++		/* Due to other customer already use incorrect EFUSE map for
++		 * their product. We need to add workaround to prevent to
++		 * modify spec and notify all customer to revise the IC 0xca
++		 * content.
++		 */
++		if (efuse->rfe_option == 4 &&
++		    (efuse->ext_pa_5g || efuse->ext_pa_2g ||
++		     efuse->ext_lna_5g || efuse->ext_lna_2g)) {
++			if (rtwdev->hci.type == RTW_HCI_TYPE_USB)
++				efuse->rfe_option = 0;
++			else if (rtwdev->hci.type == RTW_HCI_TYPE_PCIE)
++				efuse->rfe_option = 2;
++		}
++	}
++}
++
++static void rtw88xxa_read_usb_type(struct rtw_dev *rtwdev)
++{
++	struct rtw_efuse *efuse = &rtwdev->efuse;
++	struct rtw_hal *hal = &rtwdev->hal;
++	u8 antenna = 0;
++	u8 wmode = 0;
++	u8 val8, i;
++
++	efuse->hw_cap.bw = BIT(RTW_CHANNEL_WIDTH_20) |
++			   BIT(RTW_CHANNEL_WIDTH_40) |
++			   BIT(RTW_CHANNEL_WIDTH_80);
++	efuse->hw_cap.ptcl = EFUSE_HW_CAP_PTCL_VHT;
++
++	if (rtwdev->chip->id == RTW_CHIP_TYPE_8821A)
++		efuse->hw_cap.nss = 1;
++	else
++		efuse->hw_cap.nss = 2;
++
++	if (rtwdev->chip->id == RTW_CHIP_TYPE_8821A)
++		goto print_hw_cap;
++
++	for (i = 0; i < 2; i++) {
++		rtw_read8_physical_efuse(rtwdev, 1019 - i, &val8);
++
++		antenna = u8_get_bits(val8, GENMASK(7, 5));
++		if (antenna)
++			break;
++		antenna = u8_get_bits(val8, GENMASK(3, 1));
++		if (antenna)
++			break;
++	}
++
++	for (i = 0; i < 2; i++) {
++		rtw_read8_physical_efuse(rtwdev, 1021 - i, &val8);
++
++		wmode = u8_get_bits(val8, GENMASK(3, 2));
++		if (wmode)
++			break;
++	}
++
++	if (antenna == 1) {
++		rtw_info(rtwdev, "This RTL8812AU says it is 1T1R.\n");
++
++		efuse->hw_cap.nss = 1;
++		hal->rf_type = RF_1T1R;
++		hal->rf_path_num = 1;
++		hal->rf_phy_num = 1;
++		hal->antenna_tx = BB_PATH_A;
++		hal->antenna_rx = BB_PATH_A;
++	} else {
++		/* Override rtw_chip_parameter_setup(). It detects 8812au as 1T1R. */
++		efuse->hw_cap.nss = 2;
++		hal->rf_type = RF_2T2R;
++		hal->rf_path_num = 2;
++		hal->rf_phy_num = 2;
++		hal->antenna_tx = BB_PATH_AB;
++		hal->antenna_rx = BB_PATH_AB;
++
++		if (antenna == 2 && wmode == 2) {
++			rtw_info(rtwdev, "This RTL8812AU says it can't do VHT.\n");
++
++			/* Can't be EFUSE_HW_CAP_IGNORE and can't be
++			 * EFUSE_HW_CAP_PTCL_VHT, so make it 1.
++			 */
++			efuse->hw_cap.ptcl = 1;
++			efuse->hw_cap.bw &= ~BIT(RTW_CHANNEL_WIDTH_80);
++		}
++	}
++
++print_hw_cap:
++	rtw_dbg(rtwdev, RTW_DBG_EFUSE,
++		"hw cap: hci=0x%02x, bw=0x%02x, ptcl=0x%02x, ant_num=%d, nss=%d\n",
++		efuse->hw_cap.hci, efuse->hw_cap.bw, efuse->hw_cap.ptcl,
++		efuse->hw_cap.ant_num, efuse->hw_cap.nss);
++}
++
++int rtw88xxa_read_efuse(struct rtw_dev *rtwdev, u8 *log_map)
++{
++	const struct rtw_chip_info *chip = rtwdev->chip;
++	struct rtw_efuse *efuse = &rtwdev->efuse;
++	struct rtw88xxa_efuse *map;
++	int i;
++
++	if (chip->id == RTW_CHIP_TYPE_8812A)
++		rtwdev->hal.cut_version += 1;
++
++	if (rtw_dbg_is_enabled(rtwdev, RTW_DBG_EFUSE))
++		print_hex_dump(KERN_INFO, "", DUMP_PREFIX_OFFSET, 16, 1,
++			       log_map, chip->log_efuse_size, true);
++
++	map = (struct rtw88xxa_efuse *)log_map;
++
++	efuse->rf_board_option = map->rf_board_option;
++	efuse->crystal_cap = map->xtal_k;
++	if (efuse->crystal_cap == 0xff)
++		efuse->crystal_cap = 0x20;
++	efuse->pa_type_2g = map->pa_type;
++	efuse->pa_type_5g = map->pa_type;
++	efuse->lna_type_2g = map->lna_type_2g;
++	efuse->lna_type_5g = map->lna_type_5g;
++	if (chip->id == RTW_CHIP_TYPE_8812A) {
++		rtw8812a_read_amplifier_type(rtwdev);
++		rtw8812a_read_rfe_type(rtwdev, map);
++
++		efuse->usb_mode_switch = u8_get_bits(map->usb_mode, BIT(1));
++	}
++	efuse->channel_plan = map->channel_plan;
++	efuse->country_code[0] = map->country_code[0];
++	efuse->country_code[1] = map->country_code[1];
++	efuse->bt_setting = map->rf_bt_setting;
++	efuse->regd = map->rf_board_option & 0x7;
++	efuse->thermal_meter[0] = map->thermal_meter;
++	efuse->thermal_meter[1] = map->thermal_meter;
++	efuse->thermal_meter_k = map->thermal_meter;
++	efuse->tx_bb_swing_setting_2g = map->tx_bb_swing_setting_2g;
++	efuse->tx_bb_swing_setting_5g = map->tx_bb_swing_setting_5g;
++
++	rtw88xxa_read_usb_type(rtwdev);
++
++	if (chip->id == RTW_CHIP_TYPE_8821A)
++		efuse->btcoex = rtw_read32_mask(rtwdev, REG_WL_BT_PWR_CTRL,
++						BIT_BT_FUNC_EN);
++	else
++		efuse->btcoex = (map->rf_board_option & 0xe0) == 0x20;
++	efuse->share_ant = !!(efuse->bt_setting & BIT(0));
++
++	/* No antenna diversity because it's disabled in the vendor driver */
++	efuse->ant_div_cfg = 0;
++
++	efuse->ant_div_type = map->rf_antenna_option;
++	if (efuse->ant_div_type == 0xff)
++		efuse->ant_div_type = 0x3;
++
++	for (i = 0; i < 4; i++)
++		efuse->txpwr_idx_table[i] = map->txpwr_idx_table[i];
++
++	switch (rtw_hci_type(rtwdev)) {
++	case RTW_HCI_TYPE_USB:
++		if (chip->id == RTW_CHIP_TYPE_8821A)
++			ether_addr_copy(efuse->addr, map->rtw8821au.mac_addr);
++		else
++			ether_addr_copy(efuse->addr, map->rtw8812au.mac_addr);
++		break;
++	case RTW_HCI_TYPE_PCIE:
++	case RTW_HCI_TYPE_SDIO:
++	default:
++		/* unsupported now */
++		return -EOPNOTSUPP;
++	}
++
++	return 0;
++}
++EXPORT_SYMBOL(rtw88xxa_read_efuse);
++
++static void rtw88xxa_reset_8051(struct rtw_dev *rtwdev)
++{
++	const struct rtw_chip_info *chip = rtwdev->chip;
++	u8 val8;
++
++	/* Reset MCU IO Wrapper */
++	rtw_write8_clr(rtwdev, REG_RSV_CTRL, BIT(1));
++	if (chip->id == RTW_CHIP_TYPE_8812A)
++		rtw_write8_clr(rtwdev, REG_RSV_CTRL + 1, BIT(3));
++	else
++		rtw_write8_clr(rtwdev, REG_RSV_CTRL + 1, BIT(0));
++
++	val8 = rtw_read8(rtwdev, REG_SYS_FUNC_EN + 1);
++	rtw_write8(rtwdev, REG_SYS_FUNC_EN + 1, val8 & ~BIT(2));
++
++	/* Enable MCU IO Wrapper */
++	rtw_write8_clr(rtwdev, REG_RSV_CTRL, BIT(1));
++	if (chip->id == RTW_CHIP_TYPE_8812A)
++		rtw_write8_set(rtwdev, REG_RSV_CTRL + 1, BIT(3));
++	else
++		rtw_write8_set(rtwdev, REG_RSV_CTRL + 1, BIT(0));
++
++	rtw_write8(rtwdev, REG_SYS_FUNC_EN + 1, val8 | BIT(2));
++}
++
++/* A lightweight deinit function */
++static void rtw88xxau_hw_reset(struct rtw_dev *rtwdev)
++{
++	u8 val8;
++
++	if (!(rtw_read8(rtwdev, REG_MCUFW_CTRL) & BIT_RAM_DL_SEL))
++		return;
++
++	rtw88xxa_reset_8051(rtwdev);
++	rtw_write8(rtwdev, REG_MCUFW_CTRL, 0x00);
++
++	/* before BB reset should do clock gated */
++	rtw_write32_set(rtwdev, REG_FPGA0_XCD_RF_PARA, BIT(6));
++
++	/* reset BB */
++	rtw_write8_clr(rtwdev, REG_SYS_FUNC_EN, BIT(0) | BIT(1));
++
++	/* reset RF */
++	rtw_write8(rtwdev, REG_RF_CTRL, 0);
++
++	/* reset TRX path */
++	rtw_write16(rtwdev, REG_CR, 0);
++
++	/* reset MAC, reg0x5[1], auto FSM off */
++	rtw_write8_set(rtwdev, REG_APS_FSMCO + 1, APS_FSMCO_MAC_OFF >> 8);
++
++	/* check if reg0x5[1] auto cleared */
++	if (read_poll_timeout_atomic(rtw_read8, val8,
++				     !(val8 & (APS_FSMCO_MAC_OFF >> 8)),
++				     1, 5000, false,
++				     rtwdev, REG_APS_FSMCO + 1))
++		rtw_err(rtwdev, "%s: timed out waiting for 0x5[1]\n", __func__);
++
++	/* reg0x5[0], auto FSM on */
++	val8 |= APS_FSMCO_MAC_ENABLE >> 8;
++	rtw_write8(rtwdev, REG_APS_FSMCO + 1, val8);
++
++	rtw_write8_clr(rtwdev, REG_SYS_FUNC_EN + 1, BIT(4) | BIT(7));
++	rtw_write8_set(rtwdev, REG_SYS_FUNC_EN + 1, BIT(4) | BIT(7));
++}
++
++static int rtw88xxau_init_power_on(struct rtw_dev *rtwdev)
++{
++	const struct rtw_chip_info *chip = rtwdev->chip;
++	u16 val16;
++	int ret;
++
++	ret = rtw_pwr_seq_parser(rtwdev, chip->pwr_on_seq);
++	if (ret) {
++		rtw_err(rtwdev, "power on flow failed\n");
++		return ret;
++	}
++
++	rtw_write16(rtwdev, REG_CR, 0);
++	val16 = BIT_HCI_TXDMA_EN | BIT_HCI_RXDMA_EN | BIT_TXDMA_EN |
++		BIT_RXDMA_EN | BIT_PROTOCOL_EN | BIT_SCHEDULE_EN |
++		BIT_MAC_SEC_EN | BIT_32K_CAL_TMR_EN;
++	rtw_write16_set(rtwdev, REG_CR, val16);
++
++	if (chip->id == RTW_CHIP_TYPE_8821A) {
++		if (rtw_read8(rtwdev, REG_SYS_CFG1 + 3) & BIT(0))
++			rtw_write8_set(rtwdev, REG_LDO_SWR_CTRL, BIT(6));
++	}
++
++	return ret;
++}
++
++static int rtw88xxa_llt_write(struct rtw_dev *rtwdev, u32 address, u32 data)
++{
++	u32 value = BIT_LLT_WRITE_ACCESS | (address << 8) | data;
++	int count = 0;
++
++	rtw_write32(rtwdev, REG_LLT_INIT, value);
++
++	do {
++		if (!rtw_read32_mask(rtwdev, REG_LLT_INIT, BIT(31) | BIT(30)))
++			break;
++
++		if (count > 20) {
++			rtw_err(rtwdev, "Failed to poll write LLT done at %d!\n",
++				address);
++			return -EBUSY;
++		}
++	} while (++count);
++
++	return 0;
++}
++
++static int rtw88xxa_llt_init(struct rtw_dev *rtwdev, u32 boundary)
++{
++	u32 last_entry = 255;
++	int status = 0;
++	u32 i;
++
++	for (i = 0; i < boundary - 1; i++) {
++		status = rtw88xxa_llt_write(rtwdev, i, i + 1);
++		if (status)
++			return status;
++	}
++
++	status = rtw88xxa_llt_write(rtwdev, boundary - 1, 0xFF);
++	if (status)
++		return status;
++
++	for (i = boundary; i < last_entry; i++) {
++		status = rtw88xxa_llt_write(rtwdev, i, i + 1);
++		if (status)
++			return status;
++	}
++
++	status = rtw88xxa_llt_write(rtwdev, last_entry, boundary);
++
++	return status;
++}
++
++static void rtw88xxau_init_queue_reserved_page(struct rtw_dev *rtwdev)
++{
++	const struct rtw_chip_info *chip = rtwdev->chip;
++	struct rtw_fifo_conf *fifo = &rtwdev->fifo;
++	const struct rtw_page_table *pg_tbl = NULL;
++	u16 pubq_num;
++	u32 val32;
++
++	switch (rtw_hci_type(rtwdev)) {
++	case RTW_HCI_TYPE_PCIE:
++		pg_tbl = &chip->page_table[1];
++		break;
++	case RTW_HCI_TYPE_USB:
++		if (rtwdev->hci.bulkout_num == 2)
++			pg_tbl = &chip->page_table[2];
++		else if (rtwdev->hci.bulkout_num == 3)
++			pg_tbl = &chip->page_table[3];
++		else if (rtwdev->hci.bulkout_num == 4)
++			pg_tbl = &chip->page_table[4];
++		break;
++	case RTW_HCI_TYPE_SDIO:
++		pg_tbl = &chip->page_table[0];
++		break;
++	default:
++		break;
++	}
++
++	pubq_num = fifo->acq_pg_num - pg_tbl->hq_num - pg_tbl->lq_num -
++		   pg_tbl->nq_num - pg_tbl->exq_num - pg_tbl->gapq_num;
++
++	val32 = BIT_RQPN_NE(pg_tbl->nq_num, pg_tbl->exq_num);
++	rtw_write32(rtwdev, REG_RQPN_NPQ, val32);
++
++	val32 = BIT_RQPN_HLP(pg_tbl->hq_num, pg_tbl->lq_num, pubq_num);
++	rtw_write32(rtwdev, REG_RQPN, val32);
++}
++
++static void rtw88xxau_init_tx_buffer_boundary(struct rtw_dev *rtwdev)
++{
++	struct rtw_fifo_conf *fifo = &rtwdev->fifo;
++
++	rtw_write8(rtwdev, REG_BCNQ_BDNY, fifo->rsvd_boundary);
++	rtw_write8(rtwdev, REG_MGQ_BDNY, fifo->rsvd_boundary);
++	rtw_write8(rtwdev, REG_WMAC_LBK_BF_HD, fifo->rsvd_boundary);
++	rtw_write8(rtwdev, REG_TRXFF_BNDY, fifo->rsvd_boundary);
++	rtw_write8(rtwdev, REG_DWBCN0_CTRL + 1, fifo->rsvd_boundary);
++}
++
++static int rtw88xxau_init_queue_priority(struct rtw_dev *rtwdev)
++{
++	const struct rtw_chip_info *chip = rtwdev->chip;
++	u8 bulkout_num = rtwdev->hci.bulkout_num;
++	const struct rtw_rqpn *rqpn = NULL;
++	u16 txdma_pq_map;
++
++	switch (rtw_hci_type(rtwdev)) {
++	case RTW_HCI_TYPE_PCIE:
++		rqpn = &chip->rqpn_table[1];
++		break;
++	case RTW_HCI_TYPE_USB:
++		if (bulkout_num == 2)
++			rqpn = &chip->rqpn_table[2];
++		else if (bulkout_num == 3)
++			rqpn = &chip->rqpn_table[3];
++		else if (bulkout_num == 4)
++			rqpn = &chip->rqpn_table[4];
++		else
++			return -EINVAL;
++		break;
++	case RTW_HCI_TYPE_SDIO:
++		rqpn = &chip->rqpn_table[0];
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	rtwdev->fifo.rqpn = rqpn;
++
++	txdma_pq_map = rtw_read16(rtwdev, REG_TXDMA_PQ_MAP) & 0x7;
++	txdma_pq_map |= BIT_TXDMA_HIQ_MAP(rqpn->dma_map_hi);
++	txdma_pq_map |= BIT_TXDMA_MGQ_MAP(rqpn->dma_map_mg);
++	txdma_pq_map |= BIT_TXDMA_BKQ_MAP(rqpn->dma_map_bk);
++	txdma_pq_map |= BIT_TXDMA_BEQ_MAP(rqpn->dma_map_be);
++	txdma_pq_map |= BIT_TXDMA_VIQ_MAP(rqpn->dma_map_vi);
++	txdma_pq_map |= BIT_TXDMA_VOQ_MAP(rqpn->dma_map_vo);
++	rtw_write16(rtwdev, REG_TXDMA_PQ_MAP, txdma_pq_map);
++
++	/* Packet in Hi Queue Tx immediately (No constraint for ATIM Period). */
++	if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_USB && bulkout_num == 4)
++		rtw_write8(rtwdev, REG_HIQ_NO_LMT_EN, 0xff);
++
++	return 0;
++}
++
++static void rtw88xxa_init_wmac_setting(struct rtw_dev *rtwdev)
++{
++	rtw_write16(rtwdev, REG_RXFLTMAP0, 0xffff);
++	rtw_write16(rtwdev, REG_RXFLTMAP1, 0x0400);
++	rtw_write16(rtwdev, REG_RXFLTMAP2, 0xffff);
++
++	rtw_write32(rtwdev, REG_MAR, 0xffffffff);
++	rtw_write32(rtwdev, REG_MAR + 4, 0xffffffff);
++}
++
++static void rtw88xxa_init_adaptive_ctrl(struct rtw_dev *rtwdev)
++{
++	rtw_write32_mask(rtwdev, REG_RRSR, 0xfffff, 0xffff1);
++	rtw_write16(rtwdev, REG_RETRY_LIMIT, 0x3030);
++}
++
++static void rtw88xxa_init_edca(struct rtw_dev *rtwdev)
++{
++	rtw_write16(rtwdev, REG_SPEC_SIFS, 0x100a);
++	rtw_write16(rtwdev, REG_MAC_SPEC_SIFS, 0x100a);
++
++	rtw_write16(rtwdev, REG_SIFS, 0x100a);
++	rtw_write16(rtwdev, REG_SIFS + 2, 0x100a);
++
++	rtw_write32(rtwdev, REG_EDCA_BE_PARAM, 0x005EA42B);
++	rtw_write32(rtwdev, REG_EDCA_BK_PARAM, 0x0000A44F);
++	rtw_write32(rtwdev, REG_EDCA_VI_PARAM, 0x005EA324);
++	rtw_write32(rtwdev, REG_EDCA_VO_PARAM, 0x002FA226);
++
++	rtw_write8(rtwdev, REG_USTIME_TSF, 0x50);
++	rtw_write8(rtwdev, REG_USTIME_EDCA, 0x50);
++}
++
++static void rtw88xxau_tx_aggregation(struct rtw_dev *rtwdev)
++{
++	const struct rtw_chip_info *chip = rtwdev->chip;
++
++	rtw_write32_mask(rtwdev, REG_DWBCN0_CTRL, 0xf0,
++			 chip->usb_tx_agg_desc_num);
++
++	if (chip->id == RTW_CHIP_TYPE_8821A)
++		rtw_write8(rtwdev, REG_DWBCN1_CTRL,
++			   chip->usb_tx_agg_desc_num << 1);
++}
++
++static void rtw88xxa_init_beacon_parameters(struct rtw_dev *rtwdev)
++{
++	u16 val16;
++
++	val16 = (BIT_DIS_TSF_UDT << 8) | BIT_DIS_TSF_UDT;
++	if (rtwdev->efuse.btcoex)
++		val16 |= BIT_EN_BCN_FUNCTION;
++	rtw_write16(rtwdev, REG_BCN_CTRL, val16);
++
++	rtw_write32_mask(rtwdev, REG_TBTT_PROHIBIT, 0xfffff, WLAN_TBTT_TIME);
++	rtw_write8(rtwdev, REG_DRVERLYINT, 0x05);
++	rtw_write8(rtwdev, REG_BCNDMATIM, WLAN_BCN_DMA_TIME);
++	rtw_write16(rtwdev, REG_BCNTCFG, 0x4413);
++}
++
++static void rtw88xxa_phy_bb_config(struct rtw_dev *rtwdev)
++{
++	u8 val8, crystal_cap;
++
++	/* power on BB/RF domain */
++	val8 = rtw_read8(rtwdev, REG_SYS_FUNC_EN);
++	val8 |= BIT_FEN_USBA;
++	rtw_write8(rtwdev, REG_SYS_FUNC_EN, val8);
++
++	/* toggle BB reset */
++	val8 |= BIT_FEN_BB_RSTB | BIT_FEN_BB_GLB_RST;
++	rtw_write8(rtwdev, REG_SYS_FUNC_EN, val8);
++
++	rtw_write8(rtwdev, REG_RF_CTRL,
++		   BIT_RF_EN | BIT_RF_RSTB | BIT_RF_SDM_RSTB);
++	rtw_write8(rtwdev, REG_RF_B_CTRL,
++		   BIT_RF_EN | BIT_RF_RSTB | BIT_RF_SDM_RSTB);
++
++	rtw_load_table(rtwdev, rtwdev->chip->bb_tbl);
++	rtw_load_table(rtwdev, rtwdev->chip->agc_tbl);
++
++	crystal_cap = rtwdev->efuse.crystal_cap & 0x3F;
++	if (rtwdev->chip->id == RTW_CHIP_TYPE_8812A)
++		rtw_write32_mask(rtwdev, REG_AFE_CTRL3, 0x7FF80000,
++				 crystal_cap | (crystal_cap << 6));
++	else
++		rtw_write32_mask(rtwdev, REG_AFE_CTRL3, 0x00FFF000,
++				 crystal_cap | (crystal_cap << 6));
++}
++
++static void rtw88xxa_phy_rf_config(struct rtw_dev *rtwdev)
++{
++	u8 rf_path;
++
++	for (rf_path = 0; rf_path < rtwdev->hal.rf_path_num; rf_path++)
++		rtw_load_table(rtwdev, rtwdev->chip->rf_tbl[rf_path]);
++}
++
++static void rtw8812a_config_1t(struct rtw_dev *rtwdev)
++{
++	/* BB OFDM RX Path_A */
++	rtw_write32_mask(rtwdev, REG_RXPSEL, 0xff, 0x11);
++
++	/* BB OFDM TX Path_A */
++	rtw_write32_mask(rtwdev, REG_TXPSEL, MASKLWORD, 0x1111);
++
++	/* BB CCK R/Rx Path_A */
++	rtw_write32_mask(rtwdev, REG_CCK_RX, 0x0c000000, 0x0);
++
++	/* MCS support */
++	rtw_write32_mask(rtwdev, REG_RX_MCS_LIMIT, 0xc0000060, 0x4);
++
++	/* RF Path_B HSSI OFF */
++	rtw_write32_mask(rtwdev, REG_3WIRE_SWB, 0xf, 0x4);
++
++	/* RF Path_B Power Down */
++	rtw_write32_mask(rtwdev, REG_LSSI_WRITE_B, MASKDWORD, 0);
++
++	/* ADDA Path_B OFF */
++	rtw_write32_mask(rtwdev, REG_AFE_PWR1_B, MASKDWORD, 0);
++	rtw_write32_mask(rtwdev, REG_AFE_PWR2_B, MASKDWORD, 0);
++}
++
++static const u32 rtw88xxa_txscale_tbl[] = {
++	0x081, 0x088, 0x090, 0x099, 0x0a2, 0x0ac, 0x0b6, 0x0c0, 0x0cc, 0x0d8,
++	0x0e5, 0x0f2, 0x101, 0x110, 0x120, 0x131, 0x143, 0x156, 0x16a, 0x180,
++	0x197, 0x1af, 0x1c8, 0x1e3, 0x200, 0x21e, 0x23e, 0x261, 0x285, 0x2ab,
++	0x2d3, 0x2fe, 0x32b, 0x35c, 0x38e, 0x3c4, 0x3fe
++};
++
++static u32 rtw88xxa_get_bb_swing(struct rtw_dev *rtwdev, u8 band, u8 path)
++{
++	static const u32 swing2setting[4] = {0x200, 0x16a, 0x101, 0x0b6};
++	struct rtw_efuse *efuse = &rtwdev->efuse;
++	u8 tx_bb_swing;
++
++	if (band == RTW_BAND_2G)
++		tx_bb_swing = efuse->tx_bb_swing_setting_2g;
++	else
++		tx_bb_swing = efuse->tx_bb_swing_setting_5g;
++
++	if (path == RF_PATH_B)
++		tx_bb_swing >>= 2;
++	tx_bb_swing &= 0x3;
++
++	return swing2setting[tx_bb_swing];
++}
++
++static u8 rtw88xxa_get_swing_index(struct rtw_dev *rtwdev)
++{
++	u32 swing, table_value;
++	u8 i;
++
++	swing = rtw88xxa_get_bb_swing(rtwdev, rtwdev->hal.current_band_type,
++				      RF_PATH_A);
++
++	for (i = 0; i < ARRAY_SIZE(rtw88xxa_txscale_tbl); i++) {
++		table_value = rtw88xxa_txscale_tbl[i];
++		if (swing == table_value)
++			return i;
++	}
++
++	return 24;
++}
++
++static void rtw88xxa_pwrtrack_init(struct rtw_dev *rtwdev)
++{
++	struct rtw_dm_info *dm_info = &rtwdev->dm_info;
++	u8 path;
++
++	dm_info->default_ofdm_index = rtw88xxa_get_swing_index(rtwdev);
++
++	if (rtwdev->chip->id == RTW_CHIP_TYPE_8821A)
++		dm_info->default_cck_index = 0;
++	else
++		dm_info->default_cck_index = 24;
++
++	for (path = RF_PATH_A; path < rtwdev->hal.rf_path_num; path++) {
++		ewma_thermal_init(&dm_info->avg_thermal[path]);
++		dm_info->delta_power_index[path] = 0;
++		dm_info->delta_power_index_last[path] = 0;
++	}
++
++	dm_info->pwr_trk_triggered = false;
++	dm_info->pwr_trk_init_trigger = true;
++	dm_info->thermal_meter_k = rtwdev->efuse.thermal_meter_k;
++}
++
++void rtw88xxa_power_off(struct rtw_dev *rtwdev,
++			const struct rtw_pwr_seq_cmd *const *enter_lps_flow)
++{
++	struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);
++	enum usb_device_speed speed = rtwusb->udev->speed;
++	u16 ori_fsmc0;
++	u8 reg_cr;
++
++	reg_cr = rtw_read8(rtwdev, REG_CR);
++
++	/* Already powered off */
++	if (reg_cr == 0 || reg_cr == 0xEA)
++		return;
++
++	rtw_hci_stop(rtwdev);
++
++	if (!rtwdev->efuse.btcoex)
++		rtw_write16_clr(rtwdev, REG_GPIO_MUXCFG, BIT_EN_SIC);
++
++	/* set Reg 0xf008[3:4] to 2'11 to enable U1/U2 Mode in USB3.0. */
++	if (speed == USB_SPEED_SUPER)
++		rtw_write8_set(rtwdev, REG_USB_MOD, 0x18);
++
++	rtw_write32(rtwdev, REG_HISR0, 0xffffffff);
++	rtw_write32(rtwdev, REG_HISR1, 0xffffffff);
++	rtw_write32(rtwdev, REG_HIMR0, 0);
++	rtw_write32(rtwdev, REG_HIMR1, 0);
++
++	if (rtwdev->efuse.btcoex)
++		rtw_coex_power_off_setting(rtwdev);
++
++	ori_fsmc0 = rtw_read16(rtwdev, REG_APS_FSMCO);
++	rtw_write16(rtwdev, REG_APS_FSMCO, ori_fsmc0 & ~APS_FSMCO_HW_POWERDOWN);
++
++	/* Stop Tx Report Timer. */
++	rtw_write8_clr(rtwdev, REG_TX_RPT_CTRL, BIT(1));
++
++	/* Stop Rx */
++	rtw_write8(rtwdev, REG_CR, 0);
++
++	rtw_pwr_seq_parser(rtwdev, enter_lps_flow);
++
++	if (rtw_read8(rtwdev, REG_MCUFW_CTRL) & BIT_RAM_DL_SEL)
++		rtw88xxa_reset_8051(rtwdev);
++
++	rtw_write8_clr(rtwdev, REG_SYS_FUNC_EN + 1, BIT(2));
++	rtw_write8(rtwdev, REG_MCUFW_CTRL, 0);
++
++	rtw_pwr_seq_parser(rtwdev, rtwdev->chip->pwr_off_seq);
++
++	if (ori_fsmc0 & APS_FSMCO_HW_POWERDOWN)
++		rtw_write16_set(rtwdev, REG_APS_FSMCO, APS_FSMCO_HW_POWERDOWN);
++
++	clear_bit(RTW_FLAG_POWERON, rtwdev->flags);
++}
++EXPORT_SYMBOL(rtw88xxa_power_off);
++
++static void rtw88xxa_set_channel_bb_swing(struct rtw_dev *rtwdev, u8 band)
++{
++	rtw_write32_mask(rtwdev, REG_TXSCALE_A, BB_SWING_MASK,
++			 rtw88xxa_get_bb_swing(rtwdev, band, RF_PATH_A));
++	rtw_write32_mask(rtwdev, REG_TXSCALE_B, BB_SWING_MASK,
++			 rtw88xxa_get_bb_swing(rtwdev, band, RF_PATH_B));
++	rtw88xxa_pwrtrack_init(rtwdev);
++}
++
++static void rtw8821a_set_ext_band_switch(struct rtw_dev *rtwdev, u8 band)
++{
++	rtw_write32_mask(rtwdev, REG_LED_CFG, BIT_DPDT_SEL_EN, 0);
++	rtw_write32_mask(rtwdev, REG_LED_CFG, BIT_DPDT_WL_SEL, 1);
++	rtw_write32_mask(rtwdev, REG_RFE_INV_A, 0xf, 7);
++	rtw_write32_mask(rtwdev, REG_RFE_INV_A, 0xf0, 7);
++
++	if (band == RTW_BAND_2G)
++		rtw_write32_mask(rtwdev, REG_RFE_INV_A, BIT(29) | BIT(28), 1);
++	else
++		rtw_write32_mask(rtwdev, REG_RFE_INV_A, BIT(29) | BIT(28), 2);
++}
++
++static void rtw8821a_phy_set_rfe_reg_24g(struct rtw_dev *rtwdev)
++{
++	struct rtw_efuse *efuse = &rtwdev->efuse;
++
++	/* Turn off RF PA and LNA */
++
++	/* 0xCB0[15:12] = 0x7 (LNA_On)*/
++	rtw_write32_mask(rtwdev, REG_RFE_PINMUX_A, 0xF000, 0x7);
++	/* 0xCB0[7:4] = 0x7 (PAPE_A)*/
++	rtw_write32_mask(rtwdev, REG_RFE_PINMUX_A, 0xF0, 0x7);
++
++	if (efuse->ext_lna_2g) {
++		/* Turn on 2.4G External LNA */
++		rtw_write32_mask(rtwdev, REG_RFE_INV_A, BIT(20), 1);
++		rtw_write32_mask(rtwdev, REG_RFE_INV_A, BIT(22), 0);
++		rtw_write32_mask(rtwdev, REG_RFE_PINMUX_A, GENMASK(2, 0), 0x2);
++		rtw_write32_mask(rtwdev, REG_RFE_PINMUX_A, GENMASK(10, 8), 0x2);
++	} else {
++		/* Bypass 2.4G External LNA */
++		rtw_write32_mask(rtwdev, REG_RFE_INV_A, BIT(20), 0);
++		rtw_write32_mask(rtwdev, REG_RFE_INV_A, BIT(22), 0);
++		rtw_write32_mask(rtwdev, REG_RFE_PINMUX_A, GENMASK(2, 0), 0x7);
++		rtw_write32_mask(rtwdev, REG_RFE_PINMUX_A, GENMASK(10, 8), 0x7);
++	}
++}
++
++static void rtw8821a_phy_set_rfe_reg_5g(struct rtw_dev *rtwdev)
++{
++	/* Turn ON RF PA and LNA */
++
++	/* 0xCB0[15:12] = 0x7 (LNA_On)*/
++	rtw_write32_mask(rtwdev, REG_RFE_PINMUX_A, 0xF000, 0x5);
++	/* 0xCB0[7:4] = 0x7 (PAPE_A)*/
++	rtw_write32_mask(rtwdev, REG_RFE_PINMUX_A, 0xF0, 0x4);
++
++	/* Bypass 2.4G External LNA */
++	rtw_write32_mask(rtwdev, REG_RFE_INV_A, BIT(20), 0);
++	rtw_write32_mask(rtwdev, REG_RFE_INV_A, BIT(22), 0);
++	rtw_write32_mask(rtwdev, REG_RFE_PINMUX_A, GENMASK(2, 0), 0x7);
++	rtw_write32_mask(rtwdev, REG_RFE_PINMUX_A, GENMASK(10, 8), 0x7);
++}
++
++static void rtw8812a_phy_set_rfe_reg_24g(struct rtw_dev *rtwdev)
++{
++	switch (rtwdev->efuse.rfe_option) {
++	case 0:
++	case 2:
++		rtw_write32(rtwdev, REG_RFE_PINMUX_A, 0x77777777);
++		rtw_write32(rtwdev, REG_RFE_PINMUX_B, 0x77777777);
++		rtw_write32_mask(rtwdev, REG_RFE_INV_A, RFE_INV_MASK, 0x000);
++		rtw_write32_mask(rtwdev, REG_RFE_INV_B, RFE_INV_MASK, 0x000);
++		break;
++	case 1:
++		if (rtwdev->efuse.btcoex) {
++			rtw_write32_mask(rtwdev, REG_RFE_PINMUX_A, 0xffffff, 0x777777);
++			rtw_write32(rtwdev, REG_RFE_PINMUX_B, 0x77777777);
++			rtw_write32_mask(rtwdev, REG_RFE_INV_A, 0x33f00000, 0x000);
++			rtw_write32_mask(rtwdev, REG_RFE_INV_B, RFE_INV_MASK, 0x000);
++		} else {
++			rtw_write32(rtwdev, REG_RFE_PINMUX_A, 0x77777777);
++			rtw_write32(rtwdev, REG_RFE_PINMUX_B, 0x77777777);
++			rtw_write32_mask(rtwdev, REG_RFE_INV_A, RFE_INV_MASK, 0x000);
++			rtw_write32_mask(rtwdev, REG_RFE_INV_B, RFE_INV_MASK, 0x000);
++		}
++		break;
++	case 3:
++		rtw_write32(rtwdev, REG_RFE_PINMUX_A, 0x54337770);
++		rtw_write32(rtwdev, REG_RFE_PINMUX_B, 0x54337770);
++		rtw_write32_mask(rtwdev, REG_RFE_INV_A, RFE_INV_MASK, 0x010);
++		rtw_write32_mask(rtwdev, REG_RFE_INV_B, RFE_INV_MASK, 0x010);
++		rtw_write32_mask(rtwdev, REG_ANTSEL_SW, 0x00000303, 0x1);
++		break;
++	case 4:
++		rtw_write32(rtwdev, REG_RFE_PINMUX_A, 0x77777777);
++		rtw_write32(rtwdev, REG_RFE_PINMUX_B, 0x77777777);
++		rtw_write32_mask(rtwdev, REG_RFE_INV_A, RFE_INV_MASK, 0x001);
++		rtw_write32_mask(rtwdev, REG_RFE_INV_B, RFE_INV_MASK, 0x001);
++		break;
++	case 5:
++		rtw_write8(rtwdev, REG_RFE_PINMUX_A + 2, 0x77);
++		rtw_write32(rtwdev, REG_RFE_PINMUX_B, 0x77777777);
++		rtw_write8_clr(rtwdev, REG_RFE_INV_A + 3, BIT(0));
++		rtw_write32_mask(rtwdev, REG_RFE_INV_B, RFE_INV_MASK, 0x000);
++		break;
++	case 6:
++		rtw_write32(rtwdev, REG_RFE_PINMUX_A, 0x07772770);
++		rtw_write32(rtwdev, REG_RFE_PINMUX_B, 0x07772770);
++		rtw_write32(rtwdev, REG_RFE_INV_A, 0x00000077);
++		rtw_write32(rtwdev, REG_RFE_INV_B, 0x00000077);
++		break;
++	default:
++		break;
++	}
++}
++
++static void rtw8812a_phy_set_rfe_reg_5g(struct rtw_dev *rtwdev)
++{
++	switch (rtwdev->efuse.rfe_option) {
++	case 0:
++		rtw_write32(rtwdev, REG_RFE_PINMUX_A, 0x77337717);
++		rtw_write32(rtwdev, REG_RFE_PINMUX_B, 0x77337717);
++		rtw_write32_mask(rtwdev, REG_RFE_INV_A, RFE_INV_MASK, 0x010);
++		rtw_write32_mask(rtwdev, REG_RFE_INV_B, RFE_INV_MASK, 0x010);
++		break;
++	case 1:
++		if (rtwdev->efuse.btcoex) {
++			rtw_write32_mask(rtwdev, REG_RFE_PINMUX_A, 0xffffff, 0x337717);
++			rtw_write32(rtwdev, REG_RFE_PINMUX_B, 0x77337717);
++			rtw_write32_mask(rtwdev, REG_RFE_INV_A, 0x33f00000, 0x000);
++			rtw_write32_mask(rtwdev, REG_RFE_INV_B, RFE_INV_MASK, 0x000);
++		} else {
++			rtw_write32(rtwdev, REG_RFE_PINMUX_A, 0x77337717);
++			rtw_write32(rtwdev, REG_RFE_PINMUX_B, 0x77337717);
++			rtw_write32_mask(rtwdev, REG_RFE_INV_A, RFE_INV_MASK, 0x000);
++			rtw_write32_mask(rtwdev, REG_RFE_INV_B, RFE_INV_MASK, 0x000);
++		}
++		break;
++	case 2:
++	case 4:
++		rtw_write32(rtwdev, REG_RFE_PINMUX_A, 0x77337777);
++		rtw_write32(rtwdev, REG_RFE_PINMUX_B, 0x77337777);
++		rtw_write32_mask(rtwdev, REG_RFE_INV_A, RFE_INV_MASK, 0x010);
++		rtw_write32_mask(rtwdev, REG_RFE_INV_B, RFE_INV_MASK, 0x010);
++		break;
++	case 3:
++		rtw_write32(rtwdev, REG_RFE_PINMUX_A, 0x54337717);
++		rtw_write32(rtwdev, REG_RFE_PINMUX_B, 0x54337717);
++		rtw_write32_mask(rtwdev, REG_RFE_INV_A, RFE_INV_MASK, 0x010);
++		rtw_write32_mask(rtwdev, REG_RFE_INV_B, RFE_INV_MASK, 0x010);
++		rtw_write32_mask(rtwdev, REG_ANTSEL_SW, 0x00000303, 0x1);
++		break;
++	case 5:
++		rtw_write8(rtwdev, REG_RFE_PINMUX_A + 2, 0x33);
++		rtw_write32(rtwdev, REG_RFE_PINMUX_B, 0x77337777);
++		rtw_write8_set(rtwdev, REG_RFE_INV_A + 3, BIT(0));
++		rtw_write32_mask(rtwdev, REG_RFE_INV_B, RFE_INV_MASK, 0x010);
++		break;
++	case 6:
++		rtw_write32(rtwdev, REG_RFE_PINMUX_A, 0x07737717);
++		rtw_write32(rtwdev, REG_RFE_PINMUX_B, 0x07737717);
++		rtw_write32(rtwdev, REG_RFE_INV_A, 0x00000077);
++		rtw_write32(rtwdev, REG_RFE_INV_B, 0x00000077);
++		break;
++	default:
++		break;
++	}
++}
++
++static void rtw88xxa_switch_band(struct rtw_dev *rtwdev, u8 new_band, u8 bw)
++{
++	const struct rtw_chip_info *chip = rtwdev->chip;
++	u16 basic_rates, reg_41a;
++
++	/* 8811au one antenna module doesn't support antenna div, so driver must
++	 * control antenna band, otherwise one of the band will have issue
++	 */
++	if (chip->id == RTW_CHIP_TYPE_8821A && !rtwdev->efuse.btcoex &&
++	    rtwdev->efuse.ant_div_cfg == 0)
++		rtw8821a_set_ext_band_switch(rtwdev, new_band);
++
++	if (new_band == RTW_BAND_2G) {
++		rtw_write32_set(rtwdev, REG_RXPSEL, BIT_RX_PSEL_RST);
++
++		if (chip->id == RTW_CHIP_TYPE_8821A) {
++			rtw8821a_phy_set_rfe_reg_24g(rtwdev);
++
++			rtw_write32_mask(rtwdev, REG_TXSCALE_A, 0xf00, 0);
++		} else {
++			rtw_write32_mask(rtwdev, REG_BWINDICATION, 0x3, 0x1);
++			rtw_write32_mask(rtwdev, REG_PDMFTH, GENMASK(17, 13), 0x17);
++
++			if (bw == RTW_CHANNEL_WIDTH_20 &&
++			    rtwdev->hal.rf_type == RF_1T1R &&
++			    !rtwdev->efuse.ext_lna_2g)
++				rtw_write32_mask(rtwdev, REG_PDMFTH, GENMASK(3, 1), 0x02);
++			else
++				rtw_write32_mask(rtwdev, REG_PDMFTH, GENMASK(3, 1), 0x04);
++
++			rtw_write32_mask(rtwdev, REG_CCASEL, 0x3, 0);
++
++			rtw8812a_phy_set_rfe_reg_24g(rtwdev);
++		}
++
++		rtw_write32_mask(rtwdev, REG_TXPSEL, 0xf0, 0x1);
++		rtw_write32_mask(rtwdev, REG_CCK_RX, 0x0f000000, 0x1);
++
++		basic_rates = BIT(DESC_RATE1M) | BIT(DESC_RATE2M) |
++			      BIT(DESC_RATE5_5M) | BIT(DESC_RATE11M) |
++			      BIT(DESC_RATE6M) | BIT(DESC_RATE12M) |
++			      BIT(DESC_RATE24M);
++		rtw_write32_mask(rtwdev, REG_RRSR, 0xfffff, basic_rates);
++
++		rtw_write8_clr(rtwdev, REG_CCK_CHECK, BIT_CHECK_CCK_EN);
++	} else { /* RTW_BAND_5G */
++		if (chip->id == RTW_CHIP_TYPE_8821A)
++			rtw8821a_phy_set_rfe_reg_5g(rtwdev);
++
++		rtw_write8_set(rtwdev, REG_CCK_CHECK, BIT_CHECK_CCK_EN);
++
++		read_poll_timeout_atomic(rtw_read16, reg_41a, (reg_41a & 0x30) == 0x30,
++					 50, 2500, false, rtwdev, REG_TXPKT_EMPTY);
++
++		rtw_write32_set(rtwdev, REG_RXPSEL, BIT_RX_PSEL_RST);
++
++		if (chip->id == RTW_CHIP_TYPE_8821A) {
++			rtw_write32_mask(rtwdev, REG_TXSCALE_A, 0xf00, 1);
++		} else {
++			rtw_write32_mask(rtwdev, REG_BWINDICATION, 0x3, 0x2);
++			rtw_write32_mask(rtwdev, REG_PDMFTH, GENMASK(17, 13), 0x15);
++			rtw_write32_mask(rtwdev, REG_PDMFTH, GENMASK(3, 1), 0x04);
++
++			rtw_write32_mask(rtwdev, REG_CCASEL, 0x3, 1);
++
++			rtw8812a_phy_set_rfe_reg_5g(rtwdev);
++		}
++
++		rtw_write32_mask(rtwdev, REG_TXPSEL, 0xf0, 0);
++		rtw_write32_mask(rtwdev, REG_CCK_RX, 0x0f000000, 0xf);
++
++		basic_rates = BIT(DESC_RATE6M) | BIT(DESC_RATE12M) |
++			      BIT(DESC_RATE24M);
++		rtw_write32_mask(rtwdev, REG_RRSR, 0xfffff, basic_rates);
++	}
++
++	rtw88xxa_set_channel_bb_swing(rtwdev, new_band);
++}
++
++int rtw88xxa_power_on(struct rtw_dev *rtwdev)
++{
++	struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);
++	const struct rtw_chip_info *chip = rtwdev->chip;
++	struct rtw_efuse *efuse = &rtwdev->efuse;
++	struct rtw_hal *hal = &rtwdev->hal;
++	int ret;
++
++	if (test_bit(RTW_FLAG_POWERON, rtwdev->flags))
++		return 0;
++
++	/* Override rtw_chip_efuse_info_setup() */
++	if (chip->id == RTW_CHIP_TYPE_8821A)
++		efuse->btcoex = rtw_read32_mask(rtwdev, REG_WL_BT_PWR_CTRL,
++						BIT_BT_FUNC_EN);
++
++	/* Override rtw_chip_efuse_info_setup() */
++	if (chip->id == RTW_CHIP_TYPE_8812A)
++		rtw8812a_read_amplifier_type(rtwdev);
++
++	ret = rtw_hci_setup(rtwdev);
++	if (ret) {
++		rtw_err(rtwdev, "failed to setup hci\n");
++		goto err;
++	}
++
++	/* Revise for U2/U3 switch we can not update RF-A/B reset.
++	 * Reset after MAC power on to prevent RF R/W error.
++	 * Is it a right method?
++	 */
++	if (chip->id == RTW_CHIP_TYPE_8812A) {
++		rtw_write8(rtwdev, REG_RF_CTRL, 5);
++		rtw_write8(rtwdev, REG_RF_CTRL, 7);
++		rtw_write8(rtwdev, REG_RF_B_CTRL, 5);
++		rtw_write8(rtwdev, REG_RF_B_CTRL, 7);
++	}
++
++	/* If HW didn't go through a complete de-initial procedure,
++	 * it probably occurs some problem for double initial
++	 * procedure.
++	 */
++	rtw88xxau_hw_reset(rtwdev);
++
++	ret = rtw88xxau_init_power_on(rtwdev);
++	if (ret) {
++		rtw_err(rtwdev, "failed to power on\n");
++		goto err;
++	}
++
++	ret = rtw_set_trx_fifo_info(rtwdev);
++	if (ret) {
++		rtw_err(rtwdev, "failed to set trx fifo info\n");
++		goto err;
++	}
++
++	ret = rtw88xxa_llt_init(rtwdev, rtwdev->fifo.rsvd_boundary);
++	if (ret) {
++		rtw_err(rtwdev, "failed to init llt\n");
++		goto err;
++	}
++
++	rtw_write32_set(rtwdev, REG_TXDMA_OFFSET_CHK, BIT_DROP_DATA_EN);
++
++	ret = rtw_wait_firmware_completion(rtwdev);
++	if (ret) {
++		rtw_err(rtwdev, "failed to wait firmware completion\n");
++		goto err_off;
++	}
++
++	ret = rtw_download_firmware(rtwdev, &rtwdev->fw);
++	if (ret) {
++		rtw_err(rtwdev, "failed to download firmware\n");
++		goto err_off;
++	}
++
++	rtw_write8(rtwdev, REG_HMETFR, 0xf);
++
++	rtw_load_table(rtwdev, chip->mac_tbl);
++
++	rtw88xxau_init_queue_reserved_page(rtwdev);
++	rtw88xxau_init_tx_buffer_boundary(rtwdev);
++	rtw88xxau_init_queue_priority(rtwdev);
++
++	rtw_write16(rtwdev, REG_TRXFF_BNDY + 2,
++		    chip->rxff_size - REPORT_BUF - 1);
++
++	if (chip->id == RTW_CHIP_TYPE_8812A)
++		rtw_write8(rtwdev, REG_PBP,
++			   u8_encode_bits(PBP_512, PBP_TX_MASK) |
++			   u8_encode_bits(PBP_64, PBP_RX_MASK));
++
++	rtw_write8(rtwdev, REG_RX_DRVINFO_SZ, PHY_STATUS_SIZE);
++
++	rtw_write32(rtwdev, REG_HIMR0, 0);
++	rtw_write32(rtwdev, REG_HIMR1, 0);
++
++	rtw_write32_mask(rtwdev, REG_CR, 0x30000, 0x2);
++
++	rtw88xxa_init_wmac_setting(rtwdev);
++	rtw88xxa_init_adaptive_ctrl(rtwdev);
++	rtw88xxa_init_edca(rtwdev);
++
++	rtw_write8_set(rtwdev, REG_FWHW_TXQ_CTRL, BIT(7));
++	rtw_write8(rtwdev, REG_ACKTO, 0x80);
++
++	rtw88xxau_tx_aggregation(rtwdev);
++
++	rtw88xxa_init_beacon_parameters(rtwdev);
++	rtw_write8(rtwdev, REG_BCN_MAX_ERR, 0xff);
++
++	rtw_hci_interface_cfg(rtwdev);
++
++	/* usb3 rx interval */
++	rtw_write8(rtwdev, REG_USB3_RXITV, 0x01);
++
++	/* burst length=4, set 0x3400 for burst length=2 */
++	rtw_write16(rtwdev, REG_RXDMA_STATUS, 0x7400);
++	rtw_write8(rtwdev, REG_RXDMA_STATUS + 1, 0xf5);
++
++	/* 0x456 = 0x70, sugguested by Zhilin */
++	if (chip->id == RTW_CHIP_TYPE_8821A)
++		rtw_write8(rtwdev, REG_AMPDU_MAX_TIME, 0x5e);
++	else
++		rtw_write8(rtwdev, REG_AMPDU_MAX_TIME, 0x70);
++
++	rtw_write32(rtwdev, REG_AMPDU_MAX_LENGTH, 0xffffffff);
++	rtw_write8(rtwdev, REG_USTIME_TSF, 0x50);
++	rtw_write8(rtwdev, REG_USTIME_EDCA, 0x50);
++
++	if (rtwusb->udev->speed == USB_SPEED_SUPER)
++		/* Disable U1/U2 Mode to avoid 2.5G spur in USB3.0. */
++		rtw_write8_clr(rtwdev, REG_USB_MOD, BIT(4) | BIT(3));
++
++	rtw_write8_set(rtwdev, REG_SINGLE_AMPDU_CTRL, BIT_EN_SINGLE_APMDU);
++
++	/* for VHT packet length 11K */
++	rtw_write8(rtwdev, REG_RX_PKT_LIMIT, 0x18);
++
++	rtw_write8(rtwdev, REG_PIFS, 0x00);
++
++	if (chip->id == RTW_CHIP_TYPE_8821A) {
++		/* 0x0a0a too small, it can't pass AC logo. change to 0x1f1f */
++		rtw_write16(rtwdev, REG_MAX_AGGR_NUM, 0x1f1f);
++		rtw_write8(rtwdev, REG_FWHW_TXQ_CTRL, 0x80);
++		rtw_write32(rtwdev, REG_FAST_EDCA_CTRL, 0x03087777);
++	} else {
++		rtw_write16(rtwdev, REG_MAX_AGGR_NUM, 0x1f1f);
++		rtw_write8_clr(rtwdev, REG_FWHW_TXQ_CTRL, BIT(7));
++	}
++
++	 /* to prevent mac is reseted by bus. */
++	rtw_write8_set(rtwdev, REG_RSV_CTRL, BIT(5) | BIT(6));
++
++	/* ARFB table 9 for 11ac 5G 2SS */
++	rtw_write32(rtwdev, REG_ARFR0, 0x00000010);
++	rtw_write32(rtwdev, REG_ARFRH0, 0xfffff000);
++
++	/* ARFB table 10 for 11ac 5G 1SS */
++	rtw_write32(rtwdev, REG_ARFR1_V1, 0x00000010);
++	rtw_write32(rtwdev, REG_ARFRH1_V1, 0x003ff000);
++
++	/* ARFB table 11 for 11ac 24G 1SS */
++	rtw_write32(rtwdev, REG_ARFR2_V1, 0x00000015);
++	rtw_write32(rtwdev, REG_ARFRH2_V1, 0x003ff000);
++
++	/* ARFB table 12 for 11ac 24G 2SS */
++	rtw_write32(rtwdev, REG_ARFR3_V1, 0x00000015);
++	rtw_write32(rtwdev, REG_ARFRH3_V1, 0xffcff000);
++
++	rtw_write8_set(rtwdev, REG_CR, BIT_MACTXEN | BIT_MACRXEN);
++
++	rtw88xxa_phy_bb_config(rtwdev);
++	rtw88xxa_phy_rf_config(rtwdev);
++
++	if (chip->id == RTW_CHIP_TYPE_8812A && hal->rf_path_num == 1)
++		rtw8812a_config_1t(rtwdev);
++
++	rtw88xxa_switch_band(rtwdev, RTW_BAND_2G, RTW_CHANNEL_WIDTH_20);
++
++	rtw_write32(rtwdev, RTW_SEC_CMD_REG, BIT(31) | BIT(30));
++
++	rtw_write8(rtwdev, REG_HWSEQ_CTRL, 0xff);
++	rtw_write32(rtwdev, REG_BAR_MODE_CTRL, 0x0201ffff);
++	rtw_write8(rtwdev, REG_NAV_CTRL + 2, 0);
++
++	rtw_write8_clr(rtwdev, REG_GPIO_MUXCFG, BIT(5));
++
++	rtw_phy_init(rtwdev);
++
++	rtw88xxa_pwrtrack_init(rtwdev);
++
++	/* 0x4c6[3] 1: RTS BW = Data BW
++	 * 0: RTS BW depends on CCA / secondary CCA result.
++	 */
++	rtw_write8_clr(rtwdev, REG_QUEUE_CTRL, BIT(3));
++
++	/* enable Tx report. */
++	rtw_write8(rtwdev, REG_FWHW_TXQ_CTRL + 1, 0x0f);
++
++	/* Pretx_en, for WEP/TKIP SEC */
++	rtw_write8(rtwdev, REG_EARLY_MODE_CONTROL + 3, 0x01);
++
++	rtw_write16(rtwdev, REG_TX_RPT_TIME, 0x3df0);
++
++	/* Reset USB mode switch setting */
++	rtw_write8(rtwdev, REG_SYS_SDIO_CTRL, 0x0);
++	rtw_write8(rtwdev, REG_ACLK_MON, 0x0);
++
++	rtw_write8(rtwdev, REG_USB_HRPWM, 0);
++
++	/* ack for xmit mgmt frames. */
++	rtw_write32_set(rtwdev, REG_FWHW_TXQ_CTRL, BIT(12));
++
++	hal->cck_high_power = rtw_read32_mask(rtwdev, REG_CCK_RPT_FORMAT,
++					      BIT_CCK_RPT_FORMAT);
++
++	ret = rtw_hci_start(rtwdev);
++	if (ret) {
++		rtw_err(rtwdev, "failed to start hci\n");
++		goto err_off;
++	}
++
++	if (efuse->btcoex) {
++		rtw_coex_power_on_setting(rtwdev);
++		rtw_coex_init_hw_config(rtwdev, false);
++	}
++
++	set_bit(RTW_FLAG_POWERON, rtwdev->flags);
++
++	return 0;
++
++err_off:
++	chip->ops->power_off(rtwdev);
++
++err:
++	return ret;
++}
++EXPORT_SYMBOL(rtw88xxa_power_on);
++
++u32 rtw88xxa_phy_read_rf(struct rtw_dev *rtwdev,
++			 enum rtw_rf_path rf_path, u32 addr, u32 mask)
++{
++	static const u32 pi_addr[2] = { REG_3WIRE_SWA, REG_3WIRE_SWB };
++	static const u32 read_addr[2][2] = {
++		{ REG_SI_READ_A, REG_SI_READ_B },
++		{ REG_PI_READ_A, REG_PI_READ_B }
++	};
++	const struct rtw_chip_info *chip = rtwdev->chip;
++	const struct rtw_hal *hal = &rtwdev->hal;
++	bool set_cca, pi_mode;
++	u32 val;
++
++	if (rf_path >= hal->rf_phy_num) {
++		rtw_err(rtwdev, "unsupported rf path (%d)\n", rf_path);
++		return INV_RF_DATA;
++	}
++
++	/* CCA off to avoid reading the wrong value.
++	 * Toggling CCA would affect RF 0x0, skip it.
++	 */
++	set_cca = addr != 0x0 && chip->id == RTW_CHIP_TYPE_8812A &&
++		  hal->cut_version != RTW_CHIP_VER_CUT_C;
++
++	if (set_cca)
++		rtw_write32_set(rtwdev, REG_CCA2ND, BIT(3));
++
++	addr &= 0xff;
++
++	pi_mode = rtw_read32_mask(rtwdev, pi_addr[rf_path], 0x4);
++
++	rtw_write32_mask(rtwdev, REG_HSSI_READ, MASKBYTE0, addr);
++
++	if (chip->id == RTW_CHIP_TYPE_8821A ||
++	    hal->cut_version == RTW_CHIP_VER_CUT_C)
++		udelay(20);
++
++	val = rtw_read32_mask(rtwdev, read_addr[pi_mode][rf_path], mask);
++
++	/* CCA on */
++	if (set_cca)
++		rtw_write32_clr(rtwdev, REG_CCA2ND, BIT(3));
++
++	return val;
++}
++EXPORT_SYMBOL(rtw88xxa_phy_read_rf);
++
++static void rtw8812a_phy_fix_spur(struct rtw_dev *rtwdev, u8 channel, u8 bw)
++{
++	/* C cut Item12 ADC FIFO CLOCK */
++	if (rtwdev->hal.cut_version == RTW_CHIP_VER_CUT_C) {
++		if (bw == RTW_CHANNEL_WIDTH_40 && channel == 11)
++			rtw_write32_mask(rtwdev, REG_ADCCLK, 0xC00, 0x3);
++		else
++			rtw_write32_mask(rtwdev, REG_ADCCLK, 0xC00, 0x2);
++
++		/* A workaround to resolve 2480Mhz spur by setting ADC clock
++		 * as 160M.
++		 */
++		if (bw == RTW_CHANNEL_WIDTH_20 && (channel == 13 || channel == 14)) {
++			rtw_write32_mask(rtwdev, REG_ADCCLK, 0x300, 0x3);
++			rtw_write32_mask(rtwdev, REG_ADC160, BIT(30), 1);
++		} else if (bw == RTW_CHANNEL_WIDTH_40 && channel == 11) {
++			rtw_write32_mask(rtwdev, REG_ADC160, BIT(30), 1);
++		} else if (bw != RTW_CHANNEL_WIDTH_80) {
++			rtw_write32_mask(rtwdev, REG_ADCCLK, 0x300, 0x2);
++			rtw_write32_mask(rtwdev, REG_ADC160, BIT(30), 0);
++		}
++	} else {
++		/* A workaround to resolve 2480Mhz spur by setting ADC clock
++		 * as 160M.
++		 */
++		if (bw == RTW_CHANNEL_WIDTH_20 && (channel == 13 || channel == 14))
++			rtw_write32_mask(rtwdev, REG_ADCCLK, 0x300, 0x3);
++		else if (channel <= 14) /* 2.4G only */
++			rtw_write32_mask(rtwdev, REG_ADCCLK, 0x300, 0x2);
++	}
++}
++
++static void rtw88xxa_switch_channel(struct rtw_dev *rtwdev, u8 channel, u8 bw)
++{
++	struct rtw_hal *hal = &rtwdev->hal;
++	u32 fc_area, rf_mod_ag;
++	u8 path;
++
++	switch (channel) {
++	case 36 ... 48:
++		fc_area = 0x494;
++		break;
++	case 50 ... 64:
++		fc_area = 0x453;
++		break;
++	case 100 ... 116:
++		fc_area = 0x452;
++		break;
++	default:
++		if (channel >= 118)
++			fc_area = 0x412;
++		else
++			fc_area = 0x96a;
++		break;
++	}
++
++	rtw_write32_mask(rtwdev, REG_CLKTRK, 0x1ffe0000, fc_area);
++
++	for (path = 0; path < hal->rf_path_num; path++) {
++		switch (channel) {
++		case 36 ... 64:
++			rf_mod_ag = 0x101;
++			break;
++		case 100 ... 140:
++			rf_mod_ag = 0x301;
++			break;
++		default:
++			if (channel > 140)
++				rf_mod_ag = 0x501;
++			else
++				rf_mod_ag = 0x000;
++			break;
++		}
++
++		rtw_write_rf(rtwdev, path, RF_CFGCH,
++			     RF18_RFSI_MASK | RF18_BAND_MASK, rf_mod_ag);
++
++		if (rtwdev->chip->id == RTW_CHIP_TYPE_8812A)
++			rtw8812a_phy_fix_spur(rtwdev, channel, bw);
++
++		rtw_write_rf(rtwdev, path, RF_CFGCH, RF18_CHANNEL_MASK, channel);
++	}
++}
++
++static void rtw88xxa_set_reg_bw(struct rtw_dev *rtwdev, u8 bw)
++{
++	u16 val16 = rtw_read16(rtwdev, REG_WMAC_TRXPTCL_CTL);
++
++	val16 &= ~BIT_RFMOD;
++	if (bw == RTW_CHANNEL_WIDTH_80)
++		val16 |= BIT_RFMOD_80M;
++	else if (bw == RTW_CHANNEL_WIDTH_40)
++		val16 |= BIT_RFMOD_40M;
++
++	rtw_write16(rtwdev, REG_WMAC_TRXPTCL_CTL, val16);
++}
++
++static void rtw88xxa_post_set_bw_mode(struct rtw_dev *rtwdev, u8 channel,
++				      u8 bw, u8 primary_chan_idx)
++{
++	struct rtw_hal *hal = &rtwdev->hal;
++	u8 txsc40 = 0, txsc20, txsc;
++	u8 reg_837, l1pkval;
++
++	rtw88xxa_set_reg_bw(rtwdev, bw);
++
++	txsc20 = primary_chan_idx;
++	if (bw == RTW_CHANNEL_WIDTH_80) {
++		if (txsc20 == RTW_SC_20_UPPER || txsc20 == RTW_SC_20_UPMOST)
++			txsc40 = RTW_SC_40_UPPER;
++		else
++			txsc40 = RTW_SC_40_LOWER;
++	}
++
++	txsc = BIT_TXSC_20M(txsc20) | BIT_TXSC_40M(txsc40);
++	rtw_write8(rtwdev, REG_DATA_SC, txsc);
++
++	reg_837 = rtw_read8(rtwdev, REG_BWINDICATION + 3);
++
++	switch (bw) {
++	default:
++	case RTW_CHANNEL_WIDTH_20:
++		rtw_write32_mask(rtwdev, REG_ADCCLK, 0x003003C3, 0x00300200);
++		rtw_write32_mask(rtwdev, REG_ADC160, BIT(30), 0);
++
++		if (hal->rf_type == RF_2T2R)
++			rtw_write32_mask(rtwdev, REG_L1PKTH, 0x03C00000, 7);
++		else
++			rtw_write32_mask(rtwdev, REG_L1PKTH, 0x03C00000, 8);
++
++		break;
++	case RTW_CHANNEL_WIDTH_40:
++		rtw_write32_mask(rtwdev, REG_ADCCLK, 0x003003C3, 0x00300201);
++		rtw_write32_mask(rtwdev, REG_ADC160, BIT(30), 0);
++		rtw_write32_mask(rtwdev, REG_ADCCLK, 0x3C, txsc);
++		rtw_write32_mask(rtwdev, REG_CCA2ND, 0xf0000000, txsc);
++
++		if (reg_837 & BIT(2)) {
++			l1pkval = 6;
++		} else {
++			if (hal->rf_type == RF_2T2R)
++				l1pkval = 7;
++			else
++				l1pkval = 8;
++		}
++
++		rtw_write32_mask(rtwdev, REG_L1PKTH, 0x03C00000, l1pkval);
++
++		if (txsc == RTW_SC_20_UPPER)
++			rtw_write32_set(rtwdev, REG_RXSB, BIT(4));
++		else
++			rtw_write32_clr(rtwdev, REG_RXSB, BIT(4));
++
++		break;
++	case RTW_CHANNEL_WIDTH_80:
++		rtw_write32_mask(rtwdev, REG_ADCCLK, 0x003003C3, 0x00300202);
++		rtw_write32_mask(rtwdev, REG_ADC160, BIT(30), 1);
++		rtw_write32_mask(rtwdev, REG_ADCCLK, 0x3C, txsc);
++		rtw_write32_mask(rtwdev, REG_CCA2ND, 0xf0000000, txsc);
++
++		if (reg_837 & BIT(2)) {
++			l1pkval = 5;
++		} else {
++			if (hal->rf_type == RF_2T2R)
++				l1pkval = 6;
++			else
++				l1pkval = 7;
++		}
++
++		rtw_write32_mask(rtwdev, REG_L1PKTH, 0x03C00000, l1pkval);
++
++		break;
++	}
++}
++
++static void rtw88xxa_set_channel_rf(struct rtw_dev *rtwdev, u8 channel, u8 bw)
++{
++	u8 path;
++
++	for (path = RF_PATH_A; path < rtwdev->hal.rf_path_num; path++) {
++		switch (bw) {
++		case RTW_CHANNEL_WIDTH_5:
++		case RTW_CHANNEL_WIDTH_10:
++		case RTW_CHANNEL_WIDTH_20:
++		default:
++			rtw_write_rf(rtwdev, path, RF_CFGCH, RF18_BW_MASK, 3);
++			break;
++		case RTW_CHANNEL_WIDTH_40:
++			rtw_write_rf(rtwdev, path, RF_CFGCH, RF18_BW_MASK, 1);
++			break;
++		case RTW_CHANNEL_WIDTH_80:
++			rtw_write_rf(rtwdev, path, RF_CFGCH, RF18_BW_MASK, 0);
++			break;
++		}
++	}
++}
++
++void rtw88xxa_set_channel(struct rtw_dev *rtwdev, u8 channel, u8 bw,
++			  u8 primary_chan_idx)
++{
++	u8 old_band, new_band;
++
++	if (rtw_read8(rtwdev, REG_CCK_CHECK) & BIT_CHECK_CCK_EN)
++		old_band = RTW_BAND_5G;
++	else
++		old_band = RTW_BAND_2G;
++
++	if (channel > 14)
++		new_band = RTW_BAND_5G;
++	else
++		new_band = RTW_BAND_2G;
++
++	if (new_band != old_band)
++		rtw88xxa_switch_band(rtwdev, new_band, bw);
++
++	rtw88xxa_switch_channel(rtwdev, channel, bw);
++
++	rtw88xxa_post_set_bw_mode(rtwdev, channel, bw, primary_chan_idx);
++
++	if (rtwdev->chip->id == RTW_CHIP_TYPE_8812A)
++		rtw8812a_phy_fix_spur(rtwdev, channel, bw);
++
++	rtw88xxa_set_channel_rf(rtwdev, channel, bw);
++}
++EXPORT_SYMBOL(rtw88xxa_set_channel);
++
++void rtw88xxa_query_phy_status(struct rtw_dev *rtwdev, u8 *phy_status,
++			       struct rtw_rx_pkt_stat *pkt_stat,
++			       s8 (*cck_rx_pwr)(u8 lna_idx, u8 vga_idx))
++{
++	struct rtw_dm_info *dm_info = &rtwdev->dm_info;
++	struct rtw_jaguar_phy_status_rpt *rpt;
++	u8 gain[RTW_RF_PATH_MAX], rssi, i;
++	s8 rx_pwr_db, power_a, power_b;
++	const s8 min_rx_power = -120;
++	u8 lna_idx, vga_idx;
++
++	rpt = (struct rtw_jaguar_phy_status_rpt *)phy_status;
++
++	if (pkt_stat->rate <= DESC_RATE11M) {
++		lna_idx = le32_get_bits(rpt->w1, RTW_JGRPHY_W1_AGC_RPT_LNA_IDX);
++		vga_idx = le32_get_bits(rpt->w1, RTW_JGRPHY_W1_AGC_RPT_VGA_IDX);
++
++		rx_pwr_db = cck_rx_pwr(lna_idx, vga_idx);
++
++		pkt_stat->rx_power[RF_PATH_A] = rx_pwr_db;
++		pkt_stat->rssi = rtw_phy_rf_power_2_rssi(pkt_stat->rx_power, 1);
++		dm_info->rssi[RF_PATH_A] = pkt_stat->rssi;
++		pkt_stat->bw = RTW_CHANNEL_WIDTH_20;
++		pkt_stat->signal_power = rx_pwr_db;
++	} else { /* OFDM rate */
++		gain[RF_PATH_A] = le32_get_bits(rpt->w0, RTW_JGRPHY_W0_GAIN_A);
++		gain[RF_PATH_B] = le32_get_bits(rpt->w0, RTW_JGRPHY_W0_GAIN_B);
++
++		for (i = RF_PATH_A; i < rtwdev->hal.rf_path_num; i++) {
++			pkt_stat->rx_power[i] = gain[i] - 110;
++			rssi = rtw_phy_rf_power_2_rssi(&pkt_stat->rx_power[i], 1);
++			dm_info->rssi[i] = rssi;
++		}
++
++		pkt_stat->rssi = rtw_phy_rf_power_2_rssi(pkt_stat->rx_power,
++							 rtwdev->hal.rf_path_num);
++
++		power_a = pkt_stat->rx_power[RF_PATH_A];
++		power_b = pkt_stat->rx_power[RF_PATH_B];
++		if (rtwdev->hal.rf_path_num == 1)
++			power_b = power_a;
++
++		pkt_stat->signal_power = max3(power_a, power_b, min_rx_power);
++	}
++}
++EXPORT_SYMBOL(rtw88xxa_query_phy_status);
++
++static void
++rtw88xxa_set_tx_power_index_by_rate(struct rtw_dev *rtwdev, u8 path,
++				    u8 rs, u32 *phy_pwr_idx)
++{
++	static const u32 offset_txagc[2] = {
++		REG_TX_AGC_A_CCK_11_CCK_1, REG_TX_AGC_B_CCK_11_CCK_1
++	};
++	u8 rate, rate_idx, pwr_index, shift;
++	struct rtw_hal *hal = &rtwdev->hal;
++	bool write_1ss_mcs9;
++	u32 mask;
++	int j;
++
++	for (j = 0; j < rtw_rate_size[rs]; j++) {
++		rate = rtw_rate_section[rs][j];
++
++		pwr_index = hal->tx_pwr_tbl[path][rate];
++
++		shift = rate & 0x3;
++		*phy_pwr_idx |= ((u32)pwr_index << (shift * 8));
++
++		write_1ss_mcs9 = rate == DESC_RATEVHT1SS_MCS9 &&
++				 hal->rf_path_num == 1;
++
++		if (write_1ss_mcs9)
++			mask = MASKLWORD;
++		else
++			mask = MASKDWORD;
++
++		if (shift == 0x3 || write_1ss_mcs9) {
++			rate_idx = rate & 0xfc;
++			if (rate >= DESC_RATEVHT1SS_MCS0)
++				rate_idx -= 0x10;
++
++			rtw_write32_mask(rtwdev, offset_txagc[path] + rate_idx,
++					 mask, *phy_pwr_idx);
++
++			*phy_pwr_idx = 0;
++		}
++	}
++}
++
++static void rtw88xxa_tx_power_training(struct rtw_dev *rtwdev, u8 bw,
++				       u8 channel, u8 path)
++{
++	static const u32 write_offset[] = {
++		REG_TX_PWR_TRAINING_A, REG_TX_PWR_TRAINING_B,
++	};
++	u32 power_level, write_data;
++	u8 i;
++
++	power_level = rtwdev->hal.tx_pwr_tbl[path][DESC_RATEMCS7];
++	write_data = 0;
++
++	for (i = 0; i < 3; i++) {
++		if (i == 0)
++			power_level -= 10;
++		else if (i == 1)
++			power_level -= 8;
++		else
++			power_level -= 6;
++
++		write_data |= max_t(u32, power_level, 2) << (i * 8);
++	}
++
++	rtw_write32_mask(rtwdev, write_offset[path], 0xffffff, write_data);
++}
++
++void rtw88xxa_set_tx_power_index(struct rtw_dev *rtwdev)
++{
++	struct rtw_hal *hal = &rtwdev->hal;
++	u32 phy_pwr_idx = 0;
++	int rs, path;
++
++	for (path = 0; path < hal->rf_path_num; path++) {
++		for (rs = 0; rs < RTW_RATE_SECTION_MAX; rs++) {
++			if (hal->rf_path_num == 1 &&
++			    (rs == RTW_RATE_SECTION_HT_2S ||
++			     rs == RTW_RATE_SECTION_VHT_2S))
++				continue;
++
++			if (test_bit(RTW_FLAG_SCANNING, rtwdev->flags) &&
++			    rs > RTW_RATE_SECTION_OFDM)
++				continue;
++
++			if (hal->current_band_type == RTW_BAND_5G &&
++			    rs == RTW_RATE_SECTION_CCK)
++				continue;
++
++			rtw88xxa_set_tx_power_index_by_rate(rtwdev, path, rs,
++							    &phy_pwr_idx);
++		}
++
++		rtw88xxa_tx_power_training(rtwdev, hal->current_band_width,
++					   hal->current_channel, path);
++	}
++}
++EXPORT_SYMBOL(rtw88xxa_set_tx_power_index);
++
++void rtw88xxa_false_alarm_statistics(struct rtw_dev *rtwdev)
++{
++	struct rtw_dm_info *dm_info = &rtwdev->dm_info;
++	u32 cck_fa_cnt, ofdm_fa_cnt;
++	u32 crc32_cnt, cca32_cnt;
++	u32 cck_enable;
++
++	cck_enable = rtw_read32(rtwdev, REG_RXPSEL) & BIT(28);
++	cck_fa_cnt = rtw_read16(rtwdev, REG_FA_CCK);
++	ofdm_fa_cnt = rtw_read16(rtwdev, REG_FA_OFDM);
++
++	dm_info->cck_fa_cnt = cck_fa_cnt;
++	dm_info->ofdm_fa_cnt = ofdm_fa_cnt;
++	dm_info->total_fa_cnt = ofdm_fa_cnt;
++	if (cck_enable)
++		dm_info->total_fa_cnt += cck_fa_cnt;
++
++	crc32_cnt = rtw_read32(rtwdev, REG_CRC_CCK);
++	dm_info->cck_ok_cnt = u32_get_bits(crc32_cnt, MASKLWORD);
++	dm_info->cck_err_cnt = u32_get_bits(crc32_cnt, MASKHWORD);
++
++	crc32_cnt = rtw_read32(rtwdev, REG_CRC_OFDM);
++	dm_info->ofdm_ok_cnt = u32_get_bits(crc32_cnt, MASKLWORD);
++	dm_info->ofdm_err_cnt = u32_get_bits(crc32_cnt, MASKHWORD);
++
++	crc32_cnt = rtw_read32(rtwdev, REG_CRC_HT);
++	dm_info->ht_ok_cnt = u32_get_bits(crc32_cnt, MASKLWORD);
++	dm_info->ht_err_cnt = u32_get_bits(crc32_cnt, MASKHWORD);
++
++	crc32_cnt = rtw_read32(rtwdev, REG_CRC_VHT);
++	dm_info->vht_ok_cnt = u32_get_bits(crc32_cnt, MASKLWORD);
++	dm_info->vht_err_cnt = u32_get_bits(crc32_cnt, MASKHWORD);
++
++	cca32_cnt = rtw_read32(rtwdev, REG_CCA_OFDM);
++	dm_info->ofdm_cca_cnt = u32_get_bits(cca32_cnt, MASKHWORD);
++	dm_info->total_cca_cnt = dm_info->ofdm_cca_cnt;
++	if (cck_enable) {
++		cca32_cnt = rtw_read32(rtwdev, REG_CCA_CCK);
++		dm_info->cck_cca_cnt = u32_get_bits(cca32_cnt, MASKLWORD);
++		dm_info->total_cca_cnt += dm_info->cck_cca_cnt;
++	}
++
++	rtw_write32_set(rtwdev, REG_FAS, BIT(17));
++	rtw_write32_clr(rtwdev, REG_FAS, BIT(17));
++	rtw_write32_clr(rtwdev, REG_CCK0_FAREPORT, BIT(15));
++	rtw_write32_set(rtwdev, REG_CCK0_FAREPORT, BIT(15));
++	rtw_write32_set(rtwdev, REG_CNTRST, BIT(0));
++	rtw_write32_clr(rtwdev, REG_CNTRST, BIT(0));
++}
++EXPORT_SYMBOL(rtw88xxa_false_alarm_statistics);
++
++void rtw88xxa_iqk_backup_mac_bb(struct rtw_dev *rtwdev,
++				u32 *macbb_backup,
++				const u32 *backup_macbb_reg,
++				u32 macbb_num)
++{
++	u32 i;
++
++	/* [31] = 0 --> Page C */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++
++	/* save MACBB default value */
++	for (i = 0; i < macbb_num; i++)
++		macbb_backup[i] = rtw_read32(rtwdev, backup_macbb_reg[i]);
++}
++EXPORT_SYMBOL(rtw88xxa_iqk_backup_mac_bb);
++
++void rtw88xxa_iqk_backup_afe(struct rtw_dev *rtwdev, u32 *afe_backup,
++			     const u32 *backup_afe_reg, u32 afe_num)
++{
++	u32 i;
++
++	/* [31] = 0 --> Page C */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++
++	/* Save AFE Parameters */
++	for (i = 0; i < afe_num; i++)
++		afe_backup[i] = rtw_read32(rtwdev, backup_afe_reg[i]);
++}
++EXPORT_SYMBOL(rtw88xxa_iqk_backup_afe);
++
++void rtw88xxa_iqk_restore_mac_bb(struct rtw_dev *rtwdev,
++				 u32 *macbb_backup,
++				 const u32 *backup_macbb_reg,
++				 u32 macbb_num)
++{
++	u32 i;
++
++	/* [31] = 0 --> Page C */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++
++	/* Reload MacBB Parameters */
++	for (i = 0; i < macbb_num; i++)
++		rtw_write32(rtwdev, backup_macbb_reg[i], macbb_backup[i]);
++}
++EXPORT_SYMBOL(rtw88xxa_iqk_restore_mac_bb);
++
++void rtw88xxa_iqk_configure_mac(struct rtw_dev *rtwdev)
++{
++	/* [31] = 0 --> Page C */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++
++	rtw_write8(rtwdev, REG_TXPAUSE, 0x3f);
++	rtw_write32_mask(rtwdev, REG_BCN_CTRL,
++			 (BIT_EN_BCN_FUNCTION << 8) | BIT_EN_BCN_FUNCTION, 0x0);
++
++	/* RX ante off */
++	rtw_write8(rtwdev, REG_RXPSEL, 0x00);
++
++	/* CCA off */
++	rtw_write32_mask(rtwdev, REG_CCA2ND, 0xf, 0xc);
++
++	/* CCK RX path off */
++	rtw_write8(rtwdev, REG_CCK_RX + 3, 0xf);
++}
++EXPORT_SYMBOL(rtw88xxa_iqk_configure_mac);
++
++bool rtw88xxa_iqk_finish(int average, int threshold,
++			 int *x_temp, int *y_temp, int *x, int *y,
++			 bool break_inner, bool break_outer)
++{
++	bool finish = false;
++	int i, ii, dx, dy;
++
++	for (i = 0; i < average; i++) {
++		for (ii = i + 1; ii < average; ii++) {
++			dx = abs_diff(x_temp[i] >> 21, x_temp[ii] >> 21);
++			dy = abs_diff(y_temp[i] >> 21, y_temp[ii] >> 21);
++
++			if (dx < threshold && dy < threshold) {
++				*x = ((x_temp[i] >> 21) + (x_temp[ii] >> 21));
++				*y = ((y_temp[i] >> 21) + (y_temp[ii] >> 21));
++
++				*x /= 2;
++				*y /= 2;
++
++				finish = true;
++
++				if (break_inner)
++					break;
++			}
++		}
++
++		if (finish && break_outer)
++			break;
++	}
++
++	return finish;
++}
++EXPORT_SYMBOL(rtw88xxa_iqk_finish);
++
++static void rtw88xxa_pwrtrack_set(struct rtw_dev *rtwdev, u8 tx_rate, u8 path)
++{
++	static const u32 reg_txscale[2] = { REG_TXSCALE_A, REG_TXSCALE_B };
++	struct rtw_dm_info *dm_info = &rtwdev->dm_info;
++	u8 cck_swing_idx, ofdm_swing_idx;
++	u8 pwr_tracking_limit;
++
++	switch (tx_rate) {
++	case DESC_RATE1M ... DESC_RATE11M:
++		pwr_tracking_limit = 32;
++		break;
++	case DESC_RATE6M ... DESC_RATE48M:
++	case DESC_RATEMCS3 ... DESC_RATEMCS4:
++	case DESC_RATEMCS11 ... DESC_RATEMCS12:
++	case DESC_RATEVHT1SS_MCS3 ... DESC_RATEVHT1SS_MCS4:
++	case DESC_RATEVHT2SS_MCS3 ... DESC_RATEVHT2SS_MCS4:
++		pwr_tracking_limit = 30;
++		break;
++	case DESC_RATE54M:
++	case DESC_RATEMCS5 ... DESC_RATEMCS7:
++	case DESC_RATEMCS13 ... DESC_RATEMCS15:
++	case DESC_RATEVHT1SS_MCS5 ... DESC_RATEVHT1SS_MCS6:
++	case DESC_RATEVHT2SS_MCS5 ... DESC_RATEVHT2SS_MCS6:
++		pwr_tracking_limit = 28;
++		break;
++	case DESC_RATEMCS0 ... DESC_RATEMCS2:
++	case DESC_RATEMCS8 ... DESC_RATEMCS10:
++	case DESC_RATEVHT1SS_MCS0 ... DESC_RATEVHT1SS_MCS2:
++	case DESC_RATEVHT2SS_MCS0 ... DESC_RATEVHT2SS_MCS2:
++		pwr_tracking_limit = 34;
++		break;
++	case DESC_RATEVHT1SS_MCS7:
++	case DESC_RATEVHT2SS_MCS7:
++		pwr_tracking_limit = 26;
++		break;
++	default:
++	case DESC_RATEVHT1SS_MCS8:
++	case DESC_RATEVHT2SS_MCS8:
++		pwr_tracking_limit = 24;
++		break;
++	case DESC_RATEVHT1SS_MCS9:
++	case DESC_RATEVHT2SS_MCS9:
++		pwr_tracking_limit = 22;
++		break;
++	}
++
++	cck_swing_idx = dm_info->delta_power_index[path] + dm_info->default_cck_index;
++	ofdm_swing_idx = dm_info->delta_power_index[path] + dm_info->default_ofdm_index;
++
++	if (ofdm_swing_idx > pwr_tracking_limit) {
++		if (path == RF_PATH_A)
++			dm_info->txagc_remnant_cck = cck_swing_idx - pwr_tracking_limit;
++		dm_info->txagc_remnant_ofdm[path] = ofdm_swing_idx - pwr_tracking_limit;
++
++		ofdm_swing_idx = pwr_tracking_limit;
++	} else if (ofdm_swing_idx == 0) {
++		if (path == RF_PATH_A)
++			dm_info->txagc_remnant_cck = cck_swing_idx;
++		dm_info->txagc_remnant_ofdm[path] = ofdm_swing_idx;
++	} else {
++		if (path == RF_PATH_A)
++			dm_info->txagc_remnant_cck = 0;
++		dm_info->txagc_remnant_ofdm[path] = 0;
++	}
++
++	rtw_write32_mask(rtwdev, reg_txscale[path], GENMASK(31, 21),
++			 rtw88xxa_txscale_tbl[ofdm_swing_idx]);
++}
++
++void rtw88xxa_phy_pwrtrack(struct rtw_dev *rtwdev,
++			   void (*do_lck)(struct rtw_dev *rtwdev),
++			   void (*do_iqk)(struct rtw_dev *rtwdev))
++{
++	struct rtw_dm_info *dm_info = &rtwdev->dm_info;
++	struct rtw_hal *hal = &rtwdev->hal;
++	struct rtw_swing_table swing_table;
++	s8 remnant_pre[RTW_RF_PATH_MAX];
++	u8 thermal_value, delta, path;
++	bool need_iqk;
++
++	rtw_phy_config_swing_table(rtwdev, &swing_table);
++
++	if (rtwdev->efuse.thermal_meter[0] == 0xff) {
++		pr_err_once("efuse thermal meter is 0xff\n");
++		return;
++	}
++
++	thermal_value = rtw_read_rf(rtwdev, RF_PATH_A, RF_T_METER, 0xfc00);
++
++	rtw_phy_pwrtrack_avg(rtwdev, thermal_value, RF_PATH_A);
++
++	need_iqk = rtw_phy_pwrtrack_need_iqk(rtwdev);
++
++	if (need_iqk && do_lck)
++		do_lck(rtwdev);
++
++	if (dm_info->pwr_trk_init_trigger)
++		dm_info->pwr_trk_init_trigger = false;
++	else if (!rtw_phy_pwrtrack_thermal_changed(rtwdev, thermal_value,
++						   RF_PATH_A))
++		goto iqk;
++
++	delta = rtw_phy_pwrtrack_get_delta(rtwdev, RF_PATH_A);
++
++	for (path = RF_PATH_A; path < hal->rf_path_num; path++) {
++		remnant_pre[path] = dm_info->txagc_remnant_ofdm[path];
++
++		dm_info->delta_power_index[path] =
++			rtw_phy_pwrtrack_get_pwridx(rtwdev, &swing_table, path,
++						    RF_PATH_A, delta);
++
++		if (dm_info->delta_power_index[path] !=
++		    dm_info->delta_power_index_last[path]) {
++			dm_info->delta_power_index_last[path] =
++				dm_info->delta_power_index[path];
++
++			rtw88xxa_pwrtrack_set(rtwdev, dm_info->tx_rate, path);
++		}
++	}
++
++	for (path = RF_PATH_A; path < hal->rf_path_num; path++) {
++		if (remnant_pre[path] != dm_info->txagc_remnant_ofdm[path]) {
++			rtw_phy_set_tx_power_level(rtwdev,
++						   hal->current_channel);
++			break;
++		}
++	}
++
++iqk:
++	if (need_iqk)
++		do_iqk(rtwdev);
++}
++EXPORT_SYMBOL(rtw88xxa_phy_pwrtrack);
++
++void rtw88xxa_phy_cck_pd_set(struct rtw_dev *rtwdev, u8 new_lvl)
++{
++	static const u8 pd[CCK_PD_LV_MAX] = {0x40, 0x83, 0xcd, 0xdd, 0xed};
++	struct rtw_dm_info *dm_info = &rtwdev->dm_info;
++
++	/* Override rtw_phy_cck_pd_lv_link(). It implements something
++	 * like type 2/3/4. We need type 1 here.
++	 */
++	if (rtw_is_assoc(rtwdev)) {
++		if (dm_info->min_rssi > 60) {
++			new_lvl = CCK_PD_LV3;
++		} else if (dm_info->min_rssi > 35) {
++			new_lvl = CCK_PD_LV2;
++		} else if (dm_info->min_rssi > 20) {
++			if (dm_info->cck_fa_avg > 500)
++				new_lvl = CCK_PD_LV2;
++			else if (dm_info->cck_fa_avg < 250)
++				new_lvl = CCK_PD_LV1;
++			else
++				return;
++		} else {
++			new_lvl = CCK_PD_LV1;
++		}
++	}
++
++	rtw_dbg(rtwdev, RTW_DBG_PHY, "lv: (%d) -> (%d)\n",
++		dm_info->cck_pd_lv[RTW_CHANNEL_WIDTH_20][RF_PATH_A], new_lvl);
++
++	if (dm_info->cck_pd_lv[RTW_CHANNEL_WIDTH_20][RF_PATH_A] == new_lvl)
++		return;
++
++	dm_info->cck_fa_avg = CCK_FA_AVG_RESET;
++	dm_info->cck_pd_lv[RTW_CHANNEL_WIDTH_20][RF_PATH_A] = new_lvl;
++
++	rtw_write8(rtwdev, REG_CCK_PD_TH, pd[new_lvl]);
++}
++EXPORT_SYMBOL(rtw88xxa_phy_cck_pd_set);
++
++MODULE_AUTHOR("Realtek Corporation");
++MODULE_DESCRIPTION("Realtek 802.11ac wireless 8821a/8811a/8812a common code");
++MODULE_LICENSE("Dual BSD/GPL");
+--- /dev/null
++++ b/drivers/net/wireless/realtek/rtw88/rtw88xxa.h
+@@ -0,0 +1,175 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
++/* Copyright(c) 2024  Realtek Corporation
++ */
++
++#ifndef __RTW88XXA_H__
++#define __RTW88XXA_H__
++
++#include <asm/byteorder.h>
++#include "reg.h"
++
++struct rtw8821au_efuse {
++	u8 res4[48];			/* 0xd0 */
++	u8 vid[2];			/* 0x100 */
++	u8 pid[2];
++	u8 res8[3];
++	u8 mac_addr[ETH_ALEN];		/* 0x107 */
++	u8 res9[243];
++} __packed;
++
++struct rtw8812au_efuse {
++	u8 vid[2];			/* 0xd0 */
++	u8 pid[2];			/* 0xd2 */
++	u8 res0[3];
++	u8 mac_addr[ETH_ALEN];		/* 0xd7 */
++	u8 res1[291];
++} __packed;
++
++struct rtw88xxa_efuse {
++	__le16 rtl_id;
++	u8 res0[6];			/* 0x02 */
++	u8 usb_mode;			/* 0x08 */
++	u8 res1[7];			/* 0x09 */
++
++	/* power index for four RF paths */
++	struct rtw_txpwr_idx txpwr_idx_table[4];
++
++	u8 channel_plan;		/* 0xb8 */
++	u8 xtal_k;
++	u8 thermal_meter;
++	u8 iqk_lck;
++	u8 pa_type;			/* 0xbc */
++	u8 lna_type_2g;			/* 0xbd */
++	u8 res2;
++	u8 lna_type_5g;			/* 0xbf */
++	u8 res3;
++	u8 rf_board_option;		/* 0xc1 */
++	u8 rf_feature_option;
++	u8 rf_bt_setting;
++	u8 eeprom_version;
++	u8 eeprom_customer_id;		/* 0xc5 */
++	u8 tx_bb_swing_setting_2g;
++	u8 tx_bb_swing_setting_5g;
++	u8 tx_pwr_calibrate_rate;
++	u8 rf_antenna_option;		/* 0xc9 */
++	u8 rfe_option;
++	u8 country_code[2];
++	u8 res4[3];
++	union {
++		struct rtw8821au_efuse rtw8821au;
++		struct rtw8812au_efuse rtw8812au;
++	};
++} __packed;
++
++static_assert(sizeof(struct rtw88xxa_efuse) == 512);
++
++#define WLAN_BCN_DMA_TIME			0x02
++#define WLAN_TBTT_PROHIBIT			0x04
++#define WLAN_TBTT_HOLD_TIME			0x064
++#define WLAN_TBTT_TIME	(WLAN_TBTT_PROHIBIT |\
++			(WLAN_TBTT_HOLD_TIME << BIT_SHIFT_TBTT_HOLD_TIME_AP))
++
++struct rtw_jaguar_phy_status_rpt {
++	__le32 w0;
++	__le32 w1;
++	__le32 w2;
++	__le32 w3;
++	__le32 w4;
++	__le32 w5;
++	__le32 w6;
++} __packed;
++
++#define RTW_JGRPHY_W0_GAIN_A		GENMASK(6, 0)
++#define RTW_JGRPHY_W0_TRSW_A		BIT(7)
++#define RTW_JGRPHY_W0_GAIN_B		GENMASK(14, 8)
++#define RTW_JGRPHY_W0_TRSW_B		BIT(15)
++#define RTW_JGRPHY_W0_CHL_NUM		GENMASK(25, 16)
++#define RTW_JGRPHY_W0_SUB_CHNL		GENMASK(29, 26)
++#define RTW_JGRPHY_W0_R_RFMOD		GENMASK(31, 30)
++
++/* CCK: */
++#define RTW_JGRPHY_W1_SIG_QUAL		GENMASK(7, 0)
++#define RTW_JGRPHY_W1_AGC_RPT_VGA_IDX	GENMASK(12, 8)
++#define RTW_JGRPHY_W1_AGC_RPT_LNA_IDX	GENMASK(15, 13)
++#define RTW_JGRPHY_W1_BB_POWER		GENMASK(23, 16)
++/* OFDM: */
++#define RTW_JGRPHY_W1_PWDB_ALL		GENMASK(7, 0)
++#define RTW_JGRPHY_W1_CFO_SHORT_A	GENMASK(15, 8)	/* s8 */
++#define RTW_JGRPHY_W1_CFO_SHORT_B	GENMASK(23, 16)	/* s8 */
++#define RTW_JGRPHY_W1_BT_RF_CH_MSB	GENMASK(31, 30)
++
++#define RTW_JGRPHY_W2_ANT_DIV_SW_A	BIT(0)
++#define RTW_JGRPHY_W2_ANT_DIV_SW_B	BIT(1)
++#define RTW_JGRPHY_W2_BT_RF_CH_LSB	GENMASK(7, 2)
++#define RTW_JGRPHY_W2_CFO_TAIL_A	GENMASK(15, 8)	/* s8 */
++#define RTW_JGRPHY_W2_CFO_TAIL_B	GENMASK(23, 16)	/* s8 */
++#define RTW_JGRPHY_W2_PCTS_MSK_RPT_0	GENMASK(31, 24)
++
++#define RTW_JGRPHY_W3_PCTS_MSK_RPT_1	GENMASK(7, 0)
++/* Stream 1 and 2 RX EVM: */
++#define RTW_JGRPHY_W3_RXEVM_1		GENMASK(15, 8)	/* s8 */
++#define RTW_JGRPHY_W3_RXEVM_2		GENMASK(23, 16)	/* s8 */
++#define RTW_JGRPHY_W3_RXSNR_A		GENMASK(31, 24)	/* s8 */
++
++#define RTW_JGRPHY_W4_RXSNR_B		GENMASK(7, 0)	/* s8 */
++#define RTW_JGRPHY_W4_PCTS_MSK_RPT_2	GENMASK(21, 8)
++#define RTW_JGRPHY_W4_PCTS_RPT_VALID	BIT(22)
++#define RTW_JGRPHY_W4_RXEVM_3		GENMASK(31, 24)	/* s8 */
++
++#define RTW_JGRPHY_W5_RXEVM_4		GENMASK(7, 0)	/* s8 */
++/* 8812a, stream 1 and 2 CSI: */
++#define RTW_JGRPHY_W5_CSI_CURRENT_1	GENMASK(15, 8)
++#define RTW_JGRPHY_W5_CSI_CURRENT_2	GENMASK(23, 16)
++/* 8814a: */
++#define RTW_JGRPHY_W5_RXSNR_C		GENMASK(15, 8)	/* s8 */
++#define RTW_JGRPHY_W5_RXSNR_D		GENMASK(23, 16)	/* s8 */
++#define RTW_JGRPHY_W5_GAIN_C		GENMASK(30, 24)
++#define RTW_JGRPHY_W5_TRSW_C		BIT(31)
++
++#define RTW_JGRPHY_W6_GAIN_D		GENMASK(6, 0)
++#define RTW_JGRPHY_W6_TRSW_D		BIT(7)
++#define RTW_JGRPHY_W6_SIGEVM		GENMASK(15, 8)	/* s8 */
++#define RTW_JGRPHY_W6_ANTIDX_ANTC	GENMASK(18, 16)
++#define RTW_JGRPHY_W6_ANTIDX_ANTD	GENMASK(21, 19)
++#define RTW_JGRPHY_W6_DPDT_CTRL_KEEP	BIT(22)
++#define RTW_JGRPHY_W6_GNT_BT_KEEP	BIT(23)
++#define RTW_JGRPHY_W6_ANTIDX_ANTA	GENMASK(26, 24)
++#define RTW_JGRPHY_W6_ANTIDX_ANTB	GENMASK(29, 27)
++#define RTW_JGRPHY_W6_HW_ANTSW_OCCUR	GENMASK(31, 30)
++
++#define RF18_BW_MASK		(BIT(11) | BIT(10))
++
++void rtw88xxa_efuse_grant(struct rtw_dev *rtwdev, bool on);
++int rtw88xxa_read_efuse(struct rtw_dev *rtwdev, u8 *log_map);
++void rtw88xxa_power_off(struct rtw_dev *rtwdev,
++			const struct rtw_pwr_seq_cmd *const *enter_lps_flow);
++int rtw88xxa_power_on(struct rtw_dev *rtwdev);
++u32 rtw88xxa_phy_read_rf(struct rtw_dev *rtwdev,
++			 enum rtw_rf_path rf_path, u32 addr, u32 mask);
++void rtw88xxa_set_channel(struct rtw_dev *rtwdev, u8 channel, u8 bw,
++			  u8 primary_chan_idx);
++void rtw88xxa_query_phy_status(struct rtw_dev *rtwdev, u8 *phy_status,
++			       struct rtw_rx_pkt_stat *pkt_stat,
++			       s8 (*cck_rx_pwr)(u8 lna_idx, u8 vga_idx));
++void rtw88xxa_set_tx_power_index(struct rtw_dev *rtwdev);
++void rtw88xxa_false_alarm_statistics(struct rtw_dev *rtwdev);
++void rtw88xxa_iqk_backup_mac_bb(struct rtw_dev *rtwdev,
++				u32 *macbb_backup,
++				const u32 *backup_macbb_reg,
++				u32 macbb_num);
++void rtw88xxa_iqk_backup_afe(struct rtw_dev *rtwdev, u32 *afe_backup,
++			     const u32 *backup_afe_reg, u32 afe_num);
++void rtw88xxa_iqk_restore_mac_bb(struct rtw_dev *rtwdev,
++				 u32 *macbb_backup,
++				 const u32 *backup_macbb_reg,
++				 u32 macbb_num);
++void rtw88xxa_iqk_configure_mac(struct rtw_dev *rtwdev);
++bool rtw88xxa_iqk_finish(int average, int threshold,
++			 int *x_temp, int *y_temp, int *x, int *y,
++			 bool break_inner, bool break_outer);
++void rtw88xxa_phy_pwrtrack(struct rtw_dev *rtwdev,
++			   void (*do_lck)(struct rtw_dev *rtwdev),
++			   void (*do_iqk)(struct rtw_dev *rtwdev));
++void rtw88xxa_phy_cck_pd_set(struct rtw_dev *rtwdev, u8 new_lvl);
++
++#endif
diff --git a/package/kernel/mac80211/patches/rtl/042-v6.13-wifi-rtw88-Add-rtw8821a.-c-h.patch b/package/kernel/mac80211/patches/rtl/042-v6.13-wifi-rtw88-Add-rtw8821a.-c-h.patch
new file mode 100644
index 00000000000000..dca3f7b275aab6
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/042-v6.13-wifi-rtw88-Add-rtw8821a.-c-h.patch
@@ -0,0 +1,1230 @@
+From 32e284a238806d1984ea68cda25f6b09a4053b94 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 30 Oct 2024 20:28:15 +0200
+Subject: [PATCH] wifi: rtw88: Add rtw8821a.{c,h}
+
+These contain code specific to RTL8821AU.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/37218648-ada7-4fad-b7bd-d2aee28cefb9@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/rtw8821a.c | 1197 +++++++++++++++++
+ drivers/net/wireless/realtek/rtw88/rtw8821a.h |   10 +
+ 2 files changed, 1207 insertions(+)
+ create mode 100644 drivers/net/wireless/realtek/rtw88/rtw8821a.c
+ create mode 100644 drivers/net/wireless/realtek/rtw88/rtw8821a.h
+
+--- /dev/null
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821a.c
+@@ -0,0 +1,1197 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
++/* Copyright(c) 2024  Realtek Corporation
++ */
++
++#include "main.h"
++#include "coex.h"
++#include "phy.h"
++#include "reg.h"
++#include "rtw88xxa.h"
++#include "rtw8821a.h"
++#include "rtw8821a_table.h"
++#include "tx.h"
++
++static void rtw8821a_power_off(struct rtw_dev *rtwdev)
++{
++	rtw88xxa_power_off(rtwdev, enter_lps_flow_8821a);
++}
++
++static s8 rtw8821a_cck_rx_pwr(u8 lna_idx, u8 vga_idx)
++{
++	static const s8 lna_gain_table[] = {15, -1, -17, 0, -30, -38};
++	s8 rx_pwr_all = 0;
++	s8 lna_gain;
++
++	switch (lna_idx) {
++	case 5:
++	case 4:
++	case 2:
++	case 1:
++	case 0:
++		lna_gain = lna_gain_table[lna_idx];
++		rx_pwr_all = lna_gain - 2 * vga_idx;
++		break;
++	default:
++		break;
++	}
++
++	return rx_pwr_all;
++}
++
++static void rtw8821a_query_phy_status(struct rtw_dev *rtwdev, u8 *phy_status,
++				      struct rtw_rx_pkt_stat *pkt_stat)
++{
++	rtw88xxa_query_phy_status(rtwdev, phy_status, pkt_stat,
++				  rtw8821a_cck_rx_pwr);
++}
++
++static void rtw8821a_cfg_ldo25(struct rtw_dev *rtwdev, bool enable)
++{
++}
++
++#define CAL_NUM_8821A 3
++#define MACBB_REG_NUM_8821A 8
++#define AFE_REG_NUM_8821A 4
++#define RF_REG_NUM_8821A 3
++
++static void rtw8821a_iqk_backup_rf(struct rtw_dev *rtwdev, u32 *rfa_backup,
++				   const u32 *backup_rf_reg, u32 rf_num)
++{
++	u32 i;
++
++	/* [31] = 0 --> Page C */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++
++	/* Save RF Parameters */
++	for (i = 0; i < rf_num; i++)
++		rfa_backup[i] = rtw_read_rf(rtwdev, RF_PATH_A,
++					    backup_rf_reg[i], MASKDWORD);
++}
++
++static void rtw8821a_iqk_restore_rf(struct rtw_dev *rtwdev,
++				    const u32 *backup_rf_reg,
++				    u32 *RF_backup, u32 rf_reg_num)
++{
++	u32 i;
++
++	/* [31] = 0 --> Page C */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++
++	for (i = 0; i < rf_reg_num; i++)
++		rtw_write_rf(rtwdev, RF_PATH_A, backup_rf_reg[i],
++			     RFREG_MASK, RF_backup[i]);
++}
++
++static void rtw8821a_iqk_restore_afe(struct rtw_dev *rtwdev, u32 *afe_backup,
++				     const u32 *backup_afe_reg, u32 afe_num)
++{
++	u32 i;
++
++	/* [31] = 0 --> Page C */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++
++	/* Reload AFE Parameters */
++	for (i = 0; i < afe_num; i++)
++		rtw_write32(rtwdev, backup_afe_reg[i], afe_backup[i]);
++
++	/* [31] = 1 --> Page C1 */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x1);
++
++	rtw_write32(rtwdev, REG_OFDM0_XA_TX_IQ_IMBALANCE, 0x0);
++	rtw_write32(rtwdev, REG_OFDM0_A_TX_AFE, 0x0);
++	rtw_write32(rtwdev, REG_OFDM0_XB_TX_IQ_IMBALANCE, 0x0);
++	rtw_write32(rtwdev, REG_TSSI_TRK_SW, 0x3c000000);
++	rtw_write32(rtwdev, REG_LSSI_WRITE_A, 0x00000080);
++	rtw_write32(rtwdev, REG_TXAGCIDX, 0x00000000);
++	rtw_write32(rtwdev, REG_IQK_DPD_CFG, 0x20040000);
++	rtw_write32(rtwdev, REG_CFG_PMPD, 0x20000000);
++	rtw_write32(rtwdev, REG_RFECTL_A, 0x0);
++}
++
++static void rtw8821a_iqk_rx_fill(struct rtw_dev *rtwdev,
++				 unsigned int rx_x, unsigned int rx_y)
++{
++	/* [31] = 0 --> Page C */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++
++	rtw_write32_mask(rtwdev, REG_RX_IQC_AB_A,
++			 0x000003ff, rx_x >> 1);
++	rtw_write32_mask(rtwdev, REG_RX_IQC_AB_A,
++			 0x03ff0000, (rx_y >> 1) & 0x3ff);
++}
++
++static void rtw8821a_iqk_tx_fill(struct rtw_dev *rtwdev,
++				 unsigned int tx_x, unsigned int tx_y)
++{
++	/* [31] = 1 --> Page C1 */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x1);
++
++	rtw_write32(rtwdev, REG_LSSI_WRITE_A, 0x00000080);
++	rtw_write32(rtwdev, REG_IQK_DPD_CFG, 0x20040000);
++	rtw_write32(rtwdev, REG_CFG_PMPD, 0x20000000);
++	rtw_write32_mask(rtwdev, REG_IQC_Y, 0x000007ff, tx_y);
++	rtw_write32_mask(rtwdev, REG_IQC_X, 0x000007ff, tx_x);
++}
++
++static void rtw8821a_iqk_tx_vdf_true(struct rtw_dev *rtwdev, u32 cal,
++				     bool *tx0iqkok,
++				     int tx_x0[CAL_NUM_8821A],
++				     int tx_y0[CAL_NUM_8821A])
++{
++	u32 cal_retry, delay_count, iqk_ready, tx_fail;
++	int tx_dt[3], vdf_y[3], vdf_x[3];
++	int k;
++
++	for (k = 0; k < 3; k++) {
++		switch (k) {
++		case 0:
++			/* TX_Tone_idx[9:0], TxK_Mask[29] TX_Tone = 16 */
++			rtw_write32(rtwdev, REG_OFDM0_XA_TX_IQ_IMBALANCE,
++				    0x18008c38);
++			/* RX_Tone_idx[9:0], RxK_Mask[29] */
++			rtw_write32(rtwdev, REG_OFDM0_A_TX_AFE, 0x38008c38);
++			rtw_write32_mask(rtwdev, REG_INTPO_SETA, BIT(31), 0x0);
++			break;
++		case 1:
++			rtw_write32_mask(rtwdev, REG_OFDM0_XA_TX_IQ_IMBALANCE,
++					 BIT(28), 0x0);
++			rtw_write32_mask(rtwdev, REG_OFDM0_A_TX_AFE,
++					 BIT(28), 0x0);
++			rtw_write32_mask(rtwdev, REG_INTPO_SETA, BIT(31), 0x0);
++			break;
++		case 2:
++			rtw_dbg(rtwdev, RTW_DBG_RFK,
++				"vdf_y[1] = %x vdf_y[0] = %x\n",
++				vdf_y[1] >> 21 & 0x00007ff,
++				vdf_y[0] >> 21 & 0x00007ff);
++
++			rtw_dbg(rtwdev, RTW_DBG_RFK,
++				"vdf_x[1] = %x vdf_x[0] = %x\n",
++				vdf_x[1] >> 21 & 0x00007ff,
++				vdf_x[0] >> 21 & 0x00007ff);
++
++			tx_dt[cal] = (vdf_y[1] >> 20) - (vdf_y[0] >> 20);
++			tx_dt[cal] = (16 * tx_dt[cal]) * 10000 / 15708;
++			tx_dt[cal] = (tx_dt[cal] >> 1) + (tx_dt[cal] & BIT(0));
++
++			/* TX_Tone_idx[9:0], TxK_Mask[29] TX_Tone = 16 */
++			rtw_write32(rtwdev, REG_OFDM0_XA_TX_IQ_IMBALANCE,
++				    0x18008c20);
++			/* RX_Tone_idx[9:0], RxK_Mask[29] */
++			rtw_write32(rtwdev, REG_OFDM0_A_TX_AFE, 0x38008c20);
++			rtw_write32_mask(rtwdev, REG_INTPO_SETA, BIT(31), 0x1);
++			rtw_write32_mask(rtwdev, REG_INTPO_SETA, 0x3fff0000,
++					 tx_dt[cal] & 0x00003fff);
++			break;
++		}
++
++		rtw_write32(rtwdev, REG_RFECTL_A, 0x00100000);
++
++		for (cal_retry = 0; cal_retry < 10; cal_retry++) {
++			/* one shot */
++			rtw_write32(rtwdev, REG_IQK_COM64, 0xfa000000);
++			rtw_write32(rtwdev, REG_IQK_COM64, 0xf8000000);
++
++			mdelay(10);
++
++			rtw_write32(rtwdev, REG_RFECTL_A, 0x00000000);
++
++			for (delay_count = 0; delay_count < 20; delay_count++) {
++				iqk_ready = rtw_read32_mask(rtwdev,
++							    REG_IQKA_END,
++							    BIT(10));
++
++				/* Originally: if (~iqk_ready || delay_count > 20)
++				 * that looks like a typo so make it more explicit
++				 */
++				iqk_ready = true;
++
++				if (iqk_ready)
++					break;
++
++				mdelay(1);
++			}
++
++			if (delay_count < 20) {
++				/* ============TXIQK Check============== */
++				tx_fail = rtw_read32_mask(rtwdev,
++							  REG_IQKA_END,
++							  BIT(12));
++
++				/* Originally: if (~tx_fail) {
++				 * It looks like a typo, so make it more explicit.
++				 */
++				tx_fail = false;
++
++				if (!tx_fail) {
++					rtw_write32(rtwdev, REG_RFECTL_A,
++						    0x02000000);
++					vdf_x[k] = rtw_read32_mask(rtwdev,
++								   REG_IQKA_END,
++								   0x07ff0000);
++					vdf_x[k] <<= 21;
++
++					rtw_write32(rtwdev, REG_RFECTL_A,
++						    0x04000000);
++					vdf_y[k] = rtw_read32_mask(rtwdev,
++								   REG_IQKA_END,
++								   0x07ff0000);
++					vdf_y[k] <<= 21;
++
++					*tx0iqkok = true;
++					break;
++				}
++
++				rtw_write32_mask(rtwdev, REG_IQC_Y,
++						 0x000007ff, 0x0);
++				rtw_write32_mask(rtwdev, REG_IQC_X,
++						 0x000007ff, 0x200);
++			}
++
++			*tx0iqkok = false;
++		}
++	}
++
++	if (k == 3) {
++		tx_x0[cal] = vdf_x[k - 1];
++		tx_y0[cal] = vdf_y[k - 1];
++	}
++}
++
++static void rtw8821a_iqk_tx_vdf_false(struct rtw_dev *rtwdev, u32 cal,
++				      bool *tx0iqkok,
++				      int tx_x0[CAL_NUM_8821A],
++				      int tx_y0[CAL_NUM_8821A])
++{
++	u32 cal_retry, delay_count, iqk_ready, tx_fail;
++
++	/* TX_Tone_idx[9:0], TxK_Mask[29] TX_Tone = 16 */
++	rtw_write32(rtwdev, REG_OFDM0_XA_TX_IQ_IMBALANCE, 0x18008c10);
++	/* RX_Tone_idx[9:0], RxK_Mask[29] */
++	rtw_write32(rtwdev, REG_OFDM0_A_TX_AFE, 0x38008c10);
++	rtw_write32(rtwdev, REG_RFECTL_A, 0x00100000);
++
++	for (cal_retry = 0; cal_retry < 10; cal_retry++) {
++		/* one shot */
++		rtw_write32(rtwdev, REG_IQK_COM64, 0xfa000000);
++		rtw_write32(rtwdev, REG_IQK_COM64, 0xf8000000);
++
++		mdelay(10);
++		rtw_write32(rtwdev, REG_RFECTL_A, 0x00000000);
++
++		for (delay_count = 0; delay_count < 20; delay_count++) {
++			iqk_ready = rtw_read32_mask(rtwdev, REG_IQKA_END, BIT(10));
++
++			/* Originally: if (~iqk_ready || delay_count > 20)
++			 * that looks like a typo so make it more explicit
++			 */
++			iqk_ready = true;
++
++			if (iqk_ready)
++				break;
++
++			mdelay(1);
++		}
++
++		if (delay_count < 20) {
++			/* ============TXIQK Check============== */
++			tx_fail = rtw_read32_mask(rtwdev, REG_IQKA_END, BIT(12));
++
++			/* Originally: if (~tx_fail) {
++			 * It looks like a typo, so make it more explicit.
++			 */
++			tx_fail = false;
++
++			if (!tx_fail) {
++				rtw_write32(rtwdev, REG_RFECTL_A, 0x02000000);
++				tx_x0[cal] = rtw_read32_mask(rtwdev, REG_IQKA_END,
++							     0x07ff0000);
++				tx_x0[cal] <<= 21;
++
++				rtw_write32(rtwdev, REG_RFECTL_A, 0x04000000);
++				tx_y0[cal] = rtw_read32_mask(rtwdev, REG_IQKA_END,
++							     0x07ff0000);
++				tx_y0[cal] <<= 21;
++
++				*tx0iqkok = true;
++				break;
++			}
++
++			rtw_write32_mask(rtwdev, REG_IQC_Y, 0x000007ff, 0x0);
++			rtw_write32_mask(rtwdev, REG_IQC_X, 0x000007ff, 0x200);
++		}
++
++		*tx0iqkok = false;
++	}
++}
++
++static void rtw8821a_iqk_rx(struct rtw_dev *rtwdev, u32 cal, bool *rx0iqkok,
++			    int rx_x0[CAL_NUM_8821A],
++			    int rx_y0[CAL_NUM_8821A])
++{
++	u32 cal_retry, delay_count, iqk_ready, rx_fail;
++
++	rtw_write32(rtwdev, REG_RFECTL_A, 0x00100000);
++
++	for (cal_retry = 0; cal_retry < 10; cal_retry++) {
++		/* one shot */
++		rtw_write32(rtwdev, REG_IQK_COM64, 0xfa000000);
++		rtw_write32(rtwdev, REG_IQK_COM64, 0xf8000000);
++
++		mdelay(10);
++
++		rtw_write32(rtwdev, REG_RFECTL_A, 0x00000000);
++
++		for (delay_count = 0; delay_count < 20; delay_count++) {
++			iqk_ready = rtw_read32_mask(rtwdev, REG_IQKA_END, BIT(10));
++
++			/* Originally: if (~iqk_ready || delay_count > 20)
++			 * that looks like a typo so make it more explicit
++			 */
++			iqk_ready = true;
++
++			if (iqk_ready)
++				break;
++
++			mdelay(1);
++		}
++
++		if (delay_count < 20) {
++			/* ============RXIQK Check============== */
++			rx_fail = rtw_read32_mask(rtwdev, REG_IQKA_END, BIT(11));
++			if (!rx_fail) {
++				rtw_write32(rtwdev, REG_RFECTL_A, 0x06000000);
++				rx_x0[cal] = rtw_read32_mask(rtwdev, REG_IQKA_END,
++							     0x07ff0000);
++				rx_x0[cal] <<= 21;
++
++				rtw_write32(rtwdev, REG_RFECTL_A, 0x08000000);
++				rx_y0[cal] = rtw_read32_mask(rtwdev, REG_IQKA_END,
++							     0x07ff0000);
++				rx_y0[cal] <<= 21;
++
++				*rx0iqkok = true;
++				break;
++			}
++
++			rtw_write32_mask(rtwdev, REG_RX_IQC_AB_A,
++					 0x000003ff, 0x200 >> 1);
++			rtw_write32_mask(rtwdev, REG_RX_IQC_AB_A,
++					 0x03ff0000, 0x0 >> 1);
++		}
++
++		*rx0iqkok = false;
++	}
++}
++
++static void rtw8821a_iqk(struct rtw_dev *rtwdev)
++{
++	int tx_average = 0, rx_average = 0, rx_iqk_loop = 0;
++	const struct rtw_efuse *efuse = &rtwdev->efuse;
++	int tx_x = 0, tx_y = 0, rx_x = 0, rx_y = 0;
++	const struct rtw_hal *hal = &rtwdev->hal;
++	bool tx0iqkok = false, rx0iqkok = false;
++	int rx_x_temp = 0, rx_y_temp = 0;
++	int rx_x0[2][CAL_NUM_8821A];
++	int rx_y0[2][CAL_NUM_8821A];
++	int tx_x0[CAL_NUM_8821A];
++	int tx_y0[CAL_NUM_8821A];
++	bool rx_finish1 = false;
++	bool rx_finish2 = false;
++	bool vdf_enable;
++	u32 cal;
++	int i;
++
++	rtw_dbg(rtwdev, RTW_DBG_RFK,
++		"band_width = %d, ext_pa = %d, ext_pa_5g = %d\n",
++		hal->current_band_width, efuse->ext_pa_2g, efuse->ext_pa_5g);
++
++	vdf_enable = hal->current_band_width == RTW_CHANNEL_WIDTH_80;
++
++	for (cal = 0; cal < CAL_NUM_8821A; cal++) {
++		/* path-A LOK */
++
++		/* [31] = 0 --> Page C */
++		rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++
++		/* ========path-A AFE all on======== */
++		/* Port 0 DAC/ADC on */
++		rtw_write32(rtwdev, REG_AFE_PWR1_A, 0x77777777);
++		rtw_write32(rtwdev, REG_AFE_PWR2_A, 0x77777777);
++
++		rtw_write32(rtwdev, REG_RX_WAIT_CCA_TX_CCK_RFON_A, 0x19791979);
++
++		/* hardware 3-wire off */
++		rtw_write32_mask(rtwdev, REG_3WIRE_SWA, 0xf, 0x4);
++
++		/* LOK setting */
++
++		/* 1. DAC/ADC sampling rate (160 MHz) */
++		rtw_write32_mask(rtwdev, REG_CK_MONHA, GENMASK(26, 24), 0x7);
++
++		/* 2. LoK RF setting (at BW = 20M) */
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_LUTWE, RFREG_MASK, 0x80002);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_CFGCH, 0x00c00, 0x3);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_MODE_TABLE_ADDR, RFREG_MASK,
++			     0x20000);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_MODE_TABLE_DATA0, RFREG_MASK,
++			     0x0003f);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_MODE_TABLE_DATA1, RFREG_MASK,
++			     0xf3fc3);
++
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_TXA_PREPAD, RFREG_MASK,
++			     0x931d5);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_RXBB2, RFREG_MASK, 0x8a001);
++		rtw_write32(rtwdev, REG_DAC_RSTB, 0x00008000);
++		rtw_write32_mask(rtwdev, REG_TXAGCIDX, BIT(0), 0x1);
++		/* TX (X,Y) */
++		rtw_write32(rtwdev, REG_IQK_COM00, 0x29002000);
++		/* RX (X,Y) */
++		rtw_write32(rtwdev, REG_IQK_COM32, 0xa9002000);
++		/* [0]:AGC_en, [15]:idac_K_Mask */
++		rtw_write32(rtwdev, REG_IQK_COM96, 0x00462910);
++
++		/* [31] = 1 --> Page C1 */
++		rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x1);
++
++		if (efuse->ext_pa_5g)
++			rtw_write32(rtwdev, REG_OFDM0_XB_TX_IQ_IMBALANCE,
++				    0x821403f7);
++		else
++			rtw_write32(rtwdev, REG_OFDM0_XB_TX_IQ_IMBALANCE,
++				    0x821403f4);
++
++		if (hal->current_band_type == RTW_BAND_5G)
++			rtw_write32(rtwdev, REG_TSSI_TRK_SW, 0x68163e96);
++		else
++			rtw_write32(rtwdev, REG_TSSI_TRK_SW, 0x28163e96);
++
++		/* TX_Tone_idx[9:0], TxK_Mask[29] TX_Tone = 16 */
++		rtw_write32(rtwdev, REG_OFDM0_XA_TX_IQ_IMBALANCE, 0x18008c10);
++		/* RX_Tone_idx[9:0], RxK_Mask[29] */
++		rtw_write32(rtwdev, REG_OFDM0_A_TX_AFE, 0x38008c10);
++		rtw_write32(rtwdev, REG_RFECTL_A, 0x00100000);
++		rtw_write32(rtwdev, REG_IQK_COM64, 0xfa000000);
++		rtw_write32(rtwdev, REG_IQK_COM64, 0xf8000000);
++
++		mdelay(10);
++		rtw_write32(rtwdev, REG_RFECTL_A, 0x00000000);
++
++		/* [31] = 0 --> Page C */
++		rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_TXMOD, 0x7fe00,
++			     rtw_read_rf(rtwdev, RF_PATH_A, RF_DTXLOK, 0xffc00));
++
++		if (hal->current_band_width == RTW_CHANNEL_WIDTH_40)
++			rtw_write_rf(rtwdev, RF_PATH_A, RF_CFGCH,
++				     RF18_BW_MASK, 0x1);
++		else if (hal->current_band_width == RTW_CHANNEL_WIDTH_80)
++			rtw_write_rf(rtwdev, RF_PATH_A, RF_CFGCH,
++				     RF18_BW_MASK, 0x0);
++
++		/* [31] = 1 --> Page C1 */
++		rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x1);
++
++		/* 3. TX RF setting */
++		/* [31] = 0 --> Page C */
++		rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_LUTWE, RFREG_MASK, 0x80000);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_MODE_TABLE_ADDR, RFREG_MASK,
++			     0x20000);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_MODE_TABLE_DATA0, RFREG_MASK,
++			     0x0003f);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_MODE_TABLE_DATA1, RFREG_MASK,
++			     0xf3fc3);
++
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_TXA_PREPAD, RFREG_MASK, 0x931d5);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_RXBB2, RFREG_MASK, 0x8a001);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_LUTWE, RFREG_MASK, 0x00000);
++		rtw_write32(rtwdev, REG_DAC_RSTB, 0x00008000);
++		rtw_write32_mask(rtwdev, REG_TXAGCIDX, BIT(0), 0x1);
++		/* TX (X,Y) */
++		rtw_write32(rtwdev, REG_IQK_COM00, 0x29002000);
++		/* RX (X,Y) */
++		rtw_write32(rtwdev, REG_IQK_COM32, 0xa9002000);
++		/* [0]:AGC_en, [15]:idac_K_Mask */
++		rtw_write32(rtwdev, REG_IQK_COM96, 0x0046a910);
++
++		/* [31] = 1 --> Page C1 */
++		rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x1);
++
++		if (efuse->ext_pa_5g)
++			rtw_write32(rtwdev, REG_OFDM0_XB_TX_IQ_IMBALANCE,
++				    0x821403f7);
++		else
++			rtw_write32(rtwdev, REG_OFDM0_XB_TX_IQ_IMBALANCE,
++				    0x821403e3);
++
++		if (hal->current_band_type == RTW_BAND_5G)
++			rtw_write32(rtwdev, REG_TSSI_TRK_SW, 0x40163e96);
++		else
++			rtw_write32(rtwdev, REG_TSSI_TRK_SW, 0x00163e96);
++
++		if (vdf_enable)
++			rtw8821a_iqk_tx_vdf_true(rtwdev, cal, &tx0iqkok,
++						 tx_x0, tx_y0);
++		else
++			rtw8821a_iqk_tx_vdf_false(rtwdev, cal, &tx0iqkok,
++						  tx_x0, tx_y0);
++
++		if (!tx0iqkok)
++			break; /* TXK fail, Don't do RXK */
++
++		/* ====== RX IQK ====== */
++		/* [31] = 0 --> Page C */
++		rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++		/* 1. RX RF setting */
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_LUTWE, RFREG_MASK, 0x80000);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_MODE_TABLE_ADDR, RFREG_MASK,
++			     0x30000);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_MODE_TABLE_DATA0, RFREG_MASK,
++			     0x0002f);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_MODE_TABLE_DATA1, RFREG_MASK,
++			     0xfffbb);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_RXBB2, RFREG_MASK, 0x88001);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_TXA_PREPAD, RFREG_MASK, 0x931d8);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_LUTWE, RFREG_MASK, 0x00000);
++
++		rtw_write32_mask(rtwdev, REG_IQK_COM00, 0x03FF8000,
++				 (tx_x0[cal] >> 21) & 0x000007ff);
++		rtw_write32_mask(rtwdev, REG_IQK_COM00, 0x000007FF,
++				 (tx_y0[cal] >> 21) & 0x000007ff);
++		rtw_write32_mask(rtwdev, REG_IQK_COM00, BIT(31), 0x1);
++		rtw_write32_mask(rtwdev, REG_IQK_COM00, BIT(31), 0x0);
++		rtw_write32(rtwdev, REG_DAC_RSTB, 0x00008000);
++		rtw_write32(rtwdev, REG_IQK_COM96, 0x0046a911);
++
++		/* [31] = 1 --> Page C1 */
++		rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x1);
++
++		/* TX_Tone_idx[9:0], TxK_Mask[29] TX_Tone = 16 */
++		rtw_write32(rtwdev, REG_OFDM0_XA_TX_IQ_IMBALANCE, 0x38008c10);
++		/* RX_Tone_idx[9:0], RxK_Mask[29] */
++		rtw_write32(rtwdev, REG_OFDM0_A_TX_AFE, 0x18008c10);
++		rtw_write32(rtwdev, REG_OFDM0_XB_TX_IQ_IMBALANCE, 0x02140119);
++
++		if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE)
++			rx_iqk_loop = 2; /* for 2% fail; */
++		else
++			rx_iqk_loop = 1;
++
++		for (i = 0; i < rx_iqk_loop; i++) {
++			if (rtw_hci_type(rtwdev) == RTW_HCI_TYPE_PCIE && i == 0)
++				rtw_write32(rtwdev, REG_TSSI_TRK_SW, 0x28161100); /* Good */
++			else
++				rtw_write32(rtwdev, REG_TSSI_TRK_SW, 0x28160d00);
++
++			rtw8821a_iqk_rx(rtwdev, cal, &rx0iqkok,
++					rx_x0[i], rx_y0[i]);
++		}
++
++		if (tx0iqkok)
++			tx_average++;
++		if (rx0iqkok)
++			rx_average++;
++	}
++
++	/* FillIQK Result */
++
++	if (tx_average == 0)
++		return;
++
++	for (i = 0; i < tx_average; i++)
++		rtw_dbg(rtwdev, RTW_DBG_RFK,
++			"tx_x0[%d] = %x ;; tx_y0[%d] = %x\n",
++			i, (tx_x0[i] >> 21) & 0x000007ff,
++			i, (tx_y0[i] >> 21) & 0x000007ff);
++
++	if (rtw88xxa_iqk_finish(tx_average, 3, tx_x0, tx_y0,
++				&tx_x, &tx_y, true, true))
++		rtw8821a_iqk_tx_fill(rtwdev, tx_x, tx_y);
++	else
++		rtw8821a_iqk_tx_fill(rtwdev, 0x200, 0x0);
++
++	if (rx_average == 0)
++		return;
++
++	for (i = 0; i < rx_average; i++) {
++		rtw_dbg(rtwdev, RTW_DBG_RFK,
++			"rx_x0[0][%d] = %x ;; rx_y0[0][%d] = %x\n",
++			i, (rx_x0[0][i] >> 21) & 0x000007ff,
++			i, (rx_y0[0][i] >> 21) & 0x000007ff);
++
++		if (rx_iqk_loop == 2)
++			rtw_dbg(rtwdev, RTW_DBG_RFK,
++				"rx_x0[1][%d] = %x ;; rx_y0[1][%d] = %x\n",
++				i, (rx_x0[1][i] >> 21) & 0x000007ff,
++				i, (rx_y0[1][i] >> 21) & 0x000007ff);
++	}
++
++	rx_finish1 = rtw88xxa_iqk_finish(rx_average, 4, rx_x0[0], rx_y0[0],
++					 &rx_x_temp, &rx_y_temp, true, true);
++
++	if (rx_finish1) {
++		rx_x = rx_x_temp;
++		rx_y = rx_y_temp;
++	}
++
++	if (rx_iqk_loop == 2) {
++		rx_finish2 = rtw88xxa_iqk_finish(rx_average, 4,
++						 rx_x0[1], rx_y0[1],
++						 &rx_x, &rx_y, true, true);
++
++		if (rx_finish1 && rx_finish2) {
++			rx_x = (rx_x + rx_x_temp) / 2;
++			rx_y = (rx_y + rx_y_temp) / 2;
++		}
++	}
++
++	if (rx_finish1 || rx_finish2)
++		rtw8821a_iqk_rx_fill(rtwdev, rx_x, rx_y);
++	else
++		rtw8821a_iqk_rx_fill(rtwdev, 0x200, 0x0);
++}
++
++static void rtw8821a_do_iqk(struct rtw_dev *rtwdev)
++{
++	static const u32 backup_macbb_reg[MACBB_REG_NUM_8821A] = {
++		0x520, 0x550, 0x808, 0xa04, 0x90c, 0xc00, 0x838, 0x82c
++	};
++	static const u32 backup_afe_reg[AFE_REG_NUM_8821A] = {
++		0xc5c, 0xc60, 0xc64, 0xc68
++	};
++	static const u32 backup_rf_reg[RF_REG_NUM_8821A] = {
++		0x65, 0x8f, 0x0
++	};
++	u32 macbb_backup[MACBB_REG_NUM_8821A];
++	u32 afe_backup[AFE_REG_NUM_8821A];
++	u32 rfa_backup[RF_REG_NUM_8821A];
++
++	rtw88xxa_iqk_backup_mac_bb(rtwdev, macbb_backup,
++				   backup_macbb_reg, MACBB_REG_NUM_8821A);
++	rtw88xxa_iqk_backup_afe(rtwdev, afe_backup,
++				backup_afe_reg, AFE_REG_NUM_8821A);
++	rtw8821a_iqk_backup_rf(rtwdev, rfa_backup,
++			       backup_rf_reg, RF_REG_NUM_8821A);
++
++	rtw88xxa_iqk_configure_mac(rtwdev);
++
++	rtw8821a_iqk(rtwdev);
++
++	rtw8821a_iqk_restore_rf(rtwdev, backup_rf_reg,
++				rfa_backup, RF_REG_NUM_8821A);
++	rtw8821a_iqk_restore_afe(rtwdev, afe_backup,
++				 backup_afe_reg, AFE_REG_NUM_8821A);
++	rtw88xxa_iqk_restore_mac_bb(rtwdev, macbb_backup,
++				    backup_macbb_reg, MACBB_REG_NUM_8821A);
++}
++
++static void rtw8821a_phy_calibration(struct rtw_dev *rtwdev)
++{
++	rtw8821a_do_iqk(rtwdev);
++}
++
++static void rtw8821a_pwr_track(struct rtw_dev *rtwdev)
++{
++	struct rtw_dm_info *dm_info = &rtwdev->dm_info;
++
++	if (!dm_info->pwr_trk_triggered) {
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_T_METER,
++			     GENMASK(17, 16), 0x03);
++		dm_info->pwr_trk_triggered = true;
++		return;
++	}
++
++	rtw88xxa_phy_pwrtrack(rtwdev, NULL, rtw8821a_do_iqk);
++	dm_info->pwr_trk_triggered = false;
++}
++
++static void rtw8821a_fill_txdesc_checksum(struct rtw_dev *rtwdev,
++					  struct rtw_tx_pkt_info *pkt_info,
++					  u8 *txdesc)
++{
++	fill_txdesc_checksum_common(txdesc, 16);
++}
++
++static void rtw8821a_coex_cfg_init(struct rtw_dev *rtwdev)
++{
++	u8 val8;
++
++	/* BT report packet sample rate */
++	rtw_write8_mask(rtwdev, REG_BT_TDMA_TIME, BIT_MASK_SAMPLE_RATE, 0x5);
++
++	val8 = BIT_STATIS_BT_EN;
++	if (rtwdev->efuse.share_ant)
++		val8 |= BIT_R_GRANTALL_WLMASK;
++	rtw_write8(rtwdev, REG_BT_COEX_ENH_INTR_CTRL, val8);
++
++	/* enable BT counter statistics */
++	rtw_write8(rtwdev, REG_BT_STAT_CTRL, 0x3);
++
++	/* enable PTA */
++	rtw_write32_set(rtwdev, REG_GPIO_MUXCFG, BIT_BT_PTA_EN);
++}
++
++static void rtw8821a_coex_cfg_ant_switch(struct rtw_dev *rtwdev, u8 ctrl_type,
++					 u8 pos_type)
++{
++	bool share_ant = rtwdev->efuse.share_ant;
++	struct rtw_coex *coex = &rtwdev->coex;
++	struct rtw_coex_dm *coex_dm = &coex->dm;
++	u32 phase = coex_dm->cur_ant_pos_type;
++
++	if (!rtwdev->efuse.btcoex)
++		return;
++
++	switch (phase) {
++	case COEX_SET_ANT_POWERON:
++	case COEX_SET_ANT_INIT:
++		rtw_write32_clr(rtwdev, REG_LED_CFG, BIT_DPDT_SEL_EN);
++		rtw_write32_set(rtwdev, REG_LED_CFG, BIT_DPDT_WL_SEL);
++		rtw_write8_set(rtwdev, REG_GNT_BT, BIT_PTA_SW_CTL);
++
++		rtw_write8(rtwdev, REG_RFE_CTRL8,
++			   share_ant ? PTA_CTRL_PIN : DPDT_CTRL_PIN);
++		rtw_write32_mask(rtwdev, REG_RFE_CTRL8, 0x30000000, 0x1);
++		break;
++	case COEX_SET_ANT_WONLY:
++		rtw_write32_clr(rtwdev, REG_LED_CFG, BIT_DPDT_SEL_EN);
++		rtw_write32_set(rtwdev, REG_LED_CFG, BIT_DPDT_WL_SEL);
++		rtw_write8_clr(rtwdev, REG_GNT_BT, BIT_PTA_SW_CTL);
++
++		rtw_write8(rtwdev, REG_RFE_CTRL8, DPDT_CTRL_PIN);
++		rtw_write32_mask(rtwdev, REG_RFE_CTRL8, 0x30000000, 0x1);
++		break;
++	case COEX_SET_ANT_2G:
++		rtw_write32_clr(rtwdev, REG_LED_CFG, BIT_DPDT_SEL_EN);
++		rtw_write32_set(rtwdev, REG_LED_CFG, BIT_DPDT_WL_SEL);
++		rtw_write8_clr(rtwdev, REG_GNT_BT, BIT_PTA_SW_CTL);
++
++		rtw_write8(rtwdev, REG_RFE_CTRL8,
++			   share_ant ? PTA_CTRL_PIN : DPDT_CTRL_PIN);
++		rtw_write32_mask(rtwdev, REG_RFE_CTRL8, 0x30000000, 0x1);
++		break;
++	case COEX_SET_ANT_5G:
++		rtw_write32_clr(rtwdev, REG_LED_CFG, BIT_DPDT_SEL_EN);
++		rtw_write32_set(rtwdev, REG_LED_CFG, BIT_DPDT_WL_SEL);
++		rtw_write8_set(rtwdev, REG_GNT_BT, BIT_PTA_SW_CTL);
++
++		rtw_write8(rtwdev, REG_RFE_CTRL8, DPDT_CTRL_PIN);
++		rtw_write32_mask(rtwdev, REG_RFE_CTRL8, 0x30000000,
++				 share_ant ? 0x2 : 0x1);
++		break;
++	case COEX_SET_ANT_WOFF:
++		rtw_write32_clr(rtwdev, REG_LED_CFG, BIT_DPDT_SEL_EN);
++		rtw_write32_clr(rtwdev, REG_LED_CFG, BIT_DPDT_WL_SEL);
++		rtw_write8_set(rtwdev, REG_GNT_BT, BIT_PTA_SW_CTL);
++
++		rtw_write8(rtwdev, REG_RFE_CTRL8, DPDT_CTRL_PIN);
++		rtw_write32_mask(rtwdev, REG_RFE_CTRL8, 0x30000000,
++				 share_ant ? 0x2 : 0x1);
++		break;
++	default:
++		rtw_warn(rtwdev, "%s: not handling phase %d\n",
++			 __func__, phase);
++		break;
++	}
++}
++
++static void rtw8821a_coex_cfg_gnt_fix(struct rtw_dev *rtwdev)
++{
++}
++
++static void rtw8821a_coex_cfg_gnt_debug(struct rtw_dev *rtwdev)
++{
++}
++
++static void rtw8821a_coex_cfg_rfe_type(struct rtw_dev *rtwdev)
++{
++	struct rtw_coex *coex = &rtwdev->coex;
++	struct rtw_coex_rfe *coex_rfe = &coex->rfe;
++
++	coex_rfe->ant_switch_exist = true;
++}
++
++static void rtw8821a_coex_cfg_wl_tx_power(struct rtw_dev *rtwdev, u8 wl_pwr)
++{
++	struct rtw_coex *coex = &rtwdev->coex;
++	struct rtw_coex_dm *coex_dm = &coex->dm;
++	struct rtw_efuse *efuse = &rtwdev->efuse;
++	bool share_ant = efuse->share_ant;
++
++	if (share_ant)
++		return;
++
++	if (wl_pwr == coex_dm->cur_wl_pwr_lvl)
++		return;
++
++	coex_dm->cur_wl_pwr_lvl = wl_pwr;
++}
++
++static void rtw8821a_coex_cfg_wl_rx_gain(struct rtw_dev *rtwdev, bool low_gain)
++{
++}
++
++static const struct rtw_chip_ops rtw8821a_ops = {
++	.power_on		= rtw88xxa_power_on,
++	.power_off		= rtw8821a_power_off,
++	.phy_set_param		= NULL,
++	.read_efuse		= rtw88xxa_read_efuse,
++	.query_phy_status	= rtw8821a_query_phy_status,
++	.set_channel		= rtw88xxa_set_channel,
++	.mac_init		= NULL,
++	.read_rf		= rtw88xxa_phy_read_rf,
++	.write_rf		= rtw_phy_write_rf_reg_sipi,
++	.set_antenna		= NULL,
++	.set_tx_power_index	= rtw88xxa_set_tx_power_index,
++	.cfg_ldo25		= rtw8821a_cfg_ldo25,
++	.efuse_grant		= rtw88xxa_efuse_grant,
++	.false_alarm_statistics	= rtw88xxa_false_alarm_statistics,
++	.phy_calibration	= rtw8821a_phy_calibration,
++	.cck_pd_set		= rtw88xxa_phy_cck_pd_set,
++	.pwr_track		= rtw8821a_pwr_track,
++	.config_bfee		= NULL,
++	.set_gid_table		= NULL,
++	.cfg_csi_rate		= NULL,
++	.fill_txdesc_checksum	= rtw8821a_fill_txdesc_checksum,
++	.coex_set_init		= rtw8821a_coex_cfg_init,
++	.coex_set_ant_switch	= rtw8821a_coex_cfg_ant_switch,
++	.coex_set_gnt_fix	= rtw8821a_coex_cfg_gnt_fix,
++	.coex_set_gnt_debug	= rtw8821a_coex_cfg_gnt_debug,
++	.coex_set_rfe_type	= rtw8821a_coex_cfg_rfe_type,
++	.coex_set_wl_tx_power	= rtw8821a_coex_cfg_wl_tx_power,
++	.coex_set_wl_rx_gain	= rtw8821a_coex_cfg_wl_rx_gain,
++};
++
++static const struct rtw_page_table page_table_8821a[] = {
++	/* hq_num, nq_num, lq_num, exq_num, gapq_num */
++	{0, 0, 0, 0, 0},	/* SDIO */
++	{0, 0, 0, 0, 0},	/* PCI */
++	{8, 0, 0, 0, 1},	/* 2 bulk out endpoints */
++	{8, 0, 8, 0, 1},	/* 3 bulk out endpoints */
++	{8, 0, 8, 4, 1},	/* 4 bulk out endpoints */
++};
++
++static const struct rtw_rqpn rqpn_table_8821a[] = {
++	{RTW_DMA_MAPPING_NORMAL, RTW_DMA_MAPPING_NORMAL,
++	 RTW_DMA_MAPPING_LOW, RTW_DMA_MAPPING_LOW,
++	 RTW_DMA_MAPPING_EXTRA, RTW_DMA_MAPPING_HIGH},
++
++	{RTW_DMA_MAPPING_NORMAL, RTW_DMA_MAPPING_NORMAL,
++	 RTW_DMA_MAPPING_LOW, RTW_DMA_MAPPING_LOW,
++	 RTW_DMA_MAPPING_EXTRA, RTW_DMA_MAPPING_HIGH},
++
++	{RTW_DMA_MAPPING_HIGH, RTW_DMA_MAPPING_HIGH,
++	 RTW_DMA_MAPPING_NORMAL, RTW_DMA_MAPPING_NORMAL,
++	 RTW_DMA_MAPPING_HIGH, RTW_DMA_MAPPING_HIGH},
++
++	{RTW_DMA_MAPPING_HIGH, RTW_DMA_MAPPING_NORMAL,
++	 RTW_DMA_MAPPING_LOW, RTW_DMA_MAPPING_LOW,
++	 RTW_DMA_MAPPING_HIGH, RTW_DMA_MAPPING_HIGH},
++
++	{RTW_DMA_MAPPING_NORMAL, RTW_DMA_MAPPING_NORMAL,
++	 RTW_DMA_MAPPING_LOW, RTW_DMA_MAPPING_LOW,
++	 RTW_DMA_MAPPING_EXTRA, RTW_DMA_MAPPING_HIGH},
++};
++
++static const struct rtw_prioq_addrs prioq_addrs_8821a = {
++	.prio[RTW_DMA_MAPPING_EXTRA] = {
++		.rsvd = REG_RQPN_NPQ + 2, .avail = REG_RQPN_NPQ + 3,
++	},
++	.prio[RTW_DMA_MAPPING_LOW] = {
++		.rsvd = REG_RQPN + 1, .avail = REG_FIFOPAGE_CTRL_2 + 1,
++	},
++	.prio[RTW_DMA_MAPPING_NORMAL] = {
++		.rsvd = REG_RQPN_NPQ, .avail = REG_RQPN_NPQ + 1,
++	},
++	.prio[RTW_DMA_MAPPING_HIGH] = {
++		.rsvd = REG_RQPN, .avail = REG_FIFOPAGE_CTRL_2,
++	},
++	.wsize = false,
++};
++
++static const struct rtw_hw_reg rtw8821a_dig[] = {
++	[0] = { .addr = REG_RXIGI_A, .mask = 0x7f },
++};
++
++static const struct rtw_rfe_def rtw8821a_rfe_defs[] = {
++	[0] = { .phy_pg_tbl	= &rtw8821a_bb_pg_tbl,
++		.txpwr_lmt_tbl	= &rtw8821a_txpwr_lmt_tbl,
++		.pwr_track_tbl	= &rtw8821a_rtw_pwr_track_tbl, },
++};
++
++/* TODO */
++/* rssi in percentage % (dbm = % - 100) */
++static const u8 wl_rssi_step_8821a[] = {101, 45, 101, 40};
++static const u8 bt_rssi_step_8821a[] = {101, 101, 101, 101};
++
++/* table_sant_8821a, table_nsant_8821a, tdma_sant_8821a, and tdma_nsant_8821a
++ * are copied from rtw8821c.c because the 8821au driver's tables are not
++ * compatible with the coex code in rtw88.
++ *
++ * tdma case 112 (A2DP) byte 0 had to be modified from 0x61 to 0x51,
++ * otherwise the firmware gets confused after pausing the music:
++ * rtw_8821au 1-2:1.2: [BTCoex], Bt_info[1], len=7, data=[81 00 0a 01 00 00]
++ * - 81 means PAN (personal area network) when it should be 4x (A2DP)
++ * The music is not smooth with the PAN algorithm.
++ */
++
++/* Shared-Antenna Coex Table */
++static const struct coex_table_para table_sant_8821a[] = {
++	{0x55555555, 0x55555555}, /* case-0 */
++	{0x55555555, 0x55555555},
++	{0x66555555, 0x66555555},
++	{0xaaaaaaaa, 0xaaaaaaaa},
++	{0x5a5a5a5a, 0x5a5a5a5a},
++	{0xfafafafa, 0xfafafafa}, /* case-5 */
++	{0x6a5a5555, 0xaaaaaaaa},
++	{0x6a5a56aa, 0x6a5a56aa},
++	{0x6a5a5a5a, 0x6a5a5a5a},
++	{0x66555555, 0x5a5a5a5a},
++	{0x66555555, 0x6a5a5a5a}, /* case-10 */
++	{0x66555555, 0xaaaaaaaa},
++	{0x66555555, 0x6a5a5aaa},
++	{0x66555555, 0x6aaa6aaa},
++	{0x66555555, 0x6a5a5aaa},
++	{0x66555555, 0xaaaaaaaa}, /* case-15 */
++	{0xffff55ff, 0xfafafafa},
++	{0xffff55ff, 0x6afa5afa},
++	{0xaaffffaa, 0xfafafafa},
++	{0xaa5555aa, 0x5a5a5a5a},
++	{0xaa5555aa, 0x6a5a5a5a}, /* case-20 */
++	{0xaa5555aa, 0xaaaaaaaa},
++	{0xffffffff, 0x55555555},
++	{0xffffffff, 0x5a5a5a5a},
++	{0xffffffff, 0x5a5a5a5a},
++	{0xffffffff, 0x5a5a5aaa}, /* case-25 */
++	{0x55555555, 0x5a5a5a5a},
++	{0x55555555, 0xaaaaaaaa},
++	{0x66555555, 0x6a5a6a5a},
++	{0x66556655, 0x66556655},
++	{0x66556aaa, 0x6a5a6aaa}, /* case-30 */
++	{0xffffffff, 0x5aaa5aaa},
++	{0x56555555, 0x5a5a5aaa}
++};
++
++/* Non-Shared-Antenna Coex Table */
++static const struct coex_table_para table_nsant_8821a[] = {
++	{0xffffffff, 0xffffffff}, /* case-100 */
++	{0xffff55ff, 0xfafafafa},
++	{0x66555555, 0x66555555},
++	{0xaaaaaaaa, 0xaaaaaaaa},
++	{0x5a5a5a5a, 0x5a5a5a5a},
++	{0xffffffff, 0xffffffff}, /* case-105 */
++	{0x5afa5afa, 0x5afa5afa},
++	{0x55555555, 0xfafafafa},
++	{0x66555555, 0xfafafafa},
++	{0x66555555, 0x5a5a5a5a},
++	{0x66555555, 0x6a5a5a5a}, /* case-110 */
++	{0x66555555, 0xaaaaaaaa},
++	{0xffff55ff, 0xfafafafa},
++	{0xffff55ff, 0x5afa5afa},
++	{0xffff55ff, 0xaaaaaaaa},
++	{0xffff55ff, 0xffff55ff}, /* case-115 */
++	{0xaaffffaa, 0x5afa5afa},
++	{0xaaffffaa, 0xaaaaaaaa},
++	{0xffffffff, 0xfafafafa},
++	{0xffff55ff, 0xfafafafa},
++	{0xffffffff, 0xaaaaaaaa}, /* case-120 */
++	{0xffff55ff, 0x5afa5afa},
++	{0xffff55ff, 0x5afa5afa},
++	{0x55ff55ff, 0x55ff55ff}
++};
++
++/* Shared-Antenna TDMA */
++static const struct coex_tdma_para tdma_sant_8821a[] = {
++	{ {0x00, 0x00, 0x00, 0x00, 0x00} }, /* case-0 */
++	{ {0x61, 0x45, 0x03, 0x11, 0x11} }, /* case-1 */
++	{ {0x61, 0x3a, 0x03, 0x11, 0x11} },
++	{ {0x61, 0x35, 0x03, 0x11, 0x11} },
++	{ {0x61, 0x20, 0x03, 0x11, 0x11} },
++	{ {0x61, 0x3a, 0x03, 0x11, 0x11} }, /* case-5 */
++	{ {0x61, 0x45, 0x03, 0x11, 0x10} },
++	{ {0x61, 0x35, 0x03, 0x11, 0x10} },
++	{ {0x61, 0x30, 0x03, 0x11, 0x10} },
++	{ {0x61, 0x20, 0x03, 0x11, 0x10} },
++	{ {0x61, 0x10, 0x03, 0x11, 0x10} }, /* case-10 */
++	{ {0x61, 0x08, 0x03, 0x11, 0x15} },
++	{ {0x61, 0x08, 0x03, 0x10, 0x14} },
++	{ {0x51, 0x08, 0x03, 0x10, 0x54} },
++	{ {0x51, 0x08, 0x03, 0x10, 0x55} },
++	{ {0x51, 0x08, 0x07, 0x10, 0x54} }, /* case-15 */
++	{ {0x51, 0x45, 0x03, 0x10, 0x50} },
++	{ {0x51, 0x3a, 0x03, 0x11, 0x50} },
++	{ {0x51, 0x30, 0x03, 0x10, 0x50} },
++	{ {0x51, 0x21, 0x03, 0x10, 0x50} },
++	{ {0x51, 0x10, 0x03, 0x10, 0x50} }, /* case-20 */
++	{ {0x51, 0x4a, 0x03, 0x10, 0x50} },
++	{ {0x51, 0x08, 0x03, 0x30, 0x54} },
++	{ {0x55, 0x08, 0x03, 0x10, 0x54} },
++	{ {0x65, 0x10, 0x03, 0x11, 0x10} },
++	{ {0x51, 0x10, 0x03, 0x10, 0x51} }, /* case-25 */
++	{ {0x51, 0x21, 0x03, 0x10, 0x50} },
++	{ {0x61, 0x08, 0x03, 0x11, 0x11} }
++};
++
++/* Non-Shared-Antenna TDMA */
++static const struct coex_tdma_para tdma_nsant_8821a[] = {
++	{ {0x00, 0x00, 0x00, 0x40, 0x00} }, /* case-100 */
++	{ {0x61, 0x45, 0x03, 0x11, 0x11} },
++	{ {0x61, 0x25, 0x03, 0x11, 0x11} },
++	{ {0x61, 0x35, 0x03, 0x11, 0x11} },
++	{ {0x61, 0x20, 0x03, 0x11, 0x11} },
++	{ {0x61, 0x10, 0x03, 0x11, 0x11} }, /* case-105 */
++	{ {0x61, 0x45, 0x03, 0x11, 0x10} },
++	{ {0x61, 0x30, 0x03, 0x11, 0x10} },
++	{ {0x61, 0x30, 0x03, 0x11, 0x10} },
++	{ {0x61, 0x20, 0x03, 0x11, 0x10} },
++	{ {0x61, 0x10, 0x03, 0x11, 0x10} }, /* case-110 */
++	{ {0x61, 0x10, 0x03, 0x11, 0x11} },
++	{ {0x51, 0x08, 0x03, 0x10, 0x14} }, /* a2dp high rssi */
++	{ {0x51, 0x08, 0x03, 0x10, 0x54} }, /* a2dp not high rssi */
++	{ {0x51, 0x08, 0x03, 0x10, 0x55} },
++	{ {0x51, 0x08, 0x07, 0x10, 0x54} }, /* case-115 */
++	{ {0x51, 0x45, 0x03, 0x10, 0x50} },
++	{ {0x51, 0x3a, 0x03, 0x10, 0x50} },
++	{ {0x51, 0x30, 0x03, 0x10, 0x50} },
++	{ {0x51, 0x21, 0x03, 0x10, 0x50} },
++	{ {0x51, 0x21, 0x03, 0x10, 0x50} }, /* case-120 */
++	{ {0x51, 0x10, 0x03, 0x10, 0x50} }
++};
++
++/* TODO */
++static const struct coex_rf_para rf_para_tx_8821a[] = {
++	{0, 0, false, 7},  /* for normal */
++	{0, 20, false, 7}, /* for WL-CPT */
++	{8, 17, true, 4},
++	{7, 18, true, 4},
++	{6, 19, true, 4},
++	{5, 20, true, 4}
++};
++
++static const struct coex_rf_para rf_para_rx_8821a[] = {
++	{0, 0, false, 7},  /* for normal */
++	{0, 20, false, 7}, /* for WL-CPT */
++	{3, 24, true, 5},
++	{2, 26, true, 5},
++	{1, 27, true, 5},
++	{0, 28, true, 5}
++};
++
++static_assert(ARRAY_SIZE(rf_para_tx_8821a) == ARRAY_SIZE(rf_para_rx_8821a));
++
++static const struct coex_5g_afh_map afh_5g_8821a[] = { {0, 0, 0} };
++
++static const struct rtw_reg_domain coex_info_hw_regs_8821a[] = {
++	{0xCB0, MASKDWORD, RTW_REG_DOMAIN_MAC32},
++	{0xCB4, MASKDWORD, RTW_REG_DOMAIN_MAC32},
++	{0xCBA, MASKBYTE0, RTW_REG_DOMAIN_MAC8},
++	{0, 0, RTW_REG_DOMAIN_NL},
++	{0x430, MASKDWORD, RTW_REG_DOMAIN_MAC32},
++	{0x434, MASKDWORD, RTW_REG_DOMAIN_MAC32},
++	{0x42a, MASKLWORD, RTW_REG_DOMAIN_MAC16},
++	{0x426, MASKBYTE0, RTW_REG_DOMAIN_MAC8},
++	{0x45e, BIT(3), RTW_REG_DOMAIN_MAC8},
++	{0x454, MASKLWORD, RTW_REG_DOMAIN_MAC16},
++	{0, 0, RTW_REG_DOMAIN_NL},
++	{0x4c, BIT(24) | BIT(23), RTW_REG_DOMAIN_MAC32},
++	{0x64, BIT(0), RTW_REG_DOMAIN_MAC8},
++	{0x4c6, BIT(4), RTW_REG_DOMAIN_MAC8},
++	{0x40, BIT(5), RTW_REG_DOMAIN_MAC8},
++	{0x1, RFREG_MASK, RTW_REG_DOMAIN_RF_A},
++	{0, 0, RTW_REG_DOMAIN_NL},
++	{0x550, MASKDWORD, RTW_REG_DOMAIN_MAC32},
++	{0x522, MASKBYTE0, RTW_REG_DOMAIN_MAC8},
++	{0x953, BIT(1), RTW_REG_DOMAIN_MAC8},
++	{0xc50,  MASKBYTE0, RTW_REG_DOMAIN_MAC8},
++	{0x60A, MASKBYTE0, RTW_REG_DOMAIN_MAC8},
++};
++
++const struct rtw_chip_info rtw8821a_hw_spec = {
++	.ops = &rtw8821a_ops,
++	.id = RTW_CHIP_TYPE_8821A,
++	.fw_name = "rtw88/rtw8821a_fw.bin",
++	.wlan_cpu = RTW_WCPU_11N,
++	.tx_pkt_desc_sz = 40,
++	.tx_buf_desc_sz = 16,
++	.rx_pkt_desc_sz = 24,
++	.rx_buf_desc_sz = 8,
++	.phy_efuse_size = 512,
++	.log_efuse_size = 512,
++	.ptct_efuse_size = 96 + 1, /* TODO or just 18? */
++	.txff_size = 65536,
++	.rxff_size = 16128,
++	.rsvd_drv_pg_num = 8,
++	.txgi_factor = 1,
++	.is_pwr_by_rate_dec = true,
++	.max_power_index = 0x3f,
++	.csi_buf_pg_num = 0,
++	.band = RTW_BAND_2G | RTW_BAND_5G,
++	.page_size = 256,
++	.dig_min = 0x20,
++	.ht_supported = true,
++	.vht_supported = true,
++	.lps_deep_mode_supported = 0,
++	.sys_func_en = 0xFD,
++	.pwr_on_seq = card_enable_flow_8821a,
++	.pwr_off_seq = card_disable_flow_8821a,
++	.page_table = page_table_8821a,
++	.rqpn_table = rqpn_table_8821a,
++	.prioq_addrs = &prioq_addrs_8821a,
++	.intf_table = NULL,
++	.dig = rtw8821a_dig,
++	.rf_sipi_addr = {REG_LSSI_WRITE_A, REG_LSSI_WRITE_B},
++	.ltecoex_addr = NULL,
++	.mac_tbl = &rtw8821a_mac_tbl,
++	.agc_tbl = &rtw8821a_agc_tbl,
++	.bb_tbl = &rtw8821a_bb_tbl,
++	.rf_tbl = {&rtw8821a_rf_a_tbl},
++	.rfe_defs = rtw8821a_rfe_defs,
++	.rfe_defs_size = ARRAY_SIZE(rtw8821a_rfe_defs),
++	.rx_ldpc = false,
++	.hw_feature_report = false,
++	.c2h_ra_report_size = 4,
++	.old_datarate_fb_limit = true,
++	.usb_tx_agg_desc_num = 6,
++	.iqk_threshold = 8,
++	.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
++	.max_scan_ie_len = IEEE80211_MAX_DATA_LEN,
++
++	.coex_para_ver = 20190509, /* glcoex_ver_date_8821a_1ant */
++	.bt_desired_ver = 0x62, /* But for 2 ant it's 0x5c */
++	.scbd_support = false,
++	.new_scbd10_def = false,
++	.ble_hid_profile_support = false,
++	.wl_mimo_ps_support = false,
++	.pstdma_type = COEX_PSTDMA_FORCE_LPSOFF,
++	.bt_rssi_type = COEX_BTRSSI_RATIO,
++	.ant_isolation = 10,
++	.rssi_tolerance = 2,
++	.wl_rssi_step = wl_rssi_step_8821a,
++	.bt_rssi_step = bt_rssi_step_8821a,
++	.table_sant_num = ARRAY_SIZE(table_sant_8821a),
++	.table_sant = table_sant_8821a,
++	.table_nsant_num = ARRAY_SIZE(table_nsant_8821a),
++	.table_nsant = table_nsant_8821a,
++	.tdma_sant_num = ARRAY_SIZE(tdma_sant_8821a),
++	.tdma_sant = tdma_sant_8821a,
++	.tdma_nsant_num = ARRAY_SIZE(tdma_nsant_8821a),
++	.tdma_nsant = tdma_nsant_8821a,
++	.wl_rf_para_num = ARRAY_SIZE(rf_para_tx_8821a),
++	.wl_rf_para_tx = rf_para_tx_8821a,
++	.wl_rf_para_rx = rf_para_rx_8821a,
++	.bt_afh_span_bw20 = 0x20,
++	.bt_afh_span_bw40 = 0x30,
++	.afh_5g_num = ARRAY_SIZE(afh_5g_8821a),
++	.afh_5g = afh_5g_8821a,
++
++	.coex_info_hw_regs_num = ARRAY_SIZE(coex_info_hw_regs_8821a),
++	.coex_info_hw_regs = coex_info_hw_regs_8821a,
++};
++EXPORT_SYMBOL(rtw8821a_hw_spec);
++
++MODULE_FIRMWARE("rtw88/rtw8821a_fw.bin");
++
++MODULE_AUTHOR("Realtek Corporation");
++MODULE_DESCRIPTION("Realtek 802.11ac wireless 8821a/8811a driver");
++MODULE_LICENSE("Dual BSD/GPL");
+--- /dev/null
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821a.h
+@@ -0,0 +1,10 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
++/* Copyright(c) 2024  Realtek Corporation
++ */
++
++#ifndef __RTW8821A_H__
++#define __RTW8821A_H__
++
++extern const struct rtw_chip_info rtw8821a_hw_spec;
++
++#endif
diff --git a/package/kernel/mac80211/patches/rtl/043-v6.13-wifi-rtw88-Add-rtw8812a.-c-h.patch b/package/kernel/mac80211/patches/rtl/043-v6.13-wifi-rtw88-Add-rtw8812a.-c-h.patch
new file mode 100644
index 00000000000000..610dca037a2367
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/043-v6.13-wifi-rtw88-Add-rtw8812a.-c-h.patch
@@ -0,0 +1,1135 @@
+From 4f8ec8927bc292b2a71cd5a253c96ce3c6b2927f Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 30 Oct 2024 20:28:49 +0200
+Subject: [PATCH] wifi: rtw88: Add rtw8812a.{c,h}
+
+These contain code specific to RTL8812AU.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/a0057683-79eb-4ab2-8f74-11a3bc58adfb@gmail.com
+---
+ drivers/net/wireless/realtek/rtw88/rtw8812a.c | 1102 +++++++++++++++++
+ drivers/net/wireless/realtek/rtw88/rtw8812a.h |   10 +
+ 2 files changed, 1112 insertions(+)
+ create mode 100644 drivers/net/wireless/realtek/rtw88/rtw8812a.c
+ create mode 100644 drivers/net/wireless/realtek/rtw88/rtw8812a.h
+
+--- /dev/null
++++ b/drivers/net/wireless/realtek/rtw88/rtw8812a.c
+@@ -0,0 +1,1102 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
++/* Copyright(c) 2024  Realtek Corporation
++ */
++
++#include "main.h"
++#include "coex.h"
++#include "phy.h"
++#include "reg.h"
++#include "rtw88xxa.h"
++#include "rtw8812a.h"
++#include "rtw8812a_table.h"
++#include "tx.h"
++
++static void rtw8812a_power_off(struct rtw_dev *rtwdev)
++{
++	rtw88xxa_power_off(rtwdev, enter_lps_flow_8812a);
++}
++
++static s8 rtw8812a_cck_rx_pwr(u8 lna_idx, u8 vga_idx)
++{
++	s8 rx_pwr_all = 0;
++
++	switch (lna_idx) {
++	case 7:
++		if (vga_idx <= 27)
++			rx_pwr_all = -94 + 2 * (27 - vga_idx);
++		else
++			rx_pwr_all = -94;
++		break;
++	case 6:
++		rx_pwr_all = -42 + 2 * (2 - vga_idx);
++		break;
++	case 5:
++		rx_pwr_all = -36 + 2 * (7 - vga_idx);
++		break;
++	case 4:
++		rx_pwr_all = -30 + 2 * (7 - vga_idx);
++		break;
++	case 3:
++		rx_pwr_all = -18 + 2 * (7 - vga_idx);
++		break;
++	case 2:
++		rx_pwr_all = 2 * (5 - vga_idx);
++		break;
++	case 1:
++		rx_pwr_all = 14 - 2 * vga_idx;
++		break;
++	case 0:
++		rx_pwr_all = 20 - 2 * vga_idx;
++		break;
++	default:
++		break;
++	}
++
++	return rx_pwr_all;
++}
++
++static void rtw8812a_query_phy_status(struct rtw_dev *rtwdev, u8 *phy_status,
++				      struct rtw_rx_pkt_stat *pkt_stat)
++{
++	rtw88xxa_query_phy_status(rtwdev, phy_status, pkt_stat,
++				  rtw8812a_cck_rx_pwr);
++
++	if (pkt_stat->rate >= DESC_RATE6M)
++		return;
++
++	if (rtwdev->hal.cck_high_power)
++		return;
++
++	if (pkt_stat->rssi >= 80)
++		pkt_stat->rssi = ((pkt_stat->rssi - 80) << 1) +
++				 ((pkt_stat->rssi - 80) >> 1) + 80;
++	else if (pkt_stat->rssi <= 78 && pkt_stat->rssi >= 20)
++		pkt_stat->rssi += 3;
++}
++
++static void rtw8812a_cfg_ldo25(struct rtw_dev *rtwdev, bool enable)
++{
++}
++
++static void rtw8812a_do_lck(struct rtw_dev *rtwdev)
++{
++	u32 cont_tx, lc_cal, i;
++
++	cont_tx = rtw_read32_mask(rtwdev, REG_SINGLE_TONE_CONT_TX, 0x70000);
++
++	lc_cal = rtw_read_rf(rtwdev, RF_PATH_A, RF_CFGCH, RFREG_MASK);
++
++	if (!cont_tx)
++		rtw_write8(rtwdev, REG_TXPAUSE, 0xff);
++
++	rtw_write_rf(rtwdev, RF_PATH_A, RF_LCK, BIT(14), 1);
++
++	rtw_write_rf(rtwdev, RF_PATH_A, RF_CFGCH, 0x08000, 1);
++
++	mdelay(150);
++
++	for (i = 0; i < 5; i++) {
++		if (rtw_read_rf(rtwdev, RF_PATH_A, RF_CFGCH, 0x08000) != 1)
++			break;
++
++		mdelay(10);
++	}
++
++	if (i == 5)
++		rtw_dbg(rtwdev, RTW_DBG_RFK, "LCK timed out\n");
++
++	rtw_write_rf(rtwdev, RF_PATH_A, RF_CFGCH, RFREG_MASK, lc_cal);
++
++	rtw_write_rf(rtwdev, RF_PATH_A, RF_LCK, BIT(14), 0);
++
++	if (!cont_tx)
++		rtw_write8(rtwdev, REG_TXPAUSE, 0);
++
++	rtw_write_rf(rtwdev, RF_PATH_A, RF_CFGCH, RFREG_MASK, lc_cal);
++}
++
++static void rtw8812a_iqk_backup_rf(struct rtw_dev *rtwdev, u32 *rfa_backup,
++				   u32 *rfb_backup, const u32 *backup_rf_reg,
++				   u32 rf_num)
++{
++	u32 i;
++
++	/* [31] = 0 --> Page C */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++
++	/* Save RF Parameters */
++	for (i = 0; i < rf_num; i++) {
++		rfa_backup[i] = rtw_read_rf(rtwdev, RF_PATH_A,
++					    backup_rf_reg[i], MASKDWORD);
++		rfb_backup[i] = rtw_read_rf(rtwdev, RF_PATH_B,
++					    backup_rf_reg[i], MASKDWORD);
++	}
++}
++
++static void rtw8812a_iqk_restore_rf(struct rtw_dev *rtwdev,
++				    enum rtw_rf_path path,
++				    const u32 *backup_rf_reg,
++				    u32 *RF_backup, u32 rf_reg_num)
++{
++	u32 i;
++
++	/* [31] = 0 --> Page C */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++
++	for (i = 0; i < rf_reg_num; i++)
++		rtw_write_rf(rtwdev, path, backup_rf_reg[i],
++			     RFREG_MASK, RF_backup[i]);
++
++	rtw_write_rf(rtwdev, path, RF_LUTWE, RFREG_MASK, 0);
++}
++
++static void rtw8812a_iqk_restore_afe(struct rtw_dev *rtwdev, u32 *afe_backup,
++				     const u32 *backup_afe_reg, u32 afe_num)
++{
++	u32 i;
++
++	/* [31] = 0 --> Page C */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++
++	/* Reload AFE Parameters */
++	for (i = 0; i < afe_num; i++)
++		rtw_write32(rtwdev, backup_afe_reg[i], afe_backup[i]);
++
++	/* [31] = 1 --> Page C1 */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x1);
++
++	rtw_write32(rtwdev, REG_OFDM0_XA_TX_IQ_IMBALANCE, 0x0);
++	rtw_write32(rtwdev, REG_OFDM0_A_TX_AFE, 0x0);
++	rtw_write32(rtwdev, REG_OFDM0_XB_TX_IQ_IMBALANCE, 0x0);
++	rtw_write32(rtwdev, REG_TSSI_TRK_SW, 0x3c000000);
++	rtw_write32_mask(rtwdev, REG_LSSI_WRITE_A, BIT(7), 1);
++	rtw_write32_mask(rtwdev, REG_IQK_DPD_CFG, BIT(18), 1);
++	rtw_write32_mask(rtwdev, REG_IQK_DPD_CFG, BIT(29), 1);
++	rtw_write32_mask(rtwdev, REG_CFG_PMPD, BIT(29), 1);
++
++	rtw_write32(rtwdev, REG_TXTONEB, 0x0);
++	rtw_write32(rtwdev, REG_RXTONEB, 0x0);
++	rtw_write32(rtwdev, REG_TXPITMB, 0x0);
++	rtw_write32(rtwdev, REG_RXPITMB, 0x3c000000);
++	rtw_write32_mask(rtwdev, REG_LSSI_WRITE_B, BIT(7), 1);
++	rtw_write32_mask(rtwdev, REG_BPBDB, BIT(18), 1);
++	rtw_write32_mask(rtwdev, REG_BPBDB, BIT(29), 1);
++	rtw_write32_mask(rtwdev, REG_PHYTXONB, BIT(29), 1);
++}
++
++static void rtw8812a_iqk_rx_fill(struct rtw_dev *rtwdev, enum rtw_rf_path path,
++				 unsigned int rx_x, unsigned int rx_y)
++{
++	switch (path) {
++	case RF_PATH_A:
++		/* [31] = 0 --> Page C */
++		rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++		if (rx_x >> 1 >= 0x112 ||
++		    (rx_y >> 1 >= 0x12 && rx_y >> 1 <= 0x3ee)) {
++			rtw_write32_mask(rtwdev, REG_RX_IQC_AB_A,
++					 0x000003ff, 0x100);
++			rtw_write32_mask(rtwdev, REG_RX_IQC_AB_A,
++					 0x03ff0000, 0);
++		} else {
++			rtw_write32_mask(rtwdev, REG_RX_IQC_AB_A,
++					 0x000003ff, rx_x >> 1);
++			rtw_write32_mask(rtwdev, REG_RX_IQC_AB_A,
++					 0x03ff0000, rx_y >> 1);
++		}
++		rtw_dbg(rtwdev, RTW_DBG_RFK,
++			"rx_x = %x;;rx_y = %x ====>fill to IQC\n",
++			rx_x >> 1 & 0x000003ff, rx_y >> 1 & 0x000003ff);
++		rtw_dbg(rtwdev, RTW_DBG_RFK, "0xc10 = %x ====>fill to IQC\n",
++			rtw_read32(rtwdev, REG_RX_IQC_AB_A));
++		break;
++	case RF_PATH_B:
++		/* [31] = 0 --> Page C */
++		rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++		if (rx_x >> 1 >= 0x112 ||
++		    (rx_y >> 1 >= 0x12 && rx_y >> 1 <= 0x3ee)) {
++			rtw_write32_mask(rtwdev, REG_RX_IQC_AB_B,
++					 0x000003ff, 0x100);
++			rtw_write32_mask(rtwdev, REG_RX_IQC_AB_B,
++					 0x03ff0000, 0);
++		} else {
++			rtw_write32_mask(rtwdev, REG_RX_IQC_AB_B,
++					 0x000003ff, rx_x >> 1);
++			rtw_write32_mask(rtwdev, REG_RX_IQC_AB_B,
++					 0x03ff0000, rx_y >> 1);
++		}
++		rtw_dbg(rtwdev, RTW_DBG_RFK,
++			"rx_x = %x;;rx_y = %x ====>fill to IQC\n",
++			rx_x >> 1 & 0x000003ff, rx_y >> 1 & 0x000003ff);
++		rtw_dbg(rtwdev, RTW_DBG_RFK, "0xe10 = %x====>fill to IQC\n",
++			rtw_read32(rtwdev, REG_RX_IQC_AB_B));
++		break;
++	default:
++		break;
++	}
++}
++
++static void rtw8812a_iqk_tx_fill(struct rtw_dev *rtwdev, enum rtw_rf_path path,
++				 unsigned int tx_x, unsigned int tx_y)
++{
++	switch (path) {
++	case RF_PATH_A:
++		/* [31] = 1 --> Page C1 */
++		rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x1);
++		rtw_write32_mask(rtwdev, REG_PREDISTA, BIT(7), 0x1);
++		rtw_write32_mask(rtwdev, REG_IQK_DPD_CFG, BIT(18), 0x1);
++		rtw_write32_mask(rtwdev, REG_IQK_DPD_CFG, BIT(29), 0x1);
++		rtw_write32_mask(rtwdev, REG_CFG_PMPD, BIT(29), 0x1);
++		rtw_write32_mask(rtwdev, REG_IQC_Y, 0x000007ff, tx_y);
++		rtw_write32_mask(rtwdev, REG_IQC_X, 0x000007ff, tx_x);
++		rtw_dbg(rtwdev, RTW_DBG_RFK,
++			"tx_x = %x;;tx_y = %x =====> fill to IQC\n",
++			tx_x & 0x000007ff, tx_y & 0x000007ff);
++		rtw_dbg(rtwdev, RTW_DBG_RFK,
++			"0xcd4 = %x;;0xccc = %x ====>fill to IQC\n",
++			rtw_read32_mask(rtwdev, REG_IQC_X, 0x000007ff),
++			rtw_read32_mask(rtwdev, REG_IQC_Y, 0x000007ff));
++		break;
++	case RF_PATH_B:
++		/* [31] = 1 --> Page C1 */
++		rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x1);
++		rtw_write32_mask(rtwdev, REG_PREDISTB, BIT(7), 0x1);
++		rtw_write32_mask(rtwdev, REG_BPBDB, BIT(18), 0x1);
++		rtw_write32_mask(rtwdev, REG_BPBDB, BIT(29), 0x1);
++		rtw_write32_mask(rtwdev, REG_PHYTXONB, BIT(29), 0x1);
++		rtw_write32_mask(rtwdev, REG_IQKYB, 0x000007ff, tx_y);
++		rtw_write32_mask(rtwdev, REG_IQKXB, 0x000007ff, tx_x);
++		rtw_dbg(rtwdev, RTW_DBG_RFK,
++			"tx_x = %x;;tx_y = %x =====> fill to IQC\n",
++			tx_x & 0x000007ff, tx_y & 0x000007ff);
++		rtw_dbg(rtwdev, RTW_DBG_RFK,
++			"0xed4 = %x;;0xecc = %x ====>fill to IQC\n",
++			rtw_read32_mask(rtwdev, REG_IQKXB, 0x000007ff),
++			rtw_read32_mask(rtwdev, REG_IQKYB, 0x000007ff));
++		break;
++	default:
++		break;
++	}
++}
++
++static void rtw8812a_iqk(struct rtw_dev *rtwdev)
++{
++	int tx_x0_temp[10], tx_y0_temp[10], tx_x1_temp[10], tx_y1_temp[10];
++	int rx_x0_temp[10], rx_y0_temp[10], rx_x1_temp[10], rx_y1_temp[10];
++	bool iqk0_ready = false, tx0_finish = false, rx0_finish = false;
++	bool iqk1_ready = false, tx1_finish = false, rx1_finish = false;
++	u8 tx0_avg = 0, tx1_avg = 0, rx0_avg = 0, rx1_avg = 0;
++	int tx_x0 = 0, tx_y0 = 0, tx_x1 = 0, tx_y1 = 0;
++	int rx_x0 = 0, rx_y0 = 0, rx_x1 = 0, rx_y1 = 0;
++	struct rtw_efuse *efuse = &rtwdev->efuse;
++	bool tx0_fail = true, rx0_fail = true;
++	bool tx1_fail = true, rx1_fail = true;
++	u8 cal0_retry, cal1_retry;
++	u8 delay_count;
++
++	/* [31] = 0 --> Page C */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++
++	/* ========path-A AFE all on======== */
++	/* Port 0 DAC/ADC on */
++	rtw_write32(rtwdev, REG_AFE_PWR1_A, 0x77777777);
++	rtw_write32(rtwdev, REG_AFE_PWR2_A, 0x77777777);
++
++	/* Port 1 DAC/ADC on */
++	rtw_write32(rtwdev, REG_AFE_PWR1_B, 0x77777777);
++	rtw_write32(rtwdev, REG_AFE_PWR2_B, 0x77777777);
++
++	rtw_write32(rtwdev, REG_RX_WAIT_CCA_TX_CCK_RFON_A, 0x19791979);
++	rtw_write32(rtwdev, REG_RX_WAIT_CCA_TX_CCK_RFON_B, 0x19791979);
++
++	/* hardware 3-wire off */
++	rtw_write32_mask(rtwdev, REG_3WIRE_SWA, 0xf, 0x4);
++	rtw_write32_mask(rtwdev, REG_3WIRE_SWB, 0xf, 0x4);
++
++	/* DAC/ADC sampling rate (160 MHz) */
++	rtw_write32_mask(rtwdev, REG_CK_MONHA, GENMASK(26, 24), 0x7);
++	rtw_write32_mask(rtwdev, REG_CK_MONHB, GENMASK(26, 24), 0x7);
++
++	/* [31] = 0 --> Page C */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++	/* ====== path A TX IQK RF setting ====== */
++	rtw_write_rf(rtwdev, RF_PATH_A, RF_LUTWE, RFREG_MASK, 0x80002);
++	rtw_write_rf(rtwdev, RF_PATH_A, RF_MODE_TABLE_ADDR, RFREG_MASK, 0x20000);
++	rtw_write_rf(rtwdev, RF_PATH_A, RF_MODE_TABLE_DATA0, RFREG_MASK, 0x3fffd);
++	rtw_write_rf(rtwdev, RF_PATH_A, RF_MODE_TABLE_DATA1, RFREG_MASK, 0xfe83f);
++	rtw_write_rf(rtwdev, RF_PATH_A, RF_TXA_PREPAD, RFREG_MASK, 0x931d5);
++	rtw_write_rf(rtwdev, RF_PATH_A, RF_RXBB2, RFREG_MASK, 0x8a001);
++
++	/* ====== path B TX IQK RF setting ====== */
++	rtw_write_rf(rtwdev, RF_PATH_B, RF_LUTWE, RFREG_MASK, 0x80002);
++	rtw_write_rf(rtwdev, RF_PATH_B, RF_MODE_TABLE_ADDR, RFREG_MASK, 0x20000);
++	rtw_write_rf(rtwdev, RF_PATH_B, RF_MODE_TABLE_DATA0, RFREG_MASK, 0x3fffd);
++	rtw_write_rf(rtwdev, RF_PATH_B, RF_MODE_TABLE_DATA1, RFREG_MASK, 0xfe83f);
++	rtw_write_rf(rtwdev, RF_PATH_B, RF_TXA_PREPAD, RFREG_MASK, 0x931d5);
++	rtw_write_rf(rtwdev, RF_PATH_B, RF_RXBB2, RFREG_MASK, 0x8a001);
++
++	rtw_write32(rtwdev, REG_DAC_RSTB, 0x00008000);
++	rtw_write32_mask(rtwdev, REG_TXAGCIDX, BIT(0), 0x1);
++	rtw_write32_mask(rtwdev, REG_INIDLYB, BIT(0), 0x1);
++	rtw_write32(rtwdev, REG_IQK_COM00, 0x29002000); /* TX (X,Y) */
++	rtw_write32(rtwdev, REG_IQK_COM32, 0xa9002000); /* RX (X,Y) */
++	rtw_write32(rtwdev, REG_IQK_COM96, 0x00462910); /* [0]:AGC_en, [15]:idac_K_Mask */
++	/* [31] = 1 --> Page C1 */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x1);
++
++	if (efuse->ext_pa_5g) {
++		if (efuse->rfe_option == 1) {
++			rtw_write32(rtwdev, REG_OFDM0_XB_TX_IQ_IMBALANCE, 0x821403e3);
++			rtw_write32(rtwdev, REG_TXPITMB, 0x821403e3);
++		} else {
++			rtw_write32(rtwdev, REG_OFDM0_XB_TX_IQ_IMBALANCE, 0x821403f7);
++			rtw_write32(rtwdev, REG_TXPITMB, 0x821403f7);
++		}
++	} else {
++		rtw_write32(rtwdev, REG_OFDM0_XB_TX_IQ_IMBALANCE, 0x821403f1);
++		rtw_write32(rtwdev, REG_TXPITMB, 0x821403f1);
++	}
++
++	if (rtwdev->hal.current_band_type == RTW_BAND_5G) {
++		rtw_write32(rtwdev, REG_TSSI_TRK_SW, 0x68163e96);
++		rtw_write32(rtwdev, REG_RXPITMB, 0x68163e96);
++	} else {
++		rtw_write32(rtwdev, REG_TSSI_TRK_SW, 0x28163e96);
++		rtw_write32(rtwdev, REG_RXPITMB, 0x28163e96);
++
++		if (efuse->rfe_option == 3) {
++			if (efuse->ext_pa_2g)
++				rtw_write32(rtwdev, REG_OFDM0_XB_TX_IQ_IMBALANCE,
++					    0x821403e3);
++			else
++				rtw_write32(rtwdev, REG_OFDM0_XB_TX_IQ_IMBALANCE,
++					    0x821403f7);
++		}
++	}
++
++	/* TX_Tone_idx[9:0], TxK_Mask[29] TX_Tone = 16 */
++	rtw_write32(rtwdev, REG_OFDM0_XA_TX_IQ_IMBALANCE, 0x18008c10);
++	/* RX_Tone_idx[9:0], RxK_Mask[29] */
++	rtw_write32(rtwdev, REG_OFDM0_A_TX_AFE, 0x38008c10);
++	rtw_write32(rtwdev, REG_INTPO_SETA, 0x00000000);
++	/* TX_Tone_idx[9:0], TxK_Mask[29] TX_Tone = 16 */
++	rtw_write32(rtwdev, REG_TXTONEB, 0x18008c10);
++	/* RX_Tone_idx[9:0], RxK_Mask[29] */
++	rtw_write32(rtwdev, REG_RXTONEB, 0x38008c10);
++	rtw_write32(rtwdev, REG_INTPO_SETB, 0x00000000);
++
++	cal0_retry = 0;
++	cal1_retry = 0;
++	while (1) {
++		/* one shot */
++		rtw_write32(rtwdev, REG_RFECTL_A, 0x00100000);
++		rtw_write32(rtwdev, REG_RFECTL_B, 0x00100000);
++		rtw_write32(rtwdev, REG_IQK_COM64, 0xfa000000);
++		rtw_write32(rtwdev, REG_IQK_COM64, 0xf8000000);
++
++		mdelay(10);
++
++		rtw_write32(rtwdev, REG_RFECTL_A, 0x00000000);
++		rtw_write32(rtwdev, REG_RFECTL_B, 0x00000000);
++
++		for (delay_count = 0; delay_count < 20; delay_count++) {
++			if (!tx0_finish)
++				iqk0_ready = rtw_read32_mask(rtwdev,
++							     REG_IQKA_END,
++							     BIT(10));
++			if (!tx1_finish)
++				iqk1_ready = rtw_read32_mask(rtwdev,
++							     REG_IQKB_END,
++							     BIT(10));
++			if (iqk0_ready && iqk1_ready)
++				break;
++
++			mdelay(1);
++		}
++
++		rtw_dbg(rtwdev, RTW_DBG_RFK, "TX delay_count = %d\n",
++			delay_count);
++
++		if (delay_count < 20) { /* If 20ms No Result, then cal_retry++ */
++			/* ============TXIQK Check============== */
++			tx0_fail = rtw_read32_mask(rtwdev, REG_IQKA_END, BIT(12));
++			tx1_fail = rtw_read32_mask(rtwdev, REG_IQKB_END, BIT(12));
++
++			if (!(tx0_fail || tx0_finish)) {
++				rtw_write32(rtwdev, REG_RFECTL_A, 0x02000000);
++				tx_x0_temp[tx0_avg] = rtw_read32_mask(rtwdev,
++								      REG_IQKA_END,
++								      0x07ff0000);
++				rtw_write32(rtwdev, REG_RFECTL_A, 0x04000000);
++				tx_y0_temp[tx0_avg] = rtw_read32_mask(rtwdev,
++								      REG_IQKA_END,
++								      0x07ff0000);
++
++				rtw_dbg(rtwdev, RTW_DBG_RFK,
++					"tx_x0[%d] = %x ;; tx_y0[%d] = %x\n",
++					tx0_avg, tx_x0_temp[tx0_avg],
++					tx0_avg, tx_y0_temp[tx0_avg]);
++
++				tx_x0_temp[tx0_avg] <<= 21;
++				tx_y0_temp[tx0_avg] <<= 21;
++
++				tx0_avg++;
++			} else {
++				cal0_retry++;
++				if (cal0_retry == 10)
++					break;
++			}
++
++			if (!(tx1_fail || tx1_finish)) {
++				rtw_write32(rtwdev, REG_RFECTL_B, 0x02000000);
++				tx_x1_temp[tx1_avg] = rtw_read32_mask(rtwdev,
++								      REG_IQKB_END,
++								      0x07ff0000);
++				rtw_write32(rtwdev, REG_RFECTL_B, 0x04000000);
++				tx_y1_temp[tx1_avg] = rtw_read32_mask(rtwdev,
++								      REG_IQKB_END,
++								      0x07ff0000);
++
++				rtw_dbg(rtwdev, RTW_DBG_RFK,
++					"tx_x1[%d] = %x ;; tx_y1[%d] = %x\n",
++					tx1_avg, tx_x1_temp[tx1_avg],
++					tx1_avg, tx_y1_temp[tx1_avg]);
++
++				tx_x1_temp[tx1_avg] <<= 21;
++				tx_y1_temp[tx1_avg] <<= 21;
++
++				tx1_avg++;
++			} else {
++				cal1_retry++;
++				if (cal1_retry == 10)
++					break;
++			}
++		} else {
++			cal0_retry++;
++			cal1_retry++;
++
++			rtw_dbg(rtwdev, RTW_DBG_RFK,
++				"delay 20ms TX IQK Not Ready!!!!!\n");
++
++			if (cal0_retry == 10)
++				break;
++		}
++
++		if (tx0_avg >= 2)
++			tx0_finish = rtw88xxa_iqk_finish(tx0_avg, 4,
++							 tx_x0_temp, tx_y0_temp, &tx_x0, &tx_y0,
++							 false, false);
++
++		if (tx1_avg >= 2)
++			tx1_finish = rtw88xxa_iqk_finish(tx1_avg, 4,
++							 tx_x1_temp, tx_y1_temp, &tx_x1, &tx_y1,
++							 false, false);
++
++		rtw_dbg(rtwdev, RTW_DBG_RFK,
++			"tx0_average = %d, tx1_average = %d\n",
++			tx0_avg, tx1_avg);
++		rtw_dbg(rtwdev, RTW_DBG_RFK,
++			"tx0_finish = %d, tx1_finish = %d\n",
++			tx0_finish, tx1_finish);
++
++		if (tx0_finish && tx1_finish)
++			break;
++
++		if ((cal0_retry + tx0_avg) >= 10 ||
++		    (cal1_retry + tx1_avg) >= 10)
++			break;
++	}
++
++	rtw_dbg(rtwdev, RTW_DBG_RFK, "TXA_cal_retry = %d\n", cal0_retry);
++	rtw_dbg(rtwdev, RTW_DBG_RFK, "TXB_cal_retry = %d\n", cal1_retry);
++
++	/* [31] = 0 --> Page C */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++	/* Load LOK */
++	rtw_write_rf(rtwdev, RF_PATH_A, RF_TXMOD, 0x7fe00,
++		     rtw_read_rf(rtwdev, RF_PATH_A, RF_DTXLOK, 0xffc00));
++	rtw_write_rf(rtwdev, RF_PATH_B, RF_TXMOD, 0x7fe00,
++		     rtw_read_rf(rtwdev, RF_PATH_B, RF_DTXLOK, 0xffc00));
++	/* [31] = 1 --> Page C1 */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x1);
++
++	/* [31] = 0 --> Page C */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++	if (tx0_finish) {
++		/* ====== path A RX IQK RF setting====== */
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_LUTWE, RFREG_MASK, 0x80000);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_MODE_TABLE_ADDR, RFREG_MASK,
++			     0x30000);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_MODE_TABLE_DATA0, RFREG_MASK,
++			     0x3f7ff);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_MODE_TABLE_DATA1, RFREG_MASK,
++			     0xfe7bf);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_RXBB2, RFREG_MASK, 0x88001);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_TXA_PREPAD, RFREG_MASK, 0x931d1);
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_LUTWE, RFREG_MASK, 0x00000);
++	}
++	if (tx1_finish) {
++		/* ====== path B RX IQK RF setting====== */
++		rtw_write_rf(rtwdev, RF_PATH_B, RF_LUTWE, RFREG_MASK, 0x80000);
++		rtw_write_rf(rtwdev, RF_PATH_B, RF_MODE_TABLE_ADDR, RFREG_MASK,
++			     0x30000);
++		rtw_write_rf(rtwdev, RF_PATH_B, RF_MODE_TABLE_DATA0, RFREG_MASK,
++			     0x3f7ff);
++		rtw_write_rf(rtwdev, RF_PATH_B, RF_MODE_TABLE_DATA1, RFREG_MASK,
++			     0xfe7bf);
++		rtw_write_rf(rtwdev, RF_PATH_B, RF_RXBB2, RFREG_MASK, 0x88001);
++		rtw_write_rf(rtwdev, RF_PATH_B, RF_TXA_PREPAD, RFREG_MASK, 0x931d1);
++		rtw_write_rf(rtwdev, RF_PATH_B, RF_LUTWE, RFREG_MASK, 0x00000);
++	}
++
++	rtw_write32_mask(rtwdev, REG_IQK_COM00, BIT(31), 0x1);
++	rtw_write32_mask(rtwdev, REG_IQK_COM00, BIT(31), 0x0);
++	rtw_write32(rtwdev, REG_DAC_RSTB, 0x00008000);
++
++	if (rtwdev->hci.type == RTW_HCI_TYPE_PCIE)
++		rtw_write32(rtwdev, REG_IQK_COM96, 0x0046a911);
++	else
++		rtw_write32(rtwdev, REG_IQK_COM96, 0x0046a890);
++
++	if (efuse->rfe_option == 1) {
++		rtw_write32(rtwdev, REG_RFE_PINMUX_A, 0x77777717);
++		rtw_write32(rtwdev, REG_RFE_INV_A, 0x00000077);
++		rtw_write32(rtwdev, REG_RFE_PINMUX_B, 0x77777717);
++		rtw_write32(rtwdev, REG_RFE_INV_B, 0x00000077);
++	} else {
++		rtw_write32(rtwdev, REG_RFE_PINMUX_A, 0x77777717);
++		rtw_write32(rtwdev, REG_RFE_INV_A, 0x02000077);
++		rtw_write32(rtwdev, REG_RFE_PINMUX_B, 0x77777717);
++		rtw_write32(rtwdev, REG_RFE_INV_B, 0x02000077);
++	}
++
++	/* [31] = 1 --> Page C1 */
++	rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x1);
++
++	if (tx0_finish) {
++		/* TX_Tone_idx[9:0], TxK_Mask[29] TX_Tone = 16 */
++		rtw_write32(rtwdev, REG_OFDM0_XA_TX_IQ_IMBALANCE, 0x38008c10);
++		/* RX_Tone_idx[9:0], RxK_Mask[29] */
++		rtw_write32(rtwdev, REG_OFDM0_A_TX_AFE, 0x18008c10);
++		rtw_write32(rtwdev, REG_OFDM0_XB_TX_IQ_IMBALANCE, 0x82140119);
++	}
++	if (tx1_finish) {
++		/* TX_Tone_idx[9:0], TxK_Mask[29] TX_Tone = 16 */
++		rtw_write32(rtwdev, REG_TXTONEB, 0x38008c10);
++		/* RX_Tone_idx[9:0], RxK_Mask[29] */
++		rtw_write32(rtwdev, REG_RXTONEB, 0x18008c10);
++		rtw_write32(rtwdev, REG_TXPITMB, 0x82140119);
++	}
++
++	cal0_retry = 0;
++	cal1_retry = 0;
++	while (1) {
++		/* one shot */
++		/* [31] = 0 --> Page C */
++		rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++
++		if (tx0_finish) {
++			rtw_write32_mask(rtwdev, REG_IQK_COM00, 0x03FF8000,
++					 tx_x0 & 0x000007ff);
++			rtw_write32_mask(rtwdev, REG_IQK_COM00, 0x000007FF,
++					 tx_y0 & 0x000007ff);
++			/* [31] = 1 --> Page C1 */
++			rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x1);
++			if (efuse->rfe_option == 1)
++				rtw_write32(rtwdev, REG_TSSI_TRK_SW, 0x28161500);
++			else
++				rtw_write32(rtwdev, REG_TSSI_TRK_SW, 0x28160cc0);
++			rtw_write32(rtwdev, REG_RFECTL_A, 0x00300000);
++			rtw_write32(rtwdev, REG_RFECTL_A, 0x00100000);
++			mdelay(5);
++			rtw_write32(rtwdev, REG_TSSI_TRK_SW, 0x3c000000);
++			rtw_write32(rtwdev, REG_RFECTL_A, 0x00000000);
++		}
++
++		if (tx1_finish) {
++			/* [31] = 0 --> Page C */
++			rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x0);
++			rtw_write32_mask(rtwdev, REG_IQK_COM00, 0x03FF8000,
++					 tx_x1 & 0x000007ff);
++			rtw_write32_mask(rtwdev, REG_IQK_COM00, 0x000007FF,
++					 tx_y1 & 0x000007ff);
++			/* [31] = 1 --> Page C1 */
++			rtw_write32_mask(rtwdev, REG_CCASEL, BIT(31), 0x1);
++			if (efuse->rfe_option == 1)
++				rtw_write32(rtwdev, REG_RXPITMB, 0x28161500);
++			else
++				rtw_write32(rtwdev, REG_RXPITMB, 0x28160ca0);
++			rtw_write32(rtwdev, REG_RFECTL_B, 0x00300000);
++			rtw_write32(rtwdev, REG_RFECTL_B, 0x00100000);
++			mdelay(5);
++			rtw_write32(rtwdev, REG_RXPITMB, 0x3c000000);
++			rtw_write32(rtwdev, REG_RFECTL_B, 0x00000000);
++		}
++
++		for (delay_count = 0; delay_count < 20; delay_count++) {
++			if (!rx0_finish && tx0_finish)
++				iqk0_ready = rtw_read32_mask(rtwdev,
++							     REG_IQKA_END,
++							     BIT(10));
++			if (!rx1_finish && tx1_finish)
++				iqk1_ready = rtw_read32_mask(rtwdev,
++							     REG_IQKB_END,
++							     BIT(10));
++			if (iqk0_ready && iqk1_ready)
++				break;
++
++			mdelay(1);
++		}
++
++		rtw_dbg(rtwdev, RTW_DBG_RFK, "RX delay_count = %d\n",
++			delay_count);
++
++		if (delay_count < 20) { /* If 20ms No Result, then cal_retry++ */
++			/* ============RXIQK Check============== */
++			rx0_fail = rtw_read32_mask(rtwdev, REG_IQKA_END, BIT(11));
++			rx1_fail = rtw_read32_mask(rtwdev, REG_IQKB_END, BIT(11));
++
++			if (!(rx0_fail || rx0_finish) && tx0_finish) {
++				rtw_write32(rtwdev, REG_RFECTL_A, 0x06000000);
++				rx_x0_temp[rx0_avg] = rtw_read32_mask(rtwdev,
++								      REG_IQKA_END,
++								      0x07ff0000);
++				rtw_write32(rtwdev, REG_RFECTL_A, 0x08000000);
++				rx_y0_temp[rx0_avg] = rtw_read32_mask(rtwdev,
++								      REG_IQKA_END,
++								      0x07ff0000);
++
++				rtw_dbg(rtwdev, RTW_DBG_RFK,
++					"rx_x0[%d] = %x ;; rx_y0[%d] = %x\n",
++					rx0_avg, rx_x0_temp[rx0_avg],
++					rx0_avg, rx_y0_temp[rx0_avg]);
++
++				rx_x0_temp[rx0_avg] <<= 21;
++				rx_y0_temp[rx0_avg] <<= 21;
++
++				rx0_avg++;
++			} else {
++				rtw_dbg(rtwdev, RTW_DBG_RFK,
++					"1. RXA_cal_retry = %d\n", cal0_retry);
++
++				cal0_retry++;
++				if (cal0_retry == 10)
++					break;
++			}
++
++			if (!(rx1_fail || rx1_finish) && tx1_finish) {
++				rtw_write32(rtwdev, REG_RFECTL_B, 0x06000000);
++				rx_x1_temp[rx1_avg] = rtw_read32_mask(rtwdev,
++								      REG_IQKB_END,
++								      0x07ff0000);
++				rtw_write32(rtwdev, REG_RFECTL_B, 0x08000000);
++				rx_y1_temp[rx1_avg] = rtw_read32_mask(rtwdev,
++								      REG_IQKB_END,
++								      0x07ff0000);
++
++				rtw_dbg(rtwdev, RTW_DBG_RFK,
++					"rx_x1[%d] = %x ;; rx_y1[%d] = %x\n",
++					rx1_avg, rx_x1_temp[rx1_avg],
++					rx1_avg, rx_y1_temp[rx1_avg]);
++
++				rx_x1_temp[rx1_avg] <<= 21;
++				rx_y1_temp[rx1_avg] <<= 21;
++
++				rx1_avg++;
++			} else {
++				cal1_retry++;
++				if (cal1_retry == 10)
++					break;
++			}
++		} else {
++			rtw_dbg(rtwdev, RTW_DBG_RFK,
++				"2. RXA_cal_retry = %d\n", cal0_retry);
++
++			cal0_retry++;
++			cal1_retry++;
++
++			rtw_dbg(rtwdev, RTW_DBG_RFK,
++				"delay 20ms RX IQK Not Ready!!!!!\n");
++
++			if (cal0_retry == 10)
++				break;
++		}
++
++		rtw_dbg(rtwdev, RTW_DBG_RFK, "3. RXA_cal_retry = %d\n",
++			cal0_retry);
++
++		if (rx0_avg >= 2)
++			rx0_finish = rtw88xxa_iqk_finish(rx0_avg, 4,
++							 rx_x0_temp, rx_y0_temp,
++							 &rx_x0, &rx_y0,
++							 true, false);
++
++		if (rx1_avg >= 2)
++			rx1_finish = rtw88xxa_iqk_finish(rx1_avg, 4,
++							 rx_x1_temp, rx_y1_temp,
++							 &rx_x1, &rx_y1,
++							 true, false);
++
++		rtw_dbg(rtwdev, RTW_DBG_RFK,
++			"rx0_average = %d, rx1_average = %d\n",
++			rx0_avg, rx1_avg);
++		rtw_dbg(rtwdev, RTW_DBG_RFK,
++			"rx0_finish = %d, rx1_finish = %d\n",
++			rx0_finish, rx1_finish);
++
++		if ((rx0_finish || !tx0_finish) && (rx1_finish || !tx1_finish))
++			break;
++
++		if ((cal0_retry + rx0_avg) >= 10 ||
++		    (cal1_retry + rx1_avg) >= 10 ||
++		    rx0_avg == 3 || rx1_avg == 3)
++			break;
++	}
++
++	rtw_dbg(rtwdev, RTW_DBG_RFK, "RXA_cal_retry = %d\n", cal0_retry);
++	rtw_dbg(rtwdev, RTW_DBG_RFK, "RXB_cal_retry = %d\n", cal1_retry);
++
++	/* FillIQK Result */
++	rtw_dbg(rtwdev, RTW_DBG_RFK, "========Path_A =======\n");
++
++	if (tx0_finish)
++		rtw8812a_iqk_tx_fill(rtwdev, RF_PATH_A, tx_x0, tx_y0);
++	else
++		rtw8812a_iqk_tx_fill(rtwdev, RF_PATH_A, 0x200, 0x0);
++
++	if (rx0_finish)
++		rtw8812a_iqk_rx_fill(rtwdev, RF_PATH_A, rx_x0, rx_y0);
++	else
++		rtw8812a_iqk_rx_fill(rtwdev, RF_PATH_A, 0x200, 0x0);
++
++	rtw_dbg(rtwdev, RTW_DBG_RFK, "========Path_B =======\n");
++
++	if (tx1_finish)
++		rtw8812a_iqk_tx_fill(rtwdev, RF_PATH_B, tx_x1, tx_y1);
++	else
++		rtw8812a_iqk_tx_fill(rtwdev, RF_PATH_B, 0x200, 0x0);
++
++	if (rx1_finish)
++		rtw8812a_iqk_rx_fill(rtwdev, RF_PATH_B, rx_x1, rx_y1);
++	else
++		rtw8812a_iqk_rx_fill(rtwdev, RF_PATH_B, 0x200, 0x0);
++}
++
++#define MACBB_REG_NUM_8812A 9
++#define AFE_REG_NUM_8812A 12
++#define RF_REG_NUM_8812A 3
++
++static void rtw8812a_do_iqk(struct rtw_dev *rtwdev)
++{
++	static const u32 backup_macbb_reg[MACBB_REG_NUM_8812A] = {
++		0x520, 0x550, 0x808, 0xa04, 0x90c, 0xc00, 0xe00, 0x838, 0x82c
++	};
++	static const u32 backup_afe_reg[AFE_REG_NUM_8812A] = {
++		0xc5c, 0xc60, 0xc64, 0xc68, 0xcb0, 0xcb4,
++		0xe5c, 0xe60, 0xe64, 0xe68, 0xeb0, 0xeb4
++	};
++	static const u32 backup_rf_reg[RF_REG_NUM_8812A] = {
++		0x65, 0x8f, 0x0
++	};
++	u32 macbb_backup[MACBB_REG_NUM_8812A] = {};
++	u32 afe_backup[AFE_REG_NUM_8812A] = {};
++	u32 rfa_backup[RF_REG_NUM_8812A] = {};
++	u32 rfb_backup[RF_REG_NUM_8812A] = {};
++	u32 reg_cb8, reg_eb8;
++
++	rtw88xxa_iqk_backup_mac_bb(rtwdev, macbb_backup,
++				   backup_macbb_reg, MACBB_REG_NUM_8812A);
++
++	rtw_write32_set(rtwdev, REG_CCASEL, BIT(31));
++	reg_cb8 = rtw_read32(rtwdev, REG_RFECTL_A);
++	reg_eb8 = rtw_read32(rtwdev, REG_RFECTL_B);
++	rtw_write32_clr(rtwdev, REG_CCASEL, BIT(31));
++
++	rtw88xxa_iqk_backup_afe(rtwdev, afe_backup,
++				backup_afe_reg, AFE_REG_NUM_8812A);
++	rtw8812a_iqk_backup_rf(rtwdev, rfa_backup, rfb_backup,
++			       backup_rf_reg, RF_REG_NUM_8812A);
++
++	rtw88xxa_iqk_configure_mac(rtwdev);
++
++	rtw8812a_iqk(rtwdev);
++
++	rtw8812a_iqk_restore_rf(rtwdev, RF_PATH_A, backup_rf_reg,
++				rfa_backup, RF_REG_NUM_8812A);
++	rtw8812a_iqk_restore_rf(rtwdev, RF_PATH_B, backup_rf_reg,
++				rfb_backup, RF_REG_NUM_8812A);
++
++	rtw8812a_iqk_restore_afe(rtwdev, afe_backup,
++				 backup_afe_reg, AFE_REG_NUM_8812A);
++
++	rtw_write32_set(rtwdev, REG_CCASEL, BIT(31));
++	rtw_write32(rtwdev, REG_RFECTL_A, reg_cb8);
++	rtw_write32(rtwdev, REG_RFECTL_B, reg_eb8);
++	rtw_write32_clr(rtwdev, REG_CCASEL, BIT(31));
++
++	rtw88xxa_iqk_restore_mac_bb(rtwdev, macbb_backup,
++				    backup_macbb_reg, MACBB_REG_NUM_8812A);
++}
++
++static void rtw8812a_phy_calibration(struct rtw_dev *rtwdev)
++{
++	u8 channel = rtwdev->hal.current_channel;
++
++	rtw8812a_do_iqk(rtwdev);
++
++	/* The official driver wants to do this after connecting
++	 * but before first writing a new igi (phydm_get_new_igi).
++	 * Here seems close enough.
++	 */
++	if (channel >= 36 && channel <= 64)
++		rtw_load_table(rtwdev, &rtw8812a_agc_diff_lb_tbl);
++	else if (channel >= 100)
++		rtw_load_table(rtwdev, &rtw8812a_agc_diff_hb_tbl);
++}
++
++static void rtw8812a_pwr_track(struct rtw_dev *rtwdev)
++{
++	struct rtw_dm_info *dm_info = &rtwdev->dm_info;
++
++	if (!dm_info->pwr_trk_triggered) {
++		rtw_write_rf(rtwdev, RF_PATH_A, RF_T_METER,
++			     GENMASK(17, 16), 0x03);
++		dm_info->pwr_trk_triggered = true;
++		return;
++	}
++
++	rtw88xxa_phy_pwrtrack(rtwdev, rtw8812a_do_lck, rtw8812a_do_iqk);
++	dm_info->pwr_trk_triggered = false;
++}
++
++static void rtw8812a_fill_txdesc_checksum(struct rtw_dev *rtwdev,
++					  struct rtw_tx_pkt_info *pkt_info,
++					  u8 *txdesc)
++{
++	fill_txdesc_checksum_common(txdesc, 16);
++}
++
++static void rtw8812a_coex_cfg_init(struct rtw_dev *rtwdev)
++{
++}
++
++static void rtw8812a_coex_cfg_gnt_fix(struct rtw_dev *rtwdev)
++{
++}
++
++static void rtw8821a_coex_cfg_rfe_type(struct rtw_dev *rtwdev)
++{
++}
++
++static void rtw8821a_coex_cfg_wl_tx_power(struct rtw_dev *rtwdev, u8 wl_pwr)
++{
++}
++
++static void rtw8821a_coex_cfg_wl_rx_gain(struct rtw_dev *rtwdev, bool low_gain)
++{
++}
++
++static const struct rtw_chip_ops rtw8812a_ops = {
++	.power_on		= rtw88xxa_power_on,
++	.power_off		= rtw8812a_power_off,
++	.phy_set_param		= NULL,
++	.read_efuse		= rtw88xxa_read_efuse,
++	.query_phy_status	= rtw8812a_query_phy_status,
++	.set_channel		= rtw88xxa_set_channel,
++	.mac_init		= NULL,
++	.read_rf		= rtw88xxa_phy_read_rf,
++	.write_rf		= rtw_phy_write_rf_reg_sipi,
++	.set_antenna		= NULL,
++	.set_tx_power_index	= rtw88xxa_set_tx_power_index,
++	.cfg_ldo25		= rtw8812a_cfg_ldo25,
++	.efuse_grant		= rtw88xxa_efuse_grant,
++	.false_alarm_statistics	= rtw88xxa_false_alarm_statistics,
++	.phy_calibration	= rtw8812a_phy_calibration,
++	.cck_pd_set		= rtw88xxa_phy_cck_pd_set,
++	.pwr_track		= rtw8812a_pwr_track,
++	.config_bfee		= NULL,
++	.set_gid_table		= NULL,
++	.cfg_csi_rate		= NULL,
++	.fill_txdesc_checksum	= rtw8812a_fill_txdesc_checksum,
++	.coex_set_init		= rtw8812a_coex_cfg_init,
++	.coex_set_ant_switch	= NULL,
++	.coex_set_gnt_fix	= rtw8812a_coex_cfg_gnt_fix,
++	.coex_set_gnt_debug	= NULL,
++	.coex_set_rfe_type	= rtw8821a_coex_cfg_rfe_type,
++	.coex_set_wl_tx_power	= rtw8821a_coex_cfg_wl_tx_power,
++	.coex_set_wl_rx_gain	= rtw8821a_coex_cfg_wl_rx_gain,
++};
++
++static const struct rtw_page_table page_table_8812a[] = {
++	/* hq_num, nq_num, lq_num, exq_num, gapq_num */
++	{0, 0, 0, 0, 0},	/* SDIO */
++	{0, 0, 0, 0, 0},	/* PCI */
++	{16, 0, 0, 0, 1},	/* 2 bulk out endpoints */
++	{16, 0, 16, 0, 1},	/* 3 bulk out endpoints */
++	{16, 0, 16, 0, 1},	/* 4 bulk out endpoints */
++};
++
++static const struct rtw_rqpn rqpn_table_8812a[] = {
++	{RTW_DMA_MAPPING_NORMAL, RTW_DMA_MAPPING_NORMAL,
++	 RTW_DMA_MAPPING_LOW, RTW_DMA_MAPPING_LOW,
++	 RTW_DMA_MAPPING_EXTRA, RTW_DMA_MAPPING_HIGH},
++
++	{RTW_DMA_MAPPING_NORMAL, RTW_DMA_MAPPING_NORMAL,
++	 RTW_DMA_MAPPING_LOW, RTW_DMA_MAPPING_LOW,
++	 RTW_DMA_MAPPING_EXTRA, RTW_DMA_MAPPING_HIGH},
++
++	{RTW_DMA_MAPPING_HIGH, RTW_DMA_MAPPING_HIGH,
++	 RTW_DMA_MAPPING_NORMAL, RTW_DMA_MAPPING_NORMAL,
++	 RTW_DMA_MAPPING_HIGH, RTW_DMA_MAPPING_HIGH},
++
++	{RTW_DMA_MAPPING_HIGH, RTW_DMA_MAPPING_NORMAL,
++	 RTW_DMA_MAPPING_LOW, RTW_DMA_MAPPING_LOW,
++	 RTW_DMA_MAPPING_HIGH, RTW_DMA_MAPPING_HIGH},
++
++	{RTW_DMA_MAPPING_NORMAL, RTW_DMA_MAPPING_NORMAL,
++	 RTW_DMA_MAPPING_LOW, RTW_DMA_MAPPING_LOW,
++	 RTW_DMA_MAPPING_EXTRA, RTW_DMA_MAPPING_HIGH},
++};
++
++static const struct rtw_prioq_addrs prioq_addrs_8812a = {
++	.prio[RTW_DMA_MAPPING_EXTRA] = {
++		.rsvd = REG_RQPN_NPQ + 2, .avail = REG_RQPN_NPQ + 3,
++	},
++	.prio[RTW_DMA_MAPPING_LOW] = {
++		.rsvd = REG_RQPN + 1, .avail = REG_FIFOPAGE_CTRL_2 + 1,
++	},
++	.prio[RTW_DMA_MAPPING_NORMAL] = {
++		.rsvd = REG_RQPN_NPQ, .avail = REG_RQPN_NPQ + 1,
++	},
++	.prio[RTW_DMA_MAPPING_HIGH] = {
++		.rsvd = REG_RQPN, .avail = REG_FIFOPAGE_CTRL_2,
++	},
++	.wsize = false,
++};
++
++static const struct rtw_hw_reg rtw8812a_dig[] = {
++	[0] = { .addr = REG_RXIGI_A, .mask = 0x7f },
++	[1] = { .addr = REG_RXIGI_B, .mask = 0x7f },
++};
++
++static const struct rtw_rfe_def rtw8812a_rfe_defs[] = {
++	[0] = { .phy_pg_tbl	= &rtw8812a_bb_pg_tbl,
++		.txpwr_lmt_tbl	= &rtw8812a_txpwr_lmt_tbl,
++		.pwr_track_tbl	= &rtw8812a_rtw_pwr_track_tbl, },
++	[1] = { .phy_pg_tbl	= &rtw8812a_bb_pg_tbl,
++		.txpwr_lmt_tbl	= &rtw8812a_txpwr_lmt_tbl,
++		.pwr_track_tbl	= &rtw8812a_rtw_pwr_track_tbl, },
++	[3] = { .phy_pg_tbl	= &rtw8812a_bb_pg_rfe3_tbl,
++		.txpwr_lmt_tbl	= &rtw8812a_txpwr_lmt_tbl,
++		.pwr_track_tbl	= &rtw8812a_rtw_pwr_track_rfe3_tbl, },
++};
++
++static const u8 wl_rssi_step_8812a[] = {101, 45, 101, 40};
++static const u8 bt_rssi_step_8812a[] = {101, 101, 101, 101};
++
++static const struct coex_rf_para rf_para_tx_8812a[] = {
++	{0, 0, false, 7},  /* for normal */
++	{0, 20, false, 7}, /* for WL-CPT */
++	{8, 17, true, 4},
++	{7, 18, true, 4},
++	{6, 19, true, 4},
++	{5, 20, true, 4}
++};
++
++static const struct coex_rf_para rf_para_rx_8812a[] = {
++	{0, 0, false, 7},  /* for normal */
++	{0, 20, false, 7}, /* for WL-CPT */
++	{3, 24, true, 5},
++	{2, 26, true, 5},
++	{1, 27, true, 5},
++	{0, 28, true, 5}
++};
++
++static_assert(ARRAY_SIZE(rf_para_tx_8812a) == ARRAY_SIZE(rf_para_rx_8812a));
++
++const struct rtw_chip_info rtw8812a_hw_spec = {
++	.ops = &rtw8812a_ops,
++	.id = RTW_CHIP_TYPE_8812A,
++	.fw_name = "rtw88/rtw8812a_fw.bin",
++	.wlan_cpu = RTW_WCPU_11N,
++	.tx_pkt_desc_sz = 40,
++	.tx_buf_desc_sz = 16,
++	.rx_pkt_desc_sz = 24,
++	.rx_buf_desc_sz = 8,
++	.phy_efuse_size = 512,
++	.log_efuse_size = 512,
++	.ptct_efuse_size = 96 + 1, /* TODO or just 18? */
++	.txff_size = 131072,
++	.rxff_size = 16128,
++	.rsvd_drv_pg_num = 9,
++	.txgi_factor = 1,
++	.is_pwr_by_rate_dec = true,
++	.max_power_index = 0x3f,
++	.csi_buf_pg_num = 0,
++	.band = RTW_BAND_2G | RTW_BAND_5G,
++	.page_size = 512,
++	.dig_min = 0x20,
++	.ht_supported = true,
++	.vht_supported = true,
++	.lps_deep_mode_supported = 0,
++	.sys_func_en = 0xFD,
++	.pwr_on_seq = card_enable_flow_8812a,
++	.pwr_off_seq = card_disable_flow_8812a,
++	.page_table = page_table_8812a,
++	.rqpn_table = rqpn_table_8812a,
++	.prioq_addrs = &prioq_addrs_8812a,
++	.intf_table = NULL,
++	.dig = rtw8812a_dig,
++	.rf_sipi_addr = {REG_LSSI_WRITE_A, REG_LSSI_WRITE_B},
++	.ltecoex_addr = NULL,
++	.mac_tbl = &rtw8812a_mac_tbl,
++	.agc_tbl = &rtw8812a_agc_tbl,
++	.bb_tbl = &rtw8812a_bb_tbl,
++	.rf_tbl = {&rtw8812a_rf_a_tbl, &rtw8812a_rf_b_tbl},
++	.rfe_defs = rtw8812a_rfe_defs,
++	.rfe_defs_size = ARRAY_SIZE(rtw8812a_rfe_defs),
++	.rx_ldpc = false,
++	.hw_feature_report = false,
++	.c2h_ra_report_size = 4,
++	.old_datarate_fb_limit = true,
++	.usb_tx_agg_desc_num = 1,
++	.iqk_threshold = 8,
++	.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
++	.max_scan_ie_len = IEEE80211_MAX_DATA_LEN,
++
++	.coex_para_ver = 0, /* no coex code in 8812au driver */
++	.bt_desired_ver = 0,
++	.scbd_support = false,
++	.new_scbd10_def = false,
++	.ble_hid_profile_support = false,
++	.wl_mimo_ps_support = false,
++	.pstdma_type = COEX_PSTDMA_FORCE_LPSOFF,
++	.bt_rssi_type = COEX_BTRSSI_RATIO,
++	.ant_isolation = 15,
++	.rssi_tolerance = 2,
++	.wl_rssi_step = wl_rssi_step_8812a,
++	.bt_rssi_step = bt_rssi_step_8812a,
++	.table_sant_num = 0,
++	.table_sant = NULL,
++	.table_nsant_num = 0,
++	.table_nsant = NULL,
++	.tdma_sant_num = 0,
++	.tdma_sant = NULL,
++	.tdma_nsant_num = 0,
++	.tdma_nsant = NULL,
++	.wl_rf_para_num = ARRAY_SIZE(rf_para_tx_8812a),
++	.wl_rf_para_tx = rf_para_tx_8812a,
++	.wl_rf_para_rx = rf_para_rx_8812a,
++	.bt_afh_span_bw20 = 0x20,
++	.bt_afh_span_bw40 = 0x30,
++	.afh_5g_num = 0,
++	.afh_5g = NULL,
++	.coex_info_hw_regs_num = 0,
++	.coex_info_hw_regs = NULL,
++};
++EXPORT_SYMBOL(rtw8812a_hw_spec);
++
++MODULE_FIRMWARE("rtw88/rtw8812a_fw.bin");
++
++MODULE_AUTHOR("Realtek Corporation");
++MODULE_DESCRIPTION("Realtek 802.11ac wireless 8812a driver");
++MODULE_LICENSE("Dual BSD/GPL");
+--- /dev/null
++++ b/drivers/net/wireless/realtek/rtw88/rtw8812a.h
+@@ -0,0 +1,10 @@
++/* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */
++/* Copyright(c) 2024  Realtek Corporation
++ */
++
++#ifndef __RTW8812A_H__
++#define __RTW8812A_H__
++
++extern const struct rtw_chip_info rtw8812a_hw_spec;
++
++#endif
diff --git a/package/kernel/mac80211/patches/rtl/044-v6.13-wifi-rtw88-Add-rtw8821au.c-and-rtw8812au.c.patch b/package/kernel/mac80211/patches/rtl/044-v6.13-wifi-rtw88-Add-rtw8821au.c-and-rtw8812au.c.patch
new file mode 100644
index 00000000000000..a37f131bab8ffe
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/044-v6.13-wifi-rtw88-Add-rtw8821au.c-and-rtw8812au.c.patch
@@ -0,0 +1,80 @@
+From 8f82bb2cfaf7b8992e0e8493cb765138254f87c9 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 30 Oct 2024 20:29:28 +0200
+Subject: [PATCH] wifi: rtw88: Add rtw8821au.c and rtw8812au.c
+
+These are the entry points for the new modules rtw88_8821au
+(RTL8821AU/RTL8811AU) and rtw88_8812au (RTL8812AU).
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/91c495f8-a607-429b-8bc0-5a45d3c1393e@gmail.com
+---
+ .../net/wireless/realtek/rtw88/rtw8812au.c    | 28 +++++++++++++++++++
+ .../net/wireless/realtek/rtw88/rtw8821au.c    | 28 +++++++++++++++++++
+ 2 files changed, 56 insertions(+)
+ create mode 100644 drivers/net/wireless/realtek/rtw88/rtw8812au.c
+ create mode 100644 drivers/net/wireless/realtek/rtw88/rtw8821au.c
+
+--- /dev/null
++++ b/drivers/net/wireless/realtek/rtw88/rtw8812au.c
+@@ -0,0 +1,28 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
++/* Copyright(c) 2024  Realtek Corporation
++ */
++
++#include <linux/module.h>
++#include <linux/usb.h>
++#include "main.h"
++#include "rtw8812a.h"
++#include "usb.h"
++
++static const struct usb_device_id rtw_8812au_id_table[] = {
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2604, 0x0012, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) },
++	{},
++};
++MODULE_DEVICE_TABLE(usb, rtw_8812au_id_table);
++
++static struct usb_driver rtw_8812au_driver = {
++	.name = "rtw_8812au",
++	.id_table = rtw_8812au_id_table,
++	.probe = rtw_usb_probe,
++	.disconnect = rtw_usb_disconnect,
++};
++module_usb_driver(rtw_8812au_driver);
++
++MODULE_AUTHOR("Bitterblue Smith <rtl8821cerfe2@gmail.com>");
++MODULE_DESCRIPTION("Realtek 802.11ac wireless 8812au driver");
++MODULE_LICENSE("Dual BSD/GPL");
+--- /dev/null
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821au.c
+@@ -0,0 +1,28 @@
++// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
++/* Copyright(c) 2024  Realtek Corporation
++ */
++
++#include <linux/module.h>
++#include <linux/usb.h>
++#include "main.h"
++#include "rtw8821a.h"
++#include "usb.h"
++
++static const struct usb_device_id rtw_8821au_id_table[] = {
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x011e, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) },
++	{},
++};
++MODULE_DEVICE_TABLE(usb, rtw_8821au_id_table);
++
++static struct usb_driver rtw_8821au_driver = {
++	.name = "rtw_8821au",
++	.id_table = rtw_8821au_id_table,
++	.probe = rtw_usb_probe,
++	.disconnect = rtw_usb_disconnect,
++};
++module_usb_driver(rtw_8821au_driver);
++
++MODULE_AUTHOR("Bitterblue Smith <rtl8821cerfe2@gmail.com>");
++MODULE_DESCRIPTION("Realtek 802.11ac wireless 8821au/8811au driver");
++MODULE_LICENSE("Dual BSD/GPL");
diff --git a/package/kernel/mac80211/patches/rtl/045-v6.13-wifi-rtw88-Enable-the-new-RTL8821AU-RTL8812AU-driver.patch b/package/kernel/mac80211/patches/rtl/045-v6.13-wifi-rtw88-Enable-the-new-RTL8821AU-RTL8812AU-driver.patch
new file mode 100644
index 00000000000000..6a4a2aff6980d7
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/045-v6.13-wifi-rtw88-Enable-the-new-RTL8821AU-RTL8812AU-driver.patch
@@ -0,0 +1,153 @@
+From 0e3e8284f8e1bf2fc0f7bf247194efe5cfc568c1 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Wed, 30 Oct 2024 20:31:28 +0200
+Subject: [PATCH] wifi: rtw88: Enable the new RTL8821AU/RTL8812AU drivers
+
+These are older Wifi 5 chips. RTL8821AU is 1x1, with or without
+Bluetooth. RTL8812AU is 2x2, without Bluetooth.
+
+Beamforming is not implemented. It looks like these chips need a
+different implementation than what is in bf.c.
+
+Speed tests with RTL8821AU: 137 Mbps download, 144 Mbps upload.
+Speed tests with RTL8812AU: 344 Mbps download, 387 Mbps upload.
+
+Station mode and AP mode were tested.
+
+Bluetooth coexistence works. I used my Bluetooth headphones for
+several days, listening to music and watching videos. There is only
+a problem with the wifi speeds with one router:
+
+With ISP's HG6544C router:
+Official driver: 3/5 Mbps.
+rtw88: a bit more, but not steady at all. Not enough to watch a 1080p
+Youtube video.
+
+With my D-Link Eagle R32 router running Openwrt, on the same channel:
+Official driver: 6/10 Mbps.
+rtw88: download starts around 30, climbs to 50 / upload is 10 Mbps.
+I can watch a 1080p Youtube video.
+
+The music doesn't cut out during any speed tests.
+
+I also tested transferring files to and from my phone. I don't have
+other types of Bluetooth devices to test.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/0b8e8093-8103-4999-86bf-0055ec52ea64@gmail.com
+---
+Kconfig.local                               | 15 ++++++++
+ drivers/net/wireless/realtek/rtw88/Kconfig  | 40 ++++++++++++++++++++-
+ drivers/net/wireless/realtek/rtw88/Makefile | 15 ++++++++
+ 3 files changed, 69 insertions(+), 1 deletion(-)
+
+--- a/Kconfig.local
++++ b/Kconfig.local
+@@ -1144,6 +1144,15 @@ config BACKPORTED_RTW88_8723D
+ config BACKPORTED_RTW88_8821C
+ 	tristate
+ 	default RTW88_8821C
++config BACKPORTED_RTW88_88XXA
++	tristate
++	default RTW88_88XXA
++config BACKPORTED_RTW88_8821A
++	tristate
++	default RTW88_8821A
++config BACKPORTED_RTW88_8812A
++	tristate
++	default RTW88_8812A
+ config BACKPORTED_RTW88_8822BE
+ 	tristate
+ 	default RTW88_8822BE
+@@ -1183,6 +1192,12 @@ config BACKPORTED_RTW88_8821CS
+ config BACKPORTED_RTW88_8821CU
+ 	tristate
+ 	default RTW88_8821CU
++config BACKPORTED_RTW88_8821AU
++	tristate
++	default RTW88_8821AU
++config BACKPORTED_RTW88_8812AU
++	tristate
++	default RTW88_8812AU
+ config BACKPORTED_RTW88_DEBUG
+ 	tristate
+ 	default RTW88_DEBUG
+--- a/drivers/net/wireless/realtek/rtw88/Kconfig
++++ b/drivers/net/wireless/realtek/rtw88/Kconfig
+@@ -54,6 +54,20 @@ config RTW88_8821C
+ 	tristate
+ 	depends on m
+ 
++config RTW88_88XXA
++	tristate
++	depends on m
++
++config RTW88_8821A
++	tristate
++	depends on m
++	select RTW88_88XXA
++
++config RTW88_8812A
++	tristate
++	depends on m
++	select RTW88_88XXA
++
+ config RTW88_8822BE
+ 	tristate "Realtek 8822BE PCI wireless network adapter"
+ 	depends on m
+@@ -213,6 +227,30 @@ config RTW88_8821CU
+ 
+ 	  802.11ac USB wireless network adapter
+ 
++config RTW88_8821AU
++	tristate "Realtek 8821AU/8811AU USB wireless network adapter"
++	depends on m
++	depends on USB
++	select RTW88_CORE
++	select RTW88_USB
++	select RTW88_8821A
++	help
++	  Select this option will enable support for 8821AU and 8811AU chipset
++
++	  802.11ac USB wireless network adapter
++
++config RTW88_8812AU
++	tristate "Realtek 8812AU USB wireless network adapter"
++	depends on m
++	depends on USB
++	select RTW88_CORE
++	select RTW88_USB
++	select RTW88_8812A
++	help
++	  Select this option will enable support for 8812AU chipset
++
++	  802.11ac USB wireless network adapter
++
+ config RTW88_DEBUG
+ 	bool "Realtek rtw88 debug support"
+ 	depends on RTW88_CORE
+--- a/drivers/net/wireless/realtek/rtw88/Makefile
++++ b/drivers/net/wireless/realtek/rtw88/Makefile
+@@ -77,6 +77,21 @@ rtw88_8821cs-objs		:= rtw8821cs.o
+ obj-$(CPTCFG_RTW88_8821CU)	+= rtw88_8821cu.o
+ rtw88_8821cu-objs		:= rtw8821cu.o
+ 
++obj-$(CPTCFG_RTW88_88XXA)	+= rtw88_88xxa.o
++rtw88_88xxa-objs		:= rtw88xxa.o
++
++obj-$(CPTCFG_RTW88_8821A)	+= rtw88_8821a.o
++rtw88_8821a-objs		:= rtw8821a.o rtw8821a_table.o
++
++obj-$(CPTCFG_RTW88_8812A)	+= rtw88_8812a.o
++rtw88_8812a-objs		:= rtw8812a.o rtw8812a_table.o
++
++obj-$(CPTCFG_RTW88_8821AU)	+= rtw88_8821au.o
++rtw88_8821au-objs		:= rtw8821au.o
++
++obj-$(CPTCFG_RTW88_8812AU)	+= rtw88_8812au.o
++rtw88_8812au-objs		:= rtw8812au.o
++
+ obj-$(CPTCFG_RTW88_PCI)		+= rtw88_pci.o
+ rtw88_pci-objs			:= pci.o
+ 
diff --git a/package/kernel/mac80211/patches/rtl/046-wifi-rtw88-8821au-Add-additional-devices-to-the-USB_.patch b/package/kernel/mac80211/patches/rtl/046-wifi-rtw88-8821au-Add-additional-devices-to-the-USB_.patch
new file mode 100644
index 00000000000000..a83094b3c3ee2b
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/046-wifi-rtw88-8821au-Add-additional-devices-to-the-USB_.patch
@@ -0,0 +1,77 @@
+From ff5a1c94e53c0d24f610c2c30add82f75b728737 Mon Sep 17 00:00:00 2001
+From: Larry Finger <Larry.Finger@gmail.com>
+Date: Wed, 6 Nov 2024 15:55:31 +0200
+Subject: [PATCH 1/6] wifi: rtw88: 8821au: Add additional devices to the
+ USB_DEVICE list
+
+These are the entries that Nick Morrow provided. From
+https://github.com/morrownr/8821au-20210708
+
+Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+---
+ .../net/wireless/realtek/rtw88/rtw8821au.c    | 52 ++++++++++++++++++-
+ 1 file changed, 51 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/rtw8821au.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8821au.c
+@@ -9,8 +9,58 @@
+ #include "usb.h"
+ 
+ static const struct usb_device_id rtw_8821au_id_table[] = {
+-	{ USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x011e, 0xff, 0xff, 0xff),
++	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x0811, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x0820, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x0821, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x8822, 0xff, 0xff, 0xff),
+ 	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x0823, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0xa811, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0411, 0x0242, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* Buffalo */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0411, 0x029b, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* Buffalo */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x04bb, 0x0953, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* I-O DATA */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x056e, 0x4007, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* ELECOM */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x056e, 0x400e, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* ELECOM */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x056e, 0x400f, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* ELECOM */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0846, 0x9052, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* Netgear */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0e66, 0x0023, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* HAWKING */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3314, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* D-Link */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3318, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* D-Link */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2019, 0xab32, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* Planex */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x20f4, 0x804b, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* TRENDnet */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x011e, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* TP Link */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x011f, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* TP Link */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x0120, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* TP Link */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x3823, 0x6249, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* Obihai */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xa811, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* Edimax */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xa812, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* Edimax */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xa813, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* Edimax */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xb611, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8821a_hw_spec) }, /* Edimax */
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(usb, rtw_8821au_id_table);
diff --git a/package/kernel/mac80211/patches/rtl/047-wifi-rtw88-8812au-Add-more-device-IDs.patch b/package/kernel/mac80211/patches/rtl/047-wifi-rtw88-8812au-Add-more-device-IDs.patch
new file mode 100644
index 00000000000000..a93f9219d9fcc2
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/047-wifi-rtw88-8812au-Add-more-device-IDs.patch
@@ -0,0 +1,91 @@
+From d21ad2e4edfb64d3f32685607a457576eea3c5cd Mon Sep 17 00:00:00 2001
+From: Nick Morrow <usbwifi2024@gmail.com>
+Date: Wed, 6 Nov 2024 15:57:10 +0200
+Subject: [PATCH 2/6] wifi: rtw88: 8812au: Add more device IDs
+
+From https://github.com/morrownr/8812au-20210820.
+
+Signed-off-by: Nick Morrow <usbwifi2024@gmail.com>
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+---
+ .../net/wireless/realtek/rtw88/rtw8812au.c    | 68 ++++++++++++++++++-
+ 1 file changed, 67 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/rtw8812au.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8812au.c
+@@ -9,8 +9,74 @@
+ #include "usb.h"
+ 
+ static const struct usb_device_id rtw_8812au_id_table[] = {
+-	{ USB_DEVICE_AND_INTERFACE_INFO(0x2604, 0x0012, 0xff, 0xff, 0xff),
++	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x8812, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x881a, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x881b, 0xff, 0xff, 0xff),
+ 	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(RTW_USB_VENDOR_ID_REALTEK, 0x881c, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) },
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0409, 0x0408, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* NEC */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0411, 0x025d, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* Buffalo */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x04bb, 0x0952, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* I-O DATA */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x050d, 0x1106, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* Belkin */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x050d, 0x1109, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* Belkin */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0586, 0x3426, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* ZyXEL */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0789, 0x016e, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* Logitec */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x07b8, 0x8812, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* Abocom */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0846, 0x9051, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* Netgear */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0b05, 0x17d2, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* ASUS */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0df6, 0x0074, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* Sitecom */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x0e66, 0x0022, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* Hawking */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x1058, 0x0632, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* WD */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x13b1, 0x003f, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* Linksys */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x148f, 0x9097, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* Amped Wireless */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x1740, 0x0100, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* EnGenius */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x330e, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* D-Link */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3313, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* D-Link */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3315, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* D-Link */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x3316, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* D-Link */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2019, 0xab30, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* Planex */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x20f4, 0x805b, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* TRENDnet */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x0101, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* TP-Link */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x0103, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* TP-Link */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x010d, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* TP-Link */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x010e, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* TP-Link */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x010f, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* TP-Link */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2357, 0x0122, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* TP-Link */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2604, 0x0012, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* Tenda */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x7392, 0xa822, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8812a_hw_spec) }, /* Edimax */
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(usb, rtw_8812au_id_table);
diff --git a/package/kernel/mac80211/patches/rtl/048-wifi-rtw88-usb-Support-USB-3-with-RTL8812AU.patch b/package/kernel/mac80211/patches/rtl/048-wifi-rtw88-usb-Support-USB-3-with-RTL8812AU.patch
new file mode 100644
index 00000000000000..86ecfcd4a4a0ca
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/048-wifi-rtw88-usb-Support-USB-3-with-RTL8812AU.patch
@@ -0,0 +1,69 @@
+From 213dfa630285bb0241f3eaeb778db8ff128f10ba Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Fri, 8 Nov 2024 01:41:08 +0200
+Subject: [PATCH 3/6] wifi: rtw88: usb: Support USB 3 with RTL8812AU
+
+Add the function to automatically switch the RTL8812AU into USB 3 mode.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+---
+ drivers/net/wireless/realtek/rtw88/usb.c | 34 ++++++++++++++++++++++--
+ 1 file changed, 32 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/wireless/realtek/rtw88/usb.c
++++ b/drivers/net/wireless/realtek/rtw88/usb.c
+@@ -985,6 +985,32 @@ static void rtw_usb_intf_deinit(struct r
+ 	usb_set_intfdata(intf, NULL);
+ }
+ 
++static int rtw_usb_switch_mode_old(struct rtw_dev *rtwdev)
++{
++	struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);
++	enum usb_device_speed cur_speed = rtwusb->udev->speed;
++	u8 hci_opt;
++
++	if (cur_speed == USB_SPEED_HIGH) {
++		hci_opt = rtw_read8(rtwdev, REG_HCI_OPT_CTRL);
++
++		if ((hci_opt & (BIT(2) | BIT(3))) != BIT(3)) {
++			rtw_write8(rtwdev, REG_HCI_OPT_CTRL, 0x8);
++			rtw_write8(rtwdev, REG_SYS_SDIO_CTRL, 0x2);
++			rtw_write8(rtwdev, REG_ACLK_MON, 0x1);
++			rtw_write8(rtwdev, 0x3d, 0x3);
++			/* usb disconnect */
++			rtw_write8(rtwdev, REG_SYS_PW_CTRL + 1, 0x80);
++			return 1;
++		}
++	} else if (cur_speed == USB_SPEED_SUPER) {
++		rtw_write8_clr(rtwdev, REG_SYS_SDIO_CTRL, BIT(1));
++		rtw_write8_clr(rtwdev, REG_ACLK_MON, BIT(0));
++	}
++
++	return 0;
++}
++
+ static int rtw_usb_switch_mode_new(struct rtw_dev *rtwdev)
+ {
+ 	enum usb_device_speed cur_speed;
+@@ -1038,7 +1064,8 @@ static int rtw_usb_switch_mode(struct rt
+ {
+ 	u8 id = rtwdev->chip->id;
+ 
+-	if (id != RTW_CHIP_TYPE_8822C && id != RTW_CHIP_TYPE_8822B)
++	if (id != RTW_CHIP_TYPE_8822C && id != RTW_CHIP_TYPE_8822B &&
++	    id != RTW_CHIP_TYPE_8812A)
+ 		return 0;
+ 
+ 	if (!rtwdev->efuse.usb_mode_switch) {
+@@ -1053,7 +1080,10 @@ static int rtw_usb_switch_mode(struct rt
+ 		return 0;
+ 	}
+ 
+-	return rtw_usb_switch_mode_new(rtwdev);
++	if (id == RTW_CHIP_TYPE_8812A)
++		return rtw_usb_switch_mode_old(rtwdev);
++	else /* RTL8822CU, RTL8822BU */
++		return rtw_usb_switch_mode_new(rtwdev);
+ }
+ 
+ int rtw_usb_probe(struct usb_interface *intf, const struct usb_device_id *id)
diff --git a/package/kernel/mac80211/patches/rtl/049-wifi-rtw88-usb-Enable-RX-aggregation-for-8821au-8812.patch b/package/kernel/mac80211/patches/rtl/049-wifi-rtw88-usb-Enable-RX-aggregation-for-8821au-8812.patch
new file mode 100644
index 00000000000000..5b4530871b48e0
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/049-wifi-rtw88-usb-Enable-RX-aggregation-for-8821au-8812.patch
@@ -0,0 +1,65 @@
+From 2b38362bd3b8e0a3691f0a8e82444a54f702e384 Mon Sep 17 00:00:00 2001
+From: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+Date: Fri, 8 Nov 2024 01:43:50 +0200
+Subject: [PATCH 4/6] wifi: rtw88: usb: Enable RX aggregation for 8821au/8812au
+
+USB RX aggregation improves the RX speed on certain ARM systems, like
+the NanoPi NEO Core2. With RTL8811AU, before: 30 Mbps, after: 224 Mbps.
+
+The out-of-tree driver uses aggregation size of 7 in USB 3 mode, but
+that doesn't work here. rtw88 advertises support for receiving AMSDU
+in AMPDU, so the AP sends larger frames, up to ~5100 bytes. With a size
+of 7 RTL8812AU frequently tries to aggregate more frames than will fit
+in 32768 bytes. Use a size of 6 instead.
+
+Signed-off-by: Bitterblue Smith <rtl8821cerfe2@gmail.com>
+---
+ drivers/net/wireless/realtek/rtw88/usb.c | 30 ++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/usb.c
++++ b/drivers/net/wireless/realtek/rtw88/usb.c
+@@ -843,6 +843,32 @@ static void rtw_usb_dynamic_rx_agg_v1(st
+ 	rtw_write16(rtwdev, REG_RXDMA_AGG_PG_TH, val16);
+ }
+ 
++static void rtw_usb_dynamic_rx_agg_v2(struct rtw_dev *rtwdev, bool enable)
++{
++	struct rtw_usb *rtwusb = rtw_get_usb_priv(rtwdev);
++	u8 size, timeout;
++	u16 val16;
++
++	if (rtwusb->udev->speed == USB_SPEED_SUPER) {
++		size = 0x6;
++		timeout = 0x1a;
++	} else {
++		size = 0x5;
++		timeout = 0x20;
++	}
++
++	if (!enable) {
++		size = 0x0;
++		timeout = 0x1;
++	}
++
++	val16 = u16_encode_bits(size, BIT_RXDMA_AGG_PG_TH) |
++		u16_encode_bits(timeout, BIT_DMA_AGG_TO_V1);
++
++	rtw_write16(rtwdev, REG_RXDMA_AGG_PG_TH, val16);
++	rtw_write8_set(rtwdev, REG_TXDMA_PQ_MAP, BIT_RXDMA_AGG_EN);
++}
++
+ static void rtw_usb_dynamic_rx_agg(struct rtw_dev *rtwdev, bool enable)
+ {
+ 	switch (rtwdev->chip->id) {
+@@ -851,6 +877,10 @@ static void rtw_usb_dynamic_rx_agg(struc
+ 	case RTW_CHIP_TYPE_8821C:
+ 		rtw_usb_dynamic_rx_agg_v1(rtwdev, enable);
+ 		break;
++	case RTW_CHIP_TYPE_8821A:
++	case RTW_CHIP_TYPE_8812A:
++		rtw_usb_dynamic_rx_agg_v2(rtwdev, enable);
++		break;
+ 	case RTW_CHIP_TYPE_8723D:
+ 		/* Doesn't like aggregation. */
+ 		break;
diff --git a/package/kernel/mac80211/patches/rtl/051-wifi-rtw88-Add-additional-USB-IDs-for-RTL8812BU.patch b/package/kernel/mac80211/patches/rtl/051-wifi-rtw88-Add-additional-USB-IDs-for-RTL8812BU.patch
new file mode 100644
index 00000000000000..e4e26c79751116
--- /dev/null
+++ b/package/kernel/mac80211/patches/rtl/051-wifi-rtw88-Add-additional-USB-IDs-for-RTL8812BU.patch
@@ -0,0 +1,31 @@
+From acadf3a63b39ad03167a633fa3cea8c0fc2ab87f Mon Sep 17 00:00:00 2001
+From: Nick Morrow <usbwifi2024@gmail.com>
+Date: Thu, 7 Nov 2024 08:28:46 +0800
+Subject: [PATCH 6/6] wifi: rtw88: Add additional USB IDs for RTL8812BU
+
+Add three additional USB IDs found in
+https://github.com/morrownr/88x2bu-20210702
+to support more RTL8812BU devices.
+
+Signed-off-by: Nick Morrow <usbwifi2024@gmail.com>
+Signed-off-by: Zenm Chen <zenmchen@gmail.com>
+Signed-off-by: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
+---
+ drivers/net/wireless/realtek/rtw88/rtw8822bu.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtw88/rtw8822bu.c
++++ b/drivers/net/wireless/realtek/rtw88/rtw8822bu.c
+@@ -67,6 +67,12 @@ static const struct usb_device_id rtw_88
+ 	  .driver_info = (kernel_ulong_t)&(rtw8822b_hw_spec) }, /* LiteOn */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(0x20f4, 0x808a, 0xff, 0xff, 0xff),
+ 	  .driver_info = (kernel_ulong_t)&(rtw8822b_hw_spec) }, /* TRENDnet TEW-808UBM */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x20f4, 0x805a, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8822b_hw_spec) }, /* TRENDnet TEW-805UBH */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x056e, 0x4011, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8822b_hw_spec) }, /* ELECOM WDB-867DU3S */
++	{ USB_DEVICE_AND_INTERFACE_INFO(0x2c4e, 0x0107, 0xff, 0xff, 0xff),
++	  .driver_info = (kernel_ulong_t)&(rtw8822b_hw_spec) }, /* Mercusys MA30H */
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(usb, rtw_8822bu_id_table);
diff --git a/package/kernel/mac80211/patches/subsys/130-disable_auto_vif.patch b/package/kernel/mac80211/patches/subsys/130-disable_auto_vif.patch
index eea165ccca9bf9..b56531435c67d3 100644
--- a/package/kernel/mac80211/patches/subsys/130-disable_auto_vif.patch
+++ b/package/kernel/mac80211/patches/subsys/130-disable_auto_vif.patch
@@ -1,6 +1,6 @@
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -1581,24 +1581,6 @@ int ieee80211_register_hw(struct ieee802
+@@ -1585,24 +1585,6 @@ int ieee80211_register_hw(struct ieee802
  
  	ieee80211_check_wbrf_support(local);
  
diff --git a/package/kernel/mac80211/patches/subsys/220-allow-ibss-mixed.patch b/package/kernel/mac80211/patches/subsys/220-allow-ibss-mixed.patch
index 55376362a5b41c..378ca275f5ba80 100644
--- a/package/kernel/mac80211/patches/subsys/220-allow-ibss-mixed.patch
+++ b/package/kernel/mac80211/patches/subsys/220-allow-ibss-mixed.patch
@@ -16,7 +16,7 @@ and we should ignore this.
 
 --- a/net/wireless/core.c
 +++ b/net/wireless/core.c
-@@ -654,21 +654,6 @@ static int wiphy_verify_combinations(str
+@@ -678,21 +678,6 @@ int wiphy_verify_iface_combinations(stru
  				    c->limits[j].max > 1))
  				return -EINVAL;
  
diff --git a/package/kernel/mac80211/patches/subsys/230-avoid-crashing-missing-band.patch b/package/kernel/mac80211/patches/subsys/230-avoid-crashing-missing-band.patch
index 9e9e3844b7ac5b..b6b3f6af8f17f9 100644
--- a/package/kernel/mac80211/patches/subsys/230-avoid-crashing-missing-band.patch
+++ b/package/kernel/mac80211/patches/subsys/230-avoid-crashing-missing-band.patch
@@ -18,7 +18,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2439,6 +2439,13 @@ static void sta_stats_decode_rate(struct
+@@ -2446,6 +2446,13 @@ static void sta_stats_decode_rate(struct
  
  		sband = local->hw.wiphy->bands[band];
  
diff --git a/package/kernel/mac80211/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch b/package/kernel/mac80211/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
index edec97cce94022..77bc2c0df2384c 100644
--- a/package/kernel/mac80211/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
+++ b/package/kernel/mac80211/patches/subsys/301-mac80211-sta-randomize-BA-session-dialog-token-alloc.patch
@@ -28,7 +28,7 @@ Signed-off-by: Johannes Berg <johannes.berg@intel.com>
 
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -565,6 +565,7 @@ __sta_info_alloc(struct ieee80211_sub_if
+@@ -564,6 +564,7 @@ __sta_info_alloc(struct ieee80211_sub_if
  	spin_lock_init(&sta->ps_lock);
  	INIT_WORK(&sta->drv_deliver_wk, sta_deliver_ps_frames);
  	wiphy_work_init(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
diff --git a/package/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch b/package/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch
index 6cf46ce7e51459..a9929875014756 100644
--- a/package/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch
+++ b/package/kernel/mac80211/patches/subsys/305-mac80211-increase-quantum-for-airtime-scheduler.patch
@@ -23,7 +23,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/net/mac80211/tx.c
 +++ b/net/mac80211/tx.c
-@@ -4081,7 +4081,7 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -4082,7 +4082,7 @@ struct ieee80211_txq *ieee80211_next_txq
  
  		if (deficit < 0)
  			sta->airtime[txqi->txq.ac].deficit +=
@@ -32,7 +32,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  		if (deficit < 0 || !aql_check) {
  			list_move_tail(&txqi->schedule_order,
-@@ -4224,7 +4224,8 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4227,7 +4227,8 @@ bool ieee80211_txq_may_transmit(struct i
  		}
  		sta = container_of(iter->txq.sta, struct sta_info, sta);
  		if (ieee80211_sta_deficit(sta, ac) < 0)
@@ -42,7 +42,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		list_move_tail(&iter->schedule_order, &local->active_txqs[ac]);
  	}
  
-@@ -4232,7 +4233,7 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4235,7 +4236,7 @@ bool ieee80211_txq_may_transmit(struct i
  	if (sta->airtime[ac].deficit >= 0)
  		goto out;
  
diff --git a/package/kernel/mac80211/patches/subsys/310-cfg80211-allow-grace-period-for-DFS-available-after-.patch b/package/kernel/mac80211/patches/subsys/310-cfg80211-allow-grace-period-for-DFS-available-after-.patch
index 7e9be59e044348..ae65ff082fa377 100644
--- a/package/kernel/mac80211/patches/subsys/310-cfg80211-allow-grace-period-for-DFS-available-after-.patch
+++ b/package/kernel/mac80211/patches/subsys/310-cfg80211-allow-grace-period-for-DFS-available-after-.patch
@@ -11,7 +11,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -187,6 +187,8 @@ enum ieee80211_channel_flags {
+@@ -190,6 +190,8 @@ enum ieee80211_channel_flags {
   * @dfs_state: current state of this channel. Only relevant if radar is required
   *	on this channel.
   * @dfs_state_entered: timestamp (jiffies) when the dfs state was entered.
@@ -20,7 +20,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
   * @dfs_cac_ms: DFS CAC time in milliseconds, this is valid for DFS channels.
   * @psd: power spectral density (in dBm)
   */
-@@ -204,6 +206,7 @@ struct ieee80211_channel {
+@@ -207,6 +209,7 @@ struct ieee80211_channel {
  	int orig_mag, orig_mpwr;
  	enum nl80211_dfs_state dfs_state;
  	unsigned long dfs_state_entered;
@@ -113,7 +113,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  {
 --- a/net/wireless/core.h
 +++ b/net/wireless/core.h
-@@ -467,6 +467,8 @@ void cfg80211_set_dfs_state(struct wiphy
+@@ -475,6 +475,8 @@ void cfg80211_set_dfs_state(struct wiphy
  			    enum nl80211_dfs_state dfs_state);
  
  void cfg80211_dfs_channels_update_work(struct work_struct *work);
@@ -124,7 +124,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/net/wireless/mlme.c
 +++ b/net/wireless/mlme.c
-@@ -1037,6 +1037,8 @@ void cfg80211_dfs_channels_update_work(s
+@@ -1032,6 +1032,8 @@ void cfg80211_dfs_channels_update_work(s
  			if (c->dfs_state == NL80211_DFS_UNAVAILABLE) {
  				time_dfs_update = IEEE80211_DFS_MIN_NOP_TIME_MS;
  				radar_event = NL80211_RADAR_NOP_FINISHED;
@@ -133,7 +133,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			} else {
  				if (regulatory_pre_cac_allowed(wiphy) ||
  				    cfg80211_any_wiphy_oper_chan(wiphy, c))
-@@ -1044,11 +1046,10 @@ void cfg80211_dfs_channels_update_work(s
+@@ -1039,11 +1041,10 @@ void cfg80211_dfs_channels_update_work(s
  
  				time_dfs_update = REG_PRE_CAC_EXPIRY_GRACE_MS;
  				radar_event = NL80211_RADAR_PRE_CAC_EXPIRED;
diff --git a/package/kernel/mac80211/patches/subsys/320-mac80211-add-AQL-support-for-broadcast-packets.patch b/package/kernel/mac80211/patches/subsys/320-mac80211-add-AQL-support-for-broadcast-packets.patch
index c03f40d9b4f5c2..6ec52af9a47539 100644
--- a/package/kernel/mac80211/patches/subsys/320-mac80211-add-AQL-support-for-broadcast-packets.patch
+++ b/package/kernel/mac80211/patches/subsys/320-mac80211-add-AQL-support-for-broadcast-packets.patch
@@ -12,7 +12,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -3423,6 +3423,7 @@ enum wiphy_params_flags {
+@@ -3426,6 +3426,7 @@ enum wiphy_params_flags {
  /* The per TXQ device queue limit in airtime */
  #define IEEE80211_DEFAULT_AQL_TXQ_LIMIT_L	5000
  #define IEEE80211_DEFAULT_AQL_TXQ_LIMIT_H	12000
@@ -70,7 +70,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1351,10 +1351,12 @@ struct ieee80211_local {
+@@ -1360,10 +1360,12 @@ struct ieee80211_local {
  	spinlock_t handle_wake_tx_queue_lock;
  
  	u16 airtime_flags;
@@ -85,7 +85,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	const struct ieee80211_ops *ops;
 --- a/net/mac80211/main.c
 +++ b/net/mac80211/main.c
-@@ -952,6 +952,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
+@@ -954,6 +954,7 @@ struct ieee80211_hw *ieee80211_alloc_hw_
  	spin_lock_init(&local->rx_path_lock);
  	spin_lock_init(&local->queue_stop_reason_lock);
  
@@ -95,7 +95,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		spin_lock_init(&local->active_txq_lock[i]);
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
-@@ -2353,13 +2353,28 @@ EXPORT_SYMBOL(ieee80211_sta_recalc_aggre
+@@ -2360,13 +2360,28 @@ EXPORT_SYMBOL(ieee80211_sta_recalc_aggre
  
  void ieee80211_sta_update_pending_airtime(struct ieee80211_local *local,
  					  struct sta_info *sta, u8 ac,
@@ -136,7 +136,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		spin_unlock_irqrestore(&local->ack_status_lock, flags);
  
  		if (id >= 0) {
-@@ -3982,20 +3982,20 @@ begin:
+@@ -3983,20 +3983,20 @@ begin:
  encap_out:
  	info->control.vif = vif;
  
@@ -167,7 +167,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	}
  
  	return skb;
-@@ -4047,6 +4047,7 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -4048,6 +4048,7 @@ struct ieee80211_txq *ieee80211_next_txq
  	struct ieee80211_txq *ret = NULL;
  	struct txq_info *txqi = NULL, *head = NULL;
  	bool found_eligible_txq = false;
@@ -175,7 +175,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	spin_lock_bh(&local->active_txq_lock[ac]);
  
-@@ -4070,26 +4071,26 @@ struct ieee80211_txq *ieee80211_next_txq
+@@ -4071,26 +4072,26 @@ struct ieee80211_txq *ieee80211_next_txq
  	if (!head)
  		head = txqi;
  
@@ -214,7 +214,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (txqi->schedule_round == local->schedule_round[ac])
  		goto out;
  
-@@ -4154,7 +4155,8 @@ bool ieee80211_txq_airtime_check(struct
+@@ -4157,7 +4158,8 @@ bool ieee80211_txq_airtime_check(struct
  		return true;
  
  	if (!txq->sta)
@@ -224,7 +224,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	if (unlikely(txq->tid == IEEE80211_NUM_TIDS))
  		return true;
-@@ -4203,15 +4205,15 @@ bool ieee80211_txq_may_transmit(struct i
+@@ -4206,15 +4208,15 @@ bool ieee80211_txq_may_transmit(struct i
  
  	spin_lock_bh(&local->active_txq_lock[ac]);
  
diff --git a/package/kernel/mac80211/patches/subsys/321-wifi-mac80211-do-not-pass-a-stopped-vif-to-the-drive.patch b/package/kernel/mac80211/patches/subsys/321-wifi-mac80211-do-not-pass-a-stopped-vif-to-the-drive.patch
deleted file mode 100644
index f48fa38e5e96ab..00000000000000
--- a/package/kernel/mac80211/patches/subsys/321-wifi-mac80211-do-not-pass-a-stopped-vif-to-the-drive.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Wed, 2 Oct 2024 11:45:35 +0200
-Subject: [PATCH] wifi: mac80211: do not pass a stopped vif to the driver in
- .get_txpower
-
-Avoid potentially crashing in the driver because of uninitialized private data
-
-Fixes: 5b3dc42b1b0d ("mac80211: add support for driver tx power reporting")
-Cc: stable@vger.kernel.org
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -3134,7 +3134,8 @@ static int ieee80211_get_tx_power(struct
- 	struct ieee80211_local *local = wiphy_priv(wiphy);
- 	struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
- 
--	if (local->ops->get_txpower)
-+	if (local->ops->get_txpower &&
-+	    (sdata->flags & IEEE80211_SDATA_IN_DRIVER))
- 		return drv_get_txpower(local, sdata, dbm);
- 
- 	if (local->emulate_chanctx)
diff --git a/package/kernel/mac80211/patches/subsys/350-wifi-cfg80211-add-option-for-vif-allowed-radios.patch b/package/kernel/mac80211/patches/subsys/330-wifi-cfg80211-add-option-for-vif-allowed-radios.patch
similarity index 86%
rename from package/kernel/mac80211/patches/subsys/350-wifi-cfg80211-add-option-for-vif-allowed-radios.patch
rename to package/kernel/mac80211/patches/subsys/330-wifi-cfg80211-add-option-for-vif-allowed-radios.patch
index d5b42f3a3a519d..dca56f8680fdc8 100644
--- a/package/kernel/mac80211/patches/subsys/350-wifi-cfg80211-add-option-for-vif-allowed-radios.patch
+++ b/package/kernel/mac80211/patches/subsys/330-wifi-cfg80211-add-option-for-vif-allowed-radios.patch
@@ -23,15 +23,15 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -6227,6 +6227,7 @@ enum ieee80211_ap_reg_power {
+@@ -6274,6 +6274,7 @@ enum ieee80211_ap_reg_power {
   *	entered.
-  * @links[].cac_time_ms: CAC time in ms
+  * @links.cac_time_ms: CAC time in ms
   * @valid_links: bitmap describing what elements of @links are valid
 + * @radio_mask: Bitmask of radios that this interface is allowed to operate on.
   */
  struct wireless_dev {
  	struct wiphy *wiphy;
-@@ -6339,6 +6340,8 @@ struct wireless_dev {
+@@ -6386,6 +6387,8 @@ struct wireless_dev {
  		unsigned int cac_time_ms;
  	} links[IEEE80211_MLD_MAX_NUM_LINKS];
  	u16 valid_links;
@@ -40,7 +40,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  };
  
  static inline const u8 *wdev_address(struct wireless_dev *wdev)
-@@ -6525,6 +6528,17 @@ bool cfg80211_radio_chandef_valid(const
+@@ -6572,6 +6575,17 @@ bool cfg80211_radio_chandef_valid(const
  				  const struct cfg80211_chan_def *chandef);
  
  /**
@@ -81,7 +81,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	__NL80211_ATTR_AFTER_LAST,
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -829,6 +829,7 @@ static const struct nla_policy nl80211_p
+@@ -832,6 +832,7 @@ static const struct nla_policy nl80211_p
  	[NL80211_ATTR_MLO_TTLM_DLINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
  	[NL80211_ATTR_MLO_TTLM_ULINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
  	[NL80211_ATTR_ASSOC_SPP_AMSDU] = { .type = NLA_FLAG },
@@ -89,7 +89,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  };
  
  /* policy for the key attributes */
-@@ -3996,7 +3997,8 @@ static int nl80211_send_iface(struct sk_
+@@ -4003,7 +4004,8 @@ static int nl80211_send_iface(struct sk_
  	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
  			rdev->devlist_generation ^
  			(cfg80211_rdev_list_generation << 2)) ||
@@ -99,7 +99,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		goto nla_put_failure;
  
  	if (rdev->ops->get_channel && !wdev->valid_links) {
-@@ -4312,6 +4314,29 @@ static int nl80211_valid_4addr(struct cf
+@@ -4324,6 +4326,29 @@ static int nl80211_valid_4addr(struct cf
  	return -EOPNOTSUPP;
  }
  
@@ -129,7 +129,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
  {
  	struct cfg80211_registered_device *rdev = info->user_ptr[0];
-@@ -4319,6 +4344,8 @@ static int nl80211_set_interface(struct
+@@ -4331,6 +4356,8 @@ static int nl80211_set_interface(struct
  	int err;
  	enum nl80211_iftype otype, ntype;
  	struct net_device *dev = info->user_ptr[1];
@@ -138,7 +138,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	bool change = false;
  
  	memset(&params, 0, sizeof(params));
-@@ -4332,8 +4359,6 @@ static int nl80211_set_interface(struct
+@@ -4344,8 +4371,6 @@ static int nl80211_set_interface(struct
  	}
  
  	if (info->attrs[NL80211_ATTR_MESH_ID]) {
@@ -147,7 +147,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		if (ntype != NL80211_IFTYPE_MESH_POINT)
  			return -EINVAL;
  		if (otype != NL80211_IFTYPE_MESH_POINT)
-@@ -4364,6 +4389,12 @@ static int nl80211_set_interface(struct
+@@ -4376,6 +4401,12 @@ static int nl80211_set_interface(struct
  	if (err > 0)
  		change = true;
  
@@ -160,7 +160,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (change)
  		err = cfg80211_change_iface(rdev, dev, ntype, &params);
  	else
-@@ -4372,11 +4403,11 @@ static int nl80211_set_interface(struct
+@@ -4384,11 +4415,11 @@ static int nl80211_set_interface(struct
  	if (!err && params.use_4addr != -1)
  		dev->ieee80211_ptr->use_4addr = params.use_4addr;
  
@@ -175,7 +175,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	return err;
  }
-@@ -4387,6 +4418,7 @@ static int _nl80211_new_interface(struct
+@@ -4399,6 +4430,7 @@ static int _nl80211_new_interface(struct
  	struct vif_params params;
  	struct wireless_dev *wdev;
  	struct sk_buff *msg;
@@ -183,7 +183,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	int err;
  	enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
  
-@@ -4424,6 +4456,10 @@ static int _nl80211_new_interface(struct
+@@ -4436,6 +4468,10 @@ static int _nl80211_new_interface(struct
  	if (err < 0)
  		return err;
  
@@ -194,7 +194,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
  	if (!msg)
  		return -ENOMEM;
-@@ -4465,6 +4501,9 @@ static int _nl80211_new_interface(struct
+@@ -4477,6 +4513,9 @@ static int _nl80211_new_interface(struct
  		break;
  	}
  
@@ -204,7 +204,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
  			       rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
  		nlmsg_free(msg);
-@@ -9180,6 +9219,9 @@ static bool cfg80211_off_channel_oper_al
+@@ -9192,6 +9231,9 @@ static bool cfg80211_off_channel_oper_al
  
  	lockdep_assert_wiphy(wdev->wiphy);
  
@@ -214,7 +214,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!cfg80211_beaconing_iface_active(wdev))
  		return true;
  
-@@ -9392,7 +9434,8 @@ static int nl80211_trigger_scan(struct s
+@@ -9404,7 +9446,8 @@ static int nl80211_trigger_scan(struct s
  			}
  
  			/* ignore disabled channels */
@@ -224,7 +224,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  				continue;
  
  			request->channels[i] = chan;
-@@ -9412,7 +9455,8 @@ static int nl80211_trigger_scan(struct s
+@@ -9424,7 +9467,8 @@ static int nl80211_trigger_scan(struct s
  
  				chan = &wiphy->bands[band]->channels[j];
  
@@ -236,7 +236,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  				request->channels[i] = chan;
 --- a/net/wireless/scan.c
 +++ b/net/wireless/scan.c
-@@ -956,7 +956,8 @@ static int cfg80211_scan_6ghz(struct cfg
+@@ -953,7 +953,8 @@ static int cfg80211_scan_6ghz(struct cfg
  		struct ieee80211_channel *chan =
  			ieee80211_get_channel(&rdev->wiphy, ap->center_freq);
  
@@ -246,7 +246,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			continue;
  
  		for (i = 0; i < rdev_req->n_channels; i++) {
-@@ -3490,9 +3491,12 @@ int cfg80211_wext_siwscan(struct net_dev
+@@ -3512,9 +3513,12 @@ int cfg80211_wext_siwscan(struct net_dev
  			continue;
  
  		for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
@@ -263,7 +263,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			/* If we have a wireless request structure and the
 --- a/net/wireless/util.c
 +++ b/net/wireless/util.c
-@@ -2923,3 +2923,32 @@ bool cfg80211_radio_chandef_valid(const
+@@ -2970,3 +2970,32 @@ bool cfg80211_radio_chandef_valid(const
  	return true;
  }
  EXPORT_SYMBOL(cfg80211_radio_chandef_valid);
@@ -298,7 +298,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +EXPORT_SYMBOL(cfg80211_wdev_channel_allowed);
 --- a/net/wireless/core.c
 +++ b/net/wireless/core.c
-@@ -1415,6 +1415,8 @@ void cfg80211_init_wdev(struct wireless_
+@@ -1431,6 +1431,8 @@ void cfg80211_init_wdev(struct wireless_
  	/* allow mac80211 to determine the timeout */
  	wdev->ps_timeout = -1;
  
diff --git a/package/kernel/mac80211/patches/subsys/330-wifi-mac80211-introduce-EHT-rate-support-in-AQL-airt.patch b/package/kernel/mac80211/patches/subsys/330-wifi-mac80211-introduce-EHT-rate-support-in-AQL-airt.patch
deleted file mode 100644
index 0a3c8ec53b21a3..00000000000000
--- a/package/kernel/mac80211/patches/subsys/330-wifi-mac80211-introduce-EHT-rate-support-in-AQL-airt.patch
+++ /dev/null
@@ -1,233 +0,0 @@
-From: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
-Date: Wed, 4 Sep 2024 19:12:56 +0800
-Subject: [PATCH] wifi: mac80211: introduce EHT rate support in AQL airtime
-
-Add definitions related to EHT mode and airtime calculation
-according to the 802.11BE_D4.0.
-
-Co-developed-by: Bo Jiao <Bo.Jiao@mediatek.com>
-Signed-off-by: Bo Jiao <Bo.Jiao@mediatek.com>
-Signed-off-by: Deren Wu <deren.wu@mediatek.com>
-Signed-off-by: Quan Zhou <quan.zhou@mediatek.com>
-Signed-off-by: Ming Yen Hsieh <mingyen.hsieh@mediatek.com>
-Link: https://patch.msgid.link/20240904111256.11734-1-mingyen.hsieh@mediatek.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/airtime.c
-+++ b/net/mac80211/airtime.c
-@@ -55,10 +55,21 @@
- #define HE_DURATION_S(shift, streams, gi, bps)		\
- 	(HE_DURATION(streams, gi, bps) >> shift)
- 
-+/* gi in HE/EHT is identical. It matches enum nl80211_eht_gi as well */
-+#define EHT_GI_08 HE_GI_08
-+#define EHT_GI_16 HE_GI_16
-+#define EHT_GI_32 HE_GI_32
-+
-+#define EHT_DURATION(streams, gi, bps)			\
-+	HE_DURATION(streams, gi, bps)
-+#define EHT_DURATION_S(shift, streams, gi, bps)		\
-+	HE_DURATION_S(shift, streams, gi, bps)
-+
- #define BW_20			0
- #define BW_40			1
- #define BW_80			2
- #define BW_160			3
-+#define BW_320			4
- 
- /*
-  * Define group sort order: HT40 -> SGI -> #streams
-@@ -68,17 +79,26 @@
- #define IEEE80211_VHT_STREAM_GROUPS	8 /* BW(=4) * SGI(=2) */
- 
- #define IEEE80211_HE_MAX_STREAMS	8
-+#define IEEE80211_HE_STREAM_GROUPS	12 /* BW(=4) * GI(=3) */
-+
-+#define IEEE80211_EHT_MAX_STREAMS	8
-+#define IEEE80211_EHT_STREAM_GROUPS	15 /* BW(=5) * GI(=3) */
- 
- #define IEEE80211_HT_GROUPS_NB	(IEEE80211_MAX_STREAMS *	\
- 				 IEEE80211_HT_STREAM_GROUPS)
- #define IEEE80211_VHT_GROUPS_NB	(IEEE80211_MAX_STREAMS *	\
- 					 IEEE80211_VHT_STREAM_GROUPS)
-+#define IEEE80211_HE_GROUPS_NB	(IEEE80211_HE_MAX_STREAMS *	\
-+				 IEEE80211_HE_STREAM_GROUPS)
-+#define IEEE80211_EHT_GROUPS_NB	(IEEE80211_EHT_MAX_STREAMS *	\
-+				 IEEE80211_EHT_STREAM_GROUPS)
- 
- #define IEEE80211_HT_GROUP_0	0
- #define IEEE80211_VHT_GROUP_0	(IEEE80211_HT_GROUP_0 + IEEE80211_HT_GROUPS_NB)
- #define IEEE80211_HE_GROUP_0	(IEEE80211_VHT_GROUP_0 + IEEE80211_VHT_GROUPS_NB)
-+#define IEEE80211_EHT_GROUP_0	(IEEE80211_HE_GROUP_0 + IEEE80211_HE_GROUPS_NB)
- 
--#define MCS_GROUP_RATES		12
-+#define MCS_GROUP_RATES		14
- 
- #define HT_GROUP_IDX(_streams, _sgi, _ht40)	\
- 	IEEE80211_HT_GROUP_0 +			\
-@@ -203,6 +223,69 @@
- #define HE_GROUP(_streams, _gi, _bw)					\
- 	__HE_GROUP(_streams, _gi, _bw,				\
- 		   HE_GROUP_SHIFT(_streams, _gi, _bw))
-+
-+#define EHT_BW2VBPS(_bw, r5, r4, r3, r2, r1)					\
-+	((_bw) == BW_320 ? r5 : BW2VBPS(_bw, r4, r3, r2, r1))
-+
-+#define EHT_GROUP_IDX(_streams, _gi, _bw)				\
-+	(IEEE80211_EHT_GROUP_0 +					\
-+	 IEEE80211_EHT_MAX_STREAMS * 3 * (_bw) +			\
-+	 IEEE80211_EHT_MAX_STREAMS * (_gi) +				\
-+	 (_streams) - 1)
-+
-+#define __EHT_GROUP(_streams, _gi, _bw, _s)						\
-+	[EHT_GROUP_IDX(_streams, _gi, _bw)] = {						\
-+	.shift = _s,									\
-+	.duration = {									\
-+		EHT_DURATION_S(_s, _streams, _gi,					\
-+			       EHT_BW2VBPS(_bw,  1960,   980,  490,  234,  117)),	\
-+		EHT_DURATION_S(_s, _streams, _gi,					\
-+			       EHT_BW2VBPS(_bw,  3920,  1960,  980,  468,  234)),	\
-+		EHT_DURATION_S(_s, _streams, _gi,					\
-+			       EHT_BW2VBPS(_bw,  5880,  2937, 1470,  702,  351)),	\
-+		EHT_DURATION_S(_s, _streams, _gi,					\
-+			       EHT_BW2VBPS(_bw,  7840,  3920, 1960,  936,  468)),	\
-+		EHT_DURATION_S(_s, _streams, _gi,					\
-+			       EHT_BW2VBPS(_bw, 11760,  5880, 2940, 1404,  702)),	\
-+		EHT_DURATION_S(_s, _streams, _gi,					\
-+			       EHT_BW2VBPS(_bw, 15680,  7840, 3920, 1872,  936)),	\
-+		EHT_DURATION_S(_s, _streams, _gi,					\
-+			       EHT_BW2VBPS(_bw, 17640,  8820, 4410, 2106, 1053)),	\
-+		EHT_DURATION_S(_s, _streams, _gi,					\
-+			       EHT_BW2VBPS(_bw, 19600,  9800, 4900, 2340, 1170)),	\
-+		EHT_DURATION_S(_s, _streams, _gi,					\
-+			       EHT_BW2VBPS(_bw, 23520, 11760, 5880, 2808, 1404)),	\
-+		EHT_DURATION_S(_s, _streams, _gi,					\
-+			       EHT_BW2VBPS(_bw, 26133, 13066, 6533, 3120, 1560)),	\
-+		EHT_DURATION_S(_s, _streams, _gi,					\
-+			       EHT_BW2VBPS(_bw, 29400, 14700, 7350, 3510, 1755)),	\
-+		EHT_DURATION_S(_s, _streams, _gi,					\
-+			       EHT_BW2VBPS(_bw, 32666, 16333, 8166, 3900, 1950)),	\
-+		EHT_DURATION_S(_s, _streams, _gi,					\
-+			       EHT_BW2VBPS(_bw, 35280, 17640, 8820, 4212, 2106)),	\
-+		EHT_DURATION_S(_s, _streams, _gi,					\
-+			       EHT_BW2VBPS(_bw, 39200, 19600, 9800, 4680, 2340))	\
-+		}									\
-+}
-+
-+#define EHT_GROUP_SHIFT(_streams, _gi, _bw)						\
-+	GROUP_SHIFT(EHT_DURATION(_streams, _gi,						\
-+				 EHT_BW2VBPS(_bw, 1960, 980, 490, 234, 117)))
-+
-+#define EHT_GROUP(_streams, _gi, _bw)					\
-+	__EHT_GROUP(_streams, _gi, _bw,				\
-+		   EHT_GROUP_SHIFT(_streams, _gi, _bw))
-+
-+#define EHT_GROUP_RANGE(_gi, _bw)	\
-+	EHT_GROUP(1, _gi, _bw),		\
-+	EHT_GROUP(2, _gi, _bw),		\
-+	EHT_GROUP(3, _gi, _bw),		\
-+	EHT_GROUP(4, _gi, _bw),		\
-+	EHT_GROUP(5, _gi, _bw),		\
-+	EHT_GROUP(6, _gi, _bw),		\
-+	EHT_GROUP(7, _gi, _bw),		\
-+	EHT_GROUP(8, _gi, _bw)
-+
- struct mcs_group {
- 	u8 shift;
- 	u16 duration[MCS_GROUP_RATES];
-@@ -376,6 +459,26 @@ static const struct mcs_group airtime_mc
- 	HE_GROUP(6, HE_GI_32, BW_160),
- 	HE_GROUP(7, HE_GI_32, BW_160),
- 	HE_GROUP(8, HE_GI_32, BW_160),
-+
-+	EHT_GROUP_RANGE(EHT_GI_08, BW_20),
-+	EHT_GROUP_RANGE(EHT_GI_16, BW_20),
-+	EHT_GROUP_RANGE(EHT_GI_32, BW_20),
-+
-+	EHT_GROUP_RANGE(EHT_GI_08, BW_40),
-+	EHT_GROUP_RANGE(EHT_GI_16, BW_40),
-+	EHT_GROUP_RANGE(EHT_GI_32, BW_40),
-+
-+	EHT_GROUP_RANGE(EHT_GI_08, BW_80),
-+	EHT_GROUP_RANGE(EHT_GI_16, BW_80),
-+	EHT_GROUP_RANGE(EHT_GI_32, BW_80),
-+
-+	EHT_GROUP_RANGE(EHT_GI_08, BW_160),
-+	EHT_GROUP_RANGE(EHT_GI_16, BW_160),
-+	EHT_GROUP_RANGE(EHT_GI_32, BW_160),
-+
-+	EHT_GROUP_RANGE(EHT_GI_08, BW_320),
-+	EHT_GROUP_RANGE(EHT_GI_16, BW_320),
-+	EHT_GROUP_RANGE(EHT_GI_32, BW_320),
- };
- 
- static u32
-@@ -422,6 +525,9 @@ static u32 ieee80211_get_rate_duration(s
- 	case RATE_INFO_BW_160:
- 		bw = BW_160;
- 		break;
-+	case RATE_INFO_BW_320:
-+		bw = BW_320;
-+		break;
- 	default:
- 		WARN_ON_ONCE(1);
- 		return 0;
-@@ -443,14 +549,27 @@ static u32 ieee80211_get_rate_duration(s
- 		idx = status->rate_idx;
- 		group = HE_GROUP_IDX(streams, status->he_gi, bw);
- 		break;
-+	case RX_ENC_EHT:
-+		streams = status->nss;
-+		idx = status->rate_idx;
-+		group = EHT_GROUP_IDX(streams, status->eht.gi, bw);
-+		break;
- 	default:
- 		WARN_ON_ONCE(1);
- 		return 0;
- 	}
- 
--	if (WARN_ON_ONCE((status->encoding != RX_ENC_HE && streams > 4) ||
--			 (status->encoding == RX_ENC_HE && streams > 8)))
--		return 0;
-+	switch (status->encoding) {
-+	case RX_ENC_EHT:
-+	case RX_ENC_HE:
-+		if (WARN_ON_ONCE(streams > 8))
-+			return 0;
-+		break;
-+	default:
-+		if (WARN_ON_ONCE(streams > 4))
-+			return 0;
-+		break;
-+	}
- 
- 	if (idx >= MCS_GROUP_RATES)
- 		return 0;
-@@ -517,7 +636,9 @@ static bool ieee80211_fill_rate_info(str
- 	stat->nss = ri->nss;
- 	stat->rate_idx = ri->mcs;
- 
--	if (ri->flags & RATE_INFO_FLAGS_HE_MCS)
-+	if (ri->flags & RATE_INFO_FLAGS_EHT_MCS)
-+		stat->encoding = RX_ENC_EHT;
-+	else if (ri->flags & RATE_INFO_FLAGS_HE_MCS)
- 		stat->encoding = RX_ENC_HE;
- 	else if (ri->flags & RATE_INFO_FLAGS_VHT_MCS)
- 		stat->encoding = RX_ENC_VHT;
-@@ -529,7 +650,14 @@ static bool ieee80211_fill_rate_info(str
- 	if (ri->flags & RATE_INFO_FLAGS_SHORT_GI)
- 		stat->enc_flags |= RX_ENC_FLAG_SHORT_GI;
- 
--	stat->he_gi = ri->he_gi;
-+	switch (stat->encoding) {
-+	case RX_ENC_EHT:
-+		stat->eht.gi = ri->eht_gi;
-+		break;
-+	default:
-+		stat->he_gi = ri->he_gi;
-+		break;
-+	}
- 
- 	if (stat->encoding != RX_ENC_LEGACY)
- 		return true;
diff --git a/package/kernel/mac80211/patches/subsys/331-wifi-cfg80211-check-radio-iface-combination-for-mult.patch b/package/kernel/mac80211/patches/subsys/331-wifi-cfg80211-check-radio-iface-combination-for-mult.patch
deleted file mode 100644
index 76c351aa831f59..00000000000000
--- a/package/kernel/mac80211/patches/subsys/331-wifi-cfg80211-check-radio-iface-combination-for-mult.patch
+++ /dev/null
@@ -1,122 +0,0 @@
-From: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
-Date: Tue, 17 Sep 2024 19:32:39 +0530
-Subject: [PATCH] wifi: cfg80211: check radio iface combination for multi radio
- per wiphy
-
-Currently, wiphy_verify_combinations() fails for the multi-radio per wiphy
-due to the condition check on new global interface combination that DFS
-only works on one channel. In a multi-radio scenario, new global interface
-combination encompasses the capabilities of all radio combinations, so it
-supports more than one channel with DFS. For multi-radio per wiphy,
-interface combination verification needs to be performed for radio specific
-interface combinations. This is necessary as the new global interface
-combination combines the capabilities of all radio combinations.
-
-Fixes: a01b1e9f9955 ("wifi: mac80211: add support for DFS with multiple radios")
-Signed-off-by: Karthikeyan Periyasamy <quic_periyasa@quicinc.com>
----
-
---- a/net/wireless/core.c
-+++ b/net/wireless/core.c
-@@ -599,16 +599,20 @@ use_default_name:
- }
- EXPORT_SYMBOL(wiphy_new_nm);
- 
--static int wiphy_verify_combinations(struct wiphy *wiphy)
-+static
-+int wiphy_verify_iface_combinations(struct wiphy *wiphy,
-+				    const struct ieee80211_iface_combination *iface_comb,
-+				    int n_iface_comb,
-+				    bool combined_radio)
- {
- 	const struct ieee80211_iface_combination *c;
- 	int i, j;
- 
--	for (i = 0; i < wiphy->n_iface_combinations; i++) {
-+	for (i = 0; i < n_iface_comb; i++) {
- 		u32 cnt = 0;
- 		u16 all_iftypes = 0;
- 
--		c = &wiphy->iface_combinations[i];
-+		c = &iface_comb[i];
- 
- 		/*
- 		 * Combinations with just one interface aren't real,
-@@ -621,9 +625,13 @@ static int wiphy_verify_combinations(str
- 		if (WARN_ON(!c->num_different_channels))
- 			return -EINVAL;
- 
--		/* DFS only works on one channel. */
--		if (WARN_ON(c->radar_detect_widths &&
--			    (c->num_different_channels > 1)))
-+		/* DFS only works on one channel. Avoid this check
-+		 * for multi-radio global combination, since it hold
-+		 * the capabilities of all radio combinations.
-+		 */
-+		if (!combined_radio &&
-+		    WARN_ON(c->radar_detect_widths &&
-+			    c->num_different_channels > 1))
- 			return -EINVAL;
- 
- 		if (WARN_ON(!c->n_limits))
-@@ -644,13 +652,21 @@ static int wiphy_verify_combinations(str
- 			if (WARN_ON(wiphy->software_iftypes & types))
- 				return -EINVAL;
- 
--			/* Only a single P2P_DEVICE can be allowed */
--			if (WARN_ON(types & BIT(NL80211_IFTYPE_P2P_DEVICE) &&
-+			/* Only a single P2P_DEVICE can be allowed, avoid this
-+			 * check for multi-radio global combination, since it
-+			 * hold the capabilities of all radio combinations.
-+			 */
-+			if (!combined_radio &&
-+			    WARN_ON(types & BIT(NL80211_IFTYPE_P2P_DEVICE) &&
- 				    c->limits[j].max > 1))
- 				return -EINVAL;
- 
--			/* Only a single NAN can be allowed */
--			if (WARN_ON(types & BIT(NL80211_IFTYPE_NAN) &&
-+			/* Only a single NAN can be allowed, avoid this
-+			 * check for multi-radio global combination, since it
-+			 * hold the capabilities of all radio combinations.
-+			 */
-+			if (!combined_radio &&
-+			    WARN_ON(types & BIT(NL80211_IFTYPE_NAN) &&
- 				    c->limits[j].max > 1))
- 				return -EINVAL;
- 
-@@ -674,6 +690,34 @@ static int wiphy_verify_combinations(str
- 	return 0;
- }
- 
-+static int wiphy_verify_combinations(struct wiphy *wiphy)
-+{
-+	int i, ret;
-+	bool combined_radio = false;
-+
-+	if (wiphy->n_radio) {
-+		for (i = 0; i < wiphy->n_radio; i++) {
-+			const struct wiphy_radio *radio = &wiphy->radio[i];
-+
-+			ret = wiphy_verify_iface_combinations(wiphy,
-+							      radio->iface_combinations,
-+							      radio->n_iface_combinations,
-+							      false);
-+			if (ret)
-+				return ret;
-+		}
-+
-+		combined_radio = true;
-+	}
-+
-+	ret = wiphy_verify_iface_combinations(wiphy,
-+					      wiphy->iface_combinations,
-+					      wiphy->n_iface_combinations,
-+					      combined_radio);
-+
-+	return ret;
-+}
-+
- int wiphy_register(struct wiphy *wiphy)
- {
- 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
diff --git a/package/kernel/mac80211/patches/subsys/351-wifi-mac80211-use-vif-radio-mask-to-limit-ibss-scan-.patch b/package/kernel/mac80211/patches/subsys/331-wifi-mac80211-use-vif-radio-mask-to-limit-ibss-scan-.patch
similarity index 88%
rename from package/kernel/mac80211/patches/subsys/351-wifi-mac80211-use-vif-radio-mask-to-limit-ibss-scan-.patch
rename to package/kernel/mac80211/patches/subsys/331-wifi-mac80211-use-vif-radio-mask-to-limit-ibss-scan-.patch
index 7363c3873f6a2e..fd31a00dc5d7a9 100644
--- a/package/kernel/mac80211/patches/subsys/351-wifi-mac80211-use-vif-radio-mask-to-limit-ibss-scan-.patch
+++ b/package/kernel/mac80211/patches/subsys/331-wifi-mac80211-use-vif-radio-mask-to-limit-ibss-scan-.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/scan.c
 +++ b/net/mac80211/scan.c
-@@ -1178,14 +1178,14 @@ int ieee80211_request_ibss_scan(struct i
+@@ -1175,14 +1175,14 @@ int ieee80211_request_ibss_scan(struct i
  				unsigned int n_channels)
  {
  	struct ieee80211_local *local = sdata->local;
@@ -27,7 +27,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	/* fill internal scan request */
  	if (!channels) {
-@@ -1202,7 +1202,9 @@ int ieee80211_request_ibss_scan(struct i
+@@ -1199,7 +1199,9 @@ int ieee80211_request_ibss_scan(struct i
  				    &local->hw.wiphy->bands[band]->channels[i];
  
  				if (tmp_ch->flags & (IEEE80211_CHAN_NO_IR |
@@ -38,7 +38,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  					continue;
  
  				local->int_scan_req->channels[n_ch] = tmp_ch;
-@@ -1211,21 +1213,23 @@ int ieee80211_request_ibss_scan(struct i
+@@ -1208,21 +1210,23 @@ int ieee80211_request_ibss_scan(struct i
  		}
  
  		if (WARN_ON_ONCE(n_ch == 0))
@@ -66,7 +66,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  		local->int_scan_req->n_channels = n_ch;
  	}
-@@ -1235,9 +1239,7 @@ int ieee80211_request_ibss_scan(struct i
+@@ -1232,9 +1236,7 @@ int ieee80211_request_ibss_scan(struct i
  	memcpy(local->int_scan_req->ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
  	local->int_scan_req->ssids[0].ssid_len = ssid_len;
  
diff --git a/package/kernel/mac80211/patches/subsys/332-wifi-cfg80211-Set-correct-chandef-when-starting-CAC.patch b/package/kernel/mac80211/patches/subsys/332-wifi-cfg80211-Set-correct-chandef-when-starting-CAC.patch
deleted file mode 100644
index 72a3510aacfff1..00000000000000
--- a/package/kernel/mac80211/patches/subsys/332-wifi-cfg80211-Set-correct-chandef-when-starting-CAC.patch
+++ /dev/null
@@ -1,64 +0,0 @@
-From: Issam Hamdi <ih@simonwunderlich.de>
-Date: Fri, 16 Aug 2024 16:24:18 +0200
-Subject: [PATCH] wifi: cfg80211: Set correct chandef when starting CAC
-
-When starting CAC in a mode other than AP mode, it return a
-"WARNING: CPU: 0 PID: 63 at cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]"
-caused by the chandef.chan being null at the end of CAC.
-
-Solution: Ensure the channel definition is set for the different modes
-when starting CAC to avoid getting a NULL 'chan' at the end of CAC.
-
- Call Trace:
-  ? show_regs.part.0+0x14/0x16
-  ? __warn+0x67/0xc0
-  ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]
-  ? report_bug+0xa7/0x130
-  ? exc_overflow+0x30/0x30
-  ? handle_bug+0x27/0x50
-  ? exc_invalid_op+0x18/0x60
-  ? handle_exception+0xf6/0xf6
-  ? exc_overflow+0x30/0x30
-  ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]
-  ? exc_overflow+0x30/0x30
-  ? cfg80211_chandef_dfs_usable+0x20/0xaf [cfg80211]
-  ? regulatory_propagate_dfs_state.cold+0x1b/0x4c [cfg80211]
-  ? cfg80211_propagate_cac_done_wk+0x1a/0x30 [cfg80211]
-  ? process_one_work+0x165/0x280
-  ? worker_thread+0x120/0x3f0
-  ? kthread+0xc2/0xf0
-  ? process_one_work+0x280/0x280
-  ? kthread_complete_and_exit+0x20/0x20
-  ? ret_from_fork+0x19/0x24
-
-Reported-by: Kretschmer Mathias <mathias.kretschmer@fit.fraunhofer.de>
-Signed-off-by: Issam Hamdi <ih@simonwunderlich.de>
-Link: https://patch.msgid.link/20240816142418.3381951-1-ih@simonwunderlich.de
-[shorten subject, remove OCB, reorder cases to match previous list]
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -10144,7 +10144,20 @@ static int nl80211_start_radar_detection
- 
- 	err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
- 	if (!err) {
--		wdev->links[0].ap.chandef = chandef;
-+		switch (wdev->iftype) {
-+		case NL80211_IFTYPE_AP:
-+		case NL80211_IFTYPE_P2P_GO:
-+			wdev->links[0].ap.chandef = chandef;
-+			break;
-+		case NL80211_IFTYPE_ADHOC:
-+			wdev->u.ibss.chandef = chandef;
-+			break;
-+		case NL80211_IFTYPE_MESH_POINT:
-+			wdev->u.mesh.chandef = chandef;
-+			break;
-+		default:
-+			break;
-+		}
- 		wdev->cac_started = true;
- 		wdev->cac_start_time = jiffies;
- 		wdev->cac_time_ms = cac_time_ms;
diff --git a/package/kernel/mac80211/patches/subsys/352-wifi-mac80211-use-vif-radio-mask-to-limit-chanctx-an.patch b/package/kernel/mac80211/patches/subsys/332-wifi-mac80211-use-vif-radio-mask-to-limit-chanctx-an.patch
similarity index 86%
rename from package/kernel/mac80211/patches/subsys/352-wifi-mac80211-use-vif-radio-mask-to-limit-chanctx-an.patch
rename to package/kernel/mac80211/patches/subsys/332-wifi-mac80211-use-vif-radio-mask-to-limit-chanctx-an.patch
index ac3d1011489a1b..04d2f2291ac2e7 100644
--- a/package/kernel/mac80211/patches/subsys/352-wifi-mac80211-use-vif-radio-mask-to-limit-chanctx-an.patch
+++ b/package/kernel/mac80211/patches/subsys/332-wifi-mac80211-use-vif-radio-mask-to-limit-chanctx-an.patch
@@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/chan.c
 +++ b/net/mac80211/chan.c
-@@ -1167,7 +1167,7 @@ ieee80211_replace_chanctx(struct ieee802
+@@ -1169,7 +1169,7 @@ ieee80211_replace_chanctx(struct ieee802
  static bool
  ieee80211_find_available_radio(struct ieee80211_local *local,
  			       const struct ieee80211_chan_req *chanreq,
@@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  {
  	struct wiphy *wiphy = local->hw.wiphy;
  	const struct wiphy_radio *radio;
-@@ -1178,6 +1178,9 @@ ieee80211_find_available_radio(struct ie
+@@ -1180,6 +1180,9 @@ ieee80211_find_available_radio(struct ie
  		return true;
  
  	for (i = 0; i < wiphy->n_radio; i++) {
@@ -28,7 +28,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		radio = &wiphy->radio[i];
  		if (!cfg80211_radio_chandef_valid(radio, &chanreq->oper))
  			continue;
-@@ -1211,7 +1214,9 @@ int ieee80211_link_reserve_chanctx(struc
+@@ -1213,7 +1216,9 @@ int ieee80211_link_reserve_chanctx(struc
  	new_ctx = ieee80211_find_reservation_chanctx(local, chanreq, mode);
  	if (!new_ctx) {
  		if (ieee80211_can_create_new_chanctx(local, -1) &&
@@ -39,7 +39,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			new_ctx = ieee80211_new_chanctx(local, chanreq, mode,
  							false, radio_idx);
  		else
-@@ -1881,7 +1886,9 @@ int _ieee80211_link_use_channel(struct i
+@@ -1884,7 +1889,9 @@ int _ieee80211_link_use_channel(struct i
  	/* Note: context is now reserved */
  	if (ctx)
  		reserved = true;
diff --git a/package/kernel/mac80211/patches/subsys/333-Revert-wifi-mac80211-move-radar-detect-work-to-sdata.patch b/package/kernel/mac80211/patches/subsys/333-Revert-wifi-mac80211-move-radar-detect-work-to-sdata.patch
deleted file mode 100644
index d12df8f53ea8b6..00000000000000
--- a/package/kernel/mac80211/patches/subsys/333-Revert-wifi-mac80211-move-radar-detect-work-to-sdata.patch
+++ /dev/null
@@ -1,136 +0,0 @@
-From: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Date: Fri, 6 Sep 2024 12:14:19 +0530
-Subject: [PATCH] Revert "wifi: mac80211: move radar detect work to sdata"
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This reverts commit ce9e660ef32e ("wifi: mac80211: move radar detect work to sdata").
-
-To enable radar detection with MLO, it’s essential to handle it on a
-per-link basis. This is because when using MLO, multiple links may already
-be active and beaconing. In this scenario, another link should be able to
-initiate a radar detection. Also, if underlying links are associated with
-different hardware devices but grouped together for MLO, they could
-potentially start radar detection simultaneously. Therefore, it makes
-sense to manage radar detection settings separately for each link by moving
-them back to a per-link data structure.
-
-Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Link: https://patch.msgid.link/20240906064426.2101315-2-quic_adisi@quicinc.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -1658,7 +1658,7 @@ static int ieee80211_stop_ap(struct wiph
- 
- 	if (sdata->wdev.cac_started) {
- 		chandef = link_conf->chanreq.oper;
--		wiphy_delayed_work_cancel(wiphy, &sdata->dfs_cac_timer_work);
-+		wiphy_delayed_work_cancel(wiphy, &link->dfs_cac_timer_work);
- 		cfg80211_cac_event(sdata->dev, &chandef,
- 				   NL80211_RADAR_CAC_ABORTED,
- 				   GFP_KERNEL);
-@@ -3482,7 +3482,7 @@ static int ieee80211_start_radar_detecti
- 	if (err)
- 		goto out_unlock;
- 
--	wiphy_delayed_work_queue(wiphy, &sdata->dfs_cac_timer_work,
-+	wiphy_delayed_work_queue(wiphy, &sdata->deflink.dfs_cac_timer_work,
- 				 msecs_to_jiffies(cac_time_ms));
- 
-  out_unlock:
-@@ -3499,7 +3499,7 @@ static void ieee80211_end_cac(struct wip
- 
- 	list_for_each_entry(sdata, &local->interfaces, list) {
- 		wiphy_delayed_work_cancel(wiphy,
--					  &sdata->dfs_cac_timer_work);
-+					  &sdata->deflink.dfs_cac_timer_work);
- 
- 		if (sdata->wdev.cac_started) {
- 			ieee80211_link_release_channel(&sdata->deflink);
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -1069,6 +1069,7 @@ struct ieee80211_link_data {
- 	int ap_power_level; /* in dBm */
- 
- 	bool radar_required;
-+	struct wiphy_delayed_work dfs_cac_timer_work;
- 
- 	union {
- 		struct ieee80211_link_data_managed mgd;
-@@ -1167,8 +1168,6 @@ struct ieee80211_sub_if_data {
- 	struct ieee80211_link_data deflink;
- 	struct ieee80211_link_data __rcu *link[IEEE80211_MLD_MAX_NUM_LINKS];
- 
--	struct wiphy_delayed_work dfs_cac_timer_work;
--
- 	/* for ieee80211_set_active_links_async() */
- 	struct wiphy_work activate_links_work;
- 	u16 desired_active_links;
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -551,7 +551,7 @@ static void ieee80211_do_stop(struct iee
- 	wiphy_work_cancel(local->hw.wiphy,
- 			  &sdata->deflink.color_change_finalize_work);
- 	wiphy_delayed_work_cancel(local->hw.wiphy,
--				  &sdata->dfs_cac_timer_work);
-+				  &sdata->deflink.dfs_cac_timer_work);
- 
- 	if (sdata->wdev.cac_started) {
- 		chandef = sdata->vif.bss_conf.chanreq.oper;
-@@ -1744,8 +1744,6 @@ static void ieee80211_setup_sdata(struct
- 	wiphy_work_init(&sdata->work, ieee80211_iface_work);
- 	wiphy_work_init(&sdata->activate_links_work,
- 			ieee80211_activate_links_work);
--	wiphy_delayed_work_init(&sdata->dfs_cac_timer_work,
--				ieee80211_dfs_cac_timer_work);
- 
- 	switch (type) {
- 	case NL80211_IFTYPE_P2P_GO:
---- a/net/mac80211/link.c
-+++ b/net/mac80211/link.c
-@@ -45,6 +45,8 @@ void ieee80211_link_init(struct ieee8021
- 			  ieee80211_color_collision_detection_work);
- 	INIT_LIST_HEAD(&link->assigned_chanctx_list);
- 	INIT_LIST_HEAD(&link->reserved_chanctx_list);
-+	wiphy_delayed_work_init(&link->dfs_cac_timer_work,
-+				ieee80211_dfs_cac_timer_work);
- 
- 	if (!deflink) {
- 		switch (sdata->vif.type) {
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -3031,15 +3031,16 @@ void ieee80211_dynamic_ps_timer(struct t
- 
- void ieee80211_dfs_cac_timer_work(struct wiphy *wiphy, struct wiphy_work *work)
- {
--	struct ieee80211_sub_if_data *sdata =
--		container_of(work, struct ieee80211_sub_if_data,
-+	struct ieee80211_link_data *link =
-+		container_of(work, struct ieee80211_link_data,
- 			     dfs_cac_timer_work.work);
--	struct cfg80211_chan_def chandef = sdata->vif.bss_conf.chanreq.oper;
-+	struct cfg80211_chan_def chandef = link->conf->chanreq.oper;
-+	struct ieee80211_sub_if_data *sdata = link->sdata;
- 
- 	lockdep_assert_wiphy(sdata->local->hw.wiphy);
- 
- 	if (sdata->wdev.cac_started) {
--		ieee80211_link_release_channel(&sdata->deflink);
-+		ieee80211_link_release_channel(link);
- 		cfg80211_cac_event(sdata->dev, &chandef,
- 				   NL80211_RADAR_CAC_FINISHED,
- 				   GFP_KERNEL);
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -3460,7 +3460,7 @@ void ieee80211_dfs_cac_cancel(struct iee
- 
- 	list_for_each_entry(sdata, &local->interfaces, list) {
- 		wiphy_delayed_work_cancel(local->hw.wiphy,
--					  &sdata->dfs_cac_timer_work);
-+					  &sdata->deflink.dfs_cac_timer_work);
- 
- 		if (sdata->wdev.cac_started) {
- 			chandef = sdata->vif.bss_conf.chanreq.oper;
diff --git a/package/kernel/mac80211/patches/subsys/353-wifi-mac80211-remove-status-ampdu_delimiter_crc.patch b/package/kernel/mac80211/patches/subsys/333-wifi-mac80211-remove-status-ampdu_delimiter_crc.patch
similarity index 100%
rename from package/kernel/mac80211/patches/subsys/353-wifi-mac80211-remove-status-ampdu_delimiter_crc.patch
rename to package/kernel/mac80211/patches/subsys/333-wifi-mac80211-remove-status-ampdu_delimiter_crc.patch
diff --git a/package/kernel/mac80211/patches/subsys/354-wifi-cfg80211-pass-net_device-to-.set_monitor_channel.patch b/package/kernel/mac80211/patches/subsys/334-wifi-cfg80211-pass-net_device-to-.set_monitor_channel.patch
similarity index 94%
rename from package/kernel/mac80211/patches/subsys/354-wifi-cfg80211-pass-net_device-to-.set_monitor_channel.patch
rename to package/kernel/mac80211/patches/subsys/334-wifi-cfg80211-pass-net_device-to-.set_monitor_channel.patch
index c2a915963c2de6..f1fc9190fc8b56 100644
--- a/package/kernel/mac80211/patches/subsys/354-wifi-cfg80211-pass-net_device-to-.set_monitor_channel.patch
+++ b/package/kernel/mac80211/patches/subsys/334-wifi-cfg80211-pass-net_device-to-.set_monitor_channel.patch
@@ -49,7 +49,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -4700,6 +4700,7 @@ struct cfg80211_ops {
+@@ -4703,6 +4703,7 @@ struct cfg80211_ops {
  					     struct ieee80211_channel *chan);
  
  	int	(*set_monitor_channel)(struct wiphy *wiphy,
@@ -69,7 +69,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	struct ieee80211_local *local = wiphy_priv(wiphy);
 --- a/net/wireless/chan.c
 +++ b/net/wireless/chan.c
-@@ -1673,6 +1673,7 @@ bool cfg80211_reg_check_beaconing(struct
+@@ -1679,6 +1679,7 @@ bool cfg80211_reg_check_beaconing(struct
  EXPORT_SYMBOL(cfg80211_reg_check_beaconing);
  
  int cfg80211_set_monitor_channel(struct cfg80211_registered_device *rdev,
@@ -77,7 +77,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  				 struct cfg80211_chan_def *chandef)
  {
  	if (!rdev->ops->set_monitor_channel)
-@@ -1680,7 +1681,7 @@ int cfg80211_set_monitor_channel(struct
+@@ -1686,7 +1687,7 @@ int cfg80211_set_monitor_channel(struct
  	if (!cfg80211_has_monitors_only(rdev))
  		return -EBUSY;
  
@@ -88,7 +88,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  bool cfg80211_any_usable_channels(struct wiphy *wiphy,
 --- a/net/wireless/core.h
 +++ b/net/wireless/core.h
-@@ -510,6 +510,7 @@ static inline unsigned int elapsed_jiffi
+@@ -518,6 +518,7 @@ static inline unsigned int elapsed_jiffi
  }
  
  int cfg80211_set_monitor_channel(struct cfg80211_registered_device *rdev,
@@ -98,7 +98,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  int ieee80211_get_ratemask(struct ieee80211_supported_band *sband,
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -3562,7 +3562,7 @@ static int __nl80211_set_channel(struct
+@@ -3569,7 +3569,7 @@ static int __nl80211_set_channel(struct
  	case NL80211_IFTYPE_MESH_POINT:
  		return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
  	case NL80211_IFTYPE_MONITOR:
diff --git a/package/kernel/mac80211/patches/subsys/334-wifi-mac80211-remove-label-usage-in-ieee80211_start_.patch b/package/kernel/mac80211/patches/subsys/334-wifi-mac80211-remove-label-usage-in-ieee80211_start_.patch
deleted file mode 100644
index 329b6454628073..00000000000000
--- a/package/kernel/mac80211/patches/subsys/334-wifi-mac80211-remove-label-usage-in-ieee80211_start_.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Date: Fri, 6 Sep 2024 12:14:20 +0530
-Subject: [PATCH] wifi: mac80211: remove label usage in
- ieee80211_start_radar_detection()
-
-After locks rework [1], ieee80211_start_radar_detection() function is no
-longer acquiring any lock as such explicitly. Hence, it is not unlocking
-anything as well. However, label "out_unlock" is still used which creates
-confusion. Also, now there is no need of goto label as such.
-
-Get rid of the goto logic and use direct return statements.
-
-[1]: https://lore.kernel.org/all/20230828135928.b1c6efffe9ad.I4aec875e25abc9ef0b5ad1e70b5747fd483fbd3c@changeid/
-
-Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Link: https://patch.msgid.link/20240906064426.2101315-3-quic_adisi@quicinc.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -3468,10 +3468,8 @@ static int ieee80211_start_radar_detecti
- 
- 	lockdep_assert_wiphy(local->hw.wiphy);
- 
--	if (!list_empty(&local->roc_list) || local->scanning) {
--		err = -EBUSY;
--		goto out_unlock;
--	}
-+	if (!list_empty(&local->roc_list) || local->scanning)
-+		return -EBUSY;
- 
- 	/* whatever, but channel contexts should not complain about that one */
- 	sdata->deflink.smps_mode = IEEE80211_SMPS_OFF;
-@@ -3480,13 +3478,12 @@ static int ieee80211_start_radar_detecti
- 	err = ieee80211_link_use_channel(&sdata->deflink, &chanreq,
- 					 IEEE80211_CHANCTX_SHARED);
- 	if (err)
--		goto out_unlock;
-+		return err;
- 
- 	wiphy_delayed_work_queue(wiphy, &sdata->deflink.dfs_cac_timer_work,
- 				 msecs_to_jiffies(cac_time_ms));
- 
-- out_unlock:
--	return err;
-+	return 0;
- }
- 
- static void ieee80211_end_cac(struct wiphy *wiphy,
diff --git a/package/kernel/mac80211/patches/subsys/355-wifi-mac80211-add-flag-to-opt-out-of-virtual-monitor.patch b/package/kernel/mac80211/patches/subsys/335-wifi-mac80211-add-flag-to-opt-out-of-virtual-monitor.patch
similarity index 90%
rename from package/kernel/mac80211/patches/subsys/355-wifi-mac80211-add-flag-to-opt-out-of-virtual-monitor.patch
rename to package/kernel/mac80211/patches/subsys/335-wifi-mac80211-add-flag-to-opt-out-of-virtual-monitor.patch
index 2510cb0dbe95f1..bb2d5da1a4a00a 100644
--- a/package/kernel/mac80211/patches/subsys/355-wifi-mac80211-add-flag-to-opt-out-of-virtual-monitor.patch
+++ b/package/kernel/mac80211/patches/subsys/335-wifi-mac80211-add-flag-to-opt-out-of-virtual-monitor.patch
@@ -25,7 +25,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
   * @IEEE80211_HW_NO_AUTO_VIF: The driver would like for no wlanX to
   *	be created.  It is expected user-space will create vifs as
   *	desired (and thus have them named as desired).
-@@ -2838,6 +2843,7 @@ enum ieee80211_hw_flags {
+@@ -2843,6 +2848,7 @@ enum ieee80211_hw_flags {
  	IEEE80211_HW_SUPPORTS_DYNAMIC_PS,
  	IEEE80211_HW_MFP_CAPABLE,
  	IEEE80211_HW_WANT_MONITOR_VIF,
@@ -95,7 +95,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (ret)
  		return ret;
  done:
-@@ -3049,7 +3057,8 @@ static int ieee80211_set_tx_power(struct
+@@ -3050,7 +3058,8 @@ static int ieee80211_set_tx_power(struct
  	if (wdev) {
  		sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
  
@@ -105,7 +105,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			if (!ieee80211_hw_check(&local->hw, WANT_MONITOR_VIF))
  				return -EOPNOTSUPP;
  
-@@ -3097,7 +3106,8 @@ static int ieee80211_set_tx_power(struct
+@@ -3098,7 +3107,8 @@ static int ieee80211_set_tx_power(struct
  	}
  
  	list_for_each_entry(sdata, &local->interfaces, list) {
@@ -115,7 +115,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			has_monitor = true;
  			continue;
  		}
-@@ -3107,7 +3117,8 @@ static int ieee80211_set_tx_power(struct
+@@ -3108,7 +3118,8 @@ static int ieee80211_set_tx_power(struct
  		sdata->vif.bss_conf.txpower_type = txp_type;
  	}
  	list_for_each_entry(sdata, &local->interfaces, list) {
@@ -125,7 +125,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			continue;
  		ieee80211_recalc_txpower(sdata, update_txp_type);
  	}
-@@ -4299,7 +4310,8 @@ static int ieee80211_cfg_get_channel(str
+@@ -4303,7 +4314,8 @@ static int ieee80211_cfg_get_channel(str
  	if (chanctx_conf) {
  		*chandef = link->conf->chanreq.oper;
  		ret = 0;
@@ -137,7 +137,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		*chandef = local->monitor_chanreq.oper;
 --- a/net/mac80211/chan.c
 +++ b/net/mac80211/chan.c
-@@ -337,6 +337,10 @@ ieee80211_get_chanctx_max_required_bw(st
+@@ -339,6 +339,10 @@ ieee80211_get_chanctx_max_required_bw(st
  		case NL80211_IFTYPE_P2P_DEVICE:
  		case NL80211_IFTYPE_NAN:
  			continue;
@@ -148,7 +148,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		case NL80211_IFTYPE_ADHOC:
  		case NL80211_IFTYPE_MESH_POINT:
  		case NL80211_IFTYPE_OCB:
-@@ -345,7 +349,6 @@ ieee80211_get_chanctx_max_required_bw(st
+@@ -347,7 +351,6 @@ ieee80211_get_chanctx_max_required_bw(st
  		case NL80211_IFTYPE_WDS:
  		case NL80211_IFTYPE_UNSPECIFIED:
  		case NUM_NL80211_IFTYPES:
@@ -156,7 +156,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		case NL80211_IFTYPE_P2P_CLIENT:
  		case NL80211_IFTYPE_P2P_GO:
  			WARN_ON_ONCE(1);
-@@ -954,6 +957,10 @@ void ieee80211_recalc_smps_chanctx(struc
+@@ -956,6 +959,10 @@ void ieee80211_recalc_smps_chanctx(struc
  			if (!link->sdata->u.mgd.associated)
  				continue;
  			break;
@@ -167,7 +167,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		case NL80211_IFTYPE_AP:
  		case NL80211_IFTYPE_ADHOC:
  		case NL80211_IFTYPE_MESH_POINT:
-@@ -966,6 +973,11 @@ void ieee80211_recalc_smps_chanctx(struc
+@@ -968,6 +975,11 @@ void ieee80211_recalc_smps_chanctx(struc
  		if (rcu_access_pointer(link->conf->chanctx_conf) != &chanctx->conf)
  			continue;
  
@@ -217,7 +217,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	}
  
  	/* Regardless of eth_mac_addr() return we still want to add the
-@@ -699,9 +704,11 @@ static void ieee80211_do_stop(struct iee
+@@ -705,9 +710,11 @@ static void ieee80211_do_stop(struct iee
  		ieee80211_recalc_idle(local);
  		ieee80211_recalc_offload(local);
  
@@ -230,7 +230,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		fallthrough;
  	default:
  		if (!going_down)
-@@ -1131,7 +1138,8 @@ int ieee80211_add_virtual_monitor(struct
+@@ -1140,7 +1147,8 @@ int ieee80211_add_virtual_monitor(struct
  	ASSERT_RTNL();
  	lockdep_assert_wiphy(local->hw.wiphy);
  
@@ -240,7 +240,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		return 0;
  
  	sdata = kzalloc(sizeof(*sdata) + local->hw.vif_data_size, GFP_KERNEL);
-@@ -1193,6 +1201,9 @@ void ieee80211_del_virtual_monitor(struc
+@@ -1202,6 +1210,9 @@ void ieee80211_del_virtual_monitor(struc
  {
  	struct ieee80211_sub_if_data *sdata;
  
@@ -250,7 +250,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	ASSERT_RTNL();
  	lockdep_assert_wiphy(local->hw.wiphy);
  
-@@ -1328,7 +1339,8 @@ int ieee80211_do_open(struct wireless_de
+@@ -1345,7 +1356,8 @@ int ieee80211_do_open(struct wireless_de
  			break;
  		}
  
@@ -284,7 +284,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			vif = &sdata->vif;
  			break;
  		}
-@@ -3952,7 +3953,8 @@ begin:
+@@ -3953,7 +3954,8 @@ begin:
  
  	switch (tx.sdata->vif.type) {
  	case NL80211_IFTYPE_MONITOR:
@@ -296,8 +296,8 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		}
 --- a/net/mac80211/util.c
 +++ b/net/mac80211/util.c
-@@ -754,7 +754,8 @@ static void __iterate_interfaces(struct
- 	list_for_each_entry_rcu(sdata, &local->interfaces, list) {
+@@ -740,7 +740,8 @@ static void __iterate_interfaces(struct
+ 				lockdep_is_held(&local->hw.wiphy->mtx)) {
  		switch (sdata->vif.type) {
  		case NL80211_IFTYPE_MONITOR:
 -			if (!(sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE))
@@ -306,7 +306,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  				continue;
  			break;
  		case NL80211_IFTYPE_AP_VLAN:
-@@ -1857,8 +1858,10 @@ int ieee80211_reconfig(struct ieee80211_
+@@ -1860,8 +1861,10 @@ int ieee80211_reconfig(struct ieee80211_
  	}
  
  	list_for_each_entry(sdata, &local->interfaces, list) {
@@ -318,7 +318,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		    ieee80211_sdata_running(sdata)) {
  			res = drv_add_interface(local, sdata);
  			if (WARN_ON(res))
-@@ -1871,11 +1874,14 @@ int ieee80211_reconfig(struct ieee80211_
+@@ -1874,11 +1877,14 @@ int ieee80211_reconfig(struct ieee80211_
  	 */
  	if (res) {
  		list_for_each_entry_continue_reverse(sdata, &local->interfaces,
diff --git a/package/kernel/mac80211/patches/subsys/335-wifi-trace-unlink-rdev_end_cac-trace-event-from-wiph.patch b/package/kernel/mac80211/patches/subsys/335-wifi-trace-unlink-rdev_end_cac-trace-event-from-wiph.patch
deleted file mode 100644
index 98bc0c26fdb8f2..00000000000000
--- a/package/kernel/mac80211/patches/subsys/335-wifi-trace-unlink-rdev_end_cac-trace-event-from-wiph.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Date: Fri, 6 Sep 2024 12:14:21 +0530
-Subject: [PATCH] wifi: trace: unlink rdev_end_cac trace event from
- wiphy_netdev_evt class
-
-rdev_end_cac trace event is linked with wiphy_netdev_evt event class.
-There is no option to pass link ID currently to wiphy_netdev_evt class.
-A subsequent change would pass link ID to rdev_end_cac event and hence
-it can no longer derive the event class from wiphy_netdev_evt.
-
-Therefore, unlink rdev_end_cac event from wiphy_netdev_evt and define it's
-own independent trace event. Link ID would be passed in subsequent change.
-
-Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Link: https://patch.msgid.link/20240906064426.2101315-4-quic_adisi@quicinc.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/wireless/trace.h
-+++ b/net/wireless/trace.h
-@@ -805,9 +805,18 @@ DEFINE_EVENT(wiphy_netdev_evt, rdev_flus
- 	TP_ARGS(wiphy, netdev)
- );
- 
--DEFINE_EVENT(wiphy_netdev_evt, rdev_end_cac,
--	     TP_PROTO(struct wiphy *wiphy, struct net_device *netdev),
--	     TP_ARGS(wiphy, netdev)
-+TRACE_EVENT(rdev_end_cac,
-+	TP_PROTO(struct wiphy *wiphy, struct net_device *netdev),
-+	TP_ARGS(wiphy, netdev),
-+	TP_STRUCT__entry(
-+		WIPHY_ENTRY
-+		NETDEV_ENTRY
-+	),
-+	TP_fast_assign(
-+		WIPHY_ASSIGN;
-+		NETDEV_ASSIGN;
-+	),
-+	TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT, WIPHY_PR_ARG, NETDEV_PR_ARG)
- );
- 
- DECLARE_EVENT_CLASS(station_add_change,
diff --git a/package/kernel/mac80211/patches/subsys/356-wifi-cfg80211-add-monitor-SKIP_TX-flag.patch b/package/kernel/mac80211/patches/subsys/336-wifi-cfg80211-add-monitor-SKIP_TX-flag.patch
similarity index 87%
rename from package/kernel/mac80211/patches/subsys/356-wifi-cfg80211-add-monitor-SKIP_TX-flag.patch
rename to package/kernel/mac80211/patches/subsys/336-wifi-cfg80211-add-monitor-SKIP_TX-flag.patch
index dfc01c6c9bc546..d60f74fc113291 100644
--- a/package/kernel/mac80211/patches/subsys/356-wifi-cfg80211-add-monitor-SKIP_TX-flag.patch
+++ b/package/kernel/mac80211/patches/subsys/336-wifi-cfg80211-add-monitor-SKIP_TX-flag.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -2272,6 +2272,7 @@ static inline int cfg80211_get_station(s
+@@ -2275,6 +2275,7 @@ static inline int cfg80211_get_station(s
   * @MONITOR_FLAG_OTHER_BSS: disable BSSID filtering
   * @MONITOR_FLAG_COOK_FRAMES: report frames after processing
   * @MONITOR_FLAG_ACTIVE: active monitor, ACKs frames on its MAC address
@@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
   */
  enum monitor_flags {
  	MONITOR_FLAG_CHANGED		= BIT(__NL80211_MNTR_FLAG_INVALID),
-@@ -2281,6 +2282,7 @@ enum monitor_flags {
+@@ -2284,6 +2285,7 @@ enum monitor_flags {
  	MONITOR_FLAG_OTHER_BSS		= BIT(NL80211_MNTR_FLAG_OTHER_BSS),
  	MONITOR_FLAG_COOK_FRAMES	= BIT(NL80211_MNTR_FLAG_COOK_FRAMES),
  	MONITOR_FLAG_ACTIVE		= BIT(NL80211_MNTR_FLAG_ACTIVE),
@@ -28,7 +28,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  /**
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -4703,6 +4703,7 @@ enum nl80211_survey_info {
+@@ -4709,6 +4709,7 @@ enum nl80211_survey_info {
   *	overrides all other flags.
   * @NL80211_MNTR_FLAG_ACTIVE: use the configured MAC address
   *	and ACK incoming unicast packets.
@@ -36,7 +36,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
   *
   * @__NL80211_MNTR_FLAG_AFTER_LAST: internal use
   * @NL80211_MNTR_FLAG_MAX: highest possible monitor flag
-@@ -4715,6 +4716,7 @@ enum nl80211_mntr_flags {
+@@ -4721,6 +4722,7 @@ enum nl80211_mntr_flags {
  	NL80211_MNTR_FLAG_OTHER_BSS,
  	NL80211_MNTR_FLAG_COOK_FRAMES,
  	NL80211_MNTR_FLAG_ACTIVE,
@@ -46,7 +46,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	__NL80211_MNTR_FLAG_AFTER_LAST,
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -4201,6 +4201,7 @@ static const struct nla_policy mntr_flag
+@@ -4208,6 +4208,7 @@ static const struct nla_policy mntr_flag
  	[NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
  	[NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
  	[NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
diff --git a/package/kernel/mac80211/patches/subsys/336-wifi-cfg80211-move-DFS-related-members-to-links-in-w.patch b/package/kernel/mac80211/patches/subsys/336-wifi-cfg80211-move-DFS-related-members-to-links-in-w.patch
deleted file mode 100644
index 95dac04de5e411..00000000000000
--- a/package/kernel/mac80211/patches/subsys/336-wifi-cfg80211-move-DFS-related-members-to-links-in-w.patch
+++ /dev/null
@@ -1,309 +0,0 @@
-From: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Date: Fri, 6 Sep 2024 12:14:22 +0530
-Subject: [PATCH] wifi: cfg80211: move DFS related members to links[] in
- wireless_dev
-
-A few members related to DFS handling are currently under per wireless
-device data structure. However, in order to support DFS with MLO, there is
-a need to have them on a per-link manner.
-
-Hence, as a preliminary step, move members cac_started, cac_start_time
-and cac_time_ms to be on a per-link basis.
-
-Since currently, link ID is not known at all places, use default value of
-0 for now.
-
-Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Link: https://patch.msgid.link/20240906064426.2101315-5-quic_adisi@quicinc.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/drivers/net/wireless/marvell/mwifiex/11h.c
-+++ b/drivers/net/wireless/marvell/mwifiex/11h.c
-@@ -117,7 +117,7 @@ void mwifiex_dfs_cac_work_queue(struct w
- 				     dfs_cac_work);
- 
- 	chandef = priv->dfs_chandef;
--	if (priv->wdev.cac_started) {
-+	if (priv->wdev.links[0].cac_started) {
- 		mwifiex_dbg(priv->adapter, MSG,
- 			    "CAC timer finished; No radar detected\n");
- 		cfg80211_cac_event(priv->netdev, &chandef,
-@@ -174,7 +174,7 @@ int mwifiex_stop_radar_detection(struct
-  */
- void mwifiex_abort_cac(struct mwifiex_private *priv)
- {
--	if (priv->wdev.cac_started) {
-+	if (priv->wdev.links[0].cac_started) {
- 		if (mwifiex_stop_radar_detection(priv, &priv->dfs_chandef))
- 			mwifiex_dbg(priv->adapter, ERROR,
- 				    "failed to stop CAC in FW\n");
---- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
-+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
-@@ -1880,7 +1880,7 @@ mwifiex_cfg80211_del_station(struct wiph
- 	struct mwifiex_sta_node *sta_node;
- 	u8 deauth_mac[ETH_ALEN];
- 
--	if (!priv->bss_started && priv->wdev.cac_started) {
-+	if (!priv->bss_started && priv->wdev.links[0].cac_started) {
- 		mwifiex_dbg(priv->adapter, INFO, "%s: abort CAC!\n", __func__);
- 		mwifiex_abort_cac(priv);
- 	}
-@@ -3978,7 +3978,7 @@ mwifiex_cfg80211_channel_switch(struct w
- 		return -EBUSY;
- 	}
- 
--	if (priv->wdev.cac_started)
-+	if (priv->wdev.links[0].cac_started)
- 		return -EBUSY;
- 
- 	if (cfg80211_chandef_identical(&params->chandef,
---- a/drivers/net/wireless/quantenna/qtnfmac/event.c
-+++ b/drivers/net/wireless/quantenna/qtnfmac/event.c
-@@ -520,21 +520,21 @@ static int qtnf_event_handle_radar(struc
- 		cfg80211_radar_event(wiphy, &chandef, GFP_KERNEL);
- 		break;
- 	case QLINK_RADAR_CAC_FINISHED:
--		if (!vif->wdev.cac_started)
-+		if (!vif->wdev.links[0].cac_started)
- 			break;
- 
- 		cfg80211_cac_event(vif->netdev, &chandef,
- 				   NL80211_RADAR_CAC_FINISHED, GFP_KERNEL);
- 		break;
- 	case QLINK_RADAR_CAC_ABORTED:
--		if (!vif->wdev.cac_started)
-+		if (!vif->wdev.links[0].cac_started)
- 			break;
- 
- 		cfg80211_cac_event(vif->netdev, &chandef,
- 				   NL80211_RADAR_CAC_ABORTED, GFP_KERNEL);
- 		break;
- 	case QLINK_RADAR_CAC_STARTED:
--		if (vif->wdev.cac_started)
-+		if (vif->wdev.links[0].cac_started)
- 			break;
- 
- 		if (!wiphy_ext_feature_isset(wiphy,
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -6198,9 +6198,6 @@ enum ieee80211_ap_reg_power {
-  * @address: The address for this device, valid only if @netdev is %NULL
-  * @is_running: true if this is a non-netdev device that has been started, e.g.
-  *	the P2P Device.
-- * @cac_started: true if DFS channel availability check has been started
-- * @cac_start_time: timestamp (jiffies) when the dfs state was entered.
-- * @cac_time_ms: CAC time in ms
-  * @ps: powersave mode is enabled
-  * @ps_timeout: dynamic powersave timeout
-  * @ap_unexpected_nlportid: (private) netlink port ID of application
-@@ -6224,6 +6221,11 @@ enum ieee80211_ap_reg_power {
-  *	unprotected beacon report
-  * @links: array of %IEEE80211_MLD_MAX_NUM_LINKS elements containing @addr
-  *	@ap and @client for each link
-+ * @links[].cac_started: true if DFS channel availability check has been
-+ *	started
-+ * @links[].cac_start_time: timestamp (jiffies) when the dfs state was
-+ *	entered.
-+ * @links[].cac_time_ms: CAC time in ms
-  * @valid_links: bitmap describing what elements of @links are valid
-  */
- struct wireless_dev {
-@@ -6265,11 +6267,6 @@ struct wireless_dev {
- 	u32 owner_nlportid;
- 	bool nl_owner_dead;
- 
--	/* FIXME: need to rework radar detection for MLO */
--	bool cac_started;
--	unsigned long cac_start_time;
--	unsigned int cac_time_ms;
--
- #ifdef CPTCFG_CFG80211_WEXT
- 	/* wext data */
- 	struct {
-@@ -6336,6 +6333,10 @@ struct wireless_dev {
- 				struct cfg80211_internal_bss *current_bss;
- 			} client;
- 		};
-+
-+		bool cac_started;
-+		unsigned long cac_start_time;
-+		unsigned int cac_time_ms;
- 	} links[IEEE80211_MLD_MAX_NUM_LINKS];
- 	u16 valid_links;
- };
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -1656,7 +1656,7 @@ static int ieee80211_stop_ap(struct wiph
- 	ieee80211_link_info_change_notify(sdata, link,
- 					  BSS_CHANGED_BEACON_ENABLED);
- 
--	if (sdata->wdev.cac_started) {
-+	if (sdata->wdev.links[0].cac_started) {
- 		chandef = link_conf->chanreq.oper;
- 		wiphy_delayed_work_cancel(wiphy, &link->dfs_cac_timer_work);
- 		cfg80211_cac_event(sdata->dev, &chandef,
-@@ -3498,9 +3498,9 @@ static void ieee80211_end_cac(struct wip
- 		wiphy_delayed_work_cancel(wiphy,
- 					  &sdata->deflink.dfs_cac_timer_work);
- 
--		if (sdata->wdev.cac_started) {
-+		if (sdata->wdev.links[0].cac_started) {
- 			ieee80211_link_release_channel(&sdata->deflink);
--			sdata->wdev.cac_started = false;
-+			sdata->wdev.links[0].cac_started = false;
- 		}
- 	}
- }
-@@ -3955,7 +3955,7 @@ __ieee80211_channel_switch(struct wiphy
- 	if (!list_empty(&local->roc_list) || local->scanning)
- 		return -EBUSY;
- 
--	if (sdata->wdev.cac_started)
-+	if (sdata->wdev.links[0].cac_started)
- 		return -EBUSY;
- 
- 	if (WARN_ON(link_id >= IEEE80211_MLD_MAX_NUM_LINKS))
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -553,7 +553,7 @@ static void ieee80211_do_stop(struct iee
- 	wiphy_delayed_work_cancel(local->hw.wiphy,
- 				  &sdata->deflink.dfs_cac_timer_work);
- 
--	if (sdata->wdev.cac_started) {
-+	if (sdata->wdev.links[0].cac_started) {
- 		chandef = sdata->vif.bss_conf.chanreq.oper;
- 		WARN_ON(local->suspended);
- 		ieee80211_link_release_channel(&sdata->deflink);
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -3039,7 +3039,7 @@ void ieee80211_dfs_cac_timer_work(struct
- 
- 	lockdep_assert_wiphy(sdata->local->hw.wiphy);
- 
--	if (sdata->wdev.cac_started) {
-+	if (sdata->wdev.links[0].cac_started) {
- 		ieee80211_link_release_channel(link);
- 		cfg80211_cac_event(sdata->dev, &chandef,
- 				   NL80211_RADAR_CAC_FINISHED,
---- a/net/mac80211/scan.c
-+++ b/net/mac80211/scan.c
-@@ -585,7 +585,7 @@ static bool __ieee80211_can_leave_ch(str
- 		return false;
- 
- 	list_for_each_entry(sdata_iter, &local->interfaces, list) {
--		if (sdata_iter->wdev.cac_started)
-+		if (sdata_iter->wdev.links[0].cac_started)
- 			return false;
- 	}
- 
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -3462,7 +3462,7 @@ void ieee80211_dfs_cac_cancel(struct iee
- 		wiphy_delayed_work_cancel(local->hw.wiphy,
- 					  &sdata->deflink.dfs_cac_timer_work);
- 
--		if (sdata->wdev.cac_started) {
-+		if (sdata->wdev.links[0].cac_started) {
- 			chandef = sdata->vif.bss_conf.chanreq.oper;
- 			ieee80211_link_release_channel(&sdata->deflink);
- 			cfg80211_cac_event(sdata->dev,
---- a/net/wireless/ibss.c
-+++ b/net/wireless/ibss.c
-@@ -94,7 +94,7 @@ int __cfg80211_join_ibss(struct cfg80211
- 
- 	lockdep_assert_held(&rdev->wiphy.mtx);
- 
--	if (wdev->cac_started)
-+	if (wdev->links[0].cac_started)
- 		return -EBUSY;
- 
- 	if (wdev->u.ibss.ssid_len)
---- a/net/wireless/mesh.c
-+++ b/net/wireless/mesh.c
-@@ -127,7 +127,7 @@ int __cfg80211_join_mesh(struct cfg80211
- 	if (!rdev->ops->join_mesh)
- 		return -EOPNOTSUPP;
- 
--	if (wdev->cac_started)
-+	if (wdev->links[0].cac_started)
- 		return -EBUSY;
- 
- 	if (!setup->chandef.chan) {
---- a/net/wireless/mlme.c
-+++ b/net/wireless/mlme.c
-@@ -1124,13 +1124,14 @@ void cfg80211_cac_event(struct net_devic
- 
- 	trace_cfg80211_cac_event(netdev, event);
- 
--	if (WARN_ON(!wdev->cac_started && event != NL80211_RADAR_CAC_STARTED))
-+	if (WARN_ON(!wdev->links[0].cac_started &&
-+		    event != NL80211_RADAR_CAC_STARTED))
- 		return;
- 
- 	switch (event) {
- 	case NL80211_RADAR_CAC_FINISHED:
--		timeout = wdev->cac_start_time +
--			  msecs_to_jiffies(wdev->cac_time_ms);
-+		timeout = wdev->links[0].cac_start_time +
-+			  msecs_to_jiffies(wdev->links[0].cac_time_ms);
- 		WARN_ON(!time_after_eq(jiffies, timeout));
- 		cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
- 		memcpy(&rdev->cac_done_chandef, chandef,
-@@ -1139,10 +1140,10 @@ void cfg80211_cac_event(struct net_devic
- 		cfg80211_sched_dfs_chan_update(rdev);
- 		fallthrough;
- 	case NL80211_RADAR_CAC_ABORTED:
--		wdev->cac_started = false;
-+		wdev->links[0].cac_started = false;
- 		break;
- 	case NL80211_RADAR_CAC_STARTED:
--		wdev->cac_started = true;
-+		wdev->links[0].cac_started = true;
- 		break;
- 	default:
- 		WARN_ON(1);
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -6066,7 +6066,7 @@ static int nl80211_start_ap(struct sk_bu
- 	if (!rdev->ops->start_ap)
- 		return -EOPNOTSUPP;
- 
--	if (wdev->cac_started)
-+	if (wdev->links[0].cac_started)
- 		return -EBUSY;
- 
- 	if (wdev->links[link_id].ap.beacon_interval)
-@@ -10122,7 +10122,7 @@ static int nl80211_start_radar_detection
- 		goto unlock;
- 	}
- 
--	if (cfg80211_beaconing_iface_active(wdev) || wdev->cac_started) {
-+	if (cfg80211_beaconing_iface_active(wdev) || wdev->links[0].cac_started) {
- 		err = -EBUSY;
- 		goto unlock;
- 	}
-@@ -10158,9 +10158,9 @@ static int nl80211_start_radar_detection
- 		default:
- 			break;
- 		}
--		wdev->cac_started = true;
--		wdev->cac_start_time = jiffies;
--		wdev->cac_time_ms = cac_time_ms;
-+		wdev->links[0].cac_started = true;
-+		wdev->links[0].cac_start_time = jiffies;
-+		wdev->links[0].cac_time_ms = cac_time_ms;
- 	}
- unlock:
- 	wiphy_unlock(wiphy);
---- a/net/wireless/reg.c
-+++ b/net/wireless/reg.c
-@@ -4241,7 +4241,7 @@ static void cfg80211_check_and_end_cac(s
- 	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
- 		struct cfg80211_chan_def *chandef;
- 
--		if (!wdev->cac_started)
-+		if (!wdev->links[0].cac_started)
- 			continue;
- 
- 		/* FIXME: radar detection is tied to link 0 for now */
diff --git a/package/kernel/mac80211/patches/subsys/337-wifi-cfg80211-handle-DFS-per-link.patch b/package/kernel/mac80211/patches/subsys/337-wifi-cfg80211-handle-DFS-per-link.patch
deleted file mode 100644
index a4e0333642ae5b..00000000000000
--- a/package/kernel/mac80211/patches/subsys/337-wifi-cfg80211-handle-DFS-per-link.patch
+++ /dev/null
@@ -1,435 +0,0 @@
-From: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Date: Fri, 6 Sep 2024 12:14:23 +0530
-Subject: [PATCH] wifi: cfg80211: handle DFS per link
-
-Currently, during starting a radar detection, no link id information is
-parsed and passed down. In order to support starting radar detection
-during Multi Link Operation, it is required to pass link id as well.
-
-Add changes to first parse and then pass link id in the start radar
-detection path.
-
-Additionally, update notification APIs to allow drivers/mac80211 to
-pass the link ID.
-
-However, everything is handled at link 0 only until all API's are ready to
-handle it per link.
-
-Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Link: https://patch.msgid.link/20240906064426.2101315-6-quic_adisi@quicinc.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/drivers/net/wireless/marvell/mwifiex/11h.c
-+++ b/drivers/net/wireless/marvell/mwifiex/11h.c
-@@ -122,7 +122,7 @@ void mwifiex_dfs_cac_work_queue(struct w
- 			    "CAC timer finished; No radar detected\n");
- 		cfg80211_cac_event(priv->netdev, &chandef,
- 				   NL80211_RADAR_CAC_FINISHED,
--				   GFP_KERNEL);
-+				   GFP_KERNEL, 0);
- 	}
- }
- 
-@@ -182,7 +182,8 @@ void mwifiex_abort_cac(struct mwifiex_pr
- 			    "Aborting delayed work for CAC.\n");
- 		cancel_delayed_work_sync(&priv->dfs_cac_work);
- 		cfg80211_cac_event(priv->netdev, &priv->dfs_chandef,
--				   NL80211_RADAR_CAC_ABORTED, GFP_KERNEL);
-+				   NL80211_RADAR_CAC_ABORTED, GFP_KERNEL,
-+				   0);
- 	}
- }
- 
-@@ -221,7 +222,7 @@ int mwifiex_11h_handle_chanrpt_ready(str
- 				cfg80211_cac_event(priv->netdev,
- 						   &priv->dfs_chandef,
- 						   NL80211_RADAR_DETECTED,
--						   GFP_KERNEL);
-+						   GFP_KERNEL, 0);
- 			}
- 			break;
- 		default:
---- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
-+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
-@@ -4145,7 +4145,7 @@ static int
- mwifiex_cfg80211_start_radar_detection(struct wiphy *wiphy,
- 				       struct net_device *dev,
- 				       struct cfg80211_chan_def *chandef,
--				       u32 cac_time_ms)
-+				       u32 cac_time_ms, int link_id)
- {
- 	struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
- 	struct mwifiex_radar_params radar_params;
---- a/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
-+++ b/drivers/net/wireless/quantenna/qtnfmac/cfg80211.c
-@@ -837,7 +837,7 @@ static int qtnf_channel_switch(struct wi
- static int qtnf_start_radar_detection(struct wiphy *wiphy,
- 				      struct net_device *ndev,
- 				      struct cfg80211_chan_def *chandef,
--				      u32 cac_time_ms)
-+				      u32 cac_time_ms, int link_id)
- {
- 	struct qtnf_vif *vif = qtnf_netdev_get_priv(ndev);
- 	int ret;
---- a/drivers/net/wireless/quantenna/qtnfmac/event.c
-+++ b/drivers/net/wireless/quantenna/qtnfmac/event.c
-@@ -524,14 +524,14 @@ static int qtnf_event_handle_radar(struc
- 			break;
- 
- 		cfg80211_cac_event(vif->netdev, &chandef,
--				   NL80211_RADAR_CAC_FINISHED, GFP_KERNEL);
-+				   NL80211_RADAR_CAC_FINISHED, GFP_KERNEL, 0);
- 		break;
- 	case QLINK_RADAR_CAC_ABORTED:
- 		if (!vif->wdev.links[0].cac_started)
- 			break;
- 
- 		cfg80211_cac_event(vif->netdev, &chandef,
--				   NL80211_RADAR_CAC_ABORTED, GFP_KERNEL);
-+				   NL80211_RADAR_CAC_ABORTED, GFP_KERNEL, 0);
- 		break;
- 	case QLINK_RADAR_CAC_STARTED:
- 		if (vif->wdev.links[0].cac_started)
-@@ -542,7 +542,7 @@ static int qtnf_event_handle_radar(struc
- 			break;
- 
- 		cfg80211_cac_event(vif->netdev, &chandef,
--				   NL80211_RADAR_CAC_STARTED, GFP_KERNEL);
-+				   NL80211_RADAR_CAC_STARTED, GFP_KERNEL, 0);
- 		break;
- 	default:
- 		pr_warn("%s: unhandled radar event %u\n",
---- a/include/net/cfg80211.h
-+++ b/include/net/cfg80211.h
-@@ -4841,9 +4841,9 @@ struct cfg80211_ops {
- 	int	(*start_radar_detection)(struct wiphy *wiphy,
- 					 struct net_device *dev,
- 					 struct cfg80211_chan_def *chandef,
--					 u32 cac_time_ms);
-+					 u32 cac_time_ms, int link_id);
- 	void	(*end_cac)(struct wiphy *wiphy,
--				struct net_device *dev);
-+			   struct net_device *dev, unsigned int link_id);
- 	int	(*update_ft_ies)(struct wiphy *wiphy, struct net_device *dev,
- 				 struct cfg80211_update_ft_ies_params *ftie);
- 	int	(*crit_proto_start)(struct wiphy *wiphy,
-@@ -8745,6 +8745,7 @@ void cfg80211_sta_opmode_change_notify(s
-  * @chandef: chandef for the current channel
-  * @event: type of event
-  * @gfp: context flags
-+ * @link_id: valid link_id for MLO operation or 0 otherwise.
-  *
-  * This function is called when a Channel availability check (CAC) is finished
-  * or aborted. This must be called to notify the completion of a CAC process,
-@@ -8752,7 +8753,8 @@ void cfg80211_sta_opmode_change_notify(s
-  */
- void cfg80211_cac_event(struct net_device *netdev,
- 			const struct cfg80211_chan_def *chandef,
--			enum nl80211_radar_event event, gfp_t gfp);
-+			enum nl80211_radar_event event, gfp_t gfp,
-+			unsigned int link_id);
- 
- /**
-  * cfg80211_background_cac_abort - Channel Availability Check offchan abort event
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -1661,7 +1661,7 @@ static int ieee80211_stop_ap(struct wiph
- 		wiphy_delayed_work_cancel(wiphy, &link->dfs_cac_timer_work);
- 		cfg80211_cac_event(sdata->dev, &chandef,
- 				   NL80211_RADAR_CAC_ABORTED,
--				   GFP_KERNEL);
-+				   GFP_KERNEL, 0);
- 	}
- 
- 	drv_stop_ap(sdata->local, sdata, link_conf);
-@@ -3459,7 +3459,7 @@ static int ieee80211_set_bitrate_mask(st
- static int ieee80211_start_radar_detection(struct wiphy *wiphy,
- 					   struct net_device *dev,
- 					   struct cfg80211_chan_def *chandef,
--					   u32 cac_time_ms)
-+					   u32 cac_time_ms, int link_id)
- {
- 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
- 	struct ieee80211_chan_req chanreq = { .oper = *chandef };
-@@ -3487,7 +3487,7 @@ static int ieee80211_start_radar_detecti
- }
- 
- static void ieee80211_end_cac(struct wiphy *wiphy,
--			      struct net_device *dev)
-+			      struct net_device *dev, unsigned int link_id)
- {
- 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
- 	struct ieee80211_local *local = sdata->local;
---- a/net/mac80211/iface.c
-+++ b/net/mac80211/iface.c
-@@ -559,7 +559,7 @@ static void ieee80211_do_stop(struct iee
- 		ieee80211_link_release_channel(&sdata->deflink);
- 		cfg80211_cac_event(sdata->dev, &chandef,
- 				   NL80211_RADAR_CAC_ABORTED,
--				   GFP_KERNEL);
-+				   GFP_KERNEL, 0);
- 	}
- 
- 	if (sdata->vif.type == NL80211_IFTYPE_AP) {
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -3043,7 +3043,7 @@ void ieee80211_dfs_cac_timer_work(struct
- 		ieee80211_link_release_channel(link);
- 		cfg80211_cac_event(sdata->dev, &chandef,
- 				   NL80211_RADAR_CAC_FINISHED,
--				   GFP_KERNEL);
-+				   GFP_KERNEL, 0);
- 	}
- }
- 
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -3468,7 +3468,7 @@ void ieee80211_dfs_cac_cancel(struct iee
- 			cfg80211_cac_event(sdata->dev,
- 					   &chandef,
- 					   NL80211_RADAR_CAC_ABORTED,
--					   GFP_KERNEL);
-+					   GFP_KERNEL, 0);
- 		}
- 	}
- }
---- a/net/wireless/mlme.c
-+++ b/net/wireless/mlme.c
-@@ -1111,18 +1111,19 @@ EXPORT_SYMBOL(__cfg80211_radar_event);
- 
- void cfg80211_cac_event(struct net_device *netdev,
- 			const struct cfg80211_chan_def *chandef,
--			enum nl80211_radar_event event, gfp_t gfp)
-+			enum nl80211_radar_event event, gfp_t gfp,
-+			unsigned int link_id)
- {
- 	struct wireless_dev *wdev = netdev->ieee80211_ptr;
- 	struct wiphy *wiphy = wdev->wiphy;
- 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
- 	unsigned long timeout;
- 
--	/* not yet supported */
--	if (wdev->valid_links)
-+	if (WARN_ON(wdev->valid_links &&
-+		    !(wdev->valid_links & BIT(link_id))))
- 		return;
- 
--	trace_cfg80211_cac_event(netdev, event);
-+	trace_cfg80211_cac_event(netdev, event, link_id);
- 
- 	if (WARN_ON(!wdev->links[0].cac_started &&
- 		    event != NL80211_RADAR_CAC_STARTED))
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -10122,7 +10122,20 @@ static int nl80211_start_radar_detection
- 		goto unlock;
- 	}
- 
--	if (cfg80211_beaconing_iface_active(wdev) || wdev->links[0].cac_started) {
-+	if (cfg80211_beaconing_iface_active(wdev)) {
-+		/* During MLO other link(s) can beacon, only the current link
-+		 * can not already beacon
-+		 */
-+		if (wdev->valid_links &&
-+		    !wdev->links[0].ap.beacon_interval) {
-+			/* nothing */
-+		} else {
-+			err = -EBUSY;
-+			goto unlock;
-+		}
-+	}
-+
-+	if (wdev->links[0].cac_started) {
- 		err = -EBUSY;
- 		goto unlock;
- 	}
-@@ -10142,7 +10155,8 @@ static int nl80211_start_radar_detection
- 	if (WARN_ON(!cac_time_ms))
- 		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
- 
--	err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
-+	err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms,
-+					 0);
- 	if (!err) {
- 		switch (wdev->iftype) {
- 		case NL80211_IFTYPE_AP:
-@@ -16512,10 +16526,10 @@ nl80211_set_ttlm(struct sk_buff *skb, st
- 	SELECTOR(__sel, NETDEV_UP_NOTMX,		\
- 		 NL80211_FLAG_NEED_NETDEV_UP |		\
- 		 NL80211_FLAG_NO_WIPHY_MTX)		\
--	SELECTOR(__sel, NETDEV_UP_NOTMX_NOMLO,		\
-+	SELECTOR(__sel, NETDEV_UP_NOTMX_MLO,		\
- 		 NL80211_FLAG_NEED_NETDEV_UP |		\
- 		 NL80211_FLAG_NO_WIPHY_MTX |		\
--		 NL80211_FLAG_MLO_UNSUPPORTED)		\
-+		 NL80211_FLAG_MLO_VALID_LINK_ID)	\
- 	SELECTOR(__sel, NETDEV_UP_CLEAR,		\
- 		 NL80211_FLAG_NEED_NETDEV_UP |		\
- 		 NL80211_FLAG_CLEAR_SKB)		\
-@@ -17410,7 +17424,7 @@ static const struct genl_small_ops nl802
- 		.flags = GENL_UNS_ADMIN_PERM,
- 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
- 					 NL80211_FLAG_NO_WIPHY_MTX |
--					 NL80211_FLAG_MLO_UNSUPPORTED),
-+					 NL80211_FLAG_MLO_VALID_LINK_ID),
- 	},
- 	{
- 		.cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
---- a/net/wireless/rdev-ops.h
-+++ b/net/wireless/rdev-ops.h
-@@ -1200,26 +1200,27 @@ static inline int
- rdev_start_radar_detection(struct cfg80211_registered_device *rdev,
- 			   struct net_device *dev,
- 			   struct cfg80211_chan_def *chandef,
--			   u32 cac_time_ms)
-+			   u32 cac_time_ms, int link_id)
- {
- 	int ret = -EOPNOTSUPP;
- 
- 	trace_rdev_start_radar_detection(&rdev->wiphy, dev, chandef,
--					 cac_time_ms);
-+					 cac_time_ms, link_id);
- 	if (rdev->ops->start_radar_detection)
- 		ret = rdev->ops->start_radar_detection(&rdev->wiphy, dev,
--						       chandef, cac_time_ms);
-+						       chandef, cac_time_ms,
-+						       link_id);
- 	trace_rdev_return_int(&rdev->wiphy, ret);
- 	return ret;
- }
- 
- static inline void
- rdev_end_cac(struct cfg80211_registered_device *rdev,
--	     struct net_device *dev)
-+	     struct net_device *dev, unsigned int link_id)
- {
--	trace_rdev_end_cac(&rdev->wiphy, dev);
-+	trace_rdev_end_cac(&rdev->wiphy, dev, link_id);
- 	if (rdev->ops->end_cac)
--		rdev->ops->end_cac(&rdev->wiphy, dev);
-+		rdev->ops->end_cac(&rdev->wiphy, dev, link_id);
- 	trace_rdev_return_void(&rdev->wiphy);
- }
- 
---- a/net/wireless/reg.c
-+++ b/net/wireless/reg.c
-@@ -4229,6 +4229,8 @@ EXPORT_SYMBOL(regulatory_pre_cac_allowed
- static void cfg80211_check_and_end_cac(struct cfg80211_registered_device *rdev)
- {
- 	struct wireless_dev *wdev;
-+	unsigned int link_id;
-+
- 	/* If we finished CAC or received radar, we should end any
- 	 * CAC running on the same channels.
- 	 * the check !cfg80211_chandef_dfs_usable contain 2 options:
-@@ -4241,16 +4243,17 @@ static void cfg80211_check_and_end_cac(s
- 	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
- 		struct cfg80211_chan_def *chandef;
- 
--		if (!wdev->links[0].cac_started)
--			continue;
-+		for_each_valid_link(wdev, link_id) {
-+			if (!wdev->links[link_id].cac_started)
-+				continue;
- 
--		/* FIXME: radar detection is tied to link 0 for now */
--		chandef = wdev_chandef(wdev, 0);
--		if (!chandef)
--			continue;
-+			chandef = wdev_chandef(wdev, link_id);
-+			if (!chandef)
-+				continue;
- 
--		if (!cfg80211_chandef_dfs_usable(&rdev->wiphy, chandef))
--			rdev_end_cac(rdev, wdev->netdev);
-+			if (!cfg80211_chandef_dfs_usable(&rdev->wiphy, chandef))
-+				rdev_end_cac(rdev, wdev->netdev, link_id);
-+		}
- 	}
- }
- 
---- a/net/wireless/trace.h
-+++ b/net/wireless/trace.h
-@@ -806,17 +806,21 @@ DEFINE_EVENT(wiphy_netdev_evt, rdev_flus
- );
- 
- TRACE_EVENT(rdev_end_cac,
--	TP_PROTO(struct wiphy *wiphy, struct net_device *netdev),
--	TP_ARGS(wiphy, netdev),
-+	TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
-+		 unsigned int link_id),
-+	TP_ARGS(wiphy, netdev, link_id),
- 	TP_STRUCT__entry(
- 		WIPHY_ENTRY
- 		NETDEV_ENTRY
-+		__field(unsigned int, link_id)
- 	),
- 	TP_fast_assign(
- 		WIPHY_ASSIGN;
- 		NETDEV_ASSIGN;
-+		__entry->link_id = link_id;
- 	),
--	TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT, WIPHY_PR_ARG, NETDEV_PR_ARG)
-+	TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", link_id: %d",
-+		  WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->link_id)
- );
- 
- DECLARE_EVENT_CLASS(station_add_change,
-@@ -2661,24 +2665,26 @@ TRACE_EVENT(rdev_external_auth,
- TRACE_EVENT(rdev_start_radar_detection,
- 	TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
- 		 struct cfg80211_chan_def *chandef,
--		 u32 cac_time_ms),
--	TP_ARGS(wiphy, netdev, chandef, cac_time_ms),
-+		 u32 cac_time_ms, int link_id),
-+	TP_ARGS(wiphy, netdev, chandef, cac_time_ms, link_id),
- 	TP_STRUCT__entry(
- 		WIPHY_ENTRY
- 		NETDEV_ENTRY
- 		CHAN_DEF_ENTRY
- 		__field(u32, cac_time_ms)
-+		__field(int, link_id)
- 	),
- 	TP_fast_assign(
- 		WIPHY_ASSIGN;
- 		NETDEV_ASSIGN;
- 		CHAN_DEF_ASSIGN(chandef);
- 		__entry->cac_time_ms = cac_time_ms;
-+		__entry->link_id = link_id;
- 	),
- 	TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", " CHAN_DEF_PR_FMT
--		  ", cac_time_ms=%u",
-+		  ", cac_time_ms=%u, link_id=%d",
- 		  WIPHY_PR_ARG, NETDEV_PR_ARG, CHAN_DEF_PR_ARG,
--		  __entry->cac_time_ms)
-+		  __entry->cac_time_ms, __entry->link_id)
- );
- 
- TRACE_EVENT(rdev_set_mcast_rate,
-@@ -3492,18 +3498,21 @@ TRACE_EVENT(cfg80211_radar_event,
- );
- 
- TRACE_EVENT(cfg80211_cac_event,
--	TP_PROTO(struct net_device *netdev, enum nl80211_radar_event evt),
--	TP_ARGS(netdev, evt),
-+	TP_PROTO(struct net_device *netdev, enum nl80211_radar_event evt,
-+		 unsigned int link_id),
-+	TP_ARGS(netdev, evt, link_id),
- 	TP_STRUCT__entry(
- 		NETDEV_ENTRY
- 		__field(enum nl80211_radar_event, evt)
-+		__field(unsigned int, link_id)
- 	),
- 	TP_fast_assign(
- 		NETDEV_ASSIGN;
- 		__entry->evt = evt;
-+		__entry->link_id = link_id;
- 	),
--	TP_printk(NETDEV_PR_FMT ",  event: %d",
--		  NETDEV_PR_ARG, __entry->evt)
-+	TP_printk(NETDEV_PR_FMT ",  event: %d, link_id=%u",
-+		  NETDEV_PR_ARG, __entry->evt, __entry->link_id)
- );
- 
- DECLARE_EVENT_CLASS(cfg80211_rx_evt,
diff --git a/package/kernel/mac80211/patches/subsys/357-wifi-mac80211-add-support-for-the-monitor-SKIP_TX-fl.patch b/package/kernel/mac80211/patches/subsys/337-wifi-mac80211-add-support-for-the-monitor-SKIP_TX-fl.patch
similarity index 93%
rename from package/kernel/mac80211/patches/subsys/357-wifi-mac80211-add-support-for-the-monitor-SKIP_TX-fl.patch
rename to package/kernel/mac80211/patches/subsys/337-wifi-mac80211-add-support-for-the-monitor-SKIP_TX-fl.patch
index e62c15c19d16c9..3cd8baefe137e4 100644
--- a/package/kernel/mac80211/patches/subsys/357-wifi-mac80211-add-support-for-the-monitor-SKIP_TX-fl.patch
+++ b/package/kernel/mac80211/patches/subsys/337-wifi-mac80211-add-support-for-the-monitor-SKIP_TX-fl.patch
@@ -11,7 +11,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1374,7 +1374,7 @@ struct ieee80211_local {
+@@ -1382,7 +1382,7 @@ struct ieee80211_local {
  	spinlock_t queue_stop_reason_lock;
  
  	int open_count;
@@ -22,7 +22,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	    fif_probe_req;
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
-@@ -1094,6 +1094,8 @@ void ieee80211_adjust_monitor_flags(stru
+@@ -1103,6 +1103,8 @@ void ieee80211_adjust_monitor_flags(stru
  	ADJUST(CONTROL, control);
  	ADJUST(CONTROL, pspoll);
  	ADJUST(OTHER_BSS, other_bss);
diff --git a/package/kernel/mac80211/patches/subsys/338-wifi-mac80211-handle-DFS-per-link.patch b/package/kernel/mac80211/patches/subsys/338-wifi-mac80211-handle-DFS-per-link.patch
deleted file mode 100644
index 388c0575c88582..00000000000000
--- a/package/kernel/mac80211/patches/subsys/338-wifi-mac80211-handle-DFS-per-link.patch
+++ /dev/null
@@ -1,134 +0,0 @@
-From: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Date: Fri, 6 Sep 2024 12:14:24 +0530
-Subject: [PATCH] wifi: mac80211: handle DFS per link
-
-In order to support DFS with MLO, handle the link ID now passed from
-cfg80211, adjust the code to do everything per link and call the
-notifications to cfg80211 correctly.
-
-Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Link: https://patch.msgid.link/20240906064426.2101315-7-quic_adisi@quicinc.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -3464,6 +3464,7 @@ static int ieee80211_start_radar_detecti
- 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
- 	struct ieee80211_chan_req chanreq = { .oper = *chandef };
- 	struct ieee80211_local *local = sdata->local;
-+	struct ieee80211_link_data *link_data;
- 	int err;
- 
- 	lockdep_assert_wiphy(local->hw.wiphy);
-@@ -3471,16 +3472,20 @@ static int ieee80211_start_radar_detecti
- 	if (!list_empty(&local->roc_list) || local->scanning)
- 		return -EBUSY;
- 
-+	link_data = sdata_dereference(sdata->link[link_id], sdata);
-+	if (!link_data)
-+		return -ENOLINK;
-+
- 	/* whatever, but channel contexts should not complain about that one */
--	sdata->deflink.smps_mode = IEEE80211_SMPS_OFF;
--	sdata->deflink.needed_rx_chains = local->rx_chains;
-+	link_data->smps_mode = IEEE80211_SMPS_OFF;
-+	link_data->needed_rx_chains = local->rx_chains;
- 
--	err = ieee80211_link_use_channel(&sdata->deflink, &chanreq,
-+	err = ieee80211_link_use_channel(link_data, &chanreq,
- 					 IEEE80211_CHANCTX_SHARED);
- 	if (err)
- 		return err;
- 
--	wiphy_delayed_work_queue(wiphy, &sdata->deflink.dfs_cac_timer_work,
-+	wiphy_delayed_work_queue(wiphy, &link_data->dfs_cac_timer_work,
- 				 msecs_to_jiffies(cac_time_ms));
- 
- 	return 0;
-@@ -3491,16 +3496,21 @@ static void ieee80211_end_cac(struct wip
- {
- 	struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
- 	struct ieee80211_local *local = sdata->local;
-+	struct ieee80211_link_data *link_data;
- 
- 	lockdep_assert_wiphy(local->hw.wiphy);
- 
- 	list_for_each_entry(sdata, &local->interfaces, list) {
-+		link_data = sdata_dereference(sdata->link[link_id], sdata);
-+		if (!link_data)
-+			continue;
-+
- 		wiphy_delayed_work_cancel(wiphy,
--					  &sdata->deflink.dfs_cac_timer_work);
-+					  &link_data->dfs_cac_timer_work);
- 
--		if (sdata->wdev.links[0].cac_started) {
--			ieee80211_link_release_channel(&sdata->deflink);
--			sdata->wdev.links[0].cac_started = false;
-+		if (sdata->wdev.links[link_id].cac_started) {
-+			ieee80211_link_release_channel(link_data);
-+			sdata->wdev.links[link_id].cac_started = false;
- 		}
- 	}
- }
---- a/net/mac80211/link.c
-+++ b/net/mac80211/link.c
-@@ -77,6 +77,16 @@ void ieee80211_link_stop(struct ieee8021
- 			  &link->color_change_finalize_work);
- 	wiphy_work_cancel(link->sdata->local->hw.wiphy,
- 			  &link->csa.finalize_work);
-+
-+	if (link->sdata->wdev.links[link->link_id].cac_started) {
-+		wiphy_delayed_work_cancel(link->sdata->local->hw.wiphy,
-+					  &link->dfs_cac_timer_work);
-+		cfg80211_cac_event(link->sdata->dev,
-+				   &link->conf->chanreq.oper,
-+				   NL80211_RADAR_CAC_ABORTED,
-+				   GFP_KERNEL, link->link_id);
-+	}
-+
- 	ieee80211_link_release_channel(link);
- }
- 
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -3455,20 +3455,30 @@ void ieee80211_dfs_cac_cancel(struct iee
- {
- 	struct ieee80211_sub_if_data *sdata;
- 	struct cfg80211_chan_def chandef;
-+	struct ieee80211_link_data *link;
-+	unsigned int link_id;
- 
- 	lockdep_assert_wiphy(local->hw.wiphy);
- 
- 	list_for_each_entry(sdata, &local->interfaces, list) {
--		wiphy_delayed_work_cancel(local->hw.wiphy,
--					  &sdata->deflink.dfs_cac_timer_work);
-+		for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS;
-+		     link_id++) {
-+			link = sdata_dereference(sdata->link[link_id],
-+						 sdata);
-+			if (!link)
-+				continue;
- 
--		if (sdata->wdev.links[0].cac_started) {
--			chandef = sdata->vif.bss_conf.chanreq.oper;
--			ieee80211_link_release_channel(&sdata->deflink);
--			cfg80211_cac_event(sdata->dev,
--					   &chandef,
-+			wiphy_delayed_work_cancel(local->hw.wiphy,
-+						  &link->dfs_cac_timer_work);
-+
-+			if (!sdata->wdev.links[link_id].cac_started)
-+				continue;
-+
-+			chandef = link->conf->chanreq.oper;
-+			ieee80211_link_release_channel(link);
-+			cfg80211_cac_event(sdata->dev, &chandef,
- 					   NL80211_RADAR_CAC_ABORTED,
--					   GFP_KERNEL, 0);
-+					   GFP_KERNEL, link_id);
- 		}
- 	}
- }
diff --git a/package/kernel/mac80211/patches/subsys/358-wifi-mac80211-refactor-ieee80211_rx_monitor.patch b/package/kernel/mac80211/patches/subsys/338-wifi-mac80211-refactor-ieee80211_rx_monitor.patch
similarity index 100%
rename from package/kernel/mac80211/patches/subsys/358-wifi-mac80211-refactor-ieee80211_rx_monitor.patch
rename to package/kernel/mac80211/patches/subsys/338-wifi-mac80211-refactor-ieee80211_rx_monitor.patch
diff --git a/package/kernel/mac80211/patches/subsys/339-wifi-cfg80211-mac80211-use-proper-link-ID-for-DFS.patch b/package/kernel/mac80211/patches/subsys/339-wifi-cfg80211-mac80211-use-proper-link-ID-for-DFS.patch
deleted file mode 100644
index 53079b6cf629e0..00000000000000
--- a/package/kernel/mac80211/patches/subsys/339-wifi-cfg80211-mac80211-use-proper-link-ID-for-DFS.patch
+++ /dev/null
@@ -1,168 +0,0 @@
-From: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Date: Fri, 6 Sep 2024 12:14:25 +0530
-Subject: [PATCH] wifi: cfg80211/mac80211: use proper link ID for DFS
-
-Now that all APIs have support to handle DFS per link, use proper link ID
-instead of 0.
-
-Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Link: https://patch.msgid.link/20240906064426.2101315-8-quic_adisi@quicinc.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/net/mac80211/cfg.c
-+++ b/net/mac80211/cfg.c
-@@ -1656,12 +1656,12 @@ static int ieee80211_stop_ap(struct wiph
- 	ieee80211_link_info_change_notify(sdata, link,
- 					  BSS_CHANGED_BEACON_ENABLED);
- 
--	if (sdata->wdev.links[0].cac_started) {
-+	if (sdata->wdev.links[link_id].cac_started) {
- 		chandef = link_conf->chanreq.oper;
- 		wiphy_delayed_work_cancel(wiphy, &link->dfs_cac_timer_work);
- 		cfg80211_cac_event(sdata->dev, &chandef,
- 				   NL80211_RADAR_CAC_ABORTED,
--				   GFP_KERNEL, 0);
-+				   GFP_KERNEL, link_id);
- 	}
- 
- 	drv_stop_ap(sdata->local, sdata, link_conf);
-@@ -3965,7 +3965,7 @@ __ieee80211_channel_switch(struct wiphy
- 	if (!list_empty(&local->roc_list) || local->scanning)
- 		return -EBUSY;
- 
--	if (sdata->wdev.links[0].cac_started)
-+	if (sdata->wdev.links[link_id].cac_started)
- 		return -EBUSY;
- 
- 	if (WARN_ON(link_id >= IEEE80211_MLD_MAX_NUM_LINKS))
---- a/net/mac80211/mlme.c
-+++ b/net/mac80211/mlme.c
-@@ -3039,11 +3039,11 @@ void ieee80211_dfs_cac_timer_work(struct
- 
- 	lockdep_assert_wiphy(sdata->local->hw.wiphy);
- 
--	if (sdata->wdev.links[0].cac_started) {
-+	if (sdata->wdev.links[link->link_id].cac_started) {
- 		ieee80211_link_release_channel(link);
- 		cfg80211_cac_event(sdata->dev, &chandef,
- 				   NL80211_RADAR_CAC_FINISHED,
--				   GFP_KERNEL, 0);
-+				   GFP_KERNEL, link->link_id);
- 	}
- }
- 
---- a/net/mac80211/scan.c
-+++ b/net/mac80211/scan.c
-@@ -575,6 +575,7 @@ static bool __ieee80211_can_leave_ch(str
- {
- 	struct ieee80211_local *local = sdata->local;
- 	struct ieee80211_sub_if_data *sdata_iter;
-+	unsigned int link_id;
- 
- 	lockdep_assert_wiphy(local->hw.wiphy);
- 
-@@ -585,8 +586,9 @@ static bool __ieee80211_can_leave_ch(str
- 		return false;
- 
- 	list_for_each_entry(sdata_iter, &local->interfaces, list) {
--		if (sdata_iter->wdev.links[0].cac_started)
--			return false;
-+		for_each_valid_link(&sdata_iter->wdev, link_id)
-+			if (sdata_iter->wdev.links[link_id].cac_started)
-+				return false;
- 	}
- 
- 	return true;
---- a/net/wireless/mlme.c
-+++ b/net/wireless/mlme.c
-@@ -1125,14 +1125,14 @@ void cfg80211_cac_event(struct net_devic
- 
- 	trace_cfg80211_cac_event(netdev, event, link_id);
- 
--	if (WARN_ON(!wdev->links[0].cac_started &&
-+	if (WARN_ON(!wdev->links[link_id].cac_started &&
- 		    event != NL80211_RADAR_CAC_STARTED))
- 		return;
- 
- 	switch (event) {
- 	case NL80211_RADAR_CAC_FINISHED:
--		timeout = wdev->links[0].cac_start_time +
--			  msecs_to_jiffies(wdev->links[0].cac_time_ms);
-+		timeout = wdev->links[link_id].cac_start_time +
-+			  msecs_to_jiffies(wdev->links[link_id].cac_time_ms);
- 		WARN_ON(!time_after_eq(jiffies, timeout));
- 		cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
- 		memcpy(&rdev->cac_done_chandef, chandef,
-@@ -1141,10 +1141,10 @@ void cfg80211_cac_event(struct net_devic
- 		cfg80211_sched_dfs_chan_update(rdev);
- 		fallthrough;
- 	case NL80211_RADAR_CAC_ABORTED:
--		wdev->links[0].cac_started = false;
-+		wdev->links[link_id].cac_started = false;
- 		break;
- 	case NL80211_RADAR_CAC_STARTED:
--		wdev->links[0].cac_started = true;
-+		wdev->links[link_id].cac_started = true;
- 		break;
- 	default:
- 		WARN_ON(1);
---- a/net/wireless/nl80211.c
-+++ b/net/wireless/nl80211.c
-@@ -6066,7 +6066,7 @@ static int nl80211_start_ap(struct sk_bu
- 	if (!rdev->ops->start_ap)
- 		return -EOPNOTSUPP;
- 
--	if (wdev->links[0].cac_started)
-+	if (wdev->links[link_id].cac_started)
- 		return -EBUSY;
- 
- 	if (wdev->links[link_id].ap.beacon_interval)
-@@ -10073,6 +10073,7 @@ static int nl80211_start_radar_detection
- 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
- 	struct net_device *dev = info->user_ptr[1];
- 	struct wireless_dev *wdev = dev->ieee80211_ptr;
-+	int link_id = nl80211_link_id(info->attrs);
- 	struct wiphy *wiphy = wdev->wiphy;
- 	struct cfg80211_chan_def chandef;
- 	enum nl80211_dfs_regions dfs_region;
-@@ -10127,7 +10128,7 @@ static int nl80211_start_radar_detection
- 		 * can not already beacon
- 		 */
- 		if (wdev->valid_links &&
--		    !wdev->links[0].ap.beacon_interval) {
-+		    !wdev->links[link_id].ap.beacon_interval) {
- 			/* nothing */
- 		} else {
- 			err = -EBUSY;
-@@ -10135,7 +10136,7 @@ static int nl80211_start_radar_detection
- 		}
- 	}
- 
--	if (wdev->links[0].cac_started) {
-+	if (wdev->links[link_id].cac_started) {
- 		err = -EBUSY;
- 		goto unlock;
- 	}
-@@ -10156,7 +10157,7 @@ static int nl80211_start_radar_detection
- 		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
- 
- 	err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms,
--					 0);
-+					 link_id);
- 	if (!err) {
- 		switch (wdev->iftype) {
- 		case NL80211_IFTYPE_AP:
-@@ -10172,9 +10173,9 @@ static int nl80211_start_radar_detection
- 		default:
- 			break;
- 		}
--		wdev->links[0].cac_started = true;
--		wdev->links[0].cac_start_time = jiffies;
--		wdev->links[0].cac_time_ms = cac_time_ms;
-+		wdev->links[link_id].cac_started = true;
-+		wdev->links[link_id].cac_start_time = jiffies;
-+		wdev->links[link_id].cac_time_ms = cac_time_ms;
- 	}
- unlock:
- 	wiphy_unlock(wiphy);
diff --git a/package/kernel/mac80211/patches/subsys/359-wifi-mac80211-filter-on-monitor-interfaces-based-on-.patch b/package/kernel/mac80211/patches/subsys/339-wifi-mac80211-filter-on-monitor-interfaces-based-on-.patch
similarity index 100%
rename from package/kernel/mac80211/patches/subsys/359-wifi-mac80211-filter-on-monitor-interfaces-based-on-.patch
rename to package/kernel/mac80211/patches/subsys/339-wifi-mac80211-filter-on-monitor-interfaces-based-on-.patch
diff --git a/package/kernel/mac80211/patches/subsys/360-wifi-cfg80211-report-per-wiphy-radio-antenna-mask.patch b/package/kernel/mac80211/patches/subsys/340-wifi-cfg80211-report-per-wiphy-radio-antenna-mask.patch
similarity index 88%
rename from package/kernel/mac80211/patches/subsys/360-wifi-cfg80211-report-per-wiphy-radio-antenna-mask.patch
rename to package/kernel/mac80211/patches/subsys/340-wifi-cfg80211-report-per-wiphy-radio-antenna-mask.patch
index 178e01dc163ca8..8ce24cd3e642d3 100644
--- a/package/kernel/mac80211/patches/subsys/360-wifi-cfg80211-report-per-wiphy-radio-antenna-mask.patch
+++ b/package/kernel/mac80211/patches/subsys/340-wifi-cfg80211-report-per-wiphy-radio-antenna-mask.patch
@@ -11,7 +11,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/include/net/cfg80211.h
 +++ b/include/net/cfg80211.h
-@@ -5443,6 +5443,8 @@ struct wiphy_radio_freq_range {
+@@ -5446,6 +5446,8 @@ struct wiphy_radio_freq_range {
   * @iface_combinations: Valid interface combinations array, should not
   *	list single interface types.
   * @n_iface_combinations: number of entries in @iface_combinations array.
@@ -20,7 +20,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
   */
  struct wiphy_radio {
  	const struct wiphy_radio_freq_range *freq_range;
-@@ -5450,6 +5452,8 @@ struct wiphy_radio {
+@@ -5453,6 +5455,8 @@ struct wiphy_radio {
  
  	const struct ieee80211_iface_combination *iface_combinations;
  	int n_iface_combinations;
@@ -31,7 +31,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #define CFG80211_HW_TIMESTAMP_ALL_PEERS	0xffff
 --- a/include/uapi/linux/nl80211.h
 +++ b/include/uapi/linux/nl80211.h
-@@ -8038,6 +8038,8 @@ enum nl80211_ap_settings_flags {
+@@ -8044,6 +8044,8 @@ enum nl80211_ap_settings_flags {
   * @NL80211_WIPHY_RADIO_ATTR_INTERFACE_COMBINATION: Supported interface
   *	combination for this radio. Attribute may be present multiple times
   *	and contains attributes defined in &enum nl80211_if_combination_attrs.
@@ -40,7 +40,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
   *
   * @__NL80211_WIPHY_RADIO_ATTR_LAST: Internal
   * @NL80211_WIPHY_RADIO_ATTR_MAX: Highest attribute
-@@ -8048,6 +8050,7 @@ enum nl80211_wiphy_radio_attrs {
+@@ -8054,6 +8056,7 @@ enum nl80211_wiphy_radio_attrs {
  	NL80211_WIPHY_RADIO_ATTR_INDEX,
  	NL80211_WIPHY_RADIO_ATTR_FREQ_RANGE,
  	NL80211_WIPHY_RADIO_ATTR_INTERFACE_COMBINATION,
@@ -50,7 +50,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	__NL80211_WIPHY_RADIO_ATTR_LAST,
 --- a/net/wireless/nl80211.c
 +++ b/net/wireless/nl80211.c
-@@ -2431,6 +2431,11 @@ static int nl80211_put_radio(struct wiph
+@@ -2438,6 +2438,11 @@ static int nl80211_put_radio(struct wiph
  	if (nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_INDEX, idx))
  		goto nla_put_failure;
  
diff --git a/package/kernel/mac80211/patches/subsys/340-wifi-mac80211-handle-ieee80211_radar_detected-for-ML.patch b/package/kernel/mac80211/patches/subsys/340-wifi-mac80211-handle-ieee80211_radar_detected-for-ML.patch
deleted file mode 100644
index 3f64864bd41f2e..00000000000000
--- a/package/kernel/mac80211/patches/subsys/340-wifi-mac80211-handle-ieee80211_radar_detected-for-ML.patch
+++ /dev/null
@@ -1,360 +0,0 @@
-From: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Date: Fri, 6 Sep 2024 12:14:26 +0530
-Subject: [PATCH] wifi: mac80211: handle ieee80211_radar_detected() for MLO
-
-Currently DFS works under assumption there could be only one channel
-context in the hardware. Hence, drivers just calls the function
-ieee80211_radar_detected() passing the hardware structure. However, with
-MLO, this obviously will not work since number of channel contexts will be
-more than one and hence drivers would need to pass the channel information
-as well on which the radar is detected.
-
-Also, when radar is detected in one of the links, other link's CAC should
-not be cancelled.
-
-Hence, in order to support DFS with MLO, do the following changes -
-  * Add channel context conf pointer as an argument to the function
-    ieee80211_radar_detected(). During MLO, drivers would have to pass on
-    which channel context conf radar is detected. Otherwise, drivers could
-    just pass NULL.
-  * ieee80211_radar_detected() will iterate over all channel contexts
-    present and
-  	* if channel context conf is passed, only mark that as radar
-  	  detected
-  	* if NULL is passed, then mark all channel contexts as radar
-  	  detected
-  	* Then as usual, schedule the radar detected work.
-  * In the worker, go over all the contexts again and for all such context
-    which is marked with radar detected, cancel the ongoing CAC by calling
-    ieee80211_dfs_cac_cancel() and then notify cfg80211 via
-    cfg80211_radar_event().
-  * To cancel the CAC, pass the channel context as well where radar is
-    detected to ieee80211_dfs_cac_cancel(). This ensures that CAC is
-    canceled only on the links using the provided context, leaving other
-    links unaffected.
-
-This would also help in scenarios where there is split phy 5 GHz radio,
-which is capable of DFS channels in both lower and upper band. In this
-case, simultaneous radars can be detected.
-
-Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
-Link: https://patch.msgid.link/20240906064426.2101315-9-quic_adisi@quicinc.com
-Signed-off-by: Johannes Berg <johannes.berg@intel.com>
----
-
---- a/drivers/net/wireless/ath/ath10k/debug.c
-+++ b/drivers/net/wireless/ath/ath10k/debug.c
-@@ -3,7 +3,7 @@
-  * Copyright (c) 2005-2011 Atheros Communications Inc.
-  * Copyright (c) 2011-2017 Qualcomm Atheros, Inc.
-  * Copyright (c) 2018, The Linux Foundation. All rights reserved.
-- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
-+ * Copyright (c) 2022, 2024 Qualcomm Innovation Center, Inc. All rights reserved.
-  */
- 
- #include <linux/module.h>
-@@ -1774,7 +1774,7 @@ static ssize_t ath10k_write_simulate_rad
- 	if (!arvif->is_started)
- 		return -EINVAL;
- 
--	ieee80211_radar_detected(ar->hw);
-+	ieee80211_radar_detected(ar->hw, NULL);
- 
- 	return count;
- }
---- a/drivers/net/wireless/ath/ath10k/mac.c
-+++ b/drivers/net/wireless/ath/ath10k/mac.c
-@@ -1437,7 +1437,7 @@ static void ath10k_recalc_radar_detectio
- 		 * by indicating that radar was detected.
- 		 */
- 		ath10k_warn(ar, "failed to start CAC: %d\n", ret);
--		ieee80211_radar_detected(ar->hw);
-+		ieee80211_radar_detected(ar->hw, NULL);
- 	}
- }
- 
---- a/drivers/net/wireless/ath/ath10k/wmi.c
-+++ b/drivers/net/wireless/ath/ath10k/wmi.c
-@@ -3990,7 +3990,7 @@ static void ath10k_radar_detected(struct
- 	if (ar->dfs_block_radar_events)
- 		ath10k_info(ar, "DFS Radar detected, but ignored as requested\n");
- 	else
--		ieee80211_radar_detected(ar->hw);
-+		ieee80211_radar_detected(ar->hw, NULL);
- }
- 
- static void ath10k_radar_confirmation_work(struct work_struct *work)
---- a/drivers/net/wireless/ath/ath11k/wmi.c
-+++ b/drivers/net/wireless/ath/ath11k/wmi.c
-@@ -8358,7 +8358,7 @@ ath11k_wmi_pdev_dfs_radar_detected_event
- 	if (ar->dfs_block_radar_events)
- 		ath11k_info(ab, "DFS Radar detected, but ignored as requested\n");
- 	else
--		ieee80211_radar_detected(ar->hw);
-+		ieee80211_radar_detected(ar->hw, NULL);
- 
- exit:
- 	rcu_read_unlock();
---- a/drivers/net/wireless/ath/ath12k/wmi.c
-+++ b/drivers/net/wireless/ath/ath12k/wmi.c
-@@ -6789,7 +6789,7 @@ ath12k_wmi_pdev_dfs_radar_detected_event
- 	if (ar->dfs_block_radar_events)
- 		ath12k_info(ab, "DFS Radar detected, but ignored as requested\n");
- 	else
--		ieee80211_radar_detected(ath12k_ar_to_hw(ar));
-+		ieee80211_radar_detected(ath12k_ar_to_hw(ar), NULL);
- 
- exit:
- 	rcu_read_unlock();
---- a/drivers/net/wireless/ath/ath9k/dfs.c
-+++ b/drivers/net/wireless/ath/ath9k/dfs.c
-@@ -280,7 +280,7 @@ ath9k_dfs_process_radar_pulse(struct ath
- 	if (!pd->add_pulse(pd, pe, NULL))
- 		return;
- 	DFS_STAT_INC(sc, radar_detected);
--	ieee80211_radar_detected(sc->hw);
-+	ieee80211_radar_detected(sc->hw, NULL);
- }
- 
- /*
---- a/drivers/net/wireless/ath/ath9k/dfs_debug.c
-+++ b/drivers/net/wireless/ath/ath9k/dfs_debug.c
-@@ -116,7 +116,7 @@ static ssize_t write_file_simulate_radar
- {
- 	struct ath_softc *sc = file->private_data;
- 
--	ieee80211_radar_detected(sc->hw);
-+	ieee80211_radar_detected(sc->hw, NULL);
- 
- 	return count;
- }
---- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
-@@ -394,7 +394,7 @@ mt7615_mcu_rx_radar_detected(struct mt76
- 	if (mt76_phy_dfs_state(mphy) < MT_DFS_STATE_CAC)
- 		return;
- 
--	ieee80211_radar_detected(mphy->hw);
-+	ieee80211_radar_detected(mphy->hw, NULL);
- 	dev->hw_pattern++;
- }
- 
---- a/drivers/net/wireless/mediatek/mt76/mt76x02_dfs.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_dfs.c
-@@ -630,7 +630,7 @@ static void mt76x02_dfs_tasklet(struct t
- 		radar_detected = mt76x02_dfs_check_detection(dev);
- 		if (radar_detected) {
- 			/* sw detector rx radar pattern */
--			ieee80211_radar_detected(dev->mt76.hw);
-+			ieee80211_radar_detected(dev->mt76.hw, NULL);
- 			mt76x02_dfs_detector_reset(dev);
- 
- 			return;
-@@ -658,7 +658,7 @@ static void mt76x02_dfs_tasklet(struct t
- 
- 		/* hw detector rx radar pattern */
- 		dfs_pd->stats[i].hw_pattern++;
--		ieee80211_radar_detected(dev->mt76.hw);
-+		ieee80211_radar_detected(dev->mt76.hw, NULL);
- 		mt76x02_dfs_detector_reset(dev);
- 
- 		return;
---- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
-@@ -293,7 +293,7 @@ mt7915_mcu_rx_radar_detected(struct mt79
- 						&dev->rdd2_chandef,
- 						GFP_ATOMIC);
- 	else
--		ieee80211_radar_detected(mphy->hw);
-+		ieee80211_radar_detected(mphy->hw, NULL);
- 	dev->hw_pattern++;
- }
- 
---- a/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
-+++ b/drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
-@@ -371,7 +371,7 @@ mt7996_mcu_rx_radar_detected(struct mt79
- 						&dev->rdd2_chandef,
- 						GFP_ATOMIC);
- 	else
--		ieee80211_radar_detected(mphy->hw);
-+		ieee80211_radar_detected(mphy->hw, NULL);
- 	dev->hw_pattern++;
- }
- 
---- a/drivers/net/wireless/ti/wl18xx/event.c
-+++ b/drivers/net/wireless/ti/wl18xx/event.c
-@@ -142,7 +142,7 @@ int wl18xx_process_mailbox_events(struct
- 			    wl18xx_radar_type_decode(mbox->radar_type));
- 
- 		if (!wl->radar_debug_mode)
--			ieee80211_radar_detected(wl->hw);
-+			ieee80211_radar_detected(wl->hw, NULL);
- 	}
- 
- 	if (vector & PERIODIC_SCAN_REPORT_EVENT_ID) {
---- a/drivers/net/wireless/virtual/mac80211_hwsim.c
-+++ b/drivers/net/wireless/virtual/mac80211_hwsim.c
-@@ -1146,7 +1146,7 @@ static int hwsim_write_simulate_radar(vo
- {
- 	struct mac80211_hwsim_data *data = dat;
- 
--	ieee80211_radar_detected(data->hw);
-+	ieee80211_radar_detected(data->hw, NULL);
- 
- 	return 0;
- }
---- a/include/net/mac80211.h
-+++ b/include/net/mac80211.h
-@@ -6717,8 +6717,11 @@ void ieee80211_cqm_beacon_loss_notify(st
-  * ieee80211_radar_detected - inform that a radar was detected
-  *
-  * @hw: pointer as obtained from ieee80211_alloc_hw()
-+ * @chanctx_conf: Channel context on which radar is detected. Mandatory to
-+ *	pass a valid pointer during MLO. For non-MLO %NULL can be passed
-  */
--void ieee80211_radar_detected(struct ieee80211_hw *hw);
-+void ieee80211_radar_detected(struct ieee80211_hw *hw,
-+			      struct ieee80211_chanctx_conf *chanctx_conf);
- 
- /**
-  * ieee80211_chswitch_done - Complete channel switch process
---- a/net/mac80211/chan.c
-+++ b/net/mac80211/chan.c
-@@ -681,6 +681,7 @@ ieee80211_alloc_chanctx(struct ieee80211
- 	ctx->mode = mode;
- 	ctx->conf.radar_enabled = false;
- 	ctx->conf.radio_idx = radio_idx;
-+	ctx->radar_detected = false;
- 	_ieee80211_recalc_chanctx_min_def(local, ctx, NULL, false);
- 
- 	return ctx;
---- a/net/mac80211/ieee80211_i.h
-+++ b/net/mac80211/ieee80211_i.h
-@@ -895,6 +895,8 @@ struct ieee80211_chanctx {
- 	struct ieee80211_chan_req req;
- 
- 	struct ieee80211_chanctx_conf conf;
-+
-+	bool radar_detected;
- };
- 
- struct mac80211_qos_map {
-@@ -2632,7 +2634,8 @@ void ieee80211_recalc_chanctx_min_def(st
- bool ieee80211_is_radar_required(struct ieee80211_local *local);
- 
- void ieee80211_dfs_cac_timer_work(struct wiphy *wiphy, struct wiphy_work *work);
--void ieee80211_dfs_cac_cancel(struct ieee80211_local *local);
-+void ieee80211_dfs_cac_cancel(struct ieee80211_local *local,
-+			      struct ieee80211_chanctx *chanctx);
- void ieee80211_dfs_radar_detected_work(struct wiphy *wiphy,
- 				       struct wiphy_work *work);
- int ieee80211_send_action_csa(struct ieee80211_sub_if_data *sdata,
---- a/net/mac80211/pm.c
-+++ b/net/mac80211/pm.c
-@@ -32,7 +32,7 @@ int __ieee80211_suspend(struct ieee80211
- 
- 	ieee80211_scan_cancel(local);
- 
--	ieee80211_dfs_cac_cancel(local);
-+	ieee80211_dfs_cac_cancel(local, NULL);
- 
- 	ieee80211_roc_purge(local, NULL);
- 
---- a/net/mac80211/util.c
-+++ b/net/mac80211/util.c
-@@ -3451,11 +3451,16 @@ u64 ieee80211_calculate_rx_timestamp(str
- 	return ts;
- }
- 
--void ieee80211_dfs_cac_cancel(struct ieee80211_local *local)
-+/* Cancel CAC for the interfaces under the specified @local. If @ctx is
-+ * also provided, only the interfaces using that ctx will be canceled.
-+ */
-+void ieee80211_dfs_cac_cancel(struct ieee80211_local *local,
-+			      struct ieee80211_chanctx *ctx)
- {
- 	struct ieee80211_sub_if_data *sdata;
- 	struct cfg80211_chan_def chandef;
- 	struct ieee80211_link_data *link;
-+	struct ieee80211_chanctx_conf *chanctx_conf;
- 	unsigned int link_id;
- 
- 	lockdep_assert_wiphy(local->hw.wiphy);
-@@ -3468,6 +3473,11 @@ void ieee80211_dfs_cac_cancel(struct iee
- 			if (!link)
- 				continue;
- 
-+			chanctx_conf = sdata_dereference(link->conf->chanctx_conf,
-+							 sdata);
-+			if (ctx && &ctx->conf != chanctx_conf)
-+				continue;
-+
- 			wiphy_delayed_work_cancel(local->hw.wiphy,
- 						  &link->dfs_cac_timer_work);
- 
-@@ -3488,9 +3498,8 @@ void ieee80211_dfs_radar_detected_work(s
- {
- 	struct ieee80211_local *local =
- 		container_of(work, struct ieee80211_local, radar_detected_work);
--	struct cfg80211_chan_def chandef = local->hw.conf.chandef;
-+	struct cfg80211_chan_def chandef;
- 	struct ieee80211_chanctx *ctx;
--	int num_chanctx = 0;
- 
- 	lockdep_assert_wiphy(local->hw.wiphy);
- 
-@@ -3498,25 +3507,46 @@ void ieee80211_dfs_radar_detected_work(s
- 		if (ctx->replace_state == IEEE80211_CHANCTX_REPLACES_OTHER)
- 			continue;
- 
--		num_chanctx++;
-+		if (!ctx->radar_detected)
-+			continue;
-+
-+		ctx->radar_detected = false;
-+
- 		chandef = ctx->conf.def;
-+
-+		ieee80211_dfs_cac_cancel(local, ctx);
-+		cfg80211_radar_event(local->hw.wiphy, &chandef, GFP_KERNEL);
- 	}
-+}
- 
--	ieee80211_dfs_cac_cancel(local);
-+static void
-+ieee80211_radar_mark_chan_ctx_iterator(struct ieee80211_hw *hw,
-+				       struct ieee80211_chanctx_conf *chanctx_conf,
-+				       void *data)
-+{
-+	struct ieee80211_chanctx *ctx =
-+		container_of(chanctx_conf, struct ieee80211_chanctx,
-+			     conf);
- 
--	if (num_chanctx > 1)
--		/* XXX: multi-channel is not supported yet */
--		WARN_ON(1);
--	else
--		cfg80211_radar_event(local->hw.wiphy, &chandef, GFP_KERNEL);
-+	if (ctx->replace_state == IEEE80211_CHANCTX_REPLACES_OTHER)
-+		return;
-+
-+	if (data && data != chanctx_conf)
-+		return;
-+
-+	ctx->radar_detected = true;
- }
- 
--void ieee80211_radar_detected(struct ieee80211_hw *hw)
-+void ieee80211_radar_detected(struct ieee80211_hw *hw,
-+			      struct ieee80211_chanctx_conf *chanctx_conf)
- {
- 	struct ieee80211_local *local = hw_to_local(hw);
- 
- 	trace_api_radar_detected(local);
- 
-+	ieee80211_iter_chan_contexts_atomic(hw, ieee80211_radar_mark_chan_ctx_iterator,
-+					    chanctx_conf);
-+
- 	wiphy_work_queue(hw->wiphy, &local->radar_detected_work);
- }
- EXPORT_SYMBOL(ieee80211_radar_detected);
diff --git a/package/kernel/mac80211/patches/subsys/341-wifi-mac80211-fix-vif-addr-when-switching-from-monit.patch b/package/kernel/mac80211/patches/subsys/341-wifi-mac80211-fix-vif-addr-when-switching-from-monit.patch
new file mode 100644
index 00000000000000..4e6d2ee5e9366b
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/341-wifi-mac80211-fix-vif-addr-when-switching-from-monit.patch
@@ -0,0 +1,63 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 15 Nov 2024 12:28:43 +0100
+Subject: [PATCH] wifi: mac80211: fix vif addr when switching from monitor
+ to station
+
+Since adding support for opting out of virtual monitor support, a zero vif
+addr was used to indicate passive vs active monitor to the driver.
+This would break the vif->addr when changing the netdev mac address before
+switching the interface from monitor to sta mode.
+Fix the regression by adding a separate flag to indicate whether vif->addr
+is valid.
+
+Reported-by: syzbot+9ea265d998de25ac6a46@syzkaller.appspotmail.com
+Fixes: 9d40f7e32774 ("wifi: mac80211: add flag to opt out of virtual monitor support")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/net/mac80211.h
++++ b/include/net/mac80211.h
+@@ -1972,6 +1972,8 @@ enum ieee80211_neg_ttlm_res {
+  * @neg_ttlm: negotiated TID to link mapping info.
+  *	see &struct ieee80211_neg_ttlm.
+  * @addr: address of this interface
++ * @addr_valid: indicates if the address is actively used. Set to false for
++ *	passive monitor interfaces, true in all other cases.
+  * @p2p: indicates whether this AP or STA interface is a p2p
+  *	interface, i.e. a GO or p2p-sta respectively
+  * @netdev_features: tx netdev features supported by the hardware for this
+@@ -2011,6 +2013,7 @@ struct ieee80211_vif {
+ 	u16 valid_links, active_links, dormant_links, suspended_links;
+ 	struct ieee80211_neg_ttlm neg_ttlm;
+ 	u8 addr[ETH_ALEN] __aligned(2);
++	bool addr_valid;
+ 	bool p2p;
+ 
+ 	u8 cab_queue;
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -279,13 +279,8 @@ static int _ieee80211_change_mac(struct
+ 	ret = eth_mac_addr(sdata->dev, sa);
+ 
+ 	if (ret == 0) {
+-		if (check_dup) {
+-			memcpy(sdata->vif.addr, sa->sa_data, ETH_ALEN);
+-			ether_addr_copy(sdata->vif.bss_conf.addr, sdata->vif.addr);
+-		} else {
+-			memset(sdata->vif.addr, 0, ETH_ALEN);
+-			memset(sdata->vif.bss_conf.addr, 0, ETH_ALEN);
+-		}
++		memcpy(sdata->vif.addr, sa->sa_data, ETH_ALEN);
++		ether_addr_copy(sdata->vif.bss_conf.addr, sdata->vif.addr);
+ 	}
+ 
+ 	/* Regardless of eth_mac_addr() return we still want to add the
+@@ -1336,6 +1331,8 @@ int ieee80211_do_open(struct wireless_de
+ 		}
+ 	}
+ 
++	sdata->vif.addr_valid = sdata->vif.type != NL80211_IFTYPE_MONITOR ||
++				(sdata->u.mntr.flags & MONITOR_FLAG_ACTIVE);
+ 	switch (sdata->vif.type) {
+ 	case NL80211_IFTYPE_AP_VLAN:
+ 		/* no need to tell driver, but set carrier and chanctx */
diff --git a/package/kernel/mac80211/patches/subsys/341-wifi-mac80211-skip-non-uploaded-keys-in-ieee80211_it.patch b/package/kernel/mac80211/patches/subsys/341-wifi-mac80211-skip-non-uploaded-keys-in-ieee80211_it.patch
deleted file mode 100644
index b426d68c326fd0..00000000000000
--- a/package/kernel/mac80211/patches/subsys/341-wifi-mac80211-skip-non-uploaded-keys-in-ieee80211_it.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From: Felix Fietkau <nbd@nbd.name>
-Date: Sun, 6 Oct 2024 17:34:08 +0200
-Subject: [PATCH] wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys
-
-Sync iterator conditions with ieee80211_iter_keys_rcu.
-
-Fixes: 830af02f24fb ("mac80211: allow driver to iterate keys")
-Signed-off-by: Felix Fietkau <nbd@nbd.name>
----
-
---- a/net/mac80211/key.c
-+++ b/net/mac80211/key.c
-@@ -987,6 +987,26 @@ void ieee80211_reenable_keys(struct ieee
- 	}
- }
- 
-+static void
-+ieee80211_key_iter(struct ieee80211_hw *hw,
-+		   struct ieee80211_vif *vif,
-+		   struct ieee80211_key *key,
-+		   void (*iter)(struct ieee80211_hw *hw,
-+				struct ieee80211_vif *vif,
-+				struct ieee80211_sta *sta,
-+				struct ieee80211_key_conf *key,
-+				void *data),
-+		   void *iter_data)
-+{
-+	/* skip keys of station in removal process */
-+	if (key->sta && key->sta->removed)
-+		return;
-+	if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
-+		return;
-+	iter(hw, vif, key->sta ? &key->sta->sta : NULL,
-+	     &key->conf, iter_data);
-+}
-+
- void ieee80211_iter_keys(struct ieee80211_hw *hw,
- 			 struct ieee80211_vif *vif,
- 			 void (*iter)(struct ieee80211_hw *hw,
-@@ -1005,16 +1025,13 @@ void ieee80211_iter_keys(struct ieee8021
- 	if (vif) {
- 		sdata = vif_to_sdata(vif);
- 		list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
--			iter(hw, &sdata->vif,
--			     key->sta ? &key->sta->sta : NULL,
--			     &key->conf, iter_data);
-+			ieee80211_key_iter(hw, vif, key, iter, iter_data);
- 	} else {
- 		list_for_each_entry(sdata, &local->interfaces, list)
- 			list_for_each_entry_safe(key, tmp,
- 						 &sdata->key_list, list)
--				iter(hw, &sdata->vif,
--				     key->sta ? &key->sta->sta : NULL,
--				     &key->conf, iter_data);
-+				ieee80211_key_iter(hw, &sdata->vif, key,
-+						   iter, iter_data);
- 	}
- }
- EXPORT_SYMBOL(ieee80211_iter_keys);
-@@ -1031,17 +1048,8 @@ _ieee80211_iter_keys_rcu(struct ieee8021
- {
- 	struct ieee80211_key *key;
- 
--	list_for_each_entry_rcu(key, &sdata->key_list, list) {
--		/* skip keys of station in removal process */
--		if (key->sta && key->sta->removed)
--			continue;
--		if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE))
--			continue;
--
--		iter(hw, &sdata->vif,
--		     key->sta ? &key->sta->sta : NULL,
--		     &key->conf, iter_data);
--	}
-+	list_for_each_entry_rcu(key, &sdata->key_list, list)
-+		ieee80211_key_iter(hw, &sdata->vif, key, iter, iter_data);
- }
- 
- void ieee80211_iter_keys_rcu(struct ieee80211_hw *hw,
diff --git a/package/kernel/mac80211/patches/subsys/350-wifi-mac80211-Add-link-iteration-macro-for-link-data.patch b/package/kernel/mac80211/patches/subsys/350-wifi-mac80211-Add-link-iteration-macro-for-link-data.patch
new file mode 100644
index 00000000000000..fd6e5dc169108f
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/350-wifi-mac80211-Add-link-iteration-macro-for-link-data.patch
@@ -0,0 +1,47 @@
+From 4e1916dec9850cd49dd5792200ab649061cbedc1 Mon Sep 17 00:00:00 2001
+From: Maharaja Kennadyrajan <maharaja.kennadyrajan@oss.qualcomm.com>
+Date: Fri, 18 Jul 2025 11:38:35 +0530
+Subject: [PATCH] wifi: mac80211: Add link iteration macro for link data with
+ rcu_dereference
+
+Currently, the existing macro for_each_link_data() uses sdata_dereference()
+which requires the wiphy lock. This lock cannot be used in atomic or RCU
+read-side contexts, such as in the RX path.
+
+Introduce a new macro, for_each_link_data_rcu(), that iterates over link of
+sdata using rcu_dereference(), making it safe to use in RCU contexts. This
+allows callers to access link data without requiring the wiphy lock.
+
+The macro takes into account the vif.valid_links bitmap and ensures only
+valid links are accessed safely. Callers are responsible for ensuring that
+rcu_read_lock() is held when using this macro.
+
+Signed-off-by: Maharaja Kennadyrajan <maharaja.kennadyrajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250718060837.59371-3-maharaja.kennadyrajan@oss.qualcomm.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+ net/mac80211/ieee80211_i.h | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/net/mac80211/ieee80211_i.h
++++ b/net/mac80211/ieee80211_i.h
+@@ -1220,6 +1220,19 @@ struct ieee80211_sub_if_data *vif_to_sda
+ 		    ((__link) = sdata_dereference((__sdata)->link[__link_id],	\
+ 						  (__sdata))))
+ 
++/*
++ * for_each_link_data_rcu should be used under RCU read lock.
++ */
++#define for_each_link_data_rcu(sdata, __link)					\
++	/* outer loop just to define the variable ... */			\
++	for (struct ieee80211_sub_if_data *__sdata = (sdata); __sdata;		\
++		__sdata = NULL /* always stop */)				\
++	for (int __link_id = 0;							\
++	     __link_id < ARRAY_SIZE((__sdata)->link); __link_id++)		\
++		if ((!(__sdata)->vif.valid_links ||				\
++		     (__sdata)->vif.valid_links & BIT(__link_id)) &&		\
++		    ((__link) = rcu_dereference((__sdata)->link[__link_id])))	\
++
+ static inline int
+ ieee80211_get_mbssid_beacon_len(struct cfg80211_mbssid_elems *elems,
+ 				struct cfg80211_rnr_elems *rnr_elems,
diff --git a/package/kernel/mac80211/patches/subsys/351-wifi-mac80211-extend-beacon-monitoring-for-MLO.patch b/package/kernel/mac80211/patches/subsys/351-wifi-mac80211-extend-beacon-monitoring-for-MLO.patch
new file mode 100644
index 00000000000000..7722bcf64c9299
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/351-wifi-mac80211-extend-beacon-monitoring-for-MLO.patch
@@ -0,0 +1,77 @@
+From: Maharaja Kennadyrajan <maharaja.kennadyrajan@oss.qualcomm.com>
+Date: Fri, 18 Jul 2025 11:38:36 +0530
+Subject: [PATCH] wifi: mac80211: extend beacon monitoring for MLO
+
+Currently, reset beacon monitor (ieee80211_sta_reset_beacon_monitor())
+timer is handled only for non-AP non-MLD STA and do not support non-AP MLD
+STA. When the beacon loss occurs in non-AP MLD STA with the current
+implementation, it is treated as a single link and the timer will reset
+based on the timeout of the deflink, without checking all the links.
+
+Check the CSA flags for all the links in the MLO and decide whether to
+schedule the work queue for beacon loss. If any of the links has CSA
+active, then beacon loss work is not scheduled.
+
+Also, call the functions ieee80211_sta_reset_beacon_monitor() and
+ieee80211_sta_reset_conn_monitor() from ieee80211_csa_switch_work() only
+when all the links are CSA active.
+
+Signed-off-by: Maharaja Kennadyrajan <maharaja.kennadyrajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250718060837.59371-4-maharaja.kennadyrajan@oss.qualcomm.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -2167,6 +2167,21 @@ static void ieee80211_csa_switch_work(st
+ 		}
+ 	}
+ 
++	/*
++	 * It is not necessary to reset these timers if any link does not
++	 * have an active CSA and that link still receives the beacons
++	 * when other links have active CSA.
++	 */
++	for_each_link_data(sdata, link) {
++		if (!link->conf->csa_active)
++			return;
++	}
++
++	/*
++	 * Reset the beacon monitor and connection monitor timers when CSA
++	 * is active for all links in MLO when channel switch occurs in all
++	 * the links.
++	 */
+ 	ieee80211_sta_reset_beacon_monitor(sdata);
+ 	ieee80211_sta_reset_conn_monitor(sdata);
+ }
+@@ -7892,6 +7907,29 @@ void ieee80211_sta_work(struct ieee80211
+ 	}
+ }
+ 
++static bool
++ieee80211_is_csa_in_progress(struct ieee80211_sub_if_data *sdata)
++{
++	/*
++	 * In MLO, check the CSA flags 'active' and 'waiting_bcn' for all
++	 * the links.
++	 */
++	struct ieee80211_link_data *link;
++	bool ret = true;
++
++	rcu_read_lock();
++	for_each_link_data_rcu(sdata, link) {
++		if (!(link->conf->csa_active &&
++		      !link->u.mgd.csa.waiting_bcn)) {
++			ret = false;
++			break;
++		}
++	}
++	rcu_read_unlock();
++
++	return ret;
++}
++
+ static void ieee80211_sta_bcn_mon_timer(struct timer_list *t)
+ {
+ 	struct ieee80211_sub_if_data *sdata =
diff --git a/package/kernel/mac80211/patches/subsys/352-wifi-mac80211-extend-connection-monitoring-for-MLO.patch b/package/kernel/mac80211/patches/subsys/352-wifi-mac80211-extend-connection-monitoring-for-MLO.patch
new file mode 100644
index 00000000000000..9f16bea626a21a
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/352-wifi-mac80211-extend-connection-monitoring-for-MLO.patch
@@ -0,0 +1,141 @@
+From: Maharaja Kennadyrajan <maharaja.kennadyrajan@oss.qualcomm.com>
+Date: Fri, 18 Jul 2025 11:38:37 +0530
+Subject: [PATCH] wifi: mac80211: extend connection monitoring for MLO
+
+Currently, reset connection monitor (ieee80211_sta_reset_conn_monitor())
+timer is handled only for non-AP non-MLD STA and do not support non-AP MLD
+STA. The current implementation checks for the CSA active and update the
+monitor timer with the timeout value of deflink and reset the timer based
+on the deflink's timeout value else schedule the connection loss work when
+the deflink is timed out and it won't work for the non-AP MLD STA.
+
+Handle the reset connection monitor timer for non-AP MLD STA by updating
+the monitor timer with the timeout value which is determined based on the
+link that will expire last among all the links in MLO. If at least one link
+has not timed out, the timer is updated accordingly with the latest timeout
+value else schedule the connection loss work when all links have timed out.
+
+Remove the MLO-related WARN_ON() checks in the beacon and connection
+monitoring logic code paths as they support MLO now.
+
+Signed-off-by: Maharaja Kennadyrajan <maharaja.kennadyrajan@oss.qualcomm.com>
+Link: https://patch.msgid.link/20250718060837.59371-5-maharaja.kennadyrajan@oss.qualcomm.com
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+---
+
+--- a/net/mac80211/mlme.c
++++ b/net/mac80211/mlme.c
+@@ -3841,9 +3841,6 @@ static void ieee80211_mgd_probe_ap_send(
+ 
+ 	lockdep_assert_wiphy(sdata->local->hw.wiphy);
+ 
+-	if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
+-		return;
+-
+ 	/*
+ 	 * Try sending broadcast probe requests for the last three
+ 	 * probe requests after the first ones failed since some
+@@ -3889,9 +3886,6 @@ static void ieee80211_mgd_probe_ap(struc
+ 
+ 	lockdep_assert_wiphy(sdata->local->hw.wiphy);
+ 
+-	if (WARN_ON_ONCE(ieee80211_vif_is_mld(&sdata->vif)))
+-		return;
+-
+ 	if (!ieee80211_sdata_running(sdata))
+ 		return;
+ 
+@@ -7950,36 +7944,73 @@ static void ieee80211_sta_bcn_mon_timer(
+ 			 &sdata->u.mgd.beacon_connection_loss_work);
+ }
+ 
++static unsigned long
++ieee80211_latest_active_link_conn_timeout(struct ieee80211_sub_if_data *sdata)
++{
++	unsigned long latest_timeout = 0;
++	unsigned int link_id;
++	struct sta_info *sta;
++
++	rcu_read_lock();
++
++	sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
++	if (!sta)
++		goto out;
++
++	for (link_id = 0; link_id < ARRAY_SIZE(sta->link);
++	     link_id++) {
++		struct link_sta_info *link_sta;
++		unsigned long timeout;
++
++		link_sta = rcu_dereference(sta->link[link_id]);
++		if (!link_sta)
++			continue;
++
++		timeout = link_sta->status_stats.last_ack;
++		if (time_before(timeout, link_sta->rx_stats.last_rx))
++			timeout = link_sta->rx_stats.last_rx;
++
++		timeout += IEEE80211_CONNECTION_IDLE_TIME;
++
++		/*
++		 * latest_timeout holds the timeout of the link
++		 * that will expire last among all links in an
++		 * non-AP MLD STA. This ensures that the connection
++		 * monitor timer is only reset if at least one link
++		 * is still active, and it is scheduled to fire at
++		 * the latest possible timeout.
++		 */
++		if (time_is_after_jiffies(timeout) &&
++		    time_after(timeout, latest_timeout))
++			latest_timeout = timeout;
++	}
++
++out:
++	rcu_read_unlock();
++
++	return latest_timeout;
++}
++
+ static void ieee80211_sta_conn_mon_timer(struct timer_list *t)
+ {
+ 	struct ieee80211_sub_if_data *sdata =
+ 		from_timer(sdata, t, u.mgd.conn_mon_timer);
+ 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
+ 	struct ieee80211_local *local = sdata->local;
+-	struct sta_info *sta;
+-	unsigned long timeout;
++	unsigned long latest_timeout;
+ 
+-	if (WARN_ON(ieee80211_vif_is_mld(&sdata->vif)))
++	if (ieee80211_is_csa_in_progress(sdata))
+ 		return;
+ 
+-	if (sdata->vif.bss_conf.csa_active &&
+-	    !sdata->deflink.u.mgd.csa.waiting_bcn)
+-		return;
+-
+-	sta = sta_info_get(sdata, sdata->vif.cfg.ap_addr);
+-	if (!sta)
+-		return;
+-
+-	timeout = sta->deflink.status_stats.last_ack;
+-	if (time_before(sta->deflink.status_stats.last_ack, sta->deflink.rx_stats.last_rx))
+-		timeout = sta->deflink.rx_stats.last_rx;
+-	timeout += IEEE80211_CONNECTION_IDLE_TIME;
++	latest_timeout = ieee80211_latest_active_link_conn_timeout(sdata);
+ 
+-	/* If timeout is after now, then update timer to fire at
+-	 * the later date, but do not actually probe at this time.
+-	 */
+-	if (time_is_after_jiffies(timeout)) {
+-		mod_timer(&ifmgd->conn_mon_timer, round_jiffies_up(timeout));
++	/*
++	 * If latest timeout is after now, then update timer to fire at
++ 	 * the later date, but do not actually probe at this time.
++ 	 */
++	if (latest_timeout) {
++		mod_timer(&ifmgd->conn_mon_timer,
++			  round_jiffies_up(latest_timeout));
+ 		return;
+ 	}
+ 
diff --git a/package/kernel/mac80211/patches/subsys/353-wifi-mac80211-Make-CONNECTION_MONITOR-optional-for-M.patch b/package/kernel/mac80211/patches/subsys/353-wifi-mac80211-Make-CONNECTION_MONITOR-optional-for-M.patch
new file mode 100644
index 00000000000000..bbc02cc21d9d38
--- /dev/null
+++ b/package/kernel/mac80211/patches/subsys/353-wifi-mac80211-Make-CONNECTION_MONITOR-optional-for-M.patch
@@ -0,0 +1,25 @@
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 26 Aug 2025 13:54:31 +0200
+Subject: [PATCH] wifi: mac80211: Make CONNECTION_MONITOR optional for MLO sta
+
+Since commit '1bc892d76a6f ("wifi: mac80211: extend connection
+monitoring for MLO")' mac80211 supports connection monitor for MLO
+client interfaces. Remove the CONNECTION_MONITOR requirement in
+ieee80211_register_hw routine.
+
+Fixes: 1bc892d76a6f ("wifi: mac80211: extend connection monitoring for MLO")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+---
+
+--- a/net/mac80211/main.c
++++ b/net/mac80211/main.c
+@@ -1174,9 +1174,6 @@ int ieee80211_register_hw(struct ieee802
+ 		if (WARN_ON(!ieee80211_hw_check(hw, MFP_CAPABLE)))
+ 			return -EINVAL;
+ 
+-		if (WARN_ON(!ieee80211_hw_check(hw, CONNECTION_MONITOR)))
+-			return -EINVAL;
+-
+ 		if (WARN_ON(ieee80211_hw_check(hw, NEED_DTIM_BEFORE_ASSOC)))
+ 			return -EINVAL;
+ 
diff --git a/package/kernel/mac80211/realtek.mk b/package/kernel/mac80211/realtek.mk
index 4a6f10cddc51bb..6ac4b1aee9873c 100644
--- a/package/kernel/mac80211/realtek.mk
+++ b/package/kernel/mac80211/realtek.mk
@@ -4,6 +4,7 @@ PKG_DRIVERS += \
 	rtl8723bs rtl8821ae rtl8xxxu rtw88 rtw88-pci rtw88-usb rtw88-sdio rtw88-8821c \
 	rtw88-8822b rtw88-8822c rtw88-8723x rtw88-8723d rtw88-8821ce rtw88-8821cu \
 	rtw88-8822be rtw88-8822bu rtw88-8822ce rtw88-8822cu rtw88-8723de rtw88-8723ds \
+	rtw88-88xxa rtw88-8821a rtw88-8812a rtw88-8821au rtw88-8812au \
 	rtw88-8723du rtw89 rtw89-pci rtw89-8851be rtw89-8852ae rtw89-8852b-common \
 	rtw89-8852be rtw89-8852ce rtw89-8922ae
 
@@ -48,6 +49,11 @@ config-$(call config_package,rtw88-8723d) += RTW88_8723D
 config-$(call config_package,rtw88-8723de) += RTW88_8723DE
 config-$(call config_package,rtw88-8723ds) += RTW88_8723DS
 config-$(call config_package,rtw88-8723du) += RTW88_8723DU
+config-$(call config_package,rtw88-88xxa) += RTW88_88XXA
+config-$(call config_package,rtw88-8821a) += RTW88_8821A
+config-$(call config_package,rtw88-8812a) += RTW88_8812A
+config-$(call config_package,rtw88-8821au) += RTW88_8821AU
+config-$(call config_package,rtw88-8812au) += RTW88_8812AU
 config-$(CONFIG_PACKAGE_RTW88_DEBUG) += RTW88_DEBUG
 config-$(CONFIG_PACKAGE_RTW88_DEBUGFS) += RTW88_DEBUGFS
 
@@ -255,6 +261,33 @@ define KernelPackage/rtw88-usb
   HIDDEN:=1
 endef
 
+define KernelPackage/rtw88-88xxa
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8812A/RTL8821A family support
+  DEPENDS+= +@DRIVER_11AC_SUPPORT +kmod-rtw88-usb
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_88xxa.ko
+  AUTOLOAD:=$(call AutoProbe,rtw88_88xxa)
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtw88-8821a
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8821A family support
+  DEPENDS+= +kmod-rtw88-88xxa
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8821a.ko
+  AUTOLOAD:=$(call AutoProbe,rtw88_8821a)
+  HIDDEN:=1
+endef
+
+define KernelPackage/rtw88-8812a
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8812A family support
+  DEPENDS+= +kmod-rtw88-88xxa
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8812a.ko
+  AUTOLOAD:=$(call AutoProbe,rtw88_8812a)
+  HIDDEN:=1
+endef
+
 define KernelPackage/rtw88-8821c
   $(call KernelPackage/mac80211/Default)
   TITLE:=Realtek RTL8821C family support
@@ -300,6 +333,22 @@ define KernelPackage/rtw88-8723d
   HIDDEN:=1
 endef
 
+define KernelPackage/rtw88-8821au
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8821AU support
+  DEPENDS+= +kmod-rtw88-8821a +rtl8821a-firmware
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8821au.ko
+  AUTOLOAD:=$(call AutoProbe,rtw88_8821au)
+endef
+
+define KernelPackage/rtw88-8812au
+  $(call KernelPackage/mac80211/Default)
+  TITLE:=Realtek RTL8812AU support
+  DEPENDS+= +kmod-rtw88-8812a +rtl8812a-firmware
+  FILES:=$(PKG_BUILD_DIR)/drivers/net/wireless/realtek/rtw88/rtw88_8812au.ko
+  AUTOLOAD:=$(call AutoProbe,rtw88_8812au)
+endef
+
 define KernelPackage/rtw88-8821ce
   $(call KernelPackage/mac80211/Default)
   TITLE:=Realtek RTL8821CE support
diff --git a/package/kernel/mt76/Makefile b/package/kernel/mt76/Makefile
index 73f34d8edadf18..b5b9b22873751d 100644
--- a/package/kernel/mt76/Makefile
+++ b/package/kernel/mt76/Makefile
@@ -8,9 +8,9 @@ PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/openwrt/mt76
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2024-10-11.1
-PKG_SOURCE_VERSION:=ecca0e77b4bce629ec1f79d83bbd14a68f919188
-PKG_MIRROR_HASH:=770823f282c76532567a651bb020208c3ddd5a728c656fcde43129fc95edf538
+PKG_SOURCE_DATE:=2025-08-27
+PKG_SOURCE_VERSION:=de1df8b888bd1c99ee191f451af47b4fa9658e8c
+PKG_MIRROR_HASH:=4ead68e97fc6472a682dae2f96f9dbb377f23c316511f625b85af15de46e9397
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_USE_NINJA:=0
diff --git a/package/kernel/mt76/patches/100-api_compat.patch b/package/kernel/mt76/patches/100-api_compat.patch
new file mode 100644
index 00000000000000..989967164bd57e
--- /dev/null
+++ b/package/kernel/mt76/patches/100-api_compat.patch
@@ -0,0 +1,84 @@
+--- a/mt7915/main.c
++++ b/mt7915/main.c
+@@ -1224,10 +1224,9 @@ static void mt7915_sta_rc_work(void *dat
+ 
+ static void mt7915_sta_rc_update(struct ieee80211_hw *hw,
+ 				 struct ieee80211_vif *vif,
+-				 struct ieee80211_link_sta *link_sta,
++				 struct ieee80211_sta *sta,
+ 				 u32 changed)
+ {
+-	struct ieee80211_sta *sta = link_sta->sta;
+ 	struct mt7915_phy *phy = mt7915_hw_phy(hw);
+ 	struct mt7915_dev *dev = phy->dev;
+ 	struct mt7915_sta *msta = (struct mt7915_sta *)sta->drv_priv;
+@@ -1771,7 +1770,7 @@ const struct ieee80211_ops mt7915_ops =
+ 	.stop_ap = mt7915_stop_ap,
+ 	.sta_state = mt76_sta_state,
+ 	.sta_pre_rcu_remove = mt76_sta_pre_rcu_remove,
+-	.link_sta_rc_update = mt7915_sta_rc_update,
++	.sta_rc_update = mt7915_sta_rc_update,
+ 	.set_key = mt7915_set_key,
+ 	.ampdu_action = mt7915_ampdu_action,
+ 	.set_rts_threshold = mt7915_set_rts_threshold,
+--- a/mt7996/main.c
++++ b/mt7996/main.c
+@@ -715,8 +715,7 @@ static void mt7996_configure_filter(stru
+ }
+ 
+ static int
+-mt7996_get_txpower(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+-		   unsigned int link_id, int *dbm)
++mt7996_get_txpower(struct ieee80211_hw *hw, struct ieee80211_vif *vif, int *dbm)
+ {
+ 	struct mt7996_vif *mvif = (struct mt7996_vif *)vif->drv_priv;
+ 	struct mt7996_phy *phy = mt7996_vif_link_phy(&mvif->deflink);
+@@ -1687,13 +1686,12 @@ out:
+ 	rcu_read_unlock();
+ }
+ 
+-static void mt7996_link_sta_rc_update(struct ieee80211_hw *hw,
+-				      struct ieee80211_vif *vif,
+-				      struct ieee80211_link_sta *link_sta,
+-				      u32 changed)
++static void mt7996_sta_rc_update(struct ieee80211_hw *hw,
++				 struct ieee80211_vif *vif,
++				 struct ieee80211_sta *sta,
++				 u32 changed)
+ {
+ 	struct mt7996_dev *dev = mt7996_hw_dev(hw);
+-	struct ieee80211_sta *sta = link_sta->sta;
+ 
+ 	mt7996_link_rate_ctrl_update(&changed, sta);
+ 	ieee80211_queue_work(hw, &dev->rc_work);
+@@ -2186,7 +2184,7 @@ const struct ieee80211_ops mt7996_ops =
+ 	.link_info_changed = mt7996_link_info_changed,
+ 	.sta_state = mt7996_sta_state,
+ 	.sta_pre_rcu_remove = mt76_sta_pre_rcu_remove,
+-	.link_sta_rc_update = mt7996_link_sta_rc_update,
++	.sta_rc_update = mt7996_sta_rc_update,
+ 	.set_key = mt7996_set_key,
+ 	.ampdu_action = mt7996_ampdu_action,
+ 	.set_rts_threshold = mt7996_set_rts_threshold,
+--- a/mac80211.c
++++ b/mac80211.c
+@@ -1745,7 +1745,7 @@ s8 mt76_get_power_bound(struct mt76_phy
+ EXPORT_SYMBOL_GPL(mt76_get_power_bound);
+ 
+ int mt76_get_txpower(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+-		     unsigned int link_id, int *dbm)
++		     int *dbm)
+ {
+ 	struct mt76_phy *phy = mt76_vif_phy(hw, vif);
+ 	int n_chains, delta;
+--- a/mt76.h
++++ b/mt76.h
+@@ -1521,7 +1521,7 @@ int mt76_get_min_avg_rssi(struct mt76_de
+ s8 mt76_get_power_bound(struct mt76_phy *phy, s8 txpower);
+ 
+ int mt76_get_txpower(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+-		     unsigned int link_id, int *dbm);
++		     int *dbm);
+ int mt76_init_sar_power(struct ieee80211_hw *hw,
+ 			const struct cfg80211_sar_specs *sar);
+ int mt76_get_sar_power(struct mt76_phy *phy,
diff --git a/package/kernel/mwlwifi/Makefile b/package/kernel/mwlwifi/Makefile
index 3f2d5e0949377d..07c3acc5f909c9 100644
--- a/package/kernel/mwlwifi/Makefile
+++ b/package/kernel/mwlwifi/Makefile
@@ -8,16 +8,16 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mwlwifi
-PKG_RELEASE=2
+PKG_RELEASE=1
 
 PKG_LICENSE:=ISC
 PKG_LICENSE_FILES:=
 
 PKG_SOURCE_URL:=https://github.com/kaloz/mwlwifi
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2024-04-19
-PKG_SOURCE_VERSION:=a737d348ef4fe00434b2bc44b2b6a68ea833d95b
-PKG_MIRROR_HASH:=d55f69c2fa48d02ba535b72b108fc77f5f13a52b29130a631489a053f1670d2c
+PKG_SOURCE_DATE:=2025-02-06
+PKG_SOURCE_VERSION:=db97edf20fadea2617805006f5230665fadc6a8c
+PKG_MIRROR_HASH:=b5464cf6d57d87f6ce5f13bd2320c7e7e671a3152a74f4ef004382f898b89ecf
 
 PKG_MAINTAINER:=Imre Kaloz <kaloz@openwrt.org>
 PKG_BUILD_PARALLEL:=1
diff --git a/package/kernel/mwlwifi/patches/001-Simplify-coredump-memcpy-in-mwl_fwcmd_get_fw_core_dump.patch b/package/kernel/mwlwifi/patches/001-Simplify-coredump-memcpy-in-mwl_fwcmd_get_fw_core_dump.patch
index 4b0feeb17e6257..20e1cce382c254 100644
--- a/package/kernel/mwlwifi/patches/001-Simplify-coredump-memcpy-in-mwl_fwcmd_get_fw_core_dump.patch
+++ b/package/kernel/mwlwifi/patches/001-Simplify-coredump-memcpy-in-mwl_fwcmd_get_fw_core_dump.patch
@@ -20,7 +20,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 
 --- a/hif/fwcmd.c
 +++ b/hif/fwcmd.c
-@@ -3622,11 +3622,7 @@ int mwl_fwcmd_get_fw_core_dump(struct ie
+@@ -3624,11 +3624,7 @@ int mwl_fwcmd_get_fw_core_dump(struct ie
  	core_dump->context = pcmd->cmd_data.coredump.context;
  	core_dump->size_kb = pcmd->cmd_data.coredump.size_kb;
  	core_dump->flags = pcmd->cmd_data.coredump.flags;
diff --git a/package/kernel/mwlwifi/patches/002-Correctly-use-PTR_ERR-in-pcie_bf_mimo_ctrl_decode.patch b/package/kernel/mwlwifi/patches/002-Correctly-use-PTR_ERR-in-pcie_bf_mimo_ctrl_decode.patch
index f204e9fe73d29f..f6c398cf661b16 100644
--- a/package/kernel/mwlwifi/patches/002-Correctly-use-PTR_ERR-in-pcie_bf_mimo_ctrl_decode.patch
+++ b/package/kernel/mwlwifi/patches/002-Correctly-use-PTR_ERR-in-pcie_bf_mimo_ctrl_decode.patch
@@ -19,7 +19,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 
 --- a/hif/pcie/pcie.c
 +++ b/hif/pcie/pcie.c
-@@ -1466,8 +1466,8 @@ static void pcie_bf_mimo_ctrl_decode(str
+@@ -1449,8 +1449,8 @@ static void pcie_bf_mimo_ctrl_decode(str
  			       &fp_data->f_pos);
  		filp_close(fp_data, current->files);
  	} else {
diff --git a/package/kernel/mwlwifi/patches/003-Use-zu-and-zd-for-ssize_t-and-size_t.patch b/package/kernel/mwlwifi/patches/003-Use-zu-and-zd-for-ssize_t-and-size_t.patch
index d615e1338001f7..816fb222c05f5f 100644
--- a/package/kernel/mwlwifi/patches/003-Use-zu-and-zd-for-ssize_t-and-size_t.patch
+++ b/package/kernel/mwlwifi/patches/003-Use-zu-and-zd-for-ssize_t-and-size_t.patch
@@ -14,7 +14,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 
 --- a/debugfs.c
 +++ b/debugfs.c
-@@ -1342,7 +1342,7 @@ done:
+@@ -1394,7 +1394,7 @@ done:
  				 priv->reg_value);
  	else
  		len += scnprintf(p + len, size - len,
diff --git a/package/kernel/mwlwifi/patches/010-mwlwifi-fix-PCIe-DT-node-null-pointer-dereference.patch b/package/kernel/mwlwifi/patches/010-mwlwifi-fix-PCIe-DT-node-null-pointer-dereference.patch
deleted file mode 100644
index f37d2f8171a8df..00000000000000
--- a/package/kernel/mwlwifi/patches/010-mwlwifi-fix-PCIe-DT-node-null-pointer-dereference.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 8e809b241695252e397bf0d7fc5f36e115c38831 Mon Sep 17 00:00:00 2001
-From: Robert Marko <robert.marko@sartura.hr>
-Date: Fri, 5 Mar 2021 11:47:59 +0100
-Subject: [PATCH] mwlwifi: fix PCIe DT node null pointer dereference
-
-pci_bus_to_OF_node() used to get the PCI bus DT node
-returns node if found or NULL if none is found.
-
-Since the return of pci_bus_to_OF_node() is not checked in
-the DT node name print it will cause a null pointer
-dereference and crash the kernel.
-
-So first check whether the node is not NULL and then print.
-
-Signed-off-by: Robert Marko <robert.marko@sartura.hr>
----
- hif/pcie/pcie.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/hif/pcie/pcie.c
-+++ b/hif/pcie/pcie.c
-@@ -685,7 +685,8 @@ static struct device_node *pcie_get_devi
- 	struct device_node *dev_node;
- 
- 	dev_node = pci_bus_to_OF_node(pcie_priv->pdev->bus);
--	wiphy_info(priv->hw->wiphy, "device node: %s\n", dev_node->full_name);
-+	if (dev_node)
-+		wiphy_info(priv->hw->wiphy, "device node: %s\n", dev_node->full_name);
- 
- 	return dev_node;
- }
diff --git a/package/kernel/mwlwifi/patches/020-mac80211_update.patch b/package/kernel/mwlwifi/patches/020-mac80211_update.patch
index 1c5d5819392118..1d4afabb51db3f 100644
--- a/package/kernel/mwlwifi/patches/020-mac80211_update.patch
+++ b/package/kernel/mwlwifi/patches/020-mac80211_update.patch
@@ -13,7 +13,7 @@
  
 --- a/debugfs.c
 +++ b/debugfs.c
-@@ -498,9 +498,9 @@ static ssize_t mwl_debugfs_vif_read(stru
+@@ -550,9 +550,9 @@ static ssize_t mwl_debugfs_vif_read(stru
  		switch (vif->type) {
  		case NL80211_IFTYPE_AP:
  			len += scnprintf(p + len, size - len, "type: ap\n");
@@ -26,7 +26,7 @@
  			len += scnprintf(p + len, size - len,
  					 "ssid: %s\n", ssid);
  			len += scnprintf(p + len, size - len,
-@@ -522,8 +522,8 @@ static ssize_t mwl_debugfs_vif_read(stru
+@@ -574,8 +574,8 @@ static ssize_t mwl_debugfs_vif_read(stru
  					 "type: unknown\n");
  			break;
  		}
@@ -37,7 +37,7 @@
  			len += scnprintf(p + len, size - len,
  					 "channel: %d: width: %d\n",
  					 chan_def->chan->hw_value,
-@@ -596,18 +596,18 @@ static ssize_t mwl_debugfs_sta_read(stru
+@@ -648,18 +648,18 @@ static ssize_t mwl_debugfs_sta_read(stru
  			sta_info->wds ? "true" : "false",
  			sta_info->ba_hist.enable ? "enable" : "disable",
  			sta_info->is_amsdu_allowed ? sta_info->amsdu_ctrl.cap : 0 ,
@@ -68,7 +68,7 @@
  			sta->tdls,
  			sta->tdls_initiator,
  			sta->wme,
-@@ -1158,7 +1158,7 @@ static ssize_t mwl_debugfs_dfs_radar_wri
+@@ -1210,7 +1210,7 @@ static ssize_t mwl_debugfs_dfs_radar_wri
  	struct mwl_priv *priv = (struct mwl_priv *)file->private_data;
  
  	wiphy_info(priv->hw->wiphy, "simulate radar detected\n");
@@ -127,7 +127,7 @@
  			a_band = true;
  		else
  			return -EINVAL;
-@@ -2090,7 +2094,7 @@ int mwl_fwcmd_set_beacon(struct ieee8021
+@@ -2092,7 +2096,7 @@ int mwl_fwcmd_set_beacon(struct ieee8021
  	if (mwl_fwcmd_set_wsc_ie(hw, b_inf->ie_wsc_len, b_inf->ie_wsc_ptr))
  		goto err;
  
@@ -136,7 +136,7 @@
  		goto err;
  
  	if (b_inf->cap_info & WLAN_CAPABILITY_SPECTRUM_MGMT)
-@@ -2152,38 +2156,38 @@ int mwl_fwcmd_set_new_stn_add(struct iee
+@@ -2154,38 +2158,38 @@ int mwl_fwcmd_set_new_stn_add(struct iee
  	ether_addr_copy(pcmd->mac_addr, sta->addr);
  
  	if (hw->conf.chandef.chan->band == NL80211_BAND_2GHZ)
@@ -189,7 +189,7 @@
  	}
  
  	pcmd->is_qos_sta = sta->wme;
-@@ -2239,38 +2243,38 @@ int mwl_fwcmd_set_new_stn_add_sc4(struct
+@@ -2241,38 +2245,38 @@ int mwl_fwcmd_set_new_stn_add_sc4(struct
  	ether_addr_copy(pcmd->mac_addr, sta->addr);
  
  	if (hw->conf.chandef.chan->band == NL80211_BAND_2GHZ)
@@ -242,7 +242,7 @@
  	}
  
  	pcmd->is_qos_sta = sta->wme;
-@@ -2787,9 +2791,9 @@ int mwl_fwcmd_create_ba(struct ieee80211
+@@ -2789,9 +2793,9 @@ int mwl_fwcmd_create_ba(struct ieee80211
  	pcmd->ba_info.create_params.flags = cpu_to_le32(ba_flags);
  	pcmd->ba_info.create_params.queue_id = stream->idx;
  	pcmd->ba_info.create_params.param_info =
@@ -254,7 +254,7 @@
  		 IEEE80211_HT_AMPDU_PARM_DENSITY);
  	if (direction == BA_FLAG_DIRECTION_UP) {
  		pcmd->ba_info.create_params.reset_seq_no = 0;
-@@ -2799,9 +2803,9 @@ int mwl_fwcmd_create_ba(struct ieee80211
+@@ -2801,9 +2805,9 @@ int mwl_fwcmd_create_ba(struct ieee80211
  		pcmd->ba_info.create_params.current_seq = cpu_to_le16(0);
  	}
  	if (priv->chip_type == MWL8964 &&
@@ -268,16 +268,16 @@
  	}
 --- a/hif/pcie/8864/tx.c
 +++ b/hif/pcie/8864/tx.c
-@@ -490,7 +490,7 @@ static void pcie_non_pfu_tx_done(struct
- 				} else
- 					memmove(dma_data->data - hdrlen, &dma_data->wh, hdrlen);
- 				skb_pull(done_skb, sizeof(*dma_data) - hdrlen);
--				ieee80211_tx_status(priv->hw, done_skb);
-+				ieee80211_tx_status_skb(priv->hw, done_skb);
- 				dev_kfree_skb_any(done_skb);
- 				done_skb = NULL;
- 			}
-@@ -743,7 +743,7 @@ void pcie_8864_tx_xmit(struct ieee80211_
+@@ -478,7 +478,7 @@ static void pcie_non_pfu_tx_done(struct
+ 			} else
+ 				memmove(dma_data->data - hdrlen, &dma_data->wh, hdrlen);
+ 			skb_pull(done_skb, sizeof(*dma_data) - hdrlen);
+-			ieee80211_tx_status(priv->hw, done_skb);
++			ieee80211_tx_status_skb(priv->hw, done_skb);
+ next:
+ 			tx_hndl = tx_hndl->pnext;
+ 			tx_desc = tx_hndl->pdesc;
+@@ -730,7 +730,7 @@ void pcie_8864_tx_xmit(struct ieee80211_
  	index = SYSADPT_TX_WMM_QUEUES - index - 1;
  	txpriority = index;
  
@@ -286,7 +286,7 @@
  	  !(xmitcontrol & EAGLE_TXD_XMITCTRL_USE_MC_RATE) &&
  	    ieee80211_is_data_qos(wh->frame_control)) {
  		tid = qos & 0xf;
-@@ -925,4 +925,4 @@ void pcie_8864_tx_del_sta_amsdu_pkts(str
+@@ -912,4 +912,4 @@ void pcie_8864_tx_del_sta_amsdu_pkts(str
  		}
  	}
  	spin_unlock_bh(&sta_info->amsdu_lock);
@@ -313,7 +313,7 @@
  
  bypass_ack:
  		if (++tx_done_tail >= MAX_TX_RING_DONE_SIZE)
-@@ -596,13 +596,13 @@ void pcie_tx_xmit_ndp(struct ieee80211_h
+@@ -593,13 +593,13 @@ void pcie_tx_xmit_ndp(struct ieee80211_h
  			ack_skb = skb_copy(skb, GFP_ATOMIC);
  			ack_info = IEEE80211_SKB_CB(ack_skb);
  			pcie_tx_prepare_info(priv, 0, ack_info);
@@ -340,16 +340,16 @@
  		   pcie_priv->txbd_ring_size);
  
  	for (num = 0; num < PCIE_MAX_TXRX_BD; num++) {
-@@ -444,7 +444,7 @@ static void pcie_pfu_tx_done(struct mwl_
- 				} else
- 					memmove(dma_data->data - hdrlen, &dma_data->wh, hdrlen);
- 				skb_pull(done_skb, sizeof(*pfu_dma) - hdrlen);
--				ieee80211_tx_status(priv->hw, done_skb);
-+				ieee80211_tx_status_skb(priv->hw, done_skb);
- 			}
+@@ -431,7 +431,7 @@ static void pcie_pfu_tx_done(struct mwl_
+ 			} else
+ 				memmove(dma_data->data - hdrlen, &dma_data->wh, hdrlen);
+ 			skb_pull(done_skb, sizeof(*pfu_dma) - hdrlen);
+-			ieee80211_tx_status(priv->hw, done_skb);
++			ieee80211_tx_status_skb(priv->hw, done_skb);
  		}
  next:
-@@ -694,7 +694,7 @@ void pcie_8997_tx_xmit(struct ieee80211_
+ 		memset(data_buf, 0, sizeof(*data_buf));
+@@ -682,7 +682,7 @@ void pcie_8997_tx_xmit(struct ieee80211_
  	index = SYSADPT_TX_WMM_QUEUES - index - 1;
  	txpriority = index;
  
@@ -358,7 +358,7 @@
  	  !(xmitcontrol & EAGLE_TXD_XMITCTRL_USE_MC_RATE) &&
  	    ieee80211_is_data_qos(wh->frame_control)) {
  		tid = qos & 0xf;
-@@ -875,4 +875,4 @@ void pcie_8997_tx_del_sta_amsdu_pkts(str
+@@ -863,4 +863,4 @@ void pcie_8997_tx_del_sta_amsdu_pkts(str
  		}
  	}
  	spin_unlock_bh(&sta_info->amsdu_lock);
@@ -376,7 +376,7 @@
  {
  	mwl_fwcmd_radio_disable(hw);
  
-@@ -368,15 +368,15 @@ static void mwl_mac80211_bss_info_change
+@@ -390,15 +390,15 @@ static void mwl_mac80211_bss_info_change
  		}
  	}
  
@@ -395,7 +395,7 @@
  {
  	struct mwl_priv *priv = hw->priv;
  	struct mwl_vif *mwl_vif;
-@@ -426,8 +426,8 @@ static void mwl_mac80211_bss_info_change
+@@ -448,8 +448,8 @@ static void mwl_mac80211_bss_info_change
  	if (changed & (BSS_CHANGED_BEACON_INT | BSS_CHANGED_BEACON)) {
  		struct sk_buff *skb;
  
@@ -406,7 +406,7 @@
  		    (!info->hidden_ssid)) {
  			if (mwl_vif->broadcast_ssid != true) {
  				mwl_fwcmd_broadcast_ssid_enable(hw, vif, true);
-@@ -441,7 +441,7 @@ static void mwl_mac80211_bss_info_change
+@@ -463,7 +463,7 @@ static void mwl_mac80211_bss_info_change
  		}
  
  		if (!mwl_vif->set_beacon) {
@@ -415,7 +415,7 @@
  
  			if (skb) {
  				mwl_fwcmd_set_beacon(hw, vif, skb->data, skb->len);
-@@ -458,7 +458,7 @@ static void mwl_mac80211_bss_info_change
+@@ -480,7 +480,7 @@ static void mwl_mac80211_bss_info_change
  static void mwl_mac80211_bss_info_changed(struct ieee80211_hw *hw,
  					  struct ieee80211_vif *vif,
  					  struct ieee80211_bss_conf *info,
@@ -424,7 +424,7 @@
  {
  	switch (vif->type) {
  	case NL80211_IFTYPE_AP:
-@@ -583,10 +583,10 @@ static int mwl_mac80211_sta_add(struct i
+@@ -605,10 +605,10 @@ static int mwl_mac80211_sta_add(struct i
  	if (vif->type == NL80211_IFTYPE_MESH_POINT)
  		sta_info->is_mesh_node = true;
  
@@ -437,7 +437,7 @@
  			sta_info->amsdu_ctrl.cap = MWL_AMSDU_SIZE_8K;
  			sta_info->amsdu_ctrl.amsdu_allow_size = SYSADPT_AMSDU_8K_MAX_SIZE;
  		}
-@@ -670,7 +670,7 @@ static int mwl_mac80211_sta_remove(struc
+@@ -692,7 +692,7 @@ static int mwl_mac80211_sta_remove(struc
  
  static int mwl_mac80211_conf_tx(struct ieee80211_hw *hw,
  				struct ieee80211_vif *vif,
@@ -446,7 +446,7 @@
  				const struct ieee80211_tx_queue_params *params)
  {
  	struct mwl_priv *priv = hw->priv;
-@@ -934,4 +934,9 @@ const struct ieee80211_ops mwl_mac80211_
+@@ -956,4 +956,9 @@ const struct ieee80211_ops mwl_mac80211_
  	.pre_channel_switch = mwl_mac80211_chnl_switch,
  	.sw_scan_start      = mwl_mac80211_sw_scan_start,
  	.sw_scan_complete   = mwl_mac80211_sw_scan_complete,
@@ -502,7 +502,7 @@
  	case TX_RATE_FORMAT_LEGACY:
 --- a/hif/pcie/pcie.c
 +++ b/hif/pcie/pcie.c
-@@ -546,7 +546,7 @@ static irqreturn_t pcie_isr_8864(struct
+@@ -533,7 +533,7 @@ static irqreturn_t pcie_isr_8864(struct
  
  		if (int_status & MACREG_A2HRIC_BIT_RADAR_DETECT) {
  			wiphy_info(hw->wiphy, "radar detected by firmware\n");
@@ -510,8 +510,8 @@
 +			ieee80211_radar_detected(hw, NULL);
  		}
  
- 		if (int_status & MACREG_A2HRIC_BIT_CHAN_SWITCH) ieee80211_queue_work(hw, &priv->chnl_switch_handle);
-@@ -593,7 +593,7 @@ static irqreturn_t pcie_isr_8997(struct
+ 		if (int_status & MACREG_A2HRIC_BIT_CHAN_SWITCH)
+@@ -575,7 +575,7 @@ static irqreturn_t pcie_isr_8997(struct
  
  		if (int_status & MACREG_A2HRIC_BIT_RADAR_DETECT) {
  			wiphy_info(hw->wiphy, "radar detected by firmware\n");
@@ -520,7 +520,7 @@
  		}
  
  		if (int_status & MACREG_A2HRIC_BIT_CHAN_SWITCH)
-@@ -1071,7 +1071,7 @@ static irqreturn_t pcie_isr_ndp(struct i
+@@ -1053,7 +1053,7 @@ static irqreturn_t pcie_isr_ndp(struct i
  
  		if (int_status & MACREG_A2HRIC_NEWDP_DFS) {
  			wiphy_info(hw->wiphy, "radar detected by firmware\n");
diff --git a/package/kernel/r8101/Makefile b/package/kernel/r8101/Makefile
index 2a09855c0503c1..4b528036a2122a 100644
--- a/package/kernel/r8101/Makefile
+++ b/package/kernel/r8101/Makefile
@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=r8101
 PKG_VERSION:=1.039.00
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://github.com/openwrt/rtl8101/releases/download/$(PKG_VERSION)
@@ -20,7 +20,7 @@ define KernelPackage/r8101
   TITLE:=Realtek RTL8101 PCI Fast Ethernet driver
   DEPENDS:=@PCI_SUPPORT +kmod-libphy
   FILES:=$(PKG_BUILD_DIR)/src/r8101.ko
-  AUTOLOAD:=$(call AutoProbe,r8101)
+  AUTOLOAD:=$(call AutoProbe,r8101,1)
   PROVIDES:=kmod-r8169
 endef
 
diff --git a/package/kernel/r8125/Makefile b/package/kernel/r8125/Makefile
index ef95b52e679549..7cb28c99804825 100644
--- a/package/kernel/r8125/Makefile
+++ b/package/kernel/r8125/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=r8125
-PKG_VERSION:=9.013.02
-PKG_RELEASE:=4
+PKG_VERSION:=9.016.01
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://github.com/openwrt/rtl8125/releases/download/$(PKG_VERSION)
-PKG_HASH:=d36410ee99c956f250d9cd08340d8c36567d190f420a8ee128ff6e51225aac0c
+PKG_HASH:=5434b26500538a62541c55cd09eea099177f59bd9cc48d16969089a9bcdbbd41
 
 PKG_BUILD_PARALLEL:=1
 PKG_LICENSE:=GPLv2
@@ -20,9 +20,10 @@ define KernelPackage/r8125
   TITLE:=Realtek RTL8125 PCI 2.5 Gigabit Ethernet driver
   DEPENDS:=@PCI_SUPPORT +kmod-libphy
   FILES:=$(PKG_BUILD_DIR)/src/r8125.ko
-  AUTOLOAD:=$(call AutoProbe,r8125)
+  AUTOLOAD:=$(call AutoProbe,r8125,1)
   PROVIDES:=kmod-r8169
   VARIANT:=regular
+  PKG_MAKE_FLAGS += CONFIG_ASPM=n
 endef
 
 define KernelPackage/r8125-rss
@@ -33,7 +34,9 @@ $(call KernelPackage/r8125)
 endef
 
 ifeq ($(BUILD_VARIANT),rss)
-  PKG_MAKE_FLAGS += ENABLE_RSS_SUPPORT=y
+  PKG_MAKE_FLAGS += \
+    ENABLE_MULTIPLE_TX_QUEUE=y \
+    ENABLE_RSS_SUPPORT=y
 endif
 
 define Build/Compile
diff --git a/package/kernel/r8125/patches/100-r8125_rss-silence-rxnfc-log.patch b/package/kernel/r8125/patches/100-r8125_rss-silence-rxnfc-log.patch
deleted file mode 100644
index 58eb470037f2d2..00000000000000
--- a/package/kernel/r8125/patches/100-r8125_rss-silence-rxnfc-log.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From cd20cf48c0ec2a01fd9f512e25218a6ac8131794 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
-Date: Sat, 17 Aug 2024 22:07:23 +0200
-Subject: [PATCH] r8125_rss: silence rxnfc log
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This log is noisy and useless, just ignore it.
-
-Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
----
- src/r8125_rss.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/src/r8125_rss.c
-+++ b/src/r8125_rss.c
-@@ -91,7 +91,7 @@ int rtl8125_get_rxnfc(struct net_device
-         struct rtl8125_private *tp = netdev_priv(dev);
-         int ret = -EOPNOTSUPP;
- 
--        netif_info(tp, drv, tp->dev, "rss get rxnfc\n");
-+        netif_dbg(tp, drv, tp->dev, "rss get rxnfc\n");
- 
-         if (!(dev->features & NETIF_F_RXHASH))
-                 return ret;
diff --git a/package/kernel/r8125/patches/200-r8125-print-link-speed-and-duplex-mode.patch b/package/kernel/r8125/patches/200-r8125-print-link-speed-and-duplex-mode.patch
index df649c9ae9f619..4f1917e74b8767 100644
--- a/package/kernel/r8125/patches/200-r8125-print-link-speed-and-duplex-mode.patch
+++ b/package/kernel/r8125/patches/200-r8125-print-link-speed-and-duplex-mode.patch
@@ -18,11 +18,12 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 
 --- a/src/r8125.h
 +++ b/src/r8125.h
-@@ -1563,6 +1563,8 @@ enum RTL8125_register_content {
+@@ -1726,6 +1726,9 @@ enum RTL8125_register_content {
          LinkStatus = 0x02,
          FullDup = 0x01,
  
 +#define RTL8125_FULL_DUPLEX_MASK (_2500bpsF | _1000bpsF | FullDup)
++#define RTL8125_SPEED_1000_MASK (_1000bpsF | _1000bpsL | _2500bpsL)
 +
          /* DBG_reg */
          Fix_Nak_1 = (1 << 4),
@@ -37,11 +38,11 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
  #include <linux/netdevice.h>
  #include <linux/etherdevice.h>
  #include <linux/delay.h>
-@@ -5112,6 +5113,38 @@ rtl8125_link_down_patch(struct net_devic
+@@ -5051,6 +5052,38 @@ rtl8125_link_down_patch(struct net_devic
  #endif
  }
  
-+static unsigned int rtl8125_phy_duplex(u16 status)
++static unsigned int rtl8125_phy_duplex(u32 status)
 +{
 +        unsigned int duplex = DUPLEX_UNKNOWN;
 +
@@ -55,14 +56,14 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 +        return duplex;
 +}
 +
-+static int rtl8125_phy_speed(u16 status)
++static int rtl8125_phy_speed(u32 status)
 +{
 +        int speed = SPEED_UNKNOWN;
 +
 +        if (status & LinkStatus) {
 +                if (status & _2500bpsF)
 +                        speed = SPEED_2500;
-+                else if (status & _1000bpsF)
++                else if (status & RTL8125_SPEED_1000_MASK)
 +                        speed = SPEED_1000;
 +                else if (status & _100bps)
 +                        speed = SPEED_100;
@@ -74,16 +75,16 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 +}
 +
  static void
- _rtl8125_check_link_status(struct net_device *dev)
+ _rtl8125_check_link_status(struct net_device *dev, unsigned int link_state)
  {
-@@ -5120,11 +5153,18 @@ _rtl8125_check_link_status(struct net_de
-         if (tp->link_ok(dev)) {
+@@ -5063,11 +5096,18 @@ _rtl8125_check_link_status(struct net_de
+         if (link_state == R8125_LINK_STATE_ON) {
                  rtl8125_link_on_patch(dev);
  
 -                if (netif_msg_ifup(tp))
 -                        printk(KERN_INFO PFX "%s: link up\n", dev->name);
 +                if (netif_msg_ifup(tp)) {
-+                        const u16 phy_status = RTL_R16(tp, PHYstatus);
++                        const u32 phy_status = RTL_R32(tp, PHYstatus);
 +                        const unsigned int phy_duplex = rtl8125_phy_duplex(phy_status);
 +                        const int phy_speed = rtl8125_phy_speed(phy_status);
 +                        printk(KERN_INFO PFX "%s: Link is Up - %s/%s\n",
diff --git a/package/kernel/r8126/Makefile b/package/kernel/r8126/Makefile
index c269cdcadc4ba6..6bc39a936a5c00 100644
--- a/package/kernel/r8126/Makefile
+++ b/package/kernel/r8126/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=r8126
-PKG_VERSION:=10.013.00
-PKG_RELEASE:=4
+PKG_VERSION:=10.016.00
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://github.com/openwrt/rtl8126/releases/download/$(PKG_VERSION)
-PKG_HASH:=b41bda6ff3bbb7d9bc5b81c5c21355f031587d3a3a5862abcd4d766e942272e7
+PKG_HASH:=50c8d3d49592d2e8f372bd7ece8e7df9b50a71b055c077d42eacc42302914440
 
 PKG_BUILD_PARALLEL:=1
 PKG_LICENSE:=GPLv2
@@ -20,7 +20,7 @@ define KernelPackage/r8126
   TITLE:=Realtek RTL8126 PCI 5 Gigabit Ethernet driver
   DEPENDS:=@PCI_SUPPORT +kmod-libphy
   FILES:=$(PKG_BUILD_DIR)/src/r8126.ko
-  AUTOLOAD:=$(call AutoProbe,r8126)
+  AUTOLOAD:=$(call AutoProbe,r8126,1)
   PROVIDES:=kmod-r8169
   VARIANT:=regular
 endef
@@ -33,7 +33,9 @@ $(call KernelPackage/r8126)
 endef
 
 ifeq ($(BUILD_VARIANT),rss)
-  PKG_MAKE_FLAGS += ENABLE_RSS_SUPPORT=y
+  PKG_MAKE_FLAGS += \
+    ENABLE_MULTIPLE_TX_QUEUE=y \
+    ENABLE_RSS_SUPPORT=y
 endif
 
 define Build/Compile
diff --git a/package/kernel/r8126/patches/001-r8126.h-use-BIT_ULL.patch b/package/kernel/r8126/patches/001-r8126.h-use-BIT_ULL.patch
deleted file mode 100644
index cfbf31fcbb3e44..00000000000000
--- a/package/kernel/r8126/patches/001-r8126.h-use-BIT_ULL.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-From 9649df50a239d1379cc8d9febd4854a0c7ca0731 Mon Sep 17 00:00:00 2001
-From: Mieczyslaw Nalewaj <namiltd@poczta.onet.pl>
-Date: Sat, 10 Aug 2024 17:42:44 +0200
-Subject: [PATCH] r8126.h: use BIT_ULL
-
-Fixes compilation on 32 bit systems.
----
- src/r8126.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/src/r8126.h
-+++ b/src/r8126.h
-@@ -678,7 +678,7 @@ This is free software, and you are welco
- #ifndef ADVERTISED_2500baseX_Full
- #define ADVERTISED_2500baseX_Full  0x8000
- #endif
--#define RTK_ADVERTISED_5000baseX_Full  BIT(48)
-+#define RTK_ADVERTISED_5000baseX_Full  BIT_ULL(48)
- 
- #define RTK_ADVERTISE_2500FULL  0x80
- #define RTK_ADVERTISE_5000FULL  0x100
diff --git a/package/kernel/r8126/patches/100-r8126_rss-silence-rxnfc-log.patch b/package/kernel/r8126/patches/100-r8126_rss-silence-rxnfc-log.patch
deleted file mode 100644
index d06406004c7c68..00000000000000
--- a/package/kernel/r8126/patches/100-r8126_rss-silence-rxnfc-log.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From cd20cf48c0ec2a01fd9f512e25218a6ac8131794 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
-Date: Sat, 17 Aug 2024 22:07:23 +0200
-Subject: [PATCH] r8126_rss: silence rxnfc log
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This log is noisy and useless, just ignore it.
-
-Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
-Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
----
- src/r8126_rss.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/src/r8126_rss.c
-+++ b/src/r8126_rss.c
-@@ -91,7 +91,7 @@ int rtl8126_get_rxnfc(struct net_device
-         struct rtl8126_private *tp = netdev_priv(dev);
-         int ret = -EOPNOTSUPP;
- 
--        netif_info(tp, drv, tp->dev, "rss get rxnfc\n");
-+        netif_dbg(tp, drv, tp->dev, "rss get rxnfc\n");
- 
-         if (!(dev->features & NETIF_F_RXHASH))
-                 return ret;
diff --git a/package/kernel/r8126/patches/200-r8126-print-link-speed-and-duplex-mode.patch b/package/kernel/r8126/patches/200-r8126-print-link-speed-and-duplex-mode.patch
index 308d2494b3e952..61e2666e1f0be8 100644
--- a/package/kernel/r8126/patches/200-r8126-print-link-speed-and-duplex-mode.patch
+++ b/package/kernel/r8126/patches/200-r8126-print-link-speed-and-duplex-mode.patch
@@ -18,11 +18,13 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 
 --- a/src/r8126.h
 +++ b/src/r8126.h
-@@ -1561,6 +1561,8 @@ enum RTL8126_register_content {
+@@ -1752,6 +1752,10 @@ enum RTL8126_register_content {
          LinkStatus = 0x02,
          FullDup = 0x01,
  
 +#define RTL8126_FULL_DUPLEX_MASK (_5000bpsF | _2500bpsF | _1000bpsF | FullDup)
++#define RTL8126_SPEED_1000_MASK (_1000bpsF | _1000bpsL | _2500bpsL)
++#define RTL8126_SPEED_2500_MASK (_2500bpsF | _5000bpsL)
 +
          /* DBG_reg */
          Fix_Nak_1 = (1 << 4),
@@ -37,11 +39,11 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
  #include <linux/netdevice.h>
  #include <linux/etherdevice.h>
  #include <linux/delay.h>
-@@ -4740,6 +4741,40 @@ rtl8126_link_down_patch(struct net_devic
- #endif
+@@ -4410,6 +4411,40 @@ rtl8126_link_down_patch(struct net_devic
+         //rtl8126_set_speed(dev, tp->autoneg, tp->speed, tp->duplex, tp->advertising);
  }
  
-+static unsigned int rtl8126_phy_duplex(u16 status)
++static unsigned int rtl8126_phy_duplex(u32 status)
 +{
 +        unsigned int duplex = DUPLEX_UNKNOWN;
 +
@@ -55,16 +57,16 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 +        return duplex;
 +}
 +
-+static int rtl8126_phy_speed(u16 status)
++static int rtl8126_phy_speed(u32 status)
 +{
 +        int speed = SPEED_UNKNOWN;
 +
 +        if (status & LinkStatus) {
 +                if (status & _5000bpsF)
 +                        speed = SPEED_5000;
-+                else if (status & _2500bpsF)
++                else if (status & RTL8126_SPEED_2500_MASK)
 +                        speed = SPEED_2500;
-+                else if (status & _1000bpsF)
++                else if (status & RTL8126_SPEED_1000_MASK)
 +                        speed = SPEED_1000;
 +                else if (status & _100bps)
 +                        speed = SPEED_100;
@@ -76,16 +78,16 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 +}
 +
  static void
- _rtl8126_check_link_status(struct net_device *dev)
+ _rtl8126_check_link_status(struct net_device *dev, unsigned int link_state)
  {
-@@ -4748,11 +4783,18 @@ _rtl8126_check_link_status(struct net_de
-         if (tp->link_ok(dev)) {
+@@ -4422,11 +4457,18 @@ _rtl8126_check_link_status(struct net_de
+         if (link_state == R8126_LINK_STATE_ON) {
                  rtl8126_link_on_patch(dev);
  
 -                if (netif_msg_ifup(tp))
 -                        printk(KERN_INFO PFX "%s: link up\n", dev->name);
 +                if (netif_msg_ifup(tp)) {
-+                        const u16 phy_status = RTL_R16(tp, PHYstatus);
++                        const u32 phy_status = RTL_R32(tp, PHYstatus);
 +                        const unsigned int phy_duplex = rtl8126_phy_duplex(phy_status);
 +                        const int phy_speed = rtl8126_phy_speed(phy_status);
 +                        printk(KERN_INFO PFX "%s: Link is Up - %s/%s\n",
diff --git a/package/kernel/r8127/Makefile b/package/kernel/r8127/Makefile
new file mode 100644
index 00000000000000..38be4ae82d7c78
--- /dev/null
+++ b/package/kernel/r8127/Makefile
@@ -0,0 +1,49 @@
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=r8127
+PKG_VERSION:=11.015.00
+PKG_RELEASE:=1
+
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
+PKG_SOURCE_URL:=https://github.com/openwrt/rtl8127/releases/download/$(PKG_VERSION)
+PKG_HASH:=ab21bf69368fb9de7f591b2e81cf1a815988bbf086ecbf41af7de9787b10594b
+
+PKG_BUILD_PARALLEL:=1
+PKG_LICENSE:=GPLv2
+PKG_MAINTAINER:=Alvaro Fernandez Rojas <noltari@gmail.com>
+
+include $(INCLUDE_DIR)/kernel.mk
+include $(INCLUDE_DIR)/package.mk
+
+define KernelPackage/r8127
+  SUBMENU:=Network Devices
+  TITLE:=Realtek RTL8127 PCI 10 Gigabit Ethernet driver
+  DEPENDS:=@PCI_SUPPORT +kmod-libphy
+  FILES:=$(PKG_BUILD_DIR)/src/r8127.ko
+  AUTOLOAD:=$(call AutoProbe,r8127,1)
+  PROVIDES:=kmod-r8169
+  VARIANT:=regular
+endef
+
+define KernelPackage/r8127-rss
+$(call KernelPackage/r8127)
+  CONFLICTS:=kmod-r8127
+  TITLE+= (RSS)
+  VARIANT:=rss
+endef
+
+ifeq ($(BUILD_VARIANT),rss)
+  PKG_MAKE_FLAGS += \
+    ENABLE_MULTIPLE_TX_QUEUE=y \
+    ENABLE_RSS_SUPPORT=y
+endif
+
+define Build/Compile
+	+$(KERNEL_MAKE) $(PKG_JOBS) \
+		$(PKG_MAKE_FLAGS) \
+		M="$(PKG_BUILD_DIR)/src" \
+		modules
+endef
+
+$(eval $(call KernelPackage,r8127))
+$(eval $(call KernelPackage,r8127-rss))
diff --git a/package/kernel/r8127/patches/200-r8127-print-link-speed-and-duplex-mode.patch b/package/kernel/r8127/patches/200-r8127-print-link-speed-and-duplex-mode.patch
new file mode 100644
index 00000000000000..275feb823405f2
--- /dev/null
+++ b/package/kernel/r8127/patches/200-r8127-print-link-speed-and-duplex-mode.patch
@@ -0,0 +1,107 @@
+From 5ca1d47e065c0318774a946ffdf76010c78cc164 Mon Sep 17 00:00:00 2001
+From: Chukun Pan <amadeus@jmu.edu.cn>
+Date: Sat, 10 Aug 2024 20:16:32 +0800
+Subject: [PATCH] r8127: print link speed and duplex mode
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Like other Ethernet drivers, print link speed and duplex mode
+when the interface is up. Formatting output at the same time.
+
+Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ src/r8127.h   |  2 ++
+ src/r8127_n.c | 48 +++++++++++++++++++++++++++++++++++++++++++++---
+ 2 files changed, 47 insertions(+), 3 deletions(-)
+
+--- a/src/r8127.h
++++ b/src/r8127.h
+@@ -1770,6 +1770,11 @@ enum RTL8127_register_content {
+         LinkStatus = 0x02,
+         FullDup = 0x01,
+ 
++#define RTL8127_FULL_DUPLEX_MASK (_10000bpsF | _5000bpsF | _2500bpsF | _1000bpsF | FullDup)
++#define RTL8127_SPEED_1000_MASK (_1000bpsF | _1000bpsL | _2500bpsL)
++#define RTL8127_SPEED_2500_MASK (_2500bpsF | _5000bpsL)
++#define RTL8127_SPEED_5000_MASK (_5000bpsF | _10000bpsL)
++
+         /* DBG_reg */
+         Fix_Nak_1 = (1 << 4),
+         Fix_Nak_2 = (1 << 3),
+--- a/src/r8127_n.c
++++ b/src/r8127_n.c
+@@ -39,6 +39,7 @@
+ #include <linux/module.h>
+ #include <linux/version.h>
+ #include <linux/pci.h>
++#include <linux/phy.h>
+ #include <linux/netdevice.h>
+ #include <linux/etherdevice.h>
+ #include <linux/delay.h>
+@@ -4734,6 +4735,42 @@ rtl8127_link_down_patch(struct net_devic
+ #endif
+ }
+ 
++static unsigned int rtl8127_phy_duplex(u32 status)
++{
++        unsigned int duplex = DUPLEX_UNKNOWN;
++
++        if (status & LinkStatus) {
++                if (status & RTL8127_FULL_DUPLEX_MASK)
++                        duplex = DUPLEX_FULL;
++                else
++                        duplex = DUPLEX_HALF;
++        }
++
++        return duplex;
++}
++
++static int rtl8127_phy_speed(u32 status)
++{
++        int speed = SPEED_UNKNOWN;
++
++        if (status & LinkStatus) {
++                if (status & _10000bpsF)
++                        speed = SPEED_10000;
++                else if (status & RTL8127_SPEED_5000_MASK)
++                        speed = SPEED_5000;
++                else if (status & RTL8127_SPEED_2500_MASK)
++                        speed = SPEED_2500;
++                else if (status & RTL8127_SPEED_1000_MASK)
++                        speed = SPEED_1000;
++                else if (status & _100bps)
++                        speed = SPEED_100;
++                else if (status & _10bps)
++                        speed = SPEED_10;
++        }
++
++        return speed;
++}
++
+ static void
+ _rtl8127_check_link_status(struct net_device *dev, unsigned int link_state)
+ {
+@@ -4746,11 +4783,18 @@ _rtl8127_check_link_status(struct net_de
+         if (link_state == R8127_LINK_STATE_ON) {
+                 rtl8127_link_on_patch(dev);
+ 
+-                if (netif_msg_ifup(tp))
+-                        printk(KERN_INFO PFX "%s: link up\n", dev->name);
++                if (netif_msg_ifup(tp)) {
++                        const u32 phy_status = RTL_R32(tp, PHYstatus);
++                        const unsigned int phy_duplex = rtl8127_phy_duplex(phy_status);
++                        const int phy_speed = rtl8127_phy_speed(phy_status);
++                        printk(KERN_INFO PFX "%s: Link is Up - %s/%s\n",
++                                dev->name,
++                                phy_speed_to_str(phy_speed),
++                                phy_duplex_to_str(phy_duplex));
++                }
+         } else {
+                 if (netif_msg_ifdown(tp))
+-                        printk(KERN_INFO PFX "%s: link down\n", dev->name);
++                        printk(KERN_INFO PFX "%s: Link is Down\n", dev->name);
+ 
+                 rtl8127_link_down_patch(dev);
+         }
diff --git a/package/kernel/r8168/Makefile b/package/kernel/r8168/Makefile
index 2604425deac2bc..182950a6240f26 100644
--- a/package/kernel/r8168/Makefile
+++ b/package/kernel/r8168/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=r8168
-PKG_VERSION:=8.054.00
-PKG_RELEASE:=1
+PKG_VERSION:=8.055.00
+PKG_RELEASE:=4
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://github.com/openwrt/rtl8168/releases/download/$(PKG_VERSION)
-PKG_HASH:=5480120cf823e991e8cbd325118c1ec0c57d8f42760ba1a7334bd07d291d235d
+PKG_HASH:=61deb2a9cb7d6b08748ad51734b108da95d629712b64b204e2e6bd3f16d0a48f
 
 PKG_BUILD_PARALLEL:=1
 PKG_LICENSE:=GPLv2
@@ -20,14 +20,30 @@ define KernelPackage/r8168
   TITLE:=Realtek RTL8168 PCI Gigabit Ethernet driver
   DEPENDS:=@PCI_SUPPORT +kmod-libphy
   FILES:=$(PKG_BUILD_DIR)/src/r8168.ko
-  AUTOLOAD:=$(call AutoProbe,r8168)
+  AUTOLOAD:=$(call AutoProbe,r8168,1)
   PROVIDES:=kmod-r8169
+  VARIANT:=regular
 endef
 
+define KernelPackage/r8168-rss
+$(call KernelPackage/r8168)
+  CONFLICTS:=kmod-r8168
+  TITLE+= (RSS)
+  VARIANT:=rss
+endef
+
+ifeq ($(BUILD_VARIANT),rss)
+  PKG_MAKE_FLAGS += \
+    ENABLE_MULTIPLE_TX_QUEUE=y \
+    ENABLE_RSS_SUPPORT=y
+endif
+
 define Build/Compile
 	+$(KERNEL_MAKE) $(PKG_JOBS) \
+		$(PKG_MAKE_FLAGS) \
 		M="$(PKG_BUILD_DIR)/src" \
 		modules
 endef
 
 $(eval $(call KernelPackage,r8168))
+$(eval $(call KernelPackage,r8168-rss))
diff --git a/package/kernel/r8168/patches/001-r8168_n-fix-proc_dump_rx_desc_2-on-32-bits.patch b/package/kernel/r8168/patches/001-r8168_n-fix-proc_dump_rx_desc_2-on-32-bits.patch
index b53819a0cbb90e..bb00411e06094d 100644
--- a/package/kernel/r8168/patches/001-r8168_n-fix-proc_dump_rx_desc_2-on-32-bits.patch
+++ b/package/kernel/r8168/patches/001-r8168_n-fix-proc_dump_rx_desc_2-on-32-bits.patch
@@ -13,7 +13,7 @@ Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
 
 --- a/src/r8168_n.c
 +++ b/src/r8168_n.c
-@@ -1655,9 +1655,9 @@ static int proc_dump_rx_desc_2(struct se
+@@ -1668,9 +1668,9 @@ static int proc_dump_rx_desc_2(struct se
                                                            j, k);
                          for (i=0; i<(tp->RxDescLength/4); i++) {
                                  if (!(i % 4))
diff --git a/package/kernel/r8168/patches/200-r8168-print-link-speed-and-duplex-mode.patch b/package/kernel/r8168/patches/200-r8168-print-link-speed-and-duplex-mode.patch
index 0212ae9bc41c39..150c41d63249ab 100644
--- a/package/kernel/r8168/patches/200-r8168-print-link-speed-and-duplex-mode.patch
+++ b/package/kernel/r8168/patches/200-r8168-print-link-speed-and-duplex-mode.patch
@@ -18,7 +18,7 @@ Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
 
 --- a/src/r8168.h
 +++ b/src/r8168.h
-@@ -1385,6 +1385,8 @@ enum RTL8168_register_content {
+@@ -1480,6 +1480,8 @@ enum RTL8168_register_content {
          LinkStatus = 0x02,
          FullDup = 0x01,
  
@@ -37,7 +37,7 @@ Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
  #include <linux/netdevice.h>
  #include <linux/etherdevice.h>
  #include <linux/delay.h>
-@@ -5373,6 +5374,36 @@ rtl8168_link_down_patch(struct net_devic
+@@ -5396,6 +5397,38 @@ rtl8168_link_down_patch(struct net_devic
  #endif
  }
  
@@ -66,6 +66,8 @@ Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
 +                        speed = SPEED_100;
 +                else if (status & _10bps)
 +                        speed = SPEED_10;
++                else if (eee_giga_lite)
++                        speed = SPEED_1000;
 +        }
 +
 +        return speed;
@@ -74,7 +76,7 @@ Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
  static void
  rtl8168_check_link_status(struct net_device *dev)
  {
-@@ -5392,11 +5423,18 @@ rtl8168_check_link_status(struct net_dev
+@@ -5415,11 +5448,18 @@ rtl8168_check_link_status(struct net_dev
                  if (link_status_on) {
                          rtl8168_link_on_patch(dev);
  
diff --git a/package/kernel/ubootenv-nvram/src/ubootenv-nvram.c b/package/kernel/ubootenv-nvram/src/ubootenv-nvram.c
index f6244142167b0b..106e41231c9094 100644
--- a/package/kernel/ubootenv-nvram/src/ubootenv-nvram.c
+++ b/package/kernel/ubootenv-nvram/src/ubootenv-nvram.c
@@ -146,7 +146,6 @@ static struct platform_driver ubootenv_driver = {
 	.remove = ubootenv_remove,
 	.driver = {
 		.name           = NAME,
-		.owner          = THIS_MODULE,
 		.of_match_table = of_ubootenv_match,
 	},
 };
diff --git a/package/libs/elfutils/Makefile b/package/libs/elfutils/Makefile
index ac5841c604b235..b47bb5240683d9 100644
--- a/package/libs/elfutils/Makefile
+++ b/package/libs/elfutils/Makefile
@@ -7,15 +7,16 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=elfutils
-PKG_VERSION:=0.191
+PKG_VERSION:=0.192
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
-PKG_SOURCE_URL:=https://sourceware.org/$(PKG_NAME)/ftp/$(PKG_VERSION)
-PKG_HASH:=df76db71366d1d708365fc7a6c60ca48398f14367eb2b8954efc8897147ad871
+PKG_SOURCE_URL:=https://sourceware.org/$(PKG_NAME)/ftp/$(PKG_VERSION) \
+                https://mirrors.kernel.org/sourceware/$(PKG_NAME)/$(PKG_VERSION)
+PKG_HASH:=616099beae24aba11f9b63d86ca6cc8d566d968b802391334c91df54eab416b4
 
 PKG_MAINTAINER:=Luiz Angelo Daros de Luca <luizluca@gmail.com>
-PKG_LICENSE:=GPL-3.0-or-later
+PKG_LICENSE:=GPL-2.0-or-later OR LGPL-3.0-or-later
 PKG_LICENSE_FILES:=COPYING COPYING-GPLV2 COPYING-LGPLV3
 PKG_CPE_ID:=cpe:/a:elfutils_project:elfutils
 
diff --git a/package/libs/elfutils/patches/003-libintl-compatibility.patch b/package/libs/elfutils/patches/003-libintl-compatibility.patch
index 1271796af54fd4..eda9f2204a928c 100644
--- a/package/libs/elfutils/patches/003-libintl-compatibility.patch
+++ b/package/libs/elfutils/patches/003-libintl-compatibility.patch
@@ -11,7 +11,7 @@
  Requires.private: zlib @LIBZSTD@
 --- a/configure.ac
 +++ b/configure.ac
-@@ -717,6 +717,9 @@ dnl AM_GNU_GETTEXT_REQUIRE_VERSION suppo
+@@ -728,6 +728,9 @@ dnl AM_GNU_GETTEXT_REQUIRE_VERSION suppo
  AM_GNU_GETTEXT_VERSION([0.19.6])
  AM_GNU_GETTEXT_REQUIRE_VERSION([0.19.6])
  
diff --git a/package/libs/elfutils/patches/005-build_only_libs.patch b/package/libs/elfutils/patches/005-build_only_libs.patch
index 598b734874e764..177ac659e62403 100644
--- a/package/libs/elfutils/patches/005-build_only_libs.patch
+++ b/package/libs/elfutils/patches/005-build_only_libs.patch
@@ -8,4 +8,4 @@
 +	  libasm
  
  EXTRA_DIST = elfutils.spec GPG-KEY NOTES CONTRIBUTING SECURITY \
- 	     COPYING COPYING-GPLV2 COPYING-LGPLV3
+ 	     COPYING COPYING-GPLV2 COPYING-LGPLV3 CONDUCT
diff --git a/package/libs/elfutils/patches/006-Fix-build-on-aarch64-musl.patch b/package/libs/elfutils/patches/006-Fix-build-on-aarch64-musl.patch
index d8066c5ca717cf..a7786ed2c011a0 100644
--- a/package/libs/elfutils/patches/006-Fix-build-on-aarch64-musl.patch
+++ b/package/libs/elfutils/patches/006-Fix-build-on-aarch64-musl.patch
@@ -32,8 +32,8 @@ Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com>
 +# include <sys/uio.h>
  # include <sys/user.h>
  # include <sys/ptrace.h>
- /* Deal with old glibc defining user_pt_regs instead of user_regs_struct.  */
-@@ -82,7 +82,7 @@ aarch64_set_initial_registers_tid (pid_t
+ # include <asm/ptrace.h>
+@@ -94,7 +94,7 @@ aarch64_set_initial_registers_tid (pid_t
  
    Dwarf_Word dwarf_fregs[32];
    for (int r = 0; r < 32; r++)
diff --git a/package/libs/elfutils/patches/007-add-libeu-symbols-to-libelf.patch b/package/libs/elfutils/patches/007-add-libeu-symbols-to-libelf.patch
new file mode 100644
index 00000000000000..23489b562570e7
--- /dev/null
+++ b/package/libs/elfutils/patches/007-add-libeu-symbols-to-libelf.patch
@@ -0,0 +1,31 @@
+From f5d6e088f84dd05278c4698a21cbf1ff4569978d Mon Sep 17 00:00:00 2001
+From: Mark Wielaard <mark@klomp.org>
+Date: Tue, 22 Oct 2024 15:03:42 +0200
+Subject: [PATCH] libelf: Add libeu objects to libelf.a static archive
+
+libelf might use some symbols from libeu.a, specifically the eu-search
+wrappers. But we don't ship libeu.a separately. So include the libeu
+objects in the libelf.a archive to facilitate static linking.
+
+	* libelf/Makefile.am (libeu_objects): New variable.
+	(libelf_a_LIBADD): New, add libeu_objects.
+
+https://sourceware.org/bugzilla/show_bug.cgi?id=32293
+
+Signed-off-by: Mark Wielaard <mark@klomp.org>
+---
+ libelf/Makefile.am | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/libelf/Makefile.am
++++ b/libelf/Makefile.am
+@@ -122,6 +122,9 @@ libelf.so: $(srcdir)/libelf.map $(libelf
+ 	@$(textrel_check)
+ 	$(AM_V_at)ln -fs $@ $@.$(VERSION)
+ 
++libeu_objects = $(shell $(AR) t ../lib/libeu.a)
++libelf_a_LIBADD = $(addprefix ../lib/,$(libeu_objects))
++
+ install: install-am libelf.so
+ 	$(mkinstalldirs) $(DESTDIR)$(libdir)
+ 	$(INSTALL_PROGRAM) libelf.so $(DESTDIR)$(libdir)/libelf-$(PACKAGE_VERSION).so
diff --git a/package/libs/elfutils/patches/008-fix-autoconf-ENABLE_IMA_VERIFICATION.patch b/package/libs/elfutils/patches/008-fix-autoconf-ENABLE_IMA_VERIFICATION.patch
new file mode 100644
index 00000000000000..e5732d2b0821fd
--- /dev/null
+++ b/package/libs/elfutils/patches/008-fix-autoconf-ENABLE_IMA_VERIFICATION.patch
@@ -0,0 +1,24 @@
+From f3c664d069d81a4872a1ec8241ee709f37c53e9c Mon Sep 17 00:00:00 2001
+From: Aaron Merey <amerey@redhat.com>
+Date: Tue, 29 Oct 2024 14:16:57 -0400
+Subject: [PATCH] configure.ac: Fix ENABLE_IMA_VERIFICATION conditional
+
+Fix test statement for ENABLE_IMA_VERIFICATION always evalutating to
+false due to a missing 'x'.
+
+Signed-off-by: Aaron Merey <amerey@redhat.com>
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/configure.ac
++++ b/configure.ac
+@@ -895,7 +895,7 @@ AS_IF([test "x$enable_debuginfod" != "xn
+ AM_CONDITIONAL([DEBUGINFOD],[test "x$enable_debuginfod" = "xyes"])
+ AS_IF([test "x$enable_debuginfod_ima_verification" = "xyes"],AC_DEFINE([ENABLE_IMA_VERIFICATION],[1],[Build IMA verification]))
+ AS_IF([test "x$have_libarchive" = "xyes"],AC_DEFINE([HAVE_LIBARCHIVE],[1],[Define to 1 if libarchive is available]))
+-AM_CONDITIONAL([ENABLE_IMA_VERIFICATION],[test "$enable_debuginfod_ima_verification" = "xyes"])
++AM_CONDITIONAL([ENABLE_IMA_VERIFICATION],[test "x$enable_debuginfod_ima_verification" = "xyes"])
+ AM_CONDITIONAL([OLD_LIBMICROHTTPD],[test "x$old_libmicrohttpd" = "xyes"])
+ 
+ dnl for /etc/profile.d/elfutils.{csh,sh}
diff --git a/package/libs/elfutils/patches/009-fix-null-dereference-with-lto.patch b/package/libs/elfutils/patches/009-fix-null-dereference-with-lto.patch
new file mode 100644
index 00000000000000..1179a1e1a01f67
--- /dev/null
+++ b/package/libs/elfutils/patches/009-fix-null-dereference-with-lto.patch
@@ -0,0 +1,193 @@
+From 8707194a9f2f0b13e53041b03ebfdbdbd2942e43 Mon Sep 17 00:00:00 2001
+From: Mark Wielaard <mark@klomp.org>
+Date: Tue, 5 Nov 2024 23:31:14 +0100
+Subject: [PATCH 1/1] libelf: Only fetch shdr once in elf_compress[_gnu]
+
+Some compilers assume the second call to elf[32|64]_getshdr can fail
+and produce error: potential null pointer dereference. Just store the
+result of the first call and reuse (when not NULL).
+
+       * libelf/elf_compress.c (elf_compress): Store getshdr result in
+       a shdr union var.
+       * libelf/elf_compress_gnu.c (): Likewise
+
+https://sourceware.org/bugzilla/show_bug.cgi?id=32311
+
+Signed-off-by: Mark Wielaard <mark@klomp.org>
+---
+ libelf/elf_compress.c     | 55 +++++++++++++++++++++------------------
+ libelf/elf_compress_gnu.c | 45 ++++++++++++++------------------
+ 2 files changed, 48 insertions(+), 52 deletions(-)
+
+--- a/libelf/elf_compress.c
++++ b/libelf/elf_compress.c
+@@ -584,25 +584,30 @@ elf_compress (Elf_Scn *scn, int type, un
+   Elf64_Xword sh_flags;
+   Elf64_Word sh_type;
+   Elf64_Xword sh_addralign;
++  union shdr
++  {
++    Elf32_Shdr *s32;
++    Elf64_Shdr *s64;
++  } shdr;
+   if (elfclass == ELFCLASS32)
+     {
+-      Elf32_Shdr *shdr = elf32_getshdr (scn);
+-      if (shdr == NULL)
++      shdr.s32 = elf32_getshdr (scn);
++      if (shdr.s32 == NULL)
+ 	return -1;
+ 
+-      sh_flags = shdr->sh_flags;
+-      sh_type = shdr->sh_type;
+-      sh_addralign = shdr->sh_addralign;
++      sh_flags = shdr.s32->sh_flags;
++      sh_type = shdr.s32->sh_type;
++      sh_addralign = shdr.s32->sh_addralign;
+     }
+   else
+     {
+-      Elf64_Shdr *shdr = elf64_getshdr (scn);
+-      if (shdr == NULL)
++      shdr.s64 = elf64_getshdr (scn);
++      if (shdr.s64 == NULL)
+ 	return -1;
+ 
+-      sh_flags = shdr->sh_flags;
+-      sh_type = shdr->sh_type;
+-      sh_addralign = shdr->sh_addralign;
++      sh_flags = shdr.s64->sh_flags;
++      sh_type = shdr.s64->sh_type;
++      sh_addralign = shdr.s64->sh_addralign;
+     }
+ 
+   if ((sh_flags & SHF_ALLOC) != 0)
+@@ -679,17 +684,17 @@ elf_compress (Elf_Scn *scn, int type, un
+ 	 correctly and ignored when SHF_COMPRESSED is set.  */
+       if (elfclass == ELFCLASS32)
+ 	{
+-	  Elf32_Shdr *shdr = elf32_getshdr (scn);
+-	  shdr->sh_size = new_size;
+-	  shdr->sh_addralign = __libelf_type_align (ELFCLASS32, ELF_T_CHDR);
+-	  shdr->sh_flags |= SHF_COMPRESSED;
++	  shdr.s32->sh_size = new_size;
++	  shdr.s32->sh_addralign = __libelf_type_align (ELFCLASS32,
++							ELF_T_CHDR);
++	  shdr.s32->sh_flags |= SHF_COMPRESSED;
+ 	}
+       else
+ 	{
+-	  Elf64_Shdr *shdr = elf64_getshdr (scn);
+-	  shdr->sh_size = new_size;
+-	  shdr->sh_addralign = __libelf_type_align (ELFCLASS64, ELF_T_CHDR);
+-	  shdr->sh_flags |= SHF_COMPRESSED;
++	  shdr.s64->sh_size = new_size;
++	  shdr.s64->sh_addralign = __libelf_type_align (ELFCLASS64,
++							ELF_T_CHDR);
++	  shdr.s64->sh_flags |= SHF_COMPRESSED;
+ 	}
+ 
+       __libelf_reset_rawdata (scn, out_buf, new_size, 1, ELF_T_CHDR);
+@@ -731,17 +736,15 @@ elf_compress (Elf_Scn *scn, int type, un
+ 	 correctly and ignored when SHF_COMPRESSED is set.  */
+       if (elfclass == ELFCLASS32)
+ 	{
+-	  Elf32_Shdr *shdr = elf32_getshdr (scn);
+-	  shdr->sh_size = scn->zdata_size;
+-	  shdr->sh_addralign = scn->zdata_align;
+-	  shdr->sh_flags &= ~SHF_COMPRESSED;
++	  shdr.s32->sh_size = scn->zdata_size;
++	  shdr.s32->sh_addralign = scn->zdata_align;
++	  shdr.s32->sh_flags &= ~SHF_COMPRESSED;
+ 	}
+       else
+ 	{
+-	  Elf64_Shdr *shdr = elf64_getshdr (scn);
+-	  shdr->sh_size = scn->zdata_size;
+-	  shdr->sh_addralign = scn->zdata_align;
+-	  shdr->sh_flags &= ~SHF_COMPRESSED;
++	  shdr.s64->sh_size = scn->zdata_size;
++	  shdr.s64->sh_addralign = scn->zdata_align;
++	  shdr.s64->sh_flags &= ~SHF_COMPRESSED;
+ 	}
+ 
+       __libelf_reset_rawdata (scn, scn->zdata_base,
+--- a/libelf/elf_compress_gnu.c
++++ b/libelf/elf_compress_gnu.c
+@@ -59,25 +59,30 @@ elf_compress_gnu (Elf_Scn *scn, int infl
+   Elf64_Xword sh_flags;
+   Elf64_Word sh_type;
+   Elf64_Xword sh_addralign;
++  union shdr
++  {
++    Elf32_Shdr *s32;
++    Elf64_Shdr *s64;
++  } shdr;
+   if (elfclass == ELFCLASS32)
+     {
+-      Elf32_Shdr *shdr = elf32_getshdr (scn);
+-      if (shdr == NULL)
++      shdr.s32 = elf32_getshdr (scn);
++      if (shdr.s32 == NULL)
+ 	return -1;
+ 
+-      sh_flags = shdr->sh_flags;
+-      sh_type = shdr->sh_type;
+-      sh_addralign = shdr->sh_addralign;
++      sh_flags = shdr.s32->sh_flags;
++      sh_type = shdr.s32->sh_type;
++      sh_addralign = shdr.s32->sh_addralign;
+     }
+   else
+     {
+-      Elf64_Shdr *shdr = elf64_getshdr (scn);
+-      if (shdr == NULL)
++      shdr.s64 = elf64_getshdr (scn);
++      if (shdr.s64 == NULL)
+ 	return -1;
+ 
+-      sh_flags = shdr->sh_flags;
+-      sh_type = shdr->sh_type;
+-      sh_addralign = shdr->sh_addralign;
++      sh_flags = shdr.s64->sh_flags;
++      sh_type = shdr.s64->sh_type;
++      sh_addralign = shdr.s64->sh_addralign;
+     }
+ 
+   /* Allocated sections, or sections that are already are compressed
+@@ -122,15 +127,9 @@ elf_compress_gnu (Elf_Scn *scn, int infl
+ 	 sh_flags won't have a SHF_COMPRESSED hint in the GNU format.
+ 	 Just adjust the sh_size.  */
+       if (elfclass == ELFCLASS32)
+-	{
+-	  Elf32_Shdr *shdr = elf32_getshdr (scn);
+-	  shdr->sh_size = new_size;
+-	}
++	  shdr.s32->sh_size = new_size;
+       else
+-	{
+-	  Elf64_Shdr *shdr = elf64_getshdr (scn);
+-	  shdr->sh_size = new_size;
+-	}
++	  shdr.s64->sh_size = new_size;
+ 
+       __libelf_reset_rawdata (scn, out_buf, new_size, 1, ELF_T_BYTE);
+ 
+@@ -187,15 +186,9 @@ elf_compress_gnu (Elf_Scn *scn, int infl
+ 	 sh_flags won't have a SHF_COMPRESSED hint in the GNU format.
+ 	 Just adjust the sh_size.  */
+       if (elfclass == ELFCLASS32)
+-	{
+-	  Elf32_Shdr *shdr = elf32_getshdr (scn);
+-	  shdr->sh_size = size;
+-	}
++	shdr.s32->sh_size = size;
+       else
+-	{
+-	  Elf64_Shdr *shdr = elf64_getshdr (scn);
+-	  shdr->sh_size = size;
+-	}
++	shdr.s64->sh_size = size;
+ 
+       __libelf_reset_rawdata (scn, buf_out, size, sh_addralign,
+ 			      __libelf_data_type (&ehdr, sh_type,
diff --git a/package/libs/elfutils/patches/102-fix-potential-deref-of-null-error.patch b/package/libs/elfutils/patches/102-fix-potential-deref-of-null-error.patch
new file mode 100644
index 00000000000000..6710e4ef9cf176
--- /dev/null
+++ b/package/libs/elfutils/patches/102-fix-potential-deref-of-null-error.patch
@@ -0,0 +1,55 @@
+strip.c: Pointer `arhdr` created at strip.c:2741 and then dereferenced without NULL-check.
+The same situation for the `arhdr` pointer at the objdump.c:313 and
+the `h` pointer at the readelf.c:13545.
+
+Triggers found by static analyzer Svace.
+
+Signed-off-by: Maks Mishin <maks.mishinFZ@gmail.com>
+---
+ src/objdump.c | 5 +++++
+ src/readelf.c | 5 +++++
+ src/strip.c   | 5 +++++
+ 3 files changed, 15 insertions(+)
+
+--- a/src/objdump.c
++++ b/src/objdump.c
+@@ -311,6 +311,11 @@ handle_ar (int fd, Elf *elf, const char
+     {
+       /* The the header for this element.  */
+       Elf_Arhdr *arhdr = elf_getarhdr (subelf);
++      if (arhdr == NULL)
++	{
++	  printf ("cannot get arhdr: %s\n", elf_errmsg (-1));
++	  exit (1);
++	}
+ 
+       /* Skip over the index entries.  */
+       if (strcmp (arhdr->ar_name, "/") != 0
+--- a/src/readelf.c
++++ b/src/readelf.c
+@@ -13543,6 +13543,11 @@ dump_archive_index (Elf *elf, const char
+ 			  as_off, fname, elf_errmsg (-1));
+ 
+ 	  const Elf_Arhdr *h = elf_getarhdr (subelf);
++	  if (h == NULL)
++	{
++	  printf ("cannot get arhdr: %s\n", elf_errmsg (-1));
++	  exit (1);
++	}
+ 
+ 	  printf (_("Archive member '%s' contains:\n"), h->ar_name);
+ 
+--- a/src/strip.c
++++ b/src/strip.c
+@@ -2739,6 +2739,11 @@ handle_ar (int fd, Elf *elf, const char
+     {
+       /* The the header for this element.  */
+       Elf_Arhdr *arhdr = elf_getarhdr (subelf);
++	  if (arhdr == NULL)
++	{
++	  printf ("cannot get arhdr: %s\n", elf_errmsg (-1));
++	  exit (1);
++	}
+ 
+       if (elf_kind (subelf) == ELF_K_ELF)
+ 	result |= handle_elf (fd, subelf, new_prefix, arhdr->ar_name, 0, NULL);
diff --git a/package/libs/gettext-full/Makefile b/package/libs/gettext-full/Makefile
index 0a7782c1f1e4f6..36615f3fd28b04 100644
--- a/package/libs/gettext-full/Makefile
+++ b/package/libs/gettext-full/Makefile
@@ -18,7 +18,8 @@ PKG_BUILD_DIR:=$(BUILD_DIR)/gettext-$(PKG_VERSION)
 HOST_BUILD_DIR:=$(BUILD_DIR_HOST)/gettext-$(PKG_VERSION)
 
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
-PKG_LICENSE:=GPL-3.0-or-later
+PKG_LICENSE:=LGPL-2.1-or-later
+PKG_LICENSE_FILES:=gettext-runtime/intl/COPYING.LIB
 PKG_CPE_ID:=cpe:/a:gnu:gettext
 
 PKG_INSTALL:=1
diff --git a/package/libs/libbpf/Makefile b/package/libs/libbpf/Makefile
index 89fe730a98adfe..4d918e7bbfd8f0 100644
--- a/package/libs/libbpf/Makefile
+++ b/package/libs/libbpf/Makefile
@@ -8,11 +8,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libbpf
-PKG_VERSION:=1.4.6
+PKG_VERSION:=1.5.0
 PKG_RELEASE:=1
 
 PKG_SOURCE_URL:=https://github.com/libbpf/libbpf
-PKG_MIRROR_HASH:=0d0d70750c8e45baba19f8cc065771e5d842a90f3ad1637003cae6887dabf11e
+PKG_MIRROR_HASH:=7699fcfa89bf0f6e756c4555fbd3fdb8cbcfcc770e5944aebdd0e9244031f022
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_VERSION:=v$(PKG_VERSION)
 PKG_ABI_VERSION:=$(firstword $(subst .,$(space),$(PKG_VERSION)))
diff --git a/package/libs/libiconv-full/Makefile b/package/libs/libiconv-full/Makefile
index 0c793973a05f8a..8837942585903f 100644
--- a/package/libs/libiconv-full/Makefile
+++ b/package/libs/libiconv-full/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libiconv-full
 PKG_VERSION:=1.17
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=libiconv-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=@GNU/libiconv
diff --git a/package/libs/libiconv-full/patches/001-Fix-a-clang-warning-a-function-declaration-without-a.patch b/package/libs/libiconv-full/patches/001-Fix-a-clang-warning-a-function-declaration-without-a.patch
new file mode 100644
index 00000000000000..86cd2bc973c5c0
--- /dev/null
+++ b/package/libs/libiconv-full/patches/001-Fix-a-clang-warning-a-function-declaration-without-a.patch
@@ -0,0 +1,33 @@
+From e46dee2f581c1167137bcd045e114e96a9f00483 Mon Sep 17 00:00:00 2001
+From: Bruno Haible <bruno@clisp.org>
+Date: Sun, 29 Jan 2023 20:07:21 +0100
+Subject: [PATCH] Fix a clang warning "a function declaration without a
+ prototype...".
+
+* lib/loop_wchar.h (mbrtowc): Don't declare. Drop portability to BeOS.
+---
+ lib/loop_wchar.h | 3 +--
+ 1 file changed, 1 insertions(+), 2 deletions(-)
+
+diff --git a/lib/loop_wchar.h b/lib/loop_wchar.h
+index b3edc2925c60..9eb508e81a4f 100644
+--- a/lib/loop_wchar.h
++++ b/lib/loop_wchar.h
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (C) 2000-2002, 2005-2006, 2008-2009, 2011 Free Software Foundation, Inc.
++ * Copyright (C) 2000-2002, 2005-2006, 2008-2009, 2011, 2023 Free Software Foundation, Inc.
+  * This file is part of the GNU LIBICONV Library.
+  *
+  * The GNU LIBICONV Library is free software; you can redistribute it
+@@ -36,7 +36,6 @@
+ # include <wchar.h>
+ # define BUF_SIZE 64  /* assume MB_LEN_MAX <= 64 */
+   /* Some systems, like BeOS, have multibyte encodings but lack mbstate_t.  */
+-  extern size_t mbrtowc ();
+ # ifdef mbstate_t
+ #  define mbrtowc(pwc, s, n, ps) (mbrtowc)(pwc, s, n, 0)
+ #  define mbsinit(ps) 1
+-- 
+2.49.0
+
diff --git a/package/libs/libnftnl/Makefile b/package/libs/libnftnl/Makefile
index b512d4d58fe616..f06b223993c2be 100644
--- a/package/libs/libnftnl/Makefile
+++ b/package/libs/libnftnl/Makefile
@@ -9,12 +9,12 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libnftnl
 PKG_CPE_ID:=cpe:/a:netfilter:libnftnl
-PKG_VERSION:=1.2.6
+PKG_VERSION:=1.2.8
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://netfilter.org/projects/$(PKG_NAME)/files
-PKG_HASH:=ceeaea2cd92147da19f13a35a7f1a4bc2767ff897e838e4b479cf54b59c777f4
+PKG_HASH:=37fea5d6b5c9b08de7920d298de3cdc942e7ae64b1a3e8b880b2d390ae67ad95
 
 PKG_MAINTAINER:=Steven Barth <steven@midlink.org>
 PKG_LICENSE:=GPL-2.0-or-later
diff --git a/package/libs/libnl-tiny/Makefile b/package/libs/libnl-tiny/Makefile
index c211288f8eb150..d08100169361fc 100644
--- a/package/libs/libnl-tiny/Makefile
+++ b/package/libs/libnl-tiny/Makefile
@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/libnl-tiny.git
-PKG_SOURCE_DATE:=2023-12-05
-PKG_SOURCE_VERSION:=965c4bf49658342ced0bd6e7cb069571b4a1ddff
-PKG_MIRROR_HASH:=4b56499e71f5f10b123e1c7ee13dbfcd970de560bff8d16ab39dc25c9ff743cb
+PKG_SOURCE_DATE:=2025-03-19
+PKG_SOURCE_VERSION:=c0df580adbd4d555ecc1962dbe88e91d75b67a4e
+PKG_MIRROR_HASH:=1064a27824d99a93cbf8dbc808caf2cb277f1825b378ec6076d2ecfb8866a81f
 CMAKE_INSTALL:=1
 
 PKG_LICENSE:=LGPL-2.1
diff --git a/package/libs/libpcap/Makefile b/package/libs/libpcap/Makefile
index 09aab0981ccfc3..052358b1f5c08f 100644
--- a/package/libs/libpcap/Makefile
+++ b/package/libs/libpcap/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libpcap
 PKG_VERSION:=1.10.5
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://www.tcpdump.org/release/
@@ -22,7 +22,11 @@ PKG_CPE_ID:=cpe:/a:tcpdump:libpcap
 
 PKG_ASLR_PIE_REGULAR:=1
 
-PKG_CONFIG_DEPENDS := CONFIG_PACKAGE_rpcapd
+PKG_CONFIG_DEPENDS := \
+	CONFIG_PACKAGE_rpcapd \
+	CONFIG_PCAP_HAS_USB \
+	CONFIG_PCAP_HAS_BT \
+	CONFIG_PCAP_HAS_NETFILTER
 
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk
diff --git a/package/libs/libpcap/patches/001-Add-support-for-Realtek-Ethertype-DSA-data.patch b/package/libs/libpcap/patches/001-Add-support-for-Realtek-Ethertype-DSA-data.patch
new file mode 100644
index 00000000000000..5ec0e22afacd4c
--- /dev/null
+++ b/package/libs/libpcap/patches/001-Add-support-for-Realtek-Ethertype-DSA-data.patch
@@ -0,0 +1,28 @@
+From fcb2cbc3a306afcf7785a60a74dbea431e609d76 Mon Sep 17 00:00:00 2001
+From: Luiz Angelo Daros de Luca <luizluca@gmail.com>
+Date: Thu, 6 Jan 2022 15:51:54 -0300
+Subject: [PATCH 1/2] Add support for Realtek (Ethertype) DSA data
+
+Realtek switchtag rtl4a (4 bytes long, protocol 0xA) and rtl8_4 (8 bytes
+long, protocol 0x04) are Ethertype DSA tags, inserted in the Ethernet
+header similar to an 802.1Q tag. Both shares the same Ethertype 0x8899
+as other Realtek proprietary protocols.
+
+Realtek switchtag rtl8_4t is identical to rtl8_4 but positioned before
+the CRC, at the end of the Ethernet frame.
+---
+ pcap-linux.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/pcap-linux.c
++++ b/pcap-linux.c
+@@ -5281,6 +5281,9 @@ static struct dsa_proto {
+ 	{ "brcm-prepend", DLT_DSA_TAG_BRCM_PREPEND },
+ 	{ "dsa", DLT_DSA_TAG_DSA },
+ 	{ "edsa", DLT_DSA_TAG_EDSA },
++	{ "rtl4a", DLT_EN10MB },
++	{ "rtl8_4", DLT_EN10MB },
++	{ "rtl8_4t", DLT_EN10MB },
+ };
+ 
+ static int
diff --git a/package/libs/libpcap/patches/002-Linux-handle-other-DSA-tags.patch b/package/libs/libpcap/patches/002-Linux-handle-other-DSA-tags.patch
new file mode 100644
index 00000000000000..dc87d4010d727f
--- /dev/null
+++ b/package/libs/libpcap/patches/002-Linux-handle-other-DSA-tags.patch
@@ -0,0 +1,322 @@
+From 7d298976beff0cce310fb53a430f82b53f43a394 Mon Sep 17 00:00:00 2001
+From: Guy Harris <gharris@sonic.net>
+Date: Fri, 14 Feb 2025 19:12:24 -0800
+Subject: [PATCH 2/2] Linux: handle other DSA tags.
+
+Many of those entries need their own LINKTYPE_/DLT_? values, including
+tcpdump and Wireshark support for same, but at least this lets you see
+raw hex data from a capture.
+
+Fixes #1367.
+
+Supercedes #1451.
+---
+ pcap-linux.c | 284 ++++++++++++++++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 280 insertions(+), 4 deletions(-)
+
+--- a/pcap-linux.c
++++ b/pcap-linux.c
+@@ -5267,23 +5267,299 @@ iface_get_offload(pcap_t *handle _U_)
+ }
+ #endif /* SIOCETHTOOL */
+ 
++/*
++ * As per
++ *
++ *    https://www.kernel.org/doc/html/latest/networking/dsa/dsa.html#switch-tagging-protocols
++ *
++ * Type 1 means that the tag is prepended to the Ethernet packet.
++ * LINKTYPE_ETHERNET/DLT_EN10MB doesn't work, as it would try to
++ * dissect the tag data as the Ethernet header.  These should get
++ * their own LINKTYPE_DLT_ values.
++ *
++ * Type 2 means that the tag is inserted into the Ethernet header
++ * after the source address and before the type/length field.
++ *
++ * Type 3 means that tag is a packet trailer.  LINKTYPE_ETHERNET/DLT_EN10MB
++ * works,  unless the next-layer protocol has no length field of its own,
++ * so that the tag might be treated as part of the payload. These should
++ * get their own LINKTYPE_/DLT_ values.
++ *
++ * If you get an "unsupported DSA tag" error, please add the tag to here,
++ * complete with a full comment indicating whether it's type 1, 2, or 3,
++ * and, for type 2, indicating whether it has an Ethertype and, if so
++ * what that type is, and whether it's registered with the IEEE or is
++ * self-assigned. Also, point to *something* that indicates the format
++ * of the tag.
++ */
+ static struct dsa_proto {
+ 	const char *name;
+ 	bpf_u_int32 linktype;
+ } dsa_protos[] = {
+ 	/*
+-	 * None is special and indicates that the interface does not have
+-	 * any tagging protocol configured, and is therefore a standard
+-	 * Ethernet interface.
++	 * Type 1. See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ar9331.c
++	 */
++	{ "ar9331", DLT_EN10MB },
++
++	/*
++	 * Type 2, without an Ethertype at the beginning,
++	 * assigned a LINKTYPE_/DLT_ value.
+ 	 */
+-	{ "none", DLT_EN10MB },
+ 	{ "brcm", DLT_DSA_TAG_BRCM },
++
++	/*
++	 * Type 2, with Ethertype 0x8874, assigned to Broadcom.
++	 *
++	 * This doies not require a LINKTYPE_/DLT_ value, it
++	 * just requires that Ethertype 0x8874 be dissected
++	 * properly.
++	 */
++	{ "brcm-legacy", DLT_EN10MB },
++
++	/*
++	 * Type 1.
++	 */
+ 	{ "brcm-prepend", DLT_DSA_TAG_BRCM_PREPEND },
++
++	/*
++	 * Type 2, without an Etherype at he beginning,
++	 * assigned a LINKTYPE_/DLT_ value.
++	 */
+ 	{ "dsa", DLT_DSA_TAG_DSA },
++
++	/*
++	 * Type 2, with an Ethertype field, but without
++	 * an assigned Ethertype value that can be relied
++	 * on; assigned a LINKTYPE_/DLT_ value.
++	 */
+ 	{ "edsa", DLT_DSA_TAG_EDSA },
++
++	/*
++	 * Type 1, with different transmit and receive headers,
++	 * so can't really be handled well with the current
++	 * libpcap API and with pcap files.  Use DLT_LINUX_SLL,
++	 * to get the direction?
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_gswip.c
++	 */
++	{ "gswip", DLT_EN10MB },
++
++	/*
++	 * Type 3. See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_hellcreek.c
++	 */
++	{ "hellcreek", DLT_EN10MB },
++
++	/*
++	 * Type 3, with different transmit and receive headers,
++	 * so can't really be handled well with the current
++	 * libpcap API and with pcap files.  Use DLT_LINUX_SLL,
++	 * to get the direction?
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ksz.c#L102
++	 */
++	{ "ksz8795", DLT_EN10MB },
++
++	/*
++	 * Type 3, with different transmit and receive headers,
++	 * so can't really be handled well with the current
++	 * libpcap API and with pcap files.  Use DLT_LINUX_SLL,
++	 * to get the direction?
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ksz.c#L160
++	 */
++	{ "ksz9477", DLT_EN10MB },
++
++	/*
++	 * Type 3, with different transmit and receive headers,
++	 * so can't really be handled well with the current
++	 * libpcap API and with pcap files.  Use DLT_LINUX_SLL,
++	 * to get the direction?
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ksz.c#L341
++	 */
++	{ "ksz9893", DLT_EN10MB },
++
++	/*
++	 * Type 3, with different transmit and receive headers,
++	 * so can't really be handled well with the current
++	 * libpcap API and with pcap files.  Use DLT_LINUX_SLL,
++	 * to get the direction?
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ksz.c#L386
++	 */
++	{ "lan937x", DLT_EN10MB },
++
++	/*
++	 * Type 2, with Ethertype 0x8100; the VID can be interpreted
++	 * as per
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_lan9303.c#L24
++	 *
++	 * so giving its own LINKTYPE_/DLT_ value would allow a
++	 * dissector to do so.
++	 */
++	{ "lan9303", DLT_EN10MB },
++
++	/*
++	 * Type 2, without an Etherype at he beginning,
++	 * should be assigned a LINKTYPE_/DLT_ value.
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_mtk.c#L15
++	 */
++	{ "mtk", DLT_EN10MB },
++
++	/*
++	 * None is special and indicates that the interface does not have
++	 * any tagging protocol configured, and is therefore a standard
++	 * Ethernet interface.
++	 */
++	{ "none", DLT_EN10MB },
++
++	/*
++	 * Type 1.
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ocelot.c
++	 */
++	{ "ocelot", DLT_EN10MB },
++
++	/*
++	 * Type 1.
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_ocelot.c
++	 */
++	{ "seville", DLT_EN10MB },
++
++	/*
++	 * Type 2, with Ethertype 0x8100; the VID can be interpreted
++	 * as per
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_8021q.c#L15
++	 *
++	 * so giving its own LINKTYPE_/DLT_ value would allow a
++	 * dissector to do so.
++	 */
++	{ "ocelot-8021q", DLT_EN10MB },
++
++	/*
++	 * Type 2, without an Etherype at he beginning,
++	 * should be assigned a LINKTYPE_/DLT_ value.
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_qca.c
++	 */
++	{ "qca", DLT_EN10MB },
++
++	/*
++	 * Type 2, with Ethertype 0x8899, assigned to Realtek;
++	 * they use it for several on-the-Ethernet protocols
++	 * as well, but there are fields that allow the two
++	 * tag formats, and all the protocols in question,
++	 * to be distinguiished from one another.
++	 *
++	 * This doies not require a LINKTYPE_/DLT_ value, it
++	 * just requires that Ethertype 0x8899 be dissected
++	 * properly.
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_rtl4_a.c
++	 *
++	 *    http://realtek.info/pdf/rtl8306sd%28m%29_datasheet_1.1.pdf
++	 *
++	 * and various pages in tcpdump's print-realtek.c and Wireshark's
++	 * epan/dissectors/packet-realtek.c for the other protocols.
++	 */
+ 	{ "rtl4a", DLT_EN10MB },
++
++	/*
++	 * Type 2, with Ethertype 0x8899, assigned to Realtek;
++	 * see above.
++	 */
+ 	{ "rtl8_4", DLT_EN10MB },
++
++	/*
++	 * Type 3, with the same tag format as rtl8_4.
++	 */
+ 	{ "rtl8_4t", DLT_EN10MB },
++
++	/*
++	 * Type 2, with Ethertype 0xe001; that's probably
++	 * self-assigned, so this really should ahve its
++	 * own LINKTYPE_/DLT_ value.
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_rzn1_a5psw.c
++	 */
++	{ "a5psw", DLT_EN10MB },
++
++	/*
++	 * Type 2, with Ethertype 0x8100 or the self-assigned
++	 * 0xdadb, so this really should ahve its own
++	 * LINKTYPE_/DLT_ value; that would also allow the
++	 * VID of the tag to be dissected as per
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_8021q.c#L15
++	 */
++	{ "sja1105", DLT_EN10MB },
++
++	/*
++	 * Type "none of the above", with both a header and trailer,
++	 * with different transmit and receive tags.  Has
++	 * Ethertype 0xdadc, which is probably self-assigned.
++	 * This should really have its own LINKTYPE_/DLT_ value.
++	 */
++	{ "sja1110", DLT_EN10MB },
++
++	/*
++	 * Type 3, as the name suggests.
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_trailer.c
++	 */
++	{ "trailer", DLT_EN10MB },
++
++	/*
++	 * Type 2, with Ethertype 0x8100; the VID can be interpreted
++	 * as per
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_8021q.c#L15
++	 *
++	 * so giving its own LINKTYPE_/DLT_ value would allow a
++	 * dissector to do so.
++	 */
++	{ "vsc73xx-8021q", DLT_EN10MB },
++
++	/*
++	 * Type 3.
++	 *
++	 * See
++	 *
++	 *    https://elixir.bootlin.com/linux/v6.13.2/source/net/dsa/tag_xrs700x.c
++	 */
++	{ "xrs700x", DLT_EN10MB },
+ };
+ 
+ static int
diff --git a/package/libs/libubox/Makefile b/package/libs/libubox/Makefile
index 22abfd4372e38b..48ec2e05bb2900 100644
--- a/package/libs/libubox/Makefile
+++ b/package/libs/libubox/Makefile
@@ -5,10 +5,11 @@ PKG_RELEASE=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/libubox.git
-PKG_MIRROR_HASH:=a4f671d10840fd8487394335636051a6df5edf6d8854af4fcb834a590efb240a
-PKG_SOURCE_DATE:=2024-03-29
-PKG_SOURCE_VERSION:=eb9bcb64185ac155c02cc1a604692c4b00368324
-PKG_ABI_VERSION:=$(call abi_version_str,$(PKG_SOURCE_DATE))
+PKG_MIRROR_HASH:=51b48648a3a64eed74bcb1ab352aaad6ef7679a574df4445d2914b990aba5bbf
+PKG_SOURCE_DATE:=2025-07-23
+PKG_SOURCE_DATE_ABI:=2024-03-29
+PKG_SOURCE_VERSION:=49056d178f42da98048a5d4c23f83a6f6bc6dd80
+PKG_ABI_VERSION:=$(call abi_version_str,$(PKG_SOURCE_DATE_ABI))
 CMAKE_INSTALL:=1
 
 PKG_LICENSE:=ISC
diff --git a/package/libs/libxml2/Makefile b/package/libs/libxml2/Makefile
index c2a804b98f365e..c9ad81c128eaf4 100644
--- a/package/libs/libxml2/Makefile
+++ b/package/libs/libxml2/Makefile
@@ -1,12 +1,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=libxml2
-PKG_VERSION:=2.13.4
+PKG_VERSION:=2.14.5
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@GNOME/libxml2/$(basename $(PKG_VERSION))
-PKG_HASH:=65d042e1c8010243e617efb02afda20b85c2160acdbfbcb5b26b80cec6515650
+PKG_HASH:=03d006f3537616833c16c53addcdc32a0eb20e55443cba4038307e3fa7d8d44b
 
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=COPYING
@@ -24,6 +24,7 @@ define Package/libxml2
   TITLE:=Gnome XML library
   URL:=http://xmlsoft.org/
   DEPENDS:=+libpthread +zlib $(ICONV_DEPENDS)
+  ABI_VERSION:=16
 endef
 
 define Package/libxml2/description
@@ -61,7 +62,7 @@ endef
 CMAKE_HOST_OPTIONS += \
 	-DBUILD_SHARED_LIBS=OFF \
 	-DLIBXML2_WITH_C14N=ON \
-	-DLIBXML2_WITH_CATALOG=OFF \
+	-DLIBXML2_WITH_CATALOG=ON \
 	-DLIBXML2_WITH_DEBUG=ON \
 	-DLIBXML2_WITH_FTP=OFF \
 	-DLIBXML2_WITH_HTML=ON \
@@ -99,7 +100,7 @@ CMAKE_HOST_OPTIONS += \
 CMAKE_OPTIONS += \
 	-DBUILD_SHARED_LIBS=ON \
 	-DLIBXML2_WITH_C14N=ON \
-	-DLIBXML2_WITH_CATALOG=OFF \
+	-DLIBXML2_WITH_CATALOG=ON \
 	-DLIBXML2_WITH_DEBUG=ON \
 	-DLIBXML2_WITH_FTP=OFF \
 	-DLIBXML2_WITH_HTML=ON \
@@ -160,9 +161,6 @@ define Build/InstallDev
 
 	$(INSTALL_DIR) $(1)/usr/lib/pkgconfig
 	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/lib/pkgconfig/libxml-2.0.pc $(1)/usr/lib/pkgconfig/
-
-	$(INSTALL_DIR) $(2)/share/aclocal/
-	$(INSTALL_DATA) $(PKG_INSTALL_DIR)/usr/share/aclocal/* $(2)/share/aclocal
 endef
 
 define Host/Install
@@ -190,9 +188,6 @@ define Package/libxml2-dev/install
 	$(INSTALL_DIR) $(1)/usr/lib/{cmake,pkgconfig}
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/{cmake,pkgconfig} $(1)/usr/lib/
 	$(SED) "s,$(STAGING_DIR),,g" $(1)/usr/lib/pkgconfig/*.pc
-
-	$(INSTALL_DIR) $(1)/usr/share/aclocal
-	$(CP) $(PKG_INSTALL_DIR)/usr/share/aclocal/* $(1)/usr/share/aclocal
 endef
 
 define Package/libxml2-utils/install
diff --git a/package/libs/mbedtls/Config.in b/package/libs/mbedtls/Config.in
index 51f8bcbbdd36a0..2009d5db96f3c8 100644
--- a/package/libs/mbedtls/Config.in
+++ b/package/libs/mbedtls/Config.in
@@ -8,6 +8,10 @@ config MBEDTLS_AES_C
 	bool "MBEDTLS_AES_C"
 	default y
 
+config MBEDTLS_ARIA_C
+	bool "MBEDTLS_ARIA_C"
+	default n
+
 config MBEDTLS_CAMELLIA_C
 	bool "MBEDTLS_CAMELLIA_C"
 	default n
@@ -80,6 +84,10 @@ config MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED
 	bool "MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED"
 	default n
 
+config MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
+	bool "MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED"
+	default n
+
 comment "Curves - unselect old or less-used curves to reduce binary size"
 
 config MBEDTLS_ECP_DP_SECP192R1_ENABLED
diff --git a/package/libs/mbedtls/Makefile b/package/libs/mbedtls/Makefile
index 2efdf86cd207f9..d6dc0f7805aa46 100644
--- a/package/libs/mbedtls/Makefile
+++ b/package/libs/mbedtls/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mbedtls
-PKG_VERSION:=3.6.2
+PKG_VERSION:=3.6.4
 PKG_RELEASE:=1
 PKG_BUILD_FLAGS:=no-mips16 gc-sections no-lto
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL=https://github.com/Mbed-TLS/$(PKG_NAME)/releases/download/$(PKG_NAME)-$(PKG_VERSION)
-PKG_HASH:=8b54fb9bcf4d5a7078028e0520acddefb7900b3e66fec7f7175bb5b7d85ccdca
+PKG_HASH:=ec35b18a6c593cf98c3e30db8b98ff93e8940a8c4e690e66b41dfc011d678110
 
 PKG_LICENSE:=GPL-2.0-or-later
 PKG_LICENSE_FILES:=LICENSE
@@ -37,6 +37,7 @@ MBEDTLS_BUILD_OPTS_CURVES= \
 
 MBEDTLS_BUILD_OPTS_CIPHERS= \
   CONFIG_MBEDTLS_AES_C \
+  CONFIG_MBEDTLS_ARIA_C \
   CONFIG_MBEDTLS_CAMELLIA_C \
   CONFIG_MBEDTLS_CCM_C \
   CONFIG_MBEDTLS_CMAC_C \
@@ -52,6 +53,7 @@ MBEDTLS_BUILD_OPTS_CIPHERS= \
   CONFIG_MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED \
   CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED \
   CONFIG_MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED \
+  CONFIG_MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED \
   CONFIG_MBEDTLS_NIST_KW_C \
   CONFIG_MBEDTLS_RIPEMD160_C \
   CONFIG_MBEDTLS_RSA_NO_CRT \
diff --git a/package/libs/mbedtls/patches/101-remove-test.patch b/package/libs/mbedtls/patches/101-remove-test.patch
index 5ac5e7c1e85a11..e584a8036c7069 100644
--- a/package/libs/mbedtls/patches/101-remove-test.patch
+++ b/package/libs/mbedtls/patches/101-remove-test.patch
@@ -1,6 +1,7 @@
 --- a/programs/CMakeLists.txt
 +++ b/programs/CMakeLists.txt
-@@ -1,13 +1,9 @@
+@@ -3,14 +3,10 @@ add_custom_target(${programs_target})
+ 
  add_subdirectory(aes)
  add_subdirectory(cipher)
 -if (NOT WIN32)
diff --git a/package/libs/openssl/Makefile b/package/libs/openssl/Makefile
index 959424ce12c540..25a71fa7a438c0 100644
--- a/package/libs/openssl/Makefile
+++ b/package/libs/openssl/Makefile
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=openssl
-PKG_VERSION:=3.0.15
+PKG_VERSION:=3.0.17
 PKG_RELEASE:=1
 PKG_BUILD_FLAGS:=no-mips16 gc-sections no-lto
 
@@ -21,7 +21,7 @@ PKG_SOURCE_URL:= \
 	https://www.openssl.org/source/old/$(PKG_BASE)/ \
 	https://github.com/openssl/openssl/releases/download/$(PKG_NAME)-$(PKG_VERSION)/
 
-PKG_HASH:=23c666d0edf20f14249b3d8f0368acaee9ab585b09e1de82107c66e1f3ec9533
+PKG_HASH:=dfdd77e4ea1b57ff3a6dbde6b0bdc3f31db5ac99e7fdd4eaf9e1fbb6ec2db8ce
 
 PKG_LICENSE:=Apache-2.0
 PKG_LICENSE_FILES:=LICENSE
diff --git a/package/libs/openssl/patches/100-Configure-afalg-support.patch b/package/libs/openssl/patches/100-Configure-afalg-support.patch
index e9cd7bf9c1afa6..7ce5cd43835e87 100644
--- a/package/libs/openssl/patches/100-Configure-afalg-support.patch
+++ b/package/libs/openssl/patches/100-Configure-afalg-support.patch
@@ -10,7 +10,7 @@ Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
 
 --- a/Configure
 +++ b/Configure
-@@ -1677,7 +1677,9 @@ $config{CFLAGS} = [ map { $_ eq '--ossl-
+@@ -1678,7 +1678,9 @@ $config{CFLAGS} = [ map { $_ eq '--ossl-
  
  unless ($disabled{afalgeng}) {
      $config{afalgeng}="";
diff --git a/package/libs/readline/Makefile b/package/libs/readline/Makefile
index 11b9e0172f844a..03e56f36ed4d15 100644
--- a/package/libs/readline/Makefile
+++ b/package/libs/readline/Makefile
@@ -69,7 +69,7 @@ endef
 
 define Package/libreadline/install
 	$(INSTALL_DIR) $(1)/usr/lib
-	$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib{history,readline}.so.* $(1)/usr/lib/
+	$(CP) $(PKG_INSTALL_DIR)/usr/lib/lib{history,readline}.so* $(1)/usr/lib/
 endef
 
 $(eval $(call HostBuild))
diff --git a/package/libs/udebug/Makefile b/package/libs/udebug/Makefile
index bfb13cf788428b..fe9ac872194ae2 100644
--- a/package/libs/udebug/Makefile
+++ b/package/libs/udebug/Makefile
@@ -11,9 +11,9 @@ PKG_NAME:=udebug
 CMAKE_INSTALL:=1
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/udebug.git
-PKG_MIRROR_HASH:=4dfe98b5d5813066dccd46d112502565b6961a4a7382083c529dfb423a626c2b
-PKG_SOURCE_DATE:=2023-12-06
-PKG_SOURCE_VERSION:=6d3f51f9fda706f0cf4732c762e4dbe8c21e12cf
+PKG_MIRROR_HASH:=5e7b713aa1bff3b6480d4bd94d607b9cafed787b3d1cb27513883c83e56b0273
+PKG_SOURCE_DATE:=2025-08-24
+PKG_SOURCE_VERSION:=edeb4d6dc690acb476a47e6b11633b5632b08437
 PKG_ABI_VERSION:=$(call abi_version_str,$(PKG_SOURCE_DATE))
 
 PKG_LICENSE:=GPL-2.0
@@ -51,7 +51,7 @@ define Package/udebug-cli
   SECTION:=utils
   CATEGORY:=Utilities
   TITLE:=OpenWrt debug service CLI
-  DEPENDS:=+udebugd +ucode-mod-udebug
+  DEPENDS:=+udebugd +ucode-mod-udebug +ucode-mod-uloop +ucode-mod-ubus
 endef
 
 define Package/libudebug/install
diff --git a/package/libs/wolfssl/Makefile b/package/libs/wolfssl/Makefile
index bac4a8ef52bc83..ee6baefddcd462 100644
--- a/package/libs/wolfssl/Makefile
+++ b/package/libs/wolfssl/Makefile
@@ -8,12 +8,15 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wolfssl
-PKG_VERSION:=5.7.2-stable
+PKG_VERSION:=5.7.6
+PKG_REAL_VERSION:=$(PKG_VERSION)-stable
 PKG_RELEASE:=1
 
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_SOURCE_URL:=https://github.com/wolfSSL/wolfssl/archive/v$(PKG_VERSION)
-PKG_HASH:=0f2ed82e345b833242705bbc4b08a2a2037a33f7bf9c610efae6464f6b10e305
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_REAL_VERSION).tar.gz
+PKG_SOURCE_URL:=https://github.com/wolfSSL/wolfssl/archive/v$(PKG_REAL_VERSION)
+PKG_HASH:=52b1e439e30d1ed8162a16308a8525a862183b67aa30373b11166ecbab000d63
+
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_NAME)-$(BUILD_VARIANT)/$(PKG_NAME)-$(PKG_REAL_VERSION)
 
 PKG_FIXUP:=libtool libtool-abiver
 PKG_INSTALL:=1
@@ -40,7 +43,7 @@ PKG_CONFIG_DEPENDS:=\
 	CONFIG_WOLFSSL_HAS_TLSV13 \
 	CONFIG_WOLFSSL_HAS_WPAS
 
-PKG_ABI_VERSION:=$(patsubst %-stable,%,$(PKG_VERSION)).$(call version_abbrev,$(call confvar,$(PKG_CONFIG_DEPENDS)))
+PKG_ABI_VERSION:=$(PKG_VERSION).$(call version_abbrev,$(call confvar,$(PKG_CONFIG_DEPENDS)))
 
 PKG_CONFIG_DEPENDS+=\
 	CONFIG_PACKAGE_libwolfssl-benchmark \
diff --git a/package/libs/wolfssl/patches/100-disable-hardening-check.patch b/package/libs/wolfssl/patches/100-disable-hardening-check.patch
index 174e657982b3fe..ab695d391d83c9 100644
--- a/package/libs/wolfssl/patches/100-disable-hardening-check.patch
+++ b/package/libs/wolfssl/patches/100-disable-hardening-check.patch
@@ -1,6 +1,6 @@
 --- a/wolfssl/wolfcrypt/settings.h
 +++ b/wolfssl/wolfcrypt/settings.h
-@@ -3046,7 +3046,7 @@ extern void uITRON4_free(void *p) ;
+@@ -3722,7 +3722,7 @@ extern void uITRON4_free(void *p) ;
  
  /* warning for not using harden build options (default with ./configure) */
  /* do not warn if big integer support is disabled */
diff --git a/package/network/config/firewall4/Makefile b/package/network/config/firewall4/Makefile
index 6aacc05e365b45..9b53349275bf2c 100644
--- a/package/network/config/firewall4/Makefile
+++ b/package/network/config/firewall4/Makefile
@@ -9,9 +9,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/firewall4.git
-PKG_SOURCE_DATE:=2024-05-21
-PKG_SOURCE_VERSION:=4c01d1ebf99e8ecfa69758a9b4f450ecef7b93cd
-PKG_MIRROR_HASH:=bbc5622bc03e3b43116fcc86e3fa2d2372bfc07b3a00d2b3a6efac4f7454a403
+PKG_SOURCE_DATE:=2024-12-18
+PKG_SOURCE_VERSION:=18fc0ead19faf06b8ce7ec5be84957278e942dfa
+PKG_MIRROR_HASH:=123d1b5d00cdbbfa77813b3eb694d00949171037a0fa26e6d36a75a37066ba48
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 PKG_LICENSE:=ISC
 
diff --git a/package/network/config/ltq-adsl-app/Makefile b/package/network/config/ltq-adsl-app/Makefile
index b96a3f71e5bd1c..3da37f884d9ba6 100644
--- a/package/network/config/ltq-adsl-app/Makefile
+++ b/package/network/config/ltq-adsl-app/Makefile
@@ -10,7 +10,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=dsl_cpe_control_danube
 PKG_VERSION:=3.24.4.4
-PKG_RELEASE:=13
+PKG_RELEASE:=14
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_BUILD_DIR:=$(BUILD_DIR)/dsl_cpe_control-$(PKG_VERSION)
 PKG_SOURCE_URL:=@OPENWRT
diff --git a/package/network/config/ltq-vdsl-vr11-app/Makefile b/package/network/config/ltq-vdsl-vr11-app/Makefile
index f1782db285c064..2aacbbd785103c 100644
--- a/package/network/config/ltq-vdsl-vr11-app/Makefile
+++ b/package/network/config/ltq-vdsl-vr11-app/Makefile
@@ -9,7 +9,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=ltq-vdsl-vr11-app
 PKG_VERSION:=4.23.1
-PKG_RELEASE:=5
+PKG_RELEASE:=6
 PKG_BASE_NAME:=dsl_cpe_control
 
 UGW_VERSION=8.5.2.10
diff --git a/package/network/config/ltq-vdsl-vr9-app/Makefile b/package/network/config/ltq-vdsl-vr9-app/Makefile
index 51b88231f7e4b8..c1b3b12e1cddb6 100644
--- a/package/network/config/ltq-vdsl-vr9-app/Makefile
+++ b/package/network/config/ltq-vdsl-vr9-app/Makefile
@@ -9,7 +9,7 @@ include $(INCLUDE_DIR)/kernel.mk
 
 PKG_NAME:=ltq-vdsl-vr9-app
 PKG_VERSION:=4.17.18.6
-PKG_RELEASE:=7
+PKG_RELEASE:=8
 PKG_BASE_NAME:=dsl_cpe_control
 PKG_SOURCE:=$(PKG_BASE_NAME)_vrx-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=@OPENWRT
@@ -29,7 +29,7 @@ define Package/ltq-vdsl-vr9-app
   CATEGORY:=Network
   TITLE:=Lantiq VDSL userland tool
   URL:=http://www.lantiq.com/
-  DEPENDS:=@TARGET_lantiq_xrx200 +libpthread +librt +ltq-dsl-base +libubox +libubus
+  DEPENDS:=@(TARGET_lantiq_xrx200||TARGET_lantiq_xrx200_legacy) +libpthread +librt +ltq-dsl-base +libubox +libubus
   PROVIDES:=ltq-dsl-app
 endef
 
diff --git a/package/network/config/ltq-vdsl-vr9-app/src/src/dsl_cpe_ubus.c b/package/network/config/ltq-vdsl-vr9-app/src/src/dsl_cpe_ubus.c
index 77a1c67b6aebc2..0636fbc8cae7df 100644
--- a/package/network/config/ltq-vdsl-vr9-app/src/src/dsl_cpe_ubus.c
+++ b/package/network/config/ltq-vdsl-vr9-app/src/src/dsl_cpe_ubus.c
@@ -447,7 +447,7 @@ static void pilot_tones_status(int fd) {
 }
 
 static void band_border_status(int fd, DSL_AccessDir_t direction) {
-	IOCTL(DSL_BandBorderStatus_t, DSL_FIO_BAND_BORDER_STATUS_GET);
+	IOCTL_DIR(DSL_BandBorderStatus_t, DSL_FIO_BAND_BORDER_STATUS_GET, direction);
 
 	void *c, *c2;
 
diff --git a/package/network/config/netifd/Makefile b/package/network/config/netifd/Makefile
index 771d7dadafd119..86a2713e81395b 100644
--- a/package/network/config/netifd/Makefile
+++ b/package/network/config/netifd/Makefile
@@ -5,9 +5,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/netifd.git
-PKG_SOURCE_DATE:=2024-10-06
-PKG_SOURCE_VERSION:=3c6265fdbd02ebd35fa3e7a58d6dfeed081a09d7
-PKG_MIRROR_HASH:=00b01243b99995dc52a047e5663cf5c7732f8defd6b726f73ac15e142b02b4fa
+PKG_SOURCE_DATE:=2025-05-23
+PKG_SOURCE_VERSION:=7901e66c5f273bceee8981bc8a0c8b0e60945f60
+PKG_MIRROR_HASH:=8b85ec64e446ae065b1466c520b2d3aae329b6167221e425af903777278f557e
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 
 PKG_LICENSE:=GPL-2.0
diff --git a/package/network/config/netifd/files/etc/init.d/network b/package/network/config/netifd/files/etc/init.d/network
index dc208c4ce0a1f5..b8b2a219b18482 100755
--- a/package/network/config/netifd/files/etc/init.d/network
+++ b/package/network/config/netifd/files/etc/init.d/network
@@ -30,12 +30,11 @@ reload_service() {
 
 	init_switch
 	ubus call network reload || rv=1
-	/sbin/wifi reload_legacy
 	return $rv
 }
 
 stop_service() {
-	/sbin/wifi down
+	[ -x /sbin/wifi ] && /sbin/wifi down
 	ifdown -a
 	sleep 1
 }
diff --git a/package/network/config/netifd/files/usr/libexec/network/packet-steering.uc b/package/network/config/netifd/files/usr/libexec/network/packet-steering.uc
index a578e288791d7d..34df46d18ef5d8 100755
--- a/package/network/config/netifd/files/usr/libexec/network/packet-steering.uc
+++ b/package/network/config/netifd/files/usr/libexec/network/packet-steering.uc
@@ -65,8 +65,9 @@ function cpu_mask(cpu)
 	return sprintf("%x", mask);
 }
 
-function set_netdev_cpu(dev, cpu) {
-	let queues = glob(`/sys/class/net/${dev}/queues/rx-*/rps_cpus`);
+function set_netdev_cpu(dev, cpu, rx_queue) {
+	rx_queue ??= "rx-*";
+	let queues = glob(`/sys/class/net/${dev}/queues/${rx_queue}/rps_cpus`);
 	let val = cpu_mask(cpu);
 	if (disable)
 		val = 0;
@@ -76,7 +77,7 @@ function set_netdev_cpu(dev, cpu) {
 		if (!do_nothing)
 			writefile(queue, `${val}`);
 	}
-	queues = glob(`/sys/class/net/${dev}/queues/rx-*/rps_flow_cnt`);
+	queues = glob(`/sys/class/net/${dev}/queues/${rx_queue}/rps_flow_cnt`);
 	for (let queue in queues) {
 		if (debug || do_nothing)
 			warn(`echo ${local_flows} > ${queue}\n`);
@@ -87,7 +88,7 @@ function set_netdev_cpu(dev, cpu) {
 
 function task_device_match(name, device)
 {
-	let napi_match = match(name, /napi\/([^-+])-\d+/);
+	let napi_match = match(name, /napi\/([^-]*)-\d+/);
 	if (!napi_match)
 		napi_match = match(name, /mt76-tx (phy\d+)/);
 	if (napi_match &&
@@ -160,6 +161,9 @@ for (let dev in netdevs) {
 			netdev: [],
 			phy: [],
 			tasks: [],
+			rx_tasks: [],
+			rx_queues: map(glob(`/sys/class/net/${dev}/queues/rx-*/rps_cpus`),
+			               (v) => basename(dirname(v))),
 		};
 	}
 
@@ -187,11 +191,51 @@ for (let path in glob("/proc/*/exe")) {
 			continue;
 
 		push(dev.tasks, pid);
+
+		let napi_match = match(name, /napi\/([^-]*)-(\d+)/);
+		if (napi_match && napi_match[2] > 0)
+			push(dev.rx_tasks, pid);
 		break;
 	}
 }
 
+function assign_dev_queues_cpu(dev) {
+	let num = length(dev.rx_queues);
+	if (num < length(dev.rx_tasks))
+		num = length(dev.rx_tasks);
+
+	for (let i = 0; i < num; i++) {
+		let cpu;
+
+		let task = dev.rx_tasks[i];
+		if (num >= length(cpus))
+			cpu = i % length(cpus);
+		else if (task)
+			cpu = get_next_cpu(napi_weight);
+		else
+			cpu = -1;
+		set_task_cpu(task, cpu);
+
+		let rxq = dev.rx_queues[i];
+		if (!rxq)
+			continue;
+
+		if (num >= length(cpus))
+			cpu = (i + 1) % length(cpus);
+		else if (all_cpus)
+			cpu = -1;
+		else
+			cpu = get_next_cpu(napi_weight, cpu);
+		for (let netdev in dev.netdev)
+			set_netdev_cpu(netdev, cpu, rxq);
+	}
+}
+
 function assign_dev_cpu(dev) {
+	if (length(dev.rx_queues) > 1 &&
+		length(dev.rx_tasks) > 1)
+		return assign_dev_queues_cpu(dev);
+
 	if (length(dev.tasks) > 0) {
 		let cpu = dev.napi_cpu = get_next_cpu(napi_weight);
 		for (let task in dev.tasks)
@@ -204,7 +248,6 @@ function assign_dev_cpu(dev) {
 			cpu = -1;
 		else
 			cpu = get_next_cpu(rx_weight, dev.napi_cpu);
-		dev.rx_cpu = cpu;
 		for (let netdev in dev.netdev)
 			set_netdev_cpu(netdev, cpu);
 	}
diff --git a/package/network/config/wifi-scripts/files/lib/netifd/hostapd.sh b/package/network/config/wifi-scripts/files/lib/netifd/hostapd.sh
index 817ead71afd063..6bdd0236cf994e 100644
--- a/package/network/config/wifi-scripts/files/lib/netifd/hostapd.sh
+++ b/package/network/config/wifi-scripts/files/lib/netifd/hostapd.sh
@@ -428,9 +428,36 @@ hostapd_set_psk() {
 	local ifname="$1"
 
 	rm -f /var/run/hostapd-${ifname}.psk
+	case "$auth_type" in
+		psk|psk-sae) ;;
+		*) return ;;
+	esac
 	for_each_station hostapd_set_psk_file ${ifname}
 }
 
+hostapd_set_sae_file() {
+	local ifname="$1"
+	local vlan="$2"
+	local vlan_id=""
+
+	json_get_vars mac vid key
+	set_default mac "ff:ff:ff:ff:ff:ff"
+	[ -n "$mac" ] && mac="|mac=$mac"
+	[ -n "$vid" ] && vlan_id="|vlanid=$vid"
+	printf '%s%s%s\n' "${key}" "${mac}" "${vlan_id}" >> /var/run/hostapd-${ifname}.sae
+}
+
+hostapd_set_sae() {
+	local ifname="$1"
+
+	rm -f /var/run/hostapd-${ifname}.sae
+	case "$auth_type" in
+		sae|psk-sae) ;;
+		*) return ;;
+	esac
+	for_each_station hostapd_set_sae_file ${ifname}
+}
+
 append_iw_roaming_consortium() {
 	[ -n "$1" ] && append bss_conf "roaming_consortium=$1" "$N"
 }
@@ -686,7 +713,7 @@ hostapd_set_bss_options() {
 			wps_not_configured=1
 		;;
 		psk|sae|psk-sae)
-			json_get_vars key wpa_psk_file
+			json_get_vars key wpa_psk_file sae_password_file
 			if [ "$ppsk" -ne 0 ]; then
 				json_get_vars auth_secret auth_port
 				set_default auth_port 1812
@@ -697,15 +724,20 @@ hostapd_set_bss_options() {
 				append bss_conf "wpa_psk=$key" "$N"
 			elif [ ${#key} -ge 8 ] && [ ${#key} -le 63 ]; then
 				append bss_conf "wpa_passphrase=$key" "$N"
-			elif [ -n "$key" ] || [ -z "$wpa_psk_file" ]; then
+			elif [ -n "$key" ]; then
 				wireless_setup_vif_failed INVALID_WPA_PSK
 				return 1
 			fi
 			[ -z "$wpa_psk_file" ] && set_default wpa_psk_file /var/run/hostapd-$ifname.psk
-			[ -n "$wpa_psk_file" ] && {
+			[ -n "$wpa_psk_file" ] && [ "$auth_type" = "psk" -o "$auth_type" = "psk-sae" ] && {
 				[ -e "$wpa_psk_file" ] || touch "$wpa_psk_file"
 				append bss_conf "wpa_psk_file=$wpa_psk_file" "$N"
 			}
+			[ -z "$sae_password_file" ] && set_default sae_password_file /var/run/hostapd-$ifname.sae
+			[ -n "$sae_password_file" ] && [ "$auth_type" = "sae" -o "$auth_type" = "psk-sae" ] && {
+				[ -e "$sae_password_file" ] || touch "$sae_password_file"
+				append bss_conf "sae_password_file=$sae_password_file" "$N"
+			}
 			[ "$eapol_version" -ge "1" -a "$eapol_version" -le "2" ] && append bss_conf "eapol_version=$eapol_version" "$N"
 
 			set_default dynamic_vlan 0
@@ -1329,11 +1361,13 @@ wpa_supplicant_add_network() {
 
 	json_get_vars \
 		ssid bssid key \
-		basic_rate mcast_rate \
+		mcast_rate \
 		ieee80211w ieee80211r fils ocv \
 		multi_ap \
 		default_disabled
 
+	json_get_values basic_rate_list basic_rate
+
 	case "$auth_type" in
 		sae|owe|eap2|eap192)
 			set_default ieee80211w 2
@@ -1594,12 +1628,21 @@ wpa_supplicant_add_network() {
 	[ -n "$bssid_blacklist" ] && append network_data "bssid_blacklist=$bssid_blacklist" "$N$T"
 	[ -n "$bssid_whitelist" ] && append network_data "bssid_whitelist=$bssid_whitelist" "$N$T"
 
-	[ -n "$basic_rate" ] && {
-		local br rate_list=
-		for br in $basic_rate; do
-			wpa_supplicant_add_rate rate_list "$br"
-		done
-		[ -n "$rate_list" ] && append network_data "rates=$rate_list" "$N$T"
+	[ -n "$basic_rate_list" ] && {
+		local br rate rate_list=
+
+		if [ "$mode" = mesh ]; then
+			for br in $basic_rate_list; do
+				rate="$(($br / 100))"
+				append rate_list "$rate" " "
+			done
+			[ -n "$rate_list" ] && append network_data "mesh_basic_rates=$rate_list" "$N$T"
+		else
+			for br in $basic_rate_list; do
+				wpa_supplicant_add_rate rate_list "$br"
+			done
+			[ -n "$rate_list" ] && append network_data "rates=$rate_list" "$N$T"
+		fi
 	}
 
 	[ -n "$mcast_rate" ] && {
diff --git a/package/network/config/wifi-scripts/files/lib/netifd/netifd-wireless.sh b/package/network/config/wifi-scripts/files/lib/netifd/netifd-wireless.sh
index 5b852e0937631a..c3772bb44312d4 100644
--- a/package/network/config/wifi-scripts/files/lib/netifd/netifd-wireless.sh
+++ b/package/network/config/wifi-scripts/files/lib/netifd/netifd-wireless.sh
@@ -379,6 +379,7 @@ _wdev_common_device_config() {
 _wdev_common_iface_config() {
 	config_add_string mode ssid encryption 'key:wpakey'
 	config_add_boolean bridge_isolate
+	config_add_array tags
 }
 
 _wdev_common_vlan_config() {
diff --git a/package/network/config/wifi-scripts/files/lib/netifd/wireless/mac80211.sh b/package/network/config/wifi-scripts/files/lib/netifd/wireless/mac80211.sh
index 9998e26ec13189..eea18e830efc94 100755
--- a/package/network/config/wifi-scripts/files/lib/netifd/wireless/mac80211.sh
+++ b/package/network/config/wifi-scripts/files/lib/netifd/wireless/mac80211.sh
@@ -12,7 +12,7 @@ MP_CONFIG_INT="mesh_retry_timeout mesh_confirm_timeout mesh_holding_timeout mesh
 	       mesh_hwmp_rann_interval mesh_gate_announcements mesh_sync_offset_max_neighor
 	       mesh_rssi_threshold mesh_hwmp_active_path_to_root_timeout mesh_hwmp_root_interval
 	       mesh_hwmp_confirmation_interval mesh_awake_window mesh_plink_timeout"
-MP_CONFIG_BOOL="mesh_auto_open_plinks mesh_fwding"
+MP_CONFIG_BOOL="mesh_auto_open_plinks mesh_fwding mesh_nolearn"
 MP_CONFIG_STRING="mesh_power_mode"
 
 wdev_tool() {
@@ -29,6 +29,8 @@ drv_mac80211_init_device_config() {
 	config_add_string path phy 'macaddr:macaddr'
 	config_add_string tx_burst
 	config_add_string distance
+	config_add_string ifname_prefix
+	config_add_string macaddr_base
 	config_add_int radio beacon_int chanbw frag rts
 	config_add_int rxantenna txantenna txpower min_tx_power
 	config_add_int num_global_macaddr multiple_bssid
@@ -208,7 +210,7 @@ mac80211_hostapd_setup_base() {
 				dsss_cck_40:1
 
 			ht_cap_mask=0
-			for cap in $(iw phy "$phy" info | grep 'Capabilities:' | cut -d: -f2); do
+			for cap in $(iw phy "$phy" info | grep -E '^\s*Capabilities:' | cut -d: -f2); do
 				ht_cap_mask="$(($ht_cap_mask | $cap))"
 			done
 
@@ -529,6 +531,7 @@ ${hostapd_noscan:+noscan=1}
 ${tx_burst:+tx_queue_data2_burst=$tx_burst}
 ${multiple_bssid:+mbssid=$multiple_bssid}
 #num_global_macaddr=$num_global_macaddr
+#macaddr_base=$macaddr_base
 $base_cfg
 
 EOF
@@ -560,6 +563,7 @@ mac80211_hostapd_setup_bss() {
 $hostapd_cfg
 bssid=$macaddr
 ${default_macaddr:+#default_macaddr}
+${random_macaddr:+#random_macaddr}
 ${dtim_period:+dtim_period=$dtim_period}
 ${max_listen_int:+max_listen_interval=$max_listen_int}
 EOF
@@ -576,7 +580,7 @@ mac80211_generate_mac() {
 	local phy="$1"
 	local id="${macidx:-0}"
 
-	wdev_tool "$phy$phy_suffix" get_macaddr id=$id num_global=$num_global_macaddr mbssid=${multiple_bssid:-0}
+	wdev_tool "$phy$phy_suffix" get_macaddr id=$id num_global=$num_global_macaddr mbssid=${multiple_bssid:-0} macaddr_base=${macaddr_base}
 }
 
 get_board_phy_name() (
@@ -660,15 +664,15 @@ mac80211_check_ap() {
 }
 
 mac80211_set_ifname() {
-	local phy="$1"
-	local prefix="$2"
-	eval "ifname=\"$phy-$prefix\${idx_$prefix:-0}\"; idx_$prefix=\$((\${idx_$prefix:-0 } + 1))"
+	local prefix="$1"
+	local type="$2"
+	eval "ifname=\"$prefix$type\${idx_$type:-0}\"; idx_$type=\$((\${idx_$type:-0 } + 1))"
 }
 
 mac80211_prepare_vif() {
 	json_select config
 
-	json_get_vars ifname mode ssid wds powersave macaddr enable wpa_psk_file vlan_file
+	json_get_vars ifname mode ssid wds powersave macaddr enable wpa_psk_file sae_password_file vlan_file
 
 	[ -n "$ifname" ] || {
 		local prefix;
@@ -679,7 +683,7 @@ mac80211_prepare_vif() {
 		monitor) prefix=mon;;
 		esac
 
-		mac80211_set_ifname "$phy$vif_phy_suffix" "$prefix"
+		mac80211_set_ifname "$ifname_prefix" "$prefix"
 	}
 
 	append active_ifnames "$ifname"
@@ -688,12 +692,14 @@ mac80211_prepare_vif() {
 	json_add_string _ifname "$ifname"
 
 	default_macaddr=
+	random_macaddr=
 	if [ -z "$macaddr" ]; then
 		macaddr="$(mac80211_generate_mac $phy)"
 		macidx="$(($macidx + 1))"
 		default_macaddr=1
 	elif [ "$macaddr" = 'random' ]; then
 		macaddr="$(macaddr_random)"
+		random_macaddr=1
 	fi
 	json_add_string _macaddr "$macaddr"
 	json_add_string _default_macaddr "$default_macaddr"
@@ -701,7 +707,12 @@ mac80211_prepare_vif() {
 
 
 	[ "$mode" == "ap" ] && {
+		json_select config
+		wireless_vif_parse_encryption
+		json_select ..
+
 		[ -z "$wpa_psk_file" ] && hostapd_set_psk "$ifname"
+		[ -z "$sae_password_file" ] && hostapd_set_sae "$ifname"
 		[ -z "$vlan_file" ] && hostapd_set_vlan "$ifname"
 	}
 
@@ -732,8 +743,10 @@ mac80211_prepare_vif() {
 
 mac80211_prepare_iw_htmode() {
 	case "$htmode" in
-		VHT20|HT20|HE20) iw_htmode=HT20;;
-		HT40*|VHT40|VHT160|HE40)
+		HT20|VHT20|HE20|EHT20)
+			iw_htmode=HT20
+		;;
+		HT40*|VHT40|HE40|EHT40)
 			case "$band" in
 				2g)
 					case "$htmode" in
@@ -757,8 +770,11 @@ mac80211_prepare_iw_htmode() {
 			esac
 			[ "$auto_channel" -gt 0 ] && iw_htmode="HT40+"
 		;;
-		VHT80|HE80)
-			iw_htmode="80MHZ"
+		VHT80|HE80|EHT80)
+			iw_htmode="80MHz"
+		;;
+		VHT160|HE160|EHT160)
+			iw_htmode="160MHz"
 		;;
 		NONE|NOHT)
 			iw_htmode="NOHT"
@@ -836,11 +852,22 @@ mac80211_setup_adhoc() {
 
 mac80211_setup_mesh() {
 	json_get_vars ssid mesh_id mcast_rate
+	json_get_values iface_basic_rate_list basic_rate
 
 	mcval=
 	[ -n "$mcast_rate" ] && wpa_supplicant_add_rate mcval "$mcast_rate"
 	[ -n "$mesh_id" ] && ssid="$mesh_id"
 
+	br_list="$basic_rate_list"
+	if [ -n "$iface_basic_rate_list" ]; then
+		br_list="$iface_basic_rate_list"
+	fi
+
+	brstr=
+	for br in $br_list; do
+		wpa_supplicant_add_rate brstr "$br"
+	done
+
 	local prev
 	json_set_namespace wdev_uc prev
 
@@ -851,6 +878,7 @@ mac80211_setup_mesh() {
 	json_add_string freq "$freq"
 	json_add_string htmode "$iw_htmode"
 	[ -n "$mcval" ] && json_add_string mcast-rate "$mcval"
+	[ -n "$brstr" ] && json_add_string basic-rates "$brstr"
 	json_add_int beacon-interval "$beacon_int"
 	mac80211_add_mesh_params
 
@@ -933,6 +961,7 @@ wpa_supplicant_set_config() {
 	json_add_string phy "$phy"
 	json_add_int radio "$radio"
 	json_add_int num_global_macaddr "$num_global_macaddr"
+	json_add_string macaddr_base "$macaddr_base"
 	json_add_boolean defer 1
 	local data="$(json_dump)"
 
@@ -979,7 +1008,7 @@ wpa_supplicant_start() {
 
 	[ -n "$wpa_supp_init" ] || return 0
 
-	ubus_call wpa_supplicant config_set '{ "phy": "'"$phy"'", "radio": '"$radio"', "num_global_macaddr": '"$num_global_macaddr"' }' > /dev/null
+	ubus_call wpa_supplicant config_set '{ "phy": "'"$phy"'", "radio": '"$radio"', "num_global_macaddr": '"$num_global_macaddr"', "macaddr_base": "'"$macaddr_base"'" }' > /dev/null
 }
 
 mac80211_setup_supplicant() {
@@ -1017,7 +1046,7 @@ mac80211_setup_vif() {
 			json_get_vars $MP_CONFIG_INT $MP_CONFIG_BOOL $MP_CONFIG_STRING
 			wireless_vif_parse_encryption
 			[ -z "$htmode" ] && htmode="NOHT";
-			if wpa_supplicant -vmesh; then
+			if [ -x /usr/sbin/wpa_supplicant ] && wpa_supplicant -vmesh; then
 				mac80211_setup_supplicant || failed=1
 			else
 				mac80211_setup_mesh
@@ -1105,7 +1134,8 @@ drv_mac80211_setup() {
 		txpower \
 		rxantenna txantenna \
 		frag rts beacon_int:100 htmode \
-		num_global_macaddr:1 multiple_bssid
+		num_global_macaddr:1 multiple_bssid \
+		ifname_prefix macaddr_base
 	json_get_values basic_rate_list basic_rate
 	json_get_values scan_list scan_list
 	json_select ..
@@ -1124,6 +1154,8 @@ drv_mac80211_setup() {
 		return 1
 	}
 
+	set_default ifname_prefix "$phy$vif_phy_suffix-"
+
 	local wdev
 	local cwdev
 	local found
@@ -1198,6 +1230,14 @@ drv_mac80211_setup() {
 	wdev_tool "$phy$phy_suffix" set_config "$(json_dump)" $active_ifnames
 	json_set_namespace "$prev"
 
+	[ -z "$phy_suffix" ] && {
+		if [ -n "$txpower" ]; then
+			iw phy "$phy" set txpower fixed "${txpower%%.*}00"
+		else
+			iw phy "$phy" set txpower auto
+		fi
+	}
+
 	for_each_interface "ap sta adhoc mesh monitor" mac80211_set_vif_txpower
 	wireless_set_up
 }
diff --git a/package/network/config/wifi-scripts/files/sbin/wifi b/package/network/config/wifi-scripts/files/sbin/wifi
index f937dba7e6d92d..c70723560b767d 100755
--- a/package/network/config/wifi-scripts/files/sbin/wifi
+++ b/package/network/config/wifi-scripts/files/sbin/wifi
@@ -37,135 +37,22 @@ wifi_isup() {
 	return 0
 }
 
-find_net_config() {(
-	local vif="$1"
-	local cfg
-	local ifname
-
-	config_get cfg "$vif" network
-
-	[ -z "$cfg" ] && {
-		include /lib/network
-		scan_interfaces
-
-		config_get ifname "$vif" ifname
-
-		cfg="$(find_config "$ifname")"
-	}
-	[ -z "$cfg" ] && return 0
-	echo "$cfg"
-)}
-
-
-bridge_interface() {(
-	local cfg="$1"
-	[ -z "$cfg" ] && return 0
-
-	include /lib/network
-	scan_interfaces
-
-	for cfg in $cfg; do
-		config_get iftype "$cfg" type
-		[ "$iftype" = bridge ] && config_get "$cfg" ifname
-		prepare_interface_bridge "$cfg"
-		return $?
-	done
-)}
-
-prepare_key_wep() {
-	local key="$1"
-	local hex=1
-
-	echo -n "$key" | grep -qE "[^a-fA-F0-9]" && hex=0
-	[ "${#key}" -eq 10 -a $hex -eq 1 ] || \
-	[ "${#key}" -eq 26 -a $hex -eq 1 ] || {
-		[ "${key:0:2}" = "s:" ] && key="${key#s:}"
-		key="$(echo -n "$key" | hexdump -ve '1/1 "%02x" ""')"
-	}
-	echo "$key"
-}
-
-wifi_fixup_hwmode() {
-	local device="$1"
-	local default="$2"
-	local hwmode hwmode_11n
-
-	config_get channel "$device" channel
-	config_get hwmode "$device" hwmode
-	case "$hwmode" in
-		11bg) hwmode=bg;;
-		11a) hwmode=a;;
-		11ad) hwmode=ad;;
-		11b) hwmode=b;;
-		11g) hwmode=g;;
-		11n*)
-			hwmode_11n="${hwmode##11n}"
-			case "$hwmode_11n" in
-				a|g) ;;
-				default) hwmode_11n="$default"
-			esac
-			config_set "$device" hwmode_11n "$hwmode_11n"
-		;;
-		*)
-			hwmode=
-			if [ "${channel:-0}" -gt 0 ]; then
-				if [ "${channel:-0}" -gt 14 ]; then
-					hwmode=a
-				else
-					hwmode=g
-				fi
-			else
-				hwmode="$default"
-			fi
-		;;
-	esac
-	config_set "$device" hwmode "$hwmode"
-}
-
-_wifi_updown() {
-	for device in ${2:-$DEVICES}; do (
-		config_get disabled "$device" disabled
-		[ "$disabled" = "1" ] && {
-			echo "'$device' is disabled"
-			set disable
-		}
-		config_get iftype "$device" type
-		if eval "type ${1}_$iftype" 2>/dev/null >/dev/null; then
-			eval "scan_$iftype '$device'"
-			eval "${1}_$iftype '$device'" || echo "$device($iftype): ${1} failed"
-		elif [ ! -f /lib/netifd/wireless/$iftype.sh ]; then
-			echo "$device($iftype): Interface type not supported"
-		fi
-	); done
-}
-
 wifi_updown() {
 	cmd=down
 	[ enable = "$1" ] && {
-		_wifi_updown disable "$2"
 		ubus_wifi_cmd "$cmd" "$2"
 		ubus call network reload
-		scan_wifi
 		cmd=up
 	}
 	[ reconf = "$1" ] && {
 		ubus call network reload
-		scan_wifi
 		cmd=reconf
 	}
 	ubus_wifi_cmd "$cmd" "$2"
-	_wifi_updown "$@"
-}
-
-wifi_reload_legacy() {
-	_wifi_updown "disable" "$1"
-	scan_wifi
-	_wifi_updown "enable" "$1"
 }
 
 wifi_reload() {
 	ubus call network reload
-	wifi_reload_legacy
 }
 
 wifi_detect_notice() {
@@ -189,75 +76,9 @@ wifi_config() {
 	); done
 }
 
-start_net() {(
-	local iface="$1"
-	local config="$2"
-	local vifmac="$3"
-
-	[ -f "/var/run/$iface.pid" ] && kill "$(cat /var/run/${iface}.pid)" 2>/dev/null
-	[ -z "$config" ] || {
-		include /lib/network
-		scan_interfaces
-		for config in $config; do
-			setup_interface "$iface" "$config" "" "$vifmac"
-		done
-	}
-)}
-
-set_wifi_up() {
-	local cfg="$1"
-	local ifname="$2"
-	uci_set_state wireless "$cfg" up 1
-	uci_set_state wireless "$cfg" ifname "$ifname"
-}
-
-set_wifi_down() {
-	local cfg="$1"
-	local vifs vif vifstr
-
-	[ -f "/var/run/wifi-${cfg}.pid" ] &&
-		kill "$(cat "/var/run/wifi-${cfg}.pid")" 2>/dev/null
-	uci_revert_state wireless "$cfg"
-	config_get vifs "$cfg" vifs
-	for vif in $vifs; do
-		uci_revert_state wireless "$vif"
-	done
-}
-
-scan_wifi() {
-	local cfgfile="$1"
-	DEVICES=
-	config_cb() {
-		local type="$1"
-		local section="$2"
-
-		# section start
-		case "$type" in
-			wifi-device)
-				append DEVICES "$section"
-				config_set "$section" vifs ""
-				config_set "$section" ht_capab ""
-			;;
-		esac
-
-		# section end
-		config_get TYPE "$CONFIG_SECTION" TYPE
-		case "$TYPE" in
-			wifi-iface)
-				config_get device "$CONFIG_SECTION" device
-				config_get vifs "$device" vifs
-				append vifs "$CONFIG_SECTION"
-				config_set "$device" vifs "$vifs"
-			;;
-		esac
-	}
-	config_load "${cfgfile:-wireless}"
-}
-
 DEVICES=
 DRIVERS=
 include /lib/wifi
-scan_wifi
 
 case "$1" in
 	down) wifi_updown "disable" "$2";;
@@ -266,7 +87,6 @@ case "$1" in
 	status) ubus_wifi_cmd "status" "$2";;
 	isup) wifi_isup "$2"; exit $?;;
 	reload) wifi_reload "$2";;
-	reload_legacy) wifi_reload_legacy "$2";;
 	--help|help) usage;;
 	reconf) wifi_updown "reconf" "$2";;
 	''|up) wifi_updown "enable" "$2";;
diff --git a/package/network/config/wifi-scripts/files/usr/share/hostap/common.uc b/package/network/config/wifi-scripts/files/usr/share/hostap/common.uc
index c6bfb62ef3c5d0..31b526b6aee78b 100644
--- a/package/network/config/wifi-scripts/files/usr/share/hostap/common.uc
+++ b/package/network/config/wifi-scripts/files/usr/share/hostap/common.uc
@@ -213,7 +213,12 @@ const phy_proto = {
 		if (!base_mask)
 			return null;
 
-		if (base_mask == "00:00:00:00:00:00" &&
+		if (base_mask == "00:00:00:00:00:00")
+			base_mask = "ff:ff:ff:ff:ff:ff";
+
+		if (data.macaddr_base)
+			base_addr = data.macaddr_base;
+		else if (base_mask == "ff:ff:ff:ff:ff:ff" &&
 		    (radio_idx > 0 || idx >= num_global)) {
 			let addrs = split(phy_sysfs_file(phy, "addresses"), "\n");
 
@@ -225,8 +230,6 @@ const phy_proto = {
 			} else {
 				if (idx < length(addrs))
 					return addrs[idx];
-
-				base_mask = "ff:ff:ff:ff:ff:ff";
 			}
 		}
 
diff --git a/package/network/config/wifi-scripts/files/usr/share/hostap/wdev.uc b/package/network/config/wifi-scripts/files/usr/share/hostap/wdev.uc
index d836a930fc4f9a..166e9403dfce72 100644
--- a/package/network/config/wifi-scripts/files/usr/share/hostap/wdev.uc
+++ b/package/network/config/wifi-scripts/files/usr/share/hostap/wdev.uc
@@ -45,7 +45,7 @@ function iface_start(wdev)
 		system(cmd);
 	} else if (wdev.mode == "mesh") {
 		let cmd = [ "iw", "dev", ifname, "mesh", "join", wdev.ssid, "freq", wdev.freq, htmode ];
-		for (let key in [ "mcast-rate", "beacon-interval" ])
+		for (let key in [ "basic-rates", "mcast-rate", "beacon-interval" ])
 			if (wdev[key])
 				push(cmd, key, wdev[key]);
 		system(cmd);
diff --git a/package/network/ipv6/odhcp6c/Makefile b/package/network/ipv6/odhcp6c/Makefile
index 894f388945fc50..c16ecfa083c3bf 100644
--- a/package/network/ipv6/odhcp6c/Makefile
+++ b/package/network/ipv6/odhcp6c/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=odhcp6c
-PKG_RELEASE:=20
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/odhcp6c.git
-PKG_SOURCE_DATE:=2023-05-12
-PKG_SOURCE_VERSION:=bcd283632ac13391aac3ebdd074d1fd832d76fa3
-PKG_MIRROR_HASH:=0c18c578045f9251bd86a5b8fb0518b69c519e83f69907bf76583a2985482508
+PKG_SOURCE_DATE:=2024-09-25
+PKG_SOURCE_VERSION:=b6ae9ffaeb0e18e9fa3d5be62faa8d3c9f340a58
+PKG_MIRROR_HASH:=25499b6a0d403815e6b04869a02d2d5a32582348bff2bc2626559d297425a908
 PKG_MAINTAINER:=Hans Dedecker <dedeckeh@gmail.com>
 PKG_LICENSE:=GPL-2.0
 
diff --git a/package/network/services/dnsmasq/Makefile b/package/network/services/dnsmasq/Makefile
index 0a597c03ce405b..47a5ae54ae7f5c 100644
--- a/package/network/services/dnsmasq/Makefile
+++ b/package/network/services/dnsmasq/Makefile
@@ -10,7 +10,7 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=dnsmasq
 PKG_UPSTREAM_VERSION:=2.90
 PKG_VERSION:=$(subst test,~~test,$(subst rc,~rc,$(PKG_UPSTREAM_VERSION)))
-PKG_RELEASE:=3
+PKG_RELEASE:=4
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_UPSTREAM_VERSION).tar.xz
 PKG_SOURCE_URL:=https://thekelleys.org.uk/dnsmasq/
diff --git a/package/network/services/dnsmasq/files/dnsmasq.init b/package/network/services/dnsmasq/files/dnsmasq.init
index b864ea90699f48..e9afcc78d3176e 100755
--- a/package/network/services/dnsmasq/files/dnsmasq.init
+++ b/package/network/services/dnsmasq/files/dnsmasq.init
@@ -226,6 +226,14 @@ append_interface_name() {
 	xappend "--interface-name=$1,$2"
 }
 
+append_filter_rr() {
+	xappend "--filter-rr=$1"
+}
+
+append_cache_rr() {
+	xappend "--cache-rr=$1"
+}
+
 filter_dnsmasq() {
 	local cfg="$1" func="$2" match_cfg="$3" found_cfg
 
@@ -1000,8 +1008,8 @@ dnsmasq_start()
 	# deprecate or remove filter-X in favor of filter-rr?
 	append_bool "$cfg" filter_aaaa "--filter-AAAA"
 	append_bool "$cfg" filter_a "--filter-A"
-	append_parm "$cfg" filter_rr "--filter-rr"
-	append_parm "$cfg" cache_rr "--cache-rr"
+	config_list_foreach "$cfg" filter_rr append_filter_rr
+	config_list_foreach "$cfg" cache_rr append_cache_rr
 
 	append_parm "$cfg" logfacility "--log-facility"
 	config_get logfacility "$cfg" "logfacility"
diff --git a/package/network/services/dnsmasq/patches/0003-Handle-DS-queries-to-auth-zones.patch b/package/network/services/dnsmasq/patches/0003-Handle-DS-queries-to-auth-zones.patch
new file mode 100644
index 00000000000000..bd7270c904cc10
--- /dev/null
+++ b/package/network/services/dnsmasq/patches/0003-Handle-DS-queries-to-auth-zones.patch
@@ -0,0 +1,98 @@
+From 8ce27433f8b2e17c557cb55e4f16941d309deeac Mon Sep 17 00:00:00 2001
+From: Simon Kelley <simon@thekelleys.org.uk>
+Date: Fri, 17 Jan 2025 17:49:29 +0000
+Subject: [PATCH] Handle DS queries to auth zones.
+Origin: upstream, v2.91test8
+
+When dnsmasq is configured to act as an authoritative server and has
+an authoritative zone configured, and recieves a query for
+that zone _as_forwarder_ it answers the query directly rather
+than forwarding it. This doesn't affect the answer, but it
+saves dnsmasq forwarding the query to the recusor upstream,
+whch then bounces it back to dnsmasq in auth mode. The
+exception should be when the query is for the root of zone, for a DS
+RR. The answer to that has to come from the parent, via the
+recursor, and will typically be a proof-of-nonexistence since
+dnsmasq doesn't support signed zones. This patch suppresses
+local answers and forces forwarding to the upstream recursor
+for such queries. It stops breakage when a DNSSEC validating
+client makes queries to dnsmasq acting as forwarder for a zone
+for which it is authoritative.
+
+[ukleinek: drop changes to CHANGELOG to prevent conflicts]
+---
+ src/forward.c | 52 +++++++++++++++++++++++++++++++++++++--------------
+ 1 file changed, 38 insertions(+), 14 deletions(-)
+
+--- a/src/forward.c
++++ b/src/forward.c
+@@ -1744,15 +1744,27 @@ void receive_query(struct listener *list
+ #endif
+ 
+ #ifdef HAVE_AUTH
+-      /* find queries for zones we're authoritative for, and answer them directly */
++      /* Find queries for zones we're authoritative for, and answer them directly.
++	 The exception to this is DS queries for the zone route. They
++	 have to come from the parent zone. Since dnsmasq's auth server
++	 can't do DNSSEC, the zone will be unsigned, and anything using
++	 dnsmasq as a forwarder and doing validation will be expecting to
++	 see the proof of non-existence from the parent. */
+       if (!auth_dns && !option_bool(OPT_LOCALISE))
+ 	for (zone = daemon->auth_zones; zone; zone = zone->next)
+-	  if (in_zone(zone, daemon->namebuff, NULL))
+-	    {
+-	      auth_dns = 1;
+-	      local_auth = 1;
+-	      break;
+-	    }
++	  {
++	    char *cut;
++	    
++	    if (in_zone(zone, daemon->namebuff, &cut))
++	      {
++		if (type != T_DS || cut)
++		  {
++		    auth_dns = 1;
++		    local_auth = 1;
++		  }
++		break;
++	      }
++	  }
+ #endif
+       
+ #ifdef HAVE_LOOP
+@@ -2268,15 +2280,27 @@ unsigned char *tcp_request(int confd, ti
+ 				   &peer_addr, auth_dns ? "auth" : "query", qtype);
+ 	      
+ #ifdef HAVE_AUTH
+-	      /* find queries for zones we're authoritative for, and answer them directly */
++	      /* Find queries for zones we're authoritative for, and answer them directly.
++		 The exception to this is DS queries for the zone route. They
++		 have to come from the parent zone. Since dnsmasq's auth server
++		 can't do DNSSEC, the zone will be unsigned, and anything using
++		 dnsmasq as a forwarder and doing validation will be expecting to
++		 see the proof of non-existence from the parent. */
+ 	      if (!auth_dns && !option_bool(OPT_LOCALISE))
+ 		for (zone = daemon->auth_zones; zone; zone = zone->next)
+-		  if (in_zone(zone, daemon->namebuff, NULL))
+-		    {
+-		      auth_dns = 1;
+-		      local_auth = 1;
+-		      break;
+-		    }
++		  {
++		    char *cut;
++		    
++		    if (in_zone(zone, daemon->namebuff, &cut))
++		      {
++			if (qtype != T_DS || cut)
++			  {
++			    auth_dns = 1;
++			    local_auth = 1;
++			  }
++			break;
++		      }
++		  }
+ #endif
+ 	    }
+ 	}
diff --git a/package/network/services/dropbear/Makefile b/package/network/services/dropbear/Makefile
index e9f3bd693c617c..e13b6c2145b716 100644
--- a/package/network/services/dropbear/Makefile
+++ b/package/network/services/dropbear/Makefile
@@ -8,14 +8,14 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dropbear
-PKG_VERSION:=2024.85
+PKG_VERSION:=2024.86
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:= \
 	https://matt.ucc.asn.au/dropbear/releases/ \
 	https://dropbear.nl/mirror/releases/
-PKG_HASH:=86b036c433a69d89ce51ebae335d65c47738ccf90d13e5eb0fea832e556da502
+PKG_HASH:=e78936dffc395f2e0db099321d6be659190966b99712b55c530dd0a1822e0a5e
 
 PKG_LICENSE:=MIT
 PKG_LICENSE_FILES:=LICENSE libtomcrypt/LICENSE libtommath/LICENSE
diff --git a/package/network/services/dropbear/files/dropbear.config b/package/network/services/dropbear/files/dropbear.config
index 2139ba0bbeaac7..7eb59754490683 100644
--- a/package/network/services/dropbear/files/dropbear.config
+++ b/package/network/services/dropbear/files/dropbear.config
@@ -1,4 +1,6 @@
-config dropbear
+# See https://openwrt.org/docs/guide-user/base-system/dropbear
+config dropbear main
+	option enable '1'
 	option PasswordAuth 'on'
 	option RootPasswordAuth 'on'
 	option Port         '22'
diff --git a/package/network/services/dropbear/files/dropbear.init b/package/network/services/dropbear/files/dropbear.init
index 708fabd3269af2..395237f9bc206a 100755
--- a/package/network/services/dropbear/files/dropbear.init
+++ b/package/network/services/dropbear/files/dropbear.init
@@ -361,7 +361,7 @@ dropbear_instance()
 load_interfaces()
 {
 	local enable
-	config_get enable "$1" enable 1
+	config_get_bool enable "$1" enable 1
 	[ "${enable}" = "1" ] || return 0
 
 	local direct_iface iface
diff --git a/package/network/services/dropbear/patches/110-change_user.patch b/package/network/services/dropbear/patches/110-change_user.patch
index 9cb073cf940d46..9ef8f0cfbc4981 100644
--- a/package/network/services/dropbear/patches/110-change_user.patch
+++ b/package/network/services/dropbear/patches/110-change_user.patch
@@ -1,6 +1,6 @@
 --- a/src/svr-chansession.c
 +++ b/src/svr-chansession.c
-@@ -987,12 +987,12 @@ static void execchild(const void *user_d
+@@ -984,12 +984,12 @@ static void execchild(const void *user_d
  	/* We can only change uid/gid as root ... */
  	if (getuid() == 0) {
  
diff --git a/package/network/services/hostapd/Makefile b/package/network/services/hostapd/Makefile
index 0e3396262d0c13..8753782012e5a3 100644
--- a/package/network/services/hostapd/Makefile
+++ b/package/network/services/hostapd/Makefile
@@ -5,7 +5,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=hostapd
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE_URL:=https://w1.fi/hostap.git
 PKG_SOURCE_PROTO:=git
@@ -84,7 +84,11 @@ ifneq ($(CONFIG_DRIVER_11BE_SUPPORT),)
   HOSTAPD_IEEE80211BE:=y
 endif
 
-CORE_DEPENDS = +ucode +libubus +libucode +ucode-mod-fs +ucode-mod-nl80211 +ucode-mod-rtnl +ucode-mod-ubus +ucode-mod-uloop +libblobmsg-json +libudebug
+
+CORE_DEPENDS = +ucode +libucode \
+	+ucode-mod-fs +ucode-mod-nl80211 +ucode-mod-rtnl +ucode-mod-ubus +ucode-mod-uloop \
+	+libubus +libblobmsg-json \
+	+libudebug
 OPENSSL_DEPENDS = +PACKAGE_$(1):libopenssl +PACKAGE_$(1):libopenssl-legacy
 
 DRIVER_MAKEOPTS= \
@@ -716,7 +720,13 @@ define Install/supplicant
 endef
 
 define Package/hostapd-common/install
-	$(INSTALL_DIR) $(1)/etc/capabilities $(1)/etc/rc.button $(1)/etc/hotplug.d/ieee80211 $(1)/etc/init.d $(1)/lib/netifd  $(1)/usr/share/acl.d $(1)/usr/share/hostap
+	$(INSTALL_DIR) \
+	  $(1)/etc/capabilities \
+	  $(1)/etc/rc.button \
+	  $(1)/etc/hotplug.d/ieee80211 \
+	  $(1)/etc/init.d $(1)/lib/netifd \
+	  $(1)/usr/share/acl.d \
+	  $(1)/usr/share/hostap
 	$(INSTALL_BIN) ./files/dhcp-get-server.sh $(1)/lib/netifd/dhcp-get-server.sh
 	$(INSTALL_BIN) ./files/wpad.init $(1)/etc/init.d/wpad
 	$(INSTALL_BIN) ./files/wps-hotplug.sh $(1)/etc/rc.button/wps
diff --git a/package/network/services/hostapd/files/hostapd.uc b/package/network/services/hostapd/files/hostapd.uc
index 2d9ce2874901d2..5c172de5dfcc8e 100644
--- a/package/network/services/hostapd/files/hostapd.uc
+++ b/package/network/services/hostapd/files/hostapd.uc
@@ -10,6 +10,7 @@ hostapd.data.pending_config = {};
 hostapd.data.file_fields = {
 	vlan_file: true,
 	wpa_psk_file: true,
+	sae_password_file: true,
 	accept_mac_file: true,
 	deny_mac_file: true,
 	eap_user_file: true,
@@ -186,7 +187,7 @@ function __iface_pending_next(pending, state, ret, data)
 
 		pending.call("wpa_supplicant", "phy_status", {
 			phy: phydev.phy,
-			radio: phydev.radio,
+			radio: phydev.radio ?? -1,
 		});
 		return "check_phy";
 	case "check_phy":
@@ -199,7 +200,7 @@ function __iface_pending_next(pending, state, ret, data)
 		}
 		pending.call("wpa_supplicant", "phy_set_state", {
 			phy: phydev.phy,
-			radio: phydev.radio,
+			radio: phydev.radio ?? -1,
 			stop: true
 		});
 		return "wpas_stopped";
@@ -208,7 +209,7 @@ function __iface_pending_next(pending, state, ret, data)
 			hostapd.printf(`hostapd.add_iface failed for phy ${phy} ifname=${bss.ifname}`);
 		pending.call("wpa_supplicant", "phy_set_state", {
 			phy: phydev.phy,
-			radio: phydev.radio,
+			radio: phydev.radio ?? -1,
 			stop: false
 		});
 		return null;
@@ -278,6 +279,7 @@ function iface_macaddr_init(phydev, config, macaddr_list)
 {
 	let macaddr_data = {
 		num_global: config.num_global_macaddr ?? 1,
+		macaddr_base: config.macaddr_base,
 		mbssid: config.mbssid ?? 0,
 	};
 
@@ -364,6 +366,7 @@ function bss_remove_file_fields(config)
 	for (let key in config.hash)
 		new_cfg.hash[key] = config.hash[key];
 	delete new_cfg.hash.wpa_psk_file;
+	delete new_cfg.hash.sae_password_file;
 	delete new_cfg.hash.vlan_file;
 
 	return new_cfg;
@@ -482,7 +485,9 @@ function iface_reload_config(name, phydev, config, old_config)
 
 		// try to preserve MAC address of this BSS by reassigning another
 		// BSS if necessary
-		if (cur_config.default_macaddr &&
+		if ((cur_config.default_macaddr || cur_config.random_macaddr) &&
+		    cur_config.random_macaddr == prev_config.random_macaddr &&
+		    cur_config.default_macaddr == prev_config.default_macaddr &&
 		    !macaddr_list[prev_config.bssid]) {
 			macaddr_list[prev_config.bssid] = i;
 			cur_config.bssid = prev_config.bssid;
@@ -745,9 +750,12 @@ function iface_load_config(phy, radio, filename)
 			continue;
 		}
 
-		if (val[0] == "#num_global_macaddr" ||
-		    val[0] == "mbssid")
+		if (val[0] == "#num_global_macaddr")
 			config[substr(val[0], 1)] = int(val[1]);
+		else if (val[0] == "#macaddr_base")
+			config[substr(val[0], 1)] = val[1];
+		else if (val[0] == "mbssid")
+			config[val[0]] = int(val[1]);
 
 		push(config.radio.data, line);
 	}
@@ -755,6 +763,8 @@ function iface_load_config(phy, radio, filename)
 	while ((line = rtrim(f.read("line"), "\n")) != null) {
 		if (line == "#default_macaddr")
 			bss.default_macaddr = true;
+		if (line == "#random_macaddr")
+			bss.random_macaddr = true;
 
 		let val = split(line, "=", 2);
 		if (!val[0])
@@ -827,7 +837,7 @@ let main_obj = {
 			let phy_list = req.args.phy ? [ phy_name(req.args.phy, req.args.radio) ] : keys(hostapd.data.config);
 			for (let phy_name in phy_list) {
 				let phy = hostapd.data.config[phy_name];
-				let config = iface_load_config(phy.phy, radio, phy.orig_file);
+				let config = iface_load_config(phy.phy, phy.radio_idx, phy.orig_file);
 				iface_set_config(phy_name, config);
 			}
 
diff --git a/package/network/services/hostapd/files/wpa_supplicant.uc b/package/network/services/hostapd/files/wpa_supplicant.uc
index fbea27628e341d..f288121e9d4b03 100644
--- a/package/network/services/hostapd/files/wpa_supplicant.uc
+++ b/package/network/services/hostapd/files/wpa_supplicant.uc
@@ -68,7 +68,7 @@ function prepare_config(config, radio)
 	return { config };
 }
 
-function set_config(config_name, phy_name, radio, num_global_macaddr, config_list)
+function set_config(config_name, phy_name, radio, num_global_macaddr, macaddr_base, config_list)
 {
 	let phy = wpas.data.config[config_name];
 
@@ -83,6 +83,7 @@ function set_config(config_name, phy_name, radio, num_global_macaddr, config_lis
 
 	phy.radio = radio;
 	phy.num_global_macaddr = num_global_macaddr;
+	phy.macaddr_base = macaddr_base;
 
 	let values = [];
 	for (let config in config_list)
@@ -106,7 +107,10 @@ function start_pending(phy_name)
 	}
 
 	let macaddr_list = wpas.data.macaddr_list[phy_name];
-	phydev.macaddr_init(macaddr_list, { num_global: phy.num_global_macaddr });
+	phydev.macaddr_init(macaddr_list, {
+		num_global: phy.num_global_macaddr,
+		macaddr_base: phy.macaddr_base,
+	});
 
 	for (let ifname in phy.data)
 		iface_start(phydev, phy.data[ifname]);
@@ -210,6 +214,7 @@ let main_obj = {
 			phy: "",
 			radio: 0,
 			num_global_macaddr: 0,
+			macaddr_base: "",
 			config: [],
 			defer: true,
 		},
@@ -221,7 +226,7 @@ let main_obj = {
 			wpas.printf(`Set new config for phy ${phy}`);
 			try {
 				if (req.args.config)
-					set_config(phy, req.args.phy, req.args.radio, req.args.num_global_macaddr, req.args.config);
+					set_config(phy, req.args.phy, req.args.radio, req.args.num_global_macaddr, req.args.macaddr_base, req.args.config);
 
 				if (!req.args.defer)
 					start_pending(phy);
diff --git a/package/network/services/hostapd/patches/601-ucode_support.patch b/package/network/services/hostapd/patches/601-ucode_support.patch
index 5a88687cf222ef..13fd2b1b518a7b 100644
--- a/package/network/services/hostapd/patches/601-ucode_support.patch
+++ b/package/network/services/hostapd/patches/601-ucode_support.patch
@@ -816,7 +816,7 @@ as adding/removing interfaces.
  	if (vlan_id)
  		*vlan_id = 0;
  	if (psk_len)
-@@ -446,13 +447,16 @@ static const u8 * hostapd_wpa_auth_get_p
+@@ -446,13 +447,18 @@ static const u8 * hostapd_wpa_auth_get_p
  	 * returned psk which should not be returned again.
  	 * logic list (all hostapd_get_psk; all sta->psk)
  	 */
@@ -830,16 +830,23 @@ as adding/removing interfaces.
  			*vlan_id = 0;
  		psk = sta->psk->psk;
 -		for (pos = sta->psk; pos; pos = pos->next) {
++		if (vlan_id)
++			sta->psk_idx = psk_idx;
 +		for (pos = sta->psk; pos; pos = pos->next, psk_idx++) {
  			if (pos->is_passphrase) {
  				if (pbkdf2_sha1(pos->passphrase,
  						hapd->conf->ssid.ssid,
-@@ -469,6 +473,8 @@ static const u8 * hostapd_wpa_auth_get_p
+@@ -466,9 +472,13 @@ static const u8 * hostapd_wpa_auth_get_p
+ 			}
+ 			if (pos->psk == prev_psk) {
+ 				psk = pos->next ? pos->next->psk : NULL;
++				if (vlan_id)
++					sta->psk_idx = psk_idx + 1;
  				break;
  			}
  		}
-+		if (psk)
-+			sta->psk_idx = psk_idx;
++		if (vlan_id && !psk)
++			sta->psk_idx = 0;
  	}
  	return psk;
  }
diff --git a/package/network/services/hostapd/patches/701-reload_config_inline.patch b/package/network/services/hostapd/patches/701-reload_config_inline.patch
index 54045476477fe6..24d3aa86d057d5 100644
--- a/package/network/services/hostapd/patches/701-reload_config_inline.patch
+++ b/package/network/services/hostapd/patches/701-reload_config_inline.patch
@@ -8,7 +8,7 @@ as adding/removing interfaces.
 
 --- a/hostapd/config_file.c
 +++ b/hostapd/config_file.c
-@@ -5207,7 +5207,12 @@ struct hostapd_config * hostapd_config_r
+@@ -5207,7 +5207,14 @@ struct hostapd_config * hostapd_config_r
  	int errors = 0;
  	size_t i;
  
@@ -19,6 +19,8 @@ as adding/removing interfaces.
 +	} else {
 +		f = fopen(fname, "r");
 +	}
++	wpa_printf(MSG_INFO, "Configuration file: Reading configuration file '%s'",
++	     fname);
  	if (f == NULL) {
  		wpa_printf(MSG_ERROR, "Could not open configuration file '%s' "
  			   "for reading.", fname);
@@ -39,3 +41,35 @@ as adding/removing interfaces.
  	if (f == NULL) {
  		wpa_printf(MSG_ERROR, "Failed to open config file '%s', "
  			   "error: %s", name, strerror(errno));
+--- a/hostapd/main.c
++++ b/hostapd/main.c
+@@ -406,7 +406,11 @@ hostapd_interface_init(struct hapd_inter
+ 	struct hostapd_iface *iface;
+ 	int k;
+ 
+-	wpa_printf(MSG_DEBUG, "Configuration file: %s", config_fname);
++	if (!strncmp(config_fname, "data:", 5)) {
++		wpa_printf(MSG_DEBUG, "Configuration file: %s", "<inline>");
++	} else {
++		wpa_printf(MSG_DEBUG, "Configuration file: %s", config_fname);
++	}
+ 	iface = hostapd_init(interfaces, config_fname);
+ 	if (!iface)
+ 		return NULL;
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -2893,7 +2893,12 @@ hostapd_interface_init_bss(struct hapd_i
+ 		}
+ 	}
+ 
+-	wpa_printf(MSG_INFO, "Configuration file: %s (phy %s)%s",
+-		   config_fname, phy, iface ? "" : " --> new PHY");
++	if (!strncmp(config_fname, "data:", 5)) {
++		wpa_printf(MSG_INFO, "Configuration file: %s (phy %s)%s",
++		     "<inline>", phy, iface ? "" : " --> new PHY");
++	} else {
++		wpa_printf(MSG_INFO, "Configuration file: %s (phy %s)%s",
++		     config_fname, phy, iface ? "" : " --> new PHY");
++	}
+	if (iface) {
+		struct hostapd_config *conf;
diff --git a/package/network/services/hostapd/patches/730-ft_iface.patch b/package/network/services/hostapd/patches/730-ft_iface.patch
index ac7d3abd78af7c..f021f1f99ba4b2 100644
--- a/package/network/services/hostapd/patches/730-ft_iface.patch
+++ b/package/network/services/hostapd/patches/730-ft_iface.patch
@@ -29,7 +29,7 @@ a VLAN interface on top of the bridge, instead of using the bridge directly
  	int bridge_hairpin; /* hairpin_mode on bridge members */
 --- a/src/ap/wpa_auth_glue.c
 +++ b/src/ap/wpa_auth_glue.c
-@@ -1821,8 +1821,12 @@ int hostapd_setup_wpa(struct hostapd_dat
+@@ -1825,8 +1825,12 @@ int hostapd_setup_wpa(struct hostapd_dat
  	    wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt)) {
  		const char *ft_iface;
  
diff --git a/package/network/services/hostapd/patches/804-hostapd-Fix-clearing-up-settings-for-color-switch.patch b/package/network/services/hostapd/patches/804-hostapd-Fix-clearing-up-settings-for-color-switch.patch
new file mode 100644
index 00000000000000..87d68911c79d71
--- /dev/null
+++ b/package/network/services/hostapd/patches/804-hostapd-Fix-clearing-up-settings-for-color-switch.patch
@@ -0,0 +1,28 @@
+From 161327f91d956771996c96ea1b6e4e1cb8dc074c Mon Sep 17 00:00:00 2001
+From: Stone Zhang <quic_stonez@quicinc.com>
+Date: Mon, 14 Oct 2024 18:47:32 +0800
+Subject: [PATCH] hostapd: Fix clearing up settings for color switch
+
+Settings for color switch (struct cca_settings settings)
+is used without zero clearing, which causes the member
+settings->ubpr->unsol_bcast_probe_resp_intervalettings
+to be a random value. It is againsts the NLA policy of
+NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT and causes
+BSS color switch failure.
+
+Fixes: 654d2395dddf ("BSS coloring: Handling of collision events and triggering CCA")
+Signed-off-by: Stone Zhang <quic_stonez@quicinc.com>
+---
+ src/ap/hostapd.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/src/ap/hostapd.c
++++ b/src/ap/hostapd.c
+@@ -4813,6 +4813,7 @@ static void hostapd_switch_color_timeout
+ 		struct cca_settings settings;
+ 		int ret;
+ 
++		os_memset(&settings, 0, sizeof(settings));
+ 		hostapd_cleanup_cca_params(bss);
+ 		bss->cca_color = r;
+ 		bss->cca_count = 10;
diff --git a/package/network/services/hostapd/src/src/ap/ucode.c b/package/network/services/hostapd/src/src/ap/ucode.c
index 2da2b4dc938738..3b1f052abcc1ea 100644
--- a/package/network/services/hostapd/src/src/ap/ucode.c
+++ b/package/network/services/hostapd/src/src/ap/ucode.c
@@ -10,6 +10,7 @@
 #include "dfs.h"
 #include "acs.h"
 #include "ieee802_11_auth.h"
+#include "neighbor_db.h"
 #include <libubox/uloop.h>
 
 static uc_resource_type_t *global_type, *bss_type, *iface_type;
@@ -23,7 +24,7 @@ hostapd_ucode_bss_get_uval(struct hostapd_data *hapd)
 	uc_value_t *val;
 
 	if (hapd->ucode.idx)
-		return wpa_ucode_registry_get(bss_registry, hapd->ucode.idx);
+		return ucv_get(wpa_ucode_registry_get(bss_registry, hapd->ucode.idx));
 
 	val = uc_resource_new(bss_type, hapd);
 	hapd->ucode.idx = wpa_ucode_registry_add(bss_registry, val);
@@ -37,7 +38,7 @@ hostapd_ucode_iface_get_uval(struct hostapd_iface *hapd)
 	uc_value_t *val;
 
 	if (hapd->ucode.idx)
-		return wpa_ucode_registry_get(iface_registry, hapd->ucode.idx);
+		return ucv_get(wpa_ucode_registry_get(iface_registry, hapd->ucode.idx));
 
 	val = uc_resource_new(iface_type, hapd);
 	hapd->ucode.idx = wpa_ucode_registry_add(iface_registry, val);
@@ -54,12 +55,11 @@ hostapd_ucode_update_bss_list(struct hostapd_iface *iface, uc_value_t *if_bss, u
 	list = ucv_array_new(vm);
 	for (i = 0; iface->bss && i < iface->num_bss; i++) {
 		struct hostapd_data *hapd = iface->bss[i];
-		uc_value_t *val = hostapd_ucode_bss_get_uval(hapd);
 
-		ucv_array_set(list, i, ucv_get(ucv_string_new(hapd->conf->iface)));
-		ucv_object_add(bss, hapd->conf->iface, ucv_get(val));
+		ucv_array_set(list, i, ucv_string_new(hapd->conf->iface));
+		ucv_object_add(bss, hapd->conf->iface, hostapd_ucode_bss_get_uval(hapd));
 	}
-	ucv_object_add(if_bss, iface->phy, ucv_get(list));
+	ucv_object_add(if_bss, iface->phy, list);
 }
 
 static void
@@ -73,13 +73,14 @@ hostapd_ucode_update_interfaces(void)
 	for (i = 0; i < interfaces->count; i++) {
 		struct hostapd_iface *iface = interfaces->iface[i];
 
-		ucv_object_add(ifs, iface->phy, ucv_get(hostapd_ucode_iface_get_uval(iface)));
+		ucv_object_add(ifs, iface->phy, hostapd_ucode_iface_get_uval(iface));
 		hostapd_ucode_update_bss_list(iface, if_bss, bss);
 	}
 
-	ucv_object_add(ucv_prototype_get(global), "interfaces", ucv_get(ifs));
-	ucv_object_add(ucv_prototype_get(global), "interface_bss", ucv_get(if_bss));
-	ucv_object_add(ucv_prototype_get(global), "bss", ucv_get(bss));
+	ucv_object_add(ucv_prototype_get(global), "interfaces", ifs);
+	ucv_object_add(ucv_prototype_get(global), "interface_bss", if_bss);
+	ucv_object_add(ucv_prototype_get(global), "bss", bss);
+
 	ucv_gc(vm);
 }
 
@@ -258,7 +259,11 @@ uc_hostapd_bss_set_config(uc_vm_t *vm, size_t nargs)
 	hapd->conf = conf->bss[idx];
 	conf->bss[idx] = old_bss;
 
+	if (hapd == iface->bss[0])
+		memcpy(hapd->own_addr, hapd->conf->bssid, ETH_ALEN);
+
 	hostapd_setup_bss(hapd, hapd == iface->bss[0], true);
+	hostapd_neighbor_set_own_report(hapd);
 	hostapd_ucode_update_interfaces();
 	hostapd_owe_update_trans(iface);
 
@@ -362,6 +367,10 @@ uc_hostapd_iface_add_bss(uc_vm_t *vm, size_t nargs)
 
 	hapd->driver = iface->bss[0]->driver;
 	hapd->drv_priv = iface->bss[0]->drv_priv;
+#ifdef CONFIG_IEEE80211BE
+	os_strlcpy(hapd->ctrl_sock_iface, hapd->conf->iface,
+		   sizeof(hapd->ctrl_sock_iface));
+#endif
 	if (interfaces->ctrl_iface_init &&
 	    interfaces->ctrl_iface_init(hapd) < 0)
 		goto free_hapd;
@@ -380,6 +389,7 @@ uc_hostapd_iface_add_bss(uc_vm_t *vm, size_t nargs)
 	iface->conf->bss[iface->conf->num_bss] = bss;
 	conf->bss[idx] = NULL;
 	ret = hostapd_ucode_bss_get_uval(hapd);
+	hostapd_neighbor_set_own_report(hapd);
 	hostapd_ucode_update_interfaces();
 	hostapd_owe_update_trans(iface);
 	goto out;
@@ -721,11 +731,10 @@ int hostapd_ucode_sta_auth(struct hostapd_data *hapd, struct sta_info *sta)
 	if (wpa_ucode_call_prepare("sta_auth"))
 		return 0;
 
-	uc_value_push(ucv_get(ucv_string_new(hapd->conf->iface)));
+	uc_value_push(ucv_string_new(hapd->conf->iface));
 
 	snprintf(addr, sizeof(addr), MACSTR, MAC2STR(sta->addr));
-	val = ucv_string_new(addr);
-	uc_value_push(ucv_get(val));
+	uc_value_push(ucv_string_new(addr));
 
 	val = wpa_ucode_call(2);
 
@@ -787,16 +796,15 @@ void hostapd_ucode_sta_connected(struct hostapd_data *hapd, struct sta_info *sta
 	if (wpa_ucode_call_prepare("sta_connected"))
 		return;
 
-	uc_value_push(ucv_get(ucv_string_new(hapd->conf->iface)));
+	uc_value_push(ucv_string_new(hapd->conf->iface));
 
 	snprintf(addr, sizeof(addr), MACSTR, MAC2STR(sta->addr));
-	val = ucv_string_new(addr);
-	uc_value_push(ucv_get(val));
+	uc_value_push(ucv_string_new(addr));
 
 	val = ucv_object_new(vm);
 	if (sta->psk_idx)
 		ucv_object_add(val, "psk_idx", ucv_int64_new(sta->psk_idx - 1));
-	uc_value_push(ucv_get(val));
+	uc_value_push(val);
 
 	val = wpa_ucode_call(3);
 	if (ucv_type(val) != UC_OBJECT)
@@ -878,7 +886,7 @@ void hostapd_ucode_free(void)
 
 void hostapd_ucode_free_iface(struct hostapd_iface *iface)
 {
-	wpa_ucode_registry_remove(iface_registry, iface->ucode.idx);
+	ucv_put(wpa_ucode_registry_remove(iface_registry, iface->ucode.idx));
 }
 
 void hostapd_ucode_bss_cb(struct hostapd_data *hapd, const char *type)
@@ -889,10 +897,11 @@ void hostapd_ucode_bss_cb(struct hostapd_data *hapd, const char *type)
 		return;
 
 	val = hostapd_ucode_bss_get_uval(hapd);
-	uc_value_push(ucv_get(ucv_string_new(hapd->iface->phy)));
-	uc_value_push(ucv_get(ucv_string_new(hapd->conf->iface)));
+	uc_value_push(ucv_string_new(hapd->iface->phy));
+	uc_value_push(ucv_string_new(hapd->conf->iface));
 	uc_value_push(ucv_get(val));
 	ucv_put(wpa_ucode_call(3));
+	ucv_put(val);
 	ucv_gc(vm);
 }
 
@@ -911,6 +920,8 @@ void hostapd_ucode_free_bss(struct hostapd_data *hapd)
 	uc_value_push(ucv_string_new(hapd->conf->iface));
 	uc_value_push(ucv_get(val));
 	ucv_put(wpa_ucode_call(2));
+
+	ucv_put(val);
 	ucv_gc(vm);
 }
 
@@ -923,10 +934,11 @@ void hostapd_ucode_apup_newpeer(struct hostapd_data *hapd, const char *ifname)
 		return;
 
 	val = hostapd_ucode_bss_get_uval(hapd);
-	uc_value_push(ucv_get(ucv_string_new(hapd->conf->iface))); // BSS ifname
+	uc_value_push(ucv_string_new(hapd->conf->iface)); // BSS ifname
 	uc_value_push(ucv_get(val));
-	uc_value_push(ucv_get(ucv_string_new(ifname))); // APuP peer ifname
+	uc_value_push(ucv_string_new(ifname)); // APuP peer ifname
 	ucv_put(wpa_ucode_call(2));
+	ucv_put(val);
 	ucv_gc(vm);
 }
 #endif // def CONFIG_APUP
diff --git a/package/network/services/hostapd/src/src/utils/ucode.c b/package/network/services/hostapd/src/src/utils/ucode.c
index 29c753c326905d..7636e46aaf2894 100644
--- a/package/network/services/hostapd/src/src/utils/ucode.c
+++ b/package/network/services/hostapd/src/src/utils/ucode.c
@@ -171,7 +171,7 @@ uc_value_t *uc_wpa_freq_info(uc_vm_t *vm, size_t nargs)
 	ucv_object_add(ret, "op_class", ucv_int64_new(op_class));
 	ucv_object_add(ret, "channel", ucv_int64_new(channel));
 	ucv_object_add(ret, "hw_mode", ucv_int64_new(hw_mode));
-	ucv_object_add(ret, "hw_mode_str", ucv_get(ucv_string_new(modestr)));
+	ucv_object_add(ret, "hw_mode_str", ucv_string_new(modestr));
 	ucv_object_add(ret, "sec_channel", ucv_int64_new(sec_channel));
 	ucv_object_add(ret, "frequency", ucv_int64_new(freq_val));
 
@@ -425,7 +425,7 @@ uc_value_t *wpa_ucode_global_init(const char *name, uc_resource_type_t *global_t
 
 	uc_vm_registry_set(&vm, "hostap.global", global);
 	proto = ucv_prototype_get(global);
-	ucv_object_add(proto, "data", ucv_get(ucv_object_new(&vm)));
+	ucv_object_add(proto, "data", ucv_object_new(&vm));
 
 #define ADD_CONST(x) ucv_object_add(proto, #x, ucv_int64_new(x))
 	ADD_CONST(MSG_EXCESSIVE);
@@ -470,6 +470,7 @@ uc_value_t *wpa_ucode_registry_remove(uc_value_t *reg, int idx)
 	if (!val)
 		return NULL;
 
+	ucv_get(val);
 	ucv_array_set(reg, idx - 1, NULL);
 	dataptr = ucv_resource_dataptr(val, NULL);
 	if (dataptr)
diff --git a/package/network/services/hostapd/src/wpa_supplicant/ucode.c b/package/network/services/hostapd/src/wpa_supplicant/ucode.c
index 9380b301c36eeb..8335a27e892b88 100644
--- a/package/network/services/hostapd/src/wpa_supplicant/ucode.c
+++ b/package/network/services/hostapd/src/wpa_supplicant/ucode.c
@@ -20,7 +20,7 @@ wpas_ucode_iface_get_uval(struct wpa_supplicant *wpa_s)
 	uc_value_t *val;
 
 	if (wpa_s->ucode.idx)
-		return wpa_ucode_registry_get(iface_registry, wpa_s->ucode.idx);
+		return ucv_get(wpa_ucode_registry_get(iface_registry, wpa_s->ucode.idx));
 
 	val = uc_resource_new(iface_type, wpa_s);
 	wpa_s->ucode.idx = wpa_ucode_registry_add(iface_registry, val);
@@ -36,9 +36,9 @@ wpas_ucode_update_interfaces(void)
 	int i;
 
 	for (wpa_s = wpa_global->ifaces; wpa_s; wpa_s = wpa_s->next)
-		ucv_object_add(ifs, wpa_s->ifname, ucv_get(wpas_ucode_iface_get_uval(wpa_s)));
+		ucv_object_add(ifs, wpa_s->ifname, wpas_ucode_iface_get_uval(wpa_s));
 
-	ucv_object_add(ucv_prototype_get(global), "interfaces", ucv_get(ifs));
+	ucv_object_add(ucv_prototype_get(global), "interfaces", ifs);
 	ucv_gc(vm);
 }
 
@@ -49,8 +49,8 @@ void wpas_ucode_add_bss(struct wpa_supplicant *wpa_s)
 	if (wpa_ucode_call_prepare("iface_add"))
 		return;
 
-	uc_value_push(ucv_get(ucv_string_new(wpa_s->ifname)));
-	uc_value_push(ucv_get(wpas_ucode_iface_get_uval(wpa_s)));
+	uc_value_push(ucv_string_new(wpa_s->ifname));
+	uc_value_push(wpas_ucode_iface_get_uval(wpa_s));
 	ucv_put(wpa_ucode_call(2));
 	ucv_gc(vm);
 }
@@ -67,9 +67,10 @@ void wpas_ucode_free_bss(struct wpa_supplicant *wpa_s)
 	if (wpa_ucode_call_prepare("iface_remove"))
 		return;
 
-	uc_value_push(ucv_get(ucv_string_new(wpa_s->ifname)));
+	uc_value_push(ucv_string_new(wpa_s->ifname));
 	uc_value_push(ucv_get(val));
 	ucv_put(wpa_ucode_call(2));
+	ucv_put(val);
 	ucv_gc(vm);
 }
 
@@ -86,9 +87,9 @@ void wpas_ucode_update_state(struct wpa_supplicant *wpa_s)
 		return;
 
 	state = wpa_supplicant_state_txt(wpa_s->wpa_state);
-	uc_value_push(ucv_get(ucv_string_new(wpa_s->ifname)));
+	uc_value_push(ucv_string_new(wpa_s->ifname));
 	uc_value_push(ucv_get(val));
-	uc_value_push(ucv_get(ucv_string_new(state)));
+	uc_value_push(ucv_string_new(state));
 	ucv_put(wpa_ucode_call(3));
 	ucv_gc(vm);
 }
@@ -108,9 +109,9 @@ void wpas_ucode_event(struct wpa_supplicant *wpa_s, int event, union wpa_event_d
 	if (wpa_ucode_call_prepare("event"))
 		return;
 
-	uc_value_push(ucv_get(ucv_string_new(wpa_s->ifname)));
+	uc_value_push(ucv_string_new(wpa_s->ifname));
 	uc_value_push(ucv_get(val));
-	uc_value_push(ucv_get(ucv_string_new(event_to_string(event))));
+	uc_value_push(ucv_string_new(event_to_string(event)));
 	val = ucv_object_new(vm);
 	uc_value_push(ucv_get(val));
 
@@ -212,15 +213,14 @@ uc_wpas_iface_status(uc_vm_t *vm, size_t nargs)
 {
 	struct wpa_supplicant *wpa_s = uc_fn_thisval("wpas.iface");
 	struct wpa_bss *bss;
-	uc_value_t *ret, *val;
+	uc_value_t *ret;
 
 	if (!wpa_s)
 		return NULL;
 
 	ret = ucv_object_new(vm);
 
-	val = ucv_string_new(wpa_supplicant_state_txt(wpa_s->wpa_state));
-	ucv_object_add(ret, "state", ucv_get(val));
+	ucv_object_add(ret, "state", ucv_string_new(wpa_supplicant_state_txt(wpa_s->wpa_state)));
 
 	bss = wpa_s->current_bss;
 	if (bss) {
diff --git a/package/network/services/lldpd/Makefile b/package/network/services/lldpd/Makefile
index f34cd28faac965..3fbd0bf4f93ae8 100644
--- a/package/network/services/lldpd/Makefile
+++ b/package/network/services/lldpd/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=lldpd
-PKG_VERSION:=1.0.17
-PKG_RELEASE:=5
+PKG_VERSION:=1.0.18
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/lldpd/lldpd/releases/download/$(PKG_VERSION)/
-PKG_HASH:=89ae691a4917ac9e0ec3b8b2c1e634cc402d43b804f98850c73bd1c7df380882
+PKG_HASH:=38cd319aa02ab61d9a2ad130e22f906795ccca9ac73a0a0d9dac19ca99a8a870
 
 PKG_MAINTAINER:=Stijn Tintel <stijn@linux-ipv6.be>
 PKG_LICENSE:=ISC
@@ -90,6 +90,8 @@ endif
 ifneq ($(CONFIG_LLDPD_WITH_LLDPMED),y)
 	sed -i -e 's/CONFIG_LLDPD_WITH_LLDPMED=y/CONFIG_LLDPD_WITH_LLDPMED=n/g' $(1)/etc/init.d/lldpd
 	sed -i -e '/agentxsocket/d' $(1)/etc/config/lldpd
+	sed -i -e '/lldp_class/d' $(1)/etc/config/lldpd
+	sed -i -e '/lldp_location/d' $(1)/etc/config/lldpd
 endif
 endef
 
diff --git a/package/network/services/lldpd/files/lldpd.init b/package/network/services/lldpd/files/lldpd.init
index 3922b676b52e69..e59b5d9800b919 100644
--- a/package/network/services/lldpd/files/lldpd.init
+++ b/package/network/services/lldpd/files/lldpd.init
@@ -1,6 +1,6 @@
 #!/bin/sh /etc/rc.common
 # Copyright (C) 2008-2015 OpenWrt.org
-# shellcheck disable=1091,2034,3037,3043,3045
+# shellcheck disable=1091,2034,3037,3043,3045,3057
 
 START=90
 STOP=01
@@ -24,22 +24,69 @@ LLDPD_RESTART_HASH=${LLDPD_RUN}/lldpd.restart_hash
 
 . "$IPKG_INSTROOT/lib/functions/network.sh"
 
+# Load release info once for all 'find_*' functions
+[ -s /etc/os-release ] && . /etc/os-release
+
+# Helper function to truncate output to 31 characters
+truncate_output() {
+	# Some devices have trouble decoding inventory TLV strings > 31 chars
+	# lldpd truncates inventory TLV to a total TLV length of 36 (of which string = 32)
+	echo "${1:0:31}"
+}
+
 find_release_info()
 {
-	[ -s /etc/os-release ] && . /etc/os-release
 	[ -z "$PRETTY_NAME" ] && [ -s /etc/openwrt_version ] && \
 		PRETTY_NAME="$(cat /etc/openwrt_version)"
 
 	echo "${PRETTY_NAME:-Unknown OpenWrt release} @ $(cat /proc/sys/kernel/hostname)"
 }
 
+find_hardware_revision()
+{
+	echo "${OPENWRT_DEVICE_REVISION:-Unknown hardware revision}"
+}
+
+find_firmware_info()
+{
+	echo "${PRETTY_NAME:-Unknown firmware release}"
+}
+
+find_software_revision()
+{
+	echo "${BUILD_ID:-Unknown software revision}"
+}
+
+# Helper function to extract JSON values using jsonfilter
+extract_json_field() {
+	local _path="$1"
+	jsonfilter -q -i /etc/board.json -e "$_path" 2>/dev/null
+}
+
+find_manufacturer_info()
+{
+	local _id
+	# extract the model->id field, e.g.: "id": "glinet,gl-mt6000",
+	_id=$(extract_json_field '@.model.id')
+	# stash text up to first comma
+	_id="${_id%%,*}"
+	echo "${_id:-Unknown manufacturer}"
+}
+
+find_model_info()
+{
+	local _name
+	# extract the model->name field, e.g.: "name": "GL.iNet GL-MT6000"
+	_name=$(extract_json_field '@.model.name')
+	echo "${_name:-Unknown model name}"
+}
+
 get_config_restart_hash() {
 	local var="$1"
 	local _string _hash v
 
 	config_load 'lldpd'
 
-	config_get      v 'config' 'lldp_class'; append _string "$v" ","
 	if [ "$CONFIG_LLDPD_WITH_SNMP" = "y" ]; then
 		config_get      v 'config' 'agentxsocket'; append _string "$v" ","
 	fi
@@ -49,6 +96,7 @@ get_config_restart_hash() {
 	config_get_bool v 'config' 'lldp_no_version'; append _string "$v" ","
 	if [ "$CONFIG_LLDPD_WITH_LLDPMED" = "y" ]; then
 		config_get_bool v 'config' 'lldpmed_no_inventory'; append _string "$v" ","
+		config_get      v 'config' 'lldp_class'; append _string "$v" ","
 	fi
 	config_get_bool v 'config' 'enable_lldp' 1; append _string "$v" ","
 	config_get_bool v 'config' 'force_lldp'; append _string "$v" ","
@@ -75,9 +123,9 @@ get_config_restart_hash() {
 	export -n "$var=$_hash"
 }
 
-get_config_cid_ifaces() {
+get_interface_csv() {
 	local _ifaces
-	config_get _ifaces 'config' "$2"
+	config_get _ifaces "$2" "$3"
 
 	local _iface _ifnames=""
 	# Set noglob to prevent '*' capturing diverse file names in the for ... in
@@ -98,6 +146,21 @@ get_config_cid_ifaces() {
 	export -n "${1}=$_ifnames"
 }
 
+add_custom_tlv_callback()
+{
+	# syntax: configure [ports ethX[,…]] lldp custom-tlv [add|replace] oui XX,XX,XX subtype XX oui-info XX[,XX,...]
+	# ex: configure ports br-lan,eth0 lldp custom-tlv replace oui 33,44,55 subtype 254 oui-info 55,55,55,55,55
+	# ex: configure lldp custom-tlv oui 33,44,44 subtype 232
+
+	local _ports
+	local _tlv
+	# CSV of device ports
+	get_interface_csv _ports "$1" 'ports'
+	config_get _tlv "$1" 'tlv'
+
+	echo "configure ${_ports:+ports $_ports }lldp custom-tlv $_tlv" >> "$LLDPD_CONF"
+}
+
 write_lldpd_conf()
 {
 	local lldp_description
@@ -105,11 +168,53 @@ write_lldpd_conf()
 	config_load 'lldpd'
 	config_get lldp_description 'config' 'lldp_description' "$(find_release_info)"
 
+	# Check the 'do not send inventory' flag
+	local lldpmed_no_inventory
+	config_get_bool lldpmed_no_inventory 'config' 'lldpmed_no_inventory' 0
+
+	if [ "$lldpmed_no_inventory" = 0 ]; then
+		# lldpmed_no_inventory=1 ('-i' in start_service()) prevents these from being sent
+		# TIA TR-41 TLV 127 subtype 0x05
+		local lldp_med_inv_hardware_revision
+		config_get lldp_med_inv_hardware_revision 'config' 'lldp_med_inv_hardware_revision' "$(find_hardware_revision)"
+		lldp_med_inv_hardware_revision=$(truncate_output "$lldp_med_inv_hardware_revision")
+
+		# TIA TR-41 TLV 127 subtype 0x06
+		local lldp_med_inv_firmware_revision
+		config_get lldp_med_inv_firmware_revision 'config' 'lldp_med_inv_firmware_revision' "$(find_firmware_info)"
+		lldp_med_inv_firmware_revision=$(truncate_output "$lldp_med_inv_firmware_revision")
+
+		# TIA TR-41 TLV 127 subtype 0x07
+		local lldp_med_inv_software_revision
+		config_get lldp_med_inv_software_revision 'config' 'lldp_med_inv_software_revision' "$(find_software_revision)"
+		lldp_med_inv_software_revision=$(truncate_output "$lldp_med_inv_software_revision")
+
+		# TIA TR-41 TLV 127 subtype 0x08
+		local lldp_med_inv_serial_number
+		config_get lldp_med_inv_serial_number 'config' 'lldp_med_inv_serial_number'
+		lldp_med_inv_serial_number=$(truncate_output "$lldp_med_inv_serial_number")
+
+		# TIA TR-41 TLV 127 subtype 0x09
+		local lldp_med_inv_manufacturer_name
+		config_get lldp_med_inv_manufacturer_name 'config' 'lldp_med_inv_manufacturer_name' "$(find_manufacturer_info)"
+		lldp_med_inv_manufacturer_name=$(truncate_output "$lldp_med_inv_manufacturer_name")
+
+		# TIA TR-41 TLV 127 subtype 0x0a
+		local lldp_med_inv_model_name
+		config_get lldp_med_inv_model_name 'config' 'lldp_med_inv_model_name' "$(find_model_info)"
+		lldp_med_inv_model_name=$(truncate_output "$lldp_med_inv_model_name")
+
+		# TIA TR-41 TLV 127 subtype 0x0b
+		local lldp_med_inv_asset_id
+		config_get lldp_med_inv_asset_id 'config' 'lldp_med_inv_asset_id'
+		lldp_med_inv_asset_id=$(truncate_output "$lldp_med_inv_asset_id")
+	fi
+
 	local lldp_hostname
 	config_get lldp_hostname 'config' 'lldp_hostname' "$(cat /proc/sys/kernel/hostname)"
 
 	local ifnames
-	get_config_cid_ifaces ifnames "interface"
+	get_interface_csv ifnames 'config' "interface"
 
 	local lldp_mgmt_ip
 	config_get lldp_mgmt_ip 'config' 'lldp_mgmt_ip'
@@ -167,6 +272,17 @@ write_lldpd_conf()
 	[ -n "$lldp_mgmt_ip" ] && echo "configure system ip management pattern" "\"$lldp_mgmt_ip\"" >> "$LLDPD_CONF"
 	[ -n "$lldp_syscapabilities" ] && echo "configure system capabilities enabled $lldp_syscapabilities" >> "$LLDPD_CONF"
 
+	if [ "$lldpmed_no_inventory" = 0 ]; then
+		# Hardware inventory info
+		[ -n "$lldp_med_inv_hardware_revision" ] && echo "configure inventory hardware-revision \"$lldp_med_inv_hardware_revision\"" >> "$LLDPD_CONF"
+		[ -n "$lldp_med_inv_firmware_revision" ] && echo "configure inventory firmware-revision \"$lldp_med_inv_firmware_revision\"" >> "$LLDPD_CONF"
+		[ -n "$lldp_med_inv_software_revision" ] && echo "configure inventory software-revision \"$lldp_med_inv_software_revision\"" >> "$LLDPD_CONF"
+		[ -n "$lldp_med_inv_serial_number" ] && echo "configure inventory serial-number \"$lldp_med_inv_serial_number\"" >> "$LLDPD_CONF"
+		[ -n "$lldp_med_inv_manufacturer_name" ] && echo "configure inventory manufacturer \"$lldp_med_inv_manufacturer_name\"" >> "$LLDPD_CONF"
+		[ -n "$lldp_med_inv_model_name" ] && echo "configure inventory model \"$lldp_med_inv_model_name\"" >> "$LLDPD_CONF"
+		[ -n "$lldp_med_inv_asset_id" ] && echo "configure inventory asset \"$lldp_med_inv_asset_id\"" >> "$LLDPD_CONF"
+	fi
+
 	if [ "$CONFIG_LLDPD_WITH_LLDPMED" = "y" ] && [ "$lldpmed_fast_start" -gt 0 ]; then
 		if [ "$lldpmed_fast_start_tx_interval" -gt 0 ]; then
 			echo "configure med fast-start tx-interval $lldpmed_fast_start_tx_interval" >> "$LLDPD_CONF"
@@ -197,6 +313,9 @@ write_lldpd_conf()
 	[ "$lldp_mgmt_addr_advertisements" -gt 0 ] && echo "configure lldp management-addresses-advertisements" >> "$LLDPD_CONF" ||\
 		echo "unconfigure lldp management-addresses-advertisements" >> "$LLDPD_CONF"
 
+	# Custom TLV handling
+	config_foreach add_custom_tlv_callback 'custom-tlv'
+
 	# Since lldpd's sysconfdir is /tmp, we'll symlink /etc/lldpd.d to /tmp/$LLDPD_CONFS_DIR
 	[ -e "$LLDPD_CONFS_DIR" ] || ln -s /etc/lldpd.d "$LLDPD_CONFS_DIR"
 }
@@ -243,10 +362,10 @@ start_service() {
 		config_get_bool enable_edp 'config' 'enable_edp' 0
 		config_get_bool force_edp 'config' 'force_edp' 0
 	fi
-	config_get lldp_class 'config' 'lldp_class'
 	config_get_bool lldp_no_version 'config' 'lldp_no_version' 0
 	if [ "$CONFIG_LLDPD_WITH_LLDPMED" = "y" ]; then
 		config_get_bool lldpmed_no_inventory 'config' 'lldpmed_no_inventory' 0
+		config_get lldp_class 'config' 'lldp_class'
 	fi
 	config_get_bool readonly_mode 'config' 'readonly_mode' 0
 	if [ "$CONFIG_LLDPD_WITH_SNMP" = "y" ]; then
@@ -335,7 +454,7 @@ start_service() {
 
     # ChassisID interfaces
 	local ifnames
-	get_config_cid_ifaces ifnames "cid_interface"
+	get_interface_csv ifnames 'config' "cid_interface"
 
 	[ -n "$ifnames" ] && procd_append_param command -C "$ifnames"
 
@@ -383,6 +502,14 @@ reload_service() {
 		unconfigure system hostname
 		unconfigure system ip management pattern
 		unconfigure system platform
+		# Hardware inventory info
+		unconfigure inventory hardware-revision
+		unconfigure inventory firmware-revision
+		unconfigure inventory software-revision
+		unconfigure inventory serial-number
+		unconfigure inventory manufacturer
+		unconfigure inventory model
+		unconfigure inventory asset
 	EOF
 	if [ "$CONFIG_LLDPD_WITH_LLDPMED" = "y" ]; then
 		$LLDPCLI -u "$LLDPSOCKET" >/dev/null 2>&1 <<-EOF
diff --git a/package/network/services/omcproxy/Makefile b/package/network/services/omcproxy/Makefile
index 0ca0970af2b9f1..a295431cb553e5 100644
--- a/package/network/services/omcproxy/Makefile
+++ b/package/network/services/omcproxy/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=omcproxy
-PKG_RELEASE:=9
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/omcproxy.git
-PKG_MIRROR_HASH:=61f03d76b14149e417360b6aaa630e920b75a31a6a497353b7160b3a374b20b2
-PKG_SOURCE_DATE:=2021-11-04
-PKG_SOURCE_VERSION:=bfba2aa75802ff1a70ef2fd3eba53409a8c6e93a
+PKG_MIRROR_HASH:=b18c6dcc323dc35cfeb3503562dd3d8b9fb27fcf6ddd98690a64bd709920ff3d
+PKG_SOURCE_DATE:=2025-02-27
+PKG_SOURCE_VERSION:=582cd8d3ae7e6af0073ce1d9198387af48affd60
 PKG_MAINTAINER:=Steven Barth <cyrus@openwrt.org>
 PKG_LICENSE:=Apache-2.0
 
diff --git a/package/network/services/ppp/patches/400-simplify_kernel_checks.patch b/package/network/services/ppp/patches/400-simplify_kernel_checks.patch
index 137937c2448de0..311bb8752f9d44 100644
--- a/package/network/services/ppp/patches/400-simplify_kernel_checks.patch
+++ b/package/network/services/ppp/patches/400-simplify_kernel_checks.patch
@@ -10,7 +10,14 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
 
 --- a/pppd/sys-linux.c
 +++ b/pppd/sys-linux.c
-@@ -231,7 +231,7 @@ static int driver_is_old       = 0;
+@@ -224,14 +224,10 @@ static fd_set in_fds;		/* set of fds tha
+ static int max_in_fd;		/* highest fd set in in_fds */
+ 
+ static int has_proxy_arp       = 0;
+-static int driver_version      = 0;
+-static int driver_modification = 0;
+-static int driver_patch        = 0;
+-static int driver_is_old       = 0;
  static int restore_term        = 0;	/* 1 => we've munged the terminal */
  static struct termios inittermios;	/* Initial TTY termios */
  
@@ -19,17 +26,18 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
  
  static char loop_name[20];
  static unsigned char inbuf[512]; /* buffer for chars read from loopback */
-@@ -250,8 +250,8 @@ static int	looped;			/* 1 if using loop
+@@ -249,9 +245,8 @@ static int	dynaddr_set;		/* 1 if ip_dyna
+ static int	looped;			/* 1 if using loop */
  static int	link_mtu;		/* mtu for the link (not bundle) */
  
- static struct utsname utsname;	/* for the kernel version */
+-static struct utsname utsname;	/* for the kernel version */
 -static int kernel_version;
  #define KVERSION(j,n,p)	((j)*1000000 + (n)*1000 + (p))
-+static const int kernel_version = KVERSION(2,6,37);
++static const int kernel_version = KVERSION(4,9,0);
  
  #define MAX_IFS		100
  
-@@ -1970,11 +1970,12 @@ int ccp_fatal_error (int unit)
+@@ -1970,11 +1965,12 @@ int ccp_fatal_error (int unit)
   *
   * path_to_procfs - find the path to the proc file system mount point
   */
@@ -44,7 +52,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
      struct mntent *mntent;
      FILE *fp;
  
-@@ -1996,6 +1997,7 @@ static char *path_to_procfs(const char *
+@@ -1996,6 +1992,7 @@ static char *path_to_procfs(const char *
  	    fclose (fp);
  	}
      }
@@ -52,35 +60,24 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
  
      strlcpy(proc_path + proc_path_len, tail,
  	    sizeof(proc_path) - proc_path_len);
-@@ -2895,15 +2897,19 @@ int ppp_check_kernel_support(void)
-     int    my_version, my_modification, my_patch;
-     int osmaj, osmin, ospatch;
+@@ -2889,6 +2886,8 @@ ppp_registered(void)
  
+ int ppp_check_kernel_support(void)
+ {
++    return 1; /* OpenWrt support ppp device "/dev/ppp" by default */
 +#if 0
-     /* get the kernel version now, since we are called before sys_init */
-     uname(&utsname);
-     osmaj = osmin = ospatch = 0;
-     sscanf(utsname.release, "%d.%d.%d", &osmaj, &osmin, &ospatch);
-     kernel_version = KVERSION(osmaj, osmin, ospatch);
-+#endif
- 
-     fd = open("/dev/ppp", O_RDWR);
-     if (fd >= 0) {
-+#if 0
- 	new_style_driver = 1;
+     int s, ok, fd;
+     struct ifreq ifr;
+     int    size;
+@@ -3016,6 +3015,7 @@ int ppp_check_kernel_support(void)
+     }
+     close(s);
+     return ok;
 +#endif
+ }
  
- 	/* XXX should get from driver */
- 	driver_version = 2;
-@@ -2963,6 +2969,7 @@ int ppp_check_kernel_support(void)
- 
-     if (ok && ((ifr.ifr_hwaddr.sa_family & ~0xFF) != ARPHRD_PPP))
- 	ok = 0;
-+	return ok;
- 
- /*
-  *  This is the PPP device. Validate the version of the driver at this
-@@ -3577,6 +3584,7 @@ get_pty(int *master_fdp, int *slave_fdp,
+ #ifndef HAVE_LOGWTMP
+@@ -3577,6 +3577,7 @@ get_pty(int *master_fdp, int *slave_fdp,
      }
  #endif /* TIOCGPTN */
  
@@ -88,7 +85,7 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
      if (sfd < 0) {
  	/* the old way - scan through the pty name space */
  	for (i = 0; i < 64; ++i) {
-@@ -3601,6 +3609,7 @@ get_pty(int *master_fdp, int *slave_fdp,
+@@ -3601,6 +3602,7 @@ get_pty(int *master_fdp, int *slave_fdp,
  	    }
  	}
      }
@@ -96,23 +93,35 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
  
      if (sfd < 0)
  	return 0;
+@@ -3716,6 +3718,7 @@ get_host_seed(void)
+ int
+ sys_check_options(void)
+ {
++#if 0
+     if (demand && driver_is_old) {
+ 	ppp_option_error("demand dialling is not supported by kernel driver "
+ 		     "version %d.%d.%d", driver_version, driver_modification,
+@@ -3726,6 +3729,7 @@ sys_check_options(void)
+ 	warn("Warning: multilink is not supported by the kernel driver");
+ 	multilink = 0;
+     }
++#endif
+     return 1;
+ }
+ 
 --- a/pppd/plugins/pppoatm/pppoatm.c
 +++ b/pppd/plugins/pppoatm/pppoatm.c
-@@ -179,14 +179,6 @@ static void disconnect_pppoatm(void)
- 
+@@ -180,10 +180,6 @@ static void disconnect_pppoatm(void)
  void plugin_init(void)
  {
--#ifdef linux
+ #ifdef linux
 -	extern int new_style_driver;	/* From sys-linux.c */
 -	if (!ppp_check_kernel_support() && !new_style_driver)
 -		fatal("Kernel doesn't support ppp_generic - "
 -		    "needed for PPPoATM");
--#else
--	fatal("No PPPoATM support on this OS");
--#endif
- 	ppp_add_options(pppoa_options);
- }
- 
+ #else
+ 	fatal("No PPPoATM support on this OS");
+ #endif
 --- a/pppd/plugins/pppoe/plugin.c
 +++ b/pppd/plugins/pppoe/plugin.c
 @@ -57,9 +57,6 @@ static char const RCSID[] =
@@ -138,17 +147,14 @@ Signed-off-by: Jo-Philipp Wich <jo@mein.io>
      info("PPPoE plugin from pppd %s", PPPD_VERSION);
 --- a/pppd/plugins/pppol2tp/pppol2tp.c
 +++ b/pppd/plugins/pppol2tp/pppol2tp.c
-@@ -500,12 +500,7 @@ static void pppol2tp_cleanup(void)
- 
+@@ -501,10 +501,6 @@ static void pppol2tp_cleanup(void)
  void plugin_init(void)
  {
--#if defined(__linux__)
+ #if defined(__linux__)
 -	extern int new_style_driver;	/* From sys-linux.c */
 -	if (!ppp_check_kernel_support() && !new_style_driver)
 -		fatal("Kernel doesn't support ppp_generic - "
 -		    "needed for PPPoL2TP");
--#else
-+#if !defined(__linux__)
+ #else
  	fatal("No PPPoL2TP support on this OS");
  #endif
- 	ppp_add_options(pppol2tp_options);
diff --git a/package/network/services/uhttpd/Makefile b/package/network/services/uhttpd/Makefile
index ea76fa65ea8114..3899c5827199b0 100644
--- a/package/network/services/uhttpd/Makefile
+++ b/package/network/services/uhttpd/Makefile
@@ -12,9 +12,9 @@ PKG_RELEASE:=4
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/uhttpd.git
-PKG_SOURCE_DATE:=2023-06-25
-PKG_SOURCE_VERSION:=34a8a74dbdec3c0de38abc1b08f6a73c51263792
-PKG_MIRROR_HASH:=0603019dabb89b1b207d0f7916616c95ce8194a7ff9fd71f0ddd845dd2de944e
+PKG_SOURCE_DATE:=2025-07-06
+PKG_SOURCE_VERSION:=7e64e8bad2415cec0a6d9770ec379db54273c7a7
+PKG_MIRROR_HASH:=61a7ad046f31f229f6a8620b890e448c5df397391edb5f7bd2a84446486eaff4
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_LICENSE:=ISC
 
diff --git a/package/network/services/umdns/Makefile b/package/network/services/umdns/Makefile
index 606dc7274fe3ea..9a2763d5b2dba3 100644
--- a/package/network/services/umdns/Makefile
+++ b/package/network/services/umdns/Makefile
@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/mdnsd.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2024-09-17
-PKG_SOURCE_VERSION:=fbaca4b6f530d4b2f361ee15c266aa19a708242b
-PKG_MIRROR_HASH:=e3fc47a019ea54722b8d7dfc8158307a9fb4a9d18945a1a6794616e3b80d5d3b
+PKG_SOURCE_DATE:=2025-02-10
+PKG_SOURCE_VERSION:=c5ca22a71b2ecb83a2a28b46391dac443be315c2
+PKG_MIRROR_HASH:=2d595fa1e58f028a7ff6813b110ee6bcbc8e6ccce81b2792200508c6db9c276a
 
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 PKG_LICENSE:=LGPL-2.1
diff --git a/package/network/services/umdns/files/umdns.init b/package/network/services/umdns/files/umdns.init
index e9a2c05e093e30..61b2a338d677f6 100644
--- a/package/network/services/umdns/files/umdns.init
+++ b/package/network/services/umdns/files/umdns.init
@@ -35,6 +35,23 @@ start_service() {
 	procd_set_param command "$PROG"
 	[ -f /etc/seccomp/umdns.json ] && procd_set_param seccomp /etc/seccomp/umdns.json
 	procd_set_param respawn
+
+	procd_open_data
+	json_add_array firewall
+
+	for n in $network; do
+		json_add_object ""
+		json_add_string type rule
+		json_add_string proto udp
+		json_add_string src "$n"
+		json_add_int dest_port 5353
+		json_add_string target ACCEPT
+		json_close_object
+	done
+
+	json_close_array
+	procd_close_data
+
 	procd_open_trigger
 	procd_add_config_trigger "config.change" "umdns" /etc/init.d/umdns reload
 	for n in $network; do
diff --git a/package/network/services/unetd/Makefile b/package/network/services/unetd/Makefile
index 018f6b8ea9707e..3a0ded804e73b8 100644
--- a/package/network/services/unetd/Makefile
+++ b/package/network/services/unetd/Makefile
@@ -10,9 +10,9 @@ include $(TOPDIR)/rules.mk
 PKG_NAME:=unetd
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/unetd.git
-PKG_SOURCE_DATE:=2024-03-31
-PKG_SOURCE_VERSION:=806457664ab6e952a7f4febb82e891f596fe577c
-PKG_MIRROR_HASH:=f469d65fd83721a8da0e5253d1ba871a6734233da6f23b631009b17b3af82455
+PKG_SOURCE_DATE:=2025-03-09
+PKG_SOURCE_VERSION:=6c9c8fbd81285a2cba7dd1c2c1ac2bf25ca99e27
+PKG_MIRROR_HASH:=9dc06c945713a6a289ed0838ebe59e65b4fbb333e02d5159a8e87d29754808a6
 
 PKG_LICENSE:=GPL-2.0
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
@@ -32,7 +32,7 @@ define Package/unetd
   SECTION:=net
   CATEGORY:=Network
   TITLE:=WireGuard based VPN connection manager for OpenWrt
-  DEPENDS:=+libubox +libubus +libblobmsg-json +libnl-tiny +kmod-wireguard +UNETD_VXLAN_SUPPORT:libbpf
+  DEPENDS:=+libubox +libubus +libudebug +libblobmsg-json +libnl-tiny +kmod-wireguard +UNETD_VXLAN_SUPPORT:libbpf
 endef
 
 define Package/unetd/config
@@ -40,6 +40,7 @@ define Package/unetd/config
 		bool "VXLAN support"
 		depends on PACKAGE_unetd
 		depends on HAS_BPF_TOOLCHAIN
+		select NEED_BPF_TOOLCHAIN
 		default y
 
 endef
diff --git a/package/network/services/unetd/files/unetd.init b/package/network/services/unetd/files/unetd.init
index c1124821ee8fa1..7c980e3d0d541b 100644
--- a/package/network/services/unetd/files/unetd.init
+++ b/package/network/services/unetd/files/unetd.init
@@ -13,5 +13,20 @@ start_service() {
 	procd_set_param command "$PROG" -h /var/run/unetd/hosts -u /var/run/unetd/socket
 	procd_set_param respawn
 	procd_set_param limits core="unlimited"
+
+	procd_open_data
+	json_add_array firewall
+
+	json_add_object ""
+	json_add_string type rule
+	json_add_string proto udp
+	json_add_string src "*"
+	json_add_int dest_port 51819
+	json_add_string target ACCEPT
+	json_close_object
+
+	json_close_array
+	procd_close_data
+
 	procd_close_instance
 }
diff --git a/package/network/services/unetd/files/unetd.sh b/package/network/services/unetd/files/unetd.sh
index 2f0f0c478c78a9..726ee765654210 100644
--- a/package/network/services/unetd/files/unetd.sh
+++ b/package/network/services/unetd/files/unetd.sh
@@ -18,6 +18,7 @@ proto_unet_init_config() {
 	proto_config_add_string domain
 	proto_config_add_boolean dht
 	proto_config_add_array "tunnels:list(string)"
+	proto_config_add_array "local_network:list(string)"
 	proto_config_add_array "connect:list(string)"
 	proto_config_add_array "peer_data:list(string)"
 	no_device=1
@@ -25,6 +26,17 @@ proto_unet_init_config() {
 	no_proto_task=1
 }
 
+add_array() {
+	local name="$1"
+	local val="$2"
+
+	json_add_array "$name"
+	for c in $val; do
+		json_add_string "" "$c"
+	done
+	json_close_array
+}
+
 proto_unet_setup() {
 	local config="$1"
 
@@ -33,6 +45,7 @@ proto_unet_setup() {
 	json_get_values tunnels tunnels
 	json_get_values connect connect
 	json_get_values peer_data peer_data
+	json_get_values local_network local_network
 	device="${device:-$config}"
 
 	[ -n "$auth_key" ] && type="${type:-dynamic}"
@@ -58,17 +71,9 @@ proto_unet_setup() {
 	done
 	json_close_object
 
-	json_add_array auth_connect
-	for c in $connect; do
-		json_add_string "" "$c"
-	done
-	json_close_array
-
-	json_add_array peer_data
-	for c in $peer_data; do
-		json_add_string "" "$c"
-	done
-	json_close_array
+	add_array local_network "$local_network"
+	add_array auth_connect "$connect"
+	add_array peer_data "$peer_data"
 
 	ip link del dev "$device" >/dev/null 2>&1
 	ip link add dev "$device" type wireguard || {
@@ -82,11 +87,10 @@ proto_unet_setup() {
 
 proto_unet_teardown() {
 	local config="$1"
-	local iface="$2"
 
 	local device
 	json_get_vars device
-	device="${device:-$iface}"
+	device="${device:-$config}"
 
 	json_init
 	json_add_string name "$device"
diff --git a/package/network/utils/bpftool/Makefile b/package/network/utils/bpftool/Makefile
index f2726d18969090..b2fdfc16325e06 100644
--- a/package/network/utils/bpftool/Makefile
+++ b/package/network/utils/bpftool/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=bpftool
-PKG_VERSION:=7.4.0
+PKG_VERSION:=7.5.0
 PKG_RELEASE:=1
 
 PKG_SOURCE_URL:=https://github.com/libbpf/bpftool
-PKG_MIRROR_HASH:=18e22f72e67ff402b5ecaf314445f25c40bfe23299cb783b5834a496297c51ed
+PKG_MIRROR_HASH:=1da7c08959e7819772145774322ffd876f3180065be1c3759336dca98ac9f666
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_VERSION:=v7.4.0
+PKG_SOURCE_VERSION:=v$(PKG_VERSION)
 
 PKG_MAINTAINER:=Tony Ambardar <itugrok@yahoo.com>
 
@@ -97,7 +97,7 @@ HOST_MAKE_FLAGS += \
 	$(if $(findstring c,$(OPENWRT_VERBOSE)),V=1,V='') \
 	check_feat=0 \
 	feature-clang-bpf-co-re=0 \
-	feature-libbfd=1 \
+	feature-libbfd=0 \
 	feature-llvm=0 \
 	feature-libcap=0 \
 	feature-disassembler-four-args=1 \
diff --git a/package/network/utils/ethtool/Makefile b/package/network/utils/ethtool/Makefile
index cfb4cfaeb947f2..5da65273ca937f 100644
--- a/package/network/utils/ethtool/Makefile
+++ b/package/network/utils/ethtool/Makefile
@@ -8,13 +8,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ethtool
-PKG_VERSION:=6.10
+PKG_VERSION:=6.11
 PKG_RELEASE:=1
 
 PKG_MAINTAINER:=Felix Fietkau <nbd@nbd.name>
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/software/network/ethtool
-PKG_HASH:=cc613fe8a2bcddee17a1e6e0d763c0f3ea33c7e930658d2d7f601aa65e426a1f
+PKG_HASH:=8d91f5c72ae3f25b7e88d4781279dcb320f71e30058914370b1c574c96b31202
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=COPYING
@@ -57,6 +57,11 @@ else
 CONFIGURE_ARGS += --disable-netlink --disable-pretty-dump
 endif
 
+# enable support for input_xfrm with kernels newer than 6.6
+ifeq ($(CONFIG_LINUX_6_6),)
+CONFIGURE_ARGS += --enable-rss-input-xfrm
+endif
+
 define Package/ethtool/install
 	$(INSTALL_DIR) $(1)/usr/sbin
 	$(INSTALL_BIN) $(PKG_BUILD_DIR)/ethtool $(1)/usr/sbin
diff --git a/package/network/utils/ethtool/patches/0001-ethtool-make-building-for-RSS-input-xfrm-optional.patch b/package/network/utils/ethtool/patches/0001-ethtool-make-building-for-RSS-input-xfrm-optional.patch
new file mode 100644
index 00000000000000..4c8403dcbc5d18
--- /dev/null
+++ b/package/network/utils/ethtool/patches/0001-ethtool-make-building-for-RSS-input-xfrm-optional.patch
@@ -0,0 +1,67 @@
+From c88eb6f4e9b2d8f71f3391db2bf0ec82ecccae81 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 12 Feb 2025 04:12:42 +0000
+Subject: [PATCH] ethtool: make building for RSS input xfrm optional
+
+Unfortunately there is no way to detect at runtime if the kernel the
+support for RSS input transformation, and the default value
+RXH_XFRM_NO_CHANGE (0xff) used by newer ethtool results in breakage
+with older kernels.
+As a stop-gap solution simply don't compile with support for input
+xfrm by default.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ configure.ac | 10 ++++++++++
+ ethtool.c    | 10 ++++++++++
+ 2 files changed, 20 insertions(+)
+
+--- a/configure.ac
++++ b/configure.ac
+@@ -45,6 +45,16 @@ if test x$enable_pretty_dump = xyes; the
+ fi
+ AM_CONDITIONAL([ETHTOOL_ENABLE_PRETTY_DUMP], [test x$enable_pretty_dump = xyes])
+ 
++AC_ARG_ENABLE(rss-input-xfrm,
++	      [  --enable-rss-input-xfrm  build with support for RSS input transformation (disabled by default)],
++	      ,
++	      enable_rss_input_xfrm=no)
++if test x$enable_rss_input_xfrm = xyes; then
++    AC_DEFINE(ETHTOOL_ENABLE_RSS_INPUT_XFRM, 1,
++	      [Define this to enable building with support for RSS input transformation.])
++fi
++AM_CONDITIONAL([ETHTOOL_ENABLE_RSS_INPUT_XFRM], [test x$enable_rss_input_xfrm = xyes])
++
+ AC_ARG_WITH([bash-completion-dir],
+ 	    AS_HELP_STRING([--with-bash-completion-dir[=PATH]],
+ 	                   [Install the bash-completion script in this directory. @<:@default=yes@:>@]),
+--- a/ethtool.c
++++ b/ethtool.c
+@@ -4109,9 +4109,11 @@ static int do_grxfh(struct cmd_context *
+ 		       (const char *)hfuncs->data + i * ETH_GSTRING_LEN,
+ 		       (rss->hfunc & (1 << i)) ? "on" : "off");
+ 
++#ifdef ETHTOOL_ENABLE_RSS_INPUT_XFRM
+ 	printf("RSS input transformation:\n");
+ 	printf("    symmetric-xor: %s\n",
+ 	       (rss->input_xfrm & RXH_XFRM_SYM_XOR) ? "on" : "off");
++#endif
+ 
+ out:
+ 	free(hfuncs);
+@@ -4431,7 +4433,15 @@ static int do_srxfh(struct cmd_context *
+ 	rss->cmd = ETHTOOL_SRSSH;
+ 	rss->rss_context = rss_context;
+ 	rss->hfunc = req_hfunc;
++#ifdef ETHTOOL_ENABLE_RSS_INPUT_XFRM
+ 	rss->input_xfrm = req_input_xfrm;
++#else
++	if (req_input_xfrm != 0xff) {
++		perror("Compiled for kernel without support for input transformation");
++		err = 1;
++		goto free;
++	}
++#endif
+ 	if (delete) {
+ 		rss->indir_size = rss->key_size = 0;
+ 	} else {
diff --git a/package/network/utils/nftables/Makefile b/package/network/utils/nftables/Makefile
index 38a8199d11dc09..06b3fcfcdad7ad 100644
--- a/package/network/utils/nftables/Makefile
+++ b/package/network/utils/nftables/Makefile
@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=nftables
-PKG_VERSION:=1.0.9
+PKG_VERSION:=1.1.1
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://netfilter.org/projects/$(PKG_NAME)/files
-PKG_HASH:=a3c304cd9ba061239ee0474f9afb938a9bb99d89b960246f66f0c3a0a85e14cd
+PKG_HASH:=6358830f3a64f31e39b0ad421d7dadcd240b72343ded48d8ef13b8faf204865a
 
 PKG_MAINTAINER:=
 PKG_LICENSE:=GPL-2.0
diff --git a/package/network/utils/uqmi/Makefile b/package/network/utils/uqmi/Makefile
index 54e1b4fc7b16a2..1be3fcd9a2e5c8 100644
--- a/package/network/utils/uqmi/Makefile
+++ b/package/network/utils/uqmi/Makefile
@@ -1,13 +1,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=uqmi
-PKG_RELEASE:=2
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/uqmi.git
-PKG_SOURCE_DATE:=2024-08-25
-PKG_SOURCE_VERSION:=28b48a10dbcd1177095b73c6d8086d10114f49b8
-PKG_MIRROR_HASH:=ca4c07775185b873da572d973b9bbce86198d41d921a8d32b990da34e5ffd65d
+PKG_SOURCE_DATE:=2025-07-30
+PKG_SOURCE_VERSION:=7914da43cddaaf6cfba116260c81e6e9adffd5ab
+PKG_MIRROR_HASH:=5972a5f90bd60d34b5c7a8cec14ae98f13dbb6ea5b35d845ce5da7a8a3b0e59c
 PKG_MAINTAINER:=Matti Laakso <malaakso@elisanet.fi>
 
 PKG_LICENSE:=GPL-2.0
diff --git a/package/network/utils/uqmi/files/lib/netifd/proto/qmi.sh b/package/network/utils/uqmi/files/lib/netifd/proto/qmi.sh
index 8ec577a90b7823..a6a3fdaa693297 100755
--- a/package/network/utils/uqmi/files/lib/netifd/proto/qmi.sh
+++ b/package/network/utils/uqmi/files/lib/netifd/proto/qmi.sh
@@ -34,17 +34,20 @@ proto_qmi_init_config() {
 
 proto_qmi_setup() {
 	local interface="$1"
-	local dataformat connstat plmn_mode mcc mnc
-	local device apn v6apn auth username password pincode delay modes pdptype
-	local profile v6profile dhcp dhcpv6 autoconnect plmn timeout mtu $PROTO_DEFAULT_OPTIONS
-	local ip4table ip6table
-	local cid_4 pdh_4 cid_6 pdh_6
-	local ip_6 ip_prefix_length gateway_6 dns1_6 dns2_6
+
+	local connstat dataformat mcc mnc plmn_mode
+	local cid_4 cid_6 pdh_4 pdh_6
+	local dns1_6 dns2_6 gateway_6 ip_6 ip_prefix_length
 	local profile_pdptype
 
-	json_get_vars device apn v6apn auth username password pincode delay modes
-	json_get_vars pdptype profile v6profile dhcp dhcpv6 sourcefilter delegate autoconnect plmn ip4table
-	json_get_vars ip6table timeout mtu $PROTO_DEFAULT_OPTIONS
+	local delegate ip4table ip6table mtu sourcefilter $PROTO_DEFAULT_OPTIONS
+	json_get_vars delegate ip4table ip6table mtu sourcefilter $PROTO_DEFAULT_OPTIONS
+
+	local apn auth delay device modes password pdptype pincode username v6apn
+	json_get_vars apn auth delay device modes password pdptype pincode username v6apn
+
+	local profile v6profile dhcp dhcpv6 autoconnect plmn timeout
+	json_get_vars profile v6profile dhcp dhcpv6 autoconnect plmn timeout
 
 	[ "$timeout" = "" ] && timeout="10"
 
@@ -104,7 +107,7 @@ proto_qmi_setup() {
 	# Check if UIM application is stuck in illegal state
 	local uim_state_timeout=0
 	while true; do
-		json_load "$(uqmi -s -d "$device" -t 1000 --uim-get-sim-state)"
+		json_load "$(uqmi -s -d "$device" -t 2000 --uim-get-sim-state)"
 		json_get_var card_application_state card_application_state
 
 		# SIM card is either completely absent or state is labeled as illegal
@@ -119,7 +122,7 @@ proto_qmi_setup() {
 
 			if [ "$uim_state_timeout" -lt "$timeout" ] || [ "$timeout" = "0" ]; then
 				let uim_state_timeout++
-				sleep 1
+				sleep 5
 				continue
 			fi
 
diff --git a/package/system/apk/Makefile b/package/system/apk/Makefile
index 3e2066e2698f33..7176d64ef22b15 100644
--- a/package/system/apk/Makefile
+++ b/package/system/apk/Makefile
@@ -27,7 +27,7 @@ define Package/apk/default
   SECTION:=base
   CATEGORY:=Base system
   TITLE:=apk package manager
-  DEPENDS:=+zlib
+  DEPENDS:=@BROKEN +zlib
   URL:=$(PKG_SOURCE_URL)
   PROVIDES:=apk
 endef
@@ -36,6 +36,7 @@ define Package/apk-mbedtls
   $(Package/apk/default)
   TITLE += (mbedtls)
   DEPENDS +=+libmbedtls
+  DEFAULT:=y if USE_APK
   VARIANT:=mbedtls
   DEFAULT_VARIANT:=1
   CONFLICTS:=apk-openssl
diff --git a/package/system/ca-certificates/Makefile b/package/system/ca-certificates/Makefile
index 254d7b5178d89e..4febb647ac84ed 100644
--- a/package/system/ca-certificates/Makefile
+++ b/package/system/ca-certificates/Makefile
@@ -7,7 +7,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ca-certificates
-PKG_VERSION:=20240203
+PKG_VERSION:=20250419
 PKG_RELEASE:=1
 PKG_MAINTAINER:=
 
@@ -16,7 +16,7 @@ PKG_LICENSE_FILES:=debian/copyright
 
 PKG_SOURCE:=$(PKG_NAME)_$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@DEBIAN/pool/main/c/ca-certificates
-PKG_HASH:=3286d3fc42c4d11b7086711a85f865b44065ce05cf1fb5376b2abed07622a9c6
+PKG_HASH:=33b44ef78653ecd3f0f2f13e5bba6be466be2e7da72182f737912b81798ba5d2
 PKG_INSTALL:=1
 
 include $(INCLUDE_DIR)/package.mk
diff --git a/package/system/gpio-cdev/nu801/Makefile b/package/system/gpio-cdev/nu801/Makefile
index 82c04ccb415d1e..7724cd808bff66 100644
--- a/package/system/gpio-cdev/nu801/Makefile
+++ b/package/system/gpio-cdev/nu801/Makefile
@@ -3,6 +3,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=nu801
+PKG_FLAGS:=nonshared
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
diff --git a/package/system/mtd/src/linksys_bootcount.c b/package/system/mtd/src/linksys_bootcount.c
index bd06728696ce3f..3ec0b61718c3d8 100644
--- a/package/system/mtd/src/linksys_bootcount.c
+++ b/package/system/mtd/src/linksys_bootcount.c
@@ -69,12 +69,10 @@ struct bootcounter {
 	uint32_t checksum;
 };
 
-static char page[2048];
-
 int mtd_resetbc(const char *mtd)
 {
 	struct mtd_info_user mtd_info;
-	struct bootcounter *curr = (struct bootcounter *)page;
+	struct bootcounter *curr = NULL;
 	unsigned int i;
 	unsigned int bc_offset_increment;
 	int last_count = 0;
@@ -108,24 +106,37 @@ int mtd_resetbc(const char *mtd)
 	}
 
 	num_bc = mtd_info.size / bc_offset_increment;
+	curr = malloc(bc_offset_increment);
 
-	for (i = 0; i < num_bc; i++) {
-		pread(fd, curr, sizeof(*curr), i * bc_offset_increment);
+	if(curr == NULL) {
+		DLOG_ERR("Failed to allocate %u bytes from memory.", bc_offset_increment);
 
-		/* Existing code assumes erase is to 0xff; left as-is (2019) */
+		retval = -6;
+		goto out;
+	}
+
+	for (i = 0; i < num_bc; i++) {
+		ret = pread(fd, curr, sizeof(struct bootcounter), i * bc_offset_increment);
 
-		if (curr->magic != BOOTCOUNT_MAGIC &&
-		    curr->magic != 0xffffffff) {
-			DLOG_ERR("Unexpected magic %08x at offset %08x; aborting.",
-				 curr->magic, i * bc_offset_increment);
+		if(ret != sizeof(struct bootcounter)) {
+			DLOG_ERR("Failed to read boot-count log at offset 0x%08x.", i * bc_offset_increment);
 
-			retval = -2;
+			retval = -5;
 			goto out;
 		}
 
+		/* Existing code assumes erase is to 0xff; left as-is (2019) */
 		if (curr->magic == 0xffffffff)
 			break;
 
+		if (curr->magic != BOOTCOUNT_MAGIC || curr->checksum != curr->magic + curr->count) {
+			DLOG_ERR("Unexpected boot-count log at offset 0x%08x: magic 0x%08x boot count 0x%08x checksum 0x%08x; aborting.",
+				 i * bc_offset_increment, curr->magic, curr->count, curr->checksum);
+
+			retval = -2;
+			goto out;
+		}
+
 		last_count = curr->count;
 	}
 
@@ -182,6 +193,9 @@ int mtd_resetbc(const char *mtd)
 	}
 
 out:
+	if (curr != NULL)
+		free(curr);
+
 	close(fd);
 	return retval;
 }
diff --git a/package/system/openwrt-keyring/Makefile b/package/system/openwrt-keyring/Makefile
index 9344ec321d93b3..6c2fa3d108b6da 100644
--- a/package/system/openwrt-keyring/Makefile
+++ b/package/system/openwrt-keyring/Makefile
@@ -3,13 +3,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=openwrt-keyring
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/keyring.git
-PKG_SOURCE_DATE:=2024-09-28
-PKG_SOURCE_VERSION:=3c066ce24e80d8f537d582406930d60c7cafb251
-PKG_MIRROR_HASH:=27a52fd164d38cc57d052e0e04c95ac941ce90be6231c2eb85dcbbde9d3b916e
+PKG_SOURCE_DATE:=2024-11-01
+PKG_SOURCE_VERSION:=fbae29d730f81c892f52e0ff00fe867444aeeae6
+PKG_MIRROR_HASH:=9a314756ddb61dde084f810ef056835addd9097ad26cb5e66efc6b38debc8aa0
 
 PKG_MAINTAINER:=John Crispin <john@phrozen.org>
 PKG_LICENSE:=GPL-2.0
@@ -38,8 +38,8 @@ endef
 else
 define Package/openwrt-keyring/install
 	$(INSTALL_DIR) $(1)/etc/opkg/keys/
-	# Public usign key for unattended snapshot builds
-	$(INSTALL_DATA) $(PKG_BUILD_DIR)/usign/b5043e70f9a75cde $(1)/etc/opkg/keys/
+	# Public usign key for 24.10 release builds
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/usign/d310c6f2833e97f7 $(1)/etc/opkg/keys/
 endef
 endif
 
diff --git a/package/system/opkg/Makefile b/package/system/opkg/Makefile
index 9fea969ae96e0b..e7c45e3523135a 100644
--- a/package/system/opkg/Makefile
+++ b/package/system/opkg/Makefile
@@ -39,6 +39,7 @@ define Package/opkg
   CATEGORY:=Base system
   TITLE:=opkg package manager
   DEPENDS:=+uclient-fetch +libpthread +libubox
+  DEFAULT:=y if !USE_APK
   URL:=$(PKG_SOURCE_URL)
   MENU:=1
 endef
diff --git a/package/system/procd/Makefile b/package/system/procd/Makefile
index e07f3ec81d7cc1..65cc0ad9f65f74 100644
--- a/package/system/procd/Makefile
+++ b/package/system/procd/Makefile
@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/procd.git
-PKG_MIRROR_HASH:=3d15a68fb614c4d7e129dc1bbe8a79adcb3115753c2fc95a36fd03855efc7a58
-PKG_SOURCE_DATE:=2024-10-20
-PKG_SOURCE_VERSION:=ef3ab8bc8fb18216793dd0c8106dd222c560453a
+PKG_MIRROR_HASH:=41dbb5352eff931ecc78c4ce9a081645c26a7fb8dc57cdd6521a2f8d3a142567
+PKG_SOURCE_DATE:=2024-12-22
+PKG_SOURCE_VERSION:=42d3937654508b04da64969f9d764ac2ec411904
 CMAKE_INSTALL:=1
 
 PKG_LICENSE:=GPL-2.0
@@ -71,7 +71,7 @@ endef
 define Package/procd-seccomp
   SECTION:=base
   CATEGORY:=Base system
-  DEPENDS:=@SECCOMP +libubox +libblobmsg-json
+  DEPENDS:=@USE_SECCOMP +libubox +libblobmsg-json
   TITLE:=OpenWrt process seccomp helper + utrace
 endef
 
diff --git a/package/system/procd/files/procd.sh b/package/system/procd/files/procd.sh
index 5dc8ec42b7a4ef..0f9405a2220007 100644
--- a/package/system/procd/files/procd.sh
+++ b/package/system/procd/files/procd.sh
@@ -101,9 +101,11 @@ _procd_close_service() {
 	_procd_open_trigger
 	service_triggers
 	_procd_close_trigger
-	_procd_open_data
-	service_data
-	_procd_close_data
+	type service_data >/dev/null 2>&1 && {
+		_procd_open_data
+		service_data
+		_procd_close_data
+	}
 	_procd_ubus_call ${1:-set}
 }
 
@@ -306,6 +308,36 @@ _procd_add_reload_interface_trigger() {
 	_procd_close_trigger
 }
 
+_procd_add_data_trigger() {
+	json_add_array
+	_procd_add_array_data "service.data.update"
+
+	json_add_array
+	_procd_add_array_data "if"
+
+	json_add_array
+	_procd_add_array_data "eq" "name" "$1"
+	shift
+	json_close_array
+
+	json_add_array
+	_procd_add_array_data "run_script" "$@"
+	json_close_array
+
+	json_close_array
+	_procd_add_timeout
+	json_close_array
+}
+
+_procd_add_reload_data_trigger() {
+	local script=$(readlink "$initscript")
+	local name=$(basename ${script:-$initscript})
+
+	_procd_open_trigger
+	_procd_add_data_trigger $1 /etc/init.d/$name reload
+	_procd_close_trigger
+}
+
 _procd_add_config_trigger() {
 	json_add_array
 	_procd_add_array_data "$1"
@@ -659,6 +691,7 @@ _procd_wrapper \
 	procd_add_interface_trigger \
 	procd_add_mount_trigger \
 	procd_add_reload_trigger \
+	procd_add_reload_data_trigger \
 	procd_add_reload_interface_trigger \
 	procd_add_action_mount_trigger \
 	procd_add_reload_mount_trigger \
diff --git a/package/system/rpcd/Makefile b/package/system/rpcd/Makefile
index da031db8498d0f..dd2d57f6e7af26 100644
--- a/package/system/rpcd/Makefile
+++ b/package/system/rpcd/Makefile
@@ -12,9 +12,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/rpcd.git
-PKG_MIRROR_HASH:=67b2cb985d8712a3e5a17ebf8c74fd35d553c8f9a4197616f9a3649a8740cc33
-PKG_SOURCE_DATE:=2024-09-17
-PKG_SOURCE_VERSION:=9f4b86e70352ab9ca6aa272d096419acc53e2390
+PKG_MIRROR_HASH:=6757b14e1b30acee50b64d70d5022ec9da6da71885df81d89b949d47790ba580
+PKG_SOURCE_DATE:=2025-09-01
+PKG_SOURCE_VERSION:=bba95191ff2f22c9118a1ba1355b83afaa277ae3
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 
 PKG_LICENSE:=ISC
diff --git a/package/system/ubus/Makefile b/package/system/ubus/Makefile
index bef5e622d7067f..7e23beb2325272 100644
--- a/package/system/ubus/Makefile
+++ b/package/system/ubus/Makefile
@@ -5,10 +5,11 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/ubus.git
-PKG_SOURCE_DATE:=2024-10-20
-PKG_SOURCE_VERSION:=252a9b0c1774790fb9c25735d5a09c27dba895db
-PKG_MIRROR_HASH:=72c21f02710d2314447670f1f1ea1833d2961f65fea3f9f94c060dda7c9d5914
-PKG_ABI_VERSION:=$(call abi_version_str,$(PKG_SOURCE_DATE))
+PKG_SOURCE_DATE:=2025-07-02
+PKG_SOURCE_DATE_ABI:=2025-01-02
+PKG_SOURCE_VERSION:=5952b48e251c0ea76dfce97f129da6f18d889eda
+PKG_MIRROR_HASH:=60edfc101eaa85976d243febc368fc419fe44283bd3a743851a6bc7975e881f0
+PKG_ABI_VERSION:=$(call abi_version_str,$(PKG_SOURCE_DATE_ABI))
 CMAKE_INSTALL:=1
 
 PKG_LICENSE:=LGPL-2.1
diff --git a/package/system/uci/Makefile b/package/system/uci/Makefile
index c8f661c68434f8..6e4d8da97c755e 100644
--- a/package/system/uci/Makefile
+++ b/package/system/uci/Makefile
@@ -13,9 +13,10 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/uci.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2023-08-10
-PKG_SOURCE_VERSION:=5781664d5087ccc4b5ab58505883231212dbedbc
-PKG_MIRROR_HASH:=0ca4a29c077e85a7cfe69916c3ceb2bee98662b6268befc3c02519939647f984
+PKG_SOURCE_DATE:=2025-01-20
+PKG_SOURCE_VERSION:=16ff0badbde7e17ec3bd1f827ffe45922956cf86
+PKG_MIRROR_HASH:=e91ee4a2c0baaafe1d8ccd5321de70a8412a50323b0b27bbc7ad145e77018a22
+PKG_ABI_VERSION:=20250120
 
 PKG_LICENSE:=LGPL-2.1
 PKG_LICENSE_FILES:=
@@ -33,7 +34,7 @@ define Package/libuci
   CATEGORY:=Libraries
   TITLE:=C library for the Unified Configuration Interface (UCI)
   DEPENDS:=+libubox
-  ABI_VERSION:=20130104
+  ABI_VERSION:=$(PKG_ABI_VERSION)
 endef
 
 define Package/uci
@@ -55,11 +56,12 @@ TARGET_LDFLAGS += -L$(STAGING_DIR)/usr/lib
 
 CMAKE_OPTIONS += \
 	-DLUAPATH=/usr/lib/lua \
+	-DABIVERSION=$(PKG_ABI_VERSION) \
 	$(if $(DEBUG),-DUCI_DEBUG=ON)
 
 define Package/libuci/install
 	$(INSTALL_DIR) $(1)/lib
-	$(CP) $(PKG_BUILD_DIR)/libuci.so* $(1)/lib/
+	$(CP) $(PKG_BUILD_DIR)/libuci.so.* $(1)/lib/
 endef
 
 define Package/libuci-lua/install
diff --git a/package/utils/bcm27xx-utils/Makefile b/package/utils/bcm27xx-utils/Makefile
index 8f5d91da8f1357..f1aafd666a673e 100644
--- a/package/utils/bcm27xx-utils/Makefile
+++ b/package/utils/bcm27xx-utils/Makefile
@@ -3,13 +3,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=bcm27xx-utils
-PKG_VERSION:=2024.10.25
+PKG_VERSION:=2025.03.14
 PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/raspberrypi/utils.git
-PKG_SOURCE_VERSION:=6a2a6becebbc38fde34a94386457ac8210f9119b
-PKG_MIRROR_HASH:=a775c7ffb9fac2d798ec8e0a4c7707eb7133cbc9c4418a1cf9434f87c42c01bb
+PKG_SOURCE_VERSION:=685afa8c0d6f2310eaefe1b528627a8bf3154ca0
+PKG_MIRROR_HASH:=04528742fc5b55ba31f448a27588a9df707cbcc27823c1d219b7f877dd4ac200
 
 PKG_FLAGS:=nonshared
 PKG_BUILD_FLAGS:=no-lto
diff --git a/package/utils/bcm27xx-utils/patches/0002-cmake-disable-piolib.patch b/package/utils/bcm27xx-utils/patches/0002-cmake-disable-piolib.patch
new file mode 100644
index 00000000000000..37f8a3a7e7ba9c
--- /dev/null
+++ b/package/utils/bcm27xx-utils/patches/0002-cmake-disable-piolib.patch
@@ -0,0 +1,24 @@
+From 5249e68da31d11e0beaf9fd76a6d17ac04198b26 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=81lvaro=20Fern=C3=A1ndez=20Rojas?= <noltari@gmail.com>
+Date: Sat, 28 Dec 2024 09:42:00 +0100
+Subject: [PATCH] cmake: disable piolib
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
+---
+ CMakeLists.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -10,7 +10,7 @@ add_subdirectory(otpset)
+ add_subdirectory(overlaycheck)
+ add_subdirectory(ovmerge)
+ add_subdirectory(pinctrl)
+-add_subdirectory(piolib)
++# add_subdirectory(piolib)
+ add_subdirectory(raspinfo)
+ add_subdirectory(vcgencmd)
+ add_subdirectory(vclog)
diff --git a/package/utils/busybox/Makefile b/package/utils/busybox/Makefile
index 4ef470df755890..e3b9f256e0c797 100644
--- a/package/utils/busybox/Makefile
+++ b/package/utils/busybox/Makefile
@@ -48,7 +48,7 @@ define Package/busybox/Default
   MAINTAINER:=Felix Fietkau <nbd@nbd.name>
   TITLE:=Core utilities for embedded Linux
   URL:=http://busybox.net/
-  DEPENDS:=+BUSYBOX_CONFIG_PAM:libpam +BUSYBOX_CONFIG_NTPD:jsonfilter
+  DEPENDS:=+BUSYBOX_CONFIG_PAM:libpam +BUSYBOX_CONFIG_NTPD:jsonfilter +(USE_GLIBC&&BUSYBOX_CONFIG_FEATURE_MOUNT_NFS)||(USE_GLIBC&&BUSYBOX_CONFIG_FEATURE_INETD_RPC):libtirpc
   USERID:=ntp=123:ntp=123
 endef
 
@@ -104,6 +104,13 @@ ifeq ($(CONFIG_USE_GLIBC),y)
   LDLIBS += $(call BUSYBOX_IF_ENABLED,NSLOOKUP,resolv)
 endif
 
+ifneq ($(CONFIG_BUSYBOX_$(BUSYBOX_SYM)_FEATURE_MOUNT_NFS)$(CONFIG_BUSYBOX_$(BUSYBOX_SYM)_FEATURE_INETD_RPC),)
+ifndef CONFIG_USE_MUSL
+  TARGET_CFLAGS += -I$(STAGING_DIR)/usr/include/tirpc
+  LDLIBS += tirpc
+endif
+endif
+
 ifeq ($(BUILD_VARIANT),selinux)
   LDLIBS += selinux sepol
 endif
@@ -111,7 +118,7 @@ endif
 MAKE_VARS :=
 MAKE_FLAGS += \
 	EXTRA_CFLAGS="$(TARGET_CFLAGS) $(TARGET_CPPFLAGS)" \
-	EXTRA_LDFLAGS="$(TARGET_LDFLAGS)" \
+	EXTRA_LDFLAGS="$(TARGET_LDFLAGS) $(TARGET_CFLAGS)" \
 	LDLIBS="$(LDLIBS)" \
 	LD="$(TARGET_CC)" \
 	SKIP_STRIP=y
diff --git a/package/utils/busybox/patches/600-loginutils-login.c-libselinux-get_default_context-ex.patch b/package/utils/busybox/patches/600-loginutils-login.c-libselinux-get_default_context-ex.patch
new file mode 100644
index 00000000000000..8c26ee001bbe9b
--- /dev/null
+++ b/package/utils/busybox/patches/600-loginutils-login.c-libselinux-get_default_context-ex.patch
@@ -0,0 +1,51 @@
+From 850a6d031039237b0b13d8fab9f10a7cd4752907 Mon Sep 17 00:00:00 2001
+From: Dominick Grift <dominick.grift@defensec.nl>
+Date: Sat, 5 Apr 2025 13:40:26 +0200
+Subject: [PATCH] loginutils/login.c: libselinux get_default_context() expects
+ seuser
+
+Use getseuserbyname() to get the seuser associated with username and use that
+instead with get_default_context()
+
+>From get_default_context.3:
+"These functions takes a SELinux user identity that must be defined in the SELinux policy as their input, not a Linux username."
+
+Fixes: #19075
+Upstream-Status: Submitted [https://lists.busybox.net/pipermail/busybox/2025-April/091407.html]
+Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
+---
+ loginutils/login.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/loginutils/login.c
++++ b/loginutils/login.c
+@@ -183,12 +183,16 @@ static void die_if_nologin(void)
+ static void initselinux(char *username, char *full_tty,
+ 						security_context_t *user_sid)
+ {
++	char *seuser = NULL, *level = NULL;
+ 	security_context_t old_tty_sid, new_tty_sid;
+ 
+ 	if (!is_selinux_enabled())
+ 		return;
+ 
+-	if (get_default_context(username, NULL, user_sid)) {
++	if (getseuserbyname(username, &seuser, &level)) {
++		bb_error_msg_and_die("can't get seuser for %s", username);
++	}
++	if (get_default_context(seuser, NULL, user_sid)) {
+ 		bb_error_msg_and_die("can't get SID for %s", username);
+ 	}
+ 	if (getfilecon(full_tty, &old_tty_sid) < 0) {
+@@ -201,6 +205,11 @@ static void initselinux(char *username,
+ 	if (setfilecon(full_tty, new_tty_sid) != 0) {
+ 		bb_perror_msg_and_die("chsid(%s, %s) failed", full_tty, new_tty_sid);
+ 	}
++
++	if (ENABLE_FEATURE_CLEAN_UP) {
++		free(seuser);
++		free(level);
++	}
+ }
+ #endif
+ 
diff --git a/package/utils/debugcc/Makefile b/package/utils/debugcc/Makefile
index 3e26cea7e510c0..c3821cd8c6eb68 100644
--- a/package/utils/debugcc/Makefile
+++ b/package/utils/debugcc/Makefile
@@ -11,6 +11,7 @@ PKG_MIRROR_HASH:=4cd7a770a05db28f496a60eb9fe015a4af677bba05053b4d4be21adcf95e52e
 
 PKG_LICENSE:=BSD-3-Clause
 PKG_LICENSE_FILES:=LICENSE
+PKG_FLAGS:=nonshared
 
 PKG_MAINTAINER:=Christian Marangi <ansuelsmth@gmail.com>
 
diff --git a/package/utils/fritz-tools/Makefile b/package/utils/fritz-tools/Makefile
index 6e20b56ff8a7ca..b43fe20e9e7555 100644
--- a/package/utils/fritz-tools/Makefile
+++ b/package/utils/fritz-tools/Makefile
@@ -1,7 +1,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=fritz-tools
-PKG_RELEASE:=2
+PKG_RELEASE:=3
 CMAKE_INSTALL:=1
 
 include $(INCLUDE_DIR)/package.mk
diff --git a/package/utils/fritz-tools/src/fritz_cal_extract.c b/package/utils/fritz-tools/src/fritz_cal_extract.c
index 2978d86e0cc48e..c4547bc7e05d26 100644
--- a/package/utils/fritz-tools/src/fritz_cal_extract.c
+++ b/package/utils/fritz-tools/src/fritz_cal_extract.c
@@ -8,6 +8,9 @@
  * that is Not copyrighted -- provided to the public domain
  * Version 1.4  11 December 2005  Mark Adler
  *
+ * Modifications to also handle calibration data in reversed byte order
+ * (c) 2024 by <dzsoftware@posteo.org>.
+ *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
@@ -28,106 +31,126 @@
 #include <assert.h>
 #include <unistd.h>
 #include <stdint.h>
+#include <stdbool.h>
 #include <stdlib.h>
 #include <endian.h>
 #include <errno.h>
 #include "zlib.h"
 
 #define CHUNK 1024
+#define DEFAULT_BUFFERSIZE (129 * 1024)
+
+#define MIN(a,b) (((a)<(b))?(a):(b))
 
-static inline size_t special_min(size_t a, size_t b)
+/* Reverse byte order in data buffer.
+ * 'top' is position of last valid data byte = (datasize - 1)
+ */
+static void buffer_reverse(unsigned char *data, unsigned int top)
 {
-	return a == 0 ? b : (a < b ? a : b);
+	register unsigned char swapbyte;
+	const unsigned int center = top / 2;
+
+	for (unsigned int bottom = 0; bottom < center; ++bottom, --top) {
+		swapbyte = data[bottom];
+		data[bottom] = data[top];
+		data[top] = swapbyte;
+	}
 }
 
-/* Decompress from file source to file dest until stream ends or EOF.
-   inf() returns Z_OK on success, Z_MEM_ERROR if memory could not be
-   allocated for processing, Z_DATA_ERROR if the deflate data is
-   invalid or incomplete, Z_VERSION_ERROR if the version of zlib.h and
-   the version of the library linked do not match, or Z_ERRNO if there
-   is an error reading or writing the files. */
-static int inf(FILE *source, FILE *dest, size_t limit, size_t skip)
+/* Decompress from file source to data buffer until stream ends
+ * or *limit bytes have been written to buffer.
+ *
+ * On call, 'limit' must reference a variable containing the intended
+ * number of bytes to retrieve (must be <= allocated buffer size).
+ *
+ * Return values (success):
+ * Z_END_STREAM if complete data was retrieved (*limit == size of complete data),
+ * or Z_OK if data was retrieved up to limit (*limit == original value).
+ *
+ * Return values (failure):
+ * Z_MEM_ERROR if memory could not be allocated for processing, 
+ * Z_DATA_ERROR if the deflate data is invalid or incomplete, 
+ * Z_VERSION_ERROR if the version of zlib.h and the version of the 
+ * library linked do not match, or 
+ * Z_ERRNO if there is an error reading or writing the files.
+ */
+static int inflate_to_buffer(FILE *source, unsigned char *buf, size_t *limit)
 {
-    int ret;
-    size_t have;
-    z_stream strm;
-    unsigned char in[CHUNK];
-    unsigned char out[CHUNK];
-
-    /* allocate inflate state */
-    strm.zalloc = Z_NULL;
-    strm.zfree = Z_NULL;
-    strm.opaque = Z_NULL;
-    strm.avail_in = 0;
-    strm.next_in = Z_NULL;
-    ret = inflateInit(&strm);
-    if (ret != Z_OK)
-        return ret;
-
-    /* decompress until deflate stream ends or end of file */
-    do {
-        strm.avail_in = fread(in, 1, CHUNK, source);
-        if (ferror(source)) {
-            (void)inflateEnd(&strm);
-            return Z_ERRNO;
-        }
-        if (strm.avail_in == 0)
-            break;
-        strm.next_in = in;
-
-        /* run inflate() on input until output buffer not full */
-        do {
-            strm.avail_out = CHUNK;
-            strm.next_out = out;
-            ret = inflate(&strm, Z_NO_FLUSH);
-            assert(ret != Z_STREAM_ERROR);  /* state not clobbered */
-            switch (ret) {
-            case Z_NEED_DICT:
-                ret = Z_DATA_ERROR;     /* and fall through */
-            case Z_DATA_ERROR:
-            case Z_MEM_ERROR:
-                (void)inflateEnd(&strm);
-                return ret;
-            }
-            have = special_min(limit, CHUNK - strm.avail_out) - skip;
-            if (fwrite(&out[skip], have, 1, dest) != 1 || ferror(dest)) {
-                (void)inflateEnd(&strm);
-                return Z_ERRNO;
-            }
-	    skip = 0;
-	    limit -= have;
-        } while (strm.avail_out == 0 && limit > 0);
-
-        /* done when inflate() says it's done */
-    } while (ret != Z_STREAM_END && limit > 0);
-
-    /* clean up and return */
-    (void)inflateEnd(&strm);
-    return (limit == 0 ? Z_OK : (ret == Z_STREAM_END ? Z_OK : Z_DATA_ERROR));
+	int ret;
+	z_stream strm;
+	unsigned char in[CHUNK];
+
+	/* allocate inflate state */
+	strm.zalloc = Z_NULL;
+	strm.zfree = Z_NULL;
+	strm.opaque = Z_NULL;
+	strm.avail_in = 0;
+	strm.next_in = Z_NULL;
+	ret = inflateInit(&strm);
+	if (ret != Z_OK)
+		return ret;
+
+	/* set data buffer as stream output */
+	strm.avail_out = *limit;
+	strm.next_out = buf;
+
+	/* decompress until deflate stream ends or end of file */
+	do {
+		strm.avail_in = fread(in, 1, CHUNK, source);
+		if (ferror(source)) {
+			(void)inflateEnd(&strm);
+			return Z_ERRNO;
+		}
+		if (strm.avail_in == 0)
+			break;
+		strm.next_in = in;
+
+		/* run inflate(), fill data buffer with all available output */
+		ret = inflate(&strm, Z_FINISH);
+		assert(ret != Z_STREAM_ERROR);  /* state not clobbered */
+
+		switch (ret) {
+			case Z_NEED_DICT:
+				ret = Z_DATA_ERROR;     /* and fall through */
+			case Z_DATA_ERROR:
+			case Z_MEM_ERROR:
+				(void)inflateEnd(&strm);
+				return ret;
+		}
+		/* done when inflate() says it's done or limit reached */
+	} while (ret != Z_STREAM_END && strm.avail_out > 0);
+
+	/* set limit to end of retrieved data */
+	assert(strm.total_out <= *limit);
+	*limit = strm.total_out;
+
+	/* clean up and return */
+	(void)inflateEnd(&strm);
+	return (ret == Z_STREAM_END ? Z_STREAM_END : (strm.avail_out == 0 ? Z_OK : Z_DATA_ERROR));
 }
 
 /* report a zlib or i/o error */
 static void zerr(int ret)
 {
-    switch (ret) {
-    case Z_ERRNO:
-        if (ferror(stdin))
-            fputs("error reading stdin\n", stderr);
-        if (ferror(stdout))
-            fputs("error writing stdout\n", stderr);
-        break;
-    case Z_STREAM_ERROR:
-        fputs("invalid compression level\n", stderr);
-        break;
-    case Z_DATA_ERROR:
-        fputs("invalid or incomplete deflate data\n", stderr);
-        break;
-    case Z_MEM_ERROR:
-        fputs("out of memory\n", stderr);
-        break;
-    case Z_VERSION_ERROR:
-        fputs("zlib version mismatch!\n", stderr);
-    }
+	switch (ret) {
+	case Z_ERRNO:
+		if (ferror(stdin))
+			fputs("error reading stdin\n", stderr);
+		if (ferror(stdout))
+			fputs("error writing stdout\n", stderr);
+		break;
+	case Z_STREAM_ERROR:
+		fputs("invalid compression level\n", stderr);
+		break;
+	case Z_DATA_ERROR:
+		fputs("invalid or incomplete deflate data\n", stderr);
+		break;
+	case Z_MEM_ERROR:
+		fputs("out of memory\n", stderr);
+		break;
+	case Z_VERSION_ERROR:
+		fputs("zlib version mismatch!\n", stderr);
+	}
 }
 
 static unsigned int get_num(char *str)
@@ -140,7 +163,8 @@ static unsigned int get_num(char *str)
 
 static void usage(void)
 {
-	fprintf(stderr, "Usage: fritz_cal_extract [-s seek offset] [-i skip] [-o output file] [-l limit] [infile] -e entry_id\n"
+	fprintf(stderr, "Usage: fritz_cal_extract -e entry_id [-s seek offset] [-l limit]\n"
+			"\t[-r reverse extracted data] [-i skip n bytes] [-o output file] [infile]\n"
 			"Finds and extracts zlib compressed calibration data in the EVA loader\n");
 	exit(EXIT_FAILURE);
 }
@@ -154,15 +178,18 @@ struct cal_entry {
 int main(int argc, char **argv)
 {
 	struct cal_entry cal = { .len = 0 };
+	unsigned char *buf = NULL;
 	FILE *in = stdin;
 	FILE *out = stdout;
+	size_t datasize = DEFAULT_BUFFERSIZE;
 	size_t limit = 0, skip = 0;
 	int initial_offset = 0;
 	int entry = -1;
+	bool reversed = false, limit_was_set = true;
 	int ret;
 	int opt;
 
-	while ((opt = getopt(argc, argv, "s:e:o:l:i:")) != -1) {
+	while ((opt = getopt(argc, argv, "s:e:o:l:i:r")) != -1) {
 		switch (opt) {
 		case 's':
 			initial_offset = (int)get_num(optarg);
@@ -199,6 +226,9 @@ int main(int argc, char **argv)
 				goto out_bad;
 			}
 			break;
+		case 'r':
+			reversed = true;
+			break;
 		default: /* '?' */
 			usage();
 		}
@@ -243,11 +273,50 @@ int main(int argc, char **argv)
 		goto out_bad;
 	}
 
-	ret = inf(in, out, limit, skip);
-	if (ret == Z_OK)
-		goto out;
+	/* Set boundaries. Only keep default datasize if we need complete data
+	 * for reversal and didn't set a higher limit. */
+	if (!limit) {
+		limit_was_set = false;
+		limit = datasize - skip;
+	}
+	datasize = (reversed && datasize >= limit + skip) ? datasize : (limit + skip);
+
+	/* Create data buffer. */
+	buf = malloc(datasize);
+	assert(buf != NULL);
+
+	ret = inflate_to_buffer(in, buf, &datasize);
+
+	if ((reversed || !limit_was_set) && ret != Z_STREAM_END) { /* didn't read to stream end */
+		fprintf(stderr, "Failed: Data exceeds buffer size of %u. Refusing to reverse"
+				" or store incomplete data."
+				" Use a higher limit [-l] to increase buffer size.\n",
+				(unsigned int) datasize);
+		goto out_bad;
+	}
+
+	ret = (ret == Z_STREAM_END) ? Z_OK : ret; /* normalize return value */
+	if (ret != Z_OK) {
+		zerr(ret);
+		goto out_bad;
+	}
+
+	if (reversed)
+		buffer_reverse(buf, datasize - 1);
+
+	if (datasize <= skip) {
+		fprintf(stderr, "Failed to skip %u bytes, total data size is %u!\n", 
+				(unsigned int)skip, (unsigned int)datasize);
+		goto out_bad;
+	}
+
+	limit = MIN(limit, datasize - skip);
+	if (fwrite(&buf[skip], limit, 1, out) != 1 || ferror(out)) {
+		fprintf(stderr, "Failed to write data buffer to output file");
+		goto out_bad;
+	}
 
-	zerr(ret);
+	goto out;
 
 out_bad:
 	ret = EXIT_FAILURE;
@@ -257,5 +326,6 @@ int main(int argc, char **argv)
 		fclose(in);
 	if (out)
 		fclose(out);
+	free(buf);
 	return ret;
 }
diff --git a/package/utils/jsonfilter/Makefile b/package/utils/jsonfilter/Makefile
index d249ea1a369da7..928ba1207b314e 100644
--- a/package/utils/jsonfilter/Makefile
+++ b/package/utils/jsonfilter/Makefile
@@ -5,9 +5,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/jsonpath.git
-PKG_SOURCE_DATE:=2024-01-23
-PKG_SOURCE_VERSION:=594cfa86469c005972ba750614f5b3f1af84d0f6
-PKG_MIRROR_HASH:=2f455f04fbfcdb4c81cccd23475b47395f847db44aa4bd9a1007b9aa0ab7fd19
+PKG_SOURCE_DATE:=2025-04-18
+PKG_SOURCE_VERSION:=8a86fb78235b5d7925b762b7b0934517890cc034
+PKG_MIRROR_HASH:=06b763387d00faae0e62af68626588ff2b8f12e0e6821950ae5422033df32757
 CMAKE_INSTALL:=1
 
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
diff --git a/package/utils/mdadm/Makefile b/package/utils/mdadm/Makefile
index c2778fe351cb3a..b521daaefc92b2 100644
--- a/package/utils/mdadm/Makefile
+++ b/package/utils/mdadm/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=mdadm
 PKG_VERSION:=4.3
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/linux/utils/raid/mdadm
diff --git a/package/utils/mdadm/patches/060-gcc14.patch b/package/utils/mdadm/patches/060-gcc14.patch
new file mode 100644
index 00000000000000..545a40ac0ac563
--- /dev/null
+++ b/package/utils/mdadm/patches/060-gcc14.patch
@@ -0,0 +1,24 @@
+From 8bda86099089b44129ef6206764f9de47a45f0db Mon Sep 17 00:00:00 2001
+From: Alexander Kanavin <alex@linutronix.de>
+Date: Tue, 12 Mar 2024 11:01:50 +0100
+Subject: [PATCH] util.c: add limits.h include for NAME_MAX definition
+
+Add limits.h include for NAME_MAX definition.
+
+Signed-off-by: Alexander Kanavin <alex@linutronix.de>
+Signed-off-by: Mariusz Tkaczyk <mariusz.tkaczyk@linux.intel.com>
+---
+ util.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/util.c
++++ b/util.c
+@@ -36,7 +36,7 @@
+ #include	<ctype.h>
+ #include	<dirent.h>
+ #include	<dlfcn.h>
+-
++#include	<limits.h>
+ 
+ /*
+  * following taken from linux/blkpg.h because they aren't
diff --git a/package/utils/mtd-utils/Makefile b/package/utils/mtd-utils/Makefile
index 046572e83b415b..0dc88312514641 100644
--- a/package/utils/mtd-utils/Makefile
+++ b/package/utils/mtd-utils/Makefile
@@ -65,12 +65,20 @@ CONFIGURE_ARGS += \
 	--without-lzo \
 	--without-zlib
 
+define Package/ubi-utils/conffiles
+/etc/config/ubihealthd
+endef
+
 define Package/ubi-utils/install
 	$(INSTALL_DIR) $(1)/usr/sbin
 	$(INSTALL_BIN) \
-		$(PKG_INSTALL_DIR)/usr/sbin/{ubiattach,ubicrc32,ubiblock,ubidetach,ubiformat,ubimkvol} $(1)/usr/sbin/
+		$(PKG_INSTALL_DIR)/usr/sbin/{ubiattach,ubicrc32,ubiblock,ubidetach,ubiformat,ubihealthd} $(1)/usr/sbin/
 	$(INSTALL_BIN) \
-		$(PKG_INSTALL_DIR)/usr/sbin/{ubinfo,ubinize,ubirename,ubirmvol,ubirsvol,ubiupdatevol} $(1)/usr/sbin/
+		$(PKG_INSTALL_DIR)/usr/sbin/{ubimkvol,ubinfo,ubinize,ubirename,ubirmvol,ubirsvol,ubiupdatevol} $(1)/usr/sbin/
+	$(INSTALL_DIR) $(1)/etc/init.d
+	$(INSTALL_BIN) ./files/ubihealthd.init $(1)/etc/init.d/ubihealthd
+	$(INSTALL_DIR) $(1)/etc/uci-defaults
+	$(INSTALL_DATA) ./files/ubihealthd.defaults $(1)/etc/uci-defaults/ubihealthd
 endef
 
 define Package/nand-utils/install
diff --git a/package/utils/mtd-utils/files/ubihealthd.defaults b/package/utils/mtd-utils/files/ubihealthd.defaults
new file mode 100644
index 00000000000000..5222961bd48ddb
--- /dev/null
+++ b/package/utils/mtd-utils/files/ubihealthd.defaults
@@ -0,0 +1,18 @@
+#!/bin/sh
+
+[ -e "/etc/config/ubihealthd" ] && exit 0
+[ ! -e "/sys/class/ubi" ] && exit 0
+
+touch  "/etc/config/ubihealthd"
+
+for ubidev in /sys/class/ubi/*/total_eraseblocks; do
+	ubidev="${ubidev%/*}"
+	ubidev="${ubidev##*/}"
+	uci batch <<EOF
+set ubihealthd.$ubidev=ubi-device
+set ubihealthd.$ubidev.device="/dev/$ubidev"
+set ubihealthd.$ubidev.enable=1
+EOF
+done
+
+uci commit ubihealthd
diff --git a/package/utils/mtd-utils/files/ubihealthd.init b/package/utils/mtd-utils/files/ubihealthd.init
new file mode 100644
index 00000000000000..c5ec97b22e7c6d
--- /dev/null
+++ b/package/utils/mtd-utils/files/ubihealthd.init
@@ -0,0 +1,27 @@
+#!/bin/sh /etc/rc.common
+
+START=99
+
+USE_PROCD=1
+PROG=/usr/sbin/ubihealthd
+
+ubihealthd_instance() {
+	local cfg="$1"
+	local device interval enable
+
+	config_get_bool enable "$cfg" "enable" 1
+	[ "$enable" = "1" ] || return 0
+
+	config_get device "$cfg" "device"
+	config_get interval "$cfg" "interval"
+
+	procd_open_instance
+	procd_set_param command "$PROG" -f -d "$device"
+	[ -n "$interval" ] && procd_append_param command -i "$interval"
+	procd_close_instance
+}
+
+start_service() {
+	config_load ubihealthd
+	config_foreach ubihealthd_instance ubi-device
+}
diff --git a/package/utils/omnia-eeprom/Makefile b/package/utils/omnia-eeprom/Makefile
new file mode 100644
index 00000000000000..9418e93f4492bf
--- /dev/null
+++ b/package/utils/omnia-eeprom/Makefile
@@ -0,0 +1,57 @@
+#
+# Copyright (C) 2024 Marek Behún <kabel@kernel.org>
+#
+# This is free software, licensed under the GNU General Public License v2.
+# See /LICENSE for more information.
+#
+
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=omnia-eeprom
+PKG_VERSION:=0.1
+PKG_RELEASE:=1
+
+PKG_SOURCE_SUBDIR:=$(PKG_NAME)-v$(PKG_VERSION)
+PKG_SOURCE:=$(PKG_NAME)-v$(PKG_VERSION).tar.bz2
+PKG_SOURCE_URL:=https://gitlab.nic.cz/turris/omnia-eeprom/-/archive/v$(PKG_VERSION)/
+PKG_HASH:=6f949d0b8080adca8bae088774ce615b563ba6ec2807cce97ee6769b4eee7bbf
+PKG_FLAGS:=nonshared
+
+PKG_MAINTAINER:=Marek Behun <kabel@kernel.org>
+PKG_LICENSE:=GPL-2.0-or-later
+
+PKG_BUILD_DIR:=$(BUILD_DIR)/$(PKG_SOURCE_SUBDIR)
+
+include $(INCLUDE_DIR)/package.mk
+
+define Package/omnia-eeprom
+  SECTION:=utils
+  CATEGORY:=Utilities
+  URL:=https://gitlab.nic.cz/turris/omnia-eeprom
+  TITLE:=CZ.NIC Turris Omnia EEPROM accessing utility
+  DEPENDS:=@TARGET_mvebu_cortexa9 +kmod-eeprom-at24
+endef
+
+define Package/omnia-eeprom/description
+This package contains the omnia-eeprom utility, which allows you to display
+and update EEPROM fields on the Turris Omnia router.
+The EEPROM is normally not meant to be updated by users, but there are some
+exceptions where it might be useful.
+One such example is to change the DDR3 speed from the default 1600K mode to
+1333H mode, in order to solve random crashes that occur on some boards with
+newer versions of the U-Boot bootloader (because of bugs in newer versions of
+the DDR training algorithm).
+endef
+
+MAKE_VARS += OMNIA_EEPROM_VERSION="v$(PKG_VERSION)"
+
+TARGET_CFLAGS += -Wall
+
+Build/Compile = $(Build/Compile/Default)
+
+define Package/omnia-eeprom/install
+	$(INSTALL_DIR) $(1)/usr/bin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/omnia-eeprom $(1)/usr/bin/
+endef
+
+$(eval $(call BuildPackage,omnia-eeprom))
diff --git a/package/utils/omnia-mcutool/Makefile b/package/utils/omnia-mcutool/Makefile
index 2eca0cf1902474..66f8ffc6d4a86a 100644
--- a/package/utils/omnia-mcutool/Makefile
+++ b/package/utils/omnia-mcutool/Makefile
@@ -27,7 +27,7 @@ define Package/omnia-mcutool
   CATEGORY:=Utilities
   URL:=https://gitlab.nic.cz/turris/$(PKG_NAME)
   TITLE:=CZ.NIC Turris Omnia MCU utility
-  DEPENDS:=+libopenssl +omnia-mcu-firmware @TARGET_mvebu_cortexa9_DEVICE_cznic_turris-omnia
+  DEPENDS:=+libopenssl +omnia-mcu-firmware
 endef
 
 define Package/omnia-mcutool/description
diff --git a/package/utils/ucode/Makefile b/package/utils/ucode/Makefile
index 6ee0cf2a1d56b9..8ae1b91c1f213a 100644
--- a/package/utils/ucode/Makefile
+++ b/package/utils/ucode/Makefile
@@ -8,17 +8,18 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ucode
-PKG_RELEASE:=3
+PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=https://github.com/jow-/ucode.git
-PKG_SOURCE_DATE:=2024-07-22
-PKG_SOURCE_VERSION:=b610860dd4a0591ff586dd71a50f556a0ddafced
-PKG_MIRROR_HASH:=a5ec51dd989174422d3b19b022ff4f863d57eb559c9f08d54c0d10651f598357
+PKG_SOURCE_DATE:=2025-07-18
+PKG_SOURCE_VERSION:=3f64c8089bf3ea4847c96b91df09fbfcaec19e1d
+PKG_MIRROR_HASH:=55fbff7c527e1fadbda2e038636f39419649841ee63a5f3cdb50b9714b13420c
 PKG_MAINTAINER:=Jo-Philipp Wich <jo@mein.io>
 PKG_LICENSE:=ISC
 
 PKG_ABI_VERSION:=20230711
+PKG_BUILD_DEPENDS:=libmd
 HOST_BUILD_DEPENDS:=libjson-c/host
 
 include $(INCLUDE_DIR)/package.mk
@@ -51,7 +52,8 @@ CMAKE_HOST_OPTIONS += \
 	-DUCI_SUPPORT=OFF \
 	-DULOOP_SUPPORT=OFF \
 	-DDEBUG_SUPPORT=ON \
-	-DLOG_SUPPORT=OFF
+	-DLOG_SUPPORT=OFF \
+	-DDIGEST_SUPPORT=OFF
 
 
 define Package/ucode/default
@@ -178,6 +180,10 @@ $(eval $(call UcodeModule, \
 	uloop, ULOOP_SUPPORT, +libubox, \
 	The uloop module allows ucode scripts to interact with OpenWrt uloop event loop implementation.))
 
+$(eval $(call UcodeModule, \
+	digest, DIGEST_SUPPORT, , \
+	The digest module allows ucode scripts to use libmd digests.))
+
 $(eval $(call BuildPackage,libucode))
 $(eval $(call BuildPackage,ucode))
 
diff --git a/package/utils/ucode/patches/100-nl80211_vif_radio_mask.patch b/package/utils/ucode/patches/100-nl80211_vif_radio_mask.patch
deleted file mode 100644
index 22e05f7c620518..00000000000000
--- a/package/utils/ucode/patches/100-nl80211_vif_radio_mask.patch
+++ /dev/null
@@ -1,40 +0,0 @@
---- a/include/linux/nl80211.h
-+++ b/include/linux/nl80211.h
-@@ -2868,6 +2868,9 @@ enum nl80211_commands {
-  *	nested item, it contains attributes defined in
-  *	&enum nl80211_if_combination_attrs.
-  *
-+ * @NL80211_ATTR_VIF_RADIO_MASK: Bitmask of allowed radios (u32).
-+ *	A value of 0 means all radios.
-+ *
-  * @NUM_NL80211_ATTR: total number of nl80211_attrs available
-  * @NL80211_ATTR_MAX: highest attribute number currently defined
-  * @__NL80211_ATTR_AFTER_LAST: internal use
-@@ -3416,6 +3419,8 @@ enum nl80211_attrs {
- 	NL80211_ATTR_WIPHY_RADIOS,
- 	NL80211_ATTR_WIPHY_INTERFACE_COMBINATIONS,
- 
-+	NL80211_ATTR_VIF_RADIO_MASK,
-+
- 	/* add attributes here, update the policy in nl80211.c */
- 
- 	__NL80211_ATTR_AFTER_LAST,
---- a/lib/nl80211.c
-+++ b/lib/nl80211.c
-@@ -829,7 +829,7 @@ static const uc_nl_nested_spec_t nl80211
- 
- static const uc_nl_nested_spec_t nl80211_msg = {
- 	.headsize = 0,
--	.nattrs = 128,
-+	.nattrs = 129,
- 	.attrs = {
- 		{ NL80211_ATTR_4ADDR, "4addr", DT_U8, 0, NULL },
- 		{ NL80211_ATTR_AIRTIME_WEIGHT, "airtime_weight", DT_U16, 0, NULL },
-@@ -959,6 +959,7 @@ static const uc_nl_nested_spec_t nl80211
- 		{ NL80211_ATTR_MAX_AP_ASSOC_STA, "max_ap_assoc", DT_U16, 0, NULL },
- 		{ NL80211_ATTR_SURVEY_INFO, "survey_info", DT_NESTED, 0, &nl80211_survey_info_nla },
- 		{ NL80211_ATTR_WIPHY_RADIOS, "radios", DT_NESTED, DF_MULTIPLE|DF_AUTOIDX, &nl80211_wiphy_radio_nla },
-+		{ NL80211_ATTR_VIF_RADIO_MASK, "vif_radio_mask", DT_U32, 0, NULL },
- 	}
- };
- 
diff --git a/package/utils/ucode/patches/100-ucode-add-padding-to-uc_resource_ext_t.patch b/package/utils/ucode/patches/100-ucode-add-padding-to-uc_resource_ext_t.patch
new file mode 100644
index 00000000000000..f8a8cf29ccd67d
--- /dev/null
+++ b/package/utils/ucode/patches/100-ucode-add-padding-to-uc_resource_ext_t.patch
@@ -0,0 +1,21 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 21 Jul 2025 21:07:17 +0200
+Subject: [PATCH] ucode: add padding to uc_resource_ext_t
+
+This ensures that user data structures tied to the ext resource are aligned
+to 64 bit, as usually guaranteed by the memory allocator.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/include/ucode/types.h
++++ b/include/ucode/types.h
+@@ -213,6 +213,8 @@ typedef struct {
+ 	uint32_t persistent:1;
+ 	uint32_t uvcount:8;
+ 	uint32_t datasize:20;
++
++	uint32_t _pad;
+ } uc_resource_ext_t;
+ 
+ uc_declare_vector(uc_resource_types_t, uc_resource_type_t *);
diff --git a/package/utils/yafut/Makefile b/package/utils/yafut/Makefile
index 1e2ec7bc024d87..e3f240f75454df 100644
--- a/package/utils/yafut/Makefile
+++ b/package/utils/yafut/Makefile
@@ -11,6 +11,7 @@ PKG_SOURCE_VERSION:=38439f8a53d33b14744bc8f938662670b9d3e361
 
 PKG_LICENSE:=GPL-2.0
 PKG_LICENSE_FILES:=LICENSE
+PKG_FLAGS:=nonshared
 
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/cmake.mk
diff --git a/rules.mk b/rules.mk
index 973fd1cbb90ea3..54df407fca4b95 100644
--- a/rules.mk
+++ b/rules.mk
@@ -20,6 +20,11 @@ endif
 export TMP_DIR:=$(TOPDIR)/tmp
 export TMPDIR:=$(TMP_DIR)
 
+##@
+# @brief Strip quotes `"` and pounds `#` from string.
+#
+# @param 1: String.
+##
 qstrip=$(strip $(subst ",,$(1)))
 #"))
 
@@ -27,8 +32,23 @@ empty:=
 space:= $(empty) $(empty)
 comma:=,
 pound:=\#
+##@
+# @brief Merge strings by removing spaces.
+#
+# @param 1: String.
+##
 merge=$(subst $(space),,$(1))
+##@
+# @brief Get hash sum of variable list.
+#
+# @param 1: List of variable names.
+##
 confvar=$(shell echo '$(foreach v,$(1),$(v)=$(subst ','\'',$($(v))))' | $(MKHASH) md5)
+##@
+# @brief Strip last extension from file name.
+#
+# @param 1: File name.
+##
 strip_last=$(patsubst %.$(lastword $(subst .,$(space),$(1))),%,$(1))
 
 paren_left = (
@@ -51,9 +71,18 @@ __tr_head = $(subst $(paren_left)subst,$(paren_left)subst$(space),$(__tr_head_st
 __tr_tail = $(subst $(space),,$(foreach cv,$(1),$(paren_right)))
 __tr_template = $(__tr_head)$$(1)$(__tr_tail)
 
+##@
+# @brief Convert string characters to upper.
+##
 $(eval toupper = $(call __tr_template,$(chars_lower),$(chars_upper)))
+##@
+# @brief Convert string characters to lower.
+##
 $(eval tolower = $(call __tr_template,$(chars_upper),$(chars_lower)))
 
+##@
+# @brief Abbreviate version. Truncate to 8 characters.
+##
 version_abbrev = $(if $(if $(CHECK),,$(DUMP)),$(1),$(shell printf '%.8s' $(1)))
 
 _SINGLE=export MAKEFLAGS=$(space);
@@ -102,6 +131,13 @@ endif
 
 DEFAULT_SUBDIR_TARGETS:=clean download prepare compile update refresh prereq dist distcheck configure check check-depends
 
+##@
+# @brief Create default targets.
+#
+# Targets are created from @DEFAULT_SUBDIR_TARGETS and input argument lists.
+#
+# @param 1: Additional targets list.
+##
 define DefaultTargets
 $(foreach t,$(DEFAULT_SUBDIR_TARGETS) $(1),
   .$(t):
@@ -371,16 +407,28 @@ export BISON_PKGDATADIR:=$(STAGING_DIR_HOST)/share/bison
 export HOST_GNULIB_SRCDIR:=$(STAGING_DIR_HOST)/share/gnulib
 export M4:=$(STAGING_DIR_HOST)/bin/m4
 
+##@
+# @brief Slugify variable name and prepend suffix.
+##
 define shvar
 V_$(subst .,_,$(subst -,_,$(subst /,_,$(1))))
 endef
 
+##@
+# @brief Create and export variable, set to function result.
+#
+# @param 1: Function name. Used as variable name, prepended with `V_`.
+##
 define shexport
 export $(call shvar,$(1))=$$(call $(1))
 endef
 
+##@
+# @brief Support 64 bit tine in C code.
+#
 # Test support for 64-bit time with C code from largefile.m4 provided by GNU Gnulib
-# the value is 'y' when successful and '' otherwise
+# the value is `y` when successful and `` otherwise
+##
 define YEAR_2038
 $(shell \
   mkdir -p $(TMP_DIR); \
@@ -392,9 +440,12 @@ $(shell \
 )
 endef
 
-# Execute commands under flock
-# $(1) => The shell expression.
-# $(2) => The lock name. If not given, the global lock will be used.
+##@
+# @brief Execute commands under flock
+#
+# @param 1: The shell expression.
+# @param 2: The lock name. If not given, the global lock will be used.
+##
 ifneq ($(wildcard $(STAGING_DIR_HOST)/bin/flock),)
   define locked
 	SHELL= \
@@ -406,10 +457,14 @@ else
   locked=$(1)
 endif
 
-# Recursively copy paths into another directory, purge dangling
+
+##@
+# @brief Recursively copy paths into another directory, purge dangling
 # symlinks before.
-# $(1) => File glob expression
-# $(2) => Destination directory
+#
+# @param 1: File glob expression.
+# @param 1: Destination directory.
+##
 define file_copy
 	for src_dir in $(sort $(foreach d,$(wildcard $(1)),$(dir $(d)))); do \
 		( cd $$src_dir; find -type f -or -type d ) | \
@@ -424,19 +479,30 @@ define file_copy
 	$(CP) $(1) $(2)
 endef
 
-# Calculate sha256sum of any plain file within a given directory
-# $(1) => Input directory
-# $(2) => If set, recurse into subdirectories
+##@
+# @brief Calculate sha256sum of any plain file within a given directory.
+#
+# @param 1: Input directory.
+# @param 2: If set, recurse into subdirectories.
+##
 define sha256sums
 	(cd $(1); find . $(if $(2),,-maxdepth 1) -type f -not -name 'sha256sums' -printf "%P\n" | sort | \
 		xargs -r $(MKHASH) -n sha256 | sed -ne 's!^\(.*\) \(.*\)$$!\1 *\2!p' > sha256sums)
 endef
 
-# file extension
+##@
+# @brief Retrieve file extension.
+#
+# @param 1: File name.
+##
 ext=$(word $(words $(subst ., ,$(1))),$(subst ., ,$(1)))
 
-# Count Git commits of a package
-# $(1) => if non-empty: count commits since last ": [uU]pdate to " or ": [bB]ump to " in commit message
+##@
+# @brief Count Git commits of a package.
+#
+# @param 1: if non-empty: count commits since last ": [uU]pdate to "
+#           or ": [bB]ump to " in commit message.
+##
 define commitcount
 $(shell \
   if git log -1 >/dev/null 2>/dev/null; then \
@@ -458,6 +524,11 @@ $(shell \
 )
 endef
 
+##@
+# @brief Get ABI version string, stripping `-`, `_` and `.`.
+#
+# @param 1: Version string.
+##
 abi_version_str = $(subst -,,$(subst _,,$(subst .,,$(1))))
 
 COMMITCOUNT = $(if $(DUMP),0,$(call commitcount))
diff --git a/scripts/download-check-artifact.sh b/scripts/download-check-artifact.sh
new file mode 100755
index 00000000000000..bc0918b2146388
--- /dev/null
+++ b/scripts/download-check-artifact.sh
@@ -0,0 +1,159 @@
+#!/usr/bin/env bash
+# Script to perform verified file downloads.
+# Exit codes:
+#  0 - File downloaded successfully and verified
+#  1 - Failed to download requested file
+#  2 - Failed to download sha256sums file
+#  3 - Failed to download sha256sums.gpg file
+#  4 - GnuPG is available but fails to verify the signature (missing pubkey, file integrity error, ...)
+#  5 - The checksums do not match
+#  6 - Unable to copy the requested file to its final destination
+#  254 - The script got interrupted by a signal
+#  255 - A suitable download or checksum utility is missing
+
+[ -n "$1" ] || {
+	echo "$0 - Download and verify build artifacts"
+	echo "Usage: $0 <url>" >&2
+	exit 1
+}
+
+finish() {
+	[ -e "/tmp/verify.$$" ] && {
+		echo "Cleaning up."
+		rm -r "/tmp/verify.$$"
+	}
+	exit "$1"
+}
+
+trap "finish 254" INT TERM
+
+destdir="$(pwd)"
+image_url="$1"
+image_file="${image_url##*/}"
+sha256_url="${image_url%/*}/sha256sums"
+gpgsig_url="${image_url%/*}/sha256sums.asc"
+keyserver_url="hkp://keyserver.ubuntu.com"
+
+# Find a suitable download utility
+if which curl >/dev/null; then
+	download() { curl --progress-bar -o "$1" "$2"; }
+elif which wget >/dev/null; then
+	download() { wget -O "$1" "$2"; }
+elif which fetch >/dev/null; then
+	download() { fetch -o "$1" "$2"; }
+else
+	echo "No suitable download utility found, cannot download files!" >&2
+	finish 255
+fi
+
+# Find a suitable checksum utility
+if which sha256sum >/dev/null; then
+	checksum() { sha256sum -c --ignore-missing "sha256sums"; }
+elif which shasum >/dev/null; then
+	checksum() {
+		local sum
+		sum="$(shasum -a 256 "$image_file")";
+		grep -xF "${sum%% *} *$image_file" "sha256sums";
+	}
+else
+	echo "No SHA256 checksum executable installed, cannot verify checksums!" >&2
+	finish 255
+fi
+
+# Check for gpg availability
+if which gpg >/dev/null; then
+	runpgp() { gpg "$@"; }
+else
+	runpgp() {
+		echo "WARNING: No GnuPG installed, cannot verify digital signature!" >&2
+		return 0
+	}
+fi
+
+tmpdir="$(mktemp -d)"
+cd "$tmpdir" || {
+	echo "Failed to create temporary directory!" >&2
+	finish 255
+}
+
+echo ""
+echo "1) Downloading artifact file"
+echo "========================="
+download "$image_file" "$image_url" || {
+	echo "Failed to download image file!" >&2
+	finish 1
+}
+
+echo ""
+echo "2) Downloading checksum file"
+echo "============================"
+download "sha256sums" "$sha256_url" || {
+	echo "Failed to download checksum file!" >&2
+	finish 2
+}
+
+echo ""
+echo "3) Downloading the GPG signature"
+echo "================================"
+download "sha256sums.gpg" "$gpgsig_url" || {
+	echo "Failed to download GPG signature!" >&2
+	finish 3
+}
+
+echo ""
+echo "4) Verifying GPG signature"
+echo "=========================="
+missing_key=$(runpgp --status-fd 1 --with-fingerprint --verify \
+	"sha256sums.gpg" "sha256sums" 2>/dev/null | sed -ne 's!^.* NO_PUBKEY !!p')
+
+if [ -n "$missing_key" ]; then
+	echo "The signature was signed by a public key with the id $missing_key" >&2
+	echo "which is not present on this system."                              >&2
+	echo ""                                                                  >&2
+
+	echo "Provide a public keyserver url below or press enter to accept the" >&2
+	echo "default suggestion. Hit Ctrl-C to abort the operation."            >&2
+	echo ""                                                                  >&2
+
+	while true; do
+		printf 'Keyserver to use? [%s] > ' "$keyserver_url"
+		read -r url; case "${url:-$keyserver_url}" in
+			hkp://*)
+				gpg --keyserver "${url:-$keyserver_url}" --recv-keys "$missing_key" || {
+					echo "Failed to download public key." >&2
+					finish 7
+				}
+				break
+			;;
+			*)
+				echo "Expecting a key server url in the form 'hkp://hostname'." >&2
+			;;
+		esac
+	done
+fi
+
+runpgp --with-fingerprint --verify "sha256sums.gpg" "sha256sums" || {
+	echo "Failed to verify checksum file with GPG signature!" >&2
+	finish 4
+}
+
+echo ""
+echo "5) Verifying SHA256 checksum"
+echo "============================"
+checksum || {
+	echo "Checksums do not match!" >&2
+	finish 5
+}
+
+cp "$image_file" "$destdir/$image_file" || {
+	echo "Failed to write '$destdir/$image_file'" >&2
+	finish 6
+}
+
+echo ""
+echo "Verification done!"
+echo "=================="
+echo "Downloaded artifact placed in '$destdir/$image_file'."
+echo ""
+
+finish 0
diff --git a/scripts/feeds b/scripts/feeds
index d07c28bc50f8bd..959995c7afa171 100755
--- a/scripts/feeds
+++ b/scripts/feeds
@@ -157,12 +157,12 @@ my %update_method = (
 	'src-git' => {
 		'init'          => "git clone --depth 1 '%s' '%s'",
 		'init_branch'   => "git clone --depth 1 --branch '%s' '%s' '%s'",
-		'init_commit'   => "git clone '%s' '%s' && cd '%s' && git checkout -b '%s' '%s' && cd -",
+		'init_commit'   => "git clone --depth 1 '%s' '%s' && cd '%s' && git fetch --depth=1 origin '%s' && git -c advice.detachedHead=false checkout '%s' && cd -",
 		'update'	=> "git pull --ff-only",
 		'update_rebase'	=> "git pull --rebase=merges",
 		'update_stash'	=> "git pull --rebase=merges --autostash",
 		'update_force'	=> "git pull --ff-only || (git reset --hard HEAD; git pull --ff-only; exit 1)",
-		'post_update'	=> "git submodule update --init --recursive",
+		'post_update'	=> "git submodule update --init --recursive --depth 1",
 		'controldir'	=> ".git",
 		'revision'	=> "git rev-parse HEAD | tr -d '\n'"},
 	'src-git-full' => {
diff --git a/scripts/ipkg-remove b/scripts/ipkg-remove
index f4957004c0ebca..19d7148e83c5a4 100755
--- a/scripts/ipkg-remove
+++ b/scripts/ipkg-remove
@@ -3,17 +3,24 @@
 sourcename="$1"; shift
 
 for pkg in "$@"; do
-	tar -Ozxf "$pkg" ./control.tar.gz 2>/dev/null | tar -Ozxf - ./control 2>/dev/null | \
-	while read field value; do
-		if [ "$field" = "SourceName:" ] && [ "$value" = "$sourcename" ]; then
-			rm -vf "$pkg"
-			break
-		fi
-	done
 	case "$pkg" in
 		*/"${sourcename}_"*.ipk)
 			rm -vf "$pkg"
 		;;
+		*)
+			tar -Ozxf "$pkg" ./control.tar.gz 2>/dev/null | tar -Ozxf - ./control 2>/dev/null | {
+				packagename=
+				abiversion=
+				while read field value; do
+					case "$field" in
+						Package:) packagename="$value";;
+						ABIVersion:) abiversion="$value";;
+					esac
+				done
+				[ -n "$abiversion" ] && packagename="${packagename%%$abiversion}"
+				[ "$packagename" = "$sourcename" ] && rm -vf "$pkg"
+			}
+		;;
 	esac
 done
 
diff --git a/scripts/json_overview_image_info.py b/scripts/json_overview_image_info.py
index 0d2cf7f1ef5134..96921c27430a86 100755
--- a/scripts/json_overview_image_info.py
+++ b/scripts/json_overview_image_info.py
@@ -47,7 +47,13 @@ def get_initial_output(image_info):
 
 
 if output:
-    default_packages, output["arch_packages"] = run(
+    (
+        default_packages,
+        output["arch_packages"],
+        linux_version,
+        linux_release,
+        linux_vermagic,
+    ) = run(
         [
             "make",
             "--no-print-directory",
@@ -55,6 +61,9 @@ def get_initial_output(image_info):
             "target/linux/",
             "val.DEFAULT_PACKAGES",
             "val.ARCH_PACKAGES",
+            "val.LINUX_VERSION",
+            "val.LINUX_RELEASE",
+            "val.LINUX_VERMAGIC",
             "V=s",
         ],
         stdout=PIPE,
@@ -64,7 +73,11 @@ def get_initial_output(image_info):
     ).stdout.splitlines()
 
     output["default_packages"] = sorted(default_packages.split())
-
+    output["linux_kernel"] = {
+        "version": linux_version,
+        "release": linux_release,
+        "vermagic": linux_vermagic,
+    }
     output_path.write_text(json.dumps(output, sort_keys=True, separators=(",", ":")))
 else:
     print("JSON info file script could not find any JSON files for target")
diff --git a/scripts/kernel_bump.sh b/scripts/kernel_bump.sh
index b1c17d6c3970e8..03e809eedcb65b 100755
--- a/scripts/kernel_bump.sh
+++ b/scripts/kernel_bump.sh
@@ -2,6 +2,9 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 #
 # Copyright (C) 2024 Olliver Schinagl <oliver@schinagl.nl>
+#
+# This script was implemented from scratch -- inspired by ideas shared
+# with the OpenWrt project by Elliott Mitchell <ehem+openwrt@m5p.com>
 
 set -eu
 if [ -n "${DEBUG_TRACE_SH:-}" ] && \
diff --git a/scripts/make-index-json.py b/scripts/make-index-json.py
new file mode 100755
index 00000000000000..af5c6cf0735d4d
--- /dev/null
+++ b/scripts/make-index-json.py
@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+"""
+Parse the native package index files into a json file for use by downstream
+tools.  See:
+
+    https://github.com/openwrt/openwrt/commit/218ce40cd738f3373438aab82467807a8707fb9c
+
+The "version 1" index.json contained ABI-versioned package names, making the
+unusable by the ASU server.  The version 2 format contains package names that
+have been stripped of their ABI version.
+"""
+
+import email.parser
+import json
+
+
+def parse_args():
+    from argparse import ArgumentParser
+
+    source_format = "apk", "opkg"
+
+    parser = ArgumentParser()
+    # fmt: off
+    parser.add_argument("-a", "--architecture", required=True,
+                        help="Required device architecture: like 'x86_64' or 'aarch64_generic'")
+    parser.add_argument("-f", "--source-format", required=True, choices=source_format,
+                        help="Required source format of input: 'apk' or 'opkg'")
+    parser.add_argument(dest="source",
+                        help="File name for input, '-' for stdin")
+    # fmt: on
+    args = parser.parse_args()
+    return args
+
+
+def parse_apk(text: str) -> dict:
+    packages: dict = {}
+
+    data = json.loads(text)
+    for package in data.get("packages", []):
+        package_name: str = package["name"]
+
+        for tag in package.get("tags", []):
+            if tag.startswith("openwrt:abiversion="):
+                package_abi: str = tag.split("=")[-1]
+                package_name = package_name.removesuffix(package_abi)
+                break
+
+        packages[package_name] = package["version"]
+
+    return packages
+
+
+def parse_opkg(text: str) -> dict:
+    packages: dict = {}
+
+    parser: email.parser.Parser = email.parser.Parser()
+    chunks: list[str] = text.strip().split("\n\n")
+    for chunk in chunks:
+        package: dict = parser.parsestr(chunk, headersonly=True)
+        package_name: str = package["Package"]
+        if package_abi := package.get("ABIVersion"):
+            package_name = package_name.removesuffix(package_abi)
+
+        packages[package_name] = package["Version"]
+
+    return packages
+
+
+if __name__ == "__main__":
+    import sys
+
+    args = parse_args()
+
+    input = sys.stdin if args.source == "-" else open(args.source, "r")
+    with input:
+        text: str = input.read()
+
+    packages = parse_apk(text) if args.source_format == "apk" else parse_opkg(text)
+    index = {
+        "version": 2,
+        "architecture": args.architecture,
+        "packages": packages,
+    }
+    print(json.dumps(index, indent=2))
diff --git a/scripts/target-metadata.pl b/scripts/target-metadata.pl
index 0c17e2e3273df6..3cca361374efca 100755
--- a/scripts/target-metadata.pl
+++ b/scripts/target-metadata.pl
@@ -433,7 +433,7 @@ ()
 	my @targets = parse_target_metadata($file);
 	foreach my $cur (@targets) {
 		next unless $cur->{id} eq $target;
-		my @profile_ids_unique =  do { my %seen; grep { !$seen{$_}++} map { $_->{id} } @{$cur->{profiles}}};
+		my @profile_ids_unique =  do { my %seen; grep { !$seen{$_}++} map { $_->{id} } grep { $_->{default} !~ /^n/ } @{$cur->{profiles}}};
 		print "PROFILE_NAMES = ".join(" ", @profile_ids_unique)."\n";
 		foreach my $profile (@{$cur->{profiles}}) {
 			print $profile->{id}.'_NAME:='.$profile->{name}."\n";
diff --git a/target/imagebuilder/files/Makefile b/target/imagebuilder/files/Makefile
index f46b61b7870670..e9e08fb2765b0e 100644
--- a/target/imagebuilder/files/Makefile
+++ b/target/imagebuilder/files/Makefile
@@ -26,6 +26,7 @@ include $(INCLUDE_DIR)/debug.mk
 include $(INCLUDE_DIR)/depends.mk
 include $(INCLUDE_DIR)/rootfs.mk
 
+include $(INCLUDE_DIR)/default-packages.mk
 include $(INCLUDE_DIR)/version.mk
 export REVISION
 export SOURCE_DATE_EPOCH
@@ -138,6 +139,11 @@ _call_info: FORCE
 	echo 'Available Profiles:'
 	echo; $(PROFILE_LIST)
 
+ifneq ($(CONFIG_USE_APK),)
+  DEFAULT_PACKAGES += apk-mbedtls
+else
+  DEFAULT_PACKAGES += opkg
+endif
 BUILD_PACKAGES:=$(sort $(DEFAULT_PACKAGES) $($(USER_PROFILE)_PACKAGES) kernel)
 # "-pkgname" in the package list means remove "pkgname" from the package list
 BUILD_PACKAGES:=$(filter-out $(filter -%,$(BUILD_PACKAGES)) $(patsubst -%,%,$(filter -%,$(BUILD_PACKAGES))),$(BUILD_PACKAGES))
@@ -352,7 +358,7 @@ ifeq ($(PACKAGE),)
 endif
 	@$(MAKE) -s package_reload
 ifeq ($(CONFIG_USE_APK),)
-	@$(OPKG) list --depends $(PACKAGE)
+	@$(OPKG) whatdepends -A $(PACKAGE)
 else
 	@$(APK) list --depends $(PACKAGE)
 endif
diff --git a/target/linux/Makefile b/target/linux/Makefile
index eaf31982229677..f1e20abf046b03 100644
--- a/target/linux/Makefile
+++ b/target/linux/Makefile
@@ -4,6 +4,7 @@
 
 include $(TOPDIR)/rules.mk
 include $(INCLUDE_DIR)/target.mk
+include $(INCLUDE_DIR)/default-packages.mk
 
 export TARGET_BUILD=1
 
diff --git a/target/linux/airoha/an7581/config-6.6 b/target/linux/airoha/an7581/config-6.6
index 5001de9b199472..44f86a3b39433f 100644
--- a/target/linux/airoha/an7581/config-6.6
+++ b/target/linux/airoha/an7581/config-6.6
@@ -1,4 +1,5 @@
 CONFIG_64BIT=y
+CONFIG_AIROHA_CPU_PM_DOMAIN=y
 CONFIG_AIROHA_THERMAL=y
 CONFIG_AIROHA_WATCHDOG=y
 CONFIG_AMPERE_ERRATUM_AC03_CPU_38=y
@@ -111,8 +112,6 @@ CONFIG_CAVIUM_ERRATUM_30115=y
 CONFIG_CAVIUM_TX2_ERRATUM_219=y
 CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 # CONFIG_CFS_BANDWIDTH is not set
 CONFIG_CGROUPS=y
 CONFIG_CGROUP_CPUACCT=y
@@ -133,6 +132,8 @@ CONFIG_COMPAT_32BIT_TIME=y
 CONFIG_CONTEXT_TRACKING=y
 CONFIG_CONTEXT_TRACKING_IDLE=y
 CONFIG_COREDUMP=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
 CONFIG_CPUSETS=y
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
@@ -192,8 +193,6 @@ CONFIG_CRYPTO_SHA512=y
 CONFIG_CRYPTO_ZSTD=y
 CONFIG_DCACHE_WORD_ACCESS=y
 CONFIG_DEBUG_BUGVERBOSE=y
-# CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT is not set
-CONFIG_DEBUG_INFO_NONE=y
 CONFIG_DEBUG_MISC=y
 CONFIG_DEVMEM=y
 CONFIG_DMADEVICES=y
@@ -232,7 +231,6 @@ CONFIG_FUNCTION_ALIGNMENT_4B=y
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_CACHE=y
 # CONFIG_FW_LOADER_USER_HELPER is not set
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
@@ -354,6 +352,10 @@ CONFIG_MDIO_DEVRES=y
 # CONFIG_MEMCG is not set
 CONFIG_MFD_SYSCON=y
 CONFIG_MIGRATION=y
+CONFIG_MMC=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_CQHCI=y
+CONFIG_MMC_MTK=y
 CONFIG_MMU_LAZY_TLB_REFCOUNT=y
 CONFIG_MODULES_TREE_LOOKUP=y
 CONFIG_MODULES_USE_ELF_RELA=y
@@ -401,7 +403,8 @@ CONFIG_NET_NS=y
 CONFIG_NET_SELFTESTS=y
 CONFIG_NET_SWITCHDEV=y
 # CONFIG_NET_VENDOR_3COM is not set
-CONFIG_NET_VENDOR_MEDIATEK=y
+CONFIG_NET_VENDOR_AIROHA=y
+# CONFIG_NET_VENDOR_MEDIATEK is not set
 CONFIG_NLS=y
 CONFIG_NLS_DEFAULT="utf8"
 CONFIG_NO_HZ_COMMON=y
@@ -436,7 +439,8 @@ CONFIG_PCIEASPM_PERFORMANCE=y
 # CONFIG_PCIEASPM_POWERSAVE is not set
 # CONFIG_PCIEASPM_POWER_SUPERSAVE is not set
 CONFIG_PCIEPORTBUS=y
-# CONFIG_PCIE_MEDIATEK is not set
+CONFIG_PCIE_MEDIATEK=y
+CONFIG_PCIE_MEDIATEK_GEN3=y
 CONFIG_PCIE_PME=y
 CONFIG_PCI_DOMAINS=y
 CONFIG_PCI_DOMAINS_GENERIC=y
@@ -493,6 +497,8 @@ CONFIG_RATIONAL=y
 CONFIG_RCU_CPU_STALL_TIMEOUT=21
 CONFIG_REGMAP=y
 CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
 CONFIG_RELOCATABLE=y
 CONFIG_RESET_CONTROLLER=y
 CONFIG_RFS_ACCEL=y
diff --git a/target/linux/airoha/dts/an7581-evb-emmc.dts b/target/linux/airoha/dts/an7581-evb-emmc.dts
index 91d797779562ba..26d446e2a1efbd 100644
--- a/target/linux/airoha/dts/an7581-evb-emmc.dts
+++ b/target/linux/airoha/dts/an7581-evb-emmc.dts
@@ -100,8 +100,9 @@
 };
 
 &mmc0 {
-	pinctrl-names = "default";
+	pinctrl-names = "default", "state_uhs";
 	pinctrl-0 = <&mmc_pins>;
+	pinctrl-1 = <&mmc_pins>;
 	status = "okay";
 
 	#address-cells = <1>;
diff --git a/target/linux/airoha/dts/an7581-evb.dts b/target/linux/airoha/dts/an7581-evb.dts
index 3cf531a29c4401..9e88bc8a77b3ea 100644
--- a/target/linux/airoha/dts/an7581-evb.dts
+++ b/target/linux/airoha/dts/an7581-evb.dts
@@ -150,35 +150,40 @@
 
 &spi_nand {
 	partitions {
-		compatible = "airoha,fixed-partitions";
+		compatible = "fixed-partitions";
 		#address-cells = <1>;
 		#size-cells = <1>;
 
 		bootloader@0 {
 			label = "bootloader";
 			reg = <0x00000000 0x00080000>;
+			read-only;
 		};
 
-		tclinux@80000 {
+		art@200000 {
+			label = "art";
+			reg = <0x00200000 0x00400000>;
+		};
+
+		tclinux@600000 {
 			label = "tclinux";
-			compatible = "denx,fit";
-			reg = <0x00080000 0x02800000>;
+			reg = <0x00600000 0x03200000>;
 		};
 
-		tclinux_slave@2880000 {
-			label = "tclinux_slave";
-			reg = <0x02880000 0x02800000>;
+		tclinux_slave@3800000 {
+			label = "tclinux_alt";
+			reg = <0x03800000 0x03200000>;
 		};
 
-		rootfs_data@5080000 {
+		rootfs_data@6a00000 {
 			label = "rootfs_data";
-			reg = <0x5080000 0x00800000>;
+			reg = <0x06a00000 0x01400000>;
 		};
 
-		art@ffffffff {
-			compatible = "airoha,dynamic-art";
-			label = "art";
-			reg = <0xffffffff 0x00300000>;
+		reserved_bmt@7e00000 {
+			label = "reserved_bmt";
+			reg = <0x07e00000 0x00200000>;
+			read-only;
 		};
 	};
 };
diff --git a/target/linux/airoha/dts/an7581.dtsi b/target/linux/airoha/dts/an7581.dtsi
index 8abd736875c585..3b9f0c6d653fb9 100644
--- a/target/linux/airoha/dts/an7581.dtsi
+++ b/target/linux/airoha/dts/an7581.dtsi
@@ -78,7 +78,10 @@
 			reg = <0x0>;
 			operating-points-v2 = <&cpu_opp_table>;
 			enable-method = "psci";
-			clock-frequency = <80000000>;
+			clocks = <&cpufreq>;
+			clock-names = "cpu";
+			power-domains = <&cpufreq>;
+			power-domain-names = "perf";
 			next-level-cache = <&l2>;
 			#cooling-cells = <2>;
 		};
@@ -89,7 +92,10 @@
 			reg = <0x1>;
 			operating-points-v2 = <&cpu_opp_table>;
 			enable-method = "psci";
-			clock-frequency = <80000000>;
+			clocks = <&cpufreq>;
+			clock-names = "cpu";
+			power-domains = <&cpufreq>;
+			power-domain-names = "perf";
 			next-level-cache = <&l2>;
 			#cooling-cells = <2>;
 		};
@@ -100,7 +106,10 @@
 			reg = <0x2>;
 			operating-points-v2 = <&cpu_opp_table>;
 			enable-method = "psci";
-			clock-frequency = <80000000>;
+			clocks = <&cpufreq>;
+			clock-names = "cpu";
+			power-domains = <&cpufreq>;
+			power-domain-names = "perf";
 			next-level-cache = <&l2>;
 			#cooling-cells = <2>;
 		};
@@ -111,7 +120,10 @@
 			reg = <0x3>;
 			operating-points-v2 = <&cpu_opp_table>;
 			enable-method = "psci";
-			clock-frequency = <80000000>;
+			clocks = <&cpufreq>;
+			clock-names = "cpu";
+			power-domains = <&cpufreq>;
+			power-domain-names = "perf";
 			next-level-cache = <&l2>;
 			#cooling-cells = <2>;
 		};
@@ -125,68 +137,156 @@
 		};
 	};
 
+	cpufreq: cpufreq {
+		compatible = "airoha,en7581-cpufreq";
+
+		operating-points-v2 = <&cpu_smcc_opp_table>;
+
+		#power-domain-cells = <0>;
+		#clock-cells = <0>;
+	};
+
 	cpu_opp_table: opp-table {
 		compatible = "operating-points-v2";
 		opp-shared;
 
 		opp-500000000 {
 			opp-hz = /bits/ 64 <500000000>;
+			required-opps = <&smcc_opp0>;
 		};
 
 		opp-550000000 {
 			opp-hz = /bits/ 64 <550000000>;
+			required-opps = <&smcc_opp1>;
 		};
 
 		opp-600000000 {
 			opp-hz = /bits/ 64 <600000000>;
+			required-opps = <&smcc_opp2>;
 		};
 
 		opp-650000000 {
 			opp-hz = /bits/ 64 <650000000>;
+			required-opps = <&smcc_opp3>;
 		};
 
 		opp-7000000000 {
 			opp-hz = /bits/ 64 <700000000>;
+			required-opps = <&smcc_opp4>;
 		};
 
 		opp-7500000000 {
 			opp-hz = /bits/ 64 <750000000>;
+			required-opps = <&smcc_opp5>;
 		};
 
 		opp-8000000000 {
 			opp-hz = /bits/ 64 <800000000>;
+			required-opps = <&smcc_opp6>;
 		};
 
 		opp-8500000000 {
 			opp-hz = /bits/ 64 <850000000>;
+			required-opps = <&smcc_opp7>;
 		};
 
 		opp-9000000000 {
 			opp-hz = /bits/ 64 <900000000>;
+			required-opps = <&smcc_opp8>;
 		};
 
 		opp-9500000000 {
 			opp-hz = /bits/ 64 <950000000>;
+			required-opps = <&smcc_opp9>;
 		};
 
 		opp-10000000000 {
 			opp-hz = /bits/ 64 <1000000000>;
+			required-opps = <&smcc_opp10>;
 		};
 
 		opp-10500000000 {
 			opp-hz = /bits/ 64 <1050000000>;
+			required-opps = <&smcc_opp11>;
 		};
 
 		opp-11000000000 {
 			opp-hz = /bits/ 64 <1100000000>;
+			required-opps = <&smcc_opp12>;
 		};
 
 		opp-11500000000 {
 			opp-hz = /bits/ 64 <1150000000>;
+			required-opps = <&smcc_opp13>;
 		};
 
 		opp-12000000000 {
 			opp-hz = /bits/ 64 <1200000000>;
+			required-opps = <&smcc_opp14>;
+		};
+	};
+
+	cpu_smcc_opp_table: opp-table-cpu-smcc {
+		compatible = "operating-points-v2";
+
+		smcc_opp0: opp0 {
+			opp-level = <0>;
+		};
+
+		smcc_opp1: opp1 {
+			opp-level = <1>;
+		};
+
+		smcc_opp2: opp2 {
+			opp-level = <2>;
+		};
+
+		smcc_opp3: opp3 {
+			opp-level = <3>;
+		};
+
+		smcc_opp4: opp4 {
+			opp-level = <4>;
+		};
+
+		smcc_opp5: opp5 {
+			opp-level = <5>;
+		};
+
+		smcc_opp6: opp6 {
+			opp-level = <6>;
+		};
+
+		smcc_opp7: opp7 {
+			opp-level = <7>;
+		};
+
+		smcc_opp8: opp8 {
+			opp-level = <8>;
+		};
+
+		smcc_opp9: opp9 {
+			opp-level = <9>;
+		};
+
+		smcc_opp10: opp10 {
+			opp-level = <10>;
+		};
+
+		smcc_opp11: opp11 {
+			opp-level = <11>;
+		};
+
+		smcc_opp12: opp12 {
+			opp-level = <12>;
+		};
+
+		smcc_opp13: opp13 {
+			opp-level = <13>;
+		};
+
+		smcc_opp14: opp14 {
+			opp-level = <14>;
 		};
 	};
 
@@ -232,6 +332,21 @@
 		};
 	};
 
+	clk25m: oscillator {
+		compatible = "fixed-clock";
+		#clock-cells = <0>;
+		clock-frequency = <25000000>;
+		clock-output-names = "clkxtal";
+	};
+
+	vmmc_3v3: regulator-vmmc-3v3 {
+		compatible = "regulator-fixed";
+		regulator-name = "vmmc";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-always-on;
+	};
+
 	soc {
 		compatible = "simple-bus";
 		#address-cells = <2>;
@@ -318,7 +433,7 @@
 			reg = <0x0 0x1fa20000 0x0 0x388>;
 		};
 
-		syscon@1fbe3400 {
+		pbus_csr: syscon@1fbe3400 {
 			compatible = "airoha,en7581-pbus-csr", "syscon";
 			reg = <0x0 0x1fbe3400 0x0 0xff>;
 		};
@@ -431,7 +546,6 @@
 				spi-max-frequency = <50000000>;
 				spi-tx-bus-width = <1>;
 				spi-rx-bus-width = <2>;
-				airoha,bmt;
 			};
 		};
 
@@ -440,8 +554,11 @@
 			reg = <0x0 0x1fa0e000 0x0 0x1000>,
 			      <0x0 0x1fa0c000 0x0 0x60>;
 			interrupts = <GIC_SPI 170 IRQ_TYPE_LEVEL_HIGH>;
+			clocks = <&scuclk EN7581_CLK_EMMC>, <&clk25m>;
+			clock-names = "source", "hclk";
 			bus-width = <4>;
 			max-frequency = <52000000>;
+			vmmc-supply = <&vmmc_3v3>;
 			disable-wp;
 			cap-mmc-highspeed;
 			non-removable;
@@ -486,6 +603,8 @@
 				 <&scuclk EN7581_PCIE2_RST>;
 			reset-names = "phy-lane0", "phy-lane1", "phy-lane2";
 
+			mediatek,pbus-csr = <&pbus_csr 0x0 0x4>;
+
 			interrupts = <GIC_SPI 39 IRQ_TYPE_LEVEL_HIGH>;
 			bus-range = <0x00 0xff>;
 			#interrupt-cells = <1>;
@@ -527,6 +646,8 @@
 				 <&scuclk EN7581_PCIE2_RST>;
 			reset-names = "phy-lane0", "phy-lane1", "phy-lane2";
 
+			mediatek,pbus-csr = <&pbus_csr 0x8 0xc>;
+
 			interrupts = <GIC_SPI 40 IRQ_TYPE_LEVEL_HIGH>;
 			bus-range = <0x00 0xff>;
 			#interrupt-cells = <1>;
@@ -587,7 +708,7 @@
 				status = "disabled";
 
 				fixed-link {
-					speed = <1000>;
+					speed = <10000>;
 					full-duplex;
 					pause;
 				};
@@ -648,7 +769,7 @@
 					phy-mode = "internal";
 
 					fixed-link {
-						speed = <1000>;
+						speed = <10000>;
 						full-duplex;
 						pause;
 					};
diff --git a/target/linux/airoha/en7523/config-6.6 b/target/linux/airoha/en7523/config-6.6
index ce93f7d9ff6f57..a40b61696a11af 100644
--- a/target/linux/airoha/en7523/config-6.6
+++ b/target/linux/airoha/en7523/config-6.6
@@ -45,8 +45,6 @@ CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
 CONFIG_CACHE_L2X0=y
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CMDLINE="rootfstype=squashfs,jffs2"
 CONFIG_CMDLINE_FROM_BOOTLOADER=y
@@ -102,7 +100,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
diff --git a/target/linux/airoha/patches-6.6/002-v6.11-i2c-mt7621-Add-Airoha-EN7581-i2c-support.patch b/target/linux/airoha/patches-6.6/002-v6.11-i2c-mt7621-Add-Airoha-EN7581-i2c-support.patch
index 25eb475e214187..46c376e343d1b7 100644
--- a/target/linux/airoha/patches-6.6/002-v6.11-i2c-mt7621-Add-Airoha-EN7581-i2c-support.patch
+++ b/target/linux/airoha/patches-6.6/002-v6.11-i2c-mt7621-Add-Airoha-EN7581-i2c-support.patch
@@ -16,7 +16,7 @@ Signed-off-by: Andi Shyti <andi.shyti@kernel.org>
 
 --- a/drivers/i2c/busses/Kconfig
 +++ b/drivers/i2c/busses/Kconfig
-@@ -839,7 +839,7 @@ config I2C_MT65XX
+@@ -841,7 +841,7 @@ config I2C_MT65XX
  
  config I2C_MT7621
  	tristate "MT7621/MT7628 I2C Controller"
diff --git a/target/linux/airoha/patches-6.6/019-01-v6.11-clk-en7523-Add-reset-controller-support-for-EN7581-S.patch b/target/linux/airoha/patches-6.6/019-01-v6.11-clk-en7523-Add-reset-controller-support-for-EN7581-S.patch
index f7cc5159eaf5a6..4d9ff9ef9de3e3 100644
--- a/target/linux/airoha/patches-6.6/019-01-v6.11-clk-en7523-Add-reset-controller-support-for-EN7581-S.patch
+++ b/target/linux/airoha/patches-6.6/019-01-v6.11-clk-en7523-Add-reset-controller-support-for-EN7581-S.patch
@@ -139,7 +139,7 @@ Signed-off-by: Stephen Boyd <sboyd@kernel.org>
  		return PTR_ERR(pb_base);
  
 @@ -428,6 +510,95 @@ static void en7523_register_clocks(struc
- 	clk_data->num = EN7523_NUM_CLOCKS;
+ 	clk_data->hws[EN7523_CLK_PCIE] = hw;
  }
  
 +static int en7523_reset_update(struct reset_controller_dev *rcdev,
diff --git a/target/linux/airoha/patches-6.6/029-v6.12-net-dsa-mt7530-Add-EN7581-support.patch b/target/linux/airoha/patches-6.6/029-v6.12-net-dsa-mt7530-Add-EN7581-support.patch
index 55e4ae9d404e64..d07163902d98ce 100644
--- a/target/linux/airoha/patches-6.6/029-v6.12-net-dsa-mt7530-Add-EN7581-support.patch
+++ b/target/linux/airoha/patches-6.6/029-v6.12-net-dsa-mt7530-Add-EN7581-support.patch
@@ -66,7 +66,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  		/* Disable forwarding by default on all ports */
  		mt7530_rmw(priv, MT7530_PCR_P(i), PCR_MATRIX_MASK,
-@@ -2550,8 +2553,10 @@ mt7531_setup_common(struct dsa_switch *d
+@@ -2553,8 +2556,10 @@ mt7531_setup_common(struct dsa_switch *d
  		/* Clear link settings and enable force mode to force link down
  		 * on all ports until they're enabled later.
  		 */
@@ -79,7 +79,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  		/* Disable forwarding by default on all ports */
  		mt7530_rmw(priv, MT7530_PCR_P(i), PCR_MATRIX_MASK,
-@@ -2783,6 +2788,28 @@ static void mt7988_mac_port_get_caps(str
+@@ -2779,6 +2784,28 @@ static void mt7988_mac_port_get_caps(str
  	}
  }
  
@@ -108,7 +108,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static void
  mt7530_mac_config(struct dsa_switch *ds, int port, unsigned int mode,
  		  phy_interface_t interface)
-@@ -3220,6 +3247,16 @@ const struct mt753x_info mt753x_table[]
+@@ -3216,6 +3243,16 @@ const struct mt753x_info mt753x_table[]
  		.phy_write_c45 = mt7531_ind_c45_phy_write,
  		.mac_port_get_caps = mt7988_mac_port_get_caps,
  	},
diff --git a/target/linux/airoha/patches-6.6/031-01-v6.13-net-airoha-Read-completion-queue-data-in-airoha_qdma.patch b/target/linux/airoha/patches-6.6/031-01-v6.13-net-airoha-Read-completion-queue-data-in-airoha_qdma.patch
new file mode 100644
index 00000000000000..306ce6588396bf
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/031-01-v6.13-net-airoha-Read-completion-queue-data-in-airoha_qdma.patch
@@ -0,0 +1,92 @@
+From 3affa310de523d63e52ea8e2efb3c476df29e414 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 29 Oct 2024 13:17:09 +0100
+Subject: [PATCH 1/2] net: airoha: Read completion queue data in
+ airoha_qdma_tx_napi_poll()
+
+In order to avoid any possible race, read completion queue head and
+pending entry in airoha_qdma_tx_napi_poll routine instead of doing it in
+airoha_irq_handler. Remove unused airoha_tx_irq_queue unused fields.
+This is a preliminary patch to add Qdisc offload for airoha_eth driver.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20241029-airoha-en7581-tx-napi-work-v1-1-96ad1686b946@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/airoha_eth.c | 31 +++++++++-------------
+ 1 file changed, 13 insertions(+), 18 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/airoha_eth.c
++++ b/drivers/net/ethernet/mediatek/airoha_eth.c
+@@ -752,11 +752,9 @@ struct airoha_tx_irq_queue {
+ 	struct airoha_qdma *qdma;
+ 
+ 	struct napi_struct napi;
+-	u32 *q;
+ 
+ 	int size;
+-	int queued;
+-	u16 head;
++	u32 *q;
+ };
+ 
+ struct airoha_hw_stats {
+@@ -1656,25 +1654,31 @@ static int airoha_qdma_init_rx(struct ai
+ static int airoha_qdma_tx_napi_poll(struct napi_struct *napi, int budget)
+ {
+ 	struct airoha_tx_irq_queue *irq_q;
++	int id, done = 0, irq_queued;
+ 	struct airoha_qdma *qdma;
+ 	struct airoha_eth *eth;
+-	int id, done = 0;
++	u32 status, head;
+ 
+ 	irq_q = container_of(napi, struct airoha_tx_irq_queue, napi);
+ 	qdma = irq_q->qdma;
+ 	id = irq_q - &qdma->q_tx_irq[0];
+ 	eth = qdma->eth;
+ 
+-	while (irq_q->queued > 0 && done < budget) {
+-		u32 qid, last, val = irq_q->q[irq_q->head];
++	status = airoha_qdma_rr(qdma, REG_IRQ_STATUS(id));
++	head = FIELD_GET(IRQ_HEAD_IDX_MASK, status);
++	head = head % irq_q->size;
++	irq_queued = FIELD_GET(IRQ_ENTRY_LEN_MASK, status);
++
++	while (irq_queued > 0 && done < budget) {
++		u32 qid, last, val = irq_q->q[head];
+ 		struct airoha_queue *q;
+ 
+ 		if (val == 0xff)
+ 			break;
+ 
+-		irq_q->q[irq_q->head] = 0xff; /* mark as done */
+-		irq_q->head = (irq_q->head + 1) % irq_q->size;
+-		irq_q->queued--;
++		irq_q->q[head] = 0xff; /* mark as done */
++		head = (head + 1) % irq_q->size;
++		irq_queued--;
+ 		done++;
+ 
+ 		last = FIELD_GET(IRQ_DESC_IDX_MASK, val);
+@@ -2026,20 +2030,11 @@ static irqreturn_t airoha_irq_handler(in
+ 
+ 	if (intr[0] & INT_TX_MASK) {
+ 		for (i = 0; i < ARRAY_SIZE(qdma->q_tx_irq); i++) {
+-			struct airoha_tx_irq_queue *irq_q = &qdma->q_tx_irq[i];
+-			u32 status, head;
+-
+ 			if (!(intr[0] & TX_DONE_INT_MASK(i)))
+ 				continue;
+ 
+ 			airoha_qdma_irq_disable(qdma, QDMA_INT_REG_IDX0,
+ 						TX_DONE_INT_MASK(i));
+-
+-			status = airoha_qdma_rr(qdma, REG_IRQ_STATUS(i));
+-			head = FIELD_GET(IRQ_HEAD_IDX_MASK, status);
+-			irq_q->head = head % irq_q->size;
+-			irq_q->queued = FIELD_GET(IRQ_ENTRY_LEN_MASK, status);
+-
+ 			napi_schedule(&qdma->q_tx_irq[i].napi);
+ 		}
+ 	}
diff --git a/target/linux/airoha/patches-6.6/031-02-v6.13-net-airoha-Simplify-Tx-napi-logic.patch b/target/linux/airoha/patches-6.6/031-02-v6.13-net-airoha-Simplify-Tx-napi-logic.patch
new file mode 100644
index 00000000000000..b35f828f118d9e
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/031-02-v6.13-net-airoha-Simplify-Tx-napi-logic.patch
@@ -0,0 +1,130 @@
+From 0c729f53b8c33b9e5eadc2d5e673759e3510501e Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 29 Oct 2024 13:17:10 +0100
+Subject: [PATCH 2/2] net: airoha: Simplify Tx napi logic
+
+Simplify Tx napi logic relying just on the packet index provided by
+completion queue indicating the completed packet that can be removed
+from the Tx DMA ring.
+This is a preliminary patch to add Qdisc offload for airoha_eth driver.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20241029-airoha-en7581-tx-napi-work-v1-2-96ad1686b946@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/airoha_eth.c | 73 ++++++++++++----------
+ 1 file changed, 41 insertions(+), 32 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/airoha_eth.c
++++ b/drivers/net/ethernet/mediatek/airoha_eth.c
+@@ -1670,8 +1670,12 @@ static int airoha_qdma_tx_napi_poll(stru
+ 	irq_queued = FIELD_GET(IRQ_ENTRY_LEN_MASK, status);
+ 
+ 	while (irq_queued > 0 && done < budget) {
+-		u32 qid, last, val = irq_q->q[head];
++		u32 qid, val = irq_q->q[head];
++		struct airoha_qdma_desc *desc;
++		struct airoha_queue_entry *e;
+ 		struct airoha_queue *q;
++		u32 index, desc_ctrl;
++		struct sk_buff *skb;
+ 
+ 		if (val == 0xff)
+ 			break;
+@@ -1681,9 +1685,7 @@ static int airoha_qdma_tx_napi_poll(stru
+ 		irq_queued--;
+ 		done++;
+ 
+-		last = FIELD_GET(IRQ_DESC_IDX_MASK, val);
+ 		qid = FIELD_GET(IRQ_RING_IDX_MASK, val);
+-
+ 		if (qid >= ARRAY_SIZE(qdma->q_tx))
+ 			continue;
+ 
+@@ -1691,46 +1693,53 @@ static int airoha_qdma_tx_napi_poll(stru
+ 		if (!q->ndesc)
+ 			continue;
+ 
++		index = FIELD_GET(IRQ_DESC_IDX_MASK, val);
++		if (index >= q->ndesc)
++			continue;
++
+ 		spin_lock_bh(&q->lock);
+ 
+-		while (q->queued > 0) {
+-			struct airoha_qdma_desc *desc = &q->desc[q->tail];
+-			struct airoha_queue_entry *e = &q->entry[q->tail];
+-			u32 desc_ctrl = le32_to_cpu(desc->ctrl);
+-			struct sk_buff *skb = e->skb;
+-			u16 index = q->tail;
+-
+-			if (!(desc_ctrl & QDMA_DESC_DONE_MASK) &&
+-			    !(desc_ctrl & QDMA_DESC_DROP_MASK))
+-				break;
++		if (!q->queued)
++			goto unlock;
+ 
+-			q->tail = (q->tail + 1) % q->ndesc;
+-			q->queued--;
++		desc = &q->desc[index];
++		desc_ctrl = le32_to_cpu(desc->ctrl);
+ 
+-			dma_unmap_single(eth->dev, e->dma_addr, e->dma_len,
+-					 DMA_TO_DEVICE);
+-
+-			WRITE_ONCE(desc->msg0, 0);
+-			WRITE_ONCE(desc->msg1, 0);
++		if (!(desc_ctrl & QDMA_DESC_DONE_MASK) &&
++		    !(desc_ctrl & QDMA_DESC_DROP_MASK))
++			goto unlock;
++
++		e = &q->entry[index];
++		skb = e->skb;
++
++		dma_unmap_single(eth->dev, e->dma_addr, e->dma_len,
++				 DMA_TO_DEVICE);
++		memset(e, 0, sizeof(*e));
++		WRITE_ONCE(desc->msg0, 0);
++		WRITE_ONCE(desc->msg1, 0);
++		q->queued--;
++
++		/* completion ring can report out-of-order indexes if hw QoS
++		 * is enabled and packets with different priority are queued
++		 * to same DMA ring. Take into account possible out-of-order
++		 * reports incrementing DMA ring tail pointer
++		 */
++		while (q->tail != q->head && !q->entry[q->tail].dma_addr)
++			q->tail = (q->tail + 1) % q->ndesc;
+ 
+-			if (skb) {
+-				u16 queue = skb_get_queue_mapping(skb);
+-				struct netdev_queue *txq;
+-
+-				txq = netdev_get_tx_queue(skb->dev, queue);
+-				netdev_tx_completed_queue(txq, 1, skb->len);
+-				if (netif_tx_queue_stopped(txq) &&
+-				    q->ndesc - q->queued >= q->free_thr)
+-					netif_tx_wake_queue(txq);
+-
+-				dev_kfree_skb_any(skb);
+-				e->skb = NULL;
+-			}
++		if (skb) {
++			u16 queue = skb_get_queue_mapping(skb);
++			struct netdev_queue *txq;
++
++			txq = netdev_get_tx_queue(skb->dev, queue);
++			netdev_tx_completed_queue(txq, 1, skb->len);
++			if (netif_tx_queue_stopped(txq) &&
++			    q->ndesc - q->queued >= q->free_thr)
++				netif_tx_wake_queue(txq);
+ 
+-			if (index == last)
+-				break;
++			dev_kfree_skb_any(skb);
+ 		}
+-
++unlock:
+ 		spin_unlock_bh(&q->lock);
+ 	}
+ 
diff --git a/target/linux/airoha/patches-6.6/103-watchdog-Add-support-for-Airoha-EN7851-watchdog.patch b/target/linux/airoha/patches-6.6/032-v6.13-watchdog-Add-support-for-Airoha-EN7851-watchdog.patch
similarity index 94%
rename from target/linux/airoha/patches-6.6/103-watchdog-Add-support-for-Airoha-EN7851-watchdog.patch
rename to target/linux/airoha/patches-6.6/032-v6.13-watchdog-Add-support-for-Airoha-EN7851-watchdog.patch
index e58ee546094250..02dbadff4e8704 100644
--- a/target/linux/airoha/patches-6.6/103-watchdog-Add-support-for-Airoha-EN7851-watchdog.patch
+++ b/target/linux/airoha/patches-6.6/032-v6.13-watchdog-Add-support-for-Airoha-EN7851-watchdog.patch
@@ -1,19 +1,18 @@
-From 4019d58ca5b249e4cf79169cc0c6a4ff5275c155 Mon Sep 17 00:00:00 2001
+From 3cf67f3769b8227ca75ca7102180a2e270ee01aa Mon Sep 17 00:00:00 2001
 From: Christian Marangi <ansuelsmth@gmail.com>
-Date: Fri, 5 Jul 2024 19:12:12 +0200
-Subject: [PATCH v2 2/2] watchdog: Add support for Airoha EN7851 watchdog
+Date: Fri, 11 Oct 2024 12:43:53 +0200
+Subject: [PATCH] watchdog: Add support for Airoha EN7851 watchdog
 
 Add support for Airoha EN7851 watchdog. This is a very basic watchdog
 with no pretimeout support, max timeout is 28 seconds and it ticks based
 on half the SoC BUS clock.
 
 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20241011104411.28659-2-ansuelsmth@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
 ---
-Changes v2:
-- Drop clock-frequency implementation
-- Add missing bitfield.h header
-- Attach BUS clock
-
  drivers/watchdog/Kconfig      |   8 ++
  drivers/watchdog/Makefile     |   1 +
  drivers/watchdog/airoha_wdt.c | 216 ++++++++++++++++++++++++++++++++++
diff --git a/target/linux/airoha/patches-6.6/106-01-clk-en7523-remove-REG_PCIE-_-MEM-MEM_MASK-configurat.patch b/target/linux/airoha/patches-6.6/033-01-v6.13-clk-en7523-remove-REG_PCIE-_-MEM-MEM_MASK-configurat.patch
similarity index 89%
rename from target/linux/airoha/patches-6.6/106-01-clk-en7523-remove-REG_PCIE-_-MEM-MEM_MASK-configurat.patch
rename to target/linux/airoha/patches-6.6/033-01-v6.13-clk-en7523-remove-REG_PCIE-_-MEM-MEM_MASK-configurat.patch
index d2e0c6d5417ec9..59aefbb66e96d0 100644
--- a/target/linux/airoha/patches-6.6/106-01-clk-en7523-remove-REG_PCIE-_-MEM-MEM_MASK-configurat.patch
+++ b/target/linux/airoha/patches-6.6/033-01-v6.13-clk-en7523-remove-REG_PCIE-_-MEM-MEM_MASK-configurat.patch
@@ -1,6 +1,6 @@
-From 64e497f372dfca3e6be9fe05a0f9b874ea8604d2 Mon Sep 17 00:00:00 2001
+From c31d1cdd7bff1d2c13d435bb9d0c76bfaa332097 Mon Sep 17 00:00:00 2001
 From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Tue, 3 Sep 2024 23:39:46 +0200
+Date: Tue, 12 Nov 2024 01:08:49 +0100
 Subject: [PATCH 1/6] clk: en7523: remove REG_PCIE*_{MEM,MEM_MASK}
  configuration
 
@@ -12,6 +12,8 @@ This patch does not introduce any backward incompatibility since the dts
 for EN7581 SoC is not upstream yet.
 
 Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/20241112-clk-en7581-syscon-v2-2-8ada5e394ae4@kernel.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
 ---
  drivers/clk/clk-en7523.c | 18 ------------------
  1 file changed, 18 deletions(-)
diff --git a/target/linux/airoha/patches-6.6/106-02-clk-en7523-move-clock_register-in-hw_init-callback.patch b/target/linux/airoha/patches-6.6/033-02-v6.13-clk-en7523-move-clock_register-in-hw_init-callback.patch
similarity index 93%
rename from target/linux/airoha/patches-6.6/106-02-clk-en7523-move-clock_register-in-hw_init-callback.patch
rename to target/linux/airoha/patches-6.6/033-02-v6.13-clk-en7523-move-clock_register-in-hw_init-callback.patch
index 44bfc4404bb52d..6a76886c1b4856 100644
--- a/target/linux/airoha/patches-6.6/106-02-clk-en7523-move-clock_register-in-hw_init-callback.patch
+++ b/target/linux/airoha/patches-6.6/033-02-v6.13-clk-en7523-move-clock_register-in-hw_init-callback.patch
@@ -1,6 +1,6 @@
-From 0dd8a6df58a4a8cf1f341249e7358b3bb51f52ad Mon Sep 17 00:00:00 2001
+From b8bdfc666bc5f58caf46e67b615132fccbaca3d4 Mon Sep 17 00:00:00 2001
 From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Tue, 3 Sep 2024 23:39:47 +0200
+Date: Tue, 12 Nov 2024 01:08:50 +0100
 Subject: [PATCH 2/6] clk: en7523: move clock_register in hw_init callback
 
 Move en7523_register_clocks routine in hw_init callback.
@@ -11,6 +11,8 @@ EN7523 and EN7581 SoCs in order to access chip-scu IO region
 miscellaneous registers needed by multiple devices (clock, pinctrl ..).
 
 Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/20241112-clk-en7581-syscon-v2-3-8ada5e394ae4@kernel.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
 ---
  drivers/clk/clk-en7523.c | 82 ++++++++++++++++++++++++----------------
  1 file changed, 50 insertions(+), 32 deletions(-)
@@ -49,7 +51,7 @@ Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
  				   void __iomem *base, void __iomem *np_base)
  {
 @@ -449,6 +436,49 @@ static void en7523_register_clocks(struc
- 	clk_data->num = EN7523_NUM_CLOCKS;
+ 	clk_data->hws[EN7523_CLK_PCIE] = hw;
  }
  
 +static int en7523_clk_hw_init(struct platform_device *pdev,
diff --git a/target/linux/airoha/patches-6.6/106-03-clk-en7523-introduce-chip_scu-regmap.patch b/target/linux/airoha/patches-6.6/033-03-v6.13-clk-en7523-introduce-chip_scu-regmap.patch
similarity index 94%
rename from target/linux/airoha/patches-6.6/106-03-clk-en7523-introduce-chip_scu-regmap.patch
rename to target/linux/airoha/patches-6.6/033-03-v6.13-clk-en7523-introduce-chip_scu-regmap.patch
index 4f8211c564658c..31966273f0238d 100644
--- a/target/linux/airoha/patches-6.6/106-03-clk-en7523-introduce-chip_scu-regmap.patch
+++ b/target/linux/airoha/patches-6.6/033-03-v6.13-clk-en7523-introduce-chip_scu-regmap.patch
@@ -1,6 +1,6 @@
-From f849bcb746abeaafa63b4f02f1d8bb22703fc645 Mon Sep 17 00:00:00 2001
+From f72fc22038dd544fa4d39c06e8c81c09c0041ed4 Mon Sep 17 00:00:00 2001
 From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Tue, 3 Sep 2024 23:39:48 +0200
+Date: Tue, 12 Nov 2024 01:08:51 +0100
 Subject: [PATCH 3/6] clk: en7523: introduce chip_scu regmap
 
 Introduce chip_scu regmap pointer since EN7581 SoC will access chip-scu
@@ -9,6 +9,8 @@ for EN7581 SoC. This patch does not introduce any backward incompatibility
 since the dts for EN7581 SoC is not upstream yet.
 
 Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/20241112-clk-en7581-syscon-v2-4-8ada5e394ae4@kernel.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
 ---
  drivers/clk/clk-en7523.c | 81 ++++++++++++++++++++++++++++++----------
  1 file changed, 61 insertions(+), 20 deletions(-)
@@ -61,7 +63,7 @@ Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
  	val >>= desc->div_shift;
  	val &= (1 << desc->div_bits) - 1;
  
-@@ -416,9 +409,12 @@ static void en7523_register_clocks(struc
+@@ -418,9 +411,12 @@ static void en7523_register_clocks(struc
  
  	for (i = 0; i < ARRAY_SIZE(en7523_base_clks); i++) {
  		const struct en_clk_desc *desc = &en7523_base_clks[i];
diff --git a/target/linux/airoha/patches-6.6/106-04-clk-en7523-fix-estimation-of-fixed-rate-for-EN7581.patch b/target/linux/airoha/patches-6.6/033-04-v6.13-clk-en7523-fix-estimation-of-fixed-rate-for-EN7581.patch
similarity index 94%
rename from target/linux/airoha/patches-6.6/106-04-clk-en7523-fix-estimation-of-fixed-rate-for-EN7581.patch
rename to target/linux/airoha/patches-6.6/033-04-v6.13-clk-en7523-fix-estimation-of-fixed-rate-for-EN7581.patch
index c311375a8b780d..79c9ab2ee1c486 100644
--- a/target/linux/airoha/patches-6.6/106-04-clk-en7523-fix-estimation-of-fixed-rate-for-EN7581.patch
+++ b/target/linux/airoha/patches-6.6/033-04-v6.13-clk-en7523-fix-estimation-of-fixed-rate-for-EN7581.patch
@@ -1,6 +1,6 @@
-From b9ea4918216ca0c2511446c531d3f8163ac1466d Mon Sep 17 00:00:00 2001
+From f98eded9e9ab048c88ff59c5523e703a6ced5523 Mon Sep 17 00:00:00 2001
 From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Tue, 3 Sep 2024 23:39:49 +0200
+Date: Tue, 12 Nov 2024 01:08:52 +0100
 Subject: [PATCH 4/6] clk: en7523: fix estimation of fixed rate for EN7581
 
 Introduce en7581_base_clks array in order to define per-SoC fixed-rate
@@ -9,6 +9,8 @@ clocks
 
 Fixes: 66bc47326ce2 ("clk: en7523: Add EN7581 support")
 Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/20241112-clk-en7581-syscon-v2-5-8ada5e394ae4@kernel.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
 ---
  drivers/clk/clk-en7523.c | 105 ++++++++++++++++++++++++++++++++++++++-
  1 file changed, 103 insertions(+), 2 deletions(-)
diff --git a/target/linux/airoha/patches-6.6/106-05-clk-en7523-move-en7581_reset_register-in-en7581_clk_.patch b/target/linux/airoha/patches-6.6/033-05-v6.13-clk-en7523-move-en7581_reset_register-in-en7581_clk_.patch
similarity index 95%
rename from target/linux/airoha/patches-6.6/106-05-clk-en7523-move-en7581_reset_register-in-en7581_clk_.patch
rename to target/linux/airoha/patches-6.6/033-05-v6.13-clk-en7523-move-en7581_reset_register-in-en7581_clk_.patch
index 3869a58a83ac57..36b9d9f3dc6ed2 100644
--- a/target/linux/airoha/patches-6.6/106-05-clk-en7523-move-en7581_reset_register-in-en7581_clk_.patch
+++ b/target/linux/airoha/patches-6.6/033-05-v6.13-clk-en7523-move-en7581_reset_register-in-en7581_clk_.patch
@@ -1,6 +1,6 @@
-From 2c5b1a5b68973947a6919d9c951f9b3e0d84f347 Mon Sep 17 00:00:00 2001
+From 82e6bf912d5846646892becea659b39d178d79e3 Mon Sep 17 00:00:00 2001
 From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Tue, 3 Sep 2024 23:39:50 +0200
+Date: Tue, 12 Nov 2024 01:08:53 +0100
 Subject: [PATCH 5/6] clk: en7523: move en7581_reset_register() in
  en7581_clk_hw_init()
 
@@ -9,6 +9,8 @@ feature is supported just by EN7581 SoC.
 Get rid of reset struct in en_clk_soc_data data struct.
 
 Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/20241112-clk-en7581-syscon-v2-6-8ada5e394ae4@kernel.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
 ---
  drivers/clk/clk-en7523.c | 93 ++++++++++++++--------------------------
  1 file changed, 33 insertions(+), 60 deletions(-)
diff --git a/target/linux/airoha/patches-6.6/106-06-clk-en7523-map-io-region-in-a-single-block.patch b/target/linux/airoha/patches-6.6/033-06-v6.13-clk-en7523-map-io-region-in-a-single-block.patch
similarity index 91%
rename from target/linux/airoha/patches-6.6/106-06-clk-en7523-map-io-region-in-a-single-block.patch
rename to target/linux/airoha/patches-6.6/033-06-v6.13-clk-en7523-map-io-region-in-a-single-block.patch
index db04d602f33299..dec7b81e5b2012 100644
--- a/target/linux/airoha/patches-6.6/106-06-clk-en7523-map-io-region-in-a-single-block.patch
+++ b/target/linux/airoha/patches-6.6/033-06-v6.13-clk-en7523-map-io-region-in-a-single-block.patch
@@ -1,6 +1,6 @@
-From 665a59f4836c3d7813a9d8bfb9680d93adb4626e Mon Sep 17 00:00:00 2001
+From a9eaf305017a5ebe73ab34e85bd5414055a88f29 Mon Sep 17 00:00:00 2001
 From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Tue, 3 Sep 2024 23:39:51 +0200
+Date: Tue, 12 Nov 2024 01:08:54 +0100
 Subject: [PATCH 6/6] clk: en7523: map io region in a single block
 
 Map all clock-controller memory region in a single block.
@@ -8,6 +8,8 @@ This patch does not introduce any backward incompatibility since the dts
 for EN7581 SoC is not upstream yet.
 
 Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/20241112-clk-en7581-syscon-v2-7-8ada5e394ae4@kernel.org
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
 ---
  drivers/clk/clk-en7523.c | 32 +++++++++++++-------------------
  1 file changed, 13 insertions(+), 19 deletions(-)
diff --git a/target/linux/airoha/patches-6.6/107-pinctrl-airoha-Add-support-for-EN7581-SoC.patch b/target/linux/airoha/patches-6.6/034-v6.13-pinctrl-airoha-Add-support-for-EN7581-SoC.patch
similarity index 99%
rename from target/linux/airoha/patches-6.6/107-pinctrl-airoha-Add-support-for-EN7581-SoC.patch
rename to target/linux/airoha/patches-6.6/034-v6.13-pinctrl-airoha-Add-support-for-EN7581-SoC.patch
index 8e299512c36a40..502f89f26d7a76 100644
--- a/target/linux/airoha/patches-6.6/107-pinctrl-airoha-Add-support-for-EN7581-SoC.patch
+++ b/target/linux/airoha/patches-6.6/034-v6.13-pinctrl-airoha-Add-support-for-EN7581-SoC.patch
@@ -1,7 +1,7 @@
-From 21cb14f3e6d12d666a9ec0fd7cc01d722b04e514 Mon Sep 17 00:00:00 2001
+From 1c8ace2d0725c1c8d5012f8a56c5fb31805aad27 Mon Sep 17 00:00:00 2001
 From: Lorenzo Bianconi <lorenzo@kernel.org>
-Date: Wed, 16 Oct 2024 12:07:33 +0200
-Subject: [PATCH 1/2] pinctrl: airoha: Add support for EN7581 SoC
+Date: Wed, 23 Oct 2024 01:20:05 +0200
+Subject: [PATCH] pinctrl: airoha: Add support for EN7581 SoC
 
 Introduce pinctrl driver for EN7581 SoC. Current EN7581 pinctrl driver
 supports the following functionalities:
@@ -15,8 +15,10 @@ Tested-by: Benjamin Larsson <benjamin.larsson@genexis.eu>
 Co-developed-by: Benjamin Larsson <benjamin.larsson@genexis.eu>
 Signed-off-by: Benjamin Larsson <benjamin.larsson@genexis.eu>
 Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
-Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
 Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/20241023-en7581-pinctrl-v9-5-afb0cbcab0ec@kernel.org
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
 ---
  MAINTAINERS                               |    7 +
  drivers/pinctrl/mediatek/Kconfig          |   17 +-
@@ -25,24 +27,22 @@ Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com
  4 files changed, 2994 insertions(+), 1 deletion(-)
  create mode 100644 drivers/pinctrl/mediatek/pinctrl-airoha.c
 
-# diff --git a/MAINTAINERS b/MAINTAINERS
-# index 8a6ea49e1a9d..ca4a78737dc6 100644
-# --- a/MAINTAINERS
-# +++ b/MAINTAINERS
-# @@ -18331,6 +18331,13 @@ F:	drivers/pinctrl/
-#  F:	include/dt-bindings/pinctrl/
-#  F:	include/linux/pinctrl/
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -16871,6 +16871,13 @@ F:	drivers/pinctrl/
+ F:	include/dt-bindings/pinctrl/
+ F:	include/linux/pinctrl/
  
-# +PIN CONTROLLER - AIROHA
-# +M:	Lorenzo Bianconi <lorenzo@kernel.org>
-# +L:	linux-mediatek@lists.infradead.org (moderated for non-subscribers)
-# +S:	Maintained
-# +F:	Documentation/devicetree/bindings/pinctrl/airoha,en7581-pinctrl.yaml
-# +F:	drivers/pinctrl/mediatek/pinctrl-airoha.c
-# +
-#  PIN CONTROLLER - AMD
-#  M:	Basavaraj Natikar <Basavaraj.Natikar@amd.com>
-#  M:	Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
++PIN CONTROLLER - AIROHA
++M:	Lorenzo Bianconi <lorenzo@kernel.org>
++L:	linux-mediatek@lists.infradead.org (moderated for non-subscribers)
++S:	Maintained
++F:	Documentation/devicetree/bindings/pinctrl/airoha,en7581-pinctrl.yaml
++F:	drivers/pinctrl/mediatek/pinctrl-airoha.c
++
+ PIN CONTROLLER - AMD
+ M:	Basavaraj Natikar <Basavaraj.Natikar@amd.com>
+ M:	Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
 --- a/drivers/pinctrl/mediatek/Kconfig
 +++ b/drivers/pinctrl/mediatek/Kconfig
 @@ -1,6 +1,6 @@
diff --git a/target/linux/airoha/patches-6.6/109-clk-en7523-Fix-wrong-BUS-clock-for-EN7581.patch b/target/linux/airoha/patches-6.6/035-v6.13-clk-en7523-Fix-wrong-BUS-clock-for-EN7581.patch
similarity index 82%
rename from target/linux/airoha/patches-6.6/109-clk-en7523-Fix-wrong-BUS-clock-for-EN7581.patch
rename to target/linux/airoha/patches-6.6/035-v6.13-clk-en7523-Fix-wrong-BUS-clock-for-EN7581.patch
index 01a5fd0c876075..89b970f8bb6ba6 100644
--- a/target/linux/airoha/patches-6.6/109-clk-en7523-Fix-wrong-BUS-clock-for-EN7581.patch
+++ b/target/linux/airoha/patches-6.6/035-v6.13-clk-en7523-Fix-wrong-BUS-clock-for-EN7581.patch
@@ -1,12 +1,12 @@
-From 6d74b9e6d3bb07f50b22b9ea047b84a83aba185c Mon Sep 17 00:00:00 2001
+From 2eb75f86d52565367211c51334d15fe672633085 Mon Sep 17 00:00:00 2001
 From: Christian Marangi <ansuelsmth@gmail.com>
-Date: Thu, 17 Oct 2024 19:26:24 +0200
+Date: Sat, 16 Nov 2024 11:56:53 +0100
 Subject: [PATCH] clk: en7523: Fix wrong BUS clock for EN7581
 
 The Documentation for EN7581 had a typo and still referenced the EN7523
 BUS base source frequency. This was in conflict with a different page in
-the Documentration that state that the BUS runs at 300MHz (600MHz source with
-divisor set to 2) and the actual watchdog that tick at half the BUS
+the Documentration that state that the BUS runs at 300MHz (600MHz source
+with divisor set to 2) and the actual watchdog that tick at half the BUS
 clock (150MHz). This was verified with the watchdog by timing the
 seconds that the system takes to reboot (due too watchdog) and by
 operating on different values of the BUS divisor.
@@ -18,6 +18,9 @@ This was also confirmed by Airoha.
 Cc: stable@vger.kernel.org
 Fixes: 66bc47326ce2 ("clk: en7523: Add EN7581 support")
 Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Link: https://lore.kernel.org/r/20241116105710.19748-1-ansuelsmth@gmail.com
+Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
 ---
  drivers/clk/clk-en7523.c | 5 +++--
  1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/target/linux/airoha/patches-6.6/036-v6.13-net-airoha-Fix-typo-in-REG_CDM2_FWD_CFG-configuratio.patch b/target/linux/airoha/patches-6.6/036-v6.13-net-airoha-Fix-typo-in-REG_CDM2_FWD_CFG-configuratio.patch
new file mode 100644
index 00000000000000..a71197150f4807
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/036-v6.13-net-airoha-Fix-typo-in-REG_CDM2_FWD_CFG-configuratio.patch
@@ -0,0 +1,35 @@
+From 30d9d8f6a2d7e44a9f91737dd409dbc87ac6f6b7 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 15 Oct 2024 09:58:09 +0200
+Subject: [PATCH] net: airoha: Fix typo in REG_CDM2_FWD_CFG configuration
+
+Fix typo in airoha_fe_init routine configuring CDM2_OAM_QSEL_MASK field
+of REG_CDM2_FWD_CFG register.
+This bug is not introducing any user visible problem since Frame Engine
+CDM2 port is used just by the second QDMA block and we currently enable
+just QDMA1 block connected to the MT7530 dsa switch via CDM1 port.
+
+Introduced by commit 23020f049327 ("net: airoha: Introduce ethernet
+support for EN7581 SoC")
+
+Reported-by: ChihWei Cheng <chihwei.cheng@airoha.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Message-ID: <20241015-airoha-eth-cdm2-fixes-v1-1-9dc6993286c3@kernel.org>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+---
+ drivers/net/ethernet/mediatek/airoha_eth.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/airoha_eth.c
++++ b/drivers/net/ethernet/mediatek/airoha_eth.c
+@@ -1369,7 +1369,8 @@ static int airoha_fe_init(struct airoha_
+ 	airoha_fe_set(eth, REG_GDM_MISC_CFG,
+ 		      GDM2_RDM_ACK_WAIT_PREF_MASK |
+ 		      GDM2_CHN_VLD_MODE_MASK);
+-	airoha_fe_rmw(eth, REG_CDM2_FWD_CFG, CDM2_OAM_QSEL_MASK, 15);
++	airoha_fe_rmw(eth, REG_CDM2_FWD_CFG, CDM2_OAM_QSEL_MASK,
++		      FIELD_PREP(CDM2_OAM_QSEL_MASK, 15));
+ 
+ 	/* init fragment and assemble Force Port */
+ 	/* NPU Core-3, NPU Bridge Channel-3 */
diff --git a/target/linux/airoha/patches-6.6/037-v6.14-net-airoha-Fix-error-path-in-airoha_probe.patch b/target/linux/airoha/patches-6.6/037-v6.14-net-airoha-Fix-error-path-in-airoha_probe.patch
new file mode 100644
index 00000000000000..9499c1541a1302
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/037-v6.14-net-airoha-Fix-error-path-in-airoha_probe.patch
@@ -0,0 +1,102 @@
+From 0c7469ee718e1dd929f52bfb142a7f6fb68f0765 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Mon, 16 Dec 2024 18:47:33 +0100
+Subject: [PATCH] net: airoha: Fix error path in airoha_probe()
+
+Do not run napi_disable() if airoha_hw_init() fails since Tx/Rx napi
+has not been started yet. In order to fix the issue, introduce
+airoha_qdma_stop_napi routine and remove napi_disable in
+airoha_hw_cleanup().
+
+Fixes: 23020f049327 ("net: airoha: Introduce ethernet support for EN7581 SoC")
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20241216-airoha_probe-error-path-fix-v2-1-6b10e04e9a5c@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/airoha_eth.c | 33 ++++++++++++++++------
+ 1 file changed, 25 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/airoha_eth.c
++++ b/drivers/net/ethernet/mediatek/airoha_eth.c
+@@ -2139,17 +2139,14 @@ static void airoha_hw_cleanup(struct air
+ 		if (!qdma->q_rx[i].ndesc)
+ 			continue;
+ 
+-		napi_disable(&qdma->q_rx[i].napi);
+ 		netif_napi_del(&qdma->q_rx[i].napi);
+ 		airoha_qdma_cleanup_rx_queue(&qdma->q_rx[i]);
+ 		if (qdma->q_rx[i].page_pool)
+ 			page_pool_destroy(qdma->q_rx[i].page_pool);
+ 	}
+ 
+-	for (i = 0; i < ARRAY_SIZE(qdma->q_tx_irq); i++) {
+-		napi_disable(&qdma->q_tx_irq[i].napi);
++	for (i = 0; i < ARRAY_SIZE(qdma->q_tx_irq); i++)
+ 		netif_napi_del(&qdma->q_tx_irq[i].napi);
+-	}
+ 
+ 	for (i = 0; i < ARRAY_SIZE(qdma->q_tx); i++) {
+ 		if (!qdma->q_tx[i].ndesc)
+@@ -2174,6 +2171,21 @@ static void airoha_qdma_start_napi(struc
+ 	}
+ }
+ 
++static void airoha_qdma_stop_napi(struct airoha_qdma *qdma)
++{
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(qdma->q_tx_irq); i++)
++		napi_disable(&qdma->q_tx_irq[i].napi);
++
++	for (i = 0; i < ARRAY_SIZE(qdma->q_rx); i++) {
++		if (!qdma->q_rx[i].ndesc)
++			continue;
++
++		napi_disable(&qdma->q_rx[i].napi);
++	}
++}
++
+ static void airoha_update_hw_stats(struct airoha_gdm_port *port)
+ {
+ 	struct airoha_eth *eth = port->qdma->eth;
+@@ -2731,7 +2743,7 @@ static int airoha_probe(struct platform_
+ 
+ 	err = airoha_hw_init(pdev, eth);
+ 	if (err)
+-		goto error;
++		goto error_hw_cleanup;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)
+ 		airoha_qdma_start_napi(&eth->qdma[i]);
+@@ -2746,13 +2758,16 @@ static int airoha_probe(struct platform_
+ 		err = airoha_alloc_gdm_port(eth, np);
+ 		if (err) {
+ 			of_node_put(np);
+-			goto error;
++			goto error_napi_stop;
+ 		}
+ 	}
+ 
+ 	return 0;
+ 
+-error:
++error_napi_stop:
++	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)
++		airoha_qdma_stop_napi(&eth->qdma[i]);
++error_hw_cleanup:
+ 	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)
+ 		airoha_hw_cleanup(&eth->qdma[i]);
+ 
+@@ -2773,8 +2788,10 @@ static void airoha_remove(struct platfor
+ 	struct airoha_eth *eth = platform_get_drvdata(pdev);
+ 	int i;
+ 
+-	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)
++	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++) {
++		airoha_qdma_stop_napi(&eth->qdma[i]);
+ 		airoha_hw_cleanup(&eth->qdma[i]);
++	}
+ 
+ 	for (i = 0; i < ARRAY_SIZE(eth->ports); i++) {
+ 		struct airoha_gdm_port *port = eth->ports[i];
diff --git a/target/linux/airoha/patches-6.6/038-01-v6.14-net-airoha-Enable-Tx-drop-capability-for-each-Tx-DMA.patch b/target/linux/airoha/patches-6.6/038-01-v6.14-net-airoha-Enable-Tx-drop-capability-for-each-Tx-DMA.patch
new file mode 100644
index 00000000000000..c8681aace5b556
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/038-01-v6.14-net-airoha-Enable-Tx-drop-capability-for-each-Tx-DMA.patch
@@ -0,0 +1,27 @@
+From 5f795590380476f1c9b7ed0ac945c9b0269dc23a Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 3 Jan 2025 13:17:02 +0100
+Subject: [PATCH 1/4] net: airoha: Enable Tx drop capability for each Tx DMA
+ ring
+
+This is a preliminary patch in order to enable hw Qdisc offloading.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/mediatek/airoha_eth.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ethernet/mediatek/airoha_eth.c
++++ b/drivers/net/ethernet/mediatek/airoha_eth.c
+@@ -1790,6 +1790,10 @@ static int airoha_qdma_init_tx_queue(str
+ 		WRITE_ONCE(q->desc[i].ctrl, cpu_to_le32(val));
+ 	}
+ 
++	/* xmit ring drop default setting */
++	airoha_qdma_set(qdma, REG_TX_RING_BLOCKING(qid),
++			TX_RING_IRQ_BLOCKING_TX_DROP_EN_MASK);
++
+ 	airoha_qdma_wr(qdma, REG_TX_RING_BASE(qid), dma_addr);
+ 	airoha_qdma_rmw(qdma, REG_TX_CPU_IDX(qid), TX_RING_CPU_IDX_MASK,
+ 			FIELD_PREP(TX_RING_CPU_IDX_MASK, q->head));
diff --git a/target/linux/airoha/patches-6.6/038-02-v6.14-net-airoha-Introduce-ndo_select_queue-callback.patch b/target/linux/airoha/patches-6.6/038-02-v6.14-net-airoha-Introduce-ndo_select_queue-callback.patch
new file mode 100644
index 00000000000000..75743bdd347b26
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/038-02-v6.14-net-airoha-Introduce-ndo_select_queue-callback.patch
@@ -0,0 +1,86 @@
+From 2b288b81560b94958cd68bbe54673e55a1730c95 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 3 Jan 2025 13:17:03 +0100
+Subject: [PATCH 2/4] net: airoha: Introduce ndo_select_queue callback
+
+Airoha EN7581 SoC supports 32 Tx DMA rings used to feed packets to QoS
+channels. Each channels supports 8 QoS queues where the user can apply
+QoS scheduling policies. In a similar way, the user can configure hw
+rate shaping for each QoS channel.
+Introduce ndo_select_queue callback in order to select the tx queue
+based on QoS channel and QoS queue. In particular, for dsa device select
+QoS channel according to the dsa user port index, rely on port id
+otherwise. Select QoS queue based on the skb priority.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/mediatek/airoha_eth.c | 30 ++++++++++++++++++++--
+ 1 file changed, 28 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/airoha_eth.c
++++ b/drivers/net/ethernet/mediatek/airoha_eth.c
+@@ -23,6 +23,8 @@
+ #define AIROHA_MAX_NUM_XSI_RSTS		5
+ #define AIROHA_MAX_MTU			2000
+ #define AIROHA_MAX_PACKET_SIZE		2048
++#define AIROHA_NUM_QOS_CHANNELS		4
++#define AIROHA_NUM_QOS_QUEUES		8
+ #define AIROHA_NUM_TX_RING		32
+ #define AIROHA_NUM_RX_RING		32
+ #define AIROHA_FE_MC_MAX_VLAN_TABLE	64
+@@ -2422,21 +2424,44 @@ static void airoha_dev_get_stats64(struc
+ 	} while (u64_stats_fetch_retry(&port->stats.syncp, start));
+ }
+ 
++static u16 airoha_dev_select_queue(struct net_device *dev, struct sk_buff *skb,
++				   struct net_device *sb_dev)
++{
++	struct airoha_gdm_port *port = netdev_priv(dev);
++	int queue, channel;
++
++	/* For dsa device select QoS channel according to the dsa user port
++	 * index, rely on port id otherwise. Select QoS queue based on the
++	 * skb priority.
++	 */
++	channel = netdev_uses_dsa(dev) ? skb_get_queue_mapping(skb) : port->id;
++	channel = channel % AIROHA_NUM_QOS_CHANNELS;
++	queue = (skb->priority - 1) % AIROHA_NUM_QOS_QUEUES; /* QoS queue */
++	queue = channel * AIROHA_NUM_QOS_QUEUES + queue;
++
++	return queue < dev->num_tx_queues ? queue : 0;
++}
++
+ static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb,
+ 				   struct net_device *dev)
+ {
+ 	struct skb_shared_info *sinfo = skb_shinfo(skb);
+ 	struct airoha_gdm_port *port = netdev_priv(dev);
+-	u32 msg0 = 0, msg1, len = skb_headlen(skb);
+-	int i, qid = skb_get_queue_mapping(skb);
++	u32 msg0, msg1, len = skb_headlen(skb);
+ 	struct airoha_qdma *qdma = port->qdma;
+ 	u32 nr_frags = 1 + sinfo->nr_frags;
+ 	struct netdev_queue *txq;
+ 	struct airoha_queue *q;
+ 	void *data = skb->data;
++	int i, qid;
+ 	u16 index;
+ 	u8 fport;
+ 
++	qid = skb_get_queue_mapping(skb) % ARRAY_SIZE(qdma->q_tx);
++	msg0 = FIELD_PREP(QDMA_ETH_TXMSG_CHAN_MASK,
++			  qid / AIROHA_NUM_QOS_QUEUES) |
++	       FIELD_PREP(QDMA_ETH_TXMSG_QUEUE_MASK,
++			  qid % AIROHA_NUM_QOS_QUEUES);
+ 	if (skb->ip_summed == CHECKSUM_PARTIAL)
+ 		msg0 |= FIELD_PREP(QDMA_ETH_TXMSG_TCO_MASK, 1) |
+ 			FIELD_PREP(QDMA_ETH_TXMSG_UCO_MASK, 1) |
+@@ -2610,6 +2635,7 @@ static const struct net_device_ops airoh
+ 	.ndo_init		= airoha_dev_init,
+ 	.ndo_open		= airoha_dev_open,
+ 	.ndo_stop		= airoha_dev_stop,
++	.ndo_select_queue	= airoha_dev_select_queue,
+ 	.ndo_start_xmit		= airoha_dev_xmit,
+ 	.ndo_get_stats64        = airoha_dev_get_stats64,
+ 	.ndo_set_mac_address	= airoha_dev_set_macaddr,
diff --git a/target/linux/airoha/patches-6.6/038-03-v6.14-net-airoha-Add-sched-ETS-offload-support.patch b/target/linux/airoha/patches-6.6/038-03-v6.14-net-airoha-Add-sched-ETS-offload-support.patch
new file mode 100644
index 00000000000000..ad5e0e5c2a63b1
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/038-03-v6.14-net-airoha-Add-sched-ETS-offload-support.patch
@@ -0,0 +1,292 @@
+From 20bf7d07c956e5c7a22d3076c599cbb7a6054917 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 3 Jan 2025 13:17:04 +0100
+Subject: [PATCH 3/4] net: airoha: Add sched ETS offload support
+
+Introduce support for ETS Qdisc offload available on the Airoha EN7581
+ethernet controller. In order to be effective, ETS Qdisc must configured
+as leaf of a HTB Qdisc (HTB Qdisc offload will be added in the following
+patch). ETS Qdisc available on EN7581 ethernet controller supports at
+most 8 concurrent bands (QoS queues). We can enable an ETS Qdisc for
+each available QoS channel.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/mediatek/airoha_eth.c | 196 ++++++++++++++++++++-
+ 1 file changed, 195 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/airoha_eth.c
++++ b/drivers/net/ethernet/mediatek/airoha_eth.c
+@@ -15,6 +15,7 @@
+ #include <linux/u64_stats_sync.h>
+ #include <net/dsa.h>
+ #include <net/page_pool/helpers.h>
++#include <net/pkt_cls.h>
+ #include <uapi/linux/ppp_defs.h>
+ 
+ #define AIROHA_MAX_NUM_GDM_PORTS	1
+@@ -543,9 +544,24 @@
+ #define INGRESS_SLOW_TICK_RATIO_MASK	GENMASK(29, 16)
+ #define INGRESS_FAST_TICK_MASK		GENMASK(15, 0)
+ 
++#define REG_QUEUE_CLOSE_CFG(_n)		(0x00a0 + ((_n) & 0xfc))
++#define TXQ_DISABLE_CHAN_QUEUE_MASK(_n, _m)	BIT((_m) + (((_n) & 0x3) << 3))
++
+ #define REG_TXQ_DIS_CFG_BASE(_n)	((_n) ? 0x20a0 : 0x00a0)
+ #define REG_TXQ_DIS_CFG(_n, _m)		(REG_TXQ_DIS_CFG_BASE((_n)) + (_m) << 2)
+ 
++#define REG_CNTR_CFG(_n)		(0x0400 + ((_n) << 3))
++#define CNTR_EN_MASK			BIT(31)
++#define CNTR_ALL_CHAN_EN_MASK		BIT(30)
++#define CNTR_ALL_QUEUE_EN_MASK		BIT(29)
++#define CNTR_ALL_DSCP_RING_EN_MASK	BIT(28)
++#define CNTR_SRC_MASK			GENMASK(27, 24)
++#define CNTR_DSCP_RING_MASK		GENMASK(20, 16)
++#define CNTR_CHAN_MASK			GENMASK(7, 3)
++#define CNTR_QUEUE_MASK			GENMASK(2, 0)
++
++#define REG_CNTR_VAL(_n)		(0x0404 + ((_n) << 3))
++
+ #define REG_LMGR_INIT_CFG		0x1000
+ #define LMGR_INIT_START			BIT(31)
+ #define LMGR_SRAM_MODE_MASK		BIT(30)
+@@ -571,9 +587,19 @@
+ #define TWRR_WEIGHT_SCALE_MASK		BIT(31)
+ #define TWRR_WEIGHT_BASE_MASK		BIT(3)
+ 
++#define REG_TXWRR_WEIGHT_CFG		0x1024
++#define TWRR_RW_CMD_MASK		BIT(31)
++#define TWRR_RW_CMD_DONE		BIT(30)
++#define TWRR_CHAN_IDX_MASK		GENMASK(23, 19)
++#define TWRR_QUEUE_IDX_MASK		GENMASK(18, 16)
++#define TWRR_VALUE_MASK			GENMASK(15, 0)
++
+ #define REG_PSE_BUF_USAGE_CFG		0x1028
+ #define PSE_BUF_ESTIMATE_EN_MASK	BIT(29)
+ 
++#define REG_CHAN_QOS_MODE(_n)		(0x1040 + ((_n) << 2))
++#define CHAN_QOS_MODE_MASK(_n)		GENMASK(2 + ((_n) << 2), (_n) << 2)
++
+ #define REG_GLB_TRTCM_CFG		0x1080
+ #define GLB_TRTCM_EN_MASK		BIT(31)
+ #define GLB_TRTCM_MODE_MASK		BIT(30)
+@@ -722,6 +748,17 @@ enum {
+ 	FE_PSE_PORT_DROP = 0xf,
+ };
+ 
++enum tx_sched_mode {
++	TC_SCH_WRR8,
++	TC_SCH_SP,
++	TC_SCH_WRR7,
++	TC_SCH_WRR6,
++	TC_SCH_WRR5,
++	TC_SCH_WRR4,
++	TC_SCH_WRR3,
++	TC_SCH_WRR2,
++};
++
+ struct airoha_queue_entry {
+ 	union {
+ 		void *buf;
+@@ -812,6 +849,10 @@ struct airoha_gdm_port {
+ 	int id;
+ 
+ 	struct airoha_hw_stats stats;
++
++	/* qos stats counters */
++	u64 cpu_tx_packets;
++	u64 fwd_tx_packets;
+ };
+ 
+ struct airoha_eth {
+@@ -1962,6 +2003,27 @@ static void airoha_qdma_init_qos(struct
+ 			FIELD_PREP(SLA_SLOW_TICK_RATIO_MASK, 40));
+ }
+ 
++static void airoha_qdma_init_qos_stats(struct airoha_qdma *qdma)
++{
++	int i;
++
++	for (i = 0; i < AIROHA_NUM_QOS_CHANNELS; i++) {
++		/* Tx-cpu transferred count */
++		airoha_qdma_wr(qdma, REG_CNTR_VAL(i << 1), 0);
++		airoha_qdma_wr(qdma, REG_CNTR_CFG(i << 1),
++			       CNTR_EN_MASK | CNTR_ALL_QUEUE_EN_MASK |
++			       CNTR_ALL_DSCP_RING_EN_MASK |
++			       FIELD_PREP(CNTR_CHAN_MASK, i));
++		/* Tx-fwd transferred count */
++		airoha_qdma_wr(qdma, REG_CNTR_VAL((i << 1) + 1), 0);
++		airoha_qdma_wr(qdma, REG_CNTR_CFG(i << 1),
++			       CNTR_EN_MASK | CNTR_ALL_QUEUE_EN_MASK |
++			       CNTR_ALL_DSCP_RING_EN_MASK |
++			       FIELD_PREP(CNTR_SRC_MASK, 1) |
++			       FIELD_PREP(CNTR_CHAN_MASK, i));
++	}
++}
++
+ static int airoha_qdma_hw_init(struct airoha_qdma *qdma)
+ {
+ 	int i;
+@@ -2012,6 +2074,7 @@ static int airoha_qdma_hw_init(struct ai
+ 
+ 	airoha_qdma_set(qdma, REG_TXQ_CNGST_CFG,
+ 			TXQ_CNGST_DROP_EN | TXQ_CNGST_DEI_DROP_EN);
++	airoha_qdma_init_qos_stats(qdma);
+ 
+ 	return 0;
+ }
+@@ -2631,6 +2694,135 @@ airoha_ethtool_get_rmon_stats(struct net
+ 	} while (u64_stats_fetch_retry(&port->stats.syncp, start));
+ }
+ 
++static int airoha_qdma_set_chan_tx_sched(struct airoha_gdm_port *port,
++					 int channel, enum tx_sched_mode mode,
++					 const u16 *weights, u8 n_weights)
++{
++	int i;
++
++	for (i = 0; i < AIROHA_NUM_TX_RING; i++)
++		airoha_qdma_clear(port->qdma, REG_QUEUE_CLOSE_CFG(channel),
++				  TXQ_DISABLE_CHAN_QUEUE_MASK(channel, i));
++
++	for (i = 0; i < n_weights; i++) {
++		u32 status;
++		int err;
++
++		airoha_qdma_wr(port->qdma, REG_TXWRR_WEIGHT_CFG,
++			       TWRR_RW_CMD_MASK |
++			       FIELD_PREP(TWRR_CHAN_IDX_MASK, channel) |
++			       FIELD_PREP(TWRR_QUEUE_IDX_MASK, i) |
++			       FIELD_PREP(TWRR_VALUE_MASK, weights[i]));
++		err = read_poll_timeout(airoha_qdma_rr, status,
++					status & TWRR_RW_CMD_DONE,
++					USEC_PER_MSEC, 10 * USEC_PER_MSEC,
++					true, port->qdma,
++					REG_TXWRR_WEIGHT_CFG);
++		if (err)
++			return err;
++	}
++
++	airoha_qdma_rmw(port->qdma, REG_CHAN_QOS_MODE(channel >> 3),
++			CHAN_QOS_MODE_MASK(channel),
++			mode << __ffs(CHAN_QOS_MODE_MASK(channel)));
++
++	return 0;
++}
++
++static int airoha_qdma_set_tx_prio_sched(struct airoha_gdm_port *port,
++					 int channel)
++{
++	static const u16 w[AIROHA_NUM_QOS_QUEUES] = {};
++
++	return airoha_qdma_set_chan_tx_sched(port, channel, TC_SCH_SP, w,
++					     ARRAY_SIZE(w));
++}
++
++static int airoha_qdma_set_tx_ets_sched(struct airoha_gdm_port *port,
++					int channel,
++					struct tc_ets_qopt_offload *opt)
++{
++	struct tc_ets_qopt_offload_replace_params *p = &opt->replace_params;
++	enum tx_sched_mode mode = TC_SCH_SP;
++	u16 w[AIROHA_NUM_QOS_QUEUES] = {};
++	int i, nstrict = 0;
++
++	if (p->bands > AIROHA_NUM_QOS_QUEUES)
++		return -EINVAL;
++
++	for (i = 0; i < p->bands; i++) {
++		if (!p->quanta[i])
++			nstrict++;
++	}
++
++	/* this configuration is not supported by the hw */
++	if (nstrict == AIROHA_NUM_QOS_QUEUES - 1)
++		return -EINVAL;
++
++	for (i = 0; i < p->bands - nstrict; i++)
++		w[i] = p->weights[nstrict + i];
++
++	if (!nstrict)
++		mode = TC_SCH_WRR8;
++	else if (nstrict < AIROHA_NUM_QOS_QUEUES - 1)
++		mode = nstrict + 1;
++
++	return airoha_qdma_set_chan_tx_sched(port, channel, mode, w,
++					     ARRAY_SIZE(w));
++}
++
++static int airoha_qdma_get_tx_ets_stats(struct airoha_gdm_port *port,
++					int channel,
++					struct tc_ets_qopt_offload *opt)
++{
++	u64 cpu_tx_packets = airoha_qdma_rr(port->qdma,
++					    REG_CNTR_VAL(channel << 1));
++	u64 fwd_tx_packets = airoha_qdma_rr(port->qdma,
++					    REG_CNTR_VAL((channel << 1) + 1));
++	u64 tx_packets = (cpu_tx_packets - port->cpu_tx_packets) +
++			 (fwd_tx_packets - port->fwd_tx_packets);
++	_bstats_update(opt->stats.bstats, 0, tx_packets);
++
++	port->cpu_tx_packets = cpu_tx_packets;
++	port->fwd_tx_packets = fwd_tx_packets;
++
++	return 0;
++}
++
++static int airoha_tc_setup_qdisc_ets(struct airoha_gdm_port *port,
++				     struct tc_ets_qopt_offload *opt)
++{
++	int channel = TC_H_MAJ(opt->handle) >> 16;
++
++	if (opt->parent == TC_H_ROOT)
++		return -EINVAL;
++
++	switch (opt->command) {
++	case TC_ETS_REPLACE:
++		return airoha_qdma_set_tx_ets_sched(port, channel, opt);
++	case TC_ETS_DESTROY:
++		/* PRIO is default qdisc scheduler */
++		return airoha_qdma_set_tx_prio_sched(port, channel);
++	case TC_ETS_STATS:
++		return airoha_qdma_get_tx_ets_stats(port, channel, opt);
++	default:
++		return -EOPNOTSUPP;
++	}
++}
++
++static int airoha_dev_tc_setup(struct net_device *dev, enum tc_setup_type type,
++			       void *type_data)
++{
++	struct airoha_gdm_port *port = netdev_priv(dev);
++
++	switch (type) {
++	case TC_SETUP_QDISC_ETS:
++		return airoha_tc_setup_qdisc_ets(port, type_data);
++	default:
++		return -EOPNOTSUPP;
++	}
++}
++
+ static const struct net_device_ops airoha_netdev_ops = {
+ 	.ndo_init		= airoha_dev_init,
+ 	.ndo_open		= airoha_dev_open,
+@@ -2639,6 +2831,7 @@ static const struct net_device_ops airoh
+ 	.ndo_start_xmit		= airoha_dev_xmit,
+ 	.ndo_get_stats64        = airoha_dev_get_stats64,
+ 	.ndo_set_mac_address	= airoha_dev_set_macaddr,
++	.ndo_setup_tc		= airoha_dev_tc_setup,
+ };
+ 
+ static const struct ethtool_ops airoha_ethtool_ops = {
+@@ -2688,7 +2881,8 @@ static int airoha_alloc_gdm_port(struct
+ 	dev->watchdog_timeo = 5 * HZ;
+ 	dev->hw_features = NETIF_F_IP_CSUM | NETIF_F_RXCSUM |
+ 			   NETIF_F_TSO6 | NETIF_F_IPV6_CSUM |
+-			   NETIF_F_SG | NETIF_F_TSO;
++			   NETIF_F_SG | NETIF_F_TSO |
++			   NETIF_F_HW_TC;
+ 	dev->features |= dev->hw_features;
+ 	dev->dev.of_node = np;
+ 	dev->irq = qdma->irq;
diff --git a/target/linux/airoha/patches-6.6/038-04-v6.14-net-airoha-Add-sched-HTB-offload-support.patch b/target/linux/airoha/patches-6.6/038-04-v6.14-net-airoha-Add-sched-HTB-offload-support.patch
new file mode 100644
index 00000000000000..1239b174e51c1a
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/038-04-v6.14-net-airoha-Add-sched-HTB-offload-support.patch
@@ -0,0 +1,371 @@
+From ef1ca9271313b4ea7b03de69576aacef1e78f381 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 3 Jan 2025 13:17:05 +0100
+Subject: [PATCH 4/4] net: airoha: Add sched HTB offload support
+
+Introduce support for HTB Qdisc offload available in the Airoha EN7581
+ethernet controller. EN7581 can offload only one level of HTB leafs.
+Each HTB leaf represents a QoS channel supported by EN7581 SoC.
+The typical use-case is creating a HTB leaf for QoS channel to rate
+limit the egress traffic and attach an ETS Qdisc to each HTB leaf in
+order to enforce traffic prioritization.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/mediatek/airoha_eth.c | 288 ++++++++++++++++++++-
+ 1 file changed, 287 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/airoha_eth.c
++++ b/drivers/net/ethernet/mediatek/airoha_eth.c
+@@ -28,6 +28,8 @@
+ #define AIROHA_NUM_QOS_QUEUES		8
+ #define AIROHA_NUM_TX_RING		32
+ #define AIROHA_NUM_RX_RING		32
++#define AIROHA_NUM_NETDEV_TX_RINGS	(AIROHA_NUM_TX_RING + \
++					 AIROHA_NUM_QOS_CHANNELS)
+ #define AIROHA_FE_MC_MAX_VLAN_TABLE	64
+ #define AIROHA_FE_MC_MAX_VLAN_PORT	16
+ #define AIROHA_NUM_TX_IRQ		2
+@@ -43,6 +45,9 @@
+ #define PSE_RSV_PAGES			128
+ #define PSE_QUEUE_RSV_PAGES		64
+ 
++#define QDMA_METER_IDX(_n)		((_n) & 0xff)
++#define QDMA_METER_GROUP(_n)		(((_n) >> 8) & 0x3)
++
+ /* FE */
+ #define PSE_BASE			0x0100
+ #define CSR_IFC_BASE			0x0200
+@@ -583,6 +588,17 @@
+ #define EGRESS_SLOW_TICK_RATIO_MASK	GENMASK(29, 16)
+ #define EGRESS_FAST_TICK_MASK		GENMASK(15, 0)
+ 
++#define TRTCM_PARAM_RW_MASK		BIT(31)
++#define TRTCM_PARAM_RW_DONE_MASK	BIT(30)
++#define TRTCM_PARAM_TYPE_MASK		GENMASK(29, 28)
++#define TRTCM_METER_GROUP_MASK		GENMASK(27, 26)
++#define TRTCM_PARAM_INDEX_MASK		GENMASK(23, 17)
++#define TRTCM_PARAM_RATE_TYPE_MASK	BIT(16)
++
++#define REG_TRTCM_CFG_PARAM(_n)		((_n) + 0x4)
++#define REG_TRTCM_DATA_LOW(_n)		((_n) + 0x8)
++#define REG_TRTCM_DATA_HIGH(_n)		((_n) + 0xc)
++
+ #define REG_TXWRR_MODE_CFG		0x1020
+ #define TWRR_WEIGHT_SCALE_MASK		BIT(31)
+ #define TWRR_WEIGHT_BASE_MASK		BIT(3)
+@@ -759,6 +775,29 @@ enum tx_sched_mode {
+ 	TC_SCH_WRR2,
+ };
+ 
++enum trtcm_param_type {
++	TRTCM_MISC_MODE, /* meter_en, pps_mode, tick_sel */
++	TRTCM_TOKEN_RATE_MODE,
++	TRTCM_BUCKETSIZE_SHIFT_MODE,
++	TRTCM_BUCKET_COUNTER_MODE,
++};
++
++enum trtcm_mode_type {
++	TRTCM_COMMIT_MODE,
++	TRTCM_PEAK_MODE,
++};
++
++enum trtcm_param {
++	TRTCM_TICK_SEL = BIT(0),
++	TRTCM_PKT_MODE = BIT(1),
++	TRTCM_METER_MODE = BIT(2),
++};
++
++#define MIN_TOKEN_SIZE				4096
++#define MAX_TOKEN_SIZE_OFFSET			17
++#define TRTCM_TOKEN_RATE_MASK			GENMASK(23, 6)
++#define TRTCM_TOKEN_RATE_FRACTION_MASK		GENMASK(5, 0)
++
+ struct airoha_queue_entry {
+ 	union {
+ 		void *buf;
+@@ -850,6 +889,8 @@ struct airoha_gdm_port {
+ 
+ 	struct airoha_hw_stats stats;
+ 
++	DECLARE_BITMAP(qos_sq_bmap, AIROHA_NUM_QOS_CHANNELS);
++
+ 	/* qos stats counters */
+ 	u64 cpu_tx_packets;
+ 	u64 fwd_tx_packets;
+@@ -2810,6 +2851,243 @@ static int airoha_tc_setup_qdisc_ets(str
+ 	}
+ }
+ 
++static int airoha_qdma_get_trtcm_param(struct airoha_qdma *qdma, int channel,
++				       u32 addr, enum trtcm_param_type param,
++				       enum trtcm_mode_type mode,
++				       u32 *val_low, u32 *val_high)
++{
++	u32 idx = QDMA_METER_IDX(channel), group = QDMA_METER_GROUP(channel);
++	u32 val, config = FIELD_PREP(TRTCM_PARAM_TYPE_MASK, param) |
++			  FIELD_PREP(TRTCM_METER_GROUP_MASK, group) |
++			  FIELD_PREP(TRTCM_PARAM_INDEX_MASK, idx) |
++			  FIELD_PREP(TRTCM_PARAM_RATE_TYPE_MASK, mode);
++
++	airoha_qdma_wr(qdma, REG_TRTCM_CFG_PARAM(addr), config);
++	if (read_poll_timeout(airoha_qdma_rr, val,
++			      val & TRTCM_PARAM_RW_DONE_MASK,
++			      USEC_PER_MSEC, 10 * USEC_PER_MSEC, true,
++			      qdma, REG_TRTCM_CFG_PARAM(addr)))
++		return -ETIMEDOUT;
++
++	*val_low = airoha_qdma_rr(qdma, REG_TRTCM_DATA_LOW(addr));
++	if (val_high)
++		*val_high = airoha_qdma_rr(qdma, REG_TRTCM_DATA_HIGH(addr));
++
++	return 0;
++}
++
++static int airoha_qdma_set_trtcm_param(struct airoha_qdma *qdma, int channel,
++				       u32 addr, enum trtcm_param_type param,
++				       enum trtcm_mode_type mode, u32 val)
++{
++	u32 idx = QDMA_METER_IDX(channel), group = QDMA_METER_GROUP(channel);
++	u32 config = TRTCM_PARAM_RW_MASK |
++		     FIELD_PREP(TRTCM_PARAM_TYPE_MASK, param) |
++		     FIELD_PREP(TRTCM_METER_GROUP_MASK, group) |
++		     FIELD_PREP(TRTCM_PARAM_INDEX_MASK, idx) |
++		     FIELD_PREP(TRTCM_PARAM_RATE_TYPE_MASK, mode);
++
++	airoha_qdma_wr(qdma, REG_TRTCM_DATA_LOW(addr), val);
++	airoha_qdma_wr(qdma, REG_TRTCM_CFG_PARAM(addr), config);
++
++	return read_poll_timeout(airoha_qdma_rr, val,
++				 val & TRTCM_PARAM_RW_DONE_MASK,
++				 USEC_PER_MSEC, 10 * USEC_PER_MSEC, true,
++				 qdma, REG_TRTCM_CFG_PARAM(addr));
++}
++
++static int airoha_qdma_set_trtcm_config(struct airoha_qdma *qdma, int channel,
++					u32 addr, enum trtcm_mode_type mode,
++					bool enable, u32 enable_mask)
++{
++	u32 val;
++
++	if (airoha_qdma_get_trtcm_param(qdma, channel, addr, TRTCM_MISC_MODE,
++					mode, &val, NULL))
++		return -EINVAL;
++
++	val = enable ? val | enable_mask : val & ~enable_mask;
++
++	return airoha_qdma_set_trtcm_param(qdma, channel, addr, TRTCM_MISC_MODE,
++					   mode, val);
++}
++
++static int airoha_qdma_set_trtcm_token_bucket(struct airoha_qdma *qdma,
++					      int channel, u32 addr,
++					      enum trtcm_mode_type mode,
++					      u32 rate_val, u32 bucket_size)
++{
++	u32 val, config, tick, unit, rate, rate_frac;
++	int err;
++
++	if (airoha_qdma_get_trtcm_param(qdma, channel, addr, TRTCM_MISC_MODE,
++					mode, &config, NULL))
++		return -EINVAL;
++
++	val = airoha_qdma_rr(qdma, addr);
++	tick = FIELD_GET(INGRESS_FAST_TICK_MASK, val);
++	if (config & TRTCM_TICK_SEL)
++		tick *= FIELD_GET(INGRESS_SLOW_TICK_RATIO_MASK, val);
++	if (!tick)
++		return -EINVAL;
++
++	unit = (config & TRTCM_PKT_MODE) ? 1000000 / tick : 8000 / tick;
++	if (!unit)
++		return -EINVAL;
++
++	rate = rate_val / unit;
++	rate_frac = rate_val % unit;
++	rate_frac = FIELD_PREP(TRTCM_TOKEN_RATE_MASK, rate_frac) / unit;
++	rate = FIELD_PREP(TRTCM_TOKEN_RATE_MASK, rate) |
++	       FIELD_PREP(TRTCM_TOKEN_RATE_FRACTION_MASK, rate_frac);
++
++	err = airoha_qdma_set_trtcm_param(qdma, channel, addr,
++					  TRTCM_TOKEN_RATE_MODE, mode, rate);
++	if (err)
++		return err;
++
++	val = max_t(u32, bucket_size, MIN_TOKEN_SIZE);
++	val = min_t(u32, __fls(val), MAX_TOKEN_SIZE_OFFSET);
++
++	return airoha_qdma_set_trtcm_param(qdma, channel, addr,
++					   TRTCM_BUCKETSIZE_SHIFT_MODE,
++					   mode, val);
++}
++
++static int airoha_qdma_set_tx_rate_limit(struct airoha_gdm_port *port,
++					 int channel, u32 rate,
++					 u32 bucket_size)
++{
++	int i, err;
++
++	for (i = 0; i <= TRTCM_PEAK_MODE; i++) {
++		err = airoha_qdma_set_trtcm_config(port->qdma, channel,
++						   REG_EGRESS_TRTCM_CFG, i,
++						   !!rate, TRTCM_METER_MODE);
++		if (err)
++			return err;
++
++		err = airoha_qdma_set_trtcm_token_bucket(port->qdma, channel,
++							 REG_EGRESS_TRTCM_CFG,
++							 i, rate, bucket_size);
++		if (err)
++			return err;
++	}
++
++	return 0;
++}
++
++static int airoha_tc_htb_alloc_leaf_queue(struct airoha_gdm_port *port,
++					  struct tc_htb_qopt_offload *opt)
++{
++	u32 channel = TC_H_MIN(opt->classid) % AIROHA_NUM_QOS_CHANNELS;
++	u32 rate = div_u64(opt->rate, 1000) << 3; /* kbps */
++	struct net_device *dev = port->dev;
++	int num_tx_queues = dev->real_num_tx_queues;
++	int err;
++
++	if (opt->parent_classid != TC_HTB_CLASSID_ROOT) {
++		NL_SET_ERR_MSG_MOD(opt->extack, "invalid parent classid");
++		return -EINVAL;
++	}
++
++	err = airoha_qdma_set_tx_rate_limit(port, channel, rate, opt->quantum);
++	if (err) {
++		NL_SET_ERR_MSG_MOD(opt->extack,
++				   "failed configuring htb offload");
++		return err;
++	}
++
++	if (opt->command == TC_HTB_NODE_MODIFY)
++		return 0;
++
++	err = netif_set_real_num_tx_queues(dev, num_tx_queues + 1);
++	if (err) {
++		airoha_qdma_set_tx_rate_limit(port, channel, 0, opt->quantum);
++		NL_SET_ERR_MSG_MOD(opt->extack,
++				   "failed setting real_num_tx_queues");
++		return err;
++	}
++
++	set_bit(channel, port->qos_sq_bmap);
++	opt->qid = AIROHA_NUM_TX_RING + channel;
++
++	return 0;
++}
++
++static void airoha_tc_remove_htb_queue(struct airoha_gdm_port *port, int queue)
++{
++	struct net_device *dev = port->dev;
++
++	netif_set_real_num_tx_queues(dev, dev->real_num_tx_queues - 1);
++	airoha_qdma_set_tx_rate_limit(port, queue + 1, 0, 0);
++	clear_bit(queue, port->qos_sq_bmap);
++}
++
++static int airoha_tc_htb_delete_leaf_queue(struct airoha_gdm_port *port,
++					   struct tc_htb_qopt_offload *opt)
++{
++	u32 channel = TC_H_MIN(opt->classid) % AIROHA_NUM_QOS_CHANNELS;
++
++	if (!test_bit(channel, port->qos_sq_bmap)) {
++		NL_SET_ERR_MSG_MOD(opt->extack, "invalid queue id");
++		return -EINVAL;
++	}
++
++	airoha_tc_remove_htb_queue(port, channel);
++
++	return 0;
++}
++
++static int airoha_tc_htb_destroy(struct airoha_gdm_port *port)
++{
++	int q;
++
++	for_each_set_bit(q, port->qos_sq_bmap, AIROHA_NUM_QOS_CHANNELS)
++		airoha_tc_remove_htb_queue(port, q);
++
++	return 0;
++}
++
++static int airoha_tc_get_htb_get_leaf_queue(struct airoha_gdm_port *port,
++					    struct tc_htb_qopt_offload *opt)
++{
++	u32 channel = TC_H_MIN(opt->classid) % AIROHA_NUM_QOS_CHANNELS;
++
++	if (!test_bit(channel, port->qos_sq_bmap)) {
++		NL_SET_ERR_MSG_MOD(opt->extack, "invalid queue id");
++		return -EINVAL;
++	}
++
++	opt->qid = channel;
++
++	return 0;
++}
++
++static int airoha_tc_setup_qdisc_htb(struct airoha_gdm_port *port,
++				     struct tc_htb_qopt_offload *opt)
++{
++	switch (opt->command) {
++	case TC_HTB_CREATE:
++		break;
++	case TC_HTB_DESTROY:
++		return airoha_tc_htb_destroy(port);
++	case TC_HTB_NODE_MODIFY:
++	case TC_HTB_LEAF_ALLOC_QUEUE:
++		return airoha_tc_htb_alloc_leaf_queue(port, opt);
++	case TC_HTB_LEAF_DEL:
++	case TC_HTB_LEAF_DEL_LAST:
++	case TC_HTB_LEAF_DEL_LAST_FORCE:
++		return airoha_tc_htb_delete_leaf_queue(port, opt);
++	case TC_HTB_LEAF_QUERY_QUEUE:
++		return airoha_tc_get_htb_get_leaf_queue(port, opt);
++	default:
++		return -EOPNOTSUPP;
++	}
++
++	return 0;
++}
++
+ static int airoha_dev_tc_setup(struct net_device *dev, enum tc_setup_type type,
+ 			       void *type_data)
+ {
+@@ -2818,6 +3096,8 @@ static int airoha_dev_tc_setup(struct ne
+ 	switch (type) {
+ 	case TC_SETUP_QDISC_ETS:
+ 		return airoha_tc_setup_qdisc_ets(port, type_data);
++	case TC_SETUP_QDISC_HTB:
++		return airoha_tc_setup_qdisc_htb(port, type_data);
+ 	default:
+ 		return -EOPNOTSUPP;
+ 	}
+@@ -2868,7 +3148,8 @@ static int airoha_alloc_gdm_port(struct
+ 	}
+ 
+ 	dev = devm_alloc_etherdev_mqs(eth->dev, sizeof(*port),
+-				      AIROHA_NUM_TX_RING, AIROHA_NUM_RX_RING);
++				      AIROHA_NUM_NETDEV_TX_RINGS,
++				      AIROHA_NUM_RX_RING);
+ 	if (!dev) {
+ 		dev_err(eth->dev, "alloc_etherdev failed\n");
+ 		return -ENOMEM;
+@@ -2888,6 +3169,11 @@ static int airoha_alloc_gdm_port(struct
+ 	dev->irq = qdma->irq;
+ 	SET_NETDEV_DEV(dev, eth->dev);
+ 
++	/* reserve hw queues for HTB offloading */
++	err = netif_set_real_num_tx_queues(dev, AIROHA_NUM_TX_RING);
++	if (err)
++		return err;
++
+ 	err = of_get_ethdev_address(np, dev);
+ 	if (err) {
+ 		if (err == -EPROBE_DEFER)
diff --git a/target/linux/airoha/patches-6.6/039-v6.14-cpufreq-airoha-Add-EN7581-CPUFreq-SMCCC-driver.patch b/target/linux/airoha/patches-6.6/039-v6.14-cpufreq-airoha-Add-EN7581-CPUFreq-SMCCC-driver.patch
new file mode 100644
index 00000000000000..0db82d55e14451
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/039-v6.14-cpufreq-airoha-Add-EN7581-CPUFreq-SMCCC-driver.patch
@@ -0,0 +1,232 @@
+From 84cf9e541cccb8cb698518a9897942e8c78f1d83 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 9 Jan 2025 14:12:58 +0100
+Subject: [PATCH] cpufreq: airoha: Add EN7581 CPUFreq SMCCC driver
+
+Add simple CPU Freq driver for Airoha EN7581 SoC that control CPU
+frequency scaling with SMC APIs and register a generic "cpufreq-dt"
+device.
+
+All CPU share the same frequency and can't be controlled independently.
+CPU frequency is controlled by the attached PM domain.
+
+Add SoC compatible to cpufreq-dt-plat block list as a dedicated cpufreq
+driver is needed with OPP v2 nodes declared in DTS.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
+---
+ drivers/cpufreq/Kconfig.arm          |   8 ++
+ drivers/cpufreq/Makefile             |   1 +
+ drivers/cpufreq/airoha-cpufreq.c     | 152 +++++++++++++++++++++++++++
+ drivers/cpufreq/cpufreq-dt-platdev.c |   2 +
+ 4 files changed, 163 insertions(+)
+ create mode 100644 drivers/cpufreq/airoha-cpufreq.c
+
+--- a/drivers/cpufreq/Kconfig.arm
++++ b/drivers/cpufreq/Kconfig.arm
+@@ -41,6 +41,14 @@ config ARM_ALLWINNER_SUN50I_CPUFREQ_NVME
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called sun50i-cpufreq-nvmem.
+ 
++config ARM_AIROHA_SOC_CPUFREQ
++	tristate "Airoha EN7581 SoC CPUFreq support"
++	depends on ARCH_AIROHA || COMPILE_TEST
++	select PM_OPP
++	default ARCH_AIROHA
++	help
++	  This adds the CPUFreq driver for Airoha EN7581 SoCs.
++
+ config ARM_APPLE_SOC_CPUFREQ
+ 	tristate "Apple Silicon SoC CPUFreq support"
+ 	depends on ARCH_APPLE || (COMPILE_TEST && 64BIT)
+--- a/drivers/cpufreq/Makefile
++++ b/drivers/cpufreq/Makefile
+@@ -52,6 +52,7 @@ obj-$(CONFIG_X86_AMD_FREQ_SENSITIVITY)	+
+ 
+ ##################################################################################
+ # ARM SoC drivers
++obj-$(CONFIG_ARM_AIROHA_SOC_CPUFREQ)	+= airoha-cpufreq.o
+ obj-$(CONFIG_ARM_APPLE_SOC_CPUFREQ)	+= apple-soc-cpufreq.o
+ obj-$(CONFIG_ARM_ARMADA_37XX_CPUFREQ)	+= armada-37xx-cpufreq.o
+ obj-$(CONFIG_ARM_ARMADA_8K_CPUFREQ)	+= armada-8k-cpufreq.o
+--- /dev/null
++++ b/drivers/cpufreq/airoha-cpufreq.c
+@@ -0,0 +1,166 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <linux/bitfield.h>
++#include <linux/cpufreq.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/pm_runtime.h>
++#include <linux/slab.h>
++
++#include "cpufreq-dt.h"
++
++struct airoha_cpufreq_priv {
++	int opp_token;
++	struct device **virt_devs;
++	struct platform_device *cpufreq_dt;
++};
++
++static struct platform_device *cpufreq_pdev;
++
++/* NOP function to disable OPP from setting clock */
++static int airoha_cpufreq_config_clks_nop(struct device *dev,
++					  struct opp_table *opp_table,
++					  struct dev_pm_opp *old_opp,
++					  struct dev_pm_opp *opp,
++					  void *data, bool scaling_down)
++{
++	return 0;
++}
++
++static const char * const airoha_cpufreq_clk_names[] = { "cpu", NULL };
++static const char * const airoha_cpufreq_pd_names[] = { "perf", NULL };
++
++static int airoha_cpufreq_probe(struct platform_device *pdev)
++{
++	struct dev_pm_opp_config config = {
++		.clk_names = airoha_cpufreq_clk_names,
++		.config_clks = airoha_cpufreq_config_clks_nop,
++		.genpd_names = airoha_cpufreq_pd_names,
++	};
++	struct platform_device *cpufreq_dt;
++	struct airoha_cpufreq_priv *priv;
++	struct device *dev = &pdev->dev;
++	struct device **virt_devs = NULL;
++	struct device *cpu_dev;
++	int ret;
++
++	/* CPUs refer to the same OPP table */
++	cpu_dev = get_cpu_device(0);
++	if (!cpu_dev)
++		return -ENODEV;
++
++	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	/* Set OPP table conf with NOP config_clks */
++	priv->opp_token = dev_pm_opp_set_config(cpu_dev, &config);
++	if (priv->opp_token < 0)
++		return dev_err_probe(dev, priv->opp_token, "Failed to set OPP config\n");
++
++	/* Set Attached PM for OPP ACTIVE */
++	if (virt_devs) {
++		const char * const *name = airoha_cpufreq_pd_names;
++		int i, j;
++
++		for (i = 0; *name; i++, name++) {
++			ret = pm_runtime_resume_and_get(virt_devs[i]);
++			if (ret) {
++				dev_err(cpu_dev, "failed to resume %s: %d\n",
++					*name, ret);
++
++				/* Rollback previous PM runtime calls */
++				name = config.genpd_names;
++				for (j = 0; *name && j < i; j++, name++)
++					pm_runtime_put(virt_devs[j]);
++
++				goto err_register_cpufreq;
++			}
++		}
++		priv->virt_devs = virt_devs;
++	}
++
++	cpufreq_dt = platform_device_register_simple("cpufreq-dt", -1, NULL, 0);
++	ret = PTR_ERR_OR_ZERO(cpufreq_dt);
++	if (ret) {
++		dev_err(dev, "failed to create cpufreq-dt device: %d\n", ret);
++		goto err_register_cpufreq;
++	}
++
++	priv->cpufreq_dt = cpufreq_dt;
++	platform_set_drvdata(pdev, priv);
++
++	return 0;
++
++err_register_cpufreq:
++	dev_pm_opp_clear_config(priv->opp_token);
++
++	return ret;
++}
++
++static void airoha_cpufreq_remove(struct platform_device *pdev)
++{
++	struct airoha_cpufreq_priv *priv = platform_get_drvdata(pdev);
++	const char * const *name = airoha_cpufreq_pd_names;
++	int i;
++
++	platform_device_unregister(priv->cpufreq_dt);
++
++	dev_pm_opp_clear_config(priv->opp_token);
++
++	for (i = 0; *name; i++, name++)
++		pm_runtime_put(priv->virt_devs[i]);
++}
++
++static struct platform_driver airoha_cpufreq_driver = {
++	.probe = airoha_cpufreq_probe,
++	.remove_new = airoha_cpufreq_remove,
++	.driver = {
++		.name = "airoha-cpufreq",
++	},
++};
++
++static const struct of_device_id airoha_cpufreq_match_list[] __initconst = {
++	{ .compatible = "airoha,en7581" },
++	{},
++};
++MODULE_DEVICE_TABLE(of, airoha_cpufreq_match_list);
++
++static int __init airoha_cpufreq_init(void)
++{
++	struct device_node *np = of_find_node_by_path("/");
++	const struct of_device_id *match;
++	int ret;
++
++	if (!np)
++		return -ENODEV;
++
++	match = of_match_node(airoha_cpufreq_match_list, np);
++	of_node_put(np);
++	if (!match)
++		return -ENODEV;
++
++	ret = platform_driver_register(&airoha_cpufreq_driver);
++	if (unlikely(ret < 0))
++		return ret;
++
++	cpufreq_pdev = platform_device_register_data(NULL, "airoha-cpufreq",
++						     -1, match, sizeof(*match));
++	ret = PTR_ERR_OR_ZERO(cpufreq_pdev);
++	if (ret)
++		platform_driver_unregister(&airoha_cpufreq_driver);
++
++	return ret;
++}
++module_init(airoha_cpufreq_init);
++
++static void __exit airoha_cpufreq_exit(void)
++{
++	platform_device_unregister(cpufreq_pdev);
++	platform_driver_unregister(&airoha_cpufreq_driver);
++}
++module_exit(airoha_cpufreq_exit);
++
++MODULE_AUTHOR("Christian Marangi <ansuelsmth@gmail.com>");
++MODULE_DESCRIPTION("CPUfreq driver for Airoha SoCs");
++MODULE_LICENSE("GPL");
+--- a/drivers/cpufreq/cpufreq-dt-platdev.c
++++ b/drivers/cpufreq/cpufreq-dt-platdev.c
+@@ -103,6 +103,8 @@ static const struct of_device_id allowli
+  * platforms using "operating-points-v2" property.
+  */
+ static const struct of_device_id blocklist[] __initconst = {
++	{ .compatible = "airoha,en7581", },
++
+ 	{ .compatible = "allwinner,sun50i-h6", },
+ 
+ 	{ .compatible = "apple,arm-platform", },
diff --git a/target/linux/airoha/patches-6.6/039-v6.14-net-airoha-Enforce-ETS-Qdisc-priomap.patch b/target/linux/airoha/patches-6.6/039-v6.14-net-airoha-Enforce-ETS-Qdisc-priomap.patch
new file mode 100644
index 00000000000000..2753972070227a
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/039-v6.14-net-airoha-Enforce-ETS-Qdisc-priomap.patch
@@ -0,0 +1,53 @@
+From b56e4d660a9688ff83f5cbdc6e3ea063352d0d79 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sun, 12 Jan 2025 19:32:45 +0100
+Subject: [PATCH] net: airoha: Enforce ETS Qdisc priomap
+
+EN7581 SoC supports fixed QoS band priority where WRR queues have lowest
+priorities with respect to SP ones.
+E.g: WRR0, WRR1, .., WRRm, SP0, SP1, .., SPn
+
+Enforce ETS Qdisc priomap according to the hw capabilities.
+
+Suggested-by: Davide Caratti <dcaratti@redhat.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Davide Caratti <dcaratti@redhat.com>
+Link: https://patch.msgid.link/20250112-airoha_ets_priomap-v1-1-fb616de159ba@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/airoha_eth.c | 17 +++++++++++++++--
+ 1 file changed, 15 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/airoha_eth.c
++++ b/drivers/net/ethernet/mediatek/airoha_eth.c
+@@ -2786,7 +2786,7 @@ static int airoha_qdma_set_tx_ets_sched(
+ 	struct tc_ets_qopt_offload_replace_params *p = &opt->replace_params;
+ 	enum tx_sched_mode mode = TC_SCH_SP;
+ 	u16 w[AIROHA_NUM_QOS_QUEUES] = {};
+-	int i, nstrict = 0;
++	int i, nstrict = 0, nwrr, qidx;
+ 
+ 	if (p->bands > AIROHA_NUM_QOS_QUEUES)
+ 		return -EINVAL;
+@@ -2800,7 +2800,20 @@ static int airoha_qdma_set_tx_ets_sched(
+ 	if (nstrict == AIROHA_NUM_QOS_QUEUES - 1)
+ 		return -EINVAL;
+ 
+-	for (i = 0; i < p->bands - nstrict; i++)
++	/* EN7581 SoC supports fixed QoS band priority where WRR queues have
++	 * lowest priorities with respect to SP ones.
++	 * e.g: WRR0, WRR1, .., WRRm, SP0, SP1, .., SPn
++	 */
++	nwrr = p->bands - nstrict;
++	qidx = nstrict && nwrr ? nstrict : 0;
++	for (i = 1; i <= p->bands; i++) {
++		if (p->priomap[i % AIROHA_NUM_QOS_QUEUES] != qidx)
++			return -EINVAL;
++
++		qidx = i == nwrr ? 0 : qidx + 1;
++	}
++
++	for (i = 0; i < nwrr; i++)
+ 		w[i] = p->weights[nstrict + i];
+ 
+ 	if (!nstrict)
diff --git a/target/linux/airoha/patches-6.6/040-v6.14-pmdomain-airoha-Add-Airoha-CPU-PM-Domain-support.patch b/target/linux/airoha/patches-6.6/040-v6.14-pmdomain-airoha-Add-Airoha-CPU-PM-Domain-support.patch
new file mode 100644
index 00000000000000..8dc8a3d304a4c1
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/040-v6.14-pmdomain-airoha-Add-Airoha-CPU-PM-Domain-support.patch
@@ -0,0 +1,196 @@
+From 82e703dd438b71432cc0ccbb90925d1e32dd014a Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Thu, 9 Jan 2025 14:12:57 +0100
+Subject: [PATCH] pmdomain: airoha: Add Airoha CPU PM Domain support
+
+Add Airoha CPU PM Domain support to control frequency and power of CPU
+present on Airoha EN7581 SoC.
+
+Frequency and power can be controlled with the use of the SMC command by
+passing the performance state. The driver also expose a read-only clock
+that expose the current CPU frequency with SMC command.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Link: https://lore.kernel.org/r/20250109131313.32317-1-ansuelsmth@gmail.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+---
+ drivers/pmdomain/mediatek/Kconfig             |  12 ++
+ drivers/pmdomain/mediatek/Makefile            |   1 +
+ .../pmdomain/mediatek/airoha-cpu-pmdomain.c   | 144 ++++++++++++++++++
+ 3 files changed, 157 insertions(+)
+ create mode 100644 drivers/pmdomain/mediatek/airoha-cpu-pmdomain.c
+
+--- a/drivers/soc/mediatek/Kconfig
++++ b/drivers/soc/mediatek/Kconfig
+@@ -2,6 +2,17 @@
+ #
+ # MediaTek SoC drivers
+ #
++config AIROHA_CPU_PM_DOMAIN
++	tristate "Airoha CPU power domain"
++	default ARCH_AIROHA
++	depends on PM
++	select PM_GENERIC_DOMAINS
++	help
++	  Say y here to enable CPU power domain support for Airoha SoC.
++
++	  CPU frequency and power is controlled by ATF with SMC command to
++	  set performance states.
++
+ menu "MediaTek SoC drivers"
+ 	depends on ARCH_MEDIATEK || COMPILE_TEST
+ 
+--- a/drivers/pmdomain/mediatek/Makefile
++++ b/drivers/pmdomain/mediatek/Makefile
+@@ -1,3 +1,4 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ obj-$(CONFIG_MTK_SCPSYS)		+= mtk-scpsys.o
+ obj-$(CONFIG_MTK_SCPSYS_PM_DOMAINS) 	+= mtk-pm-domains.o
++obj-$(CONFIG_AIROHA_CPU_PM_DOMAIN) 	+= airoha-cpu-pmdomain.o
+--- /dev/null
++++ b/drivers/pmdomain/mediatek/airoha-cpu-pmdomain.c
+@@ -0,0 +1,144 @@
++// SPDX-License-Identifier: GPL-2.0
++
++#include <linux/arm-smccc.h>
++#include <linux/bitfield.h>
++#include <linux/clk-provider.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/pm_domain.h>
++#include <linux/slab.h>
++
++#define AIROHA_SIP_AVS_HANDLE			0x82000301
++#define AIROHA_AVS_OP_BASE			0xddddddd0
++#define AIROHA_AVS_OP_MASK			GENMASK(1, 0)
++#define AIROHA_AVS_OP_FREQ_DYN_ADJ		(AIROHA_AVS_OP_BASE | \
++						 FIELD_PREP(AIROHA_AVS_OP_MASK, 0x1))
++#define AIROHA_AVS_OP_GET_FREQ			(AIROHA_AVS_OP_BASE | \
++						 FIELD_PREP(AIROHA_AVS_OP_MASK, 0x2))
++
++struct airoha_cpu_pmdomain_priv {
++	struct clk_hw hw;
++	struct generic_pm_domain pd;
++};
++
++static long airoha_cpu_pmdomain_clk_round(struct clk_hw *hw, unsigned long rate,
++					  unsigned long *parent_rate)
++{
++	return rate;
++}
++
++static unsigned long airoha_cpu_pmdomain_clk_get(struct clk_hw *hw,
++						 unsigned long parent_rate)
++{
++	struct arm_smccc_res res;
++
++	arm_smccc_1_1_invoke(AIROHA_SIP_AVS_HANDLE, AIROHA_AVS_OP_GET_FREQ,
++			     0, 0, 0, 0, 0, 0, &res);
++
++	/* SMCCC returns freq in MHz */
++	return (int)(res.a0 * 1000 * 1000);
++}
++
++/* Airoha CPU clk SMCC is always enabled */
++static int airoha_cpu_pmdomain_clk_is_enabled(struct clk_hw *hw)
++{
++	return true;
++}
++
++static const struct clk_ops airoha_cpu_pmdomain_clk_ops = {
++	.recalc_rate = airoha_cpu_pmdomain_clk_get,
++	.is_enabled = airoha_cpu_pmdomain_clk_is_enabled,
++	.round_rate = airoha_cpu_pmdomain_clk_round,
++};
++
++static int airoha_cpu_pmdomain_set_performance_state(struct generic_pm_domain *domain,
++						     unsigned int state)
++{
++	struct arm_smccc_res res;
++
++	arm_smccc_1_1_invoke(AIROHA_SIP_AVS_HANDLE, AIROHA_AVS_OP_FREQ_DYN_ADJ,
++			     0, state, 0, 0, 0, 0, &res);
++
++	/* SMC signal correct apply by unsetting BIT 0 */
++	return res.a0 & BIT(0) ? -EINVAL : 0;
++}
++
++static int airoha_cpu_pmdomain_probe(struct platform_device *pdev)
++{
++	struct airoha_cpu_pmdomain_priv *priv;
++	struct device *dev = &pdev->dev;
++	const struct clk_init_data init = {
++		.name = "cpu",
++		.ops = &airoha_cpu_pmdomain_clk_ops,
++		/* Clock with no set_rate, can't cache */
++		.flags = CLK_GET_RATE_NOCACHE,
++	};
++	struct generic_pm_domain *pd;
++	int ret;
++
++	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	/* Init and register a get-only clk for Cpufreq */
++	priv->hw.init = &init;
++	ret = devm_clk_hw_register(dev, &priv->hw);
++	if (ret)
++		return ret;
++
++	ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get,
++					  &priv->hw);
++	if (ret)
++		return ret;
++
++	/* Init and register a PD for CPU */
++	pd = &priv->pd;
++	pd->name = "cpu_pd";
++	pd->flags = GENPD_FLAG_ALWAYS_ON;
++	pd->set_performance_state = airoha_cpu_pmdomain_set_performance_state;
++
++	ret = pm_genpd_init(pd, NULL, false);
++	if (ret)
++		return ret;
++
++	ret = of_genpd_add_provider_simple(dev->of_node, pd);
++	if (ret)
++		goto err_add_provider;
++
++	platform_set_drvdata(pdev, priv);
++
++	return 0;
++
++err_add_provider:
++	pm_genpd_remove(pd);
++
++	return ret;
++}
++
++static void airoha_cpu_pmdomain_remove(struct platform_device *pdev)
++{
++	struct airoha_cpu_pmdomain_priv *priv = platform_get_drvdata(pdev);
++
++	of_genpd_del_provider(pdev->dev.of_node);
++	pm_genpd_remove(&priv->pd);
++}
++
++static const struct of_device_id airoha_cpu_pmdomain_of_match[] = {
++	{ .compatible = "airoha,en7581-cpufreq" },
++	{ },
++};
++MODULE_DEVICE_TABLE(of, airoha_cpu_pmdomain_of_match);
++
++static struct platform_driver airoha_cpu_pmdomain_driver = {
++	.probe = airoha_cpu_pmdomain_probe,
++	.remove_new = airoha_cpu_pmdomain_remove,
++	.driver = {
++		.name = "airoha-cpu-pmdomain",
++		.of_match_table = airoha_cpu_pmdomain_of_match,
++	},
++};
++module_platform_driver(airoha_cpu_pmdomain_driver);
++
++MODULE_AUTHOR("Christian Marangi <ansuelsmth@gmail.com>");
++MODULE_DESCRIPTION("CPU PM domain driver for Airoha SoCs");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/airoha/patches-6.6/041-01-v6.14-clk-en7523-Rework-clock-handling-for-different-clock.patch b/target/linux/airoha/patches-6.6/041-01-v6.14-clk-en7523-Rework-clock-handling-for-different-clock.patch
new file mode 100644
index 00000000000000..96d2bbf28ef81f
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/041-01-v6.14-clk-en7523-Rework-clock-handling-for-different-clock.patch
@@ -0,0 +1,83 @@
+From e4a9748e7103c47e575459db2b6a77d14f34da2b Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 14 Jan 2025 00:10:02 +0100
+Subject: [PATCH 1/4] clk: en7523: Rework clock handling for different clock
+ numbers
+
+Airoha EN7581 SoC have additional clock compared to EN7523 but current
+driver permits to only support up to EN7523 clock numbers.
+
+To handle this, rework the clock handling and permit to declare the
+clocks number in match_data and alloca clk_data based on the compatible
+match_data.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Link: https://lore.kernel.org/r/20250113231030.6735-2-ansuelsmth@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/clk-en7523.c | 14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/clk/clk-en7523.c
++++ b/drivers/clk/clk-en7523.c
+@@ -75,6 +75,7 @@ struct en_rst_data {
+ };
+ 
+ struct en_clk_soc_data {
++	u32 num_clocks;
+ 	const struct clk_ops pcie_ops;
+ 	int (*hw_init)(struct platform_device *pdev,
+ 		       struct clk_hw_onecell_data *clk_data);
+@@ -504,8 +505,6 @@ static void en7523_register_clocks(struc
+ 	u32 rate;
+ 	int i;
+ 
+-	clk_data->num = EN7523_NUM_CLOCKS;
+-
+ 	for (i = 0; i < ARRAY_SIZE(en7523_base_clks); i++) {
+ 		const struct en_clk_desc *desc = &en7523_base_clks[i];
+ 		u32 reg = desc->div_reg ? desc->div_reg : desc->base_reg;
+@@ -587,8 +586,6 @@ static void en7581_register_clocks(struc
+ 
+ 	hw = en7523_register_pcie_clk(dev, base);
+ 	clk_data->hws[EN7523_CLK_PCIE] = hw;
+-
+-	clk_data->num = EN7523_NUM_CLOCKS;
+ }
+ 
+ static int en7523_reset_update(struct reset_controller_dev *rcdev,
+@@ -702,13 +699,15 @@ static int en7523_clk_probe(struct platf
+ 	struct clk_hw_onecell_data *clk_data;
+ 	int r;
+ 
++	soc_data = device_get_match_data(&pdev->dev);
++
+ 	clk_data = devm_kzalloc(&pdev->dev,
+-				struct_size(clk_data, hws, EN7523_NUM_CLOCKS),
++				struct_size(clk_data, hws, soc_data->num_clocks),
+ 				GFP_KERNEL);
+ 	if (!clk_data)
+ 		return -ENOMEM;
+ 
+-	soc_data = device_get_match_data(&pdev->dev);
++	clk_data->num = soc_data->num_clocks;
+ 	r = soc_data->hw_init(pdev, clk_data);
+ 	if (r)
+ 		return r;
+@@ -717,6 +716,7 @@ static int en7523_clk_probe(struct platf
+ }
+ 
+ static const struct en_clk_soc_data en7523_data = {
++	.num_clocks = ARRAY_SIZE(en7523_base_clks) + 1,
+ 	.pcie_ops = {
+ 		.is_enabled = en7523_pci_is_enabled,
+ 		.prepare = en7523_pci_prepare,
+@@ -726,6 +726,8 @@ static const struct en_clk_soc_data en75
+ };
+ 
+ static const struct en_clk_soc_data en7581_data = {
++	/* We increment num_clocks by 1 to account for additional PCIe clock */
++	.num_clocks = ARRAY_SIZE(en7581_base_clks) + 1,
+ 	.pcie_ops = {
+ 		.is_enabled = en7581_pci_is_enabled,
+ 		.enable = en7581_pci_enable,
diff --git a/target/linux/airoha/patches-6.6/041-02-v6.14-dt-bindings-clock-drop-NUM_CLOCKS-define-for-EN7581.patch b/target/linux/airoha/patches-6.6/041-02-v6.14-dt-bindings-clock-drop-NUM_CLOCKS-define-for-EN7581.patch
new file mode 100644
index 00000000000000..5db79a47488f91
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/041-02-v6.14-dt-bindings-clock-drop-NUM_CLOCKS-define-for-EN7581.patch
@@ -0,0 +1,26 @@
+From 02d3b7557ce28c373ea1e925ae16ab5988284313 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 14 Jan 2025 00:10:03 +0100
+Subject: [PATCH 2/4] dt-bindings: clock: drop NUM_CLOCKS define for EN7581
+
+Drop NUM_CLOCKS define for EN7581 include. This is not a binding and
+should not be placed here. Value is derived internally in the user
+driver.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20250113231030.6735-3-ansuelsmth@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+---
+ include/dt-bindings/clock/en7523-clk.h | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/include/dt-bindings/clock/en7523-clk.h
++++ b/include/dt-bindings/clock/en7523-clk.h
+@@ -12,6 +12,4 @@
+ #define EN7523_CLK_CRYPTO	6
+ #define EN7523_CLK_PCIE		7
+ 
+-#define EN7523_NUM_CLOCKS	8
+-
+ #endif /* _DT_BINDINGS_CLOCK_AIROHA_EN7523_H_ */
diff --git a/target/linux/airoha/patches-6.6/041-03-v6.14-dt-bindings-clock-add-ID-for-eMMC-for-EN7581.patch b/target/linux/airoha/patches-6.6/041-03-v6.14-dt-bindings-clock-add-ID-for-eMMC-for-EN7581.patch
new file mode 100644
index 00000000000000..a3f0c9e6fea76e
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/041-03-v6.14-dt-bindings-clock-add-ID-for-eMMC-for-EN7581.patch
@@ -0,0 +1,25 @@
+From 82108ad3285f58f314ad41398f44017c7dbe44de Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 14 Jan 2025 00:10:04 +0100
+Subject: [PATCH 3/4] dt-bindings: clock: add ID for eMMC for EN7581
+
+Add ID for eMMC for EN7581. This is to control clock selection of eMMC
+between 200MHz and 150MHz.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Acked-by: Conor Dooley <conor.dooley@microchip.com>
+Link: https://lore.kernel.org/r/20250113231030.6735-4-ansuelsmth@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+---
+ include/dt-bindings/clock/en7523-clk.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/include/dt-bindings/clock/en7523-clk.h
++++ b/include/dt-bindings/clock/en7523-clk.h
+@@ -12,4 +12,6 @@
+ #define EN7523_CLK_CRYPTO	6
+ #define EN7523_CLK_PCIE		7
+ 
++#define EN7581_CLK_EMMC		8
++
+ #endif /* _DT_BINDINGS_CLOCK_AIROHA_EN7523_H_ */
diff --git a/target/linux/airoha/patches-6.6/041-04-v6.14-clk-en7523-Add-clock-for-eMMC-for-EN7581.patch b/target/linux/airoha/patches-6.6/041-04-v6.14-clk-en7523-Add-clock-for-eMMC-for-EN7581.patch
new file mode 100644
index 00000000000000..6c8a3300bee185
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/041-04-v6.14-clk-en7523-Add-clock-for-eMMC-for-EN7581.patch
@@ -0,0 +1,41 @@
+From bfe257f9780d8f77045a7da6ec959ee0659d2f98 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 14 Jan 2025 00:10:05 +0100
+Subject: [PATCH 4/4] clk: en7523: Add clock for eMMC for EN7581
+
+Add clock for eMMC for EN7581. This is used to give info of the current
+eMMC source clock and to switch it from 200MHz or 150MHz.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Link: https://lore.kernel.org/r/20250113231030.6735-5-ansuelsmth@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/clk-en7523.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/clk/clk-en7523.c
++++ b/drivers/clk/clk-en7523.c
+@@ -91,6 +91,7 @@ static const u32 emi7581_base[] = { 5400
+ static const u32 bus7581_base[] = { 600000000, 540000000 };
+ static const u32 npu7581_base[] = { 800000000, 750000000, 720000000, 600000000 };
+ static const u32 crypto_base[] = { 540000000, 480000000 };
++static const u32 emmc7581_base[] = { 200000000, 150000000 };
+ 
+ static const struct en_clk_desc en7523_base_clks[] = {
+ 	{
+@@ -281,6 +282,15 @@ static const struct en_clk_desc en7581_b
+ 		.base_shift = 0,
+ 		.base_values = crypto_base,
+ 		.n_base_values = ARRAY_SIZE(crypto_base),
++	}, {
++		.id = EN7581_CLK_EMMC,
++		.name = "emmc",
++
++		.base_reg = REG_CRYPTO_CLKSRC2,
++		.base_bits = 1,
++		.base_shift = 12,
++		.base_values = emmc7581_base,
++		.n_base_values = ARRAY_SIZE(emmc7581_base),
+ 	}
+ };
+ 
diff --git a/target/linux/airoha/patches-6.6/042-01-v6.14-PCI-mediatek-gen3-Rely-on-clk_bulk_prepare_enable-in.patch b/target/linux/airoha/patches-6.6/042-01-v6.14-PCI-mediatek-gen3-Rely-on-clk_bulk_prepare_enable-in.patch
new file mode 100644
index 00000000000000..9e353f7926dc77
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/042-01-v6.14-PCI-mediatek-gen3-Rely-on-clk_bulk_prepare_enable-in.patch
@@ -0,0 +1,57 @@
+From 0e7a622da17da0042294860cdb7a2fac091d25b1 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Wed, 8 Jan 2025 10:50:40 +0100
+Subject: [PATCH 1/6] PCI: mediatek-gen3: Rely on clk_bulk_prepare_enable() in
+ mtk_pcie_en7581_power_up()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Replace clk_bulk_prepare() and clk_bulk_enable() with
+clk_bulk_prepare_enable() in mtk_pcie_en7581_power_up() routine.
+
+Link: https://lore.kernel.org/r/20250108-pcie-en7581-fixes-v6-1-21ac939a3b9b@kernel.org
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+---
+ drivers/pci/controller/pcie-mediatek-gen3.c | 14 +++-----------
+ 1 file changed, 3 insertions(+), 11 deletions(-)
+
+--- a/drivers/pci/controller/pcie-mediatek-gen3.c
++++ b/drivers/pci/controller/pcie-mediatek-gen3.c
+@@ -907,12 +907,6 @@ static int mtk_pcie_en7581_power_up(stru
+ 	pm_runtime_enable(dev);
+ 	pm_runtime_get_sync(dev);
+ 
+-	err = clk_bulk_prepare(pcie->num_clks, pcie->clks);
+-	if (err) {
+-		dev_err(dev, "failed to prepare clock\n");
+-		goto err_clk_prepare;
+-	}
+-
+ 	val = FIELD_PREP(PCIE_VAL_LN0_DOWNSTREAM, 0x47) |
+ 	      FIELD_PREP(PCIE_VAL_LN1_DOWNSTREAM, 0x47) |
+ 	      FIELD_PREP(PCIE_VAL_LN0_UPSTREAM, 0x41) |
+@@ -925,17 +919,15 @@ static int mtk_pcie_en7581_power_up(stru
+ 	      FIELD_PREP(PCIE_K_FINETUNE_MAX, 0xf);
+ 	writel_relaxed(val, pcie->base + PCIE_PIPE4_PIE8_REG);
+ 
+-	err = clk_bulk_enable(pcie->num_clks, pcie->clks);
++	err = clk_bulk_prepare_enable(pcie->num_clks, pcie->clks);
+ 	if (err) {
+ 		dev_err(dev, "failed to prepare clock\n");
+-		goto err_clk_enable;
++		goto err_clk_prepare_enable;
+ 	}
+ 
+ 	return 0;
+ 
+-err_clk_enable:
+-	clk_bulk_unprepare(pcie->num_clks, pcie->clks);
+-err_clk_prepare:
++err_clk_prepare_enable:
+ 	pm_runtime_put_sync(dev);
+ 	pm_runtime_disable(dev);
+ 	reset_control_bulk_assert(pcie->soc->phy_resets.num_resets, pcie->phy_resets);
diff --git a/target/linux/airoha/patches-6.6/042-02-v6.14-PCI-mediatek-gen3-Move-reset-assert-callbacks-in-.po.patch b/target/linux/airoha/patches-6.6/042-02-v6.14-PCI-mediatek-gen3-Move-reset-assert-callbacks-in-.po.patch
new file mode 100644
index 00000000000000..ed5636d4fda56c
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/042-02-v6.14-PCI-mediatek-gen3-Move-reset-assert-callbacks-in-.po.patch
@@ -0,0 +1,86 @@
+From e4c7dfd953f7618f0ccb70d87c1629634f306fab Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Wed, 8 Jan 2025 10:50:41 +0100
+Subject: [PATCH 2/6] PCI: mediatek-gen3: Move reset/assert callbacks in
+ .power_up()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+In order to make the code more readable, the reset_control_bulk_assert()
+function for PHY reset lines is moved to make it pair with
+reset_control_bulk_deassert() in mtk_pcie_power_up() and
+mtk_pcie_en7581_power_up(). The same change is done for
+reset_control_assert() used to assert MAC reset line.
+
+Introduce PCIE_MTK_RESET_TIME_US macro for the time needed to
+complete PCIe reset on MediaTek controller.
+
+Link: https://lore.kernel.org/r/20250108-pcie-en7581-fixes-v6-2-21ac939a3b9b@kernel.org
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+---
+ drivers/pci/controller/pcie-mediatek-gen3.c | 28 +++++++++++++--------
+ 1 file changed, 18 insertions(+), 10 deletions(-)
+
+--- a/drivers/pci/controller/pcie-mediatek-gen3.c
++++ b/drivers/pci/controller/pcie-mediatek-gen3.c
+@@ -120,6 +120,8 @@
+ 
+ #define MAX_NUM_PHY_RESETS		3
+ 
++#define PCIE_MTK_RESET_TIME_US		10
++
+ /* Time in ms needed to complete PCIe reset on EN7581 SoC */
+ #define PCIE_EN7581_RESET_TIME_MS	100
+ 
+@@ -875,9 +877,14 @@ static int mtk_pcie_en7581_power_up(stru
+ 	u32 val;
+ 
+ 	/*
+-	 * Wait for the time needed to complete the bulk assert in
+-	 * mtk_pcie_setup for EN7581 SoC.
++	 * The controller may have been left out of reset by the bootloader
++	 * so make sure that we get a clean start by asserting resets here.
+ 	 */
++	reset_control_bulk_assert(pcie->soc->phy_resets.num_resets,
++				  pcie->phy_resets);
++	reset_control_assert(pcie->mac_reset);
++
++	/* Wait for the time needed to complete the reset lines assert. */
+ 	mdelay(PCIE_EN7581_RESET_TIME_MS);
+ 
+ 	err = phy_init(pcie->phy);
+@@ -944,6 +951,15 @@ static int mtk_pcie_power_up(struct mtk_
+ 	struct device *dev = pcie->dev;
+ 	int err;
+ 
++	/*
++	 * The controller may have been left out of reset by the bootloader
++	 * so make sure that we get a clean start by asserting resets here.
++	 */
++	reset_control_bulk_assert(pcie->soc->phy_resets.num_resets,
++				  pcie->phy_resets);
++	reset_control_assert(pcie->mac_reset);
++	usleep_range(PCIE_MTK_RESET_TIME_US, 2 * PCIE_MTK_RESET_TIME_US);
++
+ 	/* PHY power on and enable pipe clock */
+ 	err = reset_control_bulk_deassert(pcie->soc->phy_resets.num_resets, pcie->phy_resets);
+ 	if (err) {
+@@ -1016,14 +1032,6 @@ static int mtk_pcie_setup(struct mtk_gen
+ 	 * counter since the bulk is shared.
+ 	 */
+ 	reset_control_bulk_deassert(pcie->soc->phy_resets.num_resets, pcie->phy_resets);
+-	/*
+-	 * The controller may have been left out of reset by the bootloader
+-	 * so make sure that we get a clean start by asserting resets here.
+-	 */
+-	reset_control_bulk_assert(pcie->soc->phy_resets.num_resets, pcie->phy_resets);
+-
+-	reset_control_assert(pcie->mac_reset);
+-	usleep_range(10, 20);
+ 
+ 	/* Don't touch the hardware registers before power up */
+ 	err = pcie->soc->power_up(pcie);
diff --git a/target/linux/airoha/patches-6.6/042-03-v6.14-PCI-mediatek-gen3-Add-comment-about-initialization-o.patch b/target/linux/airoha/patches-6.6/042-03-v6.14-PCI-mediatek-gen3-Add-comment-about-initialization-o.patch
new file mode 100644
index 00000000000000..785e5bd7617830
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/042-03-v6.14-PCI-mediatek-gen3-Add-comment-about-initialization-o.patch
@@ -0,0 +1,35 @@
+From 0c9d2d2ef0d916b490a9222ed20ff4616fca876d Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Wed, 8 Jan 2025 10:50:42 +0100
+Subject: [PATCH 3/6] PCI: mediatek-gen3: Add comment about initialization
+ order in mtk_pcie_en7581_power_up()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Add a comment in mtk_pcie_en7581_power_up() to clarify, unlike the other
+MediaTek Gen3 controllers, the Airoha EN7581 requires PHY initialization
+and power-on before PHY reset deassert.
+
+Link: https://lore.kernel.org/r/20250108-pcie-en7581-fixes-v6-3-21ac939a3b9b@kernel.org
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+---
+ drivers/pci/controller/pcie-mediatek-gen3.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/pci/controller/pcie-mediatek-gen3.c
++++ b/drivers/pci/controller/pcie-mediatek-gen3.c
+@@ -887,6 +887,10 @@ static int mtk_pcie_en7581_power_up(stru
+ 	/* Wait for the time needed to complete the reset lines assert. */
+ 	mdelay(PCIE_EN7581_RESET_TIME_MS);
+ 
++	/*
++	 * Unlike the other MediaTek Gen3 controllers, the Airoha EN7581
++	 * requires PHY initialization and power-on before PHY reset deassert.
++	 */
+ 	err = phy_init(pcie->phy);
+ 	if (err) {
+ 		dev_err(dev, "failed to initialize PHY\n");
diff --git a/target/linux/airoha/patches-6.6/042-04-v6.14-PCI-mediatek-gen3-Move-reset-delay-in-mtk_pcie_en758.patch b/target/linux/airoha/patches-6.6/042-04-v6.14-PCI-mediatek-gen3-Move-reset-delay-in-mtk_pcie_en758.patch
new file mode 100644
index 00000000000000..1e6d4cd0922ce1
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/042-04-v6.14-PCI-mediatek-gen3-Move-reset-delay-in-mtk_pcie_en758.patch
@@ -0,0 +1,59 @@
+From 90d4e466c9ea2010f33880a36317a8486ccbe082 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Wed, 8 Jan 2025 10:50:43 +0100
+Subject: [PATCH 4/6] PCI: mediatek-gen3: Move reset delay in
+ mtk_pcie_en7581_power_up()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Airoha EN7581 has a hw bug asserting/releasing PCIE_PE_RSTB signal
+causing occasional PCIe link down issues. In order to overcome the
+problem, PCIe block is reset using REG_PCI_CONTROL (0x88) and
+REG_RESET_CONTROL (0x834) registers available in the clock module
+running clk_bulk_prepare_enable() in mtk_pcie_en7581_power_up().
+
+In order to make the code more readable, move the wait for the time
+needed to complete the PCIe reset from en7581_pci_enable() to
+mtk_pcie_en7581_power_up().
+
+Reduce reset timeout from 250ms to the standard PCIE_T_PVPERL_MS value
+(100ms) since it has no impact on the driver behavior.
+
+Link: https://lore.kernel.org/r/20250108-pcie-en7581-fixes-v6-4-21ac939a3b9b@kernel.org
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Acked-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/clk-en7523.c                    | 1 -
+ drivers/pci/controller/pcie-mediatek-gen3.c | 7 +++++++
+ 2 files changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/clk-en7523.c
++++ b/drivers/clk/clk-en7523.c
+@@ -489,7 +489,6 @@ static int en7581_pci_enable(struct clk_
+ 	       REG_PCI_CONTROL_PERSTOUT;
+ 	val = readl(np_base + REG_PCI_CONTROL);
+ 	writel(val | mask, np_base + REG_PCI_CONTROL);
+-	msleep(250);
+ 
+ 	return 0;
+ }
+--- a/drivers/pci/controller/pcie-mediatek-gen3.c
++++ b/drivers/pci/controller/pcie-mediatek-gen3.c
+@@ -936,6 +936,13 @@ static int mtk_pcie_en7581_power_up(stru
+ 		goto err_clk_prepare_enable;
+ 	}
+ 
++	/*
++	 * Airoha EN7581 performs PCIe reset via clk callbacks since it has a
++	 * hw issue with PCIE_PE_RSTB signal. Add wait for the time needed to
++	 * complete the PCIe reset.
++	 */
++	msleep(PCIE_T_PVPERL_MS);
++
+ 	return 0;
+ 
+ err_clk_prepare_enable:
diff --git a/target/linux/airoha/patches-6.6/042-05-v6.14-PCI-mediatek-gen3-Rely-on-msleep-in-mtk_pcie_en7581_.patch b/target/linux/airoha/patches-6.6/042-05-v6.14-PCI-mediatek-gen3-Rely-on-msleep-in-mtk_pcie_en7581_.patch
new file mode 100644
index 00000000000000..eb89411d5944bf
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/042-05-v6.14-PCI-mediatek-gen3-Rely-on-msleep-in-mtk_pcie_en7581_.patch
@@ -0,0 +1,41 @@
+From c98bee18d0a094e37100c85effe5e161418f8644 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Wed, 8 Jan 2025 10:50:44 +0100
+Subject: [PATCH 5/6] PCI: mediatek-gen3: Rely on msleep() in
+ mtk_pcie_en7581_power_up()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Since mtk_pcie_en7581_power_up() runs in non-atomic context, rely on
+msleep() routine instead of mdelay().
+
+Link: https://lore.kernel.org/r/20250108-pcie-en7581-fixes-v6-5-21ac939a3b9b@kernel.org
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+---
+ drivers/pci/controller/pcie-mediatek-gen3.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/pci/controller/pcie-mediatek-gen3.c
++++ b/drivers/pci/controller/pcie-mediatek-gen3.c
+@@ -885,7 +885,7 @@ static int mtk_pcie_en7581_power_up(stru
+ 	reset_control_assert(pcie->mac_reset);
+ 
+ 	/* Wait for the time needed to complete the reset lines assert. */
+-	mdelay(PCIE_EN7581_RESET_TIME_MS);
++	msleep(PCIE_EN7581_RESET_TIME_MS);
+ 
+ 	/*
+ 	 * Unlike the other MediaTek Gen3 controllers, the Airoha EN7581
+@@ -913,7 +913,7 @@ static int mtk_pcie_en7581_power_up(stru
+ 	 * Wait for the time needed to complete the bulk de-assert above.
+ 	 * This time is specific for EN7581 SoC.
+ 	 */
+-	mdelay(PCIE_EN7581_RESET_TIME_MS);
++	msleep(PCIE_EN7581_RESET_TIME_MS);
+ 
+ 	pm_runtime_enable(dev);
+ 	pm_runtime_get_sync(dev);
diff --git a/target/linux/airoha/patches-6.6/042-06-v6.14-PCI-mediatek-gen3-Avoid-PCIe-resetting-via-PERST-for.patch b/target/linux/airoha/patches-6.6/042-06-v6.14-PCI-mediatek-gen3-Avoid-PCIe-resetting-via-PERST-for.patch
new file mode 100644
index 00000000000000..d18d6f6b5a8117
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/042-06-v6.14-PCI-mediatek-gen3-Avoid-PCIe-resetting-via-PERST-for.patch
@@ -0,0 +1,128 @@
+From 491cb9c5084790aafa02e843349492c284373231 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 9 Jan 2025 00:30:45 +0100
+Subject: [PATCH 6/6] PCI: mediatek-gen3: Avoid PCIe resetting via PERST# for
+ Airoha EN7581 SoC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Airoha EN7581 has a hw bug asserting/releasing PERST# signal causing
+occasional PCIe link down issues. In order to overcome the problem,
+PERST# signal is not asserted/released during device probe or
+suspend/resume phase and the PCIe block is reset using
+en7523_reset_assert() and en7581_pci_enable().
+
+Introduce flags field in the mtk_gen3_pcie_pdata struct in order to
+specify per-SoC capabilities.
+
+Link: https://lore.kernel.org/r/20250109-pcie-en7581-rst-fix-v4-1-4a45c89fb143@kernel.org
+Tested-by: Hui Ma <hui.ma@airoha.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+---
+ drivers/pci/controller/pcie-mediatek-gen3.c | 59 ++++++++++++++-------
+ 1 file changed, 41 insertions(+), 18 deletions(-)
+
+--- a/drivers/pci/controller/pcie-mediatek-gen3.c
++++ b/drivers/pci/controller/pcie-mediatek-gen3.c
+@@ -127,10 +127,18 @@
+ 
+ struct mtk_gen3_pcie;
+ 
++enum mtk_gen3_pcie_flags {
++	SKIP_PCIE_RSTB	= BIT(0), /* Skip PERST# assertion during device
++				   * probing or suspend/resume phase to
++				   * avoid hw bugs/issues.
++				   */
++};
++
+ /**
+  * struct mtk_gen3_pcie_pdata - differentiate between host generations
+  * @power_up: pcie power_up callback
+  * @phy_resets: phy reset lines SoC data.
++ * @flags: pcie device flags.
+  */
+ struct mtk_gen3_pcie_pdata {
+ 	int (*power_up)(struct mtk_gen3_pcie *pcie);
+@@ -138,6 +146,7 @@ struct mtk_gen3_pcie_pdata {
+ 		const char *id[MAX_NUM_PHY_RESETS];
+ 		int num_resets;
+ 	} phy_resets;
++	u32 flags;
+ };
+ 
+ /**
+@@ -404,22 +413,33 @@ static int mtk_pcie_startup_port(struct
+ 	val |= PCIE_DISABLE_DVFSRC_VLT_REQ;
+ 	writel_relaxed(val, pcie->base + PCIE_MISC_CTRL_REG);
+ 
+-	/* Assert all reset signals */
+-	val = readl_relaxed(pcie->base + PCIE_RST_CTRL_REG);
+-	val |= PCIE_MAC_RSTB | PCIE_PHY_RSTB | PCIE_BRG_RSTB | PCIE_PE_RSTB;
+-	writel_relaxed(val, pcie->base + PCIE_RST_CTRL_REG);
+-
+ 	/*
+-	 * Described in PCIe CEM specification sections 2.2 (PERST# Signal)
+-	 * and 2.2.1 (Initial Power-Up (G3 to S0)).
+-	 * The deassertion of PERST# should be delayed 100ms (TPVPERL)
+-	 * for the power and clock to become stable.
++	 * Airoha EN7581 has a hw bug asserting/releasing PCIE_PE_RSTB signal
++	 * causing occasional PCIe link down. In order to overcome the issue,
++	 * PCIE_RSTB signals are not asserted/released at this stage and the
++	 * PCIe block is reset using en7523_reset_assert() and
++	 * en7581_pci_enable().
+ 	 */
+-	msleep(100);
+-
+-	/* De-assert reset signals */
+-	val &= ~(PCIE_MAC_RSTB | PCIE_PHY_RSTB | PCIE_BRG_RSTB | PCIE_PE_RSTB);
+-	writel_relaxed(val, pcie->base + PCIE_RST_CTRL_REG);
++	if (!(pcie->soc->flags & SKIP_PCIE_RSTB)) {
++		/* Assert all reset signals */
++		val = readl_relaxed(pcie->base + PCIE_RST_CTRL_REG);
++		val |= PCIE_MAC_RSTB | PCIE_PHY_RSTB | PCIE_BRG_RSTB |
++		       PCIE_PE_RSTB;
++		writel_relaxed(val, pcie->base + PCIE_RST_CTRL_REG);
++
++		/*
++		 * Described in PCIe CEM specification revision 6.0.
++		 *
++		 * The deassertion of PERST# should be delayed 100ms (TPVPERL)
++		 * for the power and clock to become stable.
++		 */
++		msleep(PCIE_T_PVPERL_MS);
++
++		/* De-assert reset signals */
++		val &= ~(PCIE_MAC_RSTB | PCIE_PHY_RSTB | PCIE_BRG_RSTB |
++			 PCIE_PE_RSTB);
++		writel_relaxed(val, pcie->base + PCIE_RST_CTRL_REG);
++	}
+ 
+ 	/* Check if the link is up or not */
+ 	err = readl_poll_timeout(pcie->base + PCIE_LINK_STATUS_REG, val,
+@@ -1178,10 +1198,12 @@ static int mtk_pcie_suspend_noirq(struct
+ 		return err;
+ 	}
+ 
+-	/* Pull down the PERST# pin */
+-	val = readl_relaxed(pcie->base + PCIE_RST_CTRL_REG);
+-	val |= PCIE_PE_RSTB;
+-	writel_relaxed(val, pcie->base + PCIE_RST_CTRL_REG);
++	if (!(pcie->soc->flags & SKIP_PCIE_RSTB)) {
++		/* Assert the PERST# pin */
++		val = readl_relaxed(pcie->base + PCIE_RST_CTRL_REG);
++		val |= PCIE_PE_RSTB;
++		writel_relaxed(val, pcie->base + PCIE_RST_CTRL_REG);
++	}
+ 
+ 	dev_dbg(pcie->dev, "entered L2 states successfully");
+ 
+@@ -1232,6 +1254,7 @@ static const struct mtk_gen3_pcie_pdata
+ 		.id[2] = "phy-lane2",
+ 		.num_resets = 3,
+ 	},
++	.flags = SKIP_PCIE_RSTB,
+ };
+ 
+ static const struct of_device_id mtk_pcie_of_match[] = {
diff --git a/target/linux/airoha/patches-6.6/043-v6.15-PCI-mediatek-gen3-Remove-leftover-mac_reset-assert-f.patch b/target/linux/airoha/patches-6.6/043-v6.15-PCI-mediatek-gen3-Remove-leftover-mac_reset-assert-f.patch
new file mode 100644
index 00000000000000..b4a69eb684f6ae
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/043-v6.15-PCI-mediatek-gen3-Remove-leftover-mac_reset-assert-f.patch
@@ -0,0 +1,34 @@
+From b6d7bb0d3bd74b491e2e6fd59c4d5110d06fd63b Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Sat, 1 Feb 2025 12:00:18 +0100
+Subject: [PATCH] PCI: mediatek-gen3: Remove leftover mac_reset assert for
+ Airoha EN7581 SoC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Remove a leftover assert for mac_reset line in mtk_pcie_en7581_power_up().
+
+This is not harmful since EN7581 does not requires mac_reset and
+mac_reset is not defined in EN7581 device tree.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Reviewed-by: Philipp Zabel <p.zabel@pengutronix.de>
+Link: https://lore.kernel.org/r/20250201-pcie-en7581-remove-mac_reset-v2-1-a06786cdc683@kernel.org
+[kwilczynski: commit log]
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+---
+ drivers/pci/controller/pcie-mediatek-gen3.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/pci/controller/pcie-mediatek-gen3.c
++++ b/drivers/pci/controller/pcie-mediatek-gen3.c
+@@ -902,7 +902,6 @@ static int mtk_pcie_en7581_power_up(stru
+ 	 */
+ 	reset_control_bulk_assert(pcie->soc->phy_resets.num_resets,
+ 				  pcie->phy_resets);
+-	reset_control_assert(pcie->mac_reset);
+ 
+ 	/* Wait for the time needed to complete the reset lines assert. */
+ 	msleep(PCIE_EN7581_RESET_TIME_MS);
diff --git a/target/linux/airoha/patches-6.6/044-v6.15-PCI-mediatek-gen3-Configure-PBUS_CSR-registers-for-E.patch b/target/linux/airoha/patches-6.6/044-v6.15-PCI-mediatek-gen3-Configure-PBUS_CSR-registers-for-E.patch
new file mode 100644
index 00000000000000..6470e03bb56b6e
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/044-v6.15-PCI-mediatek-gen3-Configure-PBUS_CSR-registers-for-E.patch
@@ -0,0 +1,81 @@
+From 249b78298078448a699c39356d27d8183af4b281 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 25 Feb 2025 09:04:07 +0100
+Subject: [PATCH] PCI: mediatek-gen3: Configure PBUS_CSR registers for EN7581
+ SoC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Configure PBus base address and address mask to allow the hw
+to detect if a given address is accessible on PCIe controller.
+
+Fixes: f6ab898356dd ("PCI: mediatek-gen3: Add Airoha EN7581 support")
+Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://lore.kernel.org/r/20250225-en7581-pcie-pbus-csr-v4-2-24324382424a@kernel.org
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+---
+ drivers/pci/controller/pcie-mediatek-gen3.c | 28 ++++++++++++++++++++-
+ 1 file changed, 27 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/controller/pcie-mediatek-gen3.c
++++ b/drivers/pci/controller/pcie-mediatek-gen3.c
+@@ -15,6 +15,7 @@
+ #include <linux/irqchip/chained_irq.h>
+ #include <linux/irqdomain.h>
+ #include <linux/kernel.h>
++#include <linux/mfd/syscon.h>
+ #include <linux/module.h>
+ #include <linux/msi.h>
+ #include <linux/of_device.h>
+@@ -24,6 +25,7 @@
+ #include <linux/platform_device.h>
+ #include <linux/pm_domain.h>
+ #include <linux/pm_runtime.h>
++#include <linux/regmap.h>
+ #include <linux/reset.h>
+ 
+ #include "../pci.h"
+@@ -892,9 +894,13 @@ static int mtk_pcie_parse_port(struct mt
+ 
+ static int mtk_pcie_en7581_power_up(struct mtk_gen3_pcie *pcie)
+ {
++	struct pci_host_bridge *host = pci_host_bridge_from_priv(pcie);
+ 	struct device *dev = pcie->dev;
++	struct resource_entry *entry;
++	struct regmap *pbus_regmap;
++	u32 val, args[2], size;
++	resource_size_t addr;
+ 	int err;
+-	u32 val;
+ 
+ 	/*
+ 	 * The controller may have been left out of reset by the bootloader
+@@ -907,6 +913,26 @@ static int mtk_pcie_en7581_power_up(stru
+ 	msleep(PCIE_EN7581_RESET_TIME_MS);
+ 
+ 	/*
++	 * Configure PBus base address and base address mask to allow the
++	 * hw to detect if a given address is accessible on PCIe controller.
++	 */
++	pbus_regmap = syscon_regmap_lookup_by_phandle_args(dev->of_node,
++							   "mediatek,pbus-csr",
++							   ARRAY_SIZE(args),
++							   args);
++	if (IS_ERR(pbus_regmap))
++		return PTR_ERR(pbus_regmap);
++
++	entry = resource_list_first_type(&host->windows, IORESOURCE_MEM);
++	if (!entry)
++		return -ENODEV;
++
++	addr = entry->res->start - entry->offset;
++	regmap_write(pbus_regmap, args[0], lower_32_bits(addr));
++	size = lower_32_bits(resource_size(entry->res));
++	regmap_write(pbus_regmap, args[1], GENMASK(31, __fls(size)));
++
++	/*
+ 	 * Unlike the other MediaTek Gen3 controllers, the Airoha EN7581
+ 	 * requires PHY initialization and power-on before PHY reset deassert.
+ 	 */
diff --git a/target/linux/airoha/patches-6.6/045-v6.14-net-airoha-Fix-wrong-GDM4-register-definition.patch b/target/linux/airoha/patches-6.6/045-v6.14-net-airoha-Fix-wrong-GDM4-register-definition.patch
new file mode 100644
index 00000000000000..f17242a6c5c7fd
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/045-v6.14-net-airoha-Fix-wrong-GDM4-register-definition.patch
@@ -0,0 +1,41 @@
+From d31a49d37cb132b31cc6683eef2122f8609d6229 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Mon, 20 Jan 2025 16:41:40 +0100
+Subject: [PATCH] net: airoha: Fix wrong GDM4 register definition
+
+Fix wrong GDM4 register definition, in Airoha SDK GDM4 is defined at
+offset 0x2400 but this doesn't make sense as it does conflict with the
+CDM4 that is in the same location.
+
+Following the pattern where each GDM base is at the FWD_CFG, currently
+GDM4 base offset is set to 0x2500. This is correct but REG_GDM4_FWD_CFG
+and REG_GDM4_SRC_PORT_SET are still using the SDK reference with the
+0x2400 offset. Fix these 2 define by subtracting 0x100 to each register
+to reflect the real address location.
+
+Fixes: 23020f049327 ("net: airoha: Introduce ethernet support for EN7581 SoC")
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20250120154148.13424-1-ansuelsmth@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/airoha_eth.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/airoha_eth.c
++++ b/drivers/net/ethernet/mediatek/airoha_eth.c
+@@ -266,11 +266,11 @@
+ #define REG_GDM3_FWD_CFG		GDM3_BASE
+ #define GDM3_PAD_EN_MASK		BIT(28)
+ 
+-#define REG_GDM4_FWD_CFG		(GDM4_BASE + 0x100)
++#define REG_GDM4_FWD_CFG		GDM4_BASE
+ #define GDM4_PAD_EN_MASK		BIT(28)
+ #define GDM4_SPORT_OFFSET0_MASK		GENMASK(11, 8)
+ 
+-#define REG_GDM4_SRC_PORT_SET		(GDM4_BASE + 0x33c)
++#define REG_GDM4_SRC_PORT_SET		(GDM4_BASE + 0x23c)
+ #define GDM4_SPORT_OFF2_MASK		GENMASK(19, 16)
+ #define GDM4_SPORT_OFF1_MASK		GENMASK(15, 12)
+ #define GDM4_SPORT_OFF0_MASK		GENMASK(11, 8)
diff --git a/target/linux/airoha/patches-6.6/046-v6.15-net-airoha-Fix-TSO-support-for-header-cloned-skbs.patch b/target/linux/airoha/patches-6.6/046-v6.15-net-airoha-Fix-TSO-support-for-header-cloned-skbs.patch
new file mode 100644
index 00000000000000..9c2443ce698603
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/046-v6.15-net-airoha-Fix-TSO-support-for-header-cloned-skbs.patch
@@ -0,0 +1,60 @@
+From c6287e1a858e336cc202b484c6138a0fe252c6b3 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 13 Feb 2025 16:34:20 +0100
+Subject: [PATCH] net: airoha: Fix TSO support for header cloned skbs
+
+For GSO packets, skb_cow_head() will reallocate the skb for TSO header
+cloned skbs in airoha_dev_xmit(). For this reason, sinfo pointer can be
+no more valid. Fix the issue relying on skb_shinfo() macro directly in
+airoha_dev_xmit().
+
+The problem exists since
+commit 23020f049327 ("net: airoha: Introduce ethernet support for EN7581 SoC")
+but it is not a user visible, since we can't currently enable TSO
+for DSA user ports since we are missing to initialize net_device
+vlan_features field.
+
+Reviewed-by: Mateusz Polchlopek <mateusz.polchlopek@intel.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Link: https://patch.msgid.link/20250213-airoha-en7581-flowtable-offload-v4-1-b69ca16d74db@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/mediatek/airoha_eth.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/airoha_eth.c
++++ b/drivers/net/ethernet/mediatek/airoha_eth.c
+@@ -2549,11 +2549,10 @@ static u16 airoha_dev_select_queue(struc
+ static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb,
+ 				   struct net_device *dev)
+ {
+-	struct skb_shared_info *sinfo = skb_shinfo(skb);
+ 	struct airoha_gdm_port *port = netdev_priv(dev);
++	u32 nr_frags = 1 + skb_shinfo(skb)->nr_frags;
+ 	u32 msg0, msg1, len = skb_headlen(skb);
+ 	struct airoha_qdma *qdma = port->qdma;
+-	u32 nr_frags = 1 + sinfo->nr_frags;
+ 	struct netdev_queue *txq;
+ 	struct airoha_queue *q;
+ 	void *data = skb->data;
+@@ -2576,8 +2575,9 @@ static netdev_tx_t airoha_dev_xmit(struc
+ 		if (skb_cow_head(skb, 0))
+ 			goto error;
+ 
+-		if (sinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)) {
+-			__be16 csum = cpu_to_be16(sinfo->gso_size);
++		if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 |
++						 SKB_GSO_TCPV6)) {
++			__be16 csum = cpu_to_be16(skb_shinfo(skb)->gso_size);
+ 
+ 			tcp_hdr(skb)->check = (__force __sum16)csum;
+ 			msg0 |= FIELD_PREP(QDMA_ETH_TXMSG_TSO_MASK, 1);
+@@ -2606,7 +2606,7 @@ static netdev_tx_t airoha_dev_xmit(struc
+ 	for (i = 0; i < nr_frags; i++) {
+ 		struct airoha_qdma_desc *desc = &q->desc[index];
+ 		struct airoha_queue_entry *e = &q->entry[index];
+-		skb_frag_t *frag = &sinfo->frags[i];
++		skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+ 		dma_addr_t addr;
+ 		u32 val;
+ 
diff --git a/target/linux/airoha/patches-6.6/047-v6.13-net-airoha-Reset-BQL-stopping-the-netdevice.patch b/target/linux/airoha/patches-6.6/047-v6.13-net-airoha-Reset-BQL-stopping-the-netdevice.patch
new file mode 100644
index 00000000000000..f20e2034c22c97
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/047-v6.13-net-airoha-Reset-BQL-stopping-the-netdevice.patch
@@ -0,0 +1,42 @@
+From c9f947769b77c8e8f318bfc8a0777e5d20c44d8d Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Thu, 17 Oct 2024 16:01:41 +0200
+Subject: [PATCH] net: airoha: Reset BQL stopping the netdevice
+
+Run airoha_qdma_cleanup_tx_queue() in ndo_stop callback in order to
+unmap pending skbs. Moreover, reset BQL txq state stopping the netdevice,
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Hariprasad Kelam <hkelam@marvell.com>
+Message-ID: <20241017-airoha-en7581-reset-bql-v1-1-08c0c9888de5@kernel.org>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+---
+ drivers/net/ethernet/mediatek/airoha_eth.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mediatek/airoha_eth.c
++++ b/drivers/net/ethernet/mediatek/airoha_eth.c
+@@ -2469,7 +2469,7 @@ static int airoha_dev_stop(struct net_de
+ {
+ 	struct airoha_gdm_port *port = netdev_priv(dev);
+ 	struct airoha_qdma *qdma = port->qdma;
+-	int err;
++	int i, err;
+ 
+ 	netif_tx_disable(dev);
+ 	err = airoha_set_gdm_ports(qdma->eth, false);
+@@ -2480,6 +2480,14 @@ static int airoha_dev_stop(struct net_de
+ 			  GLOBAL_CFG_TX_DMA_EN_MASK |
+ 			  GLOBAL_CFG_RX_DMA_EN_MASK);
+ 
++	for (i = 0; i < ARRAY_SIZE(qdma->q_tx); i++) {
++		if (!qdma->q_tx[i].ndesc)
++			continue;
++
++		airoha_qdma_cleanup_tx_queue(&qdma->q_tx[i]);
++		netdev_tx_reset_subqueue(dev, i);
++	}
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/airoha/patches-6.6/048-01-v6.15-net-airoha-Move-airoha_eth-driver-in-a-dedicated-fol.patch b/target/linux/airoha/patches-6.6/048-01-v6.15-net-airoha-Move-airoha_eth-driver-in-a-dedicated-fol.patch
new file mode 100644
index 00000000000000..255bbd2ed9d837
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/048-01-v6.15-net-airoha-Move-airoha_eth-driver-in-a-dedicated-fol.patch
@@ -0,0 +1,6825 @@
+From fb3dda82fd38ca42140f29b3082324dcdc128293 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 28 Feb 2025 11:54:09 +0100
+Subject: [PATCH 01/15] net: airoha: Move airoha_eth driver in a dedicated
+ folder
+
+The airoha_eth driver has no codebase shared with mtk_eth_soc one.
+Moreover, the upcoming features (flowtable hw offloading, PCS, ..) will
+not reuse any code from MediaTek driver. Move the Airoha driver in a
+dedicated folder.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/Kconfig                   |  2 ++
+ drivers/net/ethernet/Makefile                  |  1 +
+ drivers/net/ethernet/airoha/Kconfig            | 18 ++++++++++++++++++
+ drivers/net/ethernet/airoha/Makefile           |  6 ++++++
+ .../ethernet/{mediatek => airoha}/airoha_eth.c |  0
+ drivers/net/ethernet/mediatek/Kconfig          |  8 --------
+ drivers/net/ethernet/mediatek/Makefile         |  1 -
+ 7 files changed, 27 insertions(+), 9 deletions(-)
+ create mode 100644 drivers/net/ethernet/airoha/Kconfig
+ create mode 100644 drivers/net/ethernet/airoha/Makefile
+ rename drivers/net/ethernet/{mediatek => airoha}/airoha_eth.c (100%)
+
+--- a/drivers/net/ethernet/Kconfig
++++ b/drivers/net/ethernet/Kconfig
+@@ -23,6 +23,8 @@ source "drivers/net/ethernet/actions/Kco
+ source "drivers/net/ethernet/adaptec/Kconfig"
+ source "drivers/net/ethernet/aeroflex/Kconfig"
+ source "drivers/net/ethernet/agere/Kconfig"
++source "drivers/net/ethernet/airoha/Kconfig"
++source "drivers/net/ethernet/mellanox/Kconfig"
+ source "drivers/net/ethernet/alacritech/Kconfig"
+ source "drivers/net/ethernet/allwinner/Kconfig"
+ source "drivers/net/ethernet/alteon/Kconfig"
+--- a/drivers/net/ethernet/Makefile
++++ b/drivers/net/ethernet/Makefile
+@@ -10,6 +10,7 @@ obj-$(CONFIG_NET_VENDOR_ADAPTEC) += adap
+ obj-$(CONFIG_GRETH) += aeroflex/
+ obj-$(CONFIG_NET_VENDOR_ADI) += adi/
+ obj-$(CONFIG_NET_VENDOR_AGERE) += agere/
++obj-$(CONFIG_NET_VENDOR_AIROHA) += airoha/
+ obj-$(CONFIG_NET_VENDOR_ALACRITECH) += alacritech/
+ obj-$(CONFIG_NET_VENDOR_ALLWINNER) += allwinner/
+ obj-$(CONFIG_NET_VENDOR_ALTEON) += alteon/
+--- /dev/null
++++ b/drivers/net/ethernet/airoha/Kconfig
+@@ -0,0 +1,18 @@
++# SPDX-License-Identifier: GPL-2.0-only
++config NET_VENDOR_AIROHA
++	bool "Airoha devices"
++	depends on ARCH_AIROHA || COMPILE_TEST
++	help
++	  If you have a Airoha SoC with ethernet, say Y.
++
++if NET_VENDOR_AIROHA
++
++config NET_AIROHA
++	tristate "Airoha SoC Gigabit Ethernet support"
++	depends on NET_DSA || !NET_DSA
++	select PAGE_POOL
++	help
++	  This driver supports the gigabit ethernet MACs in the
++	  Airoha SoC family.
++
++endif #NET_VENDOR_AIROHA
+--- /dev/null
++++ b/drivers/net/ethernet/airoha/Makefile
+@@ -0,0 +1,6 @@
++# SPDX-License-Identifier: GPL-2.0-only
++#
++# Airoha for the Mediatek SoCs built-in ethernet macs
++#
++
++obj-$(CONFIG_NET_AIROHA) += airoha_eth.o
+--- a/drivers/net/ethernet/mediatek/Kconfig
++++ b/drivers/net/ethernet/mediatek/Kconfig
+@@ -7,14 +7,6 @@ config NET_VENDOR_MEDIATEK
+ 
+ if NET_VENDOR_MEDIATEK
+ 
+-config NET_AIROHA
+-	tristate "Airoha SoC Gigabit Ethernet support"
+-	depends on NET_DSA || !NET_DSA
+-	select PAGE_POOL
+-	help
+-	  This driver supports the gigabit ethernet MACs in the
+-	  Airoha SoC family.
+-
+ config NET_MEDIATEK_SOC_WED
+ 	depends on ARCH_MEDIATEK || COMPILE_TEST
+ 	def_bool NET_MEDIATEK_SOC != n
+--- a/drivers/net/ethernet/mediatek/Makefile
++++ b/drivers/net/ethernet/mediatek/Makefile
+@@ -11,4 +11,3 @@ mtk_eth-$(CONFIG_NET_MEDIATEK_SOC_WED) +
+ endif
+ obj-$(CONFIG_NET_MEDIATEK_SOC_WED) += mtk_wed_ops.o
+ obj-$(CONFIG_NET_MEDIATEK_STAR_EMAC) += mtk_star_emac.o
+-obj-$(CONFIG_NET_AIROHA) += airoha_eth.o
+--- /dev/null
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -0,0 +1,3359 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Copyright (c) 2024 AIROHA Inc
++ * Author: Lorenzo Bianconi <lorenzo@kernel.org>
++ */
++#include <linux/etherdevice.h>
++#include <linux/iopoll.h>
++#include <linux/kernel.h>
++#include <linux/netdevice.h>
++#include <linux/of.h>
++#include <linux/of_net.h>
++#include <linux/platform_device.h>
++#include <linux/reset.h>
++#include <linux/tcp.h>
++#include <linux/u64_stats_sync.h>
++#include <net/dsa.h>
++#include <net/page_pool/helpers.h>
++#include <net/pkt_cls.h>
++#include <uapi/linux/ppp_defs.h>
++
++#define AIROHA_MAX_NUM_GDM_PORTS	1
++#define AIROHA_MAX_NUM_QDMA		2
++#define AIROHA_MAX_NUM_RSTS		3
++#define AIROHA_MAX_NUM_XSI_RSTS		5
++#define AIROHA_MAX_MTU			2000
++#define AIROHA_MAX_PACKET_SIZE		2048
++#define AIROHA_NUM_QOS_CHANNELS		4
++#define AIROHA_NUM_QOS_QUEUES		8
++#define AIROHA_NUM_TX_RING		32
++#define AIROHA_NUM_RX_RING		32
++#define AIROHA_NUM_NETDEV_TX_RINGS	(AIROHA_NUM_TX_RING + \
++					 AIROHA_NUM_QOS_CHANNELS)
++#define AIROHA_FE_MC_MAX_VLAN_TABLE	64
++#define AIROHA_FE_MC_MAX_VLAN_PORT	16
++#define AIROHA_NUM_TX_IRQ		2
++#define HW_DSCP_NUM			2048
++#define IRQ_QUEUE_LEN(_n)		((_n) ? 1024 : 2048)
++#define TX_DSCP_NUM			1024
++#define RX_DSCP_NUM(_n)			\
++	((_n) ==  2 ? 128 :		\
++	 (_n) == 11 ? 128 :		\
++	 (_n) == 15 ? 128 :		\
++	 (_n) ==  0 ? 1024 : 16)
++
++#define PSE_RSV_PAGES			128
++#define PSE_QUEUE_RSV_PAGES		64
++
++#define QDMA_METER_IDX(_n)		((_n) & 0xff)
++#define QDMA_METER_GROUP(_n)		(((_n) >> 8) & 0x3)
++
++/* FE */
++#define PSE_BASE			0x0100
++#define CSR_IFC_BASE			0x0200
++#define CDM1_BASE			0x0400
++#define GDM1_BASE			0x0500
++#define PPE1_BASE			0x0c00
++
++#define CDM2_BASE			0x1400
++#define GDM2_BASE			0x1500
++
++#define GDM3_BASE			0x1100
++#define GDM4_BASE			0x2500
++
++#define GDM_BASE(_n)			\
++	((_n) == 4 ? GDM4_BASE :	\
++	 (_n) == 3 ? GDM3_BASE :	\
++	 (_n) == 2 ? GDM2_BASE : GDM1_BASE)
++
++#define REG_FE_DMA_GLO_CFG		0x0000
++#define FE_DMA_GLO_L2_SPACE_MASK	GENMASK(7, 4)
++#define FE_DMA_GLO_PG_SZ_MASK		BIT(3)
++
++#define REG_FE_RST_GLO_CFG		0x0004
++#define FE_RST_GDM4_MBI_ARB_MASK	BIT(3)
++#define FE_RST_GDM3_MBI_ARB_MASK	BIT(2)
++#define FE_RST_CORE_MASK		BIT(0)
++
++#define REG_FE_WAN_MAC_H		0x0030
++#define REG_FE_LAN_MAC_H		0x0040
++
++#define REG_FE_MAC_LMIN(_n)		((_n) + 0x04)
++#define REG_FE_MAC_LMAX(_n)		((_n) + 0x08)
++
++#define REG_FE_CDM1_OQ_MAP0		0x0050
++#define REG_FE_CDM1_OQ_MAP1		0x0054
++#define REG_FE_CDM1_OQ_MAP2		0x0058
++#define REG_FE_CDM1_OQ_MAP3		0x005c
++
++#define REG_FE_PCE_CFG			0x0070
++#define PCE_DPI_EN_MASK			BIT(2)
++#define PCE_KA_EN_MASK			BIT(1)
++#define PCE_MC_EN_MASK			BIT(0)
++
++#define REG_FE_PSE_QUEUE_CFG_WR		0x0080
++#define PSE_CFG_PORT_ID_MASK		GENMASK(27, 24)
++#define PSE_CFG_QUEUE_ID_MASK		GENMASK(20, 16)
++#define PSE_CFG_WR_EN_MASK		BIT(8)
++#define PSE_CFG_OQRSV_SEL_MASK		BIT(0)
++
++#define REG_FE_PSE_QUEUE_CFG_VAL	0x0084
++#define PSE_CFG_OQ_RSV_MASK		GENMASK(13, 0)
++
++#define PSE_FQ_CFG			0x008c
++#define PSE_FQ_LIMIT_MASK		GENMASK(14, 0)
++
++#define REG_FE_PSE_BUF_SET		0x0090
++#define PSE_SHARE_USED_LTHD_MASK	GENMASK(31, 16)
++#define PSE_ALLRSV_MASK			GENMASK(14, 0)
++
++#define REG_PSE_SHARE_USED_THD		0x0094
++#define PSE_SHARE_USED_MTHD_MASK	GENMASK(31, 16)
++#define PSE_SHARE_USED_HTHD_MASK	GENMASK(15, 0)
++
++#define REG_GDM_MISC_CFG		0x0148
++#define GDM2_RDM_ACK_WAIT_PREF_MASK	BIT(9)
++#define GDM2_CHN_VLD_MODE_MASK		BIT(5)
++
++#define REG_FE_CSR_IFC_CFG		CSR_IFC_BASE
++#define FE_IFC_EN_MASK			BIT(0)
++
++#define REG_FE_VIP_PORT_EN		0x01f0
++#define REG_FE_IFC_PORT_EN		0x01f4
++
++#define REG_PSE_IQ_REV1			(PSE_BASE + 0x08)
++#define PSE_IQ_RES1_P2_MASK		GENMASK(23, 16)
++
++#define REG_PSE_IQ_REV2			(PSE_BASE + 0x0c)
++#define PSE_IQ_RES2_P5_MASK		GENMASK(15, 8)
++#define PSE_IQ_RES2_P4_MASK		GENMASK(7, 0)
++
++#define REG_FE_VIP_EN(_n)		(0x0300 + ((_n) << 3))
++#define PATN_FCPU_EN_MASK		BIT(7)
++#define PATN_SWP_EN_MASK		BIT(6)
++#define PATN_DP_EN_MASK			BIT(5)
++#define PATN_SP_EN_MASK			BIT(4)
++#define PATN_TYPE_MASK			GENMASK(3, 1)
++#define PATN_EN_MASK			BIT(0)
++
++#define REG_FE_VIP_PATN(_n)		(0x0304 + ((_n) << 3))
++#define PATN_DP_MASK			GENMASK(31, 16)
++#define PATN_SP_MASK			GENMASK(15, 0)
++
++#define REG_CDM1_VLAN_CTRL		CDM1_BASE
++#define CDM1_VLAN_MASK			GENMASK(31, 16)
++
++#define REG_CDM1_FWD_CFG		(CDM1_BASE + 0x08)
++#define CDM1_VIP_QSEL_MASK		GENMASK(24, 20)
++
++#define REG_CDM1_CRSN_QSEL(_n)		(CDM1_BASE + 0x10 + ((_n) << 2))
++#define CDM1_CRSN_QSEL_REASON_MASK(_n)	\
++	GENMASK(4 + (((_n) % 4) << 3),	(((_n) % 4) << 3))
++
++#define REG_CDM2_FWD_CFG		(CDM2_BASE + 0x08)
++#define CDM2_OAM_QSEL_MASK		GENMASK(31, 27)
++#define CDM2_VIP_QSEL_MASK		GENMASK(24, 20)
++
++#define REG_CDM2_CRSN_QSEL(_n)		(CDM2_BASE + 0x10 + ((_n) << 2))
++#define CDM2_CRSN_QSEL_REASON_MASK(_n)	\
++	GENMASK(4 + (((_n) % 4) << 3),	(((_n) % 4) << 3))
++
++#define REG_GDM_FWD_CFG(_n)		GDM_BASE(_n)
++#define GDM_DROP_CRC_ERR		BIT(23)
++#define GDM_IP4_CKSUM			BIT(22)
++#define GDM_TCP_CKSUM			BIT(21)
++#define GDM_UDP_CKSUM			BIT(20)
++#define GDM_UCFQ_MASK			GENMASK(15, 12)
++#define GDM_BCFQ_MASK			GENMASK(11, 8)
++#define GDM_MCFQ_MASK			GENMASK(7, 4)
++#define GDM_OCFQ_MASK			GENMASK(3, 0)
++
++#define REG_GDM_INGRESS_CFG(_n)		(GDM_BASE(_n) + 0x10)
++#define GDM_INGRESS_FC_EN_MASK		BIT(1)
++#define GDM_STAG_EN_MASK		BIT(0)
++
++#define REG_GDM_LEN_CFG(_n)		(GDM_BASE(_n) + 0x14)
++#define GDM_SHORT_LEN_MASK		GENMASK(13, 0)
++#define GDM_LONG_LEN_MASK		GENMASK(29, 16)
++
++#define REG_FE_CPORT_CFG		(GDM1_BASE + 0x40)
++#define FE_CPORT_PAD			BIT(26)
++#define FE_CPORT_PORT_XFC_MASK		BIT(25)
++#define FE_CPORT_QUEUE_XFC_MASK		BIT(24)
++
++#define REG_FE_GDM_MIB_CLEAR(_n)	(GDM_BASE(_n) + 0xf0)
++#define FE_GDM_MIB_RX_CLEAR_MASK	BIT(1)
++#define FE_GDM_MIB_TX_CLEAR_MASK	BIT(0)
++
++#define REG_FE_GDM1_MIB_CFG		(GDM1_BASE + 0xf4)
++#define FE_STRICT_RFC2819_MODE_MASK	BIT(31)
++#define FE_GDM1_TX_MIB_SPLIT_EN_MASK	BIT(17)
++#define FE_GDM1_RX_MIB_SPLIT_EN_MASK	BIT(16)
++#define FE_TX_MIB_ID_MASK		GENMASK(15, 8)
++#define FE_RX_MIB_ID_MASK		GENMASK(7, 0)
++
++#define REG_FE_GDM_TX_OK_PKT_CNT_L(_n)		(GDM_BASE(_n) + 0x104)
++#define REG_FE_GDM_TX_OK_BYTE_CNT_L(_n)		(GDM_BASE(_n) + 0x10c)
++#define REG_FE_GDM_TX_ETH_PKT_CNT_L(_n)		(GDM_BASE(_n) + 0x110)
++#define REG_FE_GDM_TX_ETH_BYTE_CNT_L(_n)	(GDM_BASE(_n) + 0x114)
++#define REG_FE_GDM_TX_ETH_DROP_CNT(_n)		(GDM_BASE(_n) + 0x118)
++#define REG_FE_GDM_TX_ETH_BC_CNT(_n)		(GDM_BASE(_n) + 0x11c)
++#define REG_FE_GDM_TX_ETH_MC_CNT(_n)		(GDM_BASE(_n) + 0x120)
++#define REG_FE_GDM_TX_ETH_RUNT_CNT(_n)		(GDM_BASE(_n) + 0x124)
++#define REG_FE_GDM_TX_ETH_LONG_CNT(_n)		(GDM_BASE(_n) + 0x128)
++#define REG_FE_GDM_TX_ETH_E64_CNT_L(_n)		(GDM_BASE(_n) + 0x12c)
++#define REG_FE_GDM_TX_ETH_L64_CNT_L(_n)		(GDM_BASE(_n) + 0x130)
++#define REG_FE_GDM_TX_ETH_L127_CNT_L(_n)	(GDM_BASE(_n) + 0x134)
++#define REG_FE_GDM_TX_ETH_L255_CNT_L(_n)	(GDM_BASE(_n) + 0x138)
++#define REG_FE_GDM_TX_ETH_L511_CNT_L(_n)	(GDM_BASE(_n) + 0x13c)
++#define REG_FE_GDM_TX_ETH_L1023_CNT_L(_n)	(GDM_BASE(_n) + 0x140)
++
++#define REG_FE_GDM_RX_OK_PKT_CNT_L(_n)		(GDM_BASE(_n) + 0x148)
++#define REG_FE_GDM_RX_FC_DROP_CNT(_n)		(GDM_BASE(_n) + 0x14c)
++#define REG_FE_GDM_RX_RC_DROP_CNT(_n)		(GDM_BASE(_n) + 0x150)
++#define REG_FE_GDM_RX_OVERFLOW_DROP_CNT(_n)	(GDM_BASE(_n) + 0x154)
++#define REG_FE_GDM_RX_ERROR_DROP_CNT(_n)	(GDM_BASE(_n) + 0x158)
++#define REG_FE_GDM_RX_OK_BYTE_CNT_L(_n)		(GDM_BASE(_n) + 0x15c)
++#define REG_FE_GDM_RX_ETH_PKT_CNT_L(_n)		(GDM_BASE(_n) + 0x160)
++#define REG_FE_GDM_RX_ETH_BYTE_CNT_L(_n)	(GDM_BASE(_n) + 0x164)
++#define REG_FE_GDM_RX_ETH_DROP_CNT(_n)		(GDM_BASE(_n) + 0x168)
++#define REG_FE_GDM_RX_ETH_BC_CNT(_n)		(GDM_BASE(_n) + 0x16c)
++#define REG_FE_GDM_RX_ETH_MC_CNT(_n)		(GDM_BASE(_n) + 0x170)
++#define REG_FE_GDM_RX_ETH_CRC_ERR_CNT(_n)	(GDM_BASE(_n) + 0x174)
++#define REG_FE_GDM_RX_ETH_FRAG_CNT(_n)		(GDM_BASE(_n) + 0x178)
++#define REG_FE_GDM_RX_ETH_JABBER_CNT(_n)	(GDM_BASE(_n) + 0x17c)
++#define REG_FE_GDM_RX_ETH_RUNT_CNT(_n)		(GDM_BASE(_n) + 0x180)
++#define REG_FE_GDM_RX_ETH_LONG_CNT(_n)		(GDM_BASE(_n) + 0x184)
++#define REG_FE_GDM_RX_ETH_E64_CNT_L(_n)		(GDM_BASE(_n) + 0x188)
++#define REG_FE_GDM_RX_ETH_L64_CNT_L(_n)		(GDM_BASE(_n) + 0x18c)
++#define REG_FE_GDM_RX_ETH_L127_CNT_L(_n)	(GDM_BASE(_n) + 0x190)
++#define REG_FE_GDM_RX_ETH_L255_CNT_L(_n)	(GDM_BASE(_n) + 0x194)
++#define REG_FE_GDM_RX_ETH_L511_CNT_L(_n)	(GDM_BASE(_n) + 0x198)
++#define REG_FE_GDM_RX_ETH_L1023_CNT_L(_n)	(GDM_BASE(_n) + 0x19c)
++
++#define REG_PPE1_TB_HASH_CFG		(PPE1_BASE + 0x250)
++#define PPE1_SRAM_TABLE_EN_MASK		BIT(0)
++#define PPE1_SRAM_HASH1_EN_MASK		BIT(8)
++#define PPE1_DRAM_TABLE_EN_MASK		BIT(16)
++#define PPE1_DRAM_HASH1_EN_MASK		BIT(24)
++
++#define REG_FE_GDM_TX_OK_PKT_CNT_H(_n)		(GDM_BASE(_n) + 0x280)
++#define REG_FE_GDM_TX_OK_BYTE_CNT_H(_n)		(GDM_BASE(_n) + 0x284)
++#define REG_FE_GDM_TX_ETH_PKT_CNT_H(_n)		(GDM_BASE(_n) + 0x288)
++#define REG_FE_GDM_TX_ETH_BYTE_CNT_H(_n)	(GDM_BASE(_n) + 0x28c)
++
++#define REG_FE_GDM_RX_OK_PKT_CNT_H(_n)		(GDM_BASE(_n) + 0x290)
++#define REG_FE_GDM_RX_OK_BYTE_CNT_H(_n)		(GDM_BASE(_n) + 0x294)
++#define REG_FE_GDM_RX_ETH_PKT_CNT_H(_n)		(GDM_BASE(_n) + 0x298)
++#define REG_FE_GDM_RX_ETH_BYTE_CNT_H(_n)	(GDM_BASE(_n) + 0x29c)
++#define REG_FE_GDM_TX_ETH_E64_CNT_H(_n)		(GDM_BASE(_n) + 0x2b8)
++#define REG_FE_GDM_TX_ETH_L64_CNT_H(_n)		(GDM_BASE(_n) + 0x2bc)
++#define REG_FE_GDM_TX_ETH_L127_CNT_H(_n)	(GDM_BASE(_n) + 0x2c0)
++#define REG_FE_GDM_TX_ETH_L255_CNT_H(_n)	(GDM_BASE(_n) + 0x2c4)
++#define REG_FE_GDM_TX_ETH_L511_CNT_H(_n)	(GDM_BASE(_n) + 0x2c8)
++#define REG_FE_GDM_TX_ETH_L1023_CNT_H(_n)	(GDM_BASE(_n) + 0x2cc)
++#define REG_FE_GDM_RX_ETH_E64_CNT_H(_n)		(GDM_BASE(_n) + 0x2e8)
++#define REG_FE_GDM_RX_ETH_L64_CNT_H(_n)		(GDM_BASE(_n) + 0x2ec)
++#define REG_FE_GDM_RX_ETH_L127_CNT_H(_n)	(GDM_BASE(_n) + 0x2f0)
++#define REG_FE_GDM_RX_ETH_L255_CNT_H(_n)	(GDM_BASE(_n) + 0x2f4)
++#define REG_FE_GDM_RX_ETH_L511_CNT_H(_n)	(GDM_BASE(_n) + 0x2f8)
++#define REG_FE_GDM_RX_ETH_L1023_CNT_H(_n)	(GDM_BASE(_n) + 0x2fc)
++
++#define REG_GDM2_CHN_RLS		(GDM2_BASE + 0x20)
++#define MBI_RX_AGE_SEL_MASK		GENMASK(26, 25)
++#define MBI_TX_AGE_SEL_MASK		GENMASK(18, 17)
++
++#define REG_GDM3_FWD_CFG		GDM3_BASE
++#define GDM3_PAD_EN_MASK		BIT(28)
++
++#define REG_GDM4_FWD_CFG		GDM4_BASE
++#define GDM4_PAD_EN_MASK		BIT(28)
++#define GDM4_SPORT_OFFSET0_MASK		GENMASK(11, 8)
++
++#define REG_GDM4_SRC_PORT_SET		(GDM4_BASE + 0x23c)
++#define GDM4_SPORT_OFF2_MASK		GENMASK(19, 16)
++#define GDM4_SPORT_OFF1_MASK		GENMASK(15, 12)
++#define GDM4_SPORT_OFF0_MASK		GENMASK(11, 8)
++
++#define REG_IP_FRAG_FP			0x2010
++#define IP_ASSEMBLE_PORT_MASK		GENMASK(24, 21)
++#define IP_ASSEMBLE_NBQ_MASK		GENMASK(20, 16)
++#define IP_FRAGMENT_PORT_MASK		GENMASK(8, 5)
++#define IP_FRAGMENT_NBQ_MASK		GENMASK(4, 0)
++
++#define REG_MC_VLAN_EN			0x2100
++#define MC_VLAN_EN_MASK			BIT(0)
++
++#define REG_MC_VLAN_CFG			0x2104
++#define MC_VLAN_CFG_CMD_DONE_MASK	BIT(31)
++#define MC_VLAN_CFG_TABLE_ID_MASK	GENMASK(21, 16)
++#define MC_VLAN_CFG_PORT_ID_MASK	GENMASK(11, 8)
++#define MC_VLAN_CFG_TABLE_SEL_MASK	BIT(4)
++#define MC_VLAN_CFG_RW_MASK		BIT(0)
++
++#define REG_MC_VLAN_DATA		0x2108
++
++#define REG_CDM5_RX_OQ1_DROP_CNT	0x29d4
++
++/* QDMA */
++#define REG_QDMA_GLOBAL_CFG			0x0004
++#define GLOBAL_CFG_RX_2B_OFFSET_MASK		BIT(31)
++#define GLOBAL_CFG_DMA_PREFERENCE_MASK		GENMASK(30, 29)
++#define GLOBAL_CFG_CPU_TXR_RR_MASK		BIT(28)
++#define GLOBAL_CFG_DSCP_BYTE_SWAP_MASK		BIT(27)
++#define GLOBAL_CFG_PAYLOAD_BYTE_SWAP_MASK	BIT(26)
++#define GLOBAL_CFG_MULTICAST_MODIFY_FP_MASK	BIT(25)
++#define GLOBAL_CFG_OAM_MODIFY_MASK		BIT(24)
++#define GLOBAL_CFG_RESET_MASK			BIT(23)
++#define GLOBAL_CFG_RESET_DONE_MASK		BIT(22)
++#define GLOBAL_CFG_MULTICAST_EN_MASK		BIT(21)
++#define GLOBAL_CFG_IRQ1_EN_MASK			BIT(20)
++#define GLOBAL_CFG_IRQ0_EN_MASK			BIT(19)
++#define GLOBAL_CFG_LOOPCNT_EN_MASK		BIT(18)
++#define GLOBAL_CFG_RD_BYPASS_WR_MASK		BIT(17)
++#define GLOBAL_CFG_QDMA_LOOPBACK_MASK		BIT(16)
++#define GLOBAL_CFG_LPBK_RXQ_SEL_MASK		GENMASK(13, 8)
++#define GLOBAL_CFG_CHECK_DONE_MASK		BIT(7)
++#define GLOBAL_CFG_TX_WB_DONE_MASK		BIT(6)
++#define GLOBAL_CFG_MAX_ISSUE_NUM_MASK		GENMASK(5, 4)
++#define GLOBAL_CFG_RX_DMA_BUSY_MASK		BIT(3)
++#define GLOBAL_CFG_RX_DMA_EN_MASK		BIT(2)
++#define GLOBAL_CFG_TX_DMA_BUSY_MASK		BIT(1)
++#define GLOBAL_CFG_TX_DMA_EN_MASK		BIT(0)
++
++#define REG_FWD_DSCP_BASE			0x0010
++#define REG_FWD_BUF_BASE			0x0014
++
++#define REG_HW_FWD_DSCP_CFG			0x0018
++#define HW_FWD_DSCP_PAYLOAD_SIZE_MASK		GENMASK(29, 28)
++#define HW_FWD_DSCP_SCATTER_LEN_MASK		GENMASK(17, 16)
++#define HW_FWD_DSCP_MIN_SCATTER_LEN_MASK	GENMASK(15, 0)
++
++#define REG_INT_STATUS(_n)		\
++	(((_n) == 4) ? 0x0730 :		\
++	 ((_n) == 3) ? 0x0724 :		\
++	 ((_n) == 2) ? 0x0720 :		\
++	 ((_n) == 1) ? 0x0024 : 0x0020)
++
++#define REG_INT_ENABLE(_n)		\
++	(((_n) == 4) ? 0x0750 :		\
++	 ((_n) == 3) ? 0x0744 :		\
++	 ((_n) == 2) ? 0x0740 :		\
++	 ((_n) == 1) ? 0x002c : 0x0028)
++
++/* QDMA_CSR_INT_ENABLE1 */
++#define RX15_COHERENT_INT_MASK		BIT(31)
++#define RX14_COHERENT_INT_MASK		BIT(30)
++#define RX13_COHERENT_INT_MASK		BIT(29)
++#define RX12_COHERENT_INT_MASK		BIT(28)
++#define RX11_COHERENT_INT_MASK		BIT(27)
++#define RX10_COHERENT_INT_MASK		BIT(26)
++#define RX9_COHERENT_INT_MASK		BIT(25)
++#define RX8_COHERENT_INT_MASK		BIT(24)
++#define RX7_COHERENT_INT_MASK		BIT(23)
++#define RX6_COHERENT_INT_MASK		BIT(22)
++#define RX5_COHERENT_INT_MASK		BIT(21)
++#define RX4_COHERENT_INT_MASK		BIT(20)
++#define RX3_COHERENT_INT_MASK		BIT(19)
++#define RX2_COHERENT_INT_MASK		BIT(18)
++#define RX1_COHERENT_INT_MASK		BIT(17)
++#define RX0_COHERENT_INT_MASK		BIT(16)
++#define TX7_COHERENT_INT_MASK		BIT(15)
++#define TX6_COHERENT_INT_MASK		BIT(14)
++#define TX5_COHERENT_INT_MASK		BIT(13)
++#define TX4_COHERENT_INT_MASK		BIT(12)
++#define TX3_COHERENT_INT_MASK		BIT(11)
++#define TX2_COHERENT_INT_MASK		BIT(10)
++#define TX1_COHERENT_INT_MASK		BIT(9)
++#define TX0_COHERENT_INT_MASK		BIT(8)
++#define CNT_OVER_FLOW_INT_MASK		BIT(7)
++#define IRQ1_FULL_INT_MASK		BIT(5)
++#define IRQ1_INT_MASK			BIT(4)
++#define HWFWD_DSCP_LOW_INT_MASK		BIT(3)
++#define HWFWD_DSCP_EMPTY_INT_MASK	BIT(2)
++#define IRQ0_FULL_INT_MASK		BIT(1)
++#define IRQ0_INT_MASK			BIT(0)
++
++#define TX_DONE_INT_MASK(_n)					\
++	((_n) ? IRQ1_INT_MASK | IRQ1_FULL_INT_MASK		\
++	      : IRQ0_INT_MASK | IRQ0_FULL_INT_MASK)
++
++#define INT_TX_MASK						\
++	(IRQ1_INT_MASK | IRQ1_FULL_INT_MASK |			\
++	 IRQ0_INT_MASK | IRQ0_FULL_INT_MASK)
++
++#define INT_IDX0_MASK						\
++	(TX0_COHERENT_INT_MASK | TX1_COHERENT_INT_MASK |	\
++	 TX2_COHERENT_INT_MASK | TX3_COHERENT_INT_MASK |	\
++	 TX4_COHERENT_INT_MASK | TX5_COHERENT_INT_MASK |	\
++	 TX6_COHERENT_INT_MASK | TX7_COHERENT_INT_MASK |	\
++	 RX0_COHERENT_INT_MASK | RX1_COHERENT_INT_MASK |	\
++	 RX2_COHERENT_INT_MASK | RX3_COHERENT_INT_MASK |	\
++	 RX4_COHERENT_INT_MASK | RX7_COHERENT_INT_MASK |	\
++	 RX8_COHERENT_INT_MASK | RX9_COHERENT_INT_MASK |	\
++	 RX15_COHERENT_INT_MASK | INT_TX_MASK)
++
++/* QDMA_CSR_INT_ENABLE2 */
++#define RX15_NO_CPU_DSCP_INT_MASK	BIT(31)
++#define RX14_NO_CPU_DSCP_INT_MASK	BIT(30)
++#define RX13_NO_CPU_DSCP_INT_MASK	BIT(29)
++#define RX12_NO_CPU_DSCP_INT_MASK	BIT(28)
++#define RX11_NO_CPU_DSCP_INT_MASK	BIT(27)
++#define RX10_NO_CPU_DSCP_INT_MASK	BIT(26)
++#define RX9_NO_CPU_DSCP_INT_MASK	BIT(25)
++#define RX8_NO_CPU_DSCP_INT_MASK	BIT(24)
++#define RX7_NO_CPU_DSCP_INT_MASK	BIT(23)
++#define RX6_NO_CPU_DSCP_INT_MASK	BIT(22)
++#define RX5_NO_CPU_DSCP_INT_MASK	BIT(21)
++#define RX4_NO_CPU_DSCP_INT_MASK	BIT(20)
++#define RX3_NO_CPU_DSCP_INT_MASK	BIT(19)
++#define RX2_NO_CPU_DSCP_INT_MASK	BIT(18)
++#define RX1_NO_CPU_DSCP_INT_MASK	BIT(17)
++#define RX0_NO_CPU_DSCP_INT_MASK	BIT(16)
++#define RX15_DONE_INT_MASK		BIT(15)
++#define RX14_DONE_INT_MASK		BIT(14)
++#define RX13_DONE_INT_MASK		BIT(13)
++#define RX12_DONE_INT_MASK		BIT(12)
++#define RX11_DONE_INT_MASK		BIT(11)
++#define RX10_DONE_INT_MASK		BIT(10)
++#define RX9_DONE_INT_MASK		BIT(9)
++#define RX8_DONE_INT_MASK		BIT(8)
++#define RX7_DONE_INT_MASK		BIT(7)
++#define RX6_DONE_INT_MASK		BIT(6)
++#define RX5_DONE_INT_MASK		BIT(5)
++#define RX4_DONE_INT_MASK		BIT(4)
++#define RX3_DONE_INT_MASK		BIT(3)
++#define RX2_DONE_INT_MASK		BIT(2)
++#define RX1_DONE_INT_MASK		BIT(1)
++#define RX0_DONE_INT_MASK		BIT(0)
++
++#define RX_DONE_INT_MASK					\
++	(RX0_DONE_INT_MASK | RX1_DONE_INT_MASK |		\
++	 RX2_DONE_INT_MASK | RX3_DONE_INT_MASK |		\
++	 RX4_DONE_INT_MASK | RX7_DONE_INT_MASK |		\
++	 RX8_DONE_INT_MASK | RX9_DONE_INT_MASK |		\
++	 RX15_DONE_INT_MASK)
++#define INT_IDX1_MASK						\
++	(RX_DONE_INT_MASK |					\
++	 RX0_NO_CPU_DSCP_INT_MASK | RX1_NO_CPU_DSCP_INT_MASK |	\
++	 RX2_NO_CPU_DSCP_INT_MASK | RX3_NO_CPU_DSCP_INT_MASK |	\
++	 RX4_NO_CPU_DSCP_INT_MASK | RX7_NO_CPU_DSCP_INT_MASK |	\
++	 RX8_NO_CPU_DSCP_INT_MASK | RX9_NO_CPU_DSCP_INT_MASK |	\
++	 RX15_NO_CPU_DSCP_INT_MASK)
++
++/* QDMA_CSR_INT_ENABLE5 */
++#define TX31_COHERENT_INT_MASK		BIT(31)
++#define TX30_COHERENT_INT_MASK		BIT(30)
++#define TX29_COHERENT_INT_MASK		BIT(29)
++#define TX28_COHERENT_INT_MASK		BIT(28)
++#define TX27_COHERENT_INT_MASK		BIT(27)
++#define TX26_COHERENT_INT_MASK		BIT(26)
++#define TX25_COHERENT_INT_MASK		BIT(25)
++#define TX24_COHERENT_INT_MASK		BIT(24)
++#define TX23_COHERENT_INT_MASK		BIT(23)
++#define TX22_COHERENT_INT_MASK		BIT(22)
++#define TX21_COHERENT_INT_MASK		BIT(21)
++#define TX20_COHERENT_INT_MASK		BIT(20)
++#define TX19_COHERENT_INT_MASK		BIT(19)
++#define TX18_COHERENT_INT_MASK		BIT(18)
++#define TX17_COHERENT_INT_MASK		BIT(17)
++#define TX16_COHERENT_INT_MASK		BIT(16)
++#define TX15_COHERENT_INT_MASK		BIT(15)
++#define TX14_COHERENT_INT_MASK		BIT(14)
++#define TX13_COHERENT_INT_MASK		BIT(13)
++#define TX12_COHERENT_INT_MASK		BIT(12)
++#define TX11_COHERENT_INT_MASK		BIT(11)
++#define TX10_COHERENT_INT_MASK		BIT(10)
++#define TX9_COHERENT_INT_MASK		BIT(9)
++#define TX8_COHERENT_INT_MASK		BIT(8)
++
++#define INT_IDX4_MASK						\
++	(TX8_COHERENT_INT_MASK | TX9_COHERENT_INT_MASK |	\
++	 TX10_COHERENT_INT_MASK | TX11_COHERENT_INT_MASK |	\
++	 TX12_COHERENT_INT_MASK | TX13_COHERENT_INT_MASK |	\
++	 TX14_COHERENT_INT_MASK | TX15_COHERENT_INT_MASK |	\
++	 TX16_COHERENT_INT_MASK | TX17_COHERENT_INT_MASK |	\
++	 TX18_COHERENT_INT_MASK | TX19_COHERENT_INT_MASK |	\
++	 TX20_COHERENT_INT_MASK | TX21_COHERENT_INT_MASK |	\
++	 TX22_COHERENT_INT_MASK | TX23_COHERENT_INT_MASK |	\
++	 TX24_COHERENT_INT_MASK | TX25_COHERENT_INT_MASK |	\
++	 TX26_COHERENT_INT_MASK | TX27_COHERENT_INT_MASK |	\
++	 TX28_COHERENT_INT_MASK | TX29_COHERENT_INT_MASK |	\
++	 TX30_COHERENT_INT_MASK | TX31_COHERENT_INT_MASK)
++
++#define REG_TX_IRQ_BASE(_n)		((_n) ? 0x0048 : 0x0050)
++
++#define REG_TX_IRQ_CFG(_n)		((_n) ? 0x004c : 0x0054)
++#define TX_IRQ_THR_MASK			GENMASK(27, 16)
++#define TX_IRQ_DEPTH_MASK		GENMASK(11, 0)
++
++#define REG_IRQ_CLEAR_LEN(_n)		((_n) ? 0x0064 : 0x0058)
++#define IRQ_CLEAR_LEN_MASK		GENMASK(7, 0)
++
++#define REG_IRQ_STATUS(_n)		((_n) ? 0x0068 : 0x005c)
++#define IRQ_ENTRY_LEN_MASK		GENMASK(27, 16)
++#define IRQ_HEAD_IDX_MASK		GENMASK(11, 0)
++
++#define REG_TX_RING_BASE(_n)	\
++	(((_n) < 8) ? 0x0100 + ((_n) << 5) : 0x0b00 + (((_n) - 8) << 5))
++
++#define REG_TX_RING_BLOCKING(_n)	\
++	(((_n) < 8) ? 0x0104 + ((_n) << 5) : 0x0b04 + (((_n) - 8) << 5))
++
++#define TX_RING_IRQ_BLOCKING_MAP_MASK			BIT(6)
++#define TX_RING_IRQ_BLOCKING_CFG_MASK			BIT(4)
++#define TX_RING_IRQ_BLOCKING_TX_DROP_EN_MASK		BIT(2)
++#define TX_RING_IRQ_BLOCKING_MAX_TH_TXRING_EN_MASK	BIT(1)
++#define TX_RING_IRQ_BLOCKING_MIN_TH_TXRING_EN_MASK	BIT(0)
++
++#define REG_TX_CPU_IDX(_n)	\
++	(((_n) < 8) ? 0x0108 + ((_n) << 5) : 0x0b08 + (((_n) - 8) << 5))
++
++#define TX_RING_CPU_IDX_MASK		GENMASK(15, 0)
++
++#define REG_TX_DMA_IDX(_n)	\
++	(((_n) < 8) ? 0x010c + ((_n) << 5) : 0x0b0c + (((_n) - 8) << 5))
++
++#define TX_RING_DMA_IDX_MASK		GENMASK(15, 0)
++
++#define IRQ_RING_IDX_MASK		GENMASK(20, 16)
++#define IRQ_DESC_IDX_MASK		GENMASK(15, 0)
++
++#define REG_RX_RING_BASE(_n)	\
++	(((_n) < 16) ? 0x0200 + ((_n) << 5) : 0x0e00 + (((_n) - 16) << 5))
++
++#define REG_RX_RING_SIZE(_n)	\
++	(((_n) < 16) ? 0x0204 + ((_n) << 5) : 0x0e04 + (((_n) - 16) << 5))
++
++#define RX_RING_THR_MASK		GENMASK(31, 16)
++#define RX_RING_SIZE_MASK		GENMASK(15, 0)
++
++#define REG_RX_CPU_IDX(_n)	\
++	(((_n) < 16) ? 0x0208 + ((_n) << 5) : 0x0e08 + (((_n) - 16) << 5))
++
++#define RX_RING_CPU_IDX_MASK		GENMASK(15, 0)
++
++#define REG_RX_DMA_IDX(_n)	\
++	(((_n) < 16) ? 0x020c + ((_n) << 5) : 0x0e0c + (((_n) - 16) << 5))
++
++#define REG_RX_DELAY_INT_IDX(_n)	\
++	(((_n) < 16) ? 0x0210 + ((_n) << 5) : 0x0e10 + (((_n) - 16) << 5))
++
++#define RX_DELAY_INT_MASK		GENMASK(15, 0)
++
++#define RX_RING_DMA_IDX_MASK		GENMASK(15, 0)
++
++#define REG_INGRESS_TRTCM_CFG		0x0070
++#define INGRESS_TRTCM_EN_MASK		BIT(31)
++#define INGRESS_TRTCM_MODE_MASK		BIT(30)
++#define INGRESS_SLOW_TICK_RATIO_MASK	GENMASK(29, 16)
++#define INGRESS_FAST_TICK_MASK		GENMASK(15, 0)
++
++#define REG_QUEUE_CLOSE_CFG(_n)		(0x00a0 + ((_n) & 0xfc))
++#define TXQ_DISABLE_CHAN_QUEUE_MASK(_n, _m)	BIT((_m) + (((_n) & 0x3) << 3))
++
++#define REG_TXQ_DIS_CFG_BASE(_n)	((_n) ? 0x20a0 : 0x00a0)
++#define REG_TXQ_DIS_CFG(_n, _m)		(REG_TXQ_DIS_CFG_BASE((_n)) + (_m) << 2)
++
++#define REG_CNTR_CFG(_n)		(0x0400 + ((_n) << 3))
++#define CNTR_EN_MASK			BIT(31)
++#define CNTR_ALL_CHAN_EN_MASK		BIT(30)
++#define CNTR_ALL_QUEUE_EN_MASK		BIT(29)
++#define CNTR_ALL_DSCP_RING_EN_MASK	BIT(28)
++#define CNTR_SRC_MASK			GENMASK(27, 24)
++#define CNTR_DSCP_RING_MASK		GENMASK(20, 16)
++#define CNTR_CHAN_MASK			GENMASK(7, 3)
++#define CNTR_QUEUE_MASK			GENMASK(2, 0)
++
++#define REG_CNTR_VAL(_n)		(0x0404 + ((_n) << 3))
++
++#define REG_LMGR_INIT_CFG		0x1000
++#define LMGR_INIT_START			BIT(31)
++#define LMGR_SRAM_MODE_MASK		BIT(30)
++#define HW_FWD_PKTSIZE_OVERHEAD_MASK	GENMASK(27, 20)
++#define HW_FWD_DESC_NUM_MASK		GENMASK(16, 0)
++
++#define REG_FWD_DSCP_LOW_THR		0x1004
++#define FWD_DSCP_LOW_THR_MASK		GENMASK(17, 0)
++
++#define REG_EGRESS_RATE_METER_CFG		0x100c
++#define EGRESS_RATE_METER_EN_MASK		BIT(31)
++#define EGRESS_RATE_METER_EQ_RATE_EN_MASK	BIT(17)
++#define EGRESS_RATE_METER_WINDOW_SZ_MASK	GENMASK(16, 12)
++#define EGRESS_RATE_METER_TIMESLICE_MASK	GENMASK(10, 0)
++
++#define REG_EGRESS_TRTCM_CFG		0x1010
++#define EGRESS_TRTCM_EN_MASK		BIT(31)
++#define EGRESS_TRTCM_MODE_MASK		BIT(30)
++#define EGRESS_SLOW_TICK_RATIO_MASK	GENMASK(29, 16)
++#define EGRESS_FAST_TICK_MASK		GENMASK(15, 0)
++
++#define TRTCM_PARAM_RW_MASK		BIT(31)
++#define TRTCM_PARAM_RW_DONE_MASK	BIT(30)
++#define TRTCM_PARAM_TYPE_MASK		GENMASK(29, 28)
++#define TRTCM_METER_GROUP_MASK		GENMASK(27, 26)
++#define TRTCM_PARAM_INDEX_MASK		GENMASK(23, 17)
++#define TRTCM_PARAM_RATE_TYPE_MASK	BIT(16)
++
++#define REG_TRTCM_CFG_PARAM(_n)		((_n) + 0x4)
++#define REG_TRTCM_DATA_LOW(_n)		((_n) + 0x8)
++#define REG_TRTCM_DATA_HIGH(_n)		((_n) + 0xc)
++
++#define REG_TXWRR_MODE_CFG		0x1020
++#define TWRR_WEIGHT_SCALE_MASK		BIT(31)
++#define TWRR_WEIGHT_BASE_MASK		BIT(3)
++
++#define REG_TXWRR_WEIGHT_CFG		0x1024
++#define TWRR_RW_CMD_MASK		BIT(31)
++#define TWRR_RW_CMD_DONE		BIT(30)
++#define TWRR_CHAN_IDX_MASK		GENMASK(23, 19)
++#define TWRR_QUEUE_IDX_MASK		GENMASK(18, 16)
++#define TWRR_VALUE_MASK			GENMASK(15, 0)
++
++#define REG_PSE_BUF_USAGE_CFG		0x1028
++#define PSE_BUF_ESTIMATE_EN_MASK	BIT(29)
++
++#define REG_CHAN_QOS_MODE(_n)		(0x1040 + ((_n) << 2))
++#define CHAN_QOS_MODE_MASK(_n)		GENMASK(2 + ((_n) << 2), (_n) << 2)
++
++#define REG_GLB_TRTCM_CFG		0x1080
++#define GLB_TRTCM_EN_MASK		BIT(31)
++#define GLB_TRTCM_MODE_MASK		BIT(30)
++#define GLB_SLOW_TICK_RATIO_MASK	GENMASK(29, 16)
++#define GLB_FAST_TICK_MASK		GENMASK(15, 0)
++
++#define REG_TXQ_CNGST_CFG		0x10a0
++#define TXQ_CNGST_DROP_EN		BIT(31)
++#define TXQ_CNGST_DEI_DROP_EN		BIT(30)
++
++#define REG_SLA_TRTCM_CFG		0x1150
++#define SLA_TRTCM_EN_MASK		BIT(31)
++#define SLA_TRTCM_MODE_MASK		BIT(30)
++#define SLA_SLOW_TICK_RATIO_MASK	GENMASK(29, 16)
++#define SLA_FAST_TICK_MASK		GENMASK(15, 0)
++
++/* CTRL */
++#define QDMA_DESC_DONE_MASK		BIT(31)
++#define QDMA_DESC_DROP_MASK		BIT(30) /* tx: drop - rx: overflow */
++#define QDMA_DESC_MORE_MASK		BIT(29) /* more SG elements */
++#define QDMA_DESC_DEI_MASK		BIT(25)
++#define QDMA_DESC_NO_DROP_MASK		BIT(24)
++#define QDMA_DESC_LEN_MASK		GENMASK(15, 0)
++/* DATA */
++#define QDMA_DESC_NEXT_ID_MASK		GENMASK(15, 0)
++/* TX MSG0 */
++#define QDMA_ETH_TXMSG_MIC_IDX_MASK	BIT(30)
++#define QDMA_ETH_TXMSG_SP_TAG_MASK	GENMASK(29, 14)
++#define QDMA_ETH_TXMSG_ICO_MASK		BIT(13)
++#define QDMA_ETH_TXMSG_UCO_MASK		BIT(12)
++#define QDMA_ETH_TXMSG_TCO_MASK		BIT(11)
++#define QDMA_ETH_TXMSG_TSO_MASK		BIT(10)
++#define QDMA_ETH_TXMSG_FAST_MASK	BIT(9)
++#define QDMA_ETH_TXMSG_OAM_MASK		BIT(8)
++#define QDMA_ETH_TXMSG_CHAN_MASK	GENMASK(7, 3)
++#define QDMA_ETH_TXMSG_QUEUE_MASK	GENMASK(2, 0)
++/* TX MSG1 */
++#define QDMA_ETH_TXMSG_NO_DROP		BIT(31)
++#define QDMA_ETH_TXMSG_METER_MASK	GENMASK(30, 24)	/* 0x7f no meters */
++#define QDMA_ETH_TXMSG_FPORT_MASK	GENMASK(23, 20)
++#define QDMA_ETH_TXMSG_NBOQ_MASK	GENMASK(19, 15)
++#define QDMA_ETH_TXMSG_HWF_MASK		BIT(14)
++#define QDMA_ETH_TXMSG_HOP_MASK		BIT(13)
++#define QDMA_ETH_TXMSG_PTP_MASK		BIT(12)
++#define QDMA_ETH_TXMSG_ACNT_G1_MASK	GENMASK(10, 6)	/* 0x1f do not count */
++#define QDMA_ETH_TXMSG_ACNT_G0_MASK	GENMASK(5, 0)	/* 0x3f do not count */
++
++/* RX MSG1 */
++#define QDMA_ETH_RXMSG_DEI_MASK		BIT(31)
++#define QDMA_ETH_RXMSG_IP6_MASK		BIT(30)
++#define QDMA_ETH_RXMSG_IP4_MASK		BIT(29)
++#define QDMA_ETH_RXMSG_IP4F_MASK	BIT(28)
++#define QDMA_ETH_RXMSG_L4_VALID_MASK	BIT(27)
++#define QDMA_ETH_RXMSG_L4F_MASK		BIT(26)
++#define QDMA_ETH_RXMSG_SPORT_MASK	GENMASK(25, 21)
++#define QDMA_ETH_RXMSG_CRSN_MASK	GENMASK(20, 16)
++#define QDMA_ETH_RXMSG_PPE_ENTRY_MASK	GENMASK(15, 0)
++
++struct airoha_qdma_desc {
++	__le32 rsv;
++	__le32 ctrl;
++	__le32 addr;
++	__le32 data;
++	__le32 msg0;
++	__le32 msg1;
++	__le32 msg2;
++	__le32 msg3;
++};
++
++/* CTRL0 */
++#define QDMA_FWD_DESC_CTX_MASK		BIT(31)
++#define QDMA_FWD_DESC_RING_MASK		GENMASK(30, 28)
++#define QDMA_FWD_DESC_IDX_MASK		GENMASK(27, 16)
++#define QDMA_FWD_DESC_LEN_MASK		GENMASK(15, 0)
++/* CTRL1 */
++#define QDMA_FWD_DESC_FIRST_IDX_MASK	GENMASK(15, 0)
++/* CTRL2 */
++#define QDMA_FWD_DESC_MORE_PKT_NUM_MASK	GENMASK(2, 0)
++
++struct airoha_qdma_fwd_desc {
++	__le32 addr;
++	__le32 ctrl0;
++	__le32 ctrl1;
++	__le32 ctrl2;
++	__le32 msg0;
++	__le32 msg1;
++	__le32 rsv0;
++	__le32 rsv1;
++};
++
++enum {
++	QDMA_INT_REG_IDX0,
++	QDMA_INT_REG_IDX1,
++	QDMA_INT_REG_IDX2,
++	QDMA_INT_REG_IDX3,
++	QDMA_INT_REG_IDX4,
++	QDMA_INT_REG_MAX
++};
++
++enum {
++	XSI_PCIE0_PORT,
++	XSI_PCIE1_PORT,
++	XSI_USB_PORT,
++	XSI_AE_PORT,
++	XSI_ETH_PORT,
++};
++
++enum {
++	XSI_PCIE0_VIP_PORT_MASK	= BIT(22),
++	XSI_PCIE1_VIP_PORT_MASK	= BIT(23),
++	XSI_USB_VIP_PORT_MASK	= BIT(25),
++	XSI_ETH_VIP_PORT_MASK	= BIT(24),
++};
++
++enum {
++	DEV_STATE_INITIALIZED,
++};
++
++enum {
++	CDM_CRSN_QSEL_Q1 = 1,
++	CDM_CRSN_QSEL_Q5 = 5,
++	CDM_CRSN_QSEL_Q6 = 6,
++	CDM_CRSN_QSEL_Q15 = 15,
++};
++
++enum {
++	CRSN_08 = 0x8,
++	CRSN_21 = 0x15, /* KA */
++	CRSN_22 = 0x16, /* hit bind and force route to CPU */
++	CRSN_24 = 0x18,
++	CRSN_25 = 0x19,
++};
++
++enum {
++	FE_PSE_PORT_CDM1,
++	FE_PSE_PORT_GDM1,
++	FE_PSE_PORT_GDM2,
++	FE_PSE_PORT_GDM3,
++	FE_PSE_PORT_PPE1,
++	FE_PSE_PORT_CDM2,
++	FE_PSE_PORT_CDM3,
++	FE_PSE_PORT_CDM4,
++	FE_PSE_PORT_PPE2,
++	FE_PSE_PORT_GDM4,
++	FE_PSE_PORT_CDM5,
++	FE_PSE_PORT_DROP = 0xf,
++};
++
++enum tx_sched_mode {
++	TC_SCH_WRR8,
++	TC_SCH_SP,
++	TC_SCH_WRR7,
++	TC_SCH_WRR6,
++	TC_SCH_WRR5,
++	TC_SCH_WRR4,
++	TC_SCH_WRR3,
++	TC_SCH_WRR2,
++};
++
++enum trtcm_param_type {
++	TRTCM_MISC_MODE, /* meter_en, pps_mode, tick_sel */
++	TRTCM_TOKEN_RATE_MODE,
++	TRTCM_BUCKETSIZE_SHIFT_MODE,
++	TRTCM_BUCKET_COUNTER_MODE,
++};
++
++enum trtcm_mode_type {
++	TRTCM_COMMIT_MODE,
++	TRTCM_PEAK_MODE,
++};
++
++enum trtcm_param {
++	TRTCM_TICK_SEL = BIT(0),
++	TRTCM_PKT_MODE = BIT(1),
++	TRTCM_METER_MODE = BIT(2),
++};
++
++#define MIN_TOKEN_SIZE				4096
++#define MAX_TOKEN_SIZE_OFFSET			17
++#define TRTCM_TOKEN_RATE_MASK			GENMASK(23, 6)
++#define TRTCM_TOKEN_RATE_FRACTION_MASK		GENMASK(5, 0)
++
++struct airoha_queue_entry {
++	union {
++		void *buf;
++		struct sk_buff *skb;
++	};
++	dma_addr_t dma_addr;
++	u16 dma_len;
++};
++
++struct airoha_queue {
++	struct airoha_qdma *qdma;
++
++	/* protect concurrent queue accesses */
++	spinlock_t lock;
++	struct airoha_queue_entry *entry;
++	struct airoha_qdma_desc *desc;
++	u16 head;
++	u16 tail;
++
++	int queued;
++	int ndesc;
++	int free_thr;
++	int buf_size;
++
++	struct napi_struct napi;
++	struct page_pool *page_pool;
++};
++
++struct airoha_tx_irq_queue {
++	struct airoha_qdma *qdma;
++
++	struct napi_struct napi;
++
++	int size;
++	u32 *q;
++};
++
++struct airoha_hw_stats {
++	/* protect concurrent hw_stats accesses */
++	spinlock_t lock;
++	struct u64_stats_sync syncp;
++
++	/* get_stats64 */
++	u64 rx_ok_pkts;
++	u64 tx_ok_pkts;
++	u64 rx_ok_bytes;
++	u64 tx_ok_bytes;
++	u64 rx_multicast;
++	u64 rx_errors;
++	u64 rx_drops;
++	u64 tx_drops;
++	u64 rx_crc_error;
++	u64 rx_over_errors;
++	/* ethtool stats */
++	u64 tx_broadcast;
++	u64 tx_multicast;
++	u64 tx_len[7];
++	u64 rx_broadcast;
++	u64 rx_fragment;
++	u64 rx_jabber;
++	u64 rx_len[7];
++};
++
++struct airoha_qdma {
++	struct airoha_eth *eth;
++	void __iomem *regs;
++
++	/* protect concurrent irqmask accesses */
++	spinlock_t irq_lock;
++	u32 irqmask[QDMA_INT_REG_MAX];
++	int irq;
++
++	struct airoha_tx_irq_queue q_tx_irq[AIROHA_NUM_TX_IRQ];
++
++	struct airoha_queue q_tx[AIROHA_NUM_TX_RING];
++	struct airoha_queue q_rx[AIROHA_NUM_RX_RING];
++
++	/* descriptor and packet buffers for qdma hw forward */
++	struct {
++		void *desc;
++		void *q;
++	} hfwd;
++};
++
++struct airoha_gdm_port {
++	struct airoha_qdma *qdma;
++	struct net_device *dev;
++	int id;
++
++	struct airoha_hw_stats stats;
++
++	DECLARE_BITMAP(qos_sq_bmap, AIROHA_NUM_QOS_CHANNELS);
++
++	/* qos stats counters */
++	u64 cpu_tx_packets;
++	u64 fwd_tx_packets;
++};
++
++struct airoha_eth {
++	struct device *dev;
++
++	unsigned long state;
++	void __iomem *fe_regs;
++
++	struct reset_control_bulk_data rsts[AIROHA_MAX_NUM_RSTS];
++	struct reset_control_bulk_data xsi_rsts[AIROHA_MAX_NUM_XSI_RSTS];
++
++	struct net_device *napi_dev;
++
++	struct airoha_qdma qdma[AIROHA_MAX_NUM_QDMA];
++	struct airoha_gdm_port *ports[AIROHA_MAX_NUM_GDM_PORTS];
++};
++
++static u32 airoha_rr(void __iomem *base, u32 offset)
++{
++	return readl(base + offset);
++}
++
++static void airoha_wr(void __iomem *base, u32 offset, u32 val)
++{
++	writel(val, base + offset);
++}
++
++static u32 airoha_rmw(void __iomem *base, u32 offset, u32 mask, u32 val)
++{
++	val |= (airoha_rr(base, offset) & ~mask);
++	airoha_wr(base, offset, val);
++
++	return val;
++}
++
++#define airoha_fe_rr(eth, offset)				\
++	airoha_rr((eth)->fe_regs, (offset))
++#define airoha_fe_wr(eth, offset, val)				\
++	airoha_wr((eth)->fe_regs, (offset), (val))
++#define airoha_fe_rmw(eth, offset, mask, val)			\
++	airoha_rmw((eth)->fe_regs, (offset), (mask), (val))
++#define airoha_fe_set(eth, offset, val)				\
++	airoha_rmw((eth)->fe_regs, (offset), 0, (val))
++#define airoha_fe_clear(eth, offset, val)			\
++	airoha_rmw((eth)->fe_regs, (offset), (val), 0)
++
++#define airoha_qdma_rr(qdma, offset)				\
++	airoha_rr((qdma)->regs, (offset))
++#define airoha_qdma_wr(qdma, offset, val)			\
++	airoha_wr((qdma)->regs, (offset), (val))
++#define airoha_qdma_rmw(qdma, offset, mask, val)		\
++	airoha_rmw((qdma)->regs, (offset), (mask), (val))
++#define airoha_qdma_set(qdma, offset, val)			\
++	airoha_rmw((qdma)->regs, (offset), 0, (val))
++#define airoha_qdma_clear(qdma, offset, val)			\
++	airoha_rmw((qdma)->regs, (offset), (val), 0)
++
++static void airoha_qdma_set_irqmask(struct airoha_qdma *qdma, int index,
++				    u32 clear, u32 set)
++{
++	unsigned long flags;
++
++	if (WARN_ON_ONCE(index >= ARRAY_SIZE(qdma->irqmask)))
++		return;
++
++	spin_lock_irqsave(&qdma->irq_lock, flags);
++
++	qdma->irqmask[index] &= ~clear;
++	qdma->irqmask[index] |= set;
++	airoha_qdma_wr(qdma, REG_INT_ENABLE(index), qdma->irqmask[index]);
++	/* Read irq_enable register in order to guarantee the update above
++	 * completes in the spinlock critical section.
++	 */
++	airoha_qdma_rr(qdma, REG_INT_ENABLE(index));
++
++	spin_unlock_irqrestore(&qdma->irq_lock, flags);
++}
++
++static void airoha_qdma_irq_enable(struct airoha_qdma *qdma, int index,
++				   u32 mask)
++{
++	airoha_qdma_set_irqmask(qdma, index, 0, mask);
++}
++
++static void airoha_qdma_irq_disable(struct airoha_qdma *qdma, int index,
++				    u32 mask)
++{
++	airoha_qdma_set_irqmask(qdma, index, mask, 0);
++}
++
++static bool airhoa_is_lan_gdm_port(struct airoha_gdm_port *port)
++{
++	/* GDM1 port on EN7581 SoC is connected to the lan dsa switch.
++	 * GDM{2,3,4} can be used as wan port connected to an external
++	 * phy module.
++	 */
++	return port->id == 1;
++}
++
++static void airoha_set_macaddr(struct airoha_gdm_port *port, const u8 *addr)
++{
++	struct airoha_eth *eth = port->qdma->eth;
++	u32 val, reg;
++
++	reg = airhoa_is_lan_gdm_port(port) ? REG_FE_LAN_MAC_H
++					   : REG_FE_WAN_MAC_H;
++	val = (addr[0] << 16) | (addr[1] << 8) | addr[2];
++	airoha_fe_wr(eth, reg, val);
++
++	val = (addr[3] << 16) | (addr[4] << 8) | addr[5];
++	airoha_fe_wr(eth, REG_FE_MAC_LMIN(reg), val);
++	airoha_fe_wr(eth, REG_FE_MAC_LMAX(reg), val);
++}
++
++static void airoha_set_gdm_port_fwd_cfg(struct airoha_eth *eth, u32 addr,
++					u32 val)
++{
++	airoha_fe_rmw(eth, addr, GDM_OCFQ_MASK,
++		      FIELD_PREP(GDM_OCFQ_MASK, val));
++	airoha_fe_rmw(eth, addr, GDM_MCFQ_MASK,
++		      FIELD_PREP(GDM_MCFQ_MASK, val));
++	airoha_fe_rmw(eth, addr, GDM_BCFQ_MASK,
++		      FIELD_PREP(GDM_BCFQ_MASK, val));
++	airoha_fe_rmw(eth, addr, GDM_UCFQ_MASK,
++		      FIELD_PREP(GDM_UCFQ_MASK, val));
++}
++
++static int airoha_set_gdm_port(struct airoha_eth *eth, int port, bool enable)
++{
++	u32 val = enable ? FE_PSE_PORT_PPE1 : FE_PSE_PORT_DROP;
++	u32 vip_port, cfg_addr;
++
++	switch (port) {
++	case XSI_PCIE0_PORT:
++		vip_port = XSI_PCIE0_VIP_PORT_MASK;
++		cfg_addr = REG_GDM_FWD_CFG(3);
++		break;
++	case XSI_PCIE1_PORT:
++		vip_port = XSI_PCIE1_VIP_PORT_MASK;
++		cfg_addr = REG_GDM_FWD_CFG(3);
++		break;
++	case XSI_USB_PORT:
++		vip_port = XSI_USB_VIP_PORT_MASK;
++		cfg_addr = REG_GDM_FWD_CFG(4);
++		break;
++	case XSI_ETH_PORT:
++		vip_port = XSI_ETH_VIP_PORT_MASK;
++		cfg_addr = REG_GDM_FWD_CFG(4);
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	if (enable) {
++		airoha_fe_set(eth, REG_FE_VIP_PORT_EN, vip_port);
++		airoha_fe_set(eth, REG_FE_IFC_PORT_EN, vip_port);
++	} else {
++		airoha_fe_clear(eth, REG_FE_VIP_PORT_EN, vip_port);
++		airoha_fe_clear(eth, REG_FE_IFC_PORT_EN, vip_port);
++	}
++
++	airoha_set_gdm_port_fwd_cfg(eth, cfg_addr, val);
++
++	return 0;
++}
++
++static int airoha_set_gdm_ports(struct airoha_eth *eth, bool enable)
++{
++	const int port_list[] = {
++		XSI_PCIE0_PORT,
++		XSI_PCIE1_PORT,
++		XSI_USB_PORT,
++		XSI_ETH_PORT
++	};
++	int i, err;
++
++	for (i = 0; i < ARRAY_SIZE(port_list); i++) {
++		err = airoha_set_gdm_port(eth, port_list[i], enable);
++		if (err)
++			goto error;
++	}
++
++	return 0;
++
++error:
++	for (i--; i >= 0; i--)
++		airoha_set_gdm_port(eth, port_list[i], false);
++
++	return err;
++}
++
++static void airoha_fe_maccr_init(struct airoha_eth *eth)
++{
++	int p;
++
++	for (p = 1; p <= ARRAY_SIZE(eth->ports); p++) {
++		airoha_fe_set(eth, REG_GDM_FWD_CFG(p),
++			      GDM_TCP_CKSUM | GDM_UDP_CKSUM | GDM_IP4_CKSUM |
++			      GDM_DROP_CRC_ERR);
++		airoha_set_gdm_port_fwd_cfg(eth, REG_GDM_FWD_CFG(p),
++					    FE_PSE_PORT_CDM1);
++		airoha_fe_rmw(eth, REG_GDM_LEN_CFG(p),
++			      GDM_SHORT_LEN_MASK | GDM_LONG_LEN_MASK,
++			      FIELD_PREP(GDM_SHORT_LEN_MASK, 60) |
++			      FIELD_PREP(GDM_LONG_LEN_MASK, 4004));
++	}
++
++	airoha_fe_rmw(eth, REG_CDM1_VLAN_CTRL, CDM1_VLAN_MASK,
++		      FIELD_PREP(CDM1_VLAN_MASK, 0x8100));
++
++	airoha_fe_set(eth, REG_FE_CPORT_CFG, FE_CPORT_PAD);
++}
++
++static void airoha_fe_vip_setup(struct airoha_eth *eth)
++{
++	airoha_fe_wr(eth, REG_FE_VIP_PATN(3), ETH_P_PPP_DISC);
++	airoha_fe_wr(eth, REG_FE_VIP_EN(3), PATN_FCPU_EN_MASK | PATN_EN_MASK);
++
++	airoha_fe_wr(eth, REG_FE_VIP_PATN(4), PPP_LCP);
++	airoha_fe_wr(eth, REG_FE_VIP_EN(4),
++		     PATN_FCPU_EN_MASK | FIELD_PREP(PATN_TYPE_MASK, 1) |
++		     PATN_EN_MASK);
++
++	airoha_fe_wr(eth, REG_FE_VIP_PATN(6), PPP_IPCP);
++	airoha_fe_wr(eth, REG_FE_VIP_EN(6),
++		     PATN_FCPU_EN_MASK | FIELD_PREP(PATN_TYPE_MASK, 1) |
++		     PATN_EN_MASK);
++
++	airoha_fe_wr(eth, REG_FE_VIP_PATN(7), PPP_CHAP);
++	airoha_fe_wr(eth, REG_FE_VIP_EN(7),
++		     PATN_FCPU_EN_MASK | FIELD_PREP(PATN_TYPE_MASK, 1) |
++		     PATN_EN_MASK);
++
++	/* BOOTP (0x43) */
++	airoha_fe_wr(eth, REG_FE_VIP_PATN(8), 0x43);
++	airoha_fe_wr(eth, REG_FE_VIP_EN(8),
++		     PATN_FCPU_EN_MASK | PATN_SP_EN_MASK |
++		     FIELD_PREP(PATN_TYPE_MASK, 4) | PATN_EN_MASK);
++
++	/* BOOTP (0x44) */
++	airoha_fe_wr(eth, REG_FE_VIP_PATN(9), 0x44);
++	airoha_fe_wr(eth, REG_FE_VIP_EN(9),
++		     PATN_FCPU_EN_MASK | PATN_SP_EN_MASK |
++		     FIELD_PREP(PATN_TYPE_MASK, 4) | PATN_EN_MASK);
++
++	/* ISAKMP */
++	airoha_fe_wr(eth, REG_FE_VIP_PATN(10), 0x1f401f4);
++	airoha_fe_wr(eth, REG_FE_VIP_EN(10),
++		     PATN_FCPU_EN_MASK | PATN_DP_EN_MASK | PATN_SP_EN_MASK |
++		     FIELD_PREP(PATN_TYPE_MASK, 4) | PATN_EN_MASK);
++
++	airoha_fe_wr(eth, REG_FE_VIP_PATN(11), PPP_IPV6CP);
++	airoha_fe_wr(eth, REG_FE_VIP_EN(11),
++		     PATN_FCPU_EN_MASK | FIELD_PREP(PATN_TYPE_MASK, 1) |
++		     PATN_EN_MASK);
++
++	/* DHCPv6 */
++	airoha_fe_wr(eth, REG_FE_VIP_PATN(12), 0x2220223);
++	airoha_fe_wr(eth, REG_FE_VIP_EN(12),
++		     PATN_FCPU_EN_MASK | PATN_DP_EN_MASK | PATN_SP_EN_MASK |
++		     FIELD_PREP(PATN_TYPE_MASK, 4) | PATN_EN_MASK);
++
++	airoha_fe_wr(eth, REG_FE_VIP_PATN(19), PPP_PAP);
++	airoha_fe_wr(eth, REG_FE_VIP_EN(19),
++		     PATN_FCPU_EN_MASK | FIELD_PREP(PATN_TYPE_MASK, 1) |
++		     PATN_EN_MASK);
++
++	/* ETH->ETH_P_1905 (0x893a) */
++	airoha_fe_wr(eth, REG_FE_VIP_PATN(20), 0x893a);
++	airoha_fe_wr(eth, REG_FE_VIP_EN(20),
++		     PATN_FCPU_EN_MASK | PATN_EN_MASK);
++
++	airoha_fe_wr(eth, REG_FE_VIP_PATN(21), ETH_P_LLDP);
++	airoha_fe_wr(eth, REG_FE_VIP_EN(21),
++		     PATN_FCPU_EN_MASK | PATN_EN_MASK);
++}
++
++static u32 airoha_fe_get_pse_queue_rsv_pages(struct airoha_eth *eth,
++					     u32 port, u32 queue)
++{
++	u32 val;
++
++	airoha_fe_rmw(eth, REG_FE_PSE_QUEUE_CFG_WR,
++		      PSE_CFG_PORT_ID_MASK | PSE_CFG_QUEUE_ID_MASK,
++		      FIELD_PREP(PSE_CFG_PORT_ID_MASK, port) |
++		      FIELD_PREP(PSE_CFG_QUEUE_ID_MASK, queue));
++	val = airoha_fe_rr(eth, REG_FE_PSE_QUEUE_CFG_VAL);
++
++	return FIELD_GET(PSE_CFG_OQ_RSV_MASK, val);
++}
++
++static void airoha_fe_set_pse_queue_rsv_pages(struct airoha_eth *eth,
++					      u32 port, u32 queue, u32 val)
++{
++	airoha_fe_rmw(eth, REG_FE_PSE_QUEUE_CFG_VAL, PSE_CFG_OQ_RSV_MASK,
++		      FIELD_PREP(PSE_CFG_OQ_RSV_MASK, val));
++	airoha_fe_rmw(eth, REG_FE_PSE_QUEUE_CFG_WR,
++		      PSE_CFG_PORT_ID_MASK | PSE_CFG_QUEUE_ID_MASK |
++		      PSE_CFG_WR_EN_MASK | PSE_CFG_OQRSV_SEL_MASK,
++		      FIELD_PREP(PSE_CFG_PORT_ID_MASK, port) |
++		      FIELD_PREP(PSE_CFG_QUEUE_ID_MASK, queue) |
++		      PSE_CFG_WR_EN_MASK | PSE_CFG_OQRSV_SEL_MASK);
++}
++
++static u32 airoha_fe_get_pse_all_rsv(struct airoha_eth *eth)
++{
++	u32 val = airoha_fe_rr(eth, REG_FE_PSE_BUF_SET);
++
++	return FIELD_GET(PSE_ALLRSV_MASK, val);
++}
++
++static int airoha_fe_set_pse_oq_rsv(struct airoha_eth *eth,
++				    u32 port, u32 queue, u32 val)
++{
++	u32 orig_val = airoha_fe_get_pse_queue_rsv_pages(eth, port, queue);
++	u32 tmp, all_rsv, fq_limit;
++
++	airoha_fe_set_pse_queue_rsv_pages(eth, port, queue, val);
++
++	/* modify all rsv */
++	all_rsv = airoha_fe_get_pse_all_rsv(eth);
++	all_rsv += (val - orig_val);
++	airoha_fe_rmw(eth, REG_FE_PSE_BUF_SET, PSE_ALLRSV_MASK,
++		      FIELD_PREP(PSE_ALLRSV_MASK, all_rsv));
++
++	/* modify hthd */
++	tmp = airoha_fe_rr(eth, PSE_FQ_CFG);
++	fq_limit = FIELD_GET(PSE_FQ_LIMIT_MASK, tmp);
++	tmp = fq_limit - all_rsv - 0x20;
++	airoha_fe_rmw(eth, REG_PSE_SHARE_USED_THD,
++		      PSE_SHARE_USED_HTHD_MASK,
++		      FIELD_PREP(PSE_SHARE_USED_HTHD_MASK, tmp));
++
++	tmp = fq_limit - all_rsv - 0x100;
++	airoha_fe_rmw(eth, REG_PSE_SHARE_USED_THD,
++		      PSE_SHARE_USED_MTHD_MASK,
++		      FIELD_PREP(PSE_SHARE_USED_MTHD_MASK, tmp));
++	tmp = (3 * tmp) >> 2;
++	airoha_fe_rmw(eth, REG_FE_PSE_BUF_SET,
++		      PSE_SHARE_USED_LTHD_MASK,
++		      FIELD_PREP(PSE_SHARE_USED_LTHD_MASK, tmp));
++
++	return 0;
++}
++
++static void airoha_fe_pse_ports_init(struct airoha_eth *eth)
++{
++	const u32 pse_port_num_queues[] = {
++		[FE_PSE_PORT_CDM1] = 6,
++		[FE_PSE_PORT_GDM1] = 6,
++		[FE_PSE_PORT_GDM2] = 32,
++		[FE_PSE_PORT_GDM3] = 6,
++		[FE_PSE_PORT_PPE1] = 4,
++		[FE_PSE_PORT_CDM2] = 6,
++		[FE_PSE_PORT_CDM3] = 8,
++		[FE_PSE_PORT_CDM4] = 10,
++		[FE_PSE_PORT_PPE2] = 4,
++		[FE_PSE_PORT_GDM4] = 2,
++		[FE_PSE_PORT_CDM5] = 2,
++	};
++	u32 all_rsv;
++	int q;
++
++	all_rsv = airoha_fe_get_pse_all_rsv(eth);
++	/* hw misses PPE2 oq rsv */
++	all_rsv += PSE_RSV_PAGES * pse_port_num_queues[FE_PSE_PORT_PPE2];
++	airoha_fe_set(eth, REG_FE_PSE_BUF_SET, all_rsv);
++
++	/* CMD1 */
++	for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_CDM1]; q++)
++		airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_CDM1, q,
++					 PSE_QUEUE_RSV_PAGES);
++	/* GMD1 */
++	for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_GDM1]; q++)
++		airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_GDM1, q,
++					 PSE_QUEUE_RSV_PAGES);
++	/* GMD2 */
++	for (q = 6; q < pse_port_num_queues[FE_PSE_PORT_GDM2]; q++)
++		airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_GDM2, q, 0);
++	/* GMD3 */
++	for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_GDM3]; q++)
++		airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_GDM3, q,
++					 PSE_QUEUE_RSV_PAGES);
++	/* PPE1 */
++	for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_PPE1]; q++) {
++		if (q < pse_port_num_queues[FE_PSE_PORT_PPE1])
++			airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_PPE1, q,
++						 PSE_QUEUE_RSV_PAGES);
++		else
++			airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_PPE1, q, 0);
++	}
++	/* CDM2 */
++	for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_CDM2]; q++)
++		airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_CDM2, q,
++					 PSE_QUEUE_RSV_PAGES);
++	/* CDM3 */
++	for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_CDM3] - 1; q++)
++		airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_CDM3, q, 0);
++	/* CDM4 */
++	for (q = 4; q < pse_port_num_queues[FE_PSE_PORT_CDM4]; q++)
++		airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_CDM4, q,
++					 PSE_QUEUE_RSV_PAGES);
++	/* PPE2 */
++	for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_PPE2]; q++) {
++		if (q < pse_port_num_queues[FE_PSE_PORT_PPE2] / 2)
++			airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_PPE2, q,
++						 PSE_QUEUE_RSV_PAGES);
++		else
++			airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_PPE2, q, 0);
++	}
++	/* GMD4 */
++	for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_GDM4]; q++)
++		airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_GDM4, q,
++					 PSE_QUEUE_RSV_PAGES);
++	/* CDM5 */
++	for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_CDM5]; q++)
++		airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_CDM5, q,
++					 PSE_QUEUE_RSV_PAGES);
++}
++
++static int airoha_fe_mc_vlan_clear(struct airoha_eth *eth)
++{
++	int i;
++
++	for (i = 0; i < AIROHA_FE_MC_MAX_VLAN_TABLE; i++) {
++		int err, j;
++		u32 val;
++
++		airoha_fe_wr(eth, REG_MC_VLAN_DATA, 0x0);
++
++		val = FIELD_PREP(MC_VLAN_CFG_TABLE_ID_MASK, i) |
++		      MC_VLAN_CFG_TABLE_SEL_MASK | MC_VLAN_CFG_RW_MASK;
++		airoha_fe_wr(eth, REG_MC_VLAN_CFG, val);
++		err = read_poll_timeout(airoha_fe_rr, val,
++					val & MC_VLAN_CFG_CMD_DONE_MASK,
++					USEC_PER_MSEC, 5 * USEC_PER_MSEC,
++					false, eth, REG_MC_VLAN_CFG);
++		if (err)
++			return err;
++
++		for (j = 0; j < AIROHA_FE_MC_MAX_VLAN_PORT; j++) {
++			airoha_fe_wr(eth, REG_MC_VLAN_DATA, 0x0);
++
++			val = FIELD_PREP(MC_VLAN_CFG_TABLE_ID_MASK, i) |
++			      FIELD_PREP(MC_VLAN_CFG_PORT_ID_MASK, j) |
++			      MC_VLAN_CFG_RW_MASK;
++			airoha_fe_wr(eth, REG_MC_VLAN_CFG, val);
++			err = read_poll_timeout(airoha_fe_rr, val,
++						val & MC_VLAN_CFG_CMD_DONE_MASK,
++						USEC_PER_MSEC,
++						5 * USEC_PER_MSEC, false, eth,
++						REG_MC_VLAN_CFG);
++			if (err)
++				return err;
++		}
++	}
++
++	return 0;
++}
++
++static void airoha_fe_crsn_qsel_init(struct airoha_eth *eth)
++{
++	/* CDM1_CRSN_QSEL */
++	airoha_fe_rmw(eth, REG_CDM1_CRSN_QSEL(CRSN_22 >> 2),
++		      CDM1_CRSN_QSEL_REASON_MASK(CRSN_22),
++		      FIELD_PREP(CDM1_CRSN_QSEL_REASON_MASK(CRSN_22),
++				 CDM_CRSN_QSEL_Q1));
++	airoha_fe_rmw(eth, REG_CDM1_CRSN_QSEL(CRSN_08 >> 2),
++		      CDM1_CRSN_QSEL_REASON_MASK(CRSN_08),
++		      FIELD_PREP(CDM1_CRSN_QSEL_REASON_MASK(CRSN_08),
++				 CDM_CRSN_QSEL_Q1));
++	airoha_fe_rmw(eth, REG_CDM1_CRSN_QSEL(CRSN_21 >> 2),
++		      CDM1_CRSN_QSEL_REASON_MASK(CRSN_21),
++		      FIELD_PREP(CDM1_CRSN_QSEL_REASON_MASK(CRSN_21),
++				 CDM_CRSN_QSEL_Q1));
++	airoha_fe_rmw(eth, REG_CDM1_CRSN_QSEL(CRSN_24 >> 2),
++		      CDM1_CRSN_QSEL_REASON_MASK(CRSN_24),
++		      FIELD_PREP(CDM1_CRSN_QSEL_REASON_MASK(CRSN_24),
++				 CDM_CRSN_QSEL_Q6));
++	airoha_fe_rmw(eth, REG_CDM1_CRSN_QSEL(CRSN_25 >> 2),
++		      CDM1_CRSN_QSEL_REASON_MASK(CRSN_25),
++		      FIELD_PREP(CDM1_CRSN_QSEL_REASON_MASK(CRSN_25),
++				 CDM_CRSN_QSEL_Q1));
++	/* CDM2_CRSN_QSEL */
++	airoha_fe_rmw(eth, REG_CDM2_CRSN_QSEL(CRSN_08 >> 2),
++		      CDM2_CRSN_QSEL_REASON_MASK(CRSN_08),
++		      FIELD_PREP(CDM2_CRSN_QSEL_REASON_MASK(CRSN_08),
++				 CDM_CRSN_QSEL_Q1));
++	airoha_fe_rmw(eth, REG_CDM2_CRSN_QSEL(CRSN_21 >> 2),
++		      CDM2_CRSN_QSEL_REASON_MASK(CRSN_21),
++		      FIELD_PREP(CDM2_CRSN_QSEL_REASON_MASK(CRSN_21),
++				 CDM_CRSN_QSEL_Q1));
++	airoha_fe_rmw(eth, REG_CDM2_CRSN_QSEL(CRSN_22 >> 2),
++		      CDM2_CRSN_QSEL_REASON_MASK(CRSN_22),
++		      FIELD_PREP(CDM2_CRSN_QSEL_REASON_MASK(CRSN_22),
++				 CDM_CRSN_QSEL_Q1));
++	airoha_fe_rmw(eth, REG_CDM2_CRSN_QSEL(CRSN_24 >> 2),
++		      CDM2_CRSN_QSEL_REASON_MASK(CRSN_24),
++		      FIELD_PREP(CDM2_CRSN_QSEL_REASON_MASK(CRSN_24),
++				 CDM_CRSN_QSEL_Q6));
++	airoha_fe_rmw(eth, REG_CDM2_CRSN_QSEL(CRSN_25 >> 2),
++		      CDM2_CRSN_QSEL_REASON_MASK(CRSN_25),
++		      FIELD_PREP(CDM2_CRSN_QSEL_REASON_MASK(CRSN_25),
++				 CDM_CRSN_QSEL_Q1));
++}
++
++static int airoha_fe_init(struct airoha_eth *eth)
++{
++	airoha_fe_maccr_init(eth);
++
++	/* PSE IQ reserve */
++	airoha_fe_rmw(eth, REG_PSE_IQ_REV1, PSE_IQ_RES1_P2_MASK,
++		      FIELD_PREP(PSE_IQ_RES1_P2_MASK, 0x10));
++	airoha_fe_rmw(eth, REG_PSE_IQ_REV2,
++		      PSE_IQ_RES2_P5_MASK | PSE_IQ_RES2_P4_MASK,
++		      FIELD_PREP(PSE_IQ_RES2_P5_MASK, 0x40) |
++		      FIELD_PREP(PSE_IQ_RES2_P4_MASK, 0x34));
++
++	/* enable FE copy engine for MC/KA/DPI */
++	airoha_fe_wr(eth, REG_FE_PCE_CFG,
++		     PCE_DPI_EN_MASK | PCE_KA_EN_MASK | PCE_MC_EN_MASK);
++	/* set vip queue selection to ring 1 */
++	airoha_fe_rmw(eth, REG_CDM1_FWD_CFG, CDM1_VIP_QSEL_MASK,
++		      FIELD_PREP(CDM1_VIP_QSEL_MASK, 0x4));
++	airoha_fe_rmw(eth, REG_CDM2_FWD_CFG, CDM2_VIP_QSEL_MASK,
++		      FIELD_PREP(CDM2_VIP_QSEL_MASK, 0x4));
++	/* set GDM4 source interface offset to 8 */
++	airoha_fe_rmw(eth, REG_GDM4_SRC_PORT_SET,
++		      GDM4_SPORT_OFF2_MASK |
++		      GDM4_SPORT_OFF1_MASK |
++		      GDM4_SPORT_OFF0_MASK,
++		      FIELD_PREP(GDM4_SPORT_OFF2_MASK, 8) |
++		      FIELD_PREP(GDM4_SPORT_OFF1_MASK, 8) |
++		      FIELD_PREP(GDM4_SPORT_OFF0_MASK, 8));
++
++	/* set PSE Page as 128B */
++	airoha_fe_rmw(eth, REG_FE_DMA_GLO_CFG,
++		      FE_DMA_GLO_L2_SPACE_MASK | FE_DMA_GLO_PG_SZ_MASK,
++		      FIELD_PREP(FE_DMA_GLO_L2_SPACE_MASK, 2) |
++		      FE_DMA_GLO_PG_SZ_MASK);
++	airoha_fe_wr(eth, REG_FE_RST_GLO_CFG,
++		     FE_RST_CORE_MASK | FE_RST_GDM3_MBI_ARB_MASK |
++		     FE_RST_GDM4_MBI_ARB_MASK);
++	usleep_range(1000, 2000);
++
++	/* connect RxRing1 and RxRing15 to PSE Port0 OQ-1
++	 * connect other rings to PSE Port0 OQ-0
++	 */
++	airoha_fe_wr(eth, REG_FE_CDM1_OQ_MAP0, BIT(4));
++	airoha_fe_wr(eth, REG_FE_CDM1_OQ_MAP1, BIT(28));
++	airoha_fe_wr(eth, REG_FE_CDM1_OQ_MAP2, BIT(4));
++	airoha_fe_wr(eth, REG_FE_CDM1_OQ_MAP3, BIT(28));
++
++	airoha_fe_vip_setup(eth);
++	airoha_fe_pse_ports_init(eth);
++
++	airoha_fe_set(eth, REG_GDM_MISC_CFG,
++		      GDM2_RDM_ACK_WAIT_PREF_MASK |
++		      GDM2_CHN_VLD_MODE_MASK);
++	airoha_fe_rmw(eth, REG_CDM2_FWD_CFG, CDM2_OAM_QSEL_MASK,
++		      FIELD_PREP(CDM2_OAM_QSEL_MASK, 15));
++
++	/* init fragment and assemble Force Port */
++	/* NPU Core-3, NPU Bridge Channel-3 */
++	airoha_fe_rmw(eth, REG_IP_FRAG_FP,
++		      IP_FRAGMENT_PORT_MASK | IP_FRAGMENT_NBQ_MASK,
++		      FIELD_PREP(IP_FRAGMENT_PORT_MASK, 6) |
++		      FIELD_PREP(IP_FRAGMENT_NBQ_MASK, 3));
++	/* QDMA LAN, RX Ring-22 */
++	airoha_fe_rmw(eth, REG_IP_FRAG_FP,
++		      IP_ASSEMBLE_PORT_MASK | IP_ASSEMBLE_NBQ_MASK,
++		      FIELD_PREP(IP_ASSEMBLE_PORT_MASK, 0) |
++		      FIELD_PREP(IP_ASSEMBLE_NBQ_MASK, 22));
++
++	airoha_fe_set(eth, REG_GDM3_FWD_CFG, GDM3_PAD_EN_MASK);
++	airoha_fe_set(eth, REG_GDM4_FWD_CFG, GDM4_PAD_EN_MASK);
++
++	airoha_fe_crsn_qsel_init(eth);
++
++	airoha_fe_clear(eth, REG_FE_CPORT_CFG, FE_CPORT_QUEUE_XFC_MASK);
++	airoha_fe_set(eth, REG_FE_CPORT_CFG, FE_CPORT_PORT_XFC_MASK);
++
++	/* default aging mode for mbi unlock issue */
++	airoha_fe_rmw(eth, REG_GDM2_CHN_RLS,
++		      MBI_RX_AGE_SEL_MASK | MBI_TX_AGE_SEL_MASK,
++		      FIELD_PREP(MBI_RX_AGE_SEL_MASK, 3) |
++		      FIELD_PREP(MBI_TX_AGE_SEL_MASK, 3));
++
++	/* disable IFC by default */
++	airoha_fe_clear(eth, REG_FE_CSR_IFC_CFG, FE_IFC_EN_MASK);
++
++	/* enable 1:N vlan action, init vlan table */
++	airoha_fe_set(eth, REG_MC_VLAN_EN, MC_VLAN_EN_MASK);
++
++	return airoha_fe_mc_vlan_clear(eth);
++}
++
++static int airoha_qdma_fill_rx_queue(struct airoha_queue *q)
++{
++	enum dma_data_direction dir = page_pool_get_dma_dir(q->page_pool);
++	struct airoha_qdma *qdma = q->qdma;
++	struct airoha_eth *eth = qdma->eth;
++	int qid = q - &qdma->q_rx[0];
++	int nframes = 0;
++
++	while (q->queued < q->ndesc - 1) {
++		struct airoha_queue_entry *e = &q->entry[q->head];
++		struct airoha_qdma_desc *desc = &q->desc[q->head];
++		struct page *page;
++		int offset;
++		u32 val;
++
++		page = page_pool_dev_alloc_frag(q->page_pool, &offset,
++						q->buf_size);
++		if (!page)
++			break;
++
++		q->head = (q->head + 1) % q->ndesc;
++		q->queued++;
++		nframes++;
++
++		e->buf = page_address(page) + offset;
++		e->dma_addr = page_pool_get_dma_addr(page) + offset;
++		e->dma_len = SKB_WITH_OVERHEAD(q->buf_size);
++
++		dma_sync_single_for_device(eth->dev, e->dma_addr, e->dma_len,
++					   dir);
++
++		val = FIELD_PREP(QDMA_DESC_LEN_MASK, e->dma_len);
++		WRITE_ONCE(desc->ctrl, cpu_to_le32(val));
++		WRITE_ONCE(desc->addr, cpu_to_le32(e->dma_addr));
++		val = FIELD_PREP(QDMA_DESC_NEXT_ID_MASK, q->head);
++		WRITE_ONCE(desc->data, cpu_to_le32(val));
++		WRITE_ONCE(desc->msg0, 0);
++		WRITE_ONCE(desc->msg1, 0);
++		WRITE_ONCE(desc->msg2, 0);
++		WRITE_ONCE(desc->msg3, 0);
++
++		airoha_qdma_rmw(qdma, REG_RX_CPU_IDX(qid),
++				RX_RING_CPU_IDX_MASK,
++				FIELD_PREP(RX_RING_CPU_IDX_MASK, q->head));
++	}
++
++	return nframes;
++}
++
++static int airoha_qdma_get_gdm_port(struct airoha_eth *eth,
++				    struct airoha_qdma_desc *desc)
++{
++	u32 port, sport, msg1 = le32_to_cpu(desc->msg1);
++
++	sport = FIELD_GET(QDMA_ETH_RXMSG_SPORT_MASK, msg1);
++	switch (sport) {
++	case 0x10 ... 0x13:
++		port = 0;
++		break;
++	case 0x2 ... 0x4:
++		port = sport - 1;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	return port >= ARRAY_SIZE(eth->ports) ? -EINVAL : port;
++}
++
++static int airoha_qdma_rx_process(struct airoha_queue *q, int budget)
++{
++	enum dma_data_direction dir = page_pool_get_dma_dir(q->page_pool);
++	struct airoha_qdma *qdma = q->qdma;
++	struct airoha_eth *eth = qdma->eth;
++	int qid = q - &qdma->q_rx[0];
++	int done = 0;
++
++	while (done < budget) {
++		struct airoha_queue_entry *e = &q->entry[q->tail];
++		struct airoha_qdma_desc *desc = &q->desc[q->tail];
++		dma_addr_t dma_addr = le32_to_cpu(desc->addr);
++		u32 desc_ctrl = le32_to_cpu(desc->ctrl);
++		struct sk_buff *skb;
++		int len, p;
++
++		if (!(desc_ctrl & QDMA_DESC_DONE_MASK))
++			break;
++
++		if (!dma_addr)
++			break;
++
++		len = FIELD_GET(QDMA_DESC_LEN_MASK, desc_ctrl);
++		if (!len)
++			break;
++
++		q->tail = (q->tail + 1) % q->ndesc;
++		q->queued--;
++
++		dma_sync_single_for_cpu(eth->dev, dma_addr,
++					SKB_WITH_OVERHEAD(q->buf_size), dir);
++
++		p = airoha_qdma_get_gdm_port(eth, desc);
++		if (p < 0 || !eth->ports[p]) {
++			page_pool_put_full_page(q->page_pool,
++						virt_to_head_page(e->buf),
++						true);
++			continue;
++		}
++
++		skb = napi_build_skb(e->buf, q->buf_size);
++		if (!skb) {
++			page_pool_put_full_page(q->page_pool,
++						virt_to_head_page(e->buf),
++						true);
++			break;
++		}
++
++		skb_reserve(skb, 2);
++		__skb_put(skb, len);
++		skb_mark_for_recycle(skb);
++		skb->dev = eth->ports[p]->dev;
++		skb->protocol = eth_type_trans(skb, skb->dev);
++		skb->ip_summed = CHECKSUM_UNNECESSARY;
++		skb_record_rx_queue(skb, qid);
++		napi_gro_receive(&q->napi, skb);
++
++		done++;
++	}
++	airoha_qdma_fill_rx_queue(q);
++
++	return done;
++}
++
++static int airoha_qdma_rx_napi_poll(struct napi_struct *napi, int budget)
++{
++	struct airoha_queue *q = container_of(napi, struct airoha_queue, napi);
++	int cur, done = 0;
++
++	do {
++		cur = airoha_qdma_rx_process(q, budget - done);
++		done += cur;
++	} while (cur && done < budget);
++
++	if (done < budget && napi_complete(napi))
++		airoha_qdma_irq_enable(q->qdma, QDMA_INT_REG_IDX1,
++				       RX_DONE_INT_MASK);
++
++	return done;
++}
++
++static int airoha_qdma_init_rx_queue(struct airoha_queue *q,
++				     struct airoha_qdma *qdma, int ndesc)
++{
++	const struct page_pool_params pp_params = {
++		.order = 0,
++		.pool_size = 256,
++		.flags = PP_FLAG_DMA_MAP | PP_FLAG_DMA_SYNC_DEV |
++			 PP_FLAG_PAGE_FRAG,
++		.dma_dir = DMA_FROM_DEVICE,
++		.max_len = PAGE_SIZE,
++		.nid = NUMA_NO_NODE,
++		.dev = qdma->eth->dev,
++		.napi = &q->napi,
++	};
++	struct airoha_eth *eth = qdma->eth;
++	int qid = q - &qdma->q_rx[0], thr;
++	dma_addr_t dma_addr;
++
++	q->buf_size = PAGE_SIZE / 2;
++	q->ndesc = ndesc;
++	q->qdma = qdma;
++
++	q->entry = devm_kzalloc(eth->dev, q->ndesc * sizeof(*q->entry),
++				GFP_KERNEL);
++	if (!q->entry)
++		return -ENOMEM;
++
++	q->page_pool = page_pool_create(&pp_params);
++	if (IS_ERR(q->page_pool)) {
++		int err = PTR_ERR(q->page_pool);
++
++		q->page_pool = NULL;
++		return err;
++	}
++
++	q->desc = dmam_alloc_coherent(eth->dev, q->ndesc * sizeof(*q->desc),
++				      &dma_addr, GFP_KERNEL);
++	if (!q->desc)
++		return -ENOMEM;
++
++	netif_napi_add(eth->napi_dev, &q->napi, airoha_qdma_rx_napi_poll);
++
++	airoha_qdma_wr(qdma, REG_RX_RING_BASE(qid), dma_addr);
++	airoha_qdma_rmw(qdma, REG_RX_RING_SIZE(qid),
++			RX_RING_SIZE_MASK,
++			FIELD_PREP(RX_RING_SIZE_MASK, ndesc));
++
++	thr = clamp(ndesc >> 3, 1, 32);
++	airoha_qdma_rmw(qdma, REG_RX_RING_SIZE(qid), RX_RING_THR_MASK,
++			FIELD_PREP(RX_RING_THR_MASK, thr));
++	airoha_qdma_rmw(qdma, REG_RX_DMA_IDX(qid), RX_RING_DMA_IDX_MASK,
++			FIELD_PREP(RX_RING_DMA_IDX_MASK, q->head));
++
++	airoha_qdma_fill_rx_queue(q);
++
++	return 0;
++}
++
++static void airoha_qdma_cleanup_rx_queue(struct airoha_queue *q)
++{
++	struct airoha_eth *eth = q->qdma->eth;
++
++	while (q->queued) {
++		struct airoha_queue_entry *e = &q->entry[q->tail];
++		struct page *page = virt_to_head_page(e->buf);
++
++		dma_sync_single_for_cpu(eth->dev, e->dma_addr, e->dma_len,
++					page_pool_get_dma_dir(q->page_pool));
++		page_pool_put_full_page(q->page_pool, page, false);
++		q->tail = (q->tail + 1) % q->ndesc;
++		q->queued--;
++	}
++}
++
++static int airoha_qdma_init_rx(struct airoha_qdma *qdma)
++{
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(qdma->q_rx); i++) {
++		int err;
++
++		if (!(RX_DONE_INT_MASK & BIT(i))) {
++			/* rx-queue not binded to irq */
++			continue;
++		}
++
++		err = airoha_qdma_init_rx_queue(&qdma->q_rx[i], qdma,
++						RX_DSCP_NUM(i));
++		if (err)
++			return err;
++	}
++
++	return 0;
++}
++
++static int airoha_qdma_tx_napi_poll(struct napi_struct *napi, int budget)
++{
++	struct airoha_tx_irq_queue *irq_q;
++	int id, done = 0, irq_queued;
++	struct airoha_qdma *qdma;
++	struct airoha_eth *eth;
++	u32 status, head;
++
++	irq_q = container_of(napi, struct airoha_tx_irq_queue, napi);
++	qdma = irq_q->qdma;
++	id = irq_q - &qdma->q_tx_irq[0];
++	eth = qdma->eth;
++
++	status = airoha_qdma_rr(qdma, REG_IRQ_STATUS(id));
++	head = FIELD_GET(IRQ_HEAD_IDX_MASK, status);
++	head = head % irq_q->size;
++	irq_queued = FIELD_GET(IRQ_ENTRY_LEN_MASK, status);
++
++	while (irq_queued > 0 && done < budget) {
++		u32 qid, val = irq_q->q[head];
++		struct airoha_qdma_desc *desc;
++		struct airoha_queue_entry *e;
++		struct airoha_queue *q;
++		u32 index, desc_ctrl;
++		struct sk_buff *skb;
++
++		if (val == 0xff)
++			break;
++
++		irq_q->q[head] = 0xff; /* mark as done */
++		head = (head + 1) % irq_q->size;
++		irq_queued--;
++		done++;
++
++		qid = FIELD_GET(IRQ_RING_IDX_MASK, val);
++		if (qid >= ARRAY_SIZE(qdma->q_tx))
++			continue;
++
++		q = &qdma->q_tx[qid];
++		if (!q->ndesc)
++			continue;
++
++		index = FIELD_GET(IRQ_DESC_IDX_MASK, val);
++		if (index >= q->ndesc)
++			continue;
++
++		spin_lock_bh(&q->lock);
++
++		if (!q->queued)
++			goto unlock;
++
++		desc = &q->desc[index];
++		desc_ctrl = le32_to_cpu(desc->ctrl);
++
++		if (!(desc_ctrl & QDMA_DESC_DONE_MASK) &&
++		    !(desc_ctrl & QDMA_DESC_DROP_MASK))
++			goto unlock;
++
++		e = &q->entry[index];
++		skb = e->skb;
++
++		dma_unmap_single(eth->dev, e->dma_addr, e->dma_len,
++				 DMA_TO_DEVICE);
++		memset(e, 0, sizeof(*e));
++		WRITE_ONCE(desc->msg0, 0);
++		WRITE_ONCE(desc->msg1, 0);
++		q->queued--;
++
++		/* completion ring can report out-of-order indexes if hw QoS
++		 * is enabled and packets with different priority are queued
++		 * to same DMA ring. Take into account possible out-of-order
++		 * reports incrementing DMA ring tail pointer
++		 */
++		while (q->tail != q->head && !q->entry[q->tail].dma_addr)
++			q->tail = (q->tail + 1) % q->ndesc;
++
++		if (skb) {
++			u16 queue = skb_get_queue_mapping(skb);
++			struct netdev_queue *txq;
++
++			txq = netdev_get_tx_queue(skb->dev, queue);
++			netdev_tx_completed_queue(txq, 1, skb->len);
++			if (netif_tx_queue_stopped(txq) &&
++			    q->ndesc - q->queued >= q->free_thr)
++				netif_tx_wake_queue(txq);
++
++			dev_kfree_skb_any(skb);
++		}
++unlock:
++		spin_unlock_bh(&q->lock);
++	}
++
++	if (done) {
++		int i, len = done >> 7;
++
++		for (i = 0; i < len; i++)
++			airoha_qdma_rmw(qdma, REG_IRQ_CLEAR_LEN(id),
++					IRQ_CLEAR_LEN_MASK, 0x80);
++		airoha_qdma_rmw(qdma, REG_IRQ_CLEAR_LEN(id),
++				IRQ_CLEAR_LEN_MASK, (done & 0x7f));
++	}
++
++	if (done < budget && napi_complete(napi))
++		airoha_qdma_irq_enable(qdma, QDMA_INT_REG_IDX0,
++				       TX_DONE_INT_MASK(id));
++
++	return done;
++}
++
++static int airoha_qdma_init_tx_queue(struct airoha_queue *q,
++				     struct airoha_qdma *qdma, int size)
++{
++	struct airoha_eth *eth = qdma->eth;
++	int i, qid = q - &qdma->q_tx[0];
++	dma_addr_t dma_addr;
++
++	spin_lock_init(&q->lock);
++	q->ndesc = size;
++	q->qdma = qdma;
++	q->free_thr = 1 + MAX_SKB_FRAGS;
++
++	q->entry = devm_kzalloc(eth->dev, q->ndesc * sizeof(*q->entry),
++				GFP_KERNEL);
++	if (!q->entry)
++		return -ENOMEM;
++
++	q->desc = dmam_alloc_coherent(eth->dev, q->ndesc * sizeof(*q->desc),
++				      &dma_addr, GFP_KERNEL);
++	if (!q->desc)
++		return -ENOMEM;
++
++	for (i = 0; i < q->ndesc; i++) {
++		u32 val;
++
++		val = FIELD_PREP(QDMA_DESC_DONE_MASK, 1);
++		WRITE_ONCE(q->desc[i].ctrl, cpu_to_le32(val));
++	}
++
++	/* xmit ring drop default setting */
++	airoha_qdma_set(qdma, REG_TX_RING_BLOCKING(qid),
++			TX_RING_IRQ_BLOCKING_TX_DROP_EN_MASK);
++
++	airoha_qdma_wr(qdma, REG_TX_RING_BASE(qid), dma_addr);
++	airoha_qdma_rmw(qdma, REG_TX_CPU_IDX(qid), TX_RING_CPU_IDX_MASK,
++			FIELD_PREP(TX_RING_CPU_IDX_MASK, q->head));
++	airoha_qdma_rmw(qdma, REG_TX_DMA_IDX(qid), TX_RING_DMA_IDX_MASK,
++			FIELD_PREP(TX_RING_DMA_IDX_MASK, q->head));
++
++	return 0;
++}
++
++static int airoha_qdma_tx_irq_init(struct airoha_tx_irq_queue *irq_q,
++				   struct airoha_qdma *qdma, int size)
++{
++	int id = irq_q - &qdma->q_tx_irq[0];
++	struct airoha_eth *eth = qdma->eth;
++	dma_addr_t dma_addr;
++
++	netif_napi_add_tx(eth->napi_dev, &irq_q->napi,
++			  airoha_qdma_tx_napi_poll);
++	irq_q->q = dmam_alloc_coherent(eth->dev, size * sizeof(u32),
++				       &dma_addr, GFP_KERNEL);
++	if (!irq_q->q)
++		return -ENOMEM;
++
++	memset(irq_q->q, 0xff, size * sizeof(u32));
++	irq_q->size = size;
++	irq_q->qdma = qdma;
++
++	airoha_qdma_wr(qdma, REG_TX_IRQ_BASE(id), dma_addr);
++	airoha_qdma_rmw(qdma, REG_TX_IRQ_CFG(id), TX_IRQ_DEPTH_MASK,
++			FIELD_PREP(TX_IRQ_DEPTH_MASK, size));
++	airoha_qdma_rmw(qdma, REG_TX_IRQ_CFG(id), TX_IRQ_THR_MASK,
++			FIELD_PREP(TX_IRQ_THR_MASK, 1));
++
++	return 0;
++}
++
++static int airoha_qdma_init_tx(struct airoha_qdma *qdma)
++{
++	int i, err;
++
++	for (i = 0; i < ARRAY_SIZE(qdma->q_tx_irq); i++) {
++		err = airoha_qdma_tx_irq_init(&qdma->q_tx_irq[i], qdma,
++					      IRQ_QUEUE_LEN(i));
++		if (err)
++			return err;
++	}
++
++	for (i = 0; i < ARRAY_SIZE(qdma->q_tx); i++) {
++		err = airoha_qdma_init_tx_queue(&qdma->q_tx[i], qdma,
++						TX_DSCP_NUM);
++		if (err)
++			return err;
++	}
++
++	return 0;
++}
++
++static void airoha_qdma_cleanup_tx_queue(struct airoha_queue *q)
++{
++	struct airoha_eth *eth = q->qdma->eth;
++
++	spin_lock_bh(&q->lock);
++	while (q->queued) {
++		struct airoha_queue_entry *e = &q->entry[q->tail];
++
++		dma_unmap_single(eth->dev, e->dma_addr, e->dma_len,
++				 DMA_TO_DEVICE);
++		dev_kfree_skb_any(e->skb);
++		e->skb = NULL;
++
++		q->tail = (q->tail + 1) % q->ndesc;
++		q->queued--;
++	}
++	spin_unlock_bh(&q->lock);
++}
++
++static int airoha_qdma_init_hfwd_queues(struct airoha_qdma *qdma)
++{
++	struct airoha_eth *eth = qdma->eth;
++	dma_addr_t dma_addr;
++	u32 status;
++	int size;
++
++	size = HW_DSCP_NUM * sizeof(struct airoha_qdma_fwd_desc);
++	qdma->hfwd.desc = dmam_alloc_coherent(eth->dev, size, &dma_addr,
++					      GFP_KERNEL);
++	if (!qdma->hfwd.desc)
++		return -ENOMEM;
++
++	airoha_qdma_wr(qdma, REG_FWD_DSCP_BASE, dma_addr);
++
++	size = AIROHA_MAX_PACKET_SIZE * HW_DSCP_NUM;
++	qdma->hfwd.q = dmam_alloc_coherent(eth->dev, size, &dma_addr,
++					   GFP_KERNEL);
++	if (!qdma->hfwd.q)
++		return -ENOMEM;
++
++	airoha_qdma_wr(qdma, REG_FWD_BUF_BASE, dma_addr);
++
++	airoha_qdma_rmw(qdma, REG_HW_FWD_DSCP_CFG,
++			HW_FWD_DSCP_PAYLOAD_SIZE_MASK,
++			FIELD_PREP(HW_FWD_DSCP_PAYLOAD_SIZE_MASK, 0));
++	airoha_qdma_rmw(qdma, REG_FWD_DSCP_LOW_THR, FWD_DSCP_LOW_THR_MASK,
++			FIELD_PREP(FWD_DSCP_LOW_THR_MASK, 128));
++	airoha_qdma_rmw(qdma, REG_LMGR_INIT_CFG,
++			LMGR_INIT_START | LMGR_SRAM_MODE_MASK |
++			HW_FWD_DESC_NUM_MASK,
++			FIELD_PREP(HW_FWD_DESC_NUM_MASK, HW_DSCP_NUM) |
++			LMGR_INIT_START);
++
++	return read_poll_timeout(airoha_qdma_rr, status,
++				 !(status & LMGR_INIT_START), USEC_PER_MSEC,
++				 30 * USEC_PER_MSEC, true, qdma,
++				 REG_LMGR_INIT_CFG);
++}
++
++static void airoha_qdma_init_qos(struct airoha_qdma *qdma)
++{
++	airoha_qdma_clear(qdma, REG_TXWRR_MODE_CFG, TWRR_WEIGHT_SCALE_MASK);
++	airoha_qdma_set(qdma, REG_TXWRR_MODE_CFG, TWRR_WEIGHT_BASE_MASK);
++
++	airoha_qdma_clear(qdma, REG_PSE_BUF_USAGE_CFG,
++			  PSE_BUF_ESTIMATE_EN_MASK);
++
++	airoha_qdma_set(qdma, REG_EGRESS_RATE_METER_CFG,
++			EGRESS_RATE_METER_EN_MASK |
++			EGRESS_RATE_METER_EQ_RATE_EN_MASK);
++	/* 2047us x 31 = 63.457ms */
++	airoha_qdma_rmw(qdma, REG_EGRESS_RATE_METER_CFG,
++			EGRESS_RATE_METER_WINDOW_SZ_MASK,
++			FIELD_PREP(EGRESS_RATE_METER_WINDOW_SZ_MASK, 0x1f));
++	airoha_qdma_rmw(qdma, REG_EGRESS_RATE_METER_CFG,
++			EGRESS_RATE_METER_TIMESLICE_MASK,
++			FIELD_PREP(EGRESS_RATE_METER_TIMESLICE_MASK, 0x7ff));
++
++	/* ratelimit init */
++	airoha_qdma_set(qdma, REG_GLB_TRTCM_CFG, GLB_TRTCM_EN_MASK);
++	/* fast-tick 25us */
++	airoha_qdma_rmw(qdma, REG_GLB_TRTCM_CFG, GLB_FAST_TICK_MASK,
++			FIELD_PREP(GLB_FAST_TICK_MASK, 25));
++	airoha_qdma_rmw(qdma, REG_GLB_TRTCM_CFG, GLB_SLOW_TICK_RATIO_MASK,
++			FIELD_PREP(GLB_SLOW_TICK_RATIO_MASK, 40));
++
++	airoha_qdma_set(qdma, REG_EGRESS_TRTCM_CFG, EGRESS_TRTCM_EN_MASK);
++	airoha_qdma_rmw(qdma, REG_EGRESS_TRTCM_CFG, EGRESS_FAST_TICK_MASK,
++			FIELD_PREP(EGRESS_FAST_TICK_MASK, 25));
++	airoha_qdma_rmw(qdma, REG_EGRESS_TRTCM_CFG,
++			EGRESS_SLOW_TICK_RATIO_MASK,
++			FIELD_PREP(EGRESS_SLOW_TICK_RATIO_MASK, 40));
++
++	airoha_qdma_set(qdma, REG_INGRESS_TRTCM_CFG, INGRESS_TRTCM_EN_MASK);
++	airoha_qdma_clear(qdma, REG_INGRESS_TRTCM_CFG,
++			  INGRESS_TRTCM_MODE_MASK);
++	airoha_qdma_rmw(qdma, REG_INGRESS_TRTCM_CFG, INGRESS_FAST_TICK_MASK,
++			FIELD_PREP(INGRESS_FAST_TICK_MASK, 125));
++	airoha_qdma_rmw(qdma, REG_INGRESS_TRTCM_CFG,
++			INGRESS_SLOW_TICK_RATIO_MASK,
++			FIELD_PREP(INGRESS_SLOW_TICK_RATIO_MASK, 8));
++
++	airoha_qdma_set(qdma, REG_SLA_TRTCM_CFG, SLA_TRTCM_EN_MASK);
++	airoha_qdma_rmw(qdma, REG_SLA_TRTCM_CFG, SLA_FAST_TICK_MASK,
++			FIELD_PREP(SLA_FAST_TICK_MASK, 25));
++	airoha_qdma_rmw(qdma, REG_SLA_TRTCM_CFG, SLA_SLOW_TICK_RATIO_MASK,
++			FIELD_PREP(SLA_SLOW_TICK_RATIO_MASK, 40));
++}
++
++static void airoha_qdma_init_qos_stats(struct airoha_qdma *qdma)
++{
++	int i;
++
++	for (i = 0; i < AIROHA_NUM_QOS_CHANNELS; i++) {
++		/* Tx-cpu transferred count */
++		airoha_qdma_wr(qdma, REG_CNTR_VAL(i << 1), 0);
++		airoha_qdma_wr(qdma, REG_CNTR_CFG(i << 1),
++			       CNTR_EN_MASK | CNTR_ALL_QUEUE_EN_MASK |
++			       CNTR_ALL_DSCP_RING_EN_MASK |
++			       FIELD_PREP(CNTR_CHAN_MASK, i));
++		/* Tx-fwd transferred count */
++		airoha_qdma_wr(qdma, REG_CNTR_VAL((i << 1) + 1), 0);
++		airoha_qdma_wr(qdma, REG_CNTR_CFG(i << 1),
++			       CNTR_EN_MASK | CNTR_ALL_QUEUE_EN_MASK |
++			       CNTR_ALL_DSCP_RING_EN_MASK |
++			       FIELD_PREP(CNTR_SRC_MASK, 1) |
++			       FIELD_PREP(CNTR_CHAN_MASK, i));
++	}
++}
++
++static int airoha_qdma_hw_init(struct airoha_qdma *qdma)
++{
++	int i;
++
++	/* clear pending irqs */
++	for (i = 0; i < ARRAY_SIZE(qdma->irqmask); i++)
++		airoha_qdma_wr(qdma, REG_INT_STATUS(i), 0xffffffff);
++
++	/* setup irqs */
++	airoha_qdma_irq_enable(qdma, QDMA_INT_REG_IDX0, INT_IDX0_MASK);
++	airoha_qdma_irq_enable(qdma, QDMA_INT_REG_IDX1, INT_IDX1_MASK);
++	airoha_qdma_irq_enable(qdma, QDMA_INT_REG_IDX4, INT_IDX4_MASK);
++
++	/* setup irq binding */
++	for (i = 0; i < ARRAY_SIZE(qdma->q_tx); i++) {
++		if (!qdma->q_tx[i].ndesc)
++			continue;
++
++		if (TX_RING_IRQ_BLOCKING_MAP_MASK & BIT(i))
++			airoha_qdma_set(qdma, REG_TX_RING_BLOCKING(i),
++					TX_RING_IRQ_BLOCKING_CFG_MASK);
++		else
++			airoha_qdma_clear(qdma, REG_TX_RING_BLOCKING(i),
++					  TX_RING_IRQ_BLOCKING_CFG_MASK);
++	}
++
++	airoha_qdma_wr(qdma, REG_QDMA_GLOBAL_CFG,
++		       GLOBAL_CFG_RX_2B_OFFSET_MASK |
++		       FIELD_PREP(GLOBAL_CFG_DMA_PREFERENCE_MASK, 3) |
++		       GLOBAL_CFG_CPU_TXR_RR_MASK |
++		       GLOBAL_CFG_PAYLOAD_BYTE_SWAP_MASK |
++		       GLOBAL_CFG_MULTICAST_MODIFY_FP_MASK |
++		       GLOBAL_CFG_MULTICAST_EN_MASK |
++		       GLOBAL_CFG_IRQ0_EN_MASK | GLOBAL_CFG_IRQ1_EN_MASK |
++		       GLOBAL_CFG_TX_WB_DONE_MASK |
++		       FIELD_PREP(GLOBAL_CFG_MAX_ISSUE_NUM_MASK, 2));
++
++	airoha_qdma_init_qos(qdma);
++
++	/* disable qdma rx delay interrupt */
++	for (i = 0; i < ARRAY_SIZE(qdma->q_rx); i++) {
++		if (!qdma->q_rx[i].ndesc)
++			continue;
++
++		airoha_qdma_clear(qdma, REG_RX_DELAY_INT_IDX(i),
++				  RX_DELAY_INT_MASK);
++	}
++
++	airoha_qdma_set(qdma, REG_TXQ_CNGST_CFG,
++			TXQ_CNGST_DROP_EN | TXQ_CNGST_DEI_DROP_EN);
++	airoha_qdma_init_qos_stats(qdma);
++
++	return 0;
++}
++
++static irqreturn_t airoha_irq_handler(int irq, void *dev_instance)
++{
++	struct airoha_qdma *qdma = dev_instance;
++	u32 intr[ARRAY_SIZE(qdma->irqmask)];
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(qdma->irqmask); i++) {
++		intr[i] = airoha_qdma_rr(qdma, REG_INT_STATUS(i));
++		intr[i] &= qdma->irqmask[i];
++		airoha_qdma_wr(qdma, REG_INT_STATUS(i), intr[i]);
++	}
++
++	if (!test_bit(DEV_STATE_INITIALIZED, &qdma->eth->state))
++		return IRQ_NONE;
++
++	if (intr[1] & RX_DONE_INT_MASK) {
++		airoha_qdma_irq_disable(qdma, QDMA_INT_REG_IDX1,
++					RX_DONE_INT_MASK);
++
++		for (i = 0; i < ARRAY_SIZE(qdma->q_rx); i++) {
++			if (!qdma->q_rx[i].ndesc)
++				continue;
++
++			if (intr[1] & BIT(i))
++				napi_schedule(&qdma->q_rx[i].napi);
++		}
++	}
++
++	if (intr[0] & INT_TX_MASK) {
++		for (i = 0; i < ARRAY_SIZE(qdma->q_tx_irq); i++) {
++			if (!(intr[0] & TX_DONE_INT_MASK(i)))
++				continue;
++
++			airoha_qdma_irq_disable(qdma, QDMA_INT_REG_IDX0,
++						TX_DONE_INT_MASK(i));
++			napi_schedule(&qdma->q_tx_irq[i].napi);
++		}
++	}
++
++	return IRQ_HANDLED;
++}
++
++static int airoha_qdma_init(struct platform_device *pdev,
++			    struct airoha_eth *eth,
++			    struct airoha_qdma *qdma)
++{
++	int err, id = qdma - &eth->qdma[0];
++	const char *res;
++
++	spin_lock_init(&qdma->irq_lock);
++	qdma->eth = eth;
++
++	res = devm_kasprintf(eth->dev, GFP_KERNEL, "qdma%d", id);
++	if (!res)
++		return -ENOMEM;
++
++	qdma->regs = devm_platform_ioremap_resource_byname(pdev, res);
++	if (IS_ERR(qdma->regs))
++		return dev_err_probe(eth->dev, PTR_ERR(qdma->regs),
++				     "failed to iomap qdma%d regs\n", id);
++
++	qdma->irq = platform_get_irq(pdev, 4 * id);
++	if (qdma->irq < 0)
++		return qdma->irq;
++
++	err = devm_request_irq(eth->dev, qdma->irq, airoha_irq_handler,
++			       IRQF_SHARED, KBUILD_MODNAME, qdma);
++	if (err)
++		return err;
++
++	err = airoha_qdma_init_rx(qdma);
++	if (err)
++		return err;
++
++	err = airoha_qdma_init_tx(qdma);
++	if (err)
++		return err;
++
++	err = airoha_qdma_init_hfwd_queues(qdma);
++	if (err)
++		return err;
++
++	return airoha_qdma_hw_init(qdma);
++}
++
++static int airoha_hw_init(struct platform_device *pdev,
++			  struct airoha_eth *eth)
++{
++	int err, i;
++
++	/* disable xsi */
++	err = reset_control_bulk_assert(ARRAY_SIZE(eth->xsi_rsts),
++					eth->xsi_rsts);
++	if (err)
++		return err;
++
++	err = reset_control_bulk_assert(ARRAY_SIZE(eth->rsts), eth->rsts);
++	if (err)
++		return err;
++
++	msleep(20);
++	err = reset_control_bulk_deassert(ARRAY_SIZE(eth->rsts), eth->rsts);
++	if (err)
++		return err;
++
++	msleep(20);
++	err = airoha_fe_init(eth);
++	if (err)
++		return err;
++
++	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++) {
++		err = airoha_qdma_init(pdev, eth, &eth->qdma[i]);
++		if (err)
++			return err;
++	}
++
++	set_bit(DEV_STATE_INITIALIZED, &eth->state);
++
++	return 0;
++}
++
++static void airoha_hw_cleanup(struct airoha_qdma *qdma)
++{
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(qdma->q_rx); i++) {
++		if (!qdma->q_rx[i].ndesc)
++			continue;
++
++		netif_napi_del(&qdma->q_rx[i].napi);
++		airoha_qdma_cleanup_rx_queue(&qdma->q_rx[i]);
++		if (qdma->q_rx[i].page_pool)
++			page_pool_destroy(qdma->q_rx[i].page_pool);
++	}
++
++	for (i = 0; i < ARRAY_SIZE(qdma->q_tx_irq); i++)
++		netif_napi_del(&qdma->q_tx_irq[i].napi);
++
++	for (i = 0; i < ARRAY_SIZE(qdma->q_tx); i++) {
++		if (!qdma->q_tx[i].ndesc)
++			continue;
++
++		airoha_qdma_cleanup_tx_queue(&qdma->q_tx[i]);
++	}
++}
++
++static void airoha_qdma_start_napi(struct airoha_qdma *qdma)
++{
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(qdma->q_tx_irq); i++)
++		napi_enable(&qdma->q_tx_irq[i].napi);
++
++	for (i = 0; i < ARRAY_SIZE(qdma->q_rx); i++) {
++		if (!qdma->q_rx[i].ndesc)
++			continue;
++
++		napi_enable(&qdma->q_rx[i].napi);
++	}
++}
++
++static void airoha_qdma_stop_napi(struct airoha_qdma *qdma)
++{
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(qdma->q_tx_irq); i++)
++		napi_disable(&qdma->q_tx_irq[i].napi);
++
++	for (i = 0; i < ARRAY_SIZE(qdma->q_rx); i++) {
++		if (!qdma->q_rx[i].ndesc)
++			continue;
++
++		napi_disable(&qdma->q_rx[i].napi);
++	}
++}
++
++static void airoha_update_hw_stats(struct airoha_gdm_port *port)
++{
++	struct airoha_eth *eth = port->qdma->eth;
++	u32 val, i = 0;
++
++	spin_lock(&port->stats.lock);
++	u64_stats_update_begin(&port->stats.syncp);
++
++	/* TX */
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_OK_PKT_CNT_H(port->id));
++	port->stats.tx_ok_pkts += ((u64)val << 32);
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_OK_PKT_CNT_L(port->id));
++	port->stats.tx_ok_pkts += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_OK_BYTE_CNT_H(port->id));
++	port->stats.tx_ok_bytes += ((u64)val << 32);
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_OK_BYTE_CNT_L(port->id));
++	port->stats.tx_ok_bytes += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_DROP_CNT(port->id));
++	port->stats.tx_drops += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_BC_CNT(port->id));
++	port->stats.tx_broadcast += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_MC_CNT(port->id));
++	port->stats.tx_multicast += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_RUNT_CNT(port->id));
++	port->stats.tx_len[i] += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_E64_CNT_H(port->id));
++	port->stats.tx_len[i] += ((u64)val << 32);
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_E64_CNT_L(port->id));
++	port->stats.tx_len[i++] += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L64_CNT_H(port->id));
++	port->stats.tx_len[i] += ((u64)val << 32);
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L64_CNT_L(port->id));
++	port->stats.tx_len[i++] += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L127_CNT_H(port->id));
++	port->stats.tx_len[i] += ((u64)val << 32);
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L127_CNT_L(port->id));
++	port->stats.tx_len[i++] += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L255_CNT_H(port->id));
++	port->stats.tx_len[i] += ((u64)val << 32);
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L255_CNT_L(port->id));
++	port->stats.tx_len[i++] += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L511_CNT_H(port->id));
++	port->stats.tx_len[i] += ((u64)val << 32);
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L511_CNT_L(port->id));
++	port->stats.tx_len[i++] += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L1023_CNT_H(port->id));
++	port->stats.tx_len[i] += ((u64)val << 32);
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L1023_CNT_L(port->id));
++	port->stats.tx_len[i++] += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_LONG_CNT(port->id));
++	port->stats.tx_len[i++] += val;
++
++	/* RX */
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_OK_PKT_CNT_H(port->id));
++	port->stats.rx_ok_pkts += ((u64)val << 32);
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_OK_PKT_CNT_L(port->id));
++	port->stats.rx_ok_pkts += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_OK_BYTE_CNT_H(port->id));
++	port->stats.rx_ok_bytes += ((u64)val << 32);
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_OK_BYTE_CNT_L(port->id));
++	port->stats.rx_ok_bytes += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_DROP_CNT(port->id));
++	port->stats.rx_drops += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_BC_CNT(port->id));
++	port->stats.rx_broadcast += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_MC_CNT(port->id));
++	port->stats.rx_multicast += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ERROR_DROP_CNT(port->id));
++	port->stats.rx_errors += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_CRC_ERR_CNT(port->id));
++	port->stats.rx_crc_error += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_OVERFLOW_DROP_CNT(port->id));
++	port->stats.rx_over_errors += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_FRAG_CNT(port->id));
++	port->stats.rx_fragment += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_JABBER_CNT(port->id));
++	port->stats.rx_jabber += val;
++
++	i = 0;
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_RUNT_CNT(port->id));
++	port->stats.rx_len[i] += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_E64_CNT_H(port->id));
++	port->stats.rx_len[i] += ((u64)val << 32);
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_E64_CNT_L(port->id));
++	port->stats.rx_len[i++] += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L64_CNT_H(port->id));
++	port->stats.rx_len[i] += ((u64)val << 32);
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L64_CNT_L(port->id));
++	port->stats.rx_len[i++] += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L127_CNT_H(port->id));
++	port->stats.rx_len[i] += ((u64)val << 32);
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L127_CNT_L(port->id));
++	port->stats.rx_len[i++] += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L255_CNT_H(port->id));
++	port->stats.rx_len[i] += ((u64)val << 32);
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L255_CNT_L(port->id));
++	port->stats.rx_len[i++] += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L511_CNT_H(port->id));
++	port->stats.rx_len[i] += ((u64)val << 32);
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L511_CNT_L(port->id));
++	port->stats.rx_len[i++] += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L1023_CNT_H(port->id));
++	port->stats.rx_len[i] += ((u64)val << 32);
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L1023_CNT_L(port->id));
++	port->stats.rx_len[i++] += val;
++
++	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_LONG_CNT(port->id));
++	port->stats.rx_len[i++] += val;
++
++	/* reset mib counters */
++	airoha_fe_set(eth, REG_FE_GDM_MIB_CLEAR(port->id),
++		      FE_GDM_MIB_RX_CLEAR_MASK | FE_GDM_MIB_TX_CLEAR_MASK);
++
++	u64_stats_update_end(&port->stats.syncp);
++	spin_unlock(&port->stats.lock);
++}
++
++static int airoha_dev_open(struct net_device *dev)
++{
++	struct airoha_gdm_port *port = netdev_priv(dev);
++	struct airoha_qdma *qdma = port->qdma;
++	int err;
++
++	netif_tx_start_all_queues(dev);
++	err = airoha_set_gdm_ports(qdma->eth, true);
++	if (err)
++		return err;
++
++	if (netdev_uses_dsa(dev))
++		airoha_fe_set(qdma->eth, REG_GDM_INGRESS_CFG(port->id),
++			      GDM_STAG_EN_MASK);
++	else
++		airoha_fe_clear(qdma->eth, REG_GDM_INGRESS_CFG(port->id),
++				GDM_STAG_EN_MASK);
++
++	airoha_qdma_set(qdma, REG_QDMA_GLOBAL_CFG,
++			GLOBAL_CFG_TX_DMA_EN_MASK |
++			GLOBAL_CFG_RX_DMA_EN_MASK);
++
++	return 0;
++}
++
++static int airoha_dev_stop(struct net_device *dev)
++{
++	struct airoha_gdm_port *port = netdev_priv(dev);
++	struct airoha_qdma *qdma = port->qdma;
++	int i, err;
++
++	netif_tx_disable(dev);
++	err = airoha_set_gdm_ports(qdma->eth, false);
++	if (err)
++		return err;
++
++	airoha_qdma_clear(qdma, REG_QDMA_GLOBAL_CFG,
++			  GLOBAL_CFG_TX_DMA_EN_MASK |
++			  GLOBAL_CFG_RX_DMA_EN_MASK);
++
++	for (i = 0; i < ARRAY_SIZE(qdma->q_tx); i++) {
++		if (!qdma->q_tx[i].ndesc)
++			continue;
++
++		airoha_qdma_cleanup_tx_queue(&qdma->q_tx[i]);
++		netdev_tx_reset_subqueue(dev, i);
++	}
++
++	return 0;
++}
++
++static int airoha_dev_set_macaddr(struct net_device *dev, void *p)
++{
++	struct airoha_gdm_port *port = netdev_priv(dev);
++	int err;
++
++	err = eth_mac_addr(dev, p);
++	if (err)
++		return err;
++
++	airoha_set_macaddr(port, dev->dev_addr);
++
++	return 0;
++}
++
++static int airoha_dev_init(struct net_device *dev)
++{
++	struct airoha_gdm_port *port = netdev_priv(dev);
++
++	airoha_set_macaddr(port, dev->dev_addr);
++
++	return 0;
++}
++
++static void airoha_dev_get_stats64(struct net_device *dev,
++				   struct rtnl_link_stats64 *storage)
++{
++	struct airoha_gdm_port *port = netdev_priv(dev);
++	unsigned int start;
++
++	airoha_update_hw_stats(port);
++	do {
++		start = u64_stats_fetch_begin(&port->stats.syncp);
++		storage->rx_packets = port->stats.rx_ok_pkts;
++		storage->tx_packets = port->stats.tx_ok_pkts;
++		storage->rx_bytes = port->stats.rx_ok_bytes;
++		storage->tx_bytes = port->stats.tx_ok_bytes;
++		storage->multicast = port->stats.rx_multicast;
++		storage->rx_errors = port->stats.rx_errors;
++		storage->rx_dropped = port->stats.rx_drops;
++		storage->tx_dropped = port->stats.tx_drops;
++		storage->rx_crc_errors = port->stats.rx_crc_error;
++		storage->rx_over_errors = port->stats.rx_over_errors;
++	} while (u64_stats_fetch_retry(&port->stats.syncp, start));
++}
++
++static u16 airoha_dev_select_queue(struct net_device *dev, struct sk_buff *skb,
++				   struct net_device *sb_dev)
++{
++	struct airoha_gdm_port *port = netdev_priv(dev);
++	int queue, channel;
++
++	/* For dsa device select QoS channel according to the dsa user port
++	 * index, rely on port id otherwise. Select QoS queue based on the
++	 * skb priority.
++	 */
++	channel = netdev_uses_dsa(dev) ? skb_get_queue_mapping(skb) : port->id;
++	channel = channel % AIROHA_NUM_QOS_CHANNELS;
++	queue = (skb->priority - 1) % AIROHA_NUM_QOS_QUEUES; /* QoS queue */
++	queue = channel * AIROHA_NUM_QOS_QUEUES + queue;
++
++	return queue < dev->num_tx_queues ? queue : 0;
++}
++
++static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb,
++				   struct net_device *dev)
++{
++	struct airoha_gdm_port *port = netdev_priv(dev);
++	u32 nr_frags = 1 + skb_shinfo(skb)->nr_frags;
++	u32 msg0, msg1, len = skb_headlen(skb);
++	struct airoha_qdma *qdma = port->qdma;
++	struct netdev_queue *txq;
++	struct airoha_queue *q;
++	void *data = skb->data;
++	int i, qid;
++	u16 index;
++	u8 fport;
++
++	qid = skb_get_queue_mapping(skb) % ARRAY_SIZE(qdma->q_tx);
++	msg0 = FIELD_PREP(QDMA_ETH_TXMSG_CHAN_MASK,
++			  qid / AIROHA_NUM_QOS_QUEUES) |
++	       FIELD_PREP(QDMA_ETH_TXMSG_QUEUE_MASK,
++			  qid % AIROHA_NUM_QOS_QUEUES);
++	if (skb->ip_summed == CHECKSUM_PARTIAL)
++		msg0 |= FIELD_PREP(QDMA_ETH_TXMSG_TCO_MASK, 1) |
++			FIELD_PREP(QDMA_ETH_TXMSG_UCO_MASK, 1) |
++			FIELD_PREP(QDMA_ETH_TXMSG_ICO_MASK, 1);
++
++	/* TSO: fill MSS info in tcp checksum field */
++	if (skb_is_gso(skb)) {
++		if (skb_cow_head(skb, 0))
++			goto error;
++
++		if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 |
++						 SKB_GSO_TCPV6)) {
++			__be16 csum = cpu_to_be16(skb_shinfo(skb)->gso_size);
++
++			tcp_hdr(skb)->check = (__force __sum16)csum;
++			msg0 |= FIELD_PREP(QDMA_ETH_TXMSG_TSO_MASK, 1);
++		}
++	}
++
++	fport = port->id == 4 ? FE_PSE_PORT_GDM4 : port->id;
++	msg1 = FIELD_PREP(QDMA_ETH_TXMSG_FPORT_MASK, fport) |
++	       FIELD_PREP(QDMA_ETH_TXMSG_METER_MASK, 0x7f);
++
++	q = &qdma->q_tx[qid];
++	if (WARN_ON_ONCE(!q->ndesc))
++		goto error;
++
++	spin_lock_bh(&q->lock);
++
++	txq = netdev_get_tx_queue(dev, qid);
++	if (q->queued + nr_frags > q->ndesc) {
++		/* not enough space in the queue */
++		netif_tx_stop_queue(txq);
++		spin_unlock_bh(&q->lock);
++		return NETDEV_TX_BUSY;
++	}
++
++	index = q->head;
++	for (i = 0; i < nr_frags; i++) {
++		struct airoha_qdma_desc *desc = &q->desc[index];
++		struct airoha_queue_entry *e = &q->entry[index];
++		skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
++		dma_addr_t addr;
++		u32 val;
++
++		addr = dma_map_single(dev->dev.parent, data, len,
++				      DMA_TO_DEVICE);
++		if (unlikely(dma_mapping_error(dev->dev.parent, addr)))
++			goto error_unmap;
++
++		index = (index + 1) % q->ndesc;
++
++		val = FIELD_PREP(QDMA_DESC_LEN_MASK, len);
++		if (i < nr_frags - 1)
++			val |= FIELD_PREP(QDMA_DESC_MORE_MASK, 1);
++		WRITE_ONCE(desc->ctrl, cpu_to_le32(val));
++		WRITE_ONCE(desc->addr, cpu_to_le32(addr));
++		val = FIELD_PREP(QDMA_DESC_NEXT_ID_MASK, index);
++		WRITE_ONCE(desc->data, cpu_to_le32(val));
++		WRITE_ONCE(desc->msg0, cpu_to_le32(msg0));
++		WRITE_ONCE(desc->msg1, cpu_to_le32(msg1));
++		WRITE_ONCE(desc->msg2, cpu_to_le32(0xffff));
++
++		e->skb = i ? NULL : skb;
++		e->dma_addr = addr;
++		e->dma_len = len;
++
++		data = skb_frag_address(frag);
++		len = skb_frag_size(frag);
++	}
++
++	q->head = index;
++	q->queued += i;
++
++	skb_tx_timestamp(skb);
++	netdev_tx_sent_queue(txq, skb->len);
++
++	if (netif_xmit_stopped(txq) || !netdev_xmit_more())
++		airoha_qdma_rmw(qdma, REG_TX_CPU_IDX(qid),
++				TX_RING_CPU_IDX_MASK,
++				FIELD_PREP(TX_RING_CPU_IDX_MASK, q->head));
++
++	if (q->ndesc - q->queued < q->free_thr)
++		netif_tx_stop_queue(txq);
++
++	spin_unlock_bh(&q->lock);
++
++	return NETDEV_TX_OK;
++
++error_unmap:
++	for (i--; i >= 0; i--) {
++		index = (q->head + i) % q->ndesc;
++		dma_unmap_single(dev->dev.parent, q->entry[index].dma_addr,
++				 q->entry[index].dma_len, DMA_TO_DEVICE);
++	}
++
++	spin_unlock_bh(&q->lock);
++error:
++	dev_kfree_skb_any(skb);
++	dev->stats.tx_dropped++;
++
++	return NETDEV_TX_OK;
++}
++
++static void airoha_ethtool_get_drvinfo(struct net_device *dev,
++				       struct ethtool_drvinfo *info)
++{
++	struct airoha_gdm_port *port = netdev_priv(dev);
++	struct airoha_eth *eth = port->qdma->eth;
++
++	strscpy(info->driver, eth->dev->driver->name, sizeof(info->driver));
++	strscpy(info->bus_info, dev_name(eth->dev), sizeof(info->bus_info));
++}
++
++static void airoha_ethtool_get_mac_stats(struct net_device *dev,
++					 struct ethtool_eth_mac_stats *stats)
++{
++	struct airoha_gdm_port *port = netdev_priv(dev);
++	unsigned int start;
++
++	airoha_update_hw_stats(port);
++	do {
++		start = u64_stats_fetch_begin(&port->stats.syncp);
++		stats->MulticastFramesXmittedOK = port->stats.tx_multicast;
++		stats->BroadcastFramesXmittedOK = port->stats.tx_broadcast;
++		stats->BroadcastFramesReceivedOK = port->stats.rx_broadcast;
++	} while (u64_stats_fetch_retry(&port->stats.syncp, start));
++}
++
++static const struct ethtool_rmon_hist_range airoha_ethtool_rmon_ranges[] = {
++	{    0,    64 },
++	{   65,   127 },
++	{  128,   255 },
++	{  256,   511 },
++	{  512,  1023 },
++	{ 1024,  1518 },
++	{ 1519, 10239 },
++	{},
++};
++
++static void
++airoha_ethtool_get_rmon_stats(struct net_device *dev,
++			      struct ethtool_rmon_stats *stats,
++			      const struct ethtool_rmon_hist_range **ranges)
++{
++	struct airoha_gdm_port *port = netdev_priv(dev);
++	struct airoha_hw_stats *hw_stats = &port->stats;
++	unsigned int start;
++
++	BUILD_BUG_ON(ARRAY_SIZE(airoha_ethtool_rmon_ranges) !=
++		     ARRAY_SIZE(hw_stats->tx_len) + 1);
++	BUILD_BUG_ON(ARRAY_SIZE(airoha_ethtool_rmon_ranges) !=
++		     ARRAY_SIZE(hw_stats->rx_len) + 1);
++
++	*ranges = airoha_ethtool_rmon_ranges;
++	airoha_update_hw_stats(port);
++	do {
++		int i;
++
++		start = u64_stats_fetch_begin(&port->stats.syncp);
++		stats->fragments = hw_stats->rx_fragment;
++		stats->jabbers = hw_stats->rx_jabber;
++		for (i = 0; i < ARRAY_SIZE(airoha_ethtool_rmon_ranges) - 1;
++		     i++) {
++			stats->hist[i] = hw_stats->rx_len[i];
++			stats->hist_tx[i] = hw_stats->tx_len[i];
++		}
++	} while (u64_stats_fetch_retry(&port->stats.syncp, start));
++}
++
++static int airoha_qdma_set_chan_tx_sched(struct airoha_gdm_port *port,
++					 int channel, enum tx_sched_mode mode,
++					 const u16 *weights, u8 n_weights)
++{
++	int i;
++
++	for (i = 0; i < AIROHA_NUM_TX_RING; i++)
++		airoha_qdma_clear(port->qdma, REG_QUEUE_CLOSE_CFG(channel),
++				  TXQ_DISABLE_CHAN_QUEUE_MASK(channel, i));
++
++	for (i = 0; i < n_weights; i++) {
++		u32 status;
++		int err;
++
++		airoha_qdma_wr(port->qdma, REG_TXWRR_WEIGHT_CFG,
++			       TWRR_RW_CMD_MASK |
++			       FIELD_PREP(TWRR_CHAN_IDX_MASK, channel) |
++			       FIELD_PREP(TWRR_QUEUE_IDX_MASK, i) |
++			       FIELD_PREP(TWRR_VALUE_MASK, weights[i]));
++		err = read_poll_timeout(airoha_qdma_rr, status,
++					status & TWRR_RW_CMD_DONE,
++					USEC_PER_MSEC, 10 * USEC_PER_MSEC,
++					true, port->qdma,
++					REG_TXWRR_WEIGHT_CFG);
++		if (err)
++			return err;
++	}
++
++	airoha_qdma_rmw(port->qdma, REG_CHAN_QOS_MODE(channel >> 3),
++			CHAN_QOS_MODE_MASK(channel),
++			mode << __ffs(CHAN_QOS_MODE_MASK(channel)));
++
++	return 0;
++}
++
++static int airoha_qdma_set_tx_prio_sched(struct airoha_gdm_port *port,
++					 int channel)
++{
++	static const u16 w[AIROHA_NUM_QOS_QUEUES] = {};
++
++	return airoha_qdma_set_chan_tx_sched(port, channel, TC_SCH_SP, w,
++					     ARRAY_SIZE(w));
++}
++
++static int airoha_qdma_set_tx_ets_sched(struct airoha_gdm_port *port,
++					int channel,
++					struct tc_ets_qopt_offload *opt)
++{
++	struct tc_ets_qopt_offload_replace_params *p = &opt->replace_params;
++	enum tx_sched_mode mode = TC_SCH_SP;
++	u16 w[AIROHA_NUM_QOS_QUEUES] = {};
++	int i, nstrict = 0, nwrr, qidx;
++
++	if (p->bands > AIROHA_NUM_QOS_QUEUES)
++		return -EINVAL;
++
++	for (i = 0; i < p->bands; i++) {
++		if (!p->quanta[i])
++			nstrict++;
++	}
++
++	/* this configuration is not supported by the hw */
++	if (nstrict == AIROHA_NUM_QOS_QUEUES - 1)
++		return -EINVAL;
++
++	/* EN7581 SoC supports fixed QoS band priority where WRR queues have
++	 * lowest priorities with respect to SP ones.
++	 * e.g: WRR0, WRR1, .., WRRm, SP0, SP1, .., SPn
++	 */
++	nwrr = p->bands - nstrict;
++	qidx = nstrict && nwrr ? nstrict : 0;
++	for (i = 1; i <= p->bands; i++) {
++		if (p->priomap[i % AIROHA_NUM_QOS_QUEUES] != qidx)
++			return -EINVAL;
++
++		qidx = i == nwrr ? 0 : qidx + 1;
++	}
++
++	for (i = 0; i < nwrr; i++)
++		w[i] = p->weights[nstrict + i];
++
++	if (!nstrict)
++		mode = TC_SCH_WRR8;
++	else if (nstrict < AIROHA_NUM_QOS_QUEUES - 1)
++		mode = nstrict + 1;
++
++	return airoha_qdma_set_chan_tx_sched(port, channel, mode, w,
++					     ARRAY_SIZE(w));
++}
++
++static int airoha_qdma_get_tx_ets_stats(struct airoha_gdm_port *port,
++					int channel,
++					struct tc_ets_qopt_offload *opt)
++{
++	u64 cpu_tx_packets = airoha_qdma_rr(port->qdma,
++					    REG_CNTR_VAL(channel << 1));
++	u64 fwd_tx_packets = airoha_qdma_rr(port->qdma,
++					    REG_CNTR_VAL((channel << 1) + 1));
++	u64 tx_packets = (cpu_tx_packets - port->cpu_tx_packets) +
++			 (fwd_tx_packets - port->fwd_tx_packets);
++	_bstats_update(opt->stats.bstats, 0, tx_packets);
++
++	port->cpu_tx_packets = cpu_tx_packets;
++	port->fwd_tx_packets = fwd_tx_packets;
++
++	return 0;
++}
++
++static int airoha_tc_setup_qdisc_ets(struct airoha_gdm_port *port,
++				     struct tc_ets_qopt_offload *opt)
++{
++	int channel = TC_H_MAJ(opt->handle) >> 16;
++
++	if (opt->parent == TC_H_ROOT)
++		return -EINVAL;
++
++	switch (opt->command) {
++	case TC_ETS_REPLACE:
++		return airoha_qdma_set_tx_ets_sched(port, channel, opt);
++	case TC_ETS_DESTROY:
++		/* PRIO is default qdisc scheduler */
++		return airoha_qdma_set_tx_prio_sched(port, channel);
++	case TC_ETS_STATS:
++		return airoha_qdma_get_tx_ets_stats(port, channel, opt);
++	default:
++		return -EOPNOTSUPP;
++	}
++}
++
++static int airoha_qdma_get_trtcm_param(struct airoha_qdma *qdma, int channel,
++				       u32 addr, enum trtcm_param_type param,
++				       enum trtcm_mode_type mode,
++				       u32 *val_low, u32 *val_high)
++{
++	u32 idx = QDMA_METER_IDX(channel), group = QDMA_METER_GROUP(channel);
++	u32 val, config = FIELD_PREP(TRTCM_PARAM_TYPE_MASK, param) |
++			  FIELD_PREP(TRTCM_METER_GROUP_MASK, group) |
++			  FIELD_PREP(TRTCM_PARAM_INDEX_MASK, idx) |
++			  FIELD_PREP(TRTCM_PARAM_RATE_TYPE_MASK, mode);
++
++	airoha_qdma_wr(qdma, REG_TRTCM_CFG_PARAM(addr), config);
++	if (read_poll_timeout(airoha_qdma_rr, val,
++			      val & TRTCM_PARAM_RW_DONE_MASK,
++			      USEC_PER_MSEC, 10 * USEC_PER_MSEC, true,
++			      qdma, REG_TRTCM_CFG_PARAM(addr)))
++		return -ETIMEDOUT;
++
++	*val_low = airoha_qdma_rr(qdma, REG_TRTCM_DATA_LOW(addr));
++	if (val_high)
++		*val_high = airoha_qdma_rr(qdma, REG_TRTCM_DATA_HIGH(addr));
++
++	return 0;
++}
++
++static int airoha_qdma_set_trtcm_param(struct airoha_qdma *qdma, int channel,
++				       u32 addr, enum trtcm_param_type param,
++				       enum trtcm_mode_type mode, u32 val)
++{
++	u32 idx = QDMA_METER_IDX(channel), group = QDMA_METER_GROUP(channel);
++	u32 config = TRTCM_PARAM_RW_MASK |
++		     FIELD_PREP(TRTCM_PARAM_TYPE_MASK, param) |
++		     FIELD_PREP(TRTCM_METER_GROUP_MASK, group) |
++		     FIELD_PREP(TRTCM_PARAM_INDEX_MASK, idx) |
++		     FIELD_PREP(TRTCM_PARAM_RATE_TYPE_MASK, mode);
++
++	airoha_qdma_wr(qdma, REG_TRTCM_DATA_LOW(addr), val);
++	airoha_qdma_wr(qdma, REG_TRTCM_CFG_PARAM(addr), config);
++
++	return read_poll_timeout(airoha_qdma_rr, val,
++				 val & TRTCM_PARAM_RW_DONE_MASK,
++				 USEC_PER_MSEC, 10 * USEC_PER_MSEC, true,
++				 qdma, REG_TRTCM_CFG_PARAM(addr));
++}
++
++static int airoha_qdma_set_trtcm_config(struct airoha_qdma *qdma, int channel,
++					u32 addr, enum trtcm_mode_type mode,
++					bool enable, u32 enable_mask)
++{
++	u32 val;
++
++	if (airoha_qdma_get_trtcm_param(qdma, channel, addr, TRTCM_MISC_MODE,
++					mode, &val, NULL))
++		return -EINVAL;
++
++	val = enable ? val | enable_mask : val & ~enable_mask;
++
++	return airoha_qdma_set_trtcm_param(qdma, channel, addr, TRTCM_MISC_MODE,
++					   mode, val);
++}
++
++static int airoha_qdma_set_trtcm_token_bucket(struct airoha_qdma *qdma,
++					      int channel, u32 addr,
++					      enum trtcm_mode_type mode,
++					      u32 rate_val, u32 bucket_size)
++{
++	u32 val, config, tick, unit, rate, rate_frac;
++	int err;
++
++	if (airoha_qdma_get_trtcm_param(qdma, channel, addr, TRTCM_MISC_MODE,
++					mode, &config, NULL))
++		return -EINVAL;
++
++	val = airoha_qdma_rr(qdma, addr);
++	tick = FIELD_GET(INGRESS_FAST_TICK_MASK, val);
++	if (config & TRTCM_TICK_SEL)
++		tick *= FIELD_GET(INGRESS_SLOW_TICK_RATIO_MASK, val);
++	if (!tick)
++		return -EINVAL;
++
++	unit = (config & TRTCM_PKT_MODE) ? 1000000 / tick : 8000 / tick;
++	if (!unit)
++		return -EINVAL;
++
++	rate = rate_val / unit;
++	rate_frac = rate_val % unit;
++	rate_frac = FIELD_PREP(TRTCM_TOKEN_RATE_MASK, rate_frac) / unit;
++	rate = FIELD_PREP(TRTCM_TOKEN_RATE_MASK, rate) |
++	       FIELD_PREP(TRTCM_TOKEN_RATE_FRACTION_MASK, rate_frac);
++
++	err = airoha_qdma_set_trtcm_param(qdma, channel, addr,
++					  TRTCM_TOKEN_RATE_MODE, mode, rate);
++	if (err)
++		return err;
++
++	val = max_t(u32, bucket_size, MIN_TOKEN_SIZE);
++	val = min_t(u32, __fls(val), MAX_TOKEN_SIZE_OFFSET);
++
++	return airoha_qdma_set_trtcm_param(qdma, channel, addr,
++					   TRTCM_BUCKETSIZE_SHIFT_MODE,
++					   mode, val);
++}
++
++static int airoha_qdma_set_tx_rate_limit(struct airoha_gdm_port *port,
++					 int channel, u32 rate,
++					 u32 bucket_size)
++{
++	int i, err;
++
++	for (i = 0; i <= TRTCM_PEAK_MODE; i++) {
++		err = airoha_qdma_set_trtcm_config(port->qdma, channel,
++						   REG_EGRESS_TRTCM_CFG, i,
++						   !!rate, TRTCM_METER_MODE);
++		if (err)
++			return err;
++
++		err = airoha_qdma_set_trtcm_token_bucket(port->qdma, channel,
++							 REG_EGRESS_TRTCM_CFG,
++							 i, rate, bucket_size);
++		if (err)
++			return err;
++	}
++
++	return 0;
++}
++
++static int airoha_tc_htb_alloc_leaf_queue(struct airoha_gdm_port *port,
++					  struct tc_htb_qopt_offload *opt)
++{
++	u32 channel = TC_H_MIN(opt->classid) % AIROHA_NUM_QOS_CHANNELS;
++	u32 rate = div_u64(opt->rate, 1000) << 3; /* kbps */
++	struct net_device *dev = port->dev;
++	int num_tx_queues = dev->real_num_tx_queues;
++	int err;
++
++	if (opt->parent_classid != TC_HTB_CLASSID_ROOT) {
++		NL_SET_ERR_MSG_MOD(opt->extack, "invalid parent classid");
++		return -EINVAL;
++	}
++
++	err = airoha_qdma_set_tx_rate_limit(port, channel, rate, opt->quantum);
++	if (err) {
++		NL_SET_ERR_MSG_MOD(opt->extack,
++				   "failed configuring htb offload");
++		return err;
++	}
++
++	if (opt->command == TC_HTB_NODE_MODIFY)
++		return 0;
++
++	err = netif_set_real_num_tx_queues(dev, num_tx_queues + 1);
++	if (err) {
++		airoha_qdma_set_tx_rate_limit(port, channel, 0, opt->quantum);
++		NL_SET_ERR_MSG_MOD(opt->extack,
++				   "failed setting real_num_tx_queues");
++		return err;
++	}
++
++	set_bit(channel, port->qos_sq_bmap);
++	opt->qid = AIROHA_NUM_TX_RING + channel;
++
++	return 0;
++}
++
++static void airoha_tc_remove_htb_queue(struct airoha_gdm_port *port, int queue)
++{
++	struct net_device *dev = port->dev;
++
++	netif_set_real_num_tx_queues(dev, dev->real_num_tx_queues - 1);
++	airoha_qdma_set_tx_rate_limit(port, queue + 1, 0, 0);
++	clear_bit(queue, port->qos_sq_bmap);
++}
++
++static int airoha_tc_htb_delete_leaf_queue(struct airoha_gdm_port *port,
++					   struct tc_htb_qopt_offload *opt)
++{
++	u32 channel = TC_H_MIN(opt->classid) % AIROHA_NUM_QOS_CHANNELS;
++
++	if (!test_bit(channel, port->qos_sq_bmap)) {
++		NL_SET_ERR_MSG_MOD(opt->extack, "invalid queue id");
++		return -EINVAL;
++	}
++
++	airoha_tc_remove_htb_queue(port, channel);
++
++	return 0;
++}
++
++static int airoha_tc_htb_destroy(struct airoha_gdm_port *port)
++{
++	int q;
++
++	for_each_set_bit(q, port->qos_sq_bmap, AIROHA_NUM_QOS_CHANNELS)
++		airoha_tc_remove_htb_queue(port, q);
++
++	return 0;
++}
++
++static int airoha_tc_get_htb_get_leaf_queue(struct airoha_gdm_port *port,
++					    struct tc_htb_qopt_offload *opt)
++{
++	u32 channel = TC_H_MIN(opt->classid) % AIROHA_NUM_QOS_CHANNELS;
++
++	if (!test_bit(channel, port->qos_sq_bmap)) {
++		NL_SET_ERR_MSG_MOD(opt->extack, "invalid queue id");
++		return -EINVAL;
++	}
++
++	opt->qid = channel;
++
++	return 0;
++}
++
++static int airoha_tc_setup_qdisc_htb(struct airoha_gdm_port *port,
++				     struct tc_htb_qopt_offload *opt)
++{
++	switch (opt->command) {
++	case TC_HTB_CREATE:
++		break;
++	case TC_HTB_DESTROY:
++		return airoha_tc_htb_destroy(port);
++	case TC_HTB_NODE_MODIFY:
++	case TC_HTB_LEAF_ALLOC_QUEUE:
++		return airoha_tc_htb_alloc_leaf_queue(port, opt);
++	case TC_HTB_LEAF_DEL:
++	case TC_HTB_LEAF_DEL_LAST:
++	case TC_HTB_LEAF_DEL_LAST_FORCE:
++		return airoha_tc_htb_delete_leaf_queue(port, opt);
++	case TC_HTB_LEAF_QUERY_QUEUE:
++		return airoha_tc_get_htb_get_leaf_queue(port, opt);
++	default:
++		return -EOPNOTSUPP;
++	}
++
++	return 0;
++}
++
++static int airoha_dev_tc_setup(struct net_device *dev, enum tc_setup_type type,
++			       void *type_data)
++{
++	struct airoha_gdm_port *port = netdev_priv(dev);
++
++	switch (type) {
++	case TC_SETUP_QDISC_ETS:
++		return airoha_tc_setup_qdisc_ets(port, type_data);
++	case TC_SETUP_QDISC_HTB:
++		return airoha_tc_setup_qdisc_htb(port, type_data);
++	default:
++		return -EOPNOTSUPP;
++	}
++}
++
++static const struct net_device_ops airoha_netdev_ops = {
++	.ndo_init		= airoha_dev_init,
++	.ndo_open		= airoha_dev_open,
++	.ndo_stop		= airoha_dev_stop,
++	.ndo_select_queue	= airoha_dev_select_queue,
++	.ndo_start_xmit		= airoha_dev_xmit,
++	.ndo_get_stats64        = airoha_dev_get_stats64,
++	.ndo_set_mac_address	= airoha_dev_set_macaddr,
++	.ndo_setup_tc		= airoha_dev_tc_setup,
++};
++
++static const struct ethtool_ops airoha_ethtool_ops = {
++	.get_drvinfo		= airoha_ethtool_get_drvinfo,
++	.get_eth_mac_stats      = airoha_ethtool_get_mac_stats,
++	.get_rmon_stats		= airoha_ethtool_get_rmon_stats,
++};
++
++static int airoha_alloc_gdm_port(struct airoha_eth *eth, struct device_node *np)
++{
++	const __be32 *id_ptr = of_get_property(np, "reg", NULL);
++	struct airoha_gdm_port *port;
++	struct airoha_qdma *qdma;
++	struct net_device *dev;
++	int err, index;
++	u32 id;
++
++	if (!id_ptr) {
++		dev_err(eth->dev, "missing gdm port id\n");
++		return -EINVAL;
++	}
++
++	id = be32_to_cpup(id_ptr);
++	index = id - 1;
++
++	if (!id || id > ARRAY_SIZE(eth->ports)) {
++		dev_err(eth->dev, "invalid gdm port id: %d\n", id);
++		return -EINVAL;
++	}
++
++	if (eth->ports[index]) {
++		dev_err(eth->dev, "duplicate gdm port id: %d\n", id);
++		return -EINVAL;
++	}
++
++	dev = devm_alloc_etherdev_mqs(eth->dev, sizeof(*port),
++				      AIROHA_NUM_NETDEV_TX_RINGS,
++				      AIROHA_NUM_RX_RING);
++	if (!dev) {
++		dev_err(eth->dev, "alloc_etherdev failed\n");
++		return -ENOMEM;
++	}
++
++	qdma = &eth->qdma[index % AIROHA_MAX_NUM_QDMA];
++	dev->netdev_ops = &airoha_netdev_ops;
++	dev->ethtool_ops = &airoha_ethtool_ops;
++	dev->max_mtu = AIROHA_MAX_MTU;
++	dev->watchdog_timeo = 5 * HZ;
++	dev->hw_features = NETIF_F_IP_CSUM | NETIF_F_RXCSUM |
++			   NETIF_F_TSO6 | NETIF_F_IPV6_CSUM |
++			   NETIF_F_SG | NETIF_F_TSO |
++			   NETIF_F_HW_TC;
++	dev->features |= dev->hw_features;
++	dev->dev.of_node = np;
++	dev->irq = qdma->irq;
++	SET_NETDEV_DEV(dev, eth->dev);
++
++	/* reserve hw queues for HTB offloading */
++	err = netif_set_real_num_tx_queues(dev, AIROHA_NUM_TX_RING);
++	if (err)
++		return err;
++
++	err = of_get_ethdev_address(np, dev);
++	if (err) {
++		if (err == -EPROBE_DEFER)
++			return err;
++
++		eth_hw_addr_random(dev);
++		dev_info(eth->dev, "generated random MAC address %pM\n",
++			 dev->dev_addr);
++	}
++
++	port = netdev_priv(dev);
++	u64_stats_init(&port->stats.syncp);
++	spin_lock_init(&port->stats.lock);
++	port->qdma = qdma;
++	port->dev = dev;
++	port->id = id;
++	eth->ports[index] = port;
++
++	return register_netdev(dev);
++}
++
++static int airoha_probe(struct platform_device *pdev)
++{
++	struct device_node *np;
++	struct airoha_eth *eth;
++	int i, err;
++
++	eth = devm_kzalloc(&pdev->dev, sizeof(*eth), GFP_KERNEL);
++	if (!eth)
++		return -ENOMEM;
++
++	eth->dev = &pdev->dev;
++
++	err = dma_set_mask_and_coherent(eth->dev, DMA_BIT_MASK(32));
++	if (err) {
++		dev_err(eth->dev, "failed configuring DMA mask\n");
++		return err;
++	}
++
++	eth->fe_regs = devm_platform_ioremap_resource_byname(pdev, "fe");
++	if (IS_ERR(eth->fe_regs))
++		return dev_err_probe(eth->dev, PTR_ERR(eth->fe_regs),
++				     "failed to iomap fe regs\n");
++
++	eth->rsts[0].id = "fe";
++	eth->rsts[1].id = "pdma";
++	eth->rsts[2].id = "qdma";
++	err = devm_reset_control_bulk_get_exclusive(eth->dev,
++						    ARRAY_SIZE(eth->rsts),
++						    eth->rsts);
++	if (err) {
++		dev_err(eth->dev, "failed to get bulk reset lines\n");
++		return err;
++	}
++
++	eth->xsi_rsts[0].id = "xsi-mac";
++	eth->xsi_rsts[1].id = "hsi0-mac";
++	eth->xsi_rsts[2].id = "hsi1-mac";
++	eth->xsi_rsts[3].id = "hsi-mac";
++	eth->xsi_rsts[4].id = "xfp-mac";
++	err = devm_reset_control_bulk_get_exclusive(eth->dev,
++						    ARRAY_SIZE(eth->xsi_rsts),
++						    eth->xsi_rsts);
++	if (err) {
++		dev_err(eth->dev, "failed to get bulk xsi reset lines\n");
++		return err;
++	}
++
++	eth->napi_dev = alloc_netdev_dummy(0);
++	if (!eth->napi_dev)
++		return -ENOMEM;
++
++	/* Enable threaded NAPI by default */
++	eth->napi_dev->threaded = true;
++	strscpy(eth->napi_dev->name, "qdma_eth", sizeof(eth->napi_dev->name));
++	platform_set_drvdata(pdev, eth);
++
++	err = airoha_hw_init(pdev, eth);
++	if (err)
++		goto error_hw_cleanup;
++
++	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)
++		airoha_qdma_start_napi(&eth->qdma[i]);
++
++	for_each_child_of_node(pdev->dev.of_node, np) {
++		if (!of_device_is_compatible(np, "airoha,eth-mac"))
++			continue;
++
++		if (!of_device_is_available(np))
++			continue;
++
++		err = airoha_alloc_gdm_port(eth, np);
++		if (err) {
++			of_node_put(np);
++			goto error_napi_stop;
++		}
++	}
++
++	return 0;
++
++error_napi_stop:
++	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)
++		airoha_qdma_stop_napi(&eth->qdma[i]);
++error_hw_cleanup:
++	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)
++		airoha_hw_cleanup(&eth->qdma[i]);
++
++	for (i = 0; i < ARRAY_SIZE(eth->ports); i++) {
++		struct airoha_gdm_port *port = eth->ports[i];
++
++		if (port && port->dev->reg_state == NETREG_REGISTERED)
++			unregister_netdev(port->dev);
++	}
++	free_netdev(eth->napi_dev);
++	platform_set_drvdata(pdev, NULL);
++
++	return err;
++}
++
++static void airoha_remove(struct platform_device *pdev)
++{
++	struct airoha_eth *eth = platform_get_drvdata(pdev);
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++) {
++		airoha_qdma_stop_napi(&eth->qdma[i]);
++		airoha_hw_cleanup(&eth->qdma[i]);
++	}
++
++	for (i = 0; i < ARRAY_SIZE(eth->ports); i++) {
++		struct airoha_gdm_port *port = eth->ports[i];
++
++		if (!port)
++			continue;
++
++		airoha_dev_stop(port->dev);
++		unregister_netdev(port->dev);
++	}
++	free_netdev(eth->napi_dev);
++
++	platform_set_drvdata(pdev, NULL);
++}
++
++static const struct of_device_id of_airoha_match[] = {
++	{ .compatible = "airoha,en7581-eth" },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, of_airoha_match);
++
++static struct platform_driver airoha_driver = {
++	.probe = airoha_probe,
++	.remove_new = airoha_remove,
++	.driver = {
++		.name = KBUILD_MODNAME,
++		.of_match_table = of_airoha_match,
++	},
++};
++module_platform_driver(airoha_driver);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Lorenzo Bianconi <lorenzo@kernel.org>");
++MODULE_DESCRIPTION("Ethernet driver for Airoha SoC");
+--- a/drivers/net/ethernet/mediatek/airoha_eth.c
++++ /dev/null
+@@ -1,3359 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0-only
+-/*
+- * Copyright (c) 2024 AIROHA Inc
+- * Author: Lorenzo Bianconi <lorenzo@kernel.org>
+- */
+-#include <linux/etherdevice.h>
+-#include <linux/iopoll.h>
+-#include <linux/kernel.h>
+-#include <linux/netdevice.h>
+-#include <linux/of.h>
+-#include <linux/of_net.h>
+-#include <linux/platform_device.h>
+-#include <linux/reset.h>
+-#include <linux/tcp.h>
+-#include <linux/u64_stats_sync.h>
+-#include <net/dsa.h>
+-#include <net/page_pool/helpers.h>
+-#include <net/pkt_cls.h>
+-#include <uapi/linux/ppp_defs.h>
+-
+-#define AIROHA_MAX_NUM_GDM_PORTS	1
+-#define AIROHA_MAX_NUM_QDMA		2
+-#define AIROHA_MAX_NUM_RSTS		3
+-#define AIROHA_MAX_NUM_XSI_RSTS		5
+-#define AIROHA_MAX_MTU			2000
+-#define AIROHA_MAX_PACKET_SIZE		2048
+-#define AIROHA_NUM_QOS_CHANNELS		4
+-#define AIROHA_NUM_QOS_QUEUES		8
+-#define AIROHA_NUM_TX_RING		32
+-#define AIROHA_NUM_RX_RING		32
+-#define AIROHA_NUM_NETDEV_TX_RINGS	(AIROHA_NUM_TX_RING + \
+-					 AIROHA_NUM_QOS_CHANNELS)
+-#define AIROHA_FE_MC_MAX_VLAN_TABLE	64
+-#define AIROHA_FE_MC_MAX_VLAN_PORT	16
+-#define AIROHA_NUM_TX_IRQ		2
+-#define HW_DSCP_NUM			2048
+-#define IRQ_QUEUE_LEN(_n)		((_n) ? 1024 : 2048)
+-#define TX_DSCP_NUM			1024
+-#define RX_DSCP_NUM(_n)			\
+-	((_n) ==  2 ? 128 :		\
+-	 (_n) == 11 ? 128 :		\
+-	 (_n) == 15 ? 128 :		\
+-	 (_n) ==  0 ? 1024 : 16)
+-
+-#define PSE_RSV_PAGES			128
+-#define PSE_QUEUE_RSV_PAGES		64
+-
+-#define QDMA_METER_IDX(_n)		((_n) & 0xff)
+-#define QDMA_METER_GROUP(_n)		(((_n) >> 8) & 0x3)
+-
+-/* FE */
+-#define PSE_BASE			0x0100
+-#define CSR_IFC_BASE			0x0200
+-#define CDM1_BASE			0x0400
+-#define GDM1_BASE			0x0500
+-#define PPE1_BASE			0x0c00
+-
+-#define CDM2_BASE			0x1400
+-#define GDM2_BASE			0x1500
+-
+-#define GDM3_BASE			0x1100
+-#define GDM4_BASE			0x2500
+-
+-#define GDM_BASE(_n)			\
+-	((_n) == 4 ? GDM4_BASE :	\
+-	 (_n) == 3 ? GDM3_BASE :	\
+-	 (_n) == 2 ? GDM2_BASE : GDM1_BASE)
+-
+-#define REG_FE_DMA_GLO_CFG		0x0000
+-#define FE_DMA_GLO_L2_SPACE_MASK	GENMASK(7, 4)
+-#define FE_DMA_GLO_PG_SZ_MASK		BIT(3)
+-
+-#define REG_FE_RST_GLO_CFG		0x0004
+-#define FE_RST_GDM4_MBI_ARB_MASK	BIT(3)
+-#define FE_RST_GDM3_MBI_ARB_MASK	BIT(2)
+-#define FE_RST_CORE_MASK		BIT(0)
+-
+-#define REG_FE_WAN_MAC_H		0x0030
+-#define REG_FE_LAN_MAC_H		0x0040
+-
+-#define REG_FE_MAC_LMIN(_n)		((_n) + 0x04)
+-#define REG_FE_MAC_LMAX(_n)		((_n) + 0x08)
+-
+-#define REG_FE_CDM1_OQ_MAP0		0x0050
+-#define REG_FE_CDM1_OQ_MAP1		0x0054
+-#define REG_FE_CDM1_OQ_MAP2		0x0058
+-#define REG_FE_CDM1_OQ_MAP3		0x005c
+-
+-#define REG_FE_PCE_CFG			0x0070
+-#define PCE_DPI_EN_MASK			BIT(2)
+-#define PCE_KA_EN_MASK			BIT(1)
+-#define PCE_MC_EN_MASK			BIT(0)
+-
+-#define REG_FE_PSE_QUEUE_CFG_WR		0x0080
+-#define PSE_CFG_PORT_ID_MASK		GENMASK(27, 24)
+-#define PSE_CFG_QUEUE_ID_MASK		GENMASK(20, 16)
+-#define PSE_CFG_WR_EN_MASK		BIT(8)
+-#define PSE_CFG_OQRSV_SEL_MASK		BIT(0)
+-
+-#define REG_FE_PSE_QUEUE_CFG_VAL	0x0084
+-#define PSE_CFG_OQ_RSV_MASK		GENMASK(13, 0)
+-
+-#define PSE_FQ_CFG			0x008c
+-#define PSE_FQ_LIMIT_MASK		GENMASK(14, 0)
+-
+-#define REG_FE_PSE_BUF_SET		0x0090
+-#define PSE_SHARE_USED_LTHD_MASK	GENMASK(31, 16)
+-#define PSE_ALLRSV_MASK			GENMASK(14, 0)
+-
+-#define REG_PSE_SHARE_USED_THD		0x0094
+-#define PSE_SHARE_USED_MTHD_MASK	GENMASK(31, 16)
+-#define PSE_SHARE_USED_HTHD_MASK	GENMASK(15, 0)
+-
+-#define REG_GDM_MISC_CFG		0x0148
+-#define GDM2_RDM_ACK_WAIT_PREF_MASK	BIT(9)
+-#define GDM2_CHN_VLD_MODE_MASK		BIT(5)
+-
+-#define REG_FE_CSR_IFC_CFG		CSR_IFC_BASE
+-#define FE_IFC_EN_MASK			BIT(0)
+-
+-#define REG_FE_VIP_PORT_EN		0x01f0
+-#define REG_FE_IFC_PORT_EN		0x01f4
+-
+-#define REG_PSE_IQ_REV1			(PSE_BASE + 0x08)
+-#define PSE_IQ_RES1_P2_MASK		GENMASK(23, 16)
+-
+-#define REG_PSE_IQ_REV2			(PSE_BASE + 0x0c)
+-#define PSE_IQ_RES2_P5_MASK		GENMASK(15, 8)
+-#define PSE_IQ_RES2_P4_MASK		GENMASK(7, 0)
+-
+-#define REG_FE_VIP_EN(_n)		(0x0300 + ((_n) << 3))
+-#define PATN_FCPU_EN_MASK		BIT(7)
+-#define PATN_SWP_EN_MASK		BIT(6)
+-#define PATN_DP_EN_MASK			BIT(5)
+-#define PATN_SP_EN_MASK			BIT(4)
+-#define PATN_TYPE_MASK			GENMASK(3, 1)
+-#define PATN_EN_MASK			BIT(0)
+-
+-#define REG_FE_VIP_PATN(_n)		(0x0304 + ((_n) << 3))
+-#define PATN_DP_MASK			GENMASK(31, 16)
+-#define PATN_SP_MASK			GENMASK(15, 0)
+-
+-#define REG_CDM1_VLAN_CTRL		CDM1_BASE
+-#define CDM1_VLAN_MASK			GENMASK(31, 16)
+-
+-#define REG_CDM1_FWD_CFG		(CDM1_BASE + 0x08)
+-#define CDM1_VIP_QSEL_MASK		GENMASK(24, 20)
+-
+-#define REG_CDM1_CRSN_QSEL(_n)		(CDM1_BASE + 0x10 + ((_n) << 2))
+-#define CDM1_CRSN_QSEL_REASON_MASK(_n)	\
+-	GENMASK(4 + (((_n) % 4) << 3),	(((_n) % 4) << 3))
+-
+-#define REG_CDM2_FWD_CFG		(CDM2_BASE + 0x08)
+-#define CDM2_OAM_QSEL_MASK		GENMASK(31, 27)
+-#define CDM2_VIP_QSEL_MASK		GENMASK(24, 20)
+-
+-#define REG_CDM2_CRSN_QSEL(_n)		(CDM2_BASE + 0x10 + ((_n) << 2))
+-#define CDM2_CRSN_QSEL_REASON_MASK(_n)	\
+-	GENMASK(4 + (((_n) % 4) << 3),	(((_n) % 4) << 3))
+-
+-#define REG_GDM_FWD_CFG(_n)		GDM_BASE(_n)
+-#define GDM_DROP_CRC_ERR		BIT(23)
+-#define GDM_IP4_CKSUM			BIT(22)
+-#define GDM_TCP_CKSUM			BIT(21)
+-#define GDM_UDP_CKSUM			BIT(20)
+-#define GDM_UCFQ_MASK			GENMASK(15, 12)
+-#define GDM_BCFQ_MASK			GENMASK(11, 8)
+-#define GDM_MCFQ_MASK			GENMASK(7, 4)
+-#define GDM_OCFQ_MASK			GENMASK(3, 0)
+-
+-#define REG_GDM_INGRESS_CFG(_n)		(GDM_BASE(_n) + 0x10)
+-#define GDM_INGRESS_FC_EN_MASK		BIT(1)
+-#define GDM_STAG_EN_MASK		BIT(0)
+-
+-#define REG_GDM_LEN_CFG(_n)		(GDM_BASE(_n) + 0x14)
+-#define GDM_SHORT_LEN_MASK		GENMASK(13, 0)
+-#define GDM_LONG_LEN_MASK		GENMASK(29, 16)
+-
+-#define REG_FE_CPORT_CFG		(GDM1_BASE + 0x40)
+-#define FE_CPORT_PAD			BIT(26)
+-#define FE_CPORT_PORT_XFC_MASK		BIT(25)
+-#define FE_CPORT_QUEUE_XFC_MASK		BIT(24)
+-
+-#define REG_FE_GDM_MIB_CLEAR(_n)	(GDM_BASE(_n) + 0xf0)
+-#define FE_GDM_MIB_RX_CLEAR_MASK	BIT(1)
+-#define FE_GDM_MIB_TX_CLEAR_MASK	BIT(0)
+-
+-#define REG_FE_GDM1_MIB_CFG		(GDM1_BASE + 0xf4)
+-#define FE_STRICT_RFC2819_MODE_MASK	BIT(31)
+-#define FE_GDM1_TX_MIB_SPLIT_EN_MASK	BIT(17)
+-#define FE_GDM1_RX_MIB_SPLIT_EN_MASK	BIT(16)
+-#define FE_TX_MIB_ID_MASK		GENMASK(15, 8)
+-#define FE_RX_MIB_ID_MASK		GENMASK(7, 0)
+-
+-#define REG_FE_GDM_TX_OK_PKT_CNT_L(_n)		(GDM_BASE(_n) + 0x104)
+-#define REG_FE_GDM_TX_OK_BYTE_CNT_L(_n)		(GDM_BASE(_n) + 0x10c)
+-#define REG_FE_GDM_TX_ETH_PKT_CNT_L(_n)		(GDM_BASE(_n) + 0x110)
+-#define REG_FE_GDM_TX_ETH_BYTE_CNT_L(_n)	(GDM_BASE(_n) + 0x114)
+-#define REG_FE_GDM_TX_ETH_DROP_CNT(_n)		(GDM_BASE(_n) + 0x118)
+-#define REG_FE_GDM_TX_ETH_BC_CNT(_n)		(GDM_BASE(_n) + 0x11c)
+-#define REG_FE_GDM_TX_ETH_MC_CNT(_n)		(GDM_BASE(_n) + 0x120)
+-#define REG_FE_GDM_TX_ETH_RUNT_CNT(_n)		(GDM_BASE(_n) + 0x124)
+-#define REG_FE_GDM_TX_ETH_LONG_CNT(_n)		(GDM_BASE(_n) + 0x128)
+-#define REG_FE_GDM_TX_ETH_E64_CNT_L(_n)		(GDM_BASE(_n) + 0x12c)
+-#define REG_FE_GDM_TX_ETH_L64_CNT_L(_n)		(GDM_BASE(_n) + 0x130)
+-#define REG_FE_GDM_TX_ETH_L127_CNT_L(_n)	(GDM_BASE(_n) + 0x134)
+-#define REG_FE_GDM_TX_ETH_L255_CNT_L(_n)	(GDM_BASE(_n) + 0x138)
+-#define REG_FE_GDM_TX_ETH_L511_CNT_L(_n)	(GDM_BASE(_n) + 0x13c)
+-#define REG_FE_GDM_TX_ETH_L1023_CNT_L(_n)	(GDM_BASE(_n) + 0x140)
+-
+-#define REG_FE_GDM_RX_OK_PKT_CNT_L(_n)		(GDM_BASE(_n) + 0x148)
+-#define REG_FE_GDM_RX_FC_DROP_CNT(_n)		(GDM_BASE(_n) + 0x14c)
+-#define REG_FE_GDM_RX_RC_DROP_CNT(_n)		(GDM_BASE(_n) + 0x150)
+-#define REG_FE_GDM_RX_OVERFLOW_DROP_CNT(_n)	(GDM_BASE(_n) + 0x154)
+-#define REG_FE_GDM_RX_ERROR_DROP_CNT(_n)	(GDM_BASE(_n) + 0x158)
+-#define REG_FE_GDM_RX_OK_BYTE_CNT_L(_n)		(GDM_BASE(_n) + 0x15c)
+-#define REG_FE_GDM_RX_ETH_PKT_CNT_L(_n)		(GDM_BASE(_n) + 0x160)
+-#define REG_FE_GDM_RX_ETH_BYTE_CNT_L(_n)	(GDM_BASE(_n) + 0x164)
+-#define REG_FE_GDM_RX_ETH_DROP_CNT(_n)		(GDM_BASE(_n) + 0x168)
+-#define REG_FE_GDM_RX_ETH_BC_CNT(_n)		(GDM_BASE(_n) + 0x16c)
+-#define REG_FE_GDM_RX_ETH_MC_CNT(_n)		(GDM_BASE(_n) + 0x170)
+-#define REG_FE_GDM_RX_ETH_CRC_ERR_CNT(_n)	(GDM_BASE(_n) + 0x174)
+-#define REG_FE_GDM_RX_ETH_FRAG_CNT(_n)		(GDM_BASE(_n) + 0x178)
+-#define REG_FE_GDM_RX_ETH_JABBER_CNT(_n)	(GDM_BASE(_n) + 0x17c)
+-#define REG_FE_GDM_RX_ETH_RUNT_CNT(_n)		(GDM_BASE(_n) + 0x180)
+-#define REG_FE_GDM_RX_ETH_LONG_CNT(_n)		(GDM_BASE(_n) + 0x184)
+-#define REG_FE_GDM_RX_ETH_E64_CNT_L(_n)		(GDM_BASE(_n) + 0x188)
+-#define REG_FE_GDM_RX_ETH_L64_CNT_L(_n)		(GDM_BASE(_n) + 0x18c)
+-#define REG_FE_GDM_RX_ETH_L127_CNT_L(_n)	(GDM_BASE(_n) + 0x190)
+-#define REG_FE_GDM_RX_ETH_L255_CNT_L(_n)	(GDM_BASE(_n) + 0x194)
+-#define REG_FE_GDM_RX_ETH_L511_CNT_L(_n)	(GDM_BASE(_n) + 0x198)
+-#define REG_FE_GDM_RX_ETH_L1023_CNT_L(_n)	(GDM_BASE(_n) + 0x19c)
+-
+-#define REG_PPE1_TB_HASH_CFG		(PPE1_BASE + 0x250)
+-#define PPE1_SRAM_TABLE_EN_MASK		BIT(0)
+-#define PPE1_SRAM_HASH1_EN_MASK		BIT(8)
+-#define PPE1_DRAM_TABLE_EN_MASK		BIT(16)
+-#define PPE1_DRAM_HASH1_EN_MASK		BIT(24)
+-
+-#define REG_FE_GDM_TX_OK_PKT_CNT_H(_n)		(GDM_BASE(_n) + 0x280)
+-#define REG_FE_GDM_TX_OK_BYTE_CNT_H(_n)		(GDM_BASE(_n) + 0x284)
+-#define REG_FE_GDM_TX_ETH_PKT_CNT_H(_n)		(GDM_BASE(_n) + 0x288)
+-#define REG_FE_GDM_TX_ETH_BYTE_CNT_H(_n)	(GDM_BASE(_n) + 0x28c)
+-
+-#define REG_FE_GDM_RX_OK_PKT_CNT_H(_n)		(GDM_BASE(_n) + 0x290)
+-#define REG_FE_GDM_RX_OK_BYTE_CNT_H(_n)		(GDM_BASE(_n) + 0x294)
+-#define REG_FE_GDM_RX_ETH_PKT_CNT_H(_n)		(GDM_BASE(_n) + 0x298)
+-#define REG_FE_GDM_RX_ETH_BYTE_CNT_H(_n)	(GDM_BASE(_n) + 0x29c)
+-#define REG_FE_GDM_TX_ETH_E64_CNT_H(_n)		(GDM_BASE(_n) + 0x2b8)
+-#define REG_FE_GDM_TX_ETH_L64_CNT_H(_n)		(GDM_BASE(_n) + 0x2bc)
+-#define REG_FE_GDM_TX_ETH_L127_CNT_H(_n)	(GDM_BASE(_n) + 0x2c0)
+-#define REG_FE_GDM_TX_ETH_L255_CNT_H(_n)	(GDM_BASE(_n) + 0x2c4)
+-#define REG_FE_GDM_TX_ETH_L511_CNT_H(_n)	(GDM_BASE(_n) + 0x2c8)
+-#define REG_FE_GDM_TX_ETH_L1023_CNT_H(_n)	(GDM_BASE(_n) + 0x2cc)
+-#define REG_FE_GDM_RX_ETH_E64_CNT_H(_n)		(GDM_BASE(_n) + 0x2e8)
+-#define REG_FE_GDM_RX_ETH_L64_CNT_H(_n)		(GDM_BASE(_n) + 0x2ec)
+-#define REG_FE_GDM_RX_ETH_L127_CNT_H(_n)	(GDM_BASE(_n) + 0x2f0)
+-#define REG_FE_GDM_RX_ETH_L255_CNT_H(_n)	(GDM_BASE(_n) + 0x2f4)
+-#define REG_FE_GDM_RX_ETH_L511_CNT_H(_n)	(GDM_BASE(_n) + 0x2f8)
+-#define REG_FE_GDM_RX_ETH_L1023_CNT_H(_n)	(GDM_BASE(_n) + 0x2fc)
+-
+-#define REG_GDM2_CHN_RLS		(GDM2_BASE + 0x20)
+-#define MBI_RX_AGE_SEL_MASK		GENMASK(26, 25)
+-#define MBI_TX_AGE_SEL_MASK		GENMASK(18, 17)
+-
+-#define REG_GDM3_FWD_CFG		GDM3_BASE
+-#define GDM3_PAD_EN_MASK		BIT(28)
+-
+-#define REG_GDM4_FWD_CFG		GDM4_BASE
+-#define GDM4_PAD_EN_MASK		BIT(28)
+-#define GDM4_SPORT_OFFSET0_MASK		GENMASK(11, 8)
+-
+-#define REG_GDM4_SRC_PORT_SET		(GDM4_BASE + 0x23c)
+-#define GDM4_SPORT_OFF2_MASK		GENMASK(19, 16)
+-#define GDM4_SPORT_OFF1_MASK		GENMASK(15, 12)
+-#define GDM4_SPORT_OFF0_MASK		GENMASK(11, 8)
+-
+-#define REG_IP_FRAG_FP			0x2010
+-#define IP_ASSEMBLE_PORT_MASK		GENMASK(24, 21)
+-#define IP_ASSEMBLE_NBQ_MASK		GENMASK(20, 16)
+-#define IP_FRAGMENT_PORT_MASK		GENMASK(8, 5)
+-#define IP_FRAGMENT_NBQ_MASK		GENMASK(4, 0)
+-
+-#define REG_MC_VLAN_EN			0x2100
+-#define MC_VLAN_EN_MASK			BIT(0)
+-
+-#define REG_MC_VLAN_CFG			0x2104
+-#define MC_VLAN_CFG_CMD_DONE_MASK	BIT(31)
+-#define MC_VLAN_CFG_TABLE_ID_MASK	GENMASK(21, 16)
+-#define MC_VLAN_CFG_PORT_ID_MASK	GENMASK(11, 8)
+-#define MC_VLAN_CFG_TABLE_SEL_MASK	BIT(4)
+-#define MC_VLAN_CFG_RW_MASK		BIT(0)
+-
+-#define REG_MC_VLAN_DATA		0x2108
+-
+-#define REG_CDM5_RX_OQ1_DROP_CNT	0x29d4
+-
+-/* QDMA */
+-#define REG_QDMA_GLOBAL_CFG			0x0004
+-#define GLOBAL_CFG_RX_2B_OFFSET_MASK		BIT(31)
+-#define GLOBAL_CFG_DMA_PREFERENCE_MASK		GENMASK(30, 29)
+-#define GLOBAL_CFG_CPU_TXR_RR_MASK		BIT(28)
+-#define GLOBAL_CFG_DSCP_BYTE_SWAP_MASK		BIT(27)
+-#define GLOBAL_CFG_PAYLOAD_BYTE_SWAP_MASK	BIT(26)
+-#define GLOBAL_CFG_MULTICAST_MODIFY_FP_MASK	BIT(25)
+-#define GLOBAL_CFG_OAM_MODIFY_MASK		BIT(24)
+-#define GLOBAL_CFG_RESET_MASK			BIT(23)
+-#define GLOBAL_CFG_RESET_DONE_MASK		BIT(22)
+-#define GLOBAL_CFG_MULTICAST_EN_MASK		BIT(21)
+-#define GLOBAL_CFG_IRQ1_EN_MASK			BIT(20)
+-#define GLOBAL_CFG_IRQ0_EN_MASK			BIT(19)
+-#define GLOBAL_CFG_LOOPCNT_EN_MASK		BIT(18)
+-#define GLOBAL_CFG_RD_BYPASS_WR_MASK		BIT(17)
+-#define GLOBAL_CFG_QDMA_LOOPBACK_MASK		BIT(16)
+-#define GLOBAL_CFG_LPBK_RXQ_SEL_MASK		GENMASK(13, 8)
+-#define GLOBAL_CFG_CHECK_DONE_MASK		BIT(7)
+-#define GLOBAL_CFG_TX_WB_DONE_MASK		BIT(6)
+-#define GLOBAL_CFG_MAX_ISSUE_NUM_MASK		GENMASK(5, 4)
+-#define GLOBAL_CFG_RX_DMA_BUSY_MASK		BIT(3)
+-#define GLOBAL_CFG_RX_DMA_EN_MASK		BIT(2)
+-#define GLOBAL_CFG_TX_DMA_BUSY_MASK		BIT(1)
+-#define GLOBAL_CFG_TX_DMA_EN_MASK		BIT(0)
+-
+-#define REG_FWD_DSCP_BASE			0x0010
+-#define REG_FWD_BUF_BASE			0x0014
+-
+-#define REG_HW_FWD_DSCP_CFG			0x0018
+-#define HW_FWD_DSCP_PAYLOAD_SIZE_MASK		GENMASK(29, 28)
+-#define HW_FWD_DSCP_SCATTER_LEN_MASK		GENMASK(17, 16)
+-#define HW_FWD_DSCP_MIN_SCATTER_LEN_MASK	GENMASK(15, 0)
+-
+-#define REG_INT_STATUS(_n)		\
+-	(((_n) == 4) ? 0x0730 :		\
+-	 ((_n) == 3) ? 0x0724 :		\
+-	 ((_n) == 2) ? 0x0720 :		\
+-	 ((_n) == 1) ? 0x0024 : 0x0020)
+-
+-#define REG_INT_ENABLE(_n)		\
+-	(((_n) == 4) ? 0x0750 :		\
+-	 ((_n) == 3) ? 0x0744 :		\
+-	 ((_n) == 2) ? 0x0740 :		\
+-	 ((_n) == 1) ? 0x002c : 0x0028)
+-
+-/* QDMA_CSR_INT_ENABLE1 */
+-#define RX15_COHERENT_INT_MASK		BIT(31)
+-#define RX14_COHERENT_INT_MASK		BIT(30)
+-#define RX13_COHERENT_INT_MASK		BIT(29)
+-#define RX12_COHERENT_INT_MASK		BIT(28)
+-#define RX11_COHERENT_INT_MASK		BIT(27)
+-#define RX10_COHERENT_INT_MASK		BIT(26)
+-#define RX9_COHERENT_INT_MASK		BIT(25)
+-#define RX8_COHERENT_INT_MASK		BIT(24)
+-#define RX7_COHERENT_INT_MASK		BIT(23)
+-#define RX6_COHERENT_INT_MASK		BIT(22)
+-#define RX5_COHERENT_INT_MASK		BIT(21)
+-#define RX4_COHERENT_INT_MASK		BIT(20)
+-#define RX3_COHERENT_INT_MASK		BIT(19)
+-#define RX2_COHERENT_INT_MASK		BIT(18)
+-#define RX1_COHERENT_INT_MASK		BIT(17)
+-#define RX0_COHERENT_INT_MASK		BIT(16)
+-#define TX7_COHERENT_INT_MASK		BIT(15)
+-#define TX6_COHERENT_INT_MASK		BIT(14)
+-#define TX5_COHERENT_INT_MASK		BIT(13)
+-#define TX4_COHERENT_INT_MASK		BIT(12)
+-#define TX3_COHERENT_INT_MASK		BIT(11)
+-#define TX2_COHERENT_INT_MASK		BIT(10)
+-#define TX1_COHERENT_INT_MASK		BIT(9)
+-#define TX0_COHERENT_INT_MASK		BIT(8)
+-#define CNT_OVER_FLOW_INT_MASK		BIT(7)
+-#define IRQ1_FULL_INT_MASK		BIT(5)
+-#define IRQ1_INT_MASK			BIT(4)
+-#define HWFWD_DSCP_LOW_INT_MASK		BIT(3)
+-#define HWFWD_DSCP_EMPTY_INT_MASK	BIT(2)
+-#define IRQ0_FULL_INT_MASK		BIT(1)
+-#define IRQ0_INT_MASK			BIT(0)
+-
+-#define TX_DONE_INT_MASK(_n)					\
+-	((_n) ? IRQ1_INT_MASK | IRQ1_FULL_INT_MASK		\
+-	      : IRQ0_INT_MASK | IRQ0_FULL_INT_MASK)
+-
+-#define INT_TX_MASK						\
+-	(IRQ1_INT_MASK | IRQ1_FULL_INT_MASK |			\
+-	 IRQ0_INT_MASK | IRQ0_FULL_INT_MASK)
+-
+-#define INT_IDX0_MASK						\
+-	(TX0_COHERENT_INT_MASK | TX1_COHERENT_INT_MASK |	\
+-	 TX2_COHERENT_INT_MASK | TX3_COHERENT_INT_MASK |	\
+-	 TX4_COHERENT_INT_MASK | TX5_COHERENT_INT_MASK |	\
+-	 TX6_COHERENT_INT_MASK | TX7_COHERENT_INT_MASK |	\
+-	 RX0_COHERENT_INT_MASK | RX1_COHERENT_INT_MASK |	\
+-	 RX2_COHERENT_INT_MASK | RX3_COHERENT_INT_MASK |	\
+-	 RX4_COHERENT_INT_MASK | RX7_COHERENT_INT_MASK |	\
+-	 RX8_COHERENT_INT_MASK | RX9_COHERENT_INT_MASK |	\
+-	 RX15_COHERENT_INT_MASK | INT_TX_MASK)
+-
+-/* QDMA_CSR_INT_ENABLE2 */
+-#define RX15_NO_CPU_DSCP_INT_MASK	BIT(31)
+-#define RX14_NO_CPU_DSCP_INT_MASK	BIT(30)
+-#define RX13_NO_CPU_DSCP_INT_MASK	BIT(29)
+-#define RX12_NO_CPU_DSCP_INT_MASK	BIT(28)
+-#define RX11_NO_CPU_DSCP_INT_MASK	BIT(27)
+-#define RX10_NO_CPU_DSCP_INT_MASK	BIT(26)
+-#define RX9_NO_CPU_DSCP_INT_MASK	BIT(25)
+-#define RX8_NO_CPU_DSCP_INT_MASK	BIT(24)
+-#define RX7_NO_CPU_DSCP_INT_MASK	BIT(23)
+-#define RX6_NO_CPU_DSCP_INT_MASK	BIT(22)
+-#define RX5_NO_CPU_DSCP_INT_MASK	BIT(21)
+-#define RX4_NO_CPU_DSCP_INT_MASK	BIT(20)
+-#define RX3_NO_CPU_DSCP_INT_MASK	BIT(19)
+-#define RX2_NO_CPU_DSCP_INT_MASK	BIT(18)
+-#define RX1_NO_CPU_DSCP_INT_MASK	BIT(17)
+-#define RX0_NO_CPU_DSCP_INT_MASK	BIT(16)
+-#define RX15_DONE_INT_MASK		BIT(15)
+-#define RX14_DONE_INT_MASK		BIT(14)
+-#define RX13_DONE_INT_MASK		BIT(13)
+-#define RX12_DONE_INT_MASK		BIT(12)
+-#define RX11_DONE_INT_MASK		BIT(11)
+-#define RX10_DONE_INT_MASK		BIT(10)
+-#define RX9_DONE_INT_MASK		BIT(9)
+-#define RX8_DONE_INT_MASK		BIT(8)
+-#define RX7_DONE_INT_MASK		BIT(7)
+-#define RX6_DONE_INT_MASK		BIT(6)
+-#define RX5_DONE_INT_MASK		BIT(5)
+-#define RX4_DONE_INT_MASK		BIT(4)
+-#define RX3_DONE_INT_MASK		BIT(3)
+-#define RX2_DONE_INT_MASK		BIT(2)
+-#define RX1_DONE_INT_MASK		BIT(1)
+-#define RX0_DONE_INT_MASK		BIT(0)
+-
+-#define RX_DONE_INT_MASK					\
+-	(RX0_DONE_INT_MASK | RX1_DONE_INT_MASK |		\
+-	 RX2_DONE_INT_MASK | RX3_DONE_INT_MASK |		\
+-	 RX4_DONE_INT_MASK | RX7_DONE_INT_MASK |		\
+-	 RX8_DONE_INT_MASK | RX9_DONE_INT_MASK |		\
+-	 RX15_DONE_INT_MASK)
+-#define INT_IDX1_MASK						\
+-	(RX_DONE_INT_MASK |					\
+-	 RX0_NO_CPU_DSCP_INT_MASK | RX1_NO_CPU_DSCP_INT_MASK |	\
+-	 RX2_NO_CPU_DSCP_INT_MASK | RX3_NO_CPU_DSCP_INT_MASK |	\
+-	 RX4_NO_CPU_DSCP_INT_MASK | RX7_NO_CPU_DSCP_INT_MASK |	\
+-	 RX8_NO_CPU_DSCP_INT_MASK | RX9_NO_CPU_DSCP_INT_MASK |	\
+-	 RX15_NO_CPU_DSCP_INT_MASK)
+-
+-/* QDMA_CSR_INT_ENABLE5 */
+-#define TX31_COHERENT_INT_MASK		BIT(31)
+-#define TX30_COHERENT_INT_MASK		BIT(30)
+-#define TX29_COHERENT_INT_MASK		BIT(29)
+-#define TX28_COHERENT_INT_MASK		BIT(28)
+-#define TX27_COHERENT_INT_MASK		BIT(27)
+-#define TX26_COHERENT_INT_MASK		BIT(26)
+-#define TX25_COHERENT_INT_MASK		BIT(25)
+-#define TX24_COHERENT_INT_MASK		BIT(24)
+-#define TX23_COHERENT_INT_MASK		BIT(23)
+-#define TX22_COHERENT_INT_MASK		BIT(22)
+-#define TX21_COHERENT_INT_MASK		BIT(21)
+-#define TX20_COHERENT_INT_MASK		BIT(20)
+-#define TX19_COHERENT_INT_MASK		BIT(19)
+-#define TX18_COHERENT_INT_MASK		BIT(18)
+-#define TX17_COHERENT_INT_MASK		BIT(17)
+-#define TX16_COHERENT_INT_MASK		BIT(16)
+-#define TX15_COHERENT_INT_MASK		BIT(15)
+-#define TX14_COHERENT_INT_MASK		BIT(14)
+-#define TX13_COHERENT_INT_MASK		BIT(13)
+-#define TX12_COHERENT_INT_MASK		BIT(12)
+-#define TX11_COHERENT_INT_MASK		BIT(11)
+-#define TX10_COHERENT_INT_MASK		BIT(10)
+-#define TX9_COHERENT_INT_MASK		BIT(9)
+-#define TX8_COHERENT_INT_MASK		BIT(8)
+-
+-#define INT_IDX4_MASK						\
+-	(TX8_COHERENT_INT_MASK | TX9_COHERENT_INT_MASK |	\
+-	 TX10_COHERENT_INT_MASK | TX11_COHERENT_INT_MASK |	\
+-	 TX12_COHERENT_INT_MASK | TX13_COHERENT_INT_MASK |	\
+-	 TX14_COHERENT_INT_MASK | TX15_COHERENT_INT_MASK |	\
+-	 TX16_COHERENT_INT_MASK | TX17_COHERENT_INT_MASK |	\
+-	 TX18_COHERENT_INT_MASK | TX19_COHERENT_INT_MASK |	\
+-	 TX20_COHERENT_INT_MASK | TX21_COHERENT_INT_MASK |	\
+-	 TX22_COHERENT_INT_MASK | TX23_COHERENT_INT_MASK |	\
+-	 TX24_COHERENT_INT_MASK | TX25_COHERENT_INT_MASK |	\
+-	 TX26_COHERENT_INT_MASK | TX27_COHERENT_INT_MASK |	\
+-	 TX28_COHERENT_INT_MASK | TX29_COHERENT_INT_MASK |	\
+-	 TX30_COHERENT_INT_MASK | TX31_COHERENT_INT_MASK)
+-
+-#define REG_TX_IRQ_BASE(_n)		((_n) ? 0x0048 : 0x0050)
+-
+-#define REG_TX_IRQ_CFG(_n)		((_n) ? 0x004c : 0x0054)
+-#define TX_IRQ_THR_MASK			GENMASK(27, 16)
+-#define TX_IRQ_DEPTH_MASK		GENMASK(11, 0)
+-
+-#define REG_IRQ_CLEAR_LEN(_n)		((_n) ? 0x0064 : 0x0058)
+-#define IRQ_CLEAR_LEN_MASK		GENMASK(7, 0)
+-
+-#define REG_IRQ_STATUS(_n)		((_n) ? 0x0068 : 0x005c)
+-#define IRQ_ENTRY_LEN_MASK		GENMASK(27, 16)
+-#define IRQ_HEAD_IDX_MASK		GENMASK(11, 0)
+-
+-#define REG_TX_RING_BASE(_n)	\
+-	(((_n) < 8) ? 0x0100 + ((_n) << 5) : 0x0b00 + (((_n) - 8) << 5))
+-
+-#define REG_TX_RING_BLOCKING(_n)	\
+-	(((_n) < 8) ? 0x0104 + ((_n) << 5) : 0x0b04 + (((_n) - 8) << 5))
+-
+-#define TX_RING_IRQ_BLOCKING_MAP_MASK			BIT(6)
+-#define TX_RING_IRQ_BLOCKING_CFG_MASK			BIT(4)
+-#define TX_RING_IRQ_BLOCKING_TX_DROP_EN_MASK		BIT(2)
+-#define TX_RING_IRQ_BLOCKING_MAX_TH_TXRING_EN_MASK	BIT(1)
+-#define TX_RING_IRQ_BLOCKING_MIN_TH_TXRING_EN_MASK	BIT(0)
+-
+-#define REG_TX_CPU_IDX(_n)	\
+-	(((_n) < 8) ? 0x0108 + ((_n) << 5) : 0x0b08 + (((_n) - 8) << 5))
+-
+-#define TX_RING_CPU_IDX_MASK		GENMASK(15, 0)
+-
+-#define REG_TX_DMA_IDX(_n)	\
+-	(((_n) < 8) ? 0x010c + ((_n) << 5) : 0x0b0c + (((_n) - 8) << 5))
+-
+-#define TX_RING_DMA_IDX_MASK		GENMASK(15, 0)
+-
+-#define IRQ_RING_IDX_MASK		GENMASK(20, 16)
+-#define IRQ_DESC_IDX_MASK		GENMASK(15, 0)
+-
+-#define REG_RX_RING_BASE(_n)	\
+-	(((_n) < 16) ? 0x0200 + ((_n) << 5) : 0x0e00 + (((_n) - 16) << 5))
+-
+-#define REG_RX_RING_SIZE(_n)	\
+-	(((_n) < 16) ? 0x0204 + ((_n) << 5) : 0x0e04 + (((_n) - 16) << 5))
+-
+-#define RX_RING_THR_MASK		GENMASK(31, 16)
+-#define RX_RING_SIZE_MASK		GENMASK(15, 0)
+-
+-#define REG_RX_CPU_IDX(_n)	\
+-	(((_n) < 16) ? 0x0208 + ((_n) << 5) : 0x0e08 + (((_n) - 16) << 5))
+-
+-#define RX_RING_CPU_IDX_MASK		GENMASK(15, 0)
+-
+-#define REG_RX_DMA_IDX(_n)	\
+-	(((_n) < 16) ? 0x020c + ((_n) << 5) : 0x0e0c + (((_n) - 16) << 5))
+-
+-#define REG_RX_DELAY_INT_IDX(_n)	\
+-	(((_n) < 16) ? 0x0210 + ((_n) << 5) : 0x0e10 + (((_n) - 16) << 5))
+-
+-#define RX_DELAY_INT_MASK		GENMASK(15, 0)
+-
+-#define RX_RING_DMA_IDX_MASK		GENMASK(15, 0)
+-
+-#define REG_INGRESS_TRTCM_CFG		0x0070
+-#define INGRESS_TRTCM_EN_MASK		BIT(31)
+-#define INGRESS_TRTCM_MODE_MASK		BIT(30)
+-#define INGRESS_SLOW_TICK_RATIO_MASK	GENMASK(29, 16)
+-#define INGRESS_FAST_TICK_MASK		GENMASK(15, 0)
+-
+-#define REG_QUEUE_CLOSE_CFG(_n)		(0x00a0 + ((_n) & 0xfc))
+-#define TXQ_DISABLE_CHAN_QUEUE_MASK(_n, _m)	BIT((_m) + (((_n) & 0x3) << 3))
+-
+-#define REG_TXQ_DIS_CFG_BASE(_n)	((_n) ? 0x20a0 : 0x00a0)
+-#define REG_TXQ_DIS_CFG(_n, _m)		(REG_TXQ_DIS_CFG_BASE((_n)) + (_m) << 2)
+-
+-#define REG_CNTR_CFG(_n)		(0x0400 + ((_n) << 3))
+-#define CNTR_EN_MASK			BIT(31)
+-#define CNTR_ALL_CHAN_EN_MASK		BIT(30)
+-#define CNTR_ALL_QUEUE_EN_MASK		BIT(29)
+-#define CNTR_ALL_DSCP_RING_EN_MASK	BIT(28)
+-#define CNTR_SRC_MASK			GENMASK(27, 24)
+-#define CNTR_DSCP_RING_MASK		GENMASK(20, 16)
+-#define CNTR_CHAN_MASK			GENMASK(7, 3)
+-#define CNTR_QUEUE_MASK			GENMASK(2, 0)
+-
+-#define REG_CNTR_VAL(_n)		(0x0404 + ((_n) << 3))
+-
+-#define REG_LMGR_INIT_CFG		0x1000
+-#define LMGR_INIT_START			BIT(31)
+-#define LMGR_SRAM_MODE_MASK		BIT(30)
+-#define HW_FWD_PKTSIZE_OVERHEAD_MASK	GENMASK(27, 20)
+-#define HW_FWD_DESC_NUM_MASK		GENMASK(16, 0)
+-
+-#define REG_FWD_DSCP_LOW_THR		0x1004
+-#define FWD_DSCP_LOW_THR_MASK		GENMASK(17, 0)
+-
+-#define REG_EGRESS_RATE_METER_CFG		0x100c
+-#define EGRESS_RATE_METER_EN_MASK		BIT(31)
+-#define EGRESS_RATE_METER_EQ_RATE_EN_MASK	BIT(17)
+-#define EGRESS_RATE_METER_WINDOW_SZ_MASK	GENMASK(16, 12)
+-#define EGRESS_RATE_METER_TIMESLICE_MASK	GENMASK(10, 0)
+-
+-#define REG_EGRESS_TRTCM_CFG		0x1010
+-#define EGRESS_TRTCM_EN_MASK		BIT(31)
+-#define EGRESS_TRTCM_MODE_MASK		BIT(30)
+-#define EGRESS_SLOW_TICK_RATIO_MASK	GENMASK(29, 16)
+-#define EGRESS_FAST_TICK_MASK		GENMASK(15, 0)
+-
+-#define TRTCM_PARAM_RW_MASK		BIT(31)
+-#define TRTCM_PARAM_RW_DONE_MASK	BIT(30)
+-#define TRTCM_PARAM_TYPE_MASK		GENMASK(29, 28)
+-#define TRTCM_METER_GROUP_MASK		GENMASK(27, 26)
+-#define TRTCM_PARAM_INDEX_MASK		GENMASK(23, 17)
+-#define TRTCM_PARAM_RATE_TYPE_MASK	BIT(16)
+-
+-#define REG_TRTCM_CFG_PARAM(_n)		((_n) + 0x4)
+-#define REG_TRTCM_DATA_LOW(_n)		((_n) + 0x8)
+-#define REG_TRTCM_DATA_HIGH(_n)		((_n) + 0xc)
+-
+-#define REG_TXWRR_MODE_CFG		0x1020
+-#define TWRR_WEIGHT_SCALE_MASK		BIT(31)
+-#define TWRR_WEIGHT_BASE_MASK		BIT(3)
+-
+-#define REG_TXWRR_WEIGHT_CFG		0x1024
+-#define TWRR_RW_CMD_MASK		BIT(31)
+-#define TWRR_RW_CMD_DONE		BIT(30)
+-#define TWRR_CHAN_IDX_MASK		GENMASK(23, 19)
+-#define TWRR_QUEUE_IDX_MASK		GENMASK(18, 16)
+-#define TWRR_VALUE_MASK			GENMASK(15, 0)
+-
+-#define REG_PSE_BUF_USAGE_CFG		0x1028
+-#define PSE_BUF_ESTIMATE_EN_MASK	BIT(29)
+-
+-#define REG_CHAN_QOS_MODE(_n)		(0x1040 + ((_n) << 2))
+-#define CHAN_QOS_MODE_MASK(_n)		GENMASK(2 + ((_n) << 2), (_n) << 2)
+-
+-#define REG_GLB_TRTCM_CFG		0x1080
+-#define GLB_TRTCM_EN_MASK		BIT(31)
+-#define GLB_TRTCM_MODE_MASK		BIT(30)
+-#define GLB_SLOW_TICK_RATIO_MASK	GENMASK(29, 16)
+-#define GLB_FAST_TICK_MASK		GENMASK(15, 0)
+-
+-#define REG_TXQ_CNGST_CFG		0x10a0
+-#define TXQ_CNGST_DROP_EN		BIT(31)
+-#define TXQ_CNGST_DEI_DROP_EN		BIT(30)
+-
+-#define REG_SLA_TRTCM_CFG		0x1150
+-#define SLA_TRTCM_EN_MASK		BIT(31)
+-#define SLA_TRTCM_MODE_MASK		BIT(30)
+-#define SLA_SLOW_TICK_RATIO_MASK	GENMASK(29, 16)
+-#define SLA_FAST_TICK_MASK		GENMASK(15, 0)
+-
+-/* CTRL */
+-#define QDMA_DESC_DONE_MASK		BIT(31)
+-#define QDMA_DESC_DROP_MASK		BIT(30) /* tx: drop - rx: overflow */
+-#define QDMA_DESC_MORE_MASK		BIT(29) /* more SG elements */
+-#define QDMA_DESC_DEI_MASK		BIT(25)
+-#define QDMA_DESC_NO_DROP_MASK		BIT(24)
+-#define QDMA_DESC_LEN_MASK		GENMASK(15, 0)
+-/* DATA */
+-#define QDMA_DESC_NEXT_ID_MASK		GENMASK(15, 0)
+-/* TX MSG0 */
+-#define QDMA_ETH_TXMSG_MIC_IDX_MASK	BIT(30)
+-#define QDMA_ETH_TXMSG_SP_TAG_MASK	GENMASK(29, 14)
+-#define QDMA_ETH_TXMSG_ICO_MASK		BIT(13)
+-#define QDMA_ETH_TXMSG_UCO_MASK		BIT(12)
+-#define QDMA_ETH_TXMSG_TCO_MASK		BIT(11)
+-#define QDMA_ETH_TXMSG_TSO_MASK		BIT(10)
+-#define QDMA_ETH_TXMSG_FAST_MASK	BIT(9)
+-#define QDMA_ETH_TXMSG_OAM_MASK		BIT(8)
+-#define QDMA_ETH_TXMSG_CHAN_MASK	GENMASK(7, 3)
+-#define QDMA_ETH_TXMSG_QUEUE_MASK	GENMASK(2, 0)
+-/* TX MSG1 */
+-#define QDMA_ETH_TXMSG_NO_DROP		BIT(31)
+-#define QDMA_ETH_TXMSG_METER_MASK	GENMASK(30, 24)	/* 0x7f no meters */
+-#define QDMA_ETH_TXMSG_FPORT_MASK	GENMASK(23, 20)
+-#define QDMA_ETH_TXMSG_NBOQ_MASK	GENMASK(19, 15)
+-#define QDMA_ETH_TXMSG_HWF_MASK		BIT(14)
+-#define QDMA_ETH_TXMSG_HOP_MASK		BIT(13)
+-#define QDMA_ETH_TXMSG_PTP_MASK		BIT(12)
+-#define QDMA_ETH_TXMSG_ACNT_G1_MASK	GENMASK(10, 6)	/* 0x1f do not count */
+-#define QDMA_ETH_TXMSG_ACNT_G0_MASK	GENMASK(5, 0)	/* 0x3f do not count */
+-
+-/* RX MSG1 */
+-#define QDMA_ETH_RXMSG_DEI_MASK		BIT(31)
+-#define QDMA_ETH_RXMSG_IP6_MASK		BIT(30)
+-#define QDMA_ETH_RXMSG_IP4_MASK		BIT(29)
+-#define QDMA_ETH_RXMSG_IP4F_MASK	BIT(28)
+-#define QDMA_ETH_RXMSG_L4_VALID_MASK	BIT(27)
+-#define QDMA_ETH_RXMSG_L4F_MASK		BIT(26)
+-#define QDMA_ETH_RXMSG_SPORT_MASK	GENMASK(25, 21)
+-#define QDMA_ETH_RXMSG_CRSN_MASK	GENMASK(20, 16)
+-#define QDMA_ETH_RXMSG_PPE_ENTRY_MASK	GENMASK(15, 0)
+-
+-struct airoha_qdma_desc {
+-	__le32 rsv;
+-	__le32 ctrl;
+-	__le32 addr;
+-	__le32 data;
+-	__le32 msg0;
+-	__le32 msg1;
+-	__le32 msg2;
+-	__le32 msg3;
+-};
+-
+-/* CTRL0 */
+-#define QDMA_FWD_DESC_CTX_MASK		BIT(31)
+-#define QDMA_FWD_DESC_RING_MASK		GENMASK(30, 28)
+-#define QDMA_FWD_DESC_IDX_MASK		GENMASK(27, 16)
+-#define QDMA_FWD_DESC_LEN_MASK		GENMASK(15, 0)
+-/* CTRL1 */
+-#define QDMA_FWD_DESC_FIRST_IDX_MASK	GENMASK(15, 0)
+-/* CTRL2 */
+-#define QDMA_FWD_DESC_MORE_PKT_NUM_MASK	GENMASK(2, 0)
+-
+-struct airoha_qdma_fwd_desc {
+-	__le32 addr;
+-	__le32 ctrl0;
+-	__le32 ctrl1;
+-	__le32 ctrl2;
+-	__le32 msg0;
+-	__le32 msg1;
+-	__le32 rsv0;
+-	__le32 rsv1;
+-};
+-
+-enum {
+-	QDMA_INT_REG_IDX0,
+-	QDMA_INT_REG_IDX1,
+-	QDMA_INT_REG_IDX2,
+-	QDMA_INT_REG_IDX3,
+-	QDMA_INT_REG_IDX4,
+-	QDMA_INT_REG_MAX
+-};
+-
+-enum {
+-	XSI_PCIE0_PORT,
+-	XSI_PCIE1_PORT,
+-	XSI_USB_PORT,
+-	XSI_AE_PORT,
+-	XSI_ETH_PORT,
+-};
+-
+-enum {
+-	XSI_PCIE0_VIP_PORT_MASK	= BIT(22),
+-	XSI_PCIE1_VIP_PORT_MASK	= BIT(23),
+-	XSI_USB_VIP_PORT_MASK	= BIT(25),
+-	XSI_ETH_VIP_PORT_MASK	= BIT(24),
+-};
+-
+-enum {
+-	DEV_STATE_INITIALIZED,
+-};
+-
+-enum {
+-	CDM_CRSN_QSEL_Q1 = 1,
+-	CDM_CRSN_QSEL_Q5 = 5,
+-	CDM_CRSN_QSEL_Q6 = 6,
+-	CDM_CRSN_QSEL_Q15 = 15,
+-};
+-
+-enum {
+-	CRSN_08 = 0x8,
+-	CRSN_21 = 0x15, /* KA */
+-	CRSN_22 = 0x16, /* hit bind and force route to CPU */
+-	CRSN_24 = 0x18,
+-	CRSN_25 = 0x19,
+-};
+-
+-enum {
+-	FE_PSE_PORT_CDM1,
+-	FE_PSE_PORT_GDM1,
+-	FE_PSE_PORT_GDM2,
+-	FE_PSE_PORT_GDM3,
+-	FE_PSE_PORT_PPE1,
+-	FE_PSE_PORT_CDM2,
+-	FE_PSE_PORT_CDM3,
+-	FE_PSE_PORT_CDM4,
+-	FE_PSE_PORT_PPE2,
+-	FE_PSE_PORT_GDM4,
+-	FE_PSE_PORT_CDM5,
+-	FE_PSE_PORT_DROP = 0xf,
+-};
+-
+-enum tx_sched_mode {
+-	TC_SCH_WRR8,
+-	TC_SCH_SP,
+-	TC_SCH_WRR7,
+-	TC_SCH_WRR6,
+-	TC_SCH_WRR5,
+-	TC_SCH_WRR4,
+-	TC_SCH_WRR3,
+-	TC_SCH_WRR2,
+-};
+-
+-enum trtcm_param_type {
+-	TRTCM_MISC_MODE, /* meter_en, pps_mode, tick_sel */
+-	TRTCM_TOKEN_RATE_MODE,
+-	TRTCM_BUCKETSIZE_SHIFT_MODE,
+-	TRTCM_BUCKET_COUNTER_MODE,
+-};
+-
+-enum trtcm_mode_type {
+-	TRTCM_COMMIT_MODE,
+-	TRTCM_PEAK_MODE,
+-};
+-
+-enum trtcm_param {
+-	TRTCM_TICK_SEL = BIT(0),
+-	TRTCM_PKT_MODE = BIT(1),
+-	TRTCM_METER_MODE = BIT(2),
+-};
+-
+-#define MIN_TOKEN_SIZE				4096
+-#define MAX_TOKEN_SIZE_OFFSET			17
+-#define TRTCM_TOKEN_RATE_MASK			GENMASK(23, 6)
+-#define TRTCM_TOKEN_RATE_FRACTION_MASK		GENMASK(5, 0)
+-
+-struct airoha_queue_entry {
+-	union {
+-		void *buf;
+-		struct sk_buff *skb;
+-	};
+-	dma_addr_t dma_addr;
+-	u16 dma_len;
+-};
+-
+-struct airoha_queue {
+-	struct airoha_qdma *qdma;
+-
+-	/* protect concurrent queue accesses */
+-	spinlock_t lock;
+-	struct airoha_queue_entry *entry;
+-	struct airoha_qdma_desc *desc;
+-	u16 head;
+-	u16 tail;
+-
+-	int queued;
+-	int ndesc;
+-	int free_thr;
+-	int buf_size;
+-
+-	struct napi_struct napi;
+-	struct page_pool *page_pool;
+-};
+-
+-struct airoha_tx_irq_queue {
+-	struct airoha_qdma *qdma;
+-
+-	struct napi_struct napi;
+-
+-	int size;
+-	u32 *q;
+-};
+-
+-struct airoha_hw_stats {
+-	/* protect concurrent hw_stats accesses */
+-	spinlock_t lock;
+-	struct u64_stats_sync syncp;
+-
+-	/* get_stats64 */
+-	u64 rx_ok_pkts;
+-	u64 tx_ok_pkts;
+-	u64 rx_ok_bytes;
+-	u64 tx_ok_bytes;
+-	u64 rx_multicast;
+-	u64 rx_errors;
+-	u64 rx_drops;
+-	u64 tx_drops;
+-	u64 rx_crc_error;
+-	u64 rx_over_errors;
+-	/* ethtool stats */
+-	u64 tx_broadcast;
+-	u64 tx_multicast;
+-	u64 tx_len[7];
+-	u64 rx_broadcast;
+-	u64 rx_fragment;
+-	u64 rx_jabber;
+-	u64 rx_len[7];
+-};
+-
+-struct airoha_qdma {
+-	struct airoha_eth *eth;
+-	void __iomem *regs;
+-
+-	/* protect concurrent irqmask accesses */
+-	spinlock_t irq_lock;
+-	u32 irqmask[QDMA_INT_REG_MAX];
+-	int irq;
+-
+-	struct airoha_tx_irq_queue q_tx_irq[AIROHA_NUM_TX_IRQ];
+-
+-	struct airoha_queue q_tx[AIROHA_NUM_TX_RING];
+-	struct airoha_queue q_rx[AIROHA_NUM_RX_RING];
+-
+-	/* descriptor and packet buffers for qdma hw forward */
+-	struct {
+-		void *desc;
+-		void *q;
+-	} hfwd;
+-};
+-
+-struct airoha_gdm_port {
+-	struct airoha_qdma *qdma;
+-	struct net_device *dev;
+-	int id;
+-
+-	struct airoha_hw_stats stats;
+-
+-	DECLARE_BITMAP(qos_sq_bmap, AIROHA_NUM_QOS_CHANNELS);
+-
+-	/* qos stats counters */
+-	u64 cpu_tx_packets;
+-	u64 fwd_tx_packets;
+-};
+-
+-struct airoha_eth {
+-	struct device *dev;
+-
+-	unsigned long state;
+-	void __iomem *fe_regs;
+-
+-	struct reset_control_bulk_data rsts[AIROHA_MAX_NUM_RSTS];
+-	struct reset_control_bulk_data xsi_rsts[AIROHA_MAX_NUM_XSI_RSTS];
+-
+-	struct net_device *napi_dev;
+-
+-	struct airoha_qdma qdma[AIROHA_MAX_NUM_QDMA];
+-	struct airoha_gdm_port *ports[AIROHA_MAX_NUM_GDM_PORTS];
+-};
+-
+-static u32 airoha_rr(void __iomem *base, u32 offset)
+-{
+-	return readl(base + offset);
+-}
+-
+-static void airoha_wr(void __iomem *base, u32 offset, u32 val)
+-{
+-	writel(val, base + offset);
+-}
+-
+-static u32 airoha_rmw(void __iomem *base, u32 offset, u32 mask, u32 val)
+-{
+-	val |= (airoha_rr(base, offset) & ~mask);
+-	airoha_wr(base, offset, val);
+-
+-	return val;
+-}
+-
+-#define airoha_fe_rr(eth, offset)				\
+-	airoha_rr((eth)->fe_regs, (offset))
+-#define airoha_fe_wr(eth, offset, val)				\
+-	airoha_wr((eth)->fe_regs, (offset), (val))
+-#define airoha_fe_rmw(eth, offset, mask, val)			\
+-	airoha_rmw((eth)->fe_regs, (offset), (mask), (val))
+-#define airoha_fe_set(eth, offset, val)				\
+-	airoha_rmw((eth)->fe_regs, (offset), 0, (val))
+-#define airoha_fe_clear(eth, offset, val)			\
+-	airoha_rmw((eth)->fe_regs, (offset), (val), 0)
+-
+-#define airoha_qdma_rr(qdma, offset)				\
+-	airoha_rr((qdma)->regs, (offset))
+-#define airoha_qdma_wr(qdma, offset, val)			\
+-	airoha_wr((qdma)->regs, (offset), (val))
+-#define airoha_qdma_rmw(qdma, offset, mask, val)		\
+-	airoha_rmw((qdma)->regs, (offset), (mask), (val))
+-#define airoha_qdma_set(qdma, offset, val)			\
+-	airoha_rmw((qdma)->regs, (offset), 0, (val))
+-#define airoha_qdma_clear(qdma, offset, val)			\
+-	airoha_rmw((qdma)->regs, (offset), (val), 0)
+-
+-static void airoha_qdma_set_irqmask(struct airoha_qdma *qdma, int index,
+-				    u32 clear, u32 set)
+-{
+-	unsigned long flags;
+-
+-	if (WARN_ON_ONCE(index >= ARRAY_SIZE(qdma->irqmask)))
+-		return;
+-
+-	spin_lock_irqsave(&qdma->irq_lock, flags);
+-
+-	qdma->irqmask[index] &= ~clear;
+-	qdma->irqmask[index] |= set;
+-	airoha_qdma_wr(qdma, REG_INT_ENABLE(index), qdma->irqmask[index]);
+-	/* Read irq_enable register in order to guarantee the update above
+-	 * completes in the spinlock critical section.
+-	 */
+-	airoha_qdma_rr(qdma, REG_INT_ENABLE(index));
+-
+-	spin_unlock_irqrestore(&qdma->irq_lock, flags);
+-}
+-
+-static void airoha_qdma_irq_enable(struct airoha_qdma *qdma, int index,
+-				   u32 mask)
+-{
+-	airoha_qdma_set_irqmask(qdma, index, 0, mask);
+-}
+-
+-static void airoha_qdma_irq_disable(struct airoha_qdma *qdma, int index,
+-				    u32 mask)
+-{
+-	airoha_qdma_set_irqmask(qdma, index, mask, 0);
+-}
+-
+-static bool airhoa_is_lan_gdm_port(struct airoha_gdm_port *port)
+-{
+-	/* GDM1 port on EN7581 SoC is connected to the lan dsa switch.
+-	 * GDM{2,3,4} can be used as wan port connected to an external
+-	 * phy module.
+-	 */
+-	return port->id == 1;
+-}
+-
+-static void airoha_set_macaddr(struct airoha_gdm_port *port, const u8 *addr)
+-{
+-	struct airoha_eth *eth = port->qdma->eth;
+-	u32 val, reg;
+-
+-	reg = airhoa_is_lan_gdm_port(port) ? REG_FE_LAN_MAC_H
+-					   : REG_FE_WAN_MAC_H;
+-	val = (addr[0] << 16) | (addr[1] << 8) | addr[2];
+-	airoha_fe_wr(eth, reg, val);
+-
+-	val = (addr[3] << 16) | (addr[4] << 8) | addr[5];
+-	airoha_fe_wr(eth, REG_FE_MAC_LMIN(reg), val);
+-	airoha_fe_wr(eth, REG_FE_MAC_LMAX(reg), val);
+-}
+-
+-static void airoha_set_gdm_port_fwd_cfg(struct airoha_eth *eth, u32 addr,
+-					u32 val)
+-{
+-	airoha_fe_rmw(eth, addr, GDM_OCFQ_MASK,
+-		      FIELD_PREP(GDM_OCFQ_MASK, val));
+-	airoha_fe_rmw(eth, addr, GDM_MCFQ_MASK,
+-		      FIELD_PREP(GDM_MCFQ_MASK, val));
+-	airoha_fe_rmw(eth, addr, GDM_BCFQ_MASK,
+-		      FIELD_PREP(GDM_BCFQ_MASK, val));
+-	airoha_fe_rmw(eth, addr, GDM_UCFQ_MASK,
+-		      FIELD_PREP(GDM_UCFQ_MASK, val));
+-}
+-
+-static int airoha_set_gdm_port(struct airoha_eth *eth, int port, bool enable)
+-{
+-	u32 val = enable ? FE_PSE_PORT_PPE1 : FE_PSE_PORT_DROP;
+-	u32 vip_port, cfg_addr;
+-
+-	switch (port) {
+-	case XSI_PCIE0_PORT:
+-		vip_port = XSI_PCIE0_VIP_PORT_MASK;
+-		cfg_addr = REG_GDM_FWD_CFG(3);
+-		break;
+-	case XSI_PCIE1_PORT:
+-		vip_port = XSI_PCIE1_VIP_PORT_MASK;
+-		cfg_addr = REG_GDM_FWD_CFG(3);
+-		break;
+-	case XSI_USB_PORT:
+-		vip_port = XSI_USB_VIP_PORT_MASK;
+-		cfg_addr = REG_GDM_FWD_CFG(4);
+-		break;
+-	case XSI_ETH_PORT:
+-		vip_port = XSI_ETH_VIP_PORT_MASK;
+-		cfg_addr = REG_GDM_FWD_CFG(4);
+-		break;
+-	default:
+-		return -EINVAL;
+-	}
+-
+-	if (enable) {
+-		airoha_fe_set(eth, REG_FE_VIP_PORT_EN, vip_port);
+-		airoha_fe_set(eth, REG_FE_IFC_PORT_EN, vip_port);
+-	} else {
+-		airoha_fe_clear(eth, REG_FE_VIP_PORT_EN, vip_port);
+-		airoha_fe_clear(eth, REG_FE_IFC_PORT_EN, vip_port);
+-	}
+-
+-	airoha_set_gdm_port_fwd_cfg(eth, cfg_addr, val);
+-
+-	return 0;
+-}
+-
+-static int airoha_set_gdm_ports(struct airoha_eth *eth, bool enable)
+-{
+-	const int port_list[] = {
+-		XSI_PCIE0_PORT,
+-		XSI_PCIE1_PORT,
+-		XSI_USB_PORT,
+-		XSI_ETH_PORT
+-	};
+-	int i, err;
+-
+-	for (i = 0; i < ARRAY_SIZE(port_list); i++) {
+-		err = airoha_set_gdm_port(eth, port_list[i], enable);
+-		if (err)
+-			goto error;
+-	}
+-
+-	return 0;
+-
+-error:
+-	for (i--; i >= 0; i--)
+-		airoha_set_gdm_port(eth, port_list[i], false);
+-
+-	return err;
+-}
+-
+-static void airoha_fe_maccr_init(struct airoha_eth *eth)
+-{
+-	int p;
+-
+-	for (p = 1; p <= ARRAY_SIZE(eth->ports); p++) {
+-		airoha_fe_set(eth, REG_GDM_FWD_CFG(p),
+-			      GDM_TCP_CKSUM | GDM_UDP_CKSUM | GDM_IP4_CKSUM |
+-			      GDM_DROP_CRC_ERR);
+-		airoha_set_gdm_port_fwd_cfg(eth, REG_GDM_FWD_CFG(p),
+-					    FE_PSE_PORT_CDM1);
+-		airoha_fe_rmw(eth, REG_GDM_LEN_CFG(p),
+-			      GDM_SHORT_LEN_MASK | GDM_LONG_LEN_MASK,
+-			      FIELD_PREP(GDM_SHORT_LEN_MASK, 60) |
+-			      FIELD_PREP(GDM_LONG_LEN_MASK, 4004));
+-	}
+-
+-	airoha_fe_rmw(eth, REG_CDM1_VLAN_CTRL, CDM1_VLAN_MASK,
+-		      FIELD_PREP(CDM1_VLAN_MASK, 0x8100));
+-
+-	airoha_fe_set(eth, REG_FE_CPORT_CFG, FE_CPORT_PAD);
+-}
+-
+-static void airoha_fe_vip_setup(struct airoha_eth *eth)
+-{
+-	airoha_fe_wr(eth, REG_FE_VIP_PATN(3), ETH_P_PPP_DISC);
+-	airoha_fe_wr(eth, REG_FE_VIP_EN(3), PATN_FCPU_EN_MASK | PATN_EN_MASK);
+-
+-	airoha_fe_wr(eth, REG_FE_VIP_PATN(4), PPP_LCP);
+-	airoha_fe_wr(eth, REG_FE_VIP_EN(4),
+-		     PATN_FCPU_EN_MASK | FIELD_PREP(PATN_TYPE_MASK, 1) |
+-		     PATN_EN_MASK);
+-
+-	airoha_fe_wr(eth, REG_FE_VIP_PATN(6), PPP_IPCP);
+-	airoha_fe_wr(eth, REG_FE_VIP_EN(6),
+-		     PATN_FCPU_EN_MASK | FIELD_PREP(PATN_TYPE_MASK, 1) |
+-		     PATN_EN_MASK);
+-
+-	airoha_fe_wr(eth, REG_FE_VIP_PATN(7), PPP_CHAP);
+-	airoha_fe_wr(eth, REG_FE_VIP_EN(7),
+-		     PATN_FCPU_EN_MASK | FIELD_PREP(PATN_TYPE_MASK, 1) |
+-		     PATN_EN_MASK);
+-
+-	/* BOOTP (0x43) */
+-	airoha_fe_wr(eth, REG_FE_VIP_PATN(8), 0x43);
+-	airoha_fe_wr(eth, REG_FE_VIP_EN(8),
+-		     PATN_FCPU_EN_MASK | PATN_SP_EN_MASK |
+-		     FIELD_PREP(PATN_TYPE_MASK, 4) | PATN_EN_MASK);
+-
+-	/* BOOTP (0x44) */
+-	airoha_fe_wr(eth, REG_FE_VIP_PATN(9), 0x44);
+-	airoha_fe_wr(eth, REG_FE_VIP_EN(9),
+-		     PATN_FCPU_EN_MASK | PATN_SP_EN_MASK |
+-		     FIELD_PREP(PATN_TYPE_MASK, 4) | PATN_EN_MASK);
+-
+-	/* ISAKMP */
+-	airoha_fe_wr(eth, REG_FE_VIP_PATN(10), 0x1f401f4);
+-	airoha_fe_wr(eth, REG_FE_VIP_EN(10),
+-		     PATN_FCPU_EN_MASK | PATN_DP_EN_MASK | PATN_SP_EN_MASK |
+-		     FIELD_PREP(PATN_TYPE_MASK, 4) | PATN_EN_MASK);
+-
+-	airoha_fe_wr(eth, REG_FE_VIP_PATN(11), PPP_IPV6CP);
+-	airoha_fe_wr(eth, REG_FE_VIP_EN(11),
+-		     PATN_FCPU_EN_MASK | FIELD_PREP(PATN_TYPE_MASK, 1) |
+-		     PATN_EN_MASK);
+-
+-	/* DHCPv6 */
+-	airoha_fe_wr(eth, REG_FE_VIP_PATN(12), 0x2220223);
+-	airoha_fe_wr(eth, REG_FE_VIP_EN(12),
+-		     PATN_FCPU_EN_MASK | PATN_DP_EN_MASK | PATN_SP_EN_MASK |
+-		     FIELD_PREP(PATN_TYPE_MASK, 4) | PATN_EN_MASK);
+-
+-	airoha_fe_wr(eth, REG_FE_VIP_PATN(19), PPP_PAP);
+-	airoha_fe_wr(eth, REG_FE_VIP_EN(19),
+-		     PATN_FCPU_EN_MASK | FIELD_PREP(PATN_TYPE_MASK, 1) |
+-		     PATN_EN_MASK);
+-
+-	/* ETH->ETH_P_1905 (0x893a) */
+-	airoha_fe_wr(eth, REG_FE_VIP_PATN(20), 0x893a);
+-	airoha_fe_wr(eth, REG_FE_VIP_EN(20),
+-		     PATN_FCPU_EN_MASK | PATN_EN_MASK);
+-
+-	airoha_fe_wr(eth, REG_FE_VIP_PATN(21), ETH_P_LLDP);
+-	airoha_fe_wr(eth, REG_FE_VIP_EN(21),
+-		     PATN_FCPU_EN_MASK | PATN_EN_MASK);
+-}
+-
+-static u32 airoha_fe_get_pse_queue_rsv_pages(struct airoha_eth *eth,
+-					     u32 port, u32 queue)
+-{
+-	u32 val;
+-
+-	airoha_fe_rmw(eth, REG_FE_PSE_QUEUE_CFG_WR,
+-		      PSE_CFG_PORT_ID_MASK | PSE_CFG_QUEUE_ID_MASK,
+-		      FIELD_PREP(PSE_CFG_PORT_ID_MASK, port) |
+-		      FIELD_PREP(PSE_CFG_QUEUE_ID_MASK, queue));
+-	val = airoha_fe_rr(eth, REG_FE_PSE_QUEUE_CFG_VAL);
+-
+-	return FIELD_GET(PSE_CFG_OQ_RSV_MASK, val);
+-}
+-
+-static void airoha_fe_set_pse_queue_rsv_pages(struct airoha_eth *eth,
+-					      u32 port, u32 queue, u32 val)
+-{
+-	airoha_fe_rmw(eth, REG_FE_PSE_QUEUE_CFG_VAL, PSE_CFG_OQ_RSV_MASK,
+-		      FIELD_PREP(PSE_CFG_OQ_RSV_MASK, val));
+-	airoha_fe_rmw(eth, REG_FE_PSE_QUEUE_CFG_WR,
+-		      PSE_CFG_PORT_ID_MASK | PSE_CFG_QUEUE_ID_MASK |
+-		      PSE_CFG_WR_EN_MASK | PSE_CFG_OQRSV_SEL_MASK,
+-		      FIELD_PREP(PSE_CFG_PORT_ID_MASK, port) |
+-		      FIELD_PREP(PSE_CFG_QUEUE_ID_MASK, queue) |
+-		      PSE_CFG_WR_EN_MASK | PSE_CFG_OQRSV_SEL_MASK);
+-}
+-
+-static u32 airoha_fe_get_pse_all_rsv(struct airoha_eth *eth)
+-{
+-	u32 val = airoha_fe_rr(eth, REG_FE_PSE_BUF_SET);
+-
+-	return FIELD_GET(PSE_ALLRSV_MASK, val);
+-}
+-
+-static int airoha_fe_set_pse_oq_rsv(struct airoha_eth *eth,
+-				    u32 port, u32 queue, u32 val)
+-{
+-	u32 orig_val = airoha_fe_get_pse_queue_rsv_pages(eth, port, queue);
+-	u32 tmp, all_rsv, fq_limit;
+-
+-	airoha_fe_set_pse_queue_rsv_pages(eth, port, queue, val);
+-
+-	/* modify all rsv */
+-	all_rsv = airoha_fe_get_pse_all_rsv(eth);
+-	all_rsv += (val - orig_val);
+-	airoha_fe_rmw(eth, REG_FE_PSE_BUF_SET, PSE_ALLRSV_MASK,
+-		      FIELD_PREP(PSE_ALLRSV_MASK, all_rsv));
+-
+-	/* modify hthd */
+-	tmp = airoha_fe_rr(eth, PSE_FQ_CFG);
+-	fq_limit = FIELD_GET(PSE_FQ_LIMIT_MASK, tmp);
+-	tmp = fq_limit - all_rsv - 0x20;
+-	airoha_fe_rmw(eth, REG_PSE_SHARE_USED_THD,
+-		      PSE_SHARE_USED_HTHD_MASK,
+-		      FIELD_PREP(PSE_SHARE_USED_HTHD_MASK, tmp));
+-
+-	tmp = fq_limit - all_rsv - 0x100;
+-	airoha_fe_rmw(eth, REG_PSE_SHARE_USED_THD,
+-		      PSE_SHARE_USED_MTHD_MASK,
+-		      FIELD_PREP(PSE_SHARE_USED_MTHD_MASK, tmp));
+-	tmp = (3 * tmp) >> 2;
+-	airoha_fe_rmw(eth, REG_FE_PSE_BUF_SET,
+-		      PSE_SHARE_USED_LTHD_MASK,
+-		      FIELD_PREP(PSE_SHARE_USED_LTHD_MASK, tmp));
+-
+-	return 0;
+-}
+-
+-static void airoha_fe_pse_ports_init(struct airoha_eth *eth)
+-{
+-	const u32 pse_port_num_queues[] = {
+-		[FE_PSE_PORT_CDM1] = 6,
+-		[FE_PSE_PORT_GDM1] = 6,
+-		[FE_PSE_PORT_GDM2] = 32,
+-		[FE_PSE_PORT_GDM3] = 6,
+-		[FE_PSE_PORT_PPE1] = 4,
+-		[FE_PSE_PORT_CDM2] = 6,
+-		[FE_PSE_PORT_CDM3] = 8,
+-		[FE_PSE_PORT_CDM4] = 10,
+-		[FE_PSE_PORT_PPE2] = 4,
+-		[FE_PSE_PORT_GDM4] = 2,
+-		[FE_PSE_PORT_CDM5] = 2,
+-	};
+-	u32 all_rsv;
+-	int q;
+-
+-	all_rsv = airoha_fe_get_pse_all_rsv(eth);
+-	/* hw misses PPE2 oq rsv */
+-	all_rsv += PSE_RSV_PAGES * pse_port_num_queues[FE_PSE_PORT_PPE2];
+-	airoha_fe_set(eth, REG_FE_PSE_BUF_SET, all_rsv);
+-
+-	/* CMD1 */
+-	for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_CDM1]; q++)
+-		airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_CDM1, q,
+-					 PSE_QUEUE_RSV_PAGES);
+-	/* GMD1 */
+-	for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_GDM1]; q++)
+-		airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_GDM1, q,
+-					 PSE_QUEUE_RSV_PAGES);
+-	/* GMD2 */
+-	for (q = 6; q < pse_port_num_queues[FE_PSE_PORT_GDM2]; q++)
+-		airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_GDM2, q, 0);
+-	/* GMD3 */
+-	for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_GDM3]; q++)
+-		airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_GDM3, q,
+-					 PSE_QUEUE_RSV_PAGES);
+-	/* PPE1 */
+-	for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_PPE1]; q++) {
+-		if (q < pse_port_num_queues[FE_PSE_PORT_PPE1])
+-			airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_PPE1, q,
+-						 PSE_QUEUE_RSV_PAGES);
+-		else
+-			airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_PPE1, q, 0);
+-	}
+-	/* CDM2 */
+-	for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_CDM2]; q++)
+-		airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_CDM2, q,
+-					 PSE_QUEUE_RSV_PAGES);
+-	/* CDM3 */
+-	for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_CDM3] - 1; q++)
+-		airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_CDM3, q, 0);
+-	/* CDM4 */
+-	for (q = 4; q < pse_port_num_queues[FE_PSE_PORT_CDM4]; q++)
+-		airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_CDM4, q,
+-					 PSE_QUEUE_RSV_PAGES);
+-	/* PPE2 */
+-	for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_PPE2]; q++) {
+-		if (q < pse_port_num_queues[FE_PSE_PORT_PPE2] / 2)
+-			airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_PPE2, q,
+-						 PSE_QUEUE_RSV_PAGES);
+-		else
+-			airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_PPE2, q, 0);
+-	}
+-	/* GMD4 */
+-	for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_GDM4]; q++)
+-		airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_GDM4, q,
+-					 PSE_QUEUE_RSV_PAGES);
+-	/* CDM5 */
+-	for (q = 0; q < pse_port_num_queues[FE_PSE_PORT_CDM5]; q++)
+-		airoha_fe_set_pse_oq_rsv(eth, FE_PSE_PORT_CDM5, q,
+-					 PSE_QUEUE_RSV_PAGES);
+-}
+-
+-static int airoha_fe_mc_vlan_clear(struct airoha_eth *eth)
+-{
+-	int i;
+-
+-	for (i = 0; i < AIROHA_FE_MC_MAX_VLAN_TABLE; i++) {
+-		int err, j;
+-		u32 val;
+-
+-		airoha_fe_wr(eth, REG_MC_VLAN_DATA, 0x0);
+-
+-		val = FIELD_PREP(MC_VLAN_CFG_TABLE_ID_MASK, i) |
+-		      MC_VLAN_CFG_TABLE_SEL_MASK | MC_VLAN_CFG_RW_MASK;
+-		airoha_fe_wr(eth, REG_MC_VLAN_CFG, val);
+-		err = read_poll_timeout(airoha_fe_rr, val,
+-					val & MC_VLAN_CFG_CMD_DONE_MASK,
+-					USEC_PER_MSEC, 5 * USEC_PER_MSEC,
+-					false, eth, REG_MC_VLAN_CFG);
+-		if (err)
+-			return err;
+-
+-		for (j = 0; j < AIROHA_FE_MC_MAX_VLAN_PORT; j++) {
+-			airoha_fe_wr(eth, REG_MC_VLAN_DATA, 0x0);
+-
+-			val = FIELD_PREP(MC_VLAN_CFG_TABLE_ID_MASK, i) |
+-			      FIELD_PREP(MC_VLAN_CFG_PORT_ID_MASK, j) |
+-			      MC_VLAN_CFG_RW_MASK;
+-			airoha_fe_wr(eth, REG_MC_VLAN_CFG, val);
+-			err = read_poll_timeout(airoha_fe_rr, val,
+-						val & MC_VLAN_CFG_CMD_DONE_MASK,
+-						USEC_PER_MSEC,
+-						5 * USEC_PER_MSEC, false, eth,
+-						REG_MC_VLAN_CFG);
+-			if (err)
+-				return err;
+-		}
+-	}
+-
+-	return 0;
+-}
+-
+-static void airoha_fe_crsn_qsel_init(struct airoha_eth *eth)
+-{
+-	/* CDM1_CRSN_QSEL */
+-	airoha_fe_rmw(eth, REG_CDM1_CRSN_QSEL(CRSN_22 >> 2),
+-		      CDM1_CRSN_QSEL_REASON_MASK(CRSN_22),
+-		      FIELD_PREP(CDM1_CRSN_QSEL_REASON_MASK(CRSN_22),
+-				 CDM_CRSN_QSEL_Q1));
+-	airoha_fe_rmw(eth, REG_CDM1_CRSN_QSEL(CRSN_08 >> 2),
+-		      CDM1_CRSN_QSEL_REASON_MASK(CRSN_08),
+-		      FIELD_PREP(CDM1_CRSN_QSEL_REASON_MASK(CRSN_08),
+-				 CDM_CRSN_QSEL_Q1));
+-	airoha_fe_rmw(eth, REG_CDM1_CRSN_QSEL(CRSN_21 >> 2),
+-		      CDM1_CRSN_QSEL_REASON_MASK(CRSN_21),
+-		      FIELD_PREP(CDM1_CRSN_QSEL_REASON_MASK(CRSN_21),
+-				 CDM_CRSN_QSEL_Q1));
+-	airoha_fe_rmw(eth, REG_CDM1_CRSN_QSEL(CRSN_24 >> 2),
+-		      CDM1_CRSN_QSEL_REASON_MASK(CRSN_24),
+-		      FIELD_PREP(CDM1_CRSN_QSEL_REASON_MASK(CRSN_24),
+-				 CDM_CRSN_QSEL_Q6));
+-	airoha_fe_rmw(eth, REG_CDM1_CRSN_QSEL(CRSN_25 >> 2),
+-		      CDM1_CRSN_QSEL_REASON_MASK(CRSN_25),
+-		      FIELD_PREP(CDM1_CRSN_QSEL_REASON_MASK(CRSN_25),
+-				 CDM_CRSN_QSEL_Q1));
+-	/* CDM2_CRSN_QSEL */
+-	airoha_fe_rmw(eth, REG_CDM2_CRSN_QSEL(CRSN_08 >> 2),
+-		      CDM2_CRSN_QSEL_REASON_MASK(CRSN_08),
+-		      FIELD_PREP(CDM2_CRSN_QSEL_REASON_MASK(CRSN_08),
+-				 CDM_CRSN_QSEL_Q1));
+-	airoha_fe_rmw(eth, REG_CDM2_CRSN_QSEL(CRSN_21 >> 2),
+-		      CDM2_CRSN_QSEL_REASON_MASK(CRSN_21),
+-		      FIELD_PREP(CDM2_CRSN_QSEL_REASON_MASK(CRSN_21),
+-				 CDM_CRSN_QSEL_Q1));
+-	airoha_fe_rmw(eth, REG_CDM2_CRSN_QSEL(CRSN_22 >> 2),
+-		      CDM2_CRSN_QSEL_REASON_MASK(CRSN_22),
+-		      FIELD_PREP(CDM2_CRSN_QSEL_REASON_MASK(CRSN_22),
+-				 CDM_CRSN_QSEL_Q1));
+-	airoha_fe_rmw(eth, REG_CDM2_CRSN_QSEL(CRSN_24 >> 2),
+-		      CDM2_CRSN_QSEL_REASON_MASK(CRSN_24),
+-		      FIELD_PREP(CDM2_CRSN_QSEL_REASON_MASK(CRSN_24),
+-				 CDM_CRSN_QSEL_Q6));
+-	airoha_fe_rmw(eth, REG_CDM2_CRSN_QSEL(CRSN_25 >> 2),
+-		      CDM2_CRSN_QSEL_REASON_MASK(CRSN_25),
+-		      FIELD_PREP(CDM2_CRSN_QSEL_REASON_MASK(CRSN_25),
+-				 CDM_CRSN_QSEL_Q1));
+-}
+-
+-static int airoha_fe_init(struct airoha_eth *eth)
+-{
+-	airoha_fe_maccr_init(eth);
+-
+-	/* PSE IQ reserve */
+-	airoha_fe_rmw(eth, REG_PSE_IQ_REV1, PSE_IQ_RES1_P2_MASK,
+-		      FIELD_PREP(PSE_IQ_RES1_P2_MASK, 0x10));
+-	airoha_fe_rmw(eth, REG_PSE_IQ_REV2,
+-		      PSE_IQ_RES2_P5_MASK | PSE_IQ_RES2_P4_MASK,
+-		      FIELD_PREP(PSE_IQ_RES2_P5_MASK, 0x40) |
+-		      FIELD_PREP(PSE_IQ_RES2_P4_MASK, 0x34));
+-
+-	/* enable FE copy engine for MC/KA/DPI */
+-	airoha_fe_wr(eth, REG_FE_PCE_CFG,
+-		     PCE_DPI_EN_MASK | PCE_KA_EN_MASK | PCE_MC_EN_MASK);
+-	/* set vip queue selection to ring 1 */
+-	airoha_fe_rmw(eth, REG_CDM1_FWD_CFG, CDM1_VIP_QSEL_MASK,
+-		      FIELD_PREP(CDM1_VIP_QSEL_MASK, 0x4));
+-	airoha_fe_rmw(eth, REG_CDM2_FWD_CFG, CDM2_VIP_QSEL_MASK,
+-		      FIELD_PREP(CDM2_VIP_QSEL_MASK, 0x4));
+-	/* set GDM4 source interface offset to 8 */
+-	airoha_fe_rmw(eth, REG_GDM4_SRC_PORT_SET,
+-		      GDM4_SPORT_OFF2_MASK |
+-		      GDM4_SPORT_OFF1_MASK |
+-		      GDM4_SPORT_OFF0_MASK,
+-		      FIELD_PREP(GDM4_SPORT_OFF2_MASK, 8) |
+-		      FIELD_PREP(GDM4_SPORT_OFF1_MASK, 8) |
+-		      FIELD_PREP(GDM4_SPORT_OFF0_MASK, 8));
+-
+-	/* set PSE Page as 128B */
+-	airoha_fe_rmw(eth, REG_FE_DMA_GLO_CFG,
+-		      FE_DMA_GLO_L2_SPACE_MASK | FE_DMA_GLO_PG_SZ_MASK,
+-		      FIELD_PREP(FE_DMA_GLO_L2_SPACE_MASK, 2) |
+-		      FE_DMA_GLO_PG_SZ_MASK);
+-	airoha_fe_wr(eth, REG_FE_RST_GLO_CFG,
+-		     FE_RST_CORE_MASK | FE_RST_GDM3_MBI_ARB_MASK |
+-		     FE_RST_GDM4_MBI_ARB_MASK);
+-	usleep_range(1000, 2000);
+-
+-	/* connect RxRing1 and RxRing15 to PSE Port0 OQ-1
+-	 * connect other rings to PSE Port0 OQ-0
+-	 */
+-	airoha_fe_wr(eth, REG_FE_CDM1_OQ_MAP0, BIT(4));
+-	airoha_fe_wr(eth, REG_FE_CDM1_OQ_MAP1, BIT(28));
+-	airoha_fe_wr(eth, REG_FE_CDM1_OQ_MAP2, BIT(4));
+-	airoha_fe_wr(eth, REG_FE_CDM1_OQ_MAP3, BIT(28));
+-
+-	airoha_fe_vip_setup(eth);
+-	airoha_fe_pse_ports_init(eth);
+-
+-	airoha_fe_set(eth, REG_GDM_MISC_CFG,
+-		      GDM2_RDM_ACK_WAIT_PREF_MASK |
+-		      GDM2_CHN_VLD_MODE_MASK);
+-	airoha_fe_rmw(eth, REG_CDM2_FWD_CFG, CDM2_OAM_QSEL_MASK,
+-		      FIELD_PREP(CDM2_OAM_QSEL_MASK, 15));
+-
+-	/* init fragment and assemble Force Port */
+-	/* NPU Core-3, NPU Bridge Channel-3 */
+-	airoha_fe_rmw(eth, REG_IP_FRAG_FP,
+-		      IP_FRAGMENT_PORT_MASK | IP_FRAGMENT_NBQ_MASK,
+-		      FIELD_PREP(IP_FRAGMENT_PORT_MASK, 6) |
+-		      FIELD_PREP(IP_FRAGMENT_NBQ_MASK, 3));
+-	/* QDMA LAN, RX Ring-22 */
+-	airoha_fe_rmw(eth, REG_IP_FRAG_FP,
+-		      IP_ASSEMBLE_PORT_MASK | IP_ASSEMBLE_NBQ_MASK,
+-		      FIELD_PREP(IP_ASSEMBLE_PORT_MASK, 0) |
+-		      FIELD_PREP(IP_ASSEMBLE_NBQ_MASK, 22));
+-
+-	airoha_fe_set(eth, REG_GDM3_FWD_CFG, GDM3_PAD_EN_MASK);
+-	airoha_fe_set(eth, REG_GDM4_FWD_CFG, GDM4_PAD_EN_MASK);
+-
+-	airoha_fe_crsn_qsel_init(eth);
+-
+-	airoha_fe_clear(eth, REG_FE_CPORT_CFG, FE_CPORT_QUEUE_XFC_MASK);
+-	airoha_fe_set(eth, REG_FE_CPORT_CFG, FE_CPORT_PORT_XFC_MASK);
+-
+-	/* default aging mode for mbi unlock issue */
+-	airoha_fe_rmw(eth, REG_GDM2_CHN_RLS,
+-		      MBI_RX_AGE_SEL_MASK | MBI_TX_AGE_SEL_MASK,
+-		      FIELD_PREP(MBI_RX_AGE_SEL_MASK, 3) |
+-		      FIELD_PREP(MBI_TX_AGE_SEL_MASK, 3));
+-
+-	/* disable IFC by default */
+-	airoha_fe_clear(eth, REG_FE_CSR_IFC_CFG, FE_IFC_EN_MASK);
+-
+-	/* enable 1:N vlan action, init vlan table */
+-	airoha_fe_set(eth, REG_MC_VLAN_EN, MC_VLAN_EN_MASK);
+-
+-	return airoha_fe_mc_vlan_clear(eth);
+-}
+-
+-static int airoha_qdma_fill_rx_queue(struct airoha_queue *q)
+-{
+-	enum dma_data_direction dir = page_pool_get_dma_dir(q->page_pool);
+-	struct airoha_qdma *qdma = q->qdma;
+-	struct airoha_eth *eth = qdma->eth;
+-	int qid = q - &qdma->q_rx[0];
+-	int nframes = 0;
+-
+-	while (q->queued < q->ndesc - 1) {
+-		struct airoha_queue_entry *e = &q->entry[q->head];
+-		struct airoha_qdma_desc *desc = &q->desc[q->head];
+-		struct page *page;
+-		int offset;
+-		u32 val;
+-
+-		page = page_pool_dev_alloc_frag(q->page_pool, &offset,
+-						q->buf_size);
+-		if (!page)
+-			break;
+-
+-		q->head = (q->head + 1) % q->ndesc;
+-		q->queued++;
+-		nframes++;
+-
+-		e->buf = page_address(page) + offset;
+-		e->dma_addr = page_pool_get_dma_addr(page) + offset;
+-		e->dma_len = SKB_WITH_OVERHEAD(q->buf_size);
+-
+-		dma_sync_single_for_device(eth->dev, e->dma_addr, e->dma_len,
+-					   dir);
+-
+-		val = FIELD_PREP(QDMA_DESC_LEN_MASK, e->dma_len);
+-		WRITE_ONCE(desc->ctrl, cpu_to_le32(val));
+-		WRITE_ONCE(desc->addr, cpu_to_le32(e->dma_addr));
+-		val = FIELD_PREP(QDMA_DESC_NEXT_ID_MASK, q->head);
+-		WRITE_ONCE(desc->data, cpu_to_le32(val));
+-		WRITE_ONCE(desc->msg0, 0);
+-		WRITE_ONCE(desc->msg1, 0);
+-		WRITE_ONCE(desc->msg2, 0);
+-		WRITE_ONCE(desc->msg3, 0);
+-
+-		airoha_qdma_rmw(qdma, REG_RX_CPU_IDX(qid),
+-				RX_RING_CPU_IDX_MASK,
+-				FIELD_PREP(RX_RING_CPU_IDX_MASK, q->head));
+-	}
+-
+-	return nframes;
+-}
+-
+-static int airoha_qdma_get_gdm_port(struct airoha_eth *eth,
+-				    struct airoha_qdma_desc *desc)
+-{
+-	u32 port, sport, msg1 = le32_to_cpu(desc->msg1);
+-
+-	sport = FIELD_GET(QDMA_ETH_RXMSG_SPORT_MASK, msg1);
+-	switch (sport) {
+-	case 0x10 ... 0x13:
+-		port = 0;
+-		break;
+-	case 0x2 ... 0x4:
+-		port = sport - 1;
+-		break;
+-	default:
+-		return -EINVAL;
+-	}
+-
+-	return port >= ARRAY_SIZE(eth->ports) ? -EINVAL : port;
+-}
+-
+-static int airoha_qdma_rx_process(struct airoha_queue *q, int budget)
+-{
+-	enum dma_data_direction dir = page_pool_get_dma_dir(q->page_pool);
+-	struct airoha_qdma *qdma = q->qdma;
+-	struct airoha_eth *eth = qdma->eth;
+-	int qid = q - &qdma->q_rx[0];
+-	int done = 0;
+-
+-	while (done < budget) {
+-		struct airoha_queue_entry *e = &q->entry[q->tail];
+-		struct airoha_qdma_desc *desc = &q->desc[q->tail];
+-		dma_addr_t dma_addr = le32_to_cpu(desc->addr);
+-		u32 desc_ctrl = le32_to_cpu(desc->ctrl);
+-		struct sk_buff *skb;
+-		int len, p;
+-
+-		if (!(desc_ctrl & QDMA_DESC_DONE_MASK))
+-			break;
+-
+-		if (!dma_addr)
+-			break;
+-
+-		len = FIELD_GET(QDMA_DESC_LEN_MASK, desc_ctrl);
+-		if (!len)
+-			break;
+-
+-		q->tail = (q->tail + 1) % q->ndesc;
+-		q->queued--;
+-
+-		dma_sync_single_for_cpu(eth->dev, dma_addr,
+-					SKB_WITH_OVERHEAD(q->buf_size), dir);
+-
+-		p = airoha_qdma_get_gdm_port(eth, desc);
+-		if (p < 0 || !eth->ports[p]) {
+-			page_pool_put_full_page(q->page_pool,
+-						virt_to_head_page(e->buf),
+-						true);
+-			continue;
+-		}
+-
+-		skb = napi_build_skb(e->buf, q->buf_size);
+-		if (!skb) {
+-			page_pool_put_full_page(q->page_pool,
+-						virt_to_head_page(e->buf),
+-						true);
+-			break;
+-		}
+-
+-		skb_reserve(skb, 2);
+-		__skb_put(skb, len);
+-		skb_mark_for_recycle(skb);
+-		skb->dev = eth->ports[p]->dev;
+-		skb->protocol = eth_type_trans(skb, skb->dev);
+-		skb->ip_summed = CHECKSUM_UNNECESSARY;
+-		skb_record_rx_queue(skb, qid);
+-		napi_gro_receive(&q->napi, skb);
+-
+-		done++;
+-	}
+-	airoha_qdma_fill_rx_queue(q);
+-
+-	return done;
+-}
+-
+-static int airoha_qdma_rx_napi_poll(struct napi_struct *napi, int budget)
+-{
+-	struct airoha_queue *q = container_of(napi, struct airoha_queue, napi);
+-	int cur, done = 0;
+-
+-	do {
+-		cur = airoha_qdma_rx_process(q, budget - done);
+-		done += cur;
+-	} while (cur && done < budget);
+-
+-	if (done < budget && napi_complete(napi))
+-		airoha_qdma_irq_enable(q->qdma, QDMA_INT_REG_IDX1,
+-				       RX_DONE_INT_MASK);
+-
+-	return done;
+-}
+-
+-static int airoha_qdma_init_rx_queue(struct airoha_queue *q,
+-				     struct airoha_qdma *qdma, int ndesc)
+-{
+-	const struct page_pool_params pp_params = {
+-		.order = 0,
+-		.pool_size = 256,
+-		.flags = PP_FLAG_DMA_MAP | PP_FLAG_DMA_SYNC_DEV |
+-			 PP_FLAG_PAGE_FRAG,
+-		.dma_dir = DMA_FROM_DEVICE,
+-		.max_len = PAGE_SIZE,
+-		.nid = NUMA_NO_NODE,
+-		.dev = qdma->eth->dev,
+-		.napi = &q->napi,
+-	};
+-	struct airoha_eth *eth = qdma->eth;
+-	int qid = q - &qdma->q_rx[0], thr;
+-	dma_addr_t dma_addr;
+-
+-	q->buf_size = PAGE_SIZE / 2;
+-	q->ndesc = ndesc;
+-	q->qdma = qdma;
+-
+-	q->entry = devm_kzalloc(eth->dev, q->ndesc * sizeof(*q->entry),
+-				GFP_KERNEL);
+-	if (!q->entry)
+-		return -ENOMEM;
+-
+-	q->page_pool = page_pool_create(&pp_params);
+-	if (IS_ERR(q->page_pool)) {
+-		int err = PTR_ERR(q->page_pool);
+-
+-		q->page_pool = NULL;
+-		return err;
+-	}
+-
+-	q->desc = dmam_alloc_coherent(eth->dev, q->ndesc * sizeof(*q->desc),
+-				      &dma_addr, GFP_KERNEL);
+-	if (!q->desc)
+-		return -ENOMEM;
+-
+-	netif_napi_add(eth->napi_dev, &q->napi, airoha_qdma_rx_napi_poll);
+-
+-	airoha_qdma_wr(qdma, REG_RX_RING_BASE(qid), dma_addr);
+-	airoha_qdma_rmw(qdma, REG_RX_RING_SIZE(qid),
+-			RX_RING_SIZE_MASK,
+-			FIELD_PREP(RX_RING_SIZE_MASK, ndesc));
+-
+-	thr = clamp(ndesc >> 3, 1, 32);
+-	airoha_qdma_rmw(qdma, REG_RX_RING_SIZE(qid), RX_RING_THR_MASK,
+-			FIELD_PREP(RX_RING_THR_MASK, thr));
+-	airoha_qdma_rmw(qdma, REG_RX_DMA_IDX(qid), RX_RING_DMA_IDX_MASK,
+-			FIELD_PREP(RX_RING_DMA_IDX_MASK, q->head));
+-
+-	airoha_qdma_fill_rx_queue(q);
+-
+-	return 0;
+-}
+-
+-static void airoha_qdma_cleanup_rx_queue(struct airoha_queue *q)
+-{
+-	struct airoha_eth *eth = q->qdma->eth;
+-
+-	while (q->queued) {
+-		struct airoha_queue_entry *e = &q->entry[q->tail];
+-		struct page *page = virt_to_head_page(e->buf);
+-
+-		dma_sync_single_for_cpu(eth->dev, e->dma_addr, e->dma_len,
+-					page_pool_get_dma_dir(q->page_pool));
+-		page_pool_put_full_page(q->page_pool, page, false);
+-		q->tail = (q->tail + 1) % q->ndesc;
+-		q->queued--;
+-	}
+-}
+-
+-static int airoha_qdma_init_rx(struct airoha_qdma *qdma)
+-{
+-	int i;
+-
+-	for (i = 0; i < ARRAY_SIZE(qdma->q_rx); i++) {
+-		int err;
+-
+-		if (!(RX_DONE_INT_MASK & BIT(i))) {
+-			/* rx-queue not binded to irq */
+-			continue;
+-		}
+-
+-		err = airoha_qdma_init_rx_queue(&qdma->q_rx[i], qdma,
+-						RX_DSCP_NUM(i));
+-		if (err)
+-			return err;
+-	}
+-
+-	return 0;
+-}
+-
+-static int airoha_qdma_tx_napi_poll(struct napi_struct *napi, int budget)
+-{
+-	struct airoha_tx_irq_queue *irq_q;
+-	int id, done = 0, irq_queued;
+-	struct airoha_qdma *qdma;
+-	struct airoha_eth *eth;
+-	u32 status, head;
+-
+-	irq_q = container_of(napi, struct airoha_tx_irq_queue, napi);
+-	qdma = irq_q->qdma;
+-	id = irq_q - &qdma->q_tx_irq[0];
+-	eth = qdma->eth;
+-
+-	status = airoha_qdma_rr(qdma, REG_IRQ_STATUS(id));
+-	head = FIELD_GET(IRQ_HEAD_IDX_MASK, status);
+-	head = head % irq_q->size;
+-	irq_queued = FIELD_GET(IRQ_ENTRY_LEN_MASK, status);
+-
+-	while (irq_queued > 0 && done < budget) {
+-		u32 qid, val = irq_q->q[head];
+-		struct airoha_qdma_desc *desc;
+-		struct airoha_queue_entry *e;
+-		struct airoha_queue *q;
+-		u32 index, desc_ctrl;
+-		struct sk_buff *skb;
+-
+-		if (val == 0xff)
+-			break;
+-
+-		irq_q->q[head] = 0xff; /* mark as done */
+-		head = (head + 1) % irq_q->size;
+-		irq_queued--;
+-		done++;
+-
+-		qid = FIELD_GET(IRQ_RING_IDX_MASK, val);
+-		if (qid >= ARRAY_SIZE(qdma->q_tx))
+-			continue;
+-
+-		q = &qdma->q_tx[qid];
+-		if (!q->ndesc)
+-			continue;
+-
+-		index = FIELD_GET(IRQ_DESC_IDX_MASK, val);
+-		if (index >= q->ndesc)
+-			continue;
+-
+-		spin_lock_bh(&q->lock);
+-
+-		if (!q->queued)
+-			goto unlock;
+-
+-		desc = &q->desc[index];
+-		desc_ctrl = le32_to_cpu(desc->ctrl);
+-
+-		if (!(desc_ctrl & QDMA_DESC_DONE_MASK) &&
+-		    !(desc_ctrl & QDMA_DESC_DROP_MASK))
+-			goto unlock;
+-
+-		e = &q->entry[index];
+-		skb = e->skb;
+-
+-		dma_unmap_single(eth->dev, e->dma_addr, e->dma_len,
+-				 DMA_TO_DEVICE);
+-		memset(e, 0, sizeof(*e));
+-		WRITE_ONCE(desc->msg0, 0);
+-		WRITE_ONCE(desc->msg1, 0);
+-		q->queued--;
+-
+-		/* completion ring can report out-of-order indexes if hw QoS
+-		 * is enabled and packets with different priority are queued
+-		 * to same DMA ring. Take into account possible out-of-order
+-		 * reports incrementing DMA ring tail pointer
+-		 */
+-		while (q->tail != q->head && !q->entry[q->tail].dma_addr)
+-			q->tail = (q->tail + 1) % q->ndesc;
+-
+-		if (skb) {
+-			u16 queue = skb_get_queue_mapping(skb);
+-			struct netdev_queue *txq;
+-
+-			txq = netdev_get_tx_queue(skb->dev, queue);
+-			netdev_tx_completed_queue(txq, 1, skb->len);
+-			if (netif_tx_queue_stopped(txq) &&
+-			    q->ndesc - q->queued >= q->free_thr)
+-				netif_tx_wake_queue(txq);
+-
+-			dev_kfree_skb_any(skb);
+-		}
+-unlock:
+-		spin_unlock_bh(&q->lock);
+-	}
+-
+-	if (done) {
+-		int i, len = done >> 7;
+-
+-		for (i = 0; i < len; i++)
+-			airoha_qdma_rmw(qdma, REG_IRQ_CLEAR_LEN(id),
+-					IRQ_CLEAR_LEN_MASK, 0x80);
+-		airoha_qdma_rmw(qdma, REG_IRQ_CLEAR_LEN(id),
+-				IRQ_CLEAR_LEN_MASK, (done & 0x7f));
+-	}
+-
+-	if (done < budget && napi_complete(napi))
+-		airoha_qdma_irq_enable(qdma, QDMA_INT_REG_IDX0,
+-				       TX_DONE_INT_MASK(id));
+-
+-	return done;
+-}
+-
+-static int airoha_qdma_init_tx_queue(struct airoha_queue *q,
+-				     struct airoha_qdma *qdma, int size)
+-{
+-	struct airoha_eth *eth = qdma->eth;
+-	int i, qid = q - &qdma->q_tx[0];
+-	dma_addr_t dma_addr;
+-
+-	spin_lock_init(&q->lock);
+-	q->ndesc = size;
+-	q->qdma = qdma;
+-	q->free_thr = 1 + MAX_SKB_FRAGS;
+-
+-	q->entry = devm_kzalloc(eth->dev, q->ndesc * sizeof(*q->entry),
+-				GFP_KERNEL);
+-	if (!q->entry)
+-		return -ENOMEM;
+-
+-	q->desc = dmam_alloc_coherent(eth->dev, q->ndesc * sizeof(*q->desc),
+-				      &dma_addr, GFP_KERNEL);
+-	if (!q->desc)
+-		return -ENOMEM;
+-
+-	for (i = 0; i < q->ndesc; i++) {
+-		u32 val;
+-
+-		val = FIELD_PREP(QDMA_DESC_DONE_MASK, 1);
+-		WRITE_ONCE(q->desc[i].ctrl, cpu_to_le32(val));
+-	}
+-
+-	/* xmit ring drop default setting */
+-	airoha_qdma_set(qdma, REG_TX_RING_BLOCKING(qid),
+-			TX_RING_IRQ_BLOCKING_TX_DROP_EN_MASK);
+-
+-	airoha_qdma_wr(qdma, REG_TX_RING_BASE(qid), dma_addr);
+-	airoha_qdma_rmw(qdma, REG_TX_CPU_IDX(qid), TX_RING_CPU_IDX_MASK,
+-			FIELD_PREP(TX_RING_CPU_IDX_MASK, q->head));
+-	airoha_qdma_rmw(qdma, REG_TX_DMA_IDX(qid), TX_RING_DMA_IDX_MASK,
+-			FIELD_PREP(TX_RING_DMA_IDX_MASK, q->head));
+-
+-	return 0;
+-}
+-
+-static int airoha_qdma_tx_irq_init(struct airoha_tx_irq_queue *irq_q,
+-				   struct airoha_qdma *qdma, int size)
+-{
+-	int id = irq_q - &qdma->q_tx_irq[0];
+-	struct airoha_eth *eth = qdma->eth;
+-	dma_addr_t dma_addr;
+-
+-	netif_napi_add_tx(eth->napi_dev, &irq_q->napi,
+-			  airoha_qdma_tx_napi_poll);
+-	irq_q->q = dmam_alloc_coherent(eth->dev, size * sizeof(u32),
+-				       &dma_addr, GFP_KERNEL);
+-	if (!irq_q->q)
+-		return -ENOMEM;
+-
+-	memset(irq_q->q, 0xff, size * sizeof(u32));
+-	irq_q->size = size;
+-	irq_q->qdma = qdma;
+-
+-	airoha_qdma_wr(qdma, REG_TX_IRQ_BASE(id), dma_addr);
+-	airoha_qdma_rmw(qdma, REG_TX_IRQ_CFG(id), TX_IRQ_DEPTH_MASK,
+-			FIELD_PREP(TX_IRQ_DEPTH_MASK, size));
+-	airoha_qdma_rmw(qdma, REG_TX_IRQ_CFG(id), TX_IRQ_THR_MASK,
+-			FIELD_PREP(TX_IRQ_THR_MASK, 1));
+-
+-	return 0;
+-}
+-
+-static int airoha_qdma_init_tx(struct airoha_qdma *qdma)
+-{
+-	int i, err;
+-
+-	for (i = 0; i < ARRAY_SIZE(qdma->q_tx_irq); i++) {
+-		err = airoha_qdma_tx_irq_init(&qdma->q_tx_irq[i], qdma,
+-					      IRQ_QUEUE_LEN(i));
+-		if (err)
+-			return err;
+-	}
+-
+-	for (i = 0; i < ARRAY_SIZE(qdma->q_tx); i++) {
+-		err = airoha_qdma_init_tx_queue(&qdma->q_tx[i], qdma,
+-						TX_DSCP_NUM);
+-		if (err)
+-			return err;
+-	}
+-
+-	return 0;
+-}
+-
+-static void airoha_qdma_cleanup_tx_queue(struct airoha_queue *q)
+-{
+-	struct airoha_eth *eth = q->qdma->eth;
+-
+-	spin_lock_bh(&q->lock);
+-	while (q->queued) {
+-		struct airoha_queue_entry *e = &q->entry[q->tail];
+-
+-		dma_unmap_single(eth->dev, e->dma_addr, e->dma_len,
+-				 DMA_TO_DEVICE);
+-		dev_kfree_skb_any(e->skb);
+-		e->skb = NULL;
+-
+-		q->tail = (q->tail + 1) % q->ndesc;
+-		q->queued--;
+-	}
+-	spin_unlock_bh(&q->lock);
+-}
+-
+-static int airoha_qdma_init_hfwd_queues(struct airoha_qdma *qdma)
+-{
+-	struct airoha_eth *eth = qdma->eth;
+-	dma_addr_t dma_addr;
+-	u32 status;
+-	int size;
+-
+-	size = HW_DSCP_NUM * sizeof(struct airoha_qdma_fwd_desc);
+-	qdma->hfwd.desc = dmam_alloc_coherent(eth->dev, size, &dma_addr,
+-					      GFP_KERNEL);
+-	if (!qdma->hfwd.desc)
+-		return -ENOMEM;
+-
+-	airoha_qdma_wr(qdma, REG_FWD_DSCP_BASE, dma_addr);
+-
+-	size = AIROHA_MAX_PACKET_SIZE * HW_DSCP_NUM;
+-	qdma->hfwd.q = dmam_alloc_coherent(eth->dev, size, &dma_addr,
+-					   GFP_KERNEL);
+-	if (!qdma->hfwd.q)
+-		return -ENOMEM;
+-
+-	airoha_qdma_wr(qdma, REG_FWD_BUF_BASE, dma_addr);
+-
+-	airoha_qdma_rmw(qdma, REG_HW_FWD_DSCP_CFG,
+-			HW_FWD_DSCP_PAYLOAD_SIZE_MASK,
+-			FIELD_PREP(HW_FWD_DSCP_PAYLOAD_SIZE_MASK, 0));
+-	airoha_qdma_rmw(qdma, REG_FWD_DSCP_LOW_THR, FWD_DSCP_LOW_THR_MASK,
+-			FIELD_PREP(FWD_DSCP_LOW_THR_MASK, 128));
+-	airoha_qdma_rmw(qdma, REG_LMGR_INIT_CFG,
+-			LMGR_INIT_START | LMGR_SRAM_MODE_MASK |
+-			HW_FWD_DESC_NUM_MASK,
+-			FIELD_PREP(HW_FWD_DESC_NUM_MASK, HW_DSCP_NUM) |
+-			LMGR_INIT_START);
+-
+-	return read_poll_timeout(airoha_qdma_rr, status,
+-				 !(status & LMGR_INIT_START), USEC_PER_MSEC,
+-				 30 * USEC_PER_MSEC, true, qdma,
+-				 REG_LMGR_INIT_CFG);
+-}
+-
+-static void airoha_qdma_init_qos(struct airoha_qdma *qdma)
+-{
+-	airoha_qdma_clear(qdma, REG_TXWRR_MODE_CFG, TWRR_WEIGHT_SCALE_MASK);
+-	airoha_qdma_set(qdma, REG_TXWRR_MODE_CFG, TWRR_WEIGHT_BASE_MASK);
+-
+-	airoha_qdma_clear(qdma, REG_PSE_BUF_USAGE_CFG,
+-			  PSE_BUF_ESTIMATE_EN_MASK);
+-
+-	airoha_qdma_set(qdma, REG_EGRESS_RATE_METER_CFG,
+-			EGRESS_RATE_METER_EN_MASK |
+-			EGRESS_RATE_METER_EQ_RATE_EN_MASK);
+-	/* 2047us x 31 = 63.457ms */
+-	airoha_qdma_rmw(qdma, REG_EGRESS_RATE_METER_CFG,
+-			EGRESS_RATE_METER_WINDOW_SZ_MASK,
+-			FIELD_PREP(EGRESS_RATE_METER_WINDOW_SZ_MASK, 0x1f));
+-	airoha_qdma_rmw(qdma, REG_EGRESS_RATE_METER_CFG,
+-			EGRESS_RATE_METER_TIMESLICE_MASK,
+-			FIELD_PREP(EGRESS_RATE_METER_TIMESLICE_MASK, 0x7ff));
+-
+-	/* ratelimit init */
+-	airoha_qdma_set(qdma, REG_GLB_TRTCM_CFG, GLB_TRTCM_EN_MASK);
+-	/* fast-tick 25us */
+-	airoha_qdma_rmw(qdma, REG_GLB_TRTCM_CFG, GLB_FAST_TICK_MASK,
+-			FIELD_PREP(GLB_FAST_TICK_MASK, 25));
+-	airoha_qdma_rmw(qdma, REG_GLB_TRTCM_CFG, GLB_SLOW_TICK_RATIO_MASK,
+-			FIELD_PREP(GLB_SLOW_TICK_RATIO_MASK, 40));
+-
+-	airoha_qdma_set(qdma, REG_EGRESS_TRTCM_CFG, EGRESS_TRTCM_EN_MASK);
+-	airoha_qdma_rmw(qdma, REG_EGRESS_TRTCM_CFG, EGRESS_FAST_TICK_MASK,
+-			FIELD_PREP(EGRESS_FAST_TICK_MASK, 25));
+-	airoha_qdma_rmw(qdma, REG_EGRESS_TRTCM_CFG,
+-			EGRESS_SLOW_TICK_RATIO_MASK,
+-			FIELD_PREP(EGRESS_SLOW_TICK_RATIO_MASK, 40));
+-
+-	airoha_qdma_set(qdma, REG_INGRESS_TRTCM_CFG, INGRESS_TRTCM_EN_MASK);
+-	airoha_qdma_clear(qdma, REG_INGRESS_TRTCM_CFG,
+-			  INGRESS_TRTCM_MODE_MASK);
+-	airoha_qdma_rmw(qdma, REG_INGRESS_TRTCM_CFG, INGRESS_FAST_TICK_MASK,
+-			FIELD_PREP(INGRESS_FAST_TICK_MASK, 125));
+-	airoha_qdma_rmw(qdma, REG_INGRESS_TRTCM_CFG,
+-			INGRESS_SLOW_TICK_RATIO_MASK,
+-			FIELD_PREP(INGRESS_SLOW_TICK_RATIO_MASK, 8));
+-
+-	airoha_qdma_set(qdma, REG_SLA_TRTCM_CFG, SLA_TRTCM_EN_MASK);
+-	airoha_qdma_rmw(qdma, REG_SLA_TRTCM_CFG, SLA_FAST_TICK_MASK,
+-			FIELD_PREP(SLA_FAST_TICK_MASK, 25));
+-	airoha_qdma_rmw(qdma, REG_SLA_TRTCM_CFG, SLA_SLOW_TICK_RATIO_MASK,
+-			FIELD_PREP(SLA_SLOW_TICK_RATIO_MASK, 40));
+-}
+-
+-static void airoha_qdma_init_qos_stats(struct airoha_qdma *qdma)
+-{
+-	int i;
+-
+-	for (i = 0; i < AIROHA_NUM_QOS_CHANNELS; i++) {
+-		/* Tx-cpu transferred count */
+-		airoha_qdma_wr(qdma, REG_CNTR_VAL(i << 1), 0);
+-		airoha_qdma_wr(qdma, REG_CNTR_CFG(i << 1),
+-			       CNTR_EN_MASK | CNTR_ALL_QUEUE_EN_MASK |
+-			       CNTR_ALL_DSCP_RING_EN_MASK |
+-			       FIELD_PREP(CNTR_CHAN_MASK, i));
+-		/* Tx-fwd transferred count */
+-		airoha_qdma_wr(qdma, REG_CNTR_VAL((i << 1) + 1), 0);
+-		airoha_qdma_wr(qdma, REG_CNTR_CFG(i << 1),
+-			       CNTR_EN_MASK | CNTR_ALL_QUEUE_EN_MASK |
+-			       CNTR_ALL_DSCP_RING_EN_MASK |
+-			       FIELD_PREP(CNTR_SRC_MASK, 1) |
+-			       FIELD_PREP(CNTR_CHAN_MASK, i));
+-	}
+-}
+-
+-static int airoha_qdma_hw_init(struct airoha_qdma *qdma)
+-{
+-	int i;
+-
+-	/* clear pending irqs */
+-	for (i = 0; i < ARRAY_SIZE(qdma->irqmask); i++)
+-		airoha_qdma_wr(qdma, REG_INT_STATUS(i), 0xffffffff);
+-
+-	/* setup irqs */
+-	airoha_qdma_irq_enable(qdma, QDMA_INT_REG_IDX0, INT_IDX0_MASK);
+-	airoha_qdma_irq_enable(qdma, QDMA_INT_REG_IDX1, INT_IDX1_MASK);
+-	airoha_qdma_irq_enable(qdma, QDMA_INT_REG_IDX4, INT_IDX4_MASK);
+-
+-	/* setup irq binding */
+-	for (i = 0; i < ARRAY_SIZE(qdma->q_tx); i++) {
+-		if (!qdma->q_tx[i].ndesc)
+-			continue;
+-
+-		if (TX_RING_IRQ_BLOCKING_MAP_MASK & BIT(i))
+-			airoha_qdma_set(qdma, REG_TX_RING_BLOCKING(i),
+-					TX_RING_IRQ_BLOCKING_CFG_MASK);
+-		else
+-			airoha_qdma_clear(qdma, REG_TX_RING_BLOCKING(i),
+-					  TX_RING_IRQ_BLOCKING_CFG_MASK);
+-	}
+-
+-	airoha_qdma_wr(qdma, REG_QDMA_GLOBAL_CFG,
+-		       GLOBAL_CFG_RX_2B_OFFSET_MASK |
+-		       FIELD_PREP(GLOBAL_CFG_DMA_PREFERENCE_MASK, 3) |
+-		       GLOBAL_CFG_CPU_TXR_RR_MASK |
+-		       GLOBAL_CFG_PAYLOAD_BYTE_SWAP_MASK |
+-		       GLOBAL_CFG_MULTICAST_MODIFY_FP_MASK |
+-		       GLOBAL_CFG_MULTICAST_EN_MASK |
+-		       GLOBAL_CFG_IRQ0_EN_MASK | GLOBAL_CFG_IRQ1_EN_MASK |
+-		       GLOBAL_CFG_TX_WB_DONE_MASK |
+-		       FIELD_PREP(GLOBAL_CFG_MAX_ISSUE_NUM_MASK, 2));
+-
+-	airoha_qdma_init_qos(qdma);
+-
+-	/* disable qdma rx delay interrupt */
+-	for (i = 0; i < ARRAY_SIZE(qdma->q_rx); i++) {
+-		if (!qdma->q_rx[i].ndesc)
+-			continue;
+-
+-		airoha_qdma_clear(qdma, REG_RX_DELAY_INT_IDX(i),
+-				  RX_DELAY_INT_MASK);
+-	}
+-
+-	airoha_qdma_set(qdma, REG_TXQ_CNGST_CFG,
+-			TXQ_CNGST_DROP_EN | TXQ_CNGST_DEI_DROP_EN);
+-	airoha_qdma_init_qos_stats(qdma);
+-
+-	return 0;
+-}
+-
+-static irqreturn_t airoha_irq_handler(int irq, void *dev_instance)
+-{
+-	struct airoha_qdma *qdma = dev_instance;
+-	u32 intr[ARRAY_SIZE(qdma->irqmask)];
+-	int i;
+-
+-	for (i = 0; i < ARRAY_SIZE(qdma->irqmask); i++) {
+-		intr[i] = airoha_qdma_rr(qdma, REG_INT_STATUS(i));
+-		intr[i] &= qdma->irqmask[i];
+-		airoha_qdma_wr(qdma, REG_INT_STATUS(i), intr[i]);
+-	}
+-
+-	if (!test_bit(DEV_STATE_INITIALIZED, &qdma->eth->state))
+-		return IRQ_NONE;
+-
+-	if (intr[1] & RX_DONE_INT_MASK) {
+-		airoha_qdma_irq_disable(qdma, QDMA_INT_REG_IDX1,
+-					RX_DONE_INT_MASK);
+-
+-		for (i = 0; i < ARRAY_SIZE(qdma->q_rx); i++) {
+-			if (!qdma->q_rx[i].ndesc)
+-				continue;
+-
+-			if (intr[1] & BIT(i))
+-				napi_schedule(&qdma->q_rx[i].napi);
+-		}
+-	}
+-
+-	if (intr[0] & INT_TX_MASK) {
+-		for (i = 0; i < ARRAY_SIZE(qdma->q_tx_irq); i++) {
+-			if (!(intr[0] & TX_DONE_INT_MASK(i)))
+-				continue;
+-
+-			airoha_qdma_irq_disable(qdma, QDMA_INT_REG_IDX0,
+-						TX_DONE_INT_MASK(i));
+-			napi_schedule(&qdma->q_tx_irq[i].napi);
+-		}
+-	}
+-
+-	return IRQ_HANDLED;
+-}
+-
+-static int airoha_qdma_init(struct platform_device *pdev,
+-			    struct airoha_eth *eth,
+-			    struct airoha_qdma *qdma)
+-{
+-	int err, id = qdma - &eth->qdma[0];
+-	const char *res;
+-
+-	spin_lock_init(&qdma->irq_lock);
+-	qdma->eth = eth;
+-
+-	res = devm_kasprintf(eth->dev, GFP_KERNEL, "qdma%d", id);
+-	if (!res)
+-		return -ENOMEM;
+-
+-	qdma->regs = devm_platform_ioremap_resource_byname(pdev, res);
+-	if (IS_ERR(qdma->regs))
+-		return dev_err_probe(eth->dev, PTR_ERR(qdma->regs),
+-				     "failed to iomap qdma%d regs\n", id);
+-
+-	qdma->irq = platform_get_irq(pdev, 4 * id);
+-	if (qdma->irq < 0)
+-		return qdma->irq;
+-
+-	err = devm_request_irq(eth->dev, qdma->irq, airoha_irq_handler,
+-			       IRQF_SHARED, KBUILD_MODNAME, qdma);
+-	if (err)
+-		return err;
+-
+-	err = airoha_qdma_init_rx(qdma);
+-	if (err)
+-		return err;
+-
+-	err = airoha_qdma_init_tx(qdma);
+-	if (err)
+-		return err;
+-
+-	err = airoha_qdma_init_hfwd_queues(qdma);
+-	if (err)
+-		return err;
+-
+-	return airoha_qdma_hw_init(qdma);
+-}
+-
+-static int airoha_hw_init(struct platform_device *pdev,
+-			  struct airoha_eth *eth)
+-{
+-	int err, i;
+-
+-	/* disable xsi */
+-	err = reset_control_bulk_assert(ARRAY_SIZE(eth->xsi_rsts),
+-					eth->xsi_rsts);
+-	if (err)
+-		return err;
+-
+-	err = reset_control_bulk_assert(ARRAY_SIZE(eth->rsts), eth->rsts);
+-	if (err)
+-		return err;
+-
+-	msleep(20);
+-	err = reset_control_bulk_deassert(ARRAY_SIZE(eth->rsts), eth->rsts);
+-	if (err)
+-		return err;
+-
+-	msleep(20);
+-	err = airoha_fe_init(eth);
+-	if (err)
+-		return err;
+-
+-	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++) {
+-		err = airoha_qdma_init(pdev, eth, &eth->qdma[i]);
+-		if (err)
+-			return err;
+-	}
+-
+-	set_bit(DEV_STATE_INITIALIZED, &eth->state);
+-
+-	return 0;
+-}
+-
+-static void airoha_hw_cleanup(struct airoha_qdma *qdma)
+-{
+-	int i;
+-
+-	for (i = 0; i < ARRAY_SIZE(qdma->q_rx); i++) {
+-		if (!qdma->q_rx[i].ndesc)
+-			continue;
+-
+-		netif_napi_del(&qdma->q_rx[i].napi);
+-		airoha_qdma_cleanup_rx_queue(&qdma->q_rx[i]);
+-		if (qdma->q_rx[i].page_pool)
+-			page_pool_destroy(qdma->q_rx[i].page_pool);
+-	}
+-
+-	for (i = 0; i < ARRAY_SIZE(qdma->q_tx_irq); i++)
+-		netif_napi_del(&qdma->q_tx_irq[i].napi);
+-
+-	for (i = 0; i < ARRAY_SIZE(qdma->q_tx); i++) {
+-		if (!qdma->q_tx[i].ndesc)
+-			continue;
+-
+-		airoha_qdma_cleanup_tx_queue(&qdma->q_tx[i]);
+-	}
+-}
+-
+-static void airoha_qdma_start_napi(struct airoha_qdma *qdma)
+-{
+-	int i;
+-
+-	for (i = 0; i < ARRAY_SIZE(qdma->q_tx_irq); i++)
+-		napi_enable(&qdma->q_tx_irq[i].napi);
+-
+-	for (i = 0; i < ARRAY_SIZE(qdma->q_rx); i++) {
+-		if (!qdma->q_rx[i].ndesc)
+-			continue;
+-
+-		napi_enable(&qdma->q_rx[i].napi);
+-	}
+-}
+-
+-static void airoha_qdma_stop_napi(struct airoha_qdma *qdma)
+-{
+-	int i;
+-
+-	for (i = 0; i < ARRAY_SIZE(qdma->q_tx_irq); i++)
+-		napi_disable(&qdma->q_tx_irq[i].napi);
+-
+-	for (i = 0; i < ARRAY_SIZE(qdma->q_rx); i++) {
+-		if (!qdma->q_rx[i].ndesc)
+-			continue;
+-
+-		napi_disable(&qdma->q_rx[i].napi);
+-	}
+-}
+-
+-static void airoha_update_hw_stats(struct airoha_gdm_port *port)
+-{
+-	struct airoha_eth *eth = port->qdma->eth;
+-	u32 val, i = 0;
+-
+-	spin_lock(&port->stats.lock);
+-	u64_stats_update_begin(&port->stats.syncp);
+-
+-	/* TX */
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_OK_PKT_CNT_H(port->id));
+-	port->stats.tx_ok_pkts += ((u64)val << 32);
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_OK_PKT_CNT_L(port->id));
+-	port->stats.tx_ok_pkts += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_OK_BYTE_CNT_H(port->id));
+-	port->stats.tx_ok_bytes += ((u64)val << 32);
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_OK_BYTE_CNT_L(port->id));
+-	port->stats.tx_ok_bytes += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_DROP_CNT(port->id));
+-	port->stats.tx_drops += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_BC_CNT(port->id));
+-	port->stats.tx_broadcast += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_MC_CNT(port->id));
+-	port->stats.tx_multicast += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_RUNT_CNT(port->id));
+-	port->stats.tx_len[i] += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_E64_CNT_H(port->id));
+-	port->stats.tx_len[i] += ((u64)val << 32);
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_E64_CNT_L(port->id));
+-	port->stats.tx_len[i++] += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L64_CNT_H(port->id));
+-	port->stats.tx_len[i] += ((u64)val << 32);
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L64_CNT_L(port->id));
+-	port->stats.tx_len[i++] += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L127_CNT_H(port->id));
+-	port->stats.tx_len[i] += ((u64)val << 32);
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L127_CNT_L(port->id));
+-	port->stats.tx_len[i++] += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L255_CNT_H(port->id));
+-	port->stats.tx_len[i] += ((u64)val << 32);
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L255_CNT_L(port->id));
+-	port->stats.tx_len[i++] += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L511_CNT_H(port->id));
+-	port->stats.tx_len[i] += ((u64)val << 32);
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L511_CNT_L(port->id));
+-	port->stats.tx_len[i++] += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L1023_CNT_H(port->id));
+-	port->stats.tx_len[i] += ((u64)val << 32);
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_L1023_CNT_L(port->id));
+-	port->stats.tx_len[i++] += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_TX_ETH_LONG_CNT(port->id));
+-	port->stats.tx_len[i++] += val;
+-
+-	/* RX */
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_OK_PKT_CNT_H(port->id));
+-	port->stats.rx_ok_pkts += ((u64)val << 32);
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_OK_PKT_CNT_L(port->id));
+-	port->stats.rx_ok_pkts += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_OK_BYTE_CNT_H(port->id));
+-	port->stats.rx_ok_bytes += ((u64)val << 32);
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_OK_BYTE_CNT_L(port->id));
+-	port->stats.rx_ok_bytes += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_DROP_CNT(port->id));
+-	port->stats.rx_drops += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_BC_CNT(port->id));
+-	port->stats.rx_broadcast += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_MC_CNT(port->id));
+-	port->stats.rx_multicast += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ERROR_DROP_CNT(port->id));
+-	port->stats.rx_errors += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_CRC_ERR_CNT(port->id));
+-	port->stats.rx_crc_error += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_OVERFLOW_DROP_CNT(port->id));
+-	port->stats.rx_over_errors += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_FRAG_CNT(port->id));
+-	port->stats.rx_fragment += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_JABBER_CNT(port->id));
+-	port->stats.rx_jabber += val;
+-
+-	i = 0;
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_RUNT_CNT(port->id));
+-	port->stats.rx_len[i] += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_E64_CNT_H(port->id));
+-	port->stats.rx_len[i] += ((u64)val << 32);
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_E64_CNT_L(port->id));
+-	port->stats.rx_len[i++] += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L64_CNT_H(port->id));
+-	port->stats.rx_len[i] += ((u64)val << 32);
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L64_CNT_L(port->id));
+-	port->stats.rx_len[i++] += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L127_CNT_H(port->id));
+-	port->stats.rx_len[i] += ((u64)val << 32);
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L127_CNT_L(port->id));
+-	port->stats.rx_len[i++] += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L255_CNT_H(port->id));
+-	port->stats.rx_len[i] += ((u64)val << 32);
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L255_CNT_L(port->id));
+-	port->stats.rx_len[i++] += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L511_CNT_H(port->id));
+-	port->stats.rx_len[i] += ((u64)val << 32);
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L511_CNT_L(port->id));
+-	port->stats.rx_len[i++] += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L1023_CNT_H(port->id));
+-	port->stats.rx_len[i] += ((u64)val << 32);
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_L1023_CNT_L(port->id));
+-	port->stats.rx_len[i++] += val;
+-
+-	val = airoha_fe_rr(eth, REG_FE_GDM_RX_ETH_LONG_CNT(port->id));
+-	port->stats.rx_len[i++] += val;
+-
+-	/* reset mib counters */
+-	airoha_fe_set(eth, REG_FE_GDM_MIB_CLEAR(port->id),
+-		      FE_GDM_MIB_RX_CLEAR_MASK | FE_GDM_MIB_TX_CLEAR_MASK);
+-
+-	u64_stats_update_end(&port->stats.syncp);
+-	spin_unlock(&port->stats.lock);
+-}
+-
+-static int airoha_dev_open(struct net_device *dev)
+-{
+-	struct airoha_gdm_port *port = netdev_priv(dev);
+-	struct airoha_qdma *qdma = port->qdma;
+-	int err;
+-
+-	netif_tx_start_all_queues(dev);
+-	err = airoha_set_gdm_ports(qdma->eth, true);
+-	if (err)
+-		return err;
+-
+-	if (netdev_uses_dsa(dev))
+-		airoha_fe_set(qdma->eth, REG_GDM_INGRESS_CFG(port->id),
+-			      GDM_STAG_EN_MASK);
+-	else
+-		airoha_fe_clear(qdma->eth, REG_GDM_INGRESS_CFG(port->id),
+-				GDM_STAG_EN_MASK);
+-
+-	airoha_qdma_set(qdma, REG_QDMA_GLOBAL_CFG,
+-			GLOBAL_CFG_TX_DMA_EN_MASK |
+-			GLOBAL_CFG_RX_DMA_EN_MASK);
+-
+-	return 0;
+-}
+-
+-static int airoha_dev_stop(struct net_device *dev)
+-{
+-	struct airoha_gdm_port *port = netdev_priv(dev);
+-	struct airoha_qdma *qdma = port->qdma;
+-	int i, err;
+-
+-	netif_tx_disable(dev);
+-	err = airoha_set_gdm_ports(qdma->eth, false);
+-	if (err)
+-		return err;
+-
+-	airoha_qdma_clear(qdma, REG_QDMA_GLOBAL_CFG,
+-			  GLOBAL_CFG_TX_DMA_EN_MASK |
+-			  GLOBAL_CFG_RX_DMA_EN_MASK);
+-
+-	for (i = 0; i < ARRAY_SIZE(qdma->q_tx); i++) {
+-		if (!qdma->q_tx[i].ndesc)
+-			continue;
+-
+-		airoha_qdma_cleanup_tx_queue(&qdma->q_tx[i]);
+-		netdev_tx_reset_subqueue(dev, i);
+-	}
+-
+-	return 0;
+-}
+-
+-static int airoha_dev_set_macaddr(struct net_device *dev, void *p)
+-{
+-	struct airoha_gdm_port *port = netdev_priv(dev);
+-	int err;
+-
+-	err = eth_mac_addr(dev, p);
+-	if (err)
+-		return err;
+-
+-	airoha_set_macaddr(port, dev->dev_addr);
+-
+-	return 0;
+-}
+-
+-static int airoha_dev_init(struct net_device *dev)
+-{
+-	struct airoha_gdm_port *port = netdev_priv(dev);
+-
+-	airoha_set_macaddr(port, dev->dev_addr);
+-
+-	return 0;
+-}
+-
+-static void airoha_dev_get_stats64(struct net_device *dev,
+-				   struct rtnl_link_stats64 *storage)
+-{
+-	struct airoha_gdm_port *port = netdev_priv(dev);
+-	unsigned int start;
+-
+-	airoha_update_hw_stats(port);
+-	do {
+-		start = u64_stats_fetch_begin(&port->stats.syncp);
+-		storage->rx_packets = port->stats.rx_ok_pkts;
+-		storage->tx_packets = port->stats.tx_ok_pkts;
+-		storage->rx_bytes = port->stats.rx_ok_bytes;
+-		storage->tx_bytes = port->stats.tx_ok_bytes;
+-		storage->multicast = port->stats.rx_multicast;
+-		storage->rx_errors = port->stats.rx_errors;
+-		storage->rx_dropped = port->stats.rx_drops;
+-		storage->tx_dropped = port->stats.tx_drops;
+-		storage->rx_crc_errors = port->stats.rx_crc_error;
+-		storage->rx_over_errors = port->stats.rx_over_errors;
+-	} while (u64_stats_fetch_retry(&port->stats.syncp, start));
+-}
+-
+-static u16 airoha_dev_select_queue(struct net_device *dev, struct sk_buff *skb,
+-				   struct net_device *sb_dev)
+-{
+-	struct airoha_gdm_port *port = netdev_priv(dev);
+-	int queue, channel;
+-
+-	/* For dsa device select QoS channel according to the dsa user port
+-	 * index, rely on port id otherwise. Select QoS queue based on the
+-	 * skb priority.
+-	 */
+-	channel = netdev_uses_dsa(dev) ? skb_get_queue_mapping(skb) : port->id;
+-	channel = channel % AIROHA_NUM_QOS_CHANNELS;
+-	queue = (skb->priority - 1) % AIROHA_NUM_QOS_QUEUES; /* QoS queue */
+-	queue = channel * AIROHA_NUM_QOS_QUEUES + queue;
+-
+-	return queue < dev->num_tx_queues ? queue : 0;
+-}
+-
+-static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb,
+-				   struct net_device *dev)
+-{
+-	struct airoha_gdm_port *port = netdev_priv(dev);
+-	u32 nr_frags = 1 + skb_shinfo(skb)->nr_frags;
+-	u32 msg0, msg1, len = skb_headlen(skb);
+-	struct airoha_qdma *qdma = port->qdma;
+-	struct netdev_queue *txq;
+-	struct airoha_queue *q;
+-	void *data = skb->data;
+-	int i, qid;
+-	u16 index;
+-	u8 fport;
+-
+-	qid = skb_get_queue_mapping(skb) % ARRAY_SIZE(qdma->q_tx);
+-	msg0 = FIELD_PREP(QDMA_ETH_TXMSG_CHAN_MASK,
+-			  qid / AIROHA_NUM_QOS_QUEUES) |
+-	       FIELD_PREP(QDMA_ETH_TXMSG_QUEUE_MASK,
+-			  qid % AIROHA_NUM_QOS_QUEUES);
+-	if (skb->ip_summed == CHECKSUM_PARTIAL)
+-		msg0 |= FIELD_PREP(QDMA_ETH_TXMSG_TCO_MASK, 1) |
+-			FIELD_PREP(QDMA_ETH_TXMSG_UCO_MASK, 1) |
+-			FIELD_PREP(QDMA_ETH_TXMSG_ICO_MASK, 1);
+-
+-	/* TSO: fill MSS info in tcp checksum field */
+-	if (skb_is_gso(skb)) {
+-		if (skb_cow_head(skb, 0))
+-			goto error;
+-
+-		if (skb_shinfo(skb)->gso_type & (SKB_GSO_TCPV4 |
+-						 SKB_GSO_TCPV6)) {
+-			__be16 csum = cpu_to_be16(skb_shinfo(skb)->gso_size);
+-
+-			tcp_hdr(skb)->check = (__force __sum16)csum;
+-			msg0 |= FIELD_PREP(QDMA_ETH_TXMSG_TSO_MASK, 1);
+-		}
+-	}
+-
+-	fport = port->id == 4 ? FE_PSE_PORT_GDM4 : port->id;
+-	msg1 = FIELD_PREP(QDMA_ETH_TXMSG_FPORT_MASK, fport) |
+-	       FIELD_PREP(QDMA_ETH_TXMSG_METER_MASK, 0x7f);
+-
+-	q = &qdma->q_tx[qid];
+-	if (WARN_ON_ONCE(!q->ndesc))
+-		goto error;
+-
+-	spin_lock_bh(&q->lock);
+-
+-	txq = netdev_get_tx_queue(dev, qid);
+-	if (q->queued + nr_frags > q->ndesc) {
+-		/* not enough space in the queue */
+-		netif_tx_stop_queue(txq);
+-		spin_unlock_bh(&q->lock);
+-		return NETDEV_TX_BUSY;
+-	}
+-
+-	index = q->head;
+-	for (i = 0; i < nr_frags; i++) {
+-		struct airoha_qdma_desc *desc = &q->desc[index];
+-		struct airoha_queue_entry *e = &q->entry[index];
+-		skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
+-		dma_addr_t addr;
+-		u32 val;
+-
+-		addr = dma_map_single(dev->dev.parent, data, len,
+-				      DMA_TO_DEVICE);
+-		if (unlikely(dma_mapping_error(dev->dev.parent, addr)))
+-			goto error_unmap;
+-
+-		index = (index + 1) % q->ndesc;
+-
+-		val = FIELD_PREP(QDMA_DESC_LEN_MASK, len);
+-		if (i < nr_frags - 1)
+-			val |= FIELD_PREP(QDMA_DESC_MORE_MASK, 1);
+-		WRITE_ONCE(desc->ctrl, cpu_to_le32(val));
+-		WRITE_ONCE(desc->addr, cpu_to_le32(addr));
+-		val = FIELD_PREP(QDMA_DESC_NEXT_ID_MASK, index);
+-		WRITE_ONCE(desc->data, cpu_to_le32(val));
+-		WRITE_ONCE(desc->msg0, cpu_to_le32(msg0));
+-		WRITE_ONCE(desc->msg1, cpu_to_le32(msg1));
+-		WRITE_ONCE(desc->msg2, cpu_to_le32(0xffff));
+-
+-		e->skb = i ? NULL : skb;
+-		e->dma_addr = addr;
+-		e->dma_len = len;
+-
+-		data = skb_frag_address(frag);
+-		len = skb_frag_size(frag);
+-	}
+-
+-	q->head = index;
+-	q->queued += i;
+-
+-	skb_tx_timestamp(skb);
+-	netdev_tx_sent_queue(txq, skb->len);
+-
+-	if (netif_xmit_stopped(txq) || !netdev_xmit_more())
+-		airoha_qdma_rmw(qdma, REG_TX_CPU_IDX(qid),
+-				TX_RING_CPU_IDX_MASK,
+-				FIELD_PREP(TX_RING_CPU_IDX_MASK, q->head));
+-
+-	if (q->ndesc - q->queued < q->free_thr)
+-		netif_tx_stop_queue(txq);
+-
+-	spin_unlock_bh(&q->lock);
+-
+-	return NETDEV_TX_OK;
+-
+-error_unmap:
+-	for (i--; i >= 0; i--) {
+-		index = (q->head + i) % q->ndesc;
+-		dma_unmap_single(dev->dev.parent, q->entry[index].dma_addr,
+-				 q->entry[index].dma_len, DMA_TO_DEVICE);
+-	}
+-
+-	spin_unlock_bh(&q->lock);
+-error:
+-	dev_kfree_skb_any(skb);
+-	dev->stats.tx_dropped++;
+-
+-	return NETDEV_TX_OK;
+-}
+-
+-static void airoha_ethtool_get_drvinfo(struct net_device *dev,
+-				       struct ethtool_drvinfo *info)
+-{
+-	struct airoha_gdm_port *port = netdev_priv(dev);
+-	struct airoha_eth *eth = port->qdma->eth;
+-
+-	strscpy(info->driver, eth->dev->driver->name, sizeof(info->driver));
+-	strscpy(info->bus_info, dev_name(eth->dev), sizeof(info->bus_info));
+-}
+-
+-static void airoha_ethtool_get_mac_stats(struct net_device *dev,
+-					 struct ethtool_eth_mac_stats *stats)
+-{
+-	struct airoha_gdm_port *port = netdev_priv(dev);
+-	unsigned int start;
+-
+-	airoha_update_hw_stats(port);
+-	do {
+-		start = u64_stats_fetch_begin(&port->stats.syncp);
+-		stats->MulticastFramesXmittedOK = port->stats.tx_multicast;
+-		stats->BroadcastFramesXmittedOK = port->stats.tx_broadcast;
+-		stats->BroadcastFramesReceivedOK = port->stats.rx_broadcast;
+-	} while (u64_stats_fetch_retry(&port->stats.syncp, start));
+-}
+-
+-static const struct ethtool_rmon_hist_range airoha_ethtool_rmon_ranges[] = {
+-	{    0,    64 },
+-	{   65,   127 },
+-	{  128,   255 },
+-	{  256,   511 },
+-	{  512,  1023 },
+-	{ 1024,  1518 },
+-	{ 1519, 10239 },
+-	{},
+-};
+-
+-static void
+-airoha_ethtool_get_rmon_stats(struct net_device *dev,
+-			      struct ethtool_rmon_stats *stats,
+-			      const struct ethtool_rmon_hist_range **ranges)
+-{
+-	struct airoha_gdm_port *port = netdev_priv(dev);
+-	struct airoha_hw_stats *hw_stats = &port->stats;
+-	unsigned int start;
+-
+-	BUILD_BUG_ON(ARRAY_SIZE(airoha_ethtool_rmon_ranges) !=
+-		     ARRAY_SIZE(hw_stats->tx_len) + 1);
+-	BUILD_BUG_ON(ARRAY_SIZE(airoha_ethtool_rmon_ranges) !=
+-		     ARRAY_SIZE(hw_stats->rx_len) + 1);
+-
+-	*ranges = airoha_ethtool_rmon_ranges;
+-	airoha_update_hw_stats(port);
+-	do {
+-		int i;
+-
+-		start = u64_stats_fetch_begin(&port->stats.syncp);
+-		stats->fragments = hw_stats->rx_fragment;
+-		stats->jabbers = hw_stats->rx_jabber;
+-		for (i = 0; i < ARRAY_SIZE(airoha_ethtool_rmon_ranges) - 1;
+-		     i++) {
+-			stats->hist[i] = hw_stats->rx_len[i];
+-			stats->hist_tx[i] = hw_stats->tx_len[i];
+-		}
+-	} while (u64_stats_fetch_retry(&port->stats.syncp, start));
+-}
+-
+-static int airoha_qdma_set_chan_tx_sched(struct airoha_gdm_port *port,
+-					 int channel, enum tx_sched_mode mode,
+-					 const u16 *weights, u8 n_weights)
+-{
+-	int i;
+-
+-	for (i = 0; i < AIROHA_NUM_TX_RING; i++)
+-		airoha_qdma_clear(port->qdma, REG_QUEUE_CLOSE_CFG(channel),
+-				  TXQ_DISABLE_CHAN_QUEUE_MASK(channel, i));
+-
+-	for (i = 0; i < n_weights; i++) {
+-		u32 status;
+-		int err;
+-
+-		airoha_qdma_wr(port->qdma, REG_TXWRR_WEIGHT_CFG,
+-			       TWRR_RW_CMD_MASK |
+-			       FIELD_PREP(TWRR_CHAN_IDX_MASK, channel) |
+-			       FIELD_PREP(TWRR_QUEUE_IDX_MASK, i) |
+-			       FIELD_PREP(TWRR_VALUE_MASK, weights[i]));
+-		err = read_poll_timeout(airoha_qdma_rr, status,
+-					status & TWRR_RW_CMD_DONE,
+-					USEC_PER_MSEC, 10 * USEC_PER_MSEC,
+-					true, port->qdma,
+-					REG_TXWRR_WEIGHT_CFG);
+-		if (err)
+-			return err;
+-	}
+-
+-	airoha_qdma_rmw(port->qdma, REG_CHAN_QOS_MODE(channel >> 3),
+-			CHAN_QOS_MODE_MASK(channel),
+-			mode << __ffs(CHAN_QOS_MODE_MASK(channel)));
+-
+-	return 0;
+-}
+-
+-static int airoha_qdma_set_tx_prio_sched(struct airoha_gdm_port *port,
+-					 int channel)
+-{
+-	static const u16 w[AIROHA_NUM_QOS_QUEUES] = {};
+-
+-	return airoha_qdma_set_chan_tx_sched(port, channel, TC_SCH_SP, w,
+-					     ARRAY_SIZE(w));
+-}
+-
+-static int airoha_qdma_set_tx_ets_sched(struct airoha_gdm_port *port,
+-					int channel,
+-					struct tc_ets_qopt_offload *opt)
+-{
+-	struct tc_ets_qopt_offload_replace_params *p = &opt->replace_params;
+-	enum tx_sched_mode mode = TC_SCH_SP;
+-	u16 w[AIROHA_NUM_QOS_QUEUES] = {};
+-	int i, nstrict = 0, nwrr, qidx;
+-
+-	if (p->bands > AIROHA_NUM_QOS_QUEUES)
+-		return -EINVAL;
+-
+-	for (i = 0; i < p->bands; i++) {
+-		if (!p->quanta[i])
+-			nstrict++;
+-	}
+-
+-	/* this configuration is not supported by the hw */
+-	if (nstrict == AIROHA_NUM_QOS_QUEUES - 1)
+-		return -EINVAL;
+-
+-	/* EN7581 SoC supports fixed QoS band priority where WRR queues have
+-	 * lowest priorities with respect to SP ones.
+-	 * e.g: WRR0, WRR1, .., WRRm, SP0, SP1, .., SPn
+-	 */
+-	nwrr = p->bands - nstrict;
+-	qidx = nstrict && nwrr ? nstrict : 0;
+-	for (i = 1; i <= p->bands; i++) {
+-		if (p->priomap[i % AIROHA_NUM_QOS_QUEUES] != qidx)
+-			return -EINVAL;
+-
+-		qidx = i == nwrr ? 0 : qidx + 1;
+-	}
+-
+-	for (i = 0; i < nwrr; i++)
+-		w[i] = p->weights[nstrict + i];
+-
+-	if (!nstrict)
+-		mode = TC_SCH_WRR8;
+-	else if (nstrict < AIROHA_NUM_QOS_QUEUES - 1)
+-		mode = nstrict + 1;
+-
+-	return airoha_qdma_set_chan_tx_sched(port, channel, mode, w,
+-					     ARRAY_SIZE(w));
+-}
+-
+-static int airoha_qdma_get_tx_ets_stats(struct airoha_gdm_port *port,
+-					int channel,
+-					struct tc_ets_qopt_offload *opt)
+-{
+-	u64 cpu_tx_packets = airoha_qdma_rr(port->qdma,
+-					    REG_CNTR_VAL(channel << 1));
+-	u64 fwd_tx_packets = airoha_qdma_rr(port->qdma,
+-					    REG_CNTR_VAL((channel << 1) + 1));
+-	u64 tx_packets = (cpu_tx_packets - port->cpu_tx_packets) +
+-			 (fwd_tx_packets - port->fwd_tx_packets);
+-	_bstats_update(opt->stats.bstats, 0, tx_packets);
+-
+-	port->cpu_tx_packets = cpu_tx_packets;
+-	port->fwd_tx_packets = fwd_tx_packets;
+-
+-	return 0;
+-}
+-
+-static int airoha_tc_setup_qdisc_ets(struct airoha_gdm_port *port,
+-				     struct tc_ets_qopt_offload *opt)
+-{
+-	int channel = TC_H_MAJ(opt->handle) >> 16;
+-
+-	if (opt->parent == TC_H_ROOT)
+-		return -EINVAL;
+-
+-	switch (opt->command) {
+-	case TC_ETS_REPLACE:
+-		return airoha_qdma_set_tx_ets_sched(port, channel, opt);
+-	case TC_ETS_DESTROY:
+-		/* PRIO is default qdisc scheduler */
+-		return airoha_qdma_set_tx_prio_sched(port, channel);
+-	case TC_ETS_STATS:
+-		return airoha_qdma_get_tx_ets_stats(port, channel, opt);
+-	default:
+-		return -EOPNOTSUPP;
+-	}
+-}
+-
+-static int airoha_qdma_get_trtcm_param(struct airoha_qdma *qdma, int channel,
+-				       u32 addr, enum trtcm_param_type param,
+-				       enum trtcm_mode_type mode,
+-				       u32 *val_low, u32 *val_high)
+-{
+-	u32 idx = QDMA_METER_IDX(channel), group = QDMA_METER_GROUP(channel);
+-	u32 val, config = FIELD_PREP(TRTCM_PARAM_TYPE_MASK, param) |
+-			  FIELD_PREP(TRTCM_METER_GROUP_MASK, group) |
+-			  FIELD_PREP(TRTCM_PARAM_INDEX_MASK, idx) |
+-			  FIELD_PREP(TRTCM_PARAM_RATE_TYPE_MASK, mode);
+-
+-	airoha_qdma_wr(qdma, REG_TRTCM_CFG_PARAM(addr), config);
+-	if (read_poll_timeout(airoha_qdma_rr, val,
+-			      val & TRTCM_PARAM_RW_DONE_MASK,
+-			      USEC_PER_MSEC, 10 * USEC_PER_MSEC, true,
+-			      qdma, REG_TRTCM_CFG_PARAM(addr)))
+-		return -ETIMEDOUT;
+-
+-	*val_low = airoha_qdma_rr(qdma, REG_TRTCM_DATA_LOW(addr));
+-	if (val_high)
+-		*val_high = airoha_qdma_rr(qdma, REG_TRTCM_DATA_HIGH(addr));
+-
+-	return 0;
+-}
+-
+-static int airoha_qdma_set_trtcm_param(struct airoha_qdma *qdma, int channel,
+-				       u32 addr, enum trtcm_param_type param,
+-				       enum trtcm_mode_type mode, u32 val)
+-{
+-	u32 idx = QDMA_METER_IDX(channel), group = QDMA_METER_GROUP(channel);
+-	u32 config = TRTCM_PARAM_RW_MASK |
+-		     FIELD_PREP(TRTCM_PARAM_TYPE_MASK, param) |
+-		     FIELD_PREP(TRTCM_METER_GROUP_MASK, group) |
+-		     FIELD_PREP(TRTCM_PARAM_INDEX_MASK, idx) |
+-		     FIELD_PREP(TRTCM_PARAM_RATE_TYPE_MASK, mode);
+-
+-	airoha_qdma_wr(qdma, REG_TRTCM_DATA_LOW(addr), val);
+-	airoha_qdma_wr(qdma, REG_TRTCM_CFG_PARAM(addr), config);
+-
+-	return read_poll_timeout(airoha_qdma_rr, val,
+-				 val & TRTCM_PARAM_RW_DONE_MASK,
+-				 USEC_PER_MSEC, 10 * USEC_PER_MSEC, true,
+-				 qdma, REG_TRTCM_CFG_PARAM(addr));
+-}
+-
+-static int airoha_qdma_set_trtcm_config(struct airoha_qdma *qdma, int channel,
+-					u32 addr, enum trtcm_mode_type mode,
+-					bool enable, u32 enable_mask)
+-{
+-	u32 val;
+-
+-	if (airoha_qdma_get_trtcm_param(qdma, channel, addr, TRTCM_MISC_MODE,
+-					mode, &val, NULL))
+-		return -EINVAL;
+-
+-	val = enable ? val | enable_mask : val & ~enable_mask;
+-
+-	return airoha_qdma_set_trtcm_param(qdma, channel, addr, TRTCM_MISC_MODE,
+-					   mode, val);
+-}
+-
+-static int airoha_qdma_set_trtcm_token_bucket(struct airoha_qdma *qdma,
+-					      int channel, u32 addr,
+-					      enum trtcm_mode_type mode,
+-					      u32 rate_val, u32 bucket_size)
+-{
+-	u32 val, config, tick, unit, rate, rate_frac;
+-	int err;
+-
+-	if (airoha_qdma_get_trtcm_param(qdma, channel, addr, TRTCM_MISC_MODE,
+-					mode, &config, NULL))
+-		return -EINVAL;
+-
+-	val = airoha_qdma_rr(qdma, addr);
+-	tick = FIELD_GET(INGRESS_FAST_TICK_MASK, val);
+-	if (config & TRTCM_TICK_SEL)
+-		tick *= FIELD_GET(INGRESS_SLOW_TICK_RATIO_MASK, val);
+-	if (!tick)
+-		return -EINVAL;
+-
+-	unit = (config & TRTCM_PKT_MODE) ? 1000000 / tick : 8000 / tick;
+-	if (!unit)
+-		return -EINVAL;
+-
+-	rate = rate_val / unit;
+-	rate_frac = rate_val % unit;
+-	rate_frac = FIELD_PREP(TRTCM_TOKEN_RATE_MASK, rate_frac) / unit;
+-	rate = FIELD_PREP(TRTCM_TOKEN_RATE_MASK, rate) |
+-	       FIELD_PREP(TRTCM_TOKEN_RATE_FRACTION_MASK, rate_frac);
+-
+-	err = airoha_qdma_set_trtcm_param(qdma, channel, addr,
+-					  TRTCM_TOKEN_RATE_MODE, mode, rate);
+-	if (err)
+-		return err;
+-
+-	val = max_t(u32, bucket_size, MIN_TOKEN_SIZE);
+-	val = min_t(u32, __fls(val), MAX_TOKEN_SIZE_OFFSET);
+-
+-	return airoha_qdma_set_trtcm_param(qdma, channel, addr,
+-					   TRTCM_BUCKETSIZE_SHIFT_MODE,
+-					   mode, val);
+-}
+-
+-static int airoha_qdma_set_tx_rate_limit(struct airoha_gdm_port *port,
+-					 int channel, u32 rate,
+-					 u32 bucket_size)
+-{
+-	int i, err;
+-
+-	for (i = 0; i <= TRTCM_PEAK_MODE; i++) {
+-		err = airoha_qdma_set_trtcm_config(port->qdma, channel,
+-						   REG_EGRESS_TRTCM_CFG, i,
+-						   !!rate, TRTCM_METER_MODE);
+-		if (err)
+-			return err;
+-
+-		err = airoha_qdma_set_trtcm_token_bucket(port->qdma, channel,
+-							 REG_EGRESS_TRTCM_CFG,
+-							 i, rate, bucket_size);
+-		if (err)
+-			return err;
+-	}
+-
+-	return 0;
+-}
+-
+-static int airoha_tc_htb_alloc_leaf_queue(struct airoha_gdm_port *port,
+-					  struct tc_htb_qopt_offload *opt)
+-{
+-	u32 channel = TC_H_MIN(opt->classid) % AIROHA_NUM_QOS_CHANNELS;
+-	u32 rate = div_u64(opt->rate, 1000) << 3; /* kbps */
+-	struct net_device *dev = port->dev;
+-	int num_tx_queues = dev->real_num_tx_queues;
+-	int err;
+-
+-	if (opt->parent_classid != TC_HTB_CLASSID_ROOT) {
+-		NL_SET_ERR_MSG_MOD(opt->extack, "invalid parent classid");
+-		return -EINVAL;
+-	}
+-
+-	err = airoha_qdma_set_tx_rate_limit(port, channel, rate, opt->quantum);
+-	if (err) {
+-		NL_SET_ERR_MSG_MOD(opt->extack,
+-				   "failed configuring htb offload");
+-		return err;
+-	}
+-
+-	if (opt->command == TC_HTB_NODE_MODIFY)
+-		return 0;
+-
+-	err = netif_set_real_num_tx_queues(dev, num_tx_queues + 1);
+-	if (err) {
+-		airoha_qdma_set_tx_rate_limit(port, channel, 0, opt->quantum);
+-		NL_SET_ERR_MSG_MOD(opt->extack,
+-				   "failed setting real_num_tx_queues");
+-		return err;
+-	}
+-
+-	set_bit(channel, port->qos_sq_bmap);
+-	opt->qid = AIROHA_NUM_TX_RING + channel;
+-
+-	return 0;
+-}
+-
+-static void airoha_tc_remove_htb_queue(struct airoha_gdm_port *port, int queue)
+-{
+-	struct net_device *dev = port->dev;
+-
+-	netif_set_real_num_tx_queues(dev, dev->real_num_tx_queues - 1);
+-	airoha_qdma_set_tx_rate_limit(port, queue + 1, 0, 0);
+-	clear_bit(queue, port->qos_sq_bmap);
+-}
+-
+-static int airoha_tc_htb_delete_leaf_queue(struct airoha_gdm_port *port,
+-					   struct tc_htb_qopt_offload *opt)
+-{
+-	u32 channel = TC_H_MIN(opt->classid) % AIROHA_NUM_QOS_CHANNELS;
+-
+-	if (!test_bit(channel, port->qos_sq_bmap)) {
+-		NL_SET_ERR_MSG_MOD(opt->extack, "invalid queue id");
+-		return -EINVAL;
+-	}
+-
+-	airoha_tc_remove_htb_queue(port, channel);
+-
+-	return 0;
+-}
+-
+-static int airoha_tc_htb_destroy(struct airoha_gdm_port *port)
+-{
+-	int q;
+-
+-	for_each_set_bit(q, port->qos_sq_bmap, AIROHA_NUM_QOS_CHANNELS)
+-		airoha_tc_remove_htb_queue(port, q);
+-
+-	return 0;
+-}
+-
+-static int airoha_tc_get_htb_get_leaf_queue(struct airoha_gdm_port *port,
+-					    struct tc_htb_qopt_offload *opt)
+-{
+-	u32 channel = TC_H_MIN(opt->classid) % AIROHA_NUM_QOS_CHANNELS;
+-
+-	if (!test_bit(channel, port->qos_sq_bmap)) {
+-		NL_SET_ERR_MSG_MOD(opt->extack, "invalid queue id");
+-		return -EINVAL;
+-	}
+-
+-	opt->qid = channel;
+-
+-	return 0;
+-}
+-
+-static int airoha_tc_setup_qdisc_htb(struct airoha_gdm_port *port,
+-				     struct tc_htb_qopt_offload *opt)
+-{
+-	switch (opt->command) {
+-	case TC_HTB_CREATE:
+-		break;
+-	case TC_HTB_DESTROY:
+-		return airoha_tc_htb_destroy(port);
+-	case TC_HTB_NODE_MODIFY:
+-	case TC_HTB_LEAF_ALLOC_QUEUE:
+-		return airoha_tc_htb_alloc_leaf_queue(port, opt);
+-	case TC_HTB_LEAF_DEL:
+-	case TC_HTB_LEAF_DEL_LAST:
+-	case TC_HTB_LEAF_DEL_LAST_FORCE:
+-		return airoha_tc_htb_delete_leaf_queue(port, opt);
+-	case TC_HTB_LEAF_QUERY_QUEUE:
+-		return airoha_tc_get_htb_get_leaf_queue(port, opt);
+-	default:
+-		return -EOPNOTSUPP;
+-	}
+-
+-	return 0;
+-}
+-
+-static int airoha_dev_tc_setup(struct net_device *dev, enum tc_setup_type type,
+-			       void *type_data)
+-{
+-	struct airoha_gdm_port *port = netdev_priv(dev);
+-
+-	switch (type) {
+-	case TC_SETUP_QDISC_ETS:
+-		return airoha_tc_setup_qdisc_ets(port, type_data);
+-	case TC_SETUP_QDISC_HTB:
+-		return airoha_tc_setup_qdisc_htb(port, type_data);
+-	default:
+-		return -EOPNOTSUPP;
+-	}
+-}
+-
+-static const struct net_device_ops airoha_netdev_ops = {
+-	.ndo_init		= airoha_dev_init,
+-	.ndo_open		= airoha_dev_open,
+-	.ndo_stop		= airoha_dev_stop,
+-	.ndo_select_queue	= airoha_dev_select_queue,
+-	.ndo_start_xmit		= airoha_dev_xmit,
+-	.ndo_get_stats64        = airoha_dev_get_stats64,
+-	.ndo_set_mac_address	= airoha_dev_set_macaddr,
+-	.ndo_setup_tc		= airoha_dev_tc_setup,
+-};
+-
+-static const struct ethtool_ops airoha_ethtool_ops = {
+-	.get_drvinfo		= airoha_ethtool_get_drvinfo,
+-	.get_eth_mac_stats      = airoha_ethtool_get_mac_stats,
+-	.get_rmon_stats		= airoha_ethtool_get_rmon_stats,
+-};
+-
+-static int airoha_alloc_gdm_port(struct airoha_eth *eth, struct device_node *np)
+-{
+-	const __be32 *id_ptr = of_get_property(np, "reg", NULL);
+-	struct airoha_gdm_port *port;
+-	struct airoha_qdma *qdma;
+-	struct net_device *dev;
+-	int err, index;
+-	u32 id;
+-
+-	if (!id_ptr) {
+-		dev_err(eth->dev, "missing gdm port id\n");
+-		return -EINVAL;
+-	}
+-
+-	id = be32_to_cpup(id_ptr);
+-	index = id - 1;
+-
+-	if (!id || id > ARRAY_SIZE(eth->ports)) {
+-		dev_err(eth->dev, "invalid gdm port id: %d\n", id);
+-		return -EINVAL;
+-	}
+-
+-	if (eth->ports[index]) {
+-		dev_err(eth->dev, "duplicate gdm port id: %d\n", id);
+-		return -EINVAL;
+-	}
+-
+-	dev = devm_alloc_etherdev_mqs(eth->dev, sizeof(*port),
+-				      AIROHA_NUM_NETDEV_TX_RINGS,
+-				      AIROHA_NUM_RX_RING);
+-	if (!dev) {
+-		dev_err(eth->dev, "alloc_etherdev failed\n");
+-		return -ENOMEM;
+-	}
+-
+-	qdma = &eth->qdma[index % AIROHA_MAX_NUM_QDMA];
+-	dev->netdev_ops = &airoha_netdev_ops;
+-	dev->ethtool_ops = &airoha_ethtool_ops;
+-	dev->max_mtu = AIROHA_MAX_MTU;
+-	dev->watchdog_timeo = 5 * HZ;
+-	dev->hw_features = NETIF_F_IP_CSUM | NETIF_F_RXCSUM |
+-			   NETIF_F_TSO6 | NETIF_F_IPV6_CSUM |
+-			   NETIF_F_SG | NETIF_F_TSO |
+-			   NETIF_F_HW_TC;
+-	dev->features |= dev->hw_features;
+-	dev->dev.of_node = np;
+-	dev->irq = qdma->irq;
+-	SET_NETDEV_DEV(dev, eth->dev);
+-
+-	/* reserve hw queues for HTB offloading */
+-	err = netif_set_real_num_tx_queues(dev, AIROHA_NUM_TX_RING);
+-	if (err)
+-		return err;
+-
+-	err = of_get_ethdev_address(np, dev);
+-	if (err) {
+-		if (err == -EPROBE_DEFER)
+-			return err;
+-
+-		eth_hw_addr_random(dev);
+-		dev_info(eth->dev, "generated random MAC address %pM\n",
+-			 dev->dev_addr);
+-	}
+-
+-	port = netdev_priv(dev);
+-	u64_stats_init(&port->stats.syncp);
+-	spin_lock_init(&port->stats.lock);
+-	port->qdma = qdma;
+-	port->dev = dev;
+-	port->id = id;
+-	eth->ports[index] = port;
+-
+-	return register_netdev(dev);
+-}
+-
+-static int airoha_probe(struct platform_device *pdev)
+-{
+-	struct device_node *np;
+-	struct airoha_eth *eth;
+-	int i, err;
+-
+-	eth = devm_kzalloc(&pdev->dev, sizeof(*eth), GFP_KERNEL);
+-	if (!eth)
+-		return -ENOMEM;
+-
+-	eth->dev = &pdev->dev;
+-
+-	err = dma_set_mask_and_coherent(eth->dev, DMA_BIT_MASK(32));
+-	if (err) {
+-		dev_err(eth->dev, "failed configuring DMA mask\n");
+-		return err;
+-	}
+-
+-	eth->fe_regs = devm_platform_ioremap_resource_byname(pdev, "fe");
+-	if (IS_ERR(eth->fe_regs))
+-		return dev_err_probe(eth->dev, PTR_ERR(eth->fe_regs),
+-				     "failed to iomap fe regs\n");
+-
+-	eth->rsts[0].id = "fe";
+-	eth->rsts[1].id = "pdma";
+-	eth->rsts[2].id = "qdma";
+-	err = devm_reset_control_bulk_get_exclusive(eth->dev,
+-						    ARRAY_SIZE(eth->rsts),
+-						    eth->rsts);
+-	if (err) {
+-		dev_err(eth->dev, "failed to get bulk reset lines\n");
+-		return err;
+-	}
+-
+-	eth->xsi_rsts[0].id = "xsi-mac";
+-	eth->xsi_rsts[1].id = "hsi0-mac";
+-	eth->xsi_rsts[2].id = "hsi1-mac";
+-	eth->xsi_rsts[3].id = "hsi-mac";
+-	eth->xsi_rsts[4].id = "xfp-mac";
+-	err = devm_reset_control_bulk_get_exclusive(eth->dev,
+-						    ARRAY_SIZE(eth->xsi_rsts),
+-						    eth->xsi_rsts);
+-	if (err) {
+-		dev_err(eth->dev, "failed to get bulk xsi reset lines\n");
+-		return err;
+-	}
+-
+-	eth->napi_dev = alloc_netdev_dummy(0);
+-	if (!eth->napi_dev)
+-		return -ENOMEM;
+-
+-	/* Enable threaded NAPI by default */
+-	eth->napi_dev->threaded = true;
+-	strscpy(eth->napi_dev->name, "qdma_eth", sizeof(eth->napi_dev->name));
+-	platform_set_drvdata(pdev, eth);
+-
+-	err = airoha_hw_init(pdev, eth);
+-	if (err)
+-		goto error_hw_cleanup;
+-
+-	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)
+-		airoha_qdma_start_napi(&eth->qdma[i]);
+-
+-	for_each_child_of_node(pdev->dev.of_node, np) {
+-		if (!of_device_is_compatible(np, "airoha,eth-mac"))
+-			continue;
+-
+-		if (!of_device_is_available(np))
+-			continue;
+-
+-		err = airoha_alloc_gdm_port(eth, np);
+-		if (err) {
+-			of_node_put(np);
+-			goto error_napi_stop;
+-		}
+-	}
+-
+-	return 0;
+-
+-error_napi_stop:
+-	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)
+-		airoha_qdma_stop_napi(&eth->qdma[i]);
+-error_hw_cleanup:
+-	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)
+-		airoha_hw_cleanup(&eth->qdma[i]);
+-
+-	for (i = 0; i < ARRAY_SIZE(eth->ports); i++) {
+-		struct airoha_gdm_port *port = eth->ports[i];
+-
+-		if (port && port->dev->reg_state == NETREG_REGISTERED)
+-			unregister_netdev(port->dev);
+-	}
+-	free_netdev(eth->napi_dev);
+-	platform_set_drvdata(pdev, NULL);
+-
+-	return err;
+-}
+-
+-static void airoha_remove(struct platform_device *pdev)
+-{
+-	struct airoha_eth *eth = platform_get_drvdata(pdev);
+-	int i;
+-
+-	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++) {
+-		airoha_qdma_stop_napi(&eth->qdma[i]);
+-		airoha_hw_cleanup(&eth->qdma[i]);
+-	}
+-
+-	for (i = 0; i < ARRAY_SIZE(eth->ports); i++) {
+-		struct airoha_gdm_port *port = eth->ports[i];
+-
+-		if (!port)
+-			continue;
+-
+-		airoha_dev_stop(port->dev);
+-		unregister_netdev(port->dev);
+-	}
+-	free_netdev(eth->napi_dev);
+-
+-	platform_set_drvdata(pdev, NULL);
+-}
+-
+-static const struct of_device_id of_airoha_match[] = {
+-	{ .compatible = "airoha,en7581-eth" },
+-	{ /* sentinel */ }
+-};
+-MODULE_DEVICE_TABLE(of, of_airoha_match);
+-
+-static struct platform_driver airoha_driver = {
+-	.probe = airoha_probe,
+-	.remove_new = airoha_remove,
+-	.driver = {
+-		.name = KBUILD_MODNAME,
+-		.of_match_table = of_airoha_match,
+-	},
+-};
+-module_platform_driver(airoha_driver);
+-
+-MODULE_LICENSE("GPL");
+-MODULE_AUTHOR("Lorenzo Bianconi <lorenzo@kernel.org>");
+-MODULE_DESCRIPTION("Ethernet driver for Airoha SoC");
diff --git a/target/linux/airoha/patches-6.6/048-02-v6.15-net-airoha-Move-definitions-in-airoha_eth.h.patch b/target/linux/airoha/patches-6.6/048-02-v6.15-net-airoha-Move-definitions-in-airoha_eth.h.patch
new file mode 100644
index 00000000000000..85391281a25934
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/048-02-v6.15-net-airoha-Move-definitions-in-airoha_eth.h.patch
@@ -0,0 +1,538 @@
+From b38f4ff0ceacd6ce8d333a8dc90f405a040968d3 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 28 Feb 2025 11:54:10 +0100
+Subject: [PATCH 02/15] net: airoha: Move definitions in airoha_eth.h
+
+Move common airoha_eth definitions in airoha_eth.h in order to reuse
+them for Packet Processor Engine (PPE) codebase.
+PPE module is used to enable support for flowtable hw offloading in
+airoha_eth driver.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/airoha/airoha_eth.c | 240 +---------------------
+ drivers/net/ethernet/airoha/airoha_eth.h | 251 +++++++++++++++++++++++
+ 2 files changed, 252 insertions(+), 239 deletions(-)
+ create mode 100644 drivers/net/ethernet/airoha/airoha_eth.h
+
+--- a/drivers/net/ethernet/airoha/airoha_eth.c
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -3,14 +3,9 @@
+  * Copyright (c) 2024 AIROHA Inc
+  * Author: Lorenzo Bianconi <lorenzo@kernel.org>
+  */
+-#include <linux/etherdevice.h>
+-#include <linux/iopoll.h>
+-#include <linux/kernel.h>
+-#include <linux/netdevice.h>
+ #include <linux/of.h>
+ #include <linux/of_net.h>
+ #include <linux/platform_device.h>
+-#include <linux/reset.h>
+ #include <linux/tcp.h>
+ #include <linux/u64_stats_sync.h>
+ #include <net/dsa.h>
+@@ -18,35 +13,7 @@
+ #include <net/pkt_cls.h>
+ #include <uapi/linux/ppp_defs.h>
+ 
+-#define AIROHA_MAX_NUM_GDM_PORTS	1
+-#define AIROHA_MAX_NUM_QDMA		2
+-#define AIROHA_MAX_NUM_RSTS		3
+-#define AIROHA_MAX_NUM_XSI_RSTS		5
+-#define AIROHA_MAX_MTU			2000
+-#define AIROHA_MAX_PACKET_SIZE		2048
+-#define AIROHA_NUM_QOS_CHANNELS		4
+-#define AIROHA_NUM_QOS_QUEUES		8
+-#define AIROHA_NUM_TX_RING		32
+-#define AIROHA_NUM_RX_RING		32
+-#define AIROHA_NUM_NETDEV_TX_RINGS	(AIROHA_NUM_TX_RING + \
+-					 AIROHA_NUM_QOS_CHANNELS)
+-#define AIROHA_FE_MC_MAX_VLAN_TABLE	64
+-#define AIROHA_FE_MC_MAX_VLAN_PORT	16
+-#define AIROHA_NUM_TX_IRQ		2
+-#define HW_DSCP_NUM			2048
+-#define IRQ_QUEUE_LEN(_n)		((_n) ? 1024 : 2048)
+-#define TX_DSCP_NUM			1024
+-#define RX_DSCP_NUM(_n)			\
+-	((_n) ==  2 ? 128 :		\
+-	 (_n) == 11 ? 128 :		\
+-	 (_n) == 15 ? 128 :		\
+-	 (_n) ==  0 ? 1024 : 16)
+-
+-#define PSE_RSV_PAGES			128
+-#define PSE_QUEUE_RSV_PAGES		64
+-
+-#define QDMA_METER_IDX(_n)		((_n) & 0xff)
+-#define QDMA_METER_GROUP(_n)		(((_n) >> 8) & 0x3)
++#include "airoha_eth.h"
+ 
+ /* FE */
+ #define PSE_BASE			0x0100
+@@ -706,211 +673,6 @@ struct airoha_qdma_fwd_desc {
+ 	__le32 rsv1;
+ };
+ 
+-enum {
+-	QDMA_INT_REG_IDX0,
+-	QDMA_INT_REG_IDX1,
+-	QDMA_INT_REG_IDX2,
+-	QDMA_INT_REG_IDX3,
+-	QDMA_INT_REG_IDX4,
+-	QDMA_INT_REG_MAX
+-};
+-
+-enum {
+-	XSI_PCIE0_PORT,
+-	XSI_PCIE1_PORT,
+-	XSI_USB_PORT,
+-	XSI_AE_PORT,
+-	XSI_ETH_PORT,
+-};
+-
+-enum {
+-	XSI_PCIE0_VIP_PORT_MASK	= BIT(22),
+-	XSI_PCIE1_VIP_PORT_MASK	= BIT(23),
+-	XSI_USB_VIP_PORT_MASK	= BIT(25),
+-	XSI_ETH_VIP_PORT_MASK	= BIT(24),
+-};
+-
+-enum {
+-	DEV_STATE_INITIALIZED,
+-};
+-
+-enum {
+-	CDM_CRSN_QSEL_Q1 = 1,
+-	CDM_CRSN_QSEL_Q5 = 5,
+-	CDM_CRSN_QSEL_Q6 = 6,
+-	CDM_CRSN_QSEL_Q15 = 15,
+-};
+-
+-enum {
+-	CRSN_08 = 0x8,
+-	CRSN_21 = 0x15, /* KA */
+-	CRSN_22 = 0x16, /* hit bind and force route to CPU */
+-	CRSN_24 = 0x18,
+-	CRSN_25 = 0x19,
+-};
+-
+-enum {
+-	FE_PSE_PORT_CDM1,
+-	FE_PSE_PORT_GDM1,
+-	FE_PSE_PORT_GDM2,
+-	FE_PSE_PORT_GDM3,
+-	FE_PSE_PORT_PPE1,
+-	FE_PSE_PORT_CDM2,
+-	FE_PSE_PORT_CDM3,
+-	FE_PSE_PORT_CDM4,
+-	FE_PSE_PORT_PPE2,
+-	FE_PSE_PORT_GDM4,
+-	FE_PSE_PORT_CDM5,
+-	FE_PSE_PORT_DROP = 0xf,
+-};
+-
+-enum tx_sched_mode {
+-	TC_SCH_WRR8,
+-	TC_SCH_SP,
+-	TC_SCH_WRR7,
+-	TC_SCH_WRR6,
+-	TC_SCH_WRR5,
+-	TC_SCH_WRR4,
+-	TC_SCH_WRR3,
+-	TC_SCH_WRR2,
+-};
+-
+-enum trtcm_param_type {
+-	TRTCM_MISC_MODE, /* meter_en, pps_mode, tick_sel */
+-	TRTCM_TOKEN_RATE_MODE,
+-	TRTCM_BUCKETSIZE_SHIFT_MODE,
+-	TRTCM_BUCKET_COUNTER_MODE,
+-};
+-
+-enum trtcm_mode_type {
+-	TRTCM_COMMIT_MODE,
+-	TRTCM_PEAK_MODE,
+-};
+-
+-enum trtcm_param {
+-	TRTCM_TICK_SEL = BIT(0),
+-	TRTCM_PKT_MODE = BIT(1),
+-	TRTCM_METER_MODE = BIT(2),
+-};
+-
+-#define MIN_TOKEN_SIZE				4096
+-#define MAX_TOKEN_SIZE_OFFSET			17
+-#define TRTCM_TOKEN_RATE_MASK			GENMASK(23, 6)
+-#define TRTCM_TOKEN_RATE_FRACTION_MASK		GENMASK(5, 0)
+-
+-struct airoha_queue_entry {
+-	union {
+-		void *buf;
+-		struct sk_buff *skb;
+-	};
+-	dma_addr_t dma_addr;
+-	u16 dma_len;
+-};
+-
+-struct airoha_queue {
+-	struct airoha_qdma *qdma;
+-
+-	/* protect concurrent queue accesses */
+-	spinlock_t lock;
+-	struct airoha_queue_entry *entry;
+-	struct airoha_qdma_desc *desc;
+-	u16 head;
+-	u16 tail;
+-
+-	int queued;
+-	int ndesc;
+-	int free_thr;
+-	int buf_size;
+-
+-	struct napi_struct napi;
+-	struct page_pool *page_pool;
+-};
+-
+-struct airoha_tx_irq_queue {
+-	struct airoha_qdma *qdma;
+-
+-	struct napi_struct napi;
+-
+-	int size;
+-	u32 *q;
+-};
+-
+-struct airoha_hw_stats {
+-	/* protect concurrent hw_stats accesses */
+-	spinlock_t lock;
+-	struct u64_stats_sync syncp;
+-
+-	/* get_stats64 */
+-	u64 rx_ok_pkts;
+-	u64 tx_ok_pkts;
+-	u64 rx_ok_bytes;
+-	u64 tx_ok_bytes;
+-	u64 rx_multicast;
+-	u64 rx_errors;
+-	u64 rx_drops;
+-	u64 tx_drops;
+-	u64 rx_crc_error;
+-	u64 rx_over_errors;
+-	/* ethtool stats */
+-	u64 tx_broadcast;
+-	u64 tx_multicast;
+-	u64 tx_len[7];
+-	u64 rx_broadcast;
+-	u64 rx_fragment;
+-	u64 rx_jabber;
+-	u64 rx_len[7];
+-};
+-
+-struct airoha_qdma {
+-	struct airoha_eth *eth;
+-	void __iomem *regs;
+-
+-	/* protect concurrent irqmask accesses */
+-	spinlock_t irq_lock;
+-	u32 irqmask[QDMA_INT_REG_MAX];
+-	int irq;
+-
+-	struct airoha_tx_irq_queue q_tx_irq[AIROHA_NUM_TX_IRQ];
+-
+-	struct airoha_queue q_tx[AIROHA_NUM_TX_RING];
+-	struct airoha_queue q_rx[AIROHA_NUM_RX_RING];
+-
+-	/* descriptor and packet buffers for qdma hw forward */
+-	struct {
+-		void *desc;
+-		void *q;
+-	} hfwd;
+-};
+-
+-struct airoha_gdm_port {
+-	struct airoha_qdma *qdma;
+-	struct net_device *dev;
+-	int id;
+-
+-	struct airoha_hw_stats stats;
+-
+-	DECLARE_BITMAP(qos_sq_bmap, AIROHA_NUM_QOS_CHANNELS);
+-
+-	/* qos stats counters */
+-	u64 cpu_tx_packets;
+-	u64 fwd_tx_packets;
+-};
+-
+-struct airoha_eth {
+-	struct device *dev;
+-
+-	unsigned long state;
+-	void __iomem *fe_regs;
+-
+-	struct reset_control_bulk_data rsts[AIROHA_MAX_NUM_RSTS];
+-	struct reset_control_bulk_data xsi_rsts[AIROHA_MAX_NUM_XSI_RSTS];
+-
+-	struct net_device *napi_dev;
+-
+-	struct airoha_qdma qdma[AIROHA_MAX_NUM_QDMA];
+-	struct airoha_gdm_port *ports[AIROHA_MAX_NUM_GDM_PORTS];
+-};
+-
+ static u32 airoha_rr(void __iomem *base, u32 offset)
+ {
+ 	return readl(base + offset);
+--- /dev/null
++++ b/drivers/net/ethernet/airoha/airoha_eth.h
+@@ -0,0 +1,251 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++/*
++ * Copyright (c) 2024 AIROHA Inc
++ * Author: Lorenzo Bianconi <lorenzo@kernel.org>
++ */
++
++#ifndef AIROHA_ETH_H
++#define AIROHA_ETH_H
++
++#include <linux/etherdevice.h>
++#include <linux/iopoll.h>
++#include <linux/kernel.h>
++#include <linux/netdevice.h>
++#include <linux/reset.h>
++
++#define AIROHA_MAX_NUM_GDM_PORTS	1
++#define AIROHA_MAX_NUM_QDMA		2
++#define AIROHA_MAX_NUM_RSTS		3
++#define AIROHA_MAX_NUM_XSI_RSTS		5
++#define AIROHA_MAX_MTU			2000
++#define AIROHA_MAX_PACKET_SIZE		2048
++#define AIROHA_NUM_QOS_CHANNELS		4
++#define AIROHA_NUM_QOS_QUEUES		8
++#define AIROHA_NUM_TX_RING		32
++#define AIROHA_NUM_RX_RING		32
++#define AIROHA_NUM_NETDEV_TX_RINGS	(AIROHA_NUM_TX_RING + \
++					 AIROHA_NUM_QOS_CHANNELS)
++#define AIROHA_FE_MC_MAX_VLAN_TABLE	64
++#define AIROHA_FE_MC_MAX_VLAN_PORT	16
++#define AIROHA_NUM_TX_IRQ		2
++#define HW_DSCP_NUM			2048
++#define IRQ_QUEUE_LEN(_n)		((_n) ? 1024 : 2048)
++#define TX_DSCP_NUM			1024
++#define RX_DSCP_NUM(_n)			\
++	((_n) ==  2 ? 128 :		\
++	 (_n) == 11 ? 128 :		\
++	 (_n) == 15 ? 128 :		\
++	 (_n) ==  0 ? 1024 : 16)
++
++#define PSE_RSV_PAGES			128
++#define PSE_QUEUE_RSV_PAGES		64
++
++#define QDMA_METER_IDX(_n)		((_n) & 0xff)
++#define QDMA_METER_GROUP(_n)		(((_n) >> 8) & 0x3)
++
++enum {
++	QDMA_INT_REG_IDX0,
++	QDMA_INT_REG_IDX1,
++	QDMA_INT_REG_IDX2,
++	QDMA_INT_REG_IDX3,
++	QDMA_INT_REG_IDX4,
++	QDMA_INT_REG_MAX
++};
++
++enum {
++	XSI_PCIE0_PORT,
++	XSI_PCIE1_PORT,
++	XSI_USB_PORT,
++	XSI_AE_PORT,
++	XSI_ETH_PORT,
++};
++
++enum {
++	XSI_PCIE0_VIP_PORT_MASK	= BIT(22),
++	XSI_PCIE1_VIP_PORT_MASK	= BIT(23),
++	XSI_USB_VIP_PORT_MASK	= BIT(25),
++	XSI_ETH_VIP_PORT_MASK	= BIT(24),
++};
++
++enum {
++	DEV_STATE_INITIALIZED,
++};
++
++enum {
++	CDM_CRSN_QSEL_Q1 = 1,
++	CDM_CRSN_QSEL_Q5 = 5,
++	CDM_CRSN_QSEL_Q6 = 6,
++	CDM_CRSN_QSEL_Q15 = 15,
++};
++
++enum {
++	CRSN_08 = 0x8,
++	CRSN_21 = 0x15, /* KA */
++	CRSN_22 = 0x16, /* hit bind and force route to CPU */
++	CRSN_24 = 0x18,
++	CRSN_25 = 0x19,
++};
++
++enum {
++	FE_PSE_PORT_CDM1,
++	FE_PSE_PORT_GDM1,
++	FE_PSE_PORT_GDM2,
++	FE_PSE_PORT_GDM3,
++	FE_PSE_PORT_PPE1,
++	FE_PSE_PORT_CDM2,
++	FE_PSE_PORT_CDM3,
++	FE_PSE_PORT_CDM4,
++	FE_PSE_PORT_PPE2,
++	FE_PSE_PORT_GDM4,
++	FE_PSE_PORT_CDM5,
++	FE_PSE_PORT_DROP = 0xf,
++};
++
++enum tx_sched_mode {
++	TC_SCH_WRR8,
++	TC_SCH_SP,
++	TC_SCH_WRR7,
++	TC_SCH_WRR6,
++	TC_SCH_WRR5,
++	TC_SCH_WRR4,
++	TC_SCH_WRR3,
++	TC_SCH_WRR2,
++};
++
++enum trtcm_param_type {
++	TRTCM_MISC_MODE, /* meter_en, pps_mode, tick_sel */
++	TRTCM_TOKEN_RATE_MODE,
++	TRTCM_BUCKETSIZE_SHIFT_MODE,
++	TRTCM_BUCKET_COUNTER_MODE,
++};
++
++enum trtcm_mode_type {
++	TRTCM_COMMIT_MODE,
++	TRTCM_PEAK_MODE,
++};
++
++enum trtcm_param {
++	TRTCM_TICK_SEL = BIT(0),
++	TRTCM_PKT_MODE = BIT(1),
++	TRTCM_METER_MODE = BIT(2),
++};
++
++#define MIN_TOKEN_SIZE				4096
++#define MAX_TOKEN_SIZE_OFFSET			17
++#define TRTCM_TOKEN_RATE_MASK			GENMASK(23, 6)
++#define TRTCM_TOKEN_RATE_FRACTION_MASK		GENMASK(5, 0)
++
++struct airoha_queue_entry {
++	union {
++		void *buf;
++		struct sk_buff *skb;
++	};
++	dma_addr_t dma_addr;
++	u16 dma_len;
++};
++
++struct airoha_queue {
++	struct airoha_qdma *qdma;
++
++	/* protect concurrent queue accesses */
++	spinlock_t lock;
++	struct airoha_queue_entry *entry;
++	struct airoha_qdma_desc *desc;
++	u16 head;
++	u16 tail;
++
++	int queued;
++	int ndesc;
++	int free_thr;
++	int buf_size;
++
++	struct napi_struct napi;
++	struct page_pool *page_pool;
++};
++
++struct airoha_tx_irq_queue {
++	struct airoha_qdma *qdma;
++
++	struct napi_struct napi;
++
++	int size;
++	u32 *q;
++};
++
++struct airoha_hw_stats {
++	/* protect concurrent hw_stats accesses */
++	spinlock_t lock;
++	struct u64_stats_sync syncp;
++
++	/* get_stats64 */
++	u64 rx_ok_pkts;
++	u64 tx_ok_pkts;
++	u64 rx_ok_bytes;
++	u64 tx_ok_bytes;
++	u64 rx_multicast;
++	u64 rx_errors;
++	u64 rx_drops;
++	u64 tx_drops;
++	u64 rx_crc_error;
++	u64 rx_over_errors;
++	/* ethtool stats */
++	u64 tx_broadcast;
++	u64 tx_multicast;
++	u64 tx_len[7];
++	u64 rx_broadcast;
++	u64 rx_fragment;
++	u64 rx_jabber;
++	u64 rx_len[7];
++};
++
++struct airoha_qdma {
++	struct airoha_eth *eth;
++	void __iomem *regs;
++
++	/* protect concurrent irqmask accesses */
++	spinlock_t irq_lock;
++	u32 irqmask[QDMA_INT_REG_MAX];
++	int irq;
++
++	struct airoha_tx_irq_queue q_tx_irq[AIROHA_NUM_TX_IRQ];
++
++	struct airoha_queue q_tx[AIROHA_NUM_TX_RING];
++	struct airoha_queue q_rx[AIROHA_NUM_RX_RING];
++
++	/* descriptor and packet buffers for qdma hw forward */
++	struct {
++		void *desc;
++		void *q;
++	} hfwd;
++};
++
++struct airoha_gdm_port {
++	struct airoha_qdma *qdma;
++	struct net_device *dev;
++	int id;
++
++	struct airoha_hw_stats stats;
++
++	DECLARE_BITMAP(qos_sq_bmap, AIROHA_NUM_QOS_CHANNELS);
++
++	/* qos stats counters */
++	u64 cpu_tx_packets;
++	u64 fwd_tx_packets;
++};
++
++struct airoha_eth {
++	struct device *dev;
++
++	unsigned long state;
++	void __iomem *fe_regs;
++
++	struct reset_control_bulk_data rsts[AIROHA_MAX_NUM_RSTS];
++	struct reset_control_bulk_data xsi_rsts[AIROHA_MAX_NUM_XSI_RSTS];
++
++	struct net_device *napi_dev;
++
++	struct airoha_qdma qdma[AIROHA_MAX_NUM_QDMA];
++	struct airoha_gdm_port *ports[AIROHA_MAX_NUM_GDM_PORTS];
++};
++
++#endif /* AIROHA_ETH_H */
diff --git a/target/linux/airoha/patches-6.6/048-03-v6.15-net-airoha-Move-reg-write-utility-routines-in-airoha.patch b/target/linux/airoha/patches-6.6/048-03-v6.15-net-airoha-Move-reg-write-utility-routines-in-airoha.patch
new file mode 100644
index 00000000000000..bf24638ec91fb9
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/048-03-v6.15-net-airoha-Move-reg-write-utility-routines-in-airoha.patch
@@ -0,0 +1,101 @@
+From e0758a8694fbaffdc72940774db295585e951119 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 28 Feb 2025 11:54:11 +0100
+Subject: [PATCH 03/15] net: airoha: Move reg/write utility routines in
+ airoha_eth.h
+
+This is a preliminary patch to introduce flowtable hw offloading
+support for airoha_eth driver.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/airoha/airoha_eth.c | 28 +++---------------------
+ drivers/net/ethernet/airoha/airoha_eth.h | 26 ++++++++++++++++++++++
+ 2 files changed, 29 insertions(+), 25 deletions(-)
+
+--- a/drivers/net/ethernet/airoha/airoha_eth.c
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -673,17 +673,17 @@ struct airoha_qdma_fwd_desc {
+ 	__le32 rsv1;
+ };
+ 
+-static u32 airoha_rr(void __iomem *base, u32 offset)
++u32 airoha_rr(void __iomem *base, u32 offset)
+ {
+ 	return readl(base + offset);
+ }
+ 
+-static void airoha_wr(void __iomem *base, u32 offset, u32 val)
++void airoha_wr(void __iomem *base, u32 offset, u32 val)
+ {
+ 	writel(val, base + offset);
+ }
+ 
+-static u32 airoha_rmw(void __iomem *base, u32 offset, u32 mask, u32 val)
++u32 airoha_rmw(void __iomem *base, u32 offset, u32 mask, u32 val)
+ {
+ 	val |= (airoha_rr(base, offset) & ~mask);
+ 	airoha_wr(base, offset, val);
+@@ -691,28 +691,6 @@ static u32 airoha_rmw(void __iomem *base
+ 	return val;
+ }
+ 
+-#define airoha_fe_rr(eth, offset)				\
+-	airoha_rr((eth)->fe_regs, (offset))
+-#define airoha_fe_wr(eth, offset, val)				\
+-	airoha_wr((eth)->fe_regs, (offset), (val))
+-#define airoha_fe_rmw(eth, offset, mask, val)			\
+-	airoha_rmw((eth)->fe_regs, (offset), (mask), (val))
+-#define airoha_fe_set(eth, offset, val)				\
+-	airoha_rmw((eth)->fe_regs, (offset), 0, (val))
+-#define airoha_fe_clear(eth, offset, val)			\
+-	airoha_rmw((eth)->fe_regs, (offset), (val), 0)
+-
+-#define airoha_qdma_rr(qdma, offset)				\
+-	airoha_rr((qdma)->regs, (offset))
+-#define airoha_qdma_wr(qdma, offset, val)			\
+-	airoha_wr((qdma)->regs, (offset), (val))
+-#define airoha_qdma_rmw(qdma, offset, mask, val)		\
+-	airoha_rmw((qdma)->regs, (offset), (mask), (val))
+-#define airoha_qdma_set(qdma, offset, val)			\
+-	airoha_rmw((qdma)->regs, (offset), 0, (val))
+-#define airoha_qdma_clear(qdma, offset, val)			\
+-	airoha_rmw((qdma)->regs, (offset), (val), 0)
+-
+ static void airoha_qdma_set_irqmask(struct airoha_qdma *qdma, int index,
+ 				    u32 clear, u32 set)
+ {
+--- a/drivers/net/ethernet/airoha/airoha_eth.h
++++ b/drivers/net/ethernet/airoha/airoha_eth.h
+@@ -248,4 +248,30 @@ struct airoha_eth {
+ 	struct airoha_gdm_port *ports[AIROHA_MAX_NUM_GDM_PORTS];
+ };
+ 
++u32 airoha_rr(void __iomem *base, u32 offset);
++void airoha_wr(void __iomem *base, u32 offset, u32 val);
++u32 airoha_rmw(void __iomem *base, u32 offset, u32 mask, u32 val);
++
++#define airoha_fe_rr(eth, offset)				\
++	airoha_rr((eth)->fe_regs, (offset))
++#define airoha_fe_wr(eth, offset, val)				\
++	airoha_wr((eth)->fe_regs, (offset), (val))
++#define airoha_fe_rmw(eth, offset, mask, val)			\
++	airoha_rmw((eth)->fe_regs, (offset), (mask), (val))
++#define airoha_fe_set(eth, offset, val)				\
++	airoha_rmw((eth)->fe_regs, (offset), 0, (val))
++#define airoha_fe_clear(eth, offset, val)			\
++	airoha_rmw((eth)->fe_regs, (offset), (val), 0)
++
++#define airoha_qdma_rr(qdma, offset)				\
++	airoha_rr((qdma)->regs, (offset))
++#define airoha_qdma_wr(qdma, offset, val)			\
++	airoha_wr((qdma)->regs, (offset), (val))
++#define airoha_qdma_rmw(qdma, offset, mask, val)		\
++	airoha_rmw((qdma)->regs, (offset), (mask), (val))
++#define airoha_qdma_set(qdma, offset, val)			\
++	airoha_rmw((qdma)->regs, (offset), 0, (val))
++#define airoha_qdma_clear(qdma, offset, val)			\
++	airoha_rmw((qdma)->regs, (offset), (val), 0)
++
+ #endif /* AIROHA_ETH_H */
diff --git a/target/linux/airoha/patches-6.6/048-04-v6.15-net-airoha-Move-register-definitions-in-airoha_regs..patch b/target/linux/airoha/patches-6.6/048-04-v6.15-net-airoha-Move-register-definitions-in-airoha_regs..patch
new file mode 100644
index 00000000000000..3b2b8bfe5dcfdd
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/048-04-v6.15-net-airoha-Move-register-definitions-in-airoha_regs..patch
@@ -0,0 +1,1361 @@
+From ec663d9a82bf4d16721f6b1fc29df4892ba6c088 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 28 Feb 2025 11:54:12 +0100
+Subject: [PATCH 04/15] net: airoha: Move register definitions in airoha_regs.h
+
+Move common airoha_eth register definitions in airoha_regs.h in order
+to reuse them for Packet Processor Engine (PPE) codebase.
+PPE module is used to enable support for flowtable hw offloading in
+airoha_eth driver.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/airoha/airoha_eth.c  | 659 +--------------------
+ drivers/net/ethernet/airoha/airoha_regs.h | 670 ++++++++++++++++++++++
+ 2 files changed, 671 insertions(+), 658 deletions(-)
+ create mode 100644 drivers/net/ethernet/airoha/airoha_regs.h
+
+--- a/drivers/net/ethernet/airoha/airoha_eth.c
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -13,666 +13,9 @@
+ #include <net/pkt_cls.h>
+ #include <uapi/linux/ppp_defs.h>
+ 
++#include "airoha_regs.h"
+ #include "airoha_eth.h"
+ 
+-/* FE */
+-#define PSE_BASE			0x0100
+-#define CSR_IFC_BASE			0x0200
+-#define CDM1_BASE			0x0400
+-#define GDM1_BASE			0x0500
+-#define PPE1_BASE			0x0c00
+-
+-#define CDM2_BASE			0x1400
+-#define GDM2_BASE			0x1500
+-
+-#define GDM3_BASE			0x1100
+-#define GDM4_BASE			0x2500
+-
+-#define GDM_BASE(_n)			\
+-	((_n) == 4 ? GDM4_BASE :	\
+-	 (_n) == 3 ? GDM3_BASE :	\
+-	 (_n) == 2 ? GDM2_BASE : GDM1_BASE)
+-
+-#define REG_FE_DMA_GLO_CFG		0x0000
+-#define FE_DMA_GLO_L2_SPACE_MASK	GENMASK(7, 4)
+-#define FE_DMA_GLO_PG_SZ_MASK		BIT(3)
+-
+-#define REG_FE_RST_GLO_CFG		0x0004
+-#define FE_RST_GDM4_MBI_ARB_MASK	BIT(3)
+-#define FE_RST_GDM3_MBI_ARB_MASK	BIT(2)
+-#define FE_RST_CORE_MASK		BIT(0)
+-
+-#define REG_FE_WAN_MAC_H		0x0030
+-#define REG_FE_LAN_MAC_H		0x0040
+-
+-#define REG_FE_MAC_LMIN(_n)		((_n) + 0x04)
+-#define REG_FE_MAC_LMAX(_n)		((_n) + 0x08)
+-
+-#define REG_FE_CDM1_OQ_MAP0		0x0050
+-#define REG_FE_CDM1_OQ_MAP1		0x0054
+-#define REG_FE_CDM1_OQ_MAP2		0x0058
+-#define REG_FE_CDM1_OQ_MAP3		0x005c
+-
+-#define REG_FE_PCE_CFG			0x0070
+-#define PCE_DPI_EN_MASK			BIT(2)
+-#define PCE_KA_EN_MASK			BIT(1)
+-#define PCE_MC_EN_MASK			BIT(0)
+-
+-#define REG_FE_PSE_QUEUE_CFG_WR		0x0080
+-#define PSE_CFG_PORT_ID_MASK		GENMASK(27, 24)
+-#define PSE_CFG_QUEUE_ID_MASK		GENMASK(20, 16)
+-#define PSE_CFG_WR_EN_MASK		BIT(8)
+-#define PSE_CFG_OQRSV_SEL_MASK		BIT(0)
+-
+-#define REG_FE_PSE_QUEUE_CFG_VAL	0x0084
+-#define PSE_CFG_OQ_RSV_MASK		GENMASK(13, 0)
+-
+-#define PSE_FQ_CFG			0x008c
+-#define PSE_FQ_LIMIT_MASK		GENMASK(14, 0)
+-
+-#define REG_FE_PSE_BUF_SET		0x0090
+-#define PSE_SHARE_USED_LTHD_MASK	GENMASK(31, 16)
+-#define PSE_ALLRSV_MASK			GENMASK(14, 0)
+-
+-#define REG_PSE_SHARE_USED_THD		0x0094
+-#define PSE_SHARE_USED_MTHD_MASK	GENMASK(31, 16)
+-#define PSE_SHARE_USED_HTHD_MASK	GENMASK(15, 0)
+-
+-#define REG_GDM_MISC_CFG		0x0148
+-#define GDM2_RDM_ACK_WAIT_PREF_MASK	BIT(9)
+-#define GDM2_CHN_VLD_MODE_MASK		BIT(5)
+-
+-#define REG_FE_CSR_IFC_CFG		CSR_IFC_BASE
+-#define FE_IFC_EN_MASK			BIT(0)
+-
+-#define REG_FE_VIP_PORT_EN		0x01f0
+-#define REG_FE_IFC_PORT_EN		0x01f4
+-
+-#define REG_PSE_IQ_REV1			(PSE_BASE + 0x08)
+-#define PSE_IQ_RES1_P2_MASK		GENMASK(23, 16)
+-
+-#define REG_PSE_IQ_REV2			(PSE_BASE + 0x0c)
+-#define PSE_IQ_RES2_P5_MASK		GENMASK(15, 8)
+-#define PSE_IQ_RES2_P4_MASK		GENMASK(7, 0)
+-
+-#define REG_FE_VIP_EN(_n)		(0x0300 + ((_n) << 3))
+-#define PATN_FCPU_EN_MASK		BIT(7)
+-#define PATN_SWP_EN_MASK		BIT(6)
+-#define PATN_DP_EN_MASK			BIT(5)
+-#define PATN_SP_EN_MASK			BIT(4)
+-#define PATN_TYPE_MASK			GENMASK(3, 1)
+-#define PATN_EN_MASK			BIT(0)
+-
+-#define REG_FE_VIP_PATN(_n)		(0x0304 + ((_n) << 3))
+-#define PATN_DP_MASK			GENMASK(31, 16)
+-#define PATN_SP_MASK			GENMASK(15, 0)
+-
+-#define REG_CDM1_VLAN_CTRL		CDM1_BASE
+-#define CDM1_VLAN_MASK			GENMASK(31, 16)
+-
+-#define REG_CDM1_FWD_CFG		(CDM1_BASE + 0x08)
+-#define CDM1_VIP_QSEL_MASK		GENMASK(24, 20)
+-
+-#define REG_CDM1_CRSN_QSEL(_n)		(CDM1_BASE + 0x10 + ((_n) << 2))
+-#define CDM1_CRSN_QSEL_REASON_MASK(_n)	\
+-	GENMASK(4 + (((_n) % 4) << 3),	(((_n) % 4) << 3))
+-
+-#define REG_CDM2_FWD_CFG		(CDM2_BASE + 0x08)
+-#define CDM2_OAM_QSEL_MASK		GENMASK(31, 27)
+-#define CDM2_VIP_QSEL_MASK		GENMASK(24, 20)
+-
+-#define REG_CDM2_CRSN_QSEL(_n)		(CDM2_BASE + 0x10 + ((_n) << 2))
+-#define CDM2_CRSN_QSEL_REASON_MASK(_n)	\
+-	GENMASK(4 + (((_n) % 4) << 3),	(((_n) % 4) << 3))
+-
+-#define REG_GDM_FWD_CFG(_n)		GDM_BASE(_n)
+-#define GDM_DROP_CRC_ERR		BIT(23)
+-#define GDM_IP4_CKSUM			BIT(22)
+-#define GDM_TCP_CKSUM			BIT(21)
+-#define GDM_UDP_CKSUM			BIT(20)
+-#define GDM_UCFQ_MASK			GENMASK(15, 12)
+-#define GDM_BCFQ_MASK			GENMASK(11, 8)
+-#define GDM_MCFQ_MASK			GENMASK(7, 4)
+-#define GDM_OCFQ_MASK			GENMASK(3, 0)
+-
+-#define REG_GDM_INGRESS_CFG(_n)		(GDM_BASE(_n) + 0x10)
+-#define GDM_INGRESS_FC_EN_MASK		BIT(1)
+-#define GDM_STAG_EN_MASK		BIT(0)
+-
+-#define REG_GDM_LEN_CFG(_n)		(GDM_BASE(_n) + 0x14)
+-#define GDM_SHORT_LEN_MASK		GENMASK(13, 0)
+-#define GDM_LONG_LEN_MASK		GENMASK(29, 16)
+-
+-#define REG_FE_CPORT_CFG		(GDM1_BASE + 0x40)
+-#define FE_CPORT_PAD			BIT(26)
+-#define FE_CPORT_PORT_XFC_MASK		BIT(25)
+-#define FE_CPORT_QUEUE_XFC_MASK		BIT(24)
+-
+-#define REG_FE_GDM_MIB_CLEAR(_n)	(GDM_BASE(_n) + 0xf0)
+-#define FE_GDM_MIB_RX_CLEAR_MASK	BIT(1)
+-#define FE_GDM_MIB_TX_CLEAR_MASK	BIT(0)
+-
+-#define REG_FE_GDM1_MIB_CFG		(GDM1_BASE + 0xf4)
+-#define FE_STRICT_RFC2819_MODE_MASK	BIT(31)
+-#define FE_GDM1_TX_MIB_SPLIT_EN_MASK	BIT(17)
+-#define FE_GDM1_RX_MIB_SPLIT_EN_MASK	BIT(16)
+-#define FE_TX_MIB_ID_MASK		GENMASK(15, 8)
+-#define FE_RX_MIB_ID_MASK		GENMASK(7, 0)
+-
+-#define REG_FE_GDM_TX_OK_PKT_CNT_L(_n)		(GDM_BASE(_n) + 0x104)
+-#define REG_FE_GDM_TX_OK_BYTE_CNT_L(_n)		(GDM_BASE(_n) + 0x10c)
+-#define REG_FE_GDM_TX_ETH_PKT_CNT_L(_n)		(GDM_BASE(_n) + 0x110)
+-#define REG_FE_GDM_TX_ETH_BYTE_CNT_L(_n)	(GDM_BASE(_n) + 0x114)
+-#define REG_FE_GDM_TX_ETH_DROP_CNT(_n)		(GDM_BASE(_n) + 0x118)
+-#define REG_FE_GDM_TX_ETH_BC_CNT(_n)		(GDM_BASE(_n) + 0x11c)
+-#define REG_FE_GDM_TX_ETH_MC_CNT(_n)		(GDM_BASE(_n) + 0x120)
+-#define REG_FE_GDM_TX_ETH_RUNT_CNT(_n)		(GDM_BASE(_n) + 0x124)
+-#define REG_FE_GDM_TX_ETH_LONG_CNT(_n)		(GDM_BASE(_n) + 0x128)
+-#define REG_FE_GDM_TX_ETH_E64_CNT_L(_n)		(GDM_BASE(_n) + 0x12c)
+-#define REG_FE_GDM_TX_ETH_L64_CNT_L(_n)		(GDM_BASE(_n) + 0x130)
+-#define REG_FE_GDM_TX_ETH_L127_CNT_L(_n)	(GDM_BASE(_n) + 0x134)
+-#define REG_FE_GDM_TX_ETH_L255_CNT_L(_n)	(GDM_BASE(_n) + 0x138)
+-#define REG_FE_GDM_TX_ETH_L511_CNT_L(_n)	(GDM_BASE(_n) + 0x13c)
+-#define REG_FE_GDM_TX_ETH_L1023_CNT_L(_n)	(GDM_BASE(_n) + 0x140)
+-
+-#define REG_FE_GDM_RX_OK_PKT_CNT_L(_n)		(GDM_BASE(_n) + 0x148)
+-#define REG_FE_GDM_RX_FC_DROP_CNT(_n)		(GDM_BASE(_n) + 0x14c)
+-#define REG_FE_GDM_RX_RC_DROP_CNT(_n)		(GDM_BASE(_n) + 0x150)
+-#define REG_FE_GDM_RX_OVERFLOW_DROP_CNT(_n)	(GDM_BASE(_n) + 0x154)
+-#define REG_FE_GDM_RX_ERROR_DROP_CNT(_n)	(GDM_BASE(_n) + 0x158)
+-#define REG_FE_GDM_RX_OK_BYTE_CNT_L(_n)		(GDM_BASE(_n) + 0x15c)
+-#define REG_FE_GDM_RX_ETH_PKT_CNT_L(_n)		(GDM_BASE(_n) + 0x160)
+-#define REG_FE_GDM_RX_ETH_BYTE_CNT_L(_n)	(GDM_BASE(_n) + 0x164)
+-#define REG_FE_GDM_RX_ETH_DROP_CNT(_n)		(GDM_BASE(_n) + 0x168)
+-#define REG_FE_GDM_RX_ETH_BC_CNT(_n)		(GDM_BASE(_n) + 0x16c)
+-#define REG_FE_GDM_RX_ETH_MC_CNT(_n)		(GDM_BASE(_n) + 0x170)
+-#define REG_FE_GDM_RX_ETH_CRC_ERR_CNT(_n)	(GDM_BASE(_n) + 0x174)
+-#define REG_FE_GDM_RX_ETH_FRAG_CNT(_n)		(GDM_BASE(_n) + 0x178)
+-#define REG_FE_GDM_RX_ETH_JABBER_CNT(_n)	(GDM_BASE(_n) + 0x17c)
+-#define REG_FE_GDM_RX_ETH_RUNT_CNT(_n)		(GDM_BASE(_n) + 0x180)
+-#define REG_FE_GDM_RX_ETH_LONG_CNT(_n)		(GDM_BASE(_n) + 0x184)
+-#define REG_FE_GDM_RX_ETH_E64_CNT_L(_n)		(GDM_BASE(_n) + 0x188)
+-#define REG_FE_GDM_RX_ETH_L64_CNT_L(_n)		(GDM_BASE(_n) + 0x18c)
+-#define REG_FE_GDM_RX_ETH_L127_CNT_L(_n)	(GDM_BASE(_n) + 0x190)
+-#define REG_FE_GDM_RX_ETH_L255_CNT_L(_n)	(GDM_BASE(_n) + 0x194)
+-#define REG_FE_GDM_RX_ETH_L511_CNT_L(_n)	(GDM_BASE(_n) + 0x198)
+-#define REG_FE_GDM_RX_ETH_L1023_CNT_L(_n)	(GDM_BASE(_n) + 0x19c)
+-
+-#define REG_PPE1_TB_HASH_CFG		(PPE1_BASE + 0x250)
+-#define PPE1_SRAM_TABLE_EN_MASK		BIT(0)
+-#define PPE1_SRAM_HASH1_EN_MASK		BIT(8)
+-#define PPE1_DRAM_TABLE_EN_MASK		BIT(16)
+-#define PPE1_DRAM_HASH1_EN_MASK		BIT(24)
+-
+-#define REG_FE_GDM_TX_OK_PKT_CNT_H(_n)		(GDM_BASE(_n) + 0x280)
+-#define REG_FE_GDM_TX_OK_BYTE_CNT_H(_n)		(GDM_BASE(_n) + 0x284)
+-#define REG_FE_GDM_TX_ETH_PKT_CNT_H(_n)		(GDM_BASE(_n) + 0x288)
+-#define REG_FE_GDM_TX_ETH_BYTE_CNT_H(_n)	(GDM_BASE(_n) + 0x28c)
+-
+-#define REG_FE_GDM_RX_OK_PKT_CNT_H(_n)		(GDM_BASE(_n) + 0x290)
+-#define REG_FE_GDM_RX_OK_BYTE_CNT_H(_n)		(GDM_BASE(_n) + 0x294)
+-#define REG_FE_GDM_RX_ETH_PKT_CNT_H(_n)		(GDM_BASE(_n) + 0x298)
+-#define REG_FE_GDM_RX_ETH_BYTE_CNT_H(_n)	(GDM_BASE(_n) + 0x29c)
+-#define REG_FE_GDM_TX_ETH_E64_CNT_H(_n)		(GDM_BASE(_n) + 0x2b8)
+-#define REG_FE_GDM_TX_ETH_L64_CNT_H(_n)		(GDM_BASE(_n) + 0x2bc)
+-#define REG_FE_GDM_TX_ETH_L127_CNT_H(_n)	(GDM_BASE(_n) + 0x2c0)
+-#define REG_FE_GDM_TX_ETH_L255_CNT_H(_n)	(GDM_BASE(_n) + 0x2c4)
+-#define REG_FE_GDM_TX_ETH_L511_CNT_H(_n)	(GDM_BASE(_n) + 0x2c8)
+-#define REG_FE_GDM_TX_ETH_L1023_CNT_H(_n)	(GDM_BASE(_n) + 0x2cc)
+-#define REG_FE_GDM_RX_ETH_E64_CNT_H(_n)		(GDM_BASE(_n) + 0x2e8)
+-#define REG_FE_GDM_RX_ETH_L64_CNT_H(_n)		(GDM_BASE(_n) + 0x2ec)
+-#define REG_FE_GDM_RX_ETH_L127_CNT_H(_n)	(GDM_BASE(_n) + 0x2f0)
+-#define REG_FE_GDM_RX_ETH_L255_CNT_H(_n)	(GDM_BASE(_n) + 0x2f4)
+-#define REG_FE_GDM_RX_ETH_L511_CNT_H(_n)	(GDM_BASE(_n) + 0x2f8)
+-#define REG_FE_GDM_RX_ETH_L1023_CNT_H(_n)	(GDM_BASE(_n) + 0x2fc)
+-
+-#define REG_GDM2_CHN_RLS		(GDM2_BASE + 0x20)
+-#define MBI_RX_AGE_SEL_MASK		GENMASK(26, 25)
+-#define MBI_TX_AGE_SEL_MASK		GENMASK(18, 17)
+-
+-#define REG_GDM3_FWD_CFG		GDM3_BASE
+-#define GDM3_PAD_EN_MASK		BIT(28)
+-
+-#define REG_GDM4_FWD_CFG		GDM4_BASE
+-#define GDM4_PAD_EN_MASK		BIT(28)
+-#define GDM4_SPORT_OFFSET0_MASK		GENMASK(11, 8)
+-
+-#define REG_GDM4_SRC_PORT_SET		(GDM4_BASE + 0x23c)
+-#define GDM4_SPORT_OFF2_MASK		GENMASK(19, 16)
+-#define GDM4_SPORT_OFF1_MASK		GENMASK(15, 12)
+-#define GDM4_SPORT_OFF0_MASK		GENMASK(11, 8)
+-
+-#define REG_IP_FRAG_FP			0x2010
+-#define IP_ASSEMBLE_PORT_MASK		GENMASK(24, 21)
+-#define IP_ASSEMBLE_NBQ_MASK		GENMASK(20, 16)
+-#define IP_FRAGMENT_PORT_MASK		GENMASK(8, 5)
+-#define IP_FRAGMENT_NBQ_MASK		GENMASK(4, 0)
+-
+-#define REG_MC_VLAN_EN			0x2100
+-#define MC_VLAN_EN_MASK			BIT(0)
+-
+-#define REG_MC_VLAN_CFG			0x2104
+-#define MC_VLAN_CFG_CMD_DONE_MASK	BIT(31)
+-#define MC_VLAN_CFG_TABLE_ID_MASK	GENMASK(21, 16)
+-#define MC_VLAN_CFG_PORT_ID_MASK	GENMASK(11, 8)
+-#define MC_VLAN_CFG_TABLE_SEL_MASK	BIT(4)
+-#define MC_VLAN_CFG_RW_MASK		BIT(0)
+-
+-#define REG_MC_VLAN_DATA		0x2108
+-
+-#define REG_CDM5_RX_OQ1_DROP_CNT	0x29d4
+-
+-/* QDMA */
+-#define REG_QDMA_GLOBAL_CFG			0x0004
+-#define GLOBAL_CFG_RX_2B_OFFSET_MASK		BIT(31)
+-#define GLOBAL_CFG_DMA_PREFERENCE_MASK		GENMASK(30, 29)
+-#define GLOBAL_CFG_CPU_TXR_RR_MASK		BIT(28)
+-#define GLOBAL_CFG_DSCP_BYTE_SWAP_MASK		BIT(27)
+-#define GLOBAL_CFG_PAYLOAD_BYTE_SWAP_MASK	BIT(26)
+-#define GLOBAL_CFG_MULTICAST_MODIFY_FP_MASK	BIT(25)
+-#define GLOBAL_CFG_OAM_MODIFY_MASK		BIT(24)
+-#define GLOBAL_CFG_RESET_MASK			BIT(23)
+-#define GLOBAL_CFG_RESET_DONE_MASK		BIT(22)
+-#define GLOBAL_CFG_MULTICAST_EN_MASK		BIT(21)
+-#define GLOBAL_CFG_IRQ1_EN_MASK			BIT(20)
+-#define GLOBAL_CFG_IRQ0_EN_MASK			BIT(19)
+-#define GLOBAL_CFG_LOOPCNT_EN_MASK		BIT(18)
+-#define GLOBAL_CFG_RD_BYPASS_WR_MASK		BIT(17)
+-#define GLOBAL_CFG_QDMA_LOOPBACK_MASK		BIT(16)
+-#define GLOBAL_CFG_LPBK_RXQ_SEL_MASK		GENMASK(13, 8)
+-#define GLOBAL_CFG_CHECK_DONE_MASK		BIT(7)
+-#define GLOBAL_CFG_TX_WB_DONE_MASK		BIT(6)
+-#define GLOBAL_CFG_MAX_ISSUE_NUM_MASK		GENMASK(5, 4)
+-#define GLOBAL_CFG_RX_DMA_BUSY_MASK		BIT(3)
+-#define GLOBAL_CFG_RX_DMA_EN_MASK		BIT(2)
+-#define GLOBAL_CFG_TX_DMA_BUSY_MASK		BIT(1)
+-#define GLOBAL_CFG_TX_DMA_EN_MASK		BIT(0)
+-
+-#define REG_FWD_DSCP_BASE			0x0010
+-#define REG_FWD_BUF_BASE			0x0014
+-
+-#define REG_HW_FWD_DSCP_CFG			0x0018
+-#define HW_FWD_DSCP_PAYLOAD_SIZE_MASK		GENMASK(29, 28)
+-#define HW_FWD_DSCP_SCATTER_LEN_MASK		GENMASK(17, 16)
+-#define HW_FWD_DSCP_MIN_SCATTER_LEN_MASK	GENMASK(15, 0)
+-
+-#define REG_INT_STATUS(_n)		\
+-	(((_n) == 4) ? 0x0730 :		\
+-	 ((_n) == 3) ? 0x0724 :		\
+-	 ((_n) == 2) ? 0x0720 :		\
+-	 ((_n) == 1) ? 0x0024 : 0x0020)
+-
+-#define REG_INT_ENABLE(_n)		\
+-	(((_n) == 4) ? 0x0750 :		\
+-	 ((_n) == 3) ? 0x0744 :		\
+-	 ((_n) == 2) ? 0x0740 :		\
+-	 ((_n) == 1) ? 0x002c : 0x0028)
+-
+-/* QDMA_CSR_INT_ENABLE1 */
+-#define RX15_COHERENT_INT_MASK		BIT(31)
+-#define RX14_COHERENT_INT_MASK		BIT(30)
+-#define RX13_COHERENT_INT_MASK		BIT(29)
+-#define RX12_COHERENT_INT_MASK		BIT(28)
+-#define RX11_COHERENT_INT_MASK		BIT(27)
+-#define RX10_COHERENT_INT_MASK		BIT(26)
+-#define RX9_COHERENT_INT_MASK		BIT(25)
+-#define RX8_COHERENT_INT_MASK		BIT(24)
+-#define RX7_COHERENT_INT_MASK		BIT(23)
+-#define RX6_COHERENT_INT_MASK		BIT(22)
+-#define RX5_COHERENT_INT_MASK		BIT(21)
+-#define RX4_COHERENT_INT_MASK		BIT(20)
+-#define RX3_COHERENT_INT_MASK		BIT(19)
+-#define RX2_COHERENT_INT_MASK		BIT(18)
+-#define RX1_COHERENT_INT_MASK		BIT(17)
+-#define RX0_COHERENT_INT_MASK		BIT(16)
+-#define TX7_COHERENT_INT_MASK		BIT(15)
+-#define TX6_COHERENT_INT_MASK		BIT(14)
+-#define TX5_COHERENT_INT_MASK		BIT(13)
+-#define TX4_COHERENT_INT_MASK		BIT(12)
+-#define TX3_COHERENT_INT_MASK		BIT(11)
+-#define TX2_COHERENT_INT_MASK		BIT(10)
+-#define TX1_COHERENT_INT_MASK		BIT(9)
+-#define TX0_COHERENT_INT_MASK		BIT(8)
+-#define CNT_OVER_FLOW_INT_MASK		BIT(7)
+-#define IRQ1_FULL_INT_MASK		BIT(5)
+-#define IRQ1_INT_MASK			BIT(4)
+-#define HWFWD_DSCP_LOW_INT_MASK		BIT(3)
+-#define HWFWD_DSCP_EMPTY_INT_MASK	BIT(2)
+-#define IRQ0_FULL_INT_MASK		BIT(1)
+-#define IRQ0_INT_MASK			BIT(0)
+-
+-#define TX_DONE_INT_MASK(_n)					\
+-	((_n) ? IRQ1_INT_MASK | IRQ1_FULL_INT_MASK		\
+-	      : IRQ0_INT_MASK | IRQ0_FULL_INT_MASK)
+-
+-#define INT_TX_MASK						\
+-	(IRQ1_INT_MASK | IRQ1_FULL_INT_MASK |			\
+-	 IRQ0_INT_MASK | IRQ0_FULL_INT_MASK)
+-
+-#define INT_IDX0_MASK						\
+-	(TX0_COHERENT_INT_MASK | TX1_COHERENT_INT_MASK |	\
+-	 TX2_COHERENT_INT_MASK | TX3_COHERENT_INT_MASK |	\
+-	 TX4_COHERENT_INT_MASK | TX5_COHERENT_INT_MASK |	\
+-	 TX6_COHERENT_INT_MASK | TX7_COHERENT_INT_MASK |	\
+-	 RX0_COHERENT_INT_MASK | RX1_COHERENT_INT_MASK |	\
+-	 RX2_COHERENT_INT_MASK | RX3_COHERENT_INT_MASK |	\
+-	 RX4_COHERENT_INT_MASK | RX7_COHERENT_INT_MASK |	\
+-	 RX8_COHERENT_INT_MASK | RX9_COHERENT_INT_MASK |	\
+-	 RX15_COHERENT_INT_MASK | INT_TX_MASK)
+-
+-/* QDMA_CSR_INT_ENABLE2 */
+-#define RX15_NO_CPU_DSCP_INT_MASK	BIT(31)
+-#define RX14_NO_CPU_DSCP_INT_MASK	BIT(30)
+-#define RX13_NO_CPU_DSCP_INT_MASK	BIT(29)
+-#define RX12_NO_CPU_DSCP_INT_MASK	BIT(28)
+-#define RX11_NO_CPU_DSCP_INT_MASK	BIT(27)
+-#define RX10_NO_CPU_DSCP_INT_MASK	BIT(26)
+-#define RX9_NO_CPU_DSCP_INT_MASK	BIT(25)
+-#define RX8_NO_CPU_DSCP_INT_MASK	BIT(24)
+-#define RX7_NO_CPU_DSCP_INT_MASK	BIT(23)
+-#define RX6_NO_CPU_DSCP_INT_MASK	BIT(22)
+-#define RX5_NO_CPU_DSCP_INT_MASK	BIT(21)
+-#define RX4_NO_CPU_DSCP_INT_MASK	BIT(20)
+-#define RX3_NO_CPU_DSCP_INT_MASK	BIT(19)
+-#define RX2_NO_CPU_DSCP_INT_MASK	BIT(18)
+-#define RX1_NO_CPU_DSCP_INT_MASK	BIT(17)
+-#define RX0_NO_CPU_DSCP_INT_MASK	BIT(16)
+-#define RX15_DONE_INT_MASK		BIT(15)
+-#define RX14_DONE_INT_MASK		BIT(14)
+-#define RX13_DONE_INT_MASK		BIT(13)
+-#define RX12_DONE_INT_MASK		BIT(12)
+-#define RX11_DONE_INT_MASK		BIT(11)
+-#define RX10_DONE_INT_MASK		BIT(10)
+-#define RX9_DONE_INT_MASK		BIT(9)
+-#define RX8_DONE_INT_MASK		BIT(8)
+-#define RX7_DONE_INT_MASK		BIT(7)
+-#define RX6_DONE_INT_MASK		BIT(6)
+-#define RX5_DONE_INT_MASK		BIT(5)
+-#define RX4_DONE_INT_MASK		BIT(4)
+-#define RX3_DONE_INT_MASK		BIT(3)
+-#define RX2_DONE_INT_MASK		BIT(2)
+-#define RX1_DONE_INT_MASK		BIT(1)
+-#define RX0_DONE_INT_MASK		BIT(0)
+-
+-#define RX_DONE_INT_MASK					\
+-	(RX0_DONE_INT_MASK | RX1_DONE_INT_MASK |		\
+-	 RX2_DONE_INT_MASK | RX3_DONE_INT_MASK |		\
+-	 RX4_DONE_INT_MASK | RX7_DONE_INT_MASK |		\
+-	 RX8_DONE_INT_MASK | RX9_DONE_INT_MASK |		\
+-	 RX15_DONE_INT_MASK)
+-#define INT_IDX1_MASK						\
+-	(RX_DONE_INT_MASK |					\
+-	 RX0_NO_CPU_DSCP_INT_MASK | RX1_NO_CPU_DSCP_INT_MASK |	\
+-	 RX2_NO_CPU_DSCP_INT_MASK | RX3_NO_CPU_DSCP_INT_MASK |	\
+-	 RX4_NO_CPU_DSCP_INT_MASK | RX7_NO_CPU_DSCP_INT_MASK |	\
+-	 RX8_NO_CPU_DSCP_INT_MASK | RX9_NO_CPU_DSCP_INT_MASK |	\
+-	 RX15_NO_CPU_DSCP_INT_MASK)
+-
+-/* QDMA_CSR_INT_ENABLE5 */
+-#define TX31_COHERENT_INT_MASK		BIT(31)
+-#define TX30_COHERENT_INT_MASK		BIT(30)
+-#define TX29_COHERENT_INT_MASK		BIT(29)
+-#define TX28_COHERENT_INT_MASK		BIT(28)
+-#define TX27_COHERENT_INT_MASK		BIT(27)
+-#define TX26_COHERENT_INT_MASK		BIT(26)
+-#define TX25_COHERENT_INT_MASK		BIT(25)
+-#define TX24_COHERENT_INT_MASK		BIT(24)
+-#define TX23_COHERENT_INT_MASK		BIT(23)
+-#define TX22_COHERENT_INT_MASK		BIT(22)
+-#define TX21_COHERENT_INT_MASK		BIT(21)
+-#define TX20_COHERENT_INT_MASK		BIT(20)
+-#define TX19_COHERENT_INT_MASK		BIT(19)
+-#define TX18_COHERENT_INT_MASK		BIT(18)
+-#define TX17_COHERENT_INT_MASK		BIT(17)
+-#define TX16_COHERENT_INT_MASK		BIT(16)
+-#define TX15_COHERENT_INT_MASK		BIT(15)
+-#define TX14_COHERENT_INT_MASK		BIT(14)
+-#define TX13_COHERENT_INT_MASK		BIT(13)
+-#define TX12_COHERENT_INT_MASK		BIT(12)
+-#define TX11_COHERENT_INT_MASK		BIT(11)
+-#define TX10_COHERENT_INT_MASK		BIT(10)
+-#define TX9_COHERENT_INT_MASK		BIT(9)
+-#define TX8_COHERENT_INT_MASK		BIT(8)
+-
+-#define INT_IDX4_MASK						\
+-	(TX8_COHERENT_INT_MASK | TX9_COHERENT_INT_MASK |	\
+-	 TX10_COHERENT_INT_MASK | TX11_COHERENT_INT_MASK |	\
+-	 TX12_COHERENT_INT_MASK | TX13_COHERENT_INT_MASK |	\
+-	 TX14_COHERENT_INT_MASK | TX15_COHERENT_INT_MASK |	\
+-	 TX16_COHERENT_INT_MASK | TX17_COHERENT_INT_MASK |	\
+-	 TX18_COHERENT_INT_MASK | TX19_COHERENT_INT_MASK |	\
+-	 TX20_COHERENT_INT_MASK | TX21_COHERENT_INT_MASK |	\
+-	 TX22_COHERENT_INT_MASK | TX23_COHERENT_INT_MASK |	\
+-	 TX24_COHERENT_INT_MASK | TX25_COHERENT_INT_MASK |	\
+-	 TX26_COHERENT_INT_MASK | TX27_COHERENT_INT_MASK |	\
+-	 TX28_COHERENT_INT_MASK | TX29_COHERENT_INT_MASK |	\
+-	 TX30_COHERENT_INT_MASK | TX31_COHERENT_INT_MASK)
+-
+-#define REG_TX_IRQ_BASE(_n)		((_n) ? 0x0048 : 0x0050)
+-
+-#define REG_TX_IRQ_CFG(_n)		((_n) ? 0x004c : 0x0054)
+-#define TX_IRQ_THR_MASK			GENMASK(27, 16)
+-#define TX_IRQ_DEPTH_MASK		GENMASK(11, 0)
+-
+-#define REG_IRQ_CLEAR_LEN(_n)		((_n) ? 0x0064 : 0x0058)
+-#define IRQ_CLEAR_LEN_MASK		GENMASK(7, 0)
+-
+-#define REG_IRQ_STATUS(_n)		((_n) ? 0x0068 : 0x005c)
+-#define IRQ_ENTRY_LEN_MASK		GENMASK(27, 16)
+-#define IRQ_HEAD_IDX_MASK		GENMASK(11, 0)
+-
+-#define REG_TX_RING_BASE(_n)	\
+-	(((_n) < 8) ? 0x0100 + ((_n) << 5) : 0x0b00 + (((_n) - 8) << 5))
+-
+-#define REG_TX_RING_BLOCKING(_n)	\
+-	(((_n) < 8) ? 0x0104 + ((_n) << 5) : 0x0b04 + (((_n) - 8) << 5))
+-
+-#define TX_RING_IRQ_BLOCKING_MAP_MASK			BIT(6)
+-#define TX_RING_IRQ_BLOCKING_CFG_MASK			BIT(4)
+-#define TX_RING_IRQ_BLOCKING_TX_DROP_EN_MASK		BIT(2)
+-#define TX_RING_IRQ_BLOCKING_MAX_TH_TXRING_EN_MASK	BIT(1)
+-#define TX_RING_IRQ_BLOCKING_MIN_TH_TXRING_EN_MASK	BIT(0)
+-
+-#define REG_TX_CPU_IDX(_n)	\
+-	(((_n) < 8) ? 0x0108 + ((_n) << 5) : 0x0b08 + (((_n) - 8) << 5))
+-
+-#define TX_RING_CPU_IDX_MASK		GENMASK(15, 0)
+-
+-#define REG_TX_DMA_IDX(_n)	\
+-	(((_n) < 8) ? 0x010c + ((_n) << 5) : 0x0b0c + (((_n) - 8) << 5))
+-
+-#define TX_RING_DMA_IDX_MASK		GENMASK(15, 0)
+-
+-#define IRQ_RING_IDX_MASK		GENMASK(20, 16)
+-#define IRQ_DESC_IDX_MASK		GENMASK(15, 0)
+-
+-#define REG_RX_RING_BASE(_n)	\
+-	(((_n) < 16) ? 0x0200 + ((_n) << 5) : 0x0e00 + (((_n) - 16) << 5))
+-
+-#define REG_RX_RING_SIZE(_n)	\
+-	(((_n) < 16) ? 0x0204 + ((_n) << 5) : 0x0e04 + (((_n) - 16) << 5))
+-
+-#define RX_RING_THR_MASK		GENMASK(31, 16)
+-#define RX_RING_SIZE_MASK		GENMASK(15, 0)
+-
+-#define REG_RX_CPU_IDX(_n)	\
+-	(((_n) < 16) ? 0x0208 + ((_n) << 5) : 0x0e08 + (((_n) - 16) << 5))
+-
+-#define RX_RING_CPU_IDX_MASK		GENMASK(15, 0)
+-
+-#define REG_RX_DMA_IDX(_n)	\
+-	(((_n) < 16) ? 0x020c + ((_n) << 5) : 0x0e0c + (((_n) - 16) << 5))
+-
+-#define REG_RX_DELAY_INT_IDX(_n)	\
+-	(((_n) < 16) ? 0x0210 + ((_n) << 5) : 0x0e10 + (((_n) - 16) << 5))
+-
+-#define RX_DELAY_INT_MASK		GENMASK(15, 0)
+-
+-#define RX_RING_DMA_IDX_MASK		GENMASK(15, 0)
+-
+-#define REG_INGRESS_TRTCM_CFG		0x0070
+-#define INGRESS_TRTCM_EN_MASK		BIT(31)
+-#define INGRESS_TRTCM_MODE_MASK		BIT(30)
+-#define INGRESS_SLOW_TICK_RATIO_MASK	GENMASK(29, 16)
+-#define INGRESS_FAST_TICK_MASK		GENMASK(15, 0)
+-
+-#define REG_QUEUE_CLOSE_CFG(_n)		(0x00a0 + ((_n) & 0xfc))
+-#define TXQ_DISABLE_CHAN_QUEUE_MASK(_n, _m)	BIT((_m) + (((_n) & 0x3) << 3))
+-
+-#define REG_TXQ_DIS_CFG_BASE(_n)	((_n) ? 0x20a0 : 0x00a0)
+-#define REG_TXQ_DIS_CFG(_n, _m)		(REG_TXQ_DIS_CFG_BASE((_n)) + (_m) << 2)
+-
+-#define REG_CNTR_CFG(_n)		(0x0400 + ((_n) << 3))
+-#define CNTR_EN_MASK			BIT(31)
+-#define CNTR_ALL_CHAN_EN_MASK		BIT(30)
+-#define CNTR_ALL_QUEUE_EN_MASK		BIT(29)
+-#define CNTR_ALL_DSCP_RING_EN_MASK	BIT(28)
+-#define CNTR_SRC_MASK			GENMASK(27, 24)
+-#define CNTR_DSCP_RING_MASK		GENMASK(20, 16)
+-#define CNTR_CHAN_MASK			GENMASK(7, 3)
+-#define CNTR_QUEUE_MASK			GENMASK(2, 0)
+-
+-#define REG_CNTR_VAL(_n)		(0x0404 + ((_n) << 3))
+-
+-#define REG_LMGR_INIT_CFG		0x1000
+-#define LMGR_INIT_START			BIT(31)
+-#define LMGR_SRAM_MODE_MASK		BIT(30)
+-#define HW_FWD_PKTSIZE_OVERHEAD_MASK	GENMASK(27, 20)
+-#define HW_FWD_DESC_NUM_MASK		GENMASK(16, 0)
+-
+-#define REG_FWD_DSCP_LOW_THR		0x1004
+-#define FWD_DSCP_LOW_THR_MASK		GENMASK(17, 0)
+-
+-#define REG_EGRESS_RATE_METER_CFG		0x100c
+-#define EGRESS_RATE_METER_EN_MASK		BIT(31)
+-#define EGRESS_RATE_METER_EQ_RATE_EN_MASK	BIT(17)
+-#define EGRESS_RATE_METER_WINDOW_SZ_MASK	GENMASK(16, 12)
+-#define EGRESS_RATE_METER_TIMESLICE_MASK	GENMASK(10, 0)
+-
+-#define REG_EGRESS_TRTCM_CFG		0x1010
+-#define EGRESS_TRTCM_EN_MASK		BIT(31)
+-#define EGRESS_TRTCM_MODE_MASK		BIT(30)
+-#define EGRESS_SLOW_TICK_RATIO_MASK	GENMASK(29, 16)
+-#define EGRESS_FAST_TICK_MASK		GENMASK(15, 0)
+-
+-#define TRTCM_PARAM_RW_MASK		BIT(31)
+-#define TRTCM_PARAM_RW_DONE_MASK	BIT(30)
+-#define TRTCM_PARAM_TYPE_MASK		GENMASK(29, 28)
+-#define TRTCM_METER_GROUP_MASK		GENMASK(27, 26)
+-#define TRTCM_PARAM_INDEX_MASK		GENMASK(23, 17)
+-#define TRTCM_PARAM_RATE_TYPE_MASK	BIT(16)
+-
+-#define REG_TRTCM_CFG_PARAM(_n)		((_n) + 0x4)
+-#define REG_TRTCM_DATA_LOW(_n)		((_n) + 0x8)
+-#define REG_TRTCM_DATA_HIGH(_n)		((_n) + 0xc)
+-
+-#define REG_TXWRR_MODE_CFG		0x1020
+-#define TWRR_WEIGHT_SCALE_MASK		BIT(31)
+-#define TWRR_WEIGHT_BASE_MASK		BIT(3)
+-
+-#define REG_TXWRR_WEIGHT_CFG		0x1024
+-#define TWRR_RW_CMD_MASK		BIT(31)
+-#define TWRR_RW_CMD_DONE		BIT(30)
+-#define TWRR_CHAN_IDX_MASK		GENMASK(23, 19)
+-#define TWRR_QUEUE_IDX_MASK		GENMASK(18, 16)
+-#define TWRR_VALUE_MASK			GENMASK(15, 0)
+-
+-#define REG_PSE_BUF_USAGE_CFG		0x1028
+-#define PSE_BUF_ESTIMATE_EN_MASK	BIT(29)
+-
+-#define REG_CHAN_QOS_MODE(_n)		(0x1040 + ((_n) << 2))
+-#define CHAN_QOS_MODE_MASK(_n)		GENMASK(2 + ((_n) << 2), (_n) << 2)
+-
+-#define REG_GLB_TRTCM_CFG		0x1080
+-#define GLB_TRTCM_EN_MASK		BIT(31)
+-#define GLB_TRTCM_MODE_MASK		BIT(30)
+-#define GLB_SLOW_TICK_RATIO_MASK	GENMASK(29, 16)
+-#define GLB_FAST_TICK_MASK		GENMASK(15, 0)
+-
+-#define REG_TXQ_CNGST_CFG		0x10a0
+-#define TXQ_CNGST_DROP_EN		BIT(31)
+-#define TXQ_CNGST_DEI_DROP_EN		BIT(30)
+-
+-#define REG_SLA_TRTCM_CFG		0x1150
+-#define SLA_TRTCM_EN_MASK		BIT(31)
+-#define SLA_TRTCM_MODE_MASK		BIT(30)
+-#define SLA_SLOW_TICK_RATIO_MASK	GENMASK(29, 16)
+-#define SLA_FAST_TICK_MASK		GENMASK(15, 0)
+-
+-/* CTRL */
+-#define QDMA_DESC_DONE_MASK		BIT(31)
+-#define QDMA_DESC_DROP_MASK		BIT(30) /* tx: drop - rx: overflow */
+-#define QDMA_DESC_MORE_MASK		BIT(29) /* more SG elements */
+-#define QDMA_DESC_DEI_MASK		BIT(25)
+-#define QDMA_DESC_NO_DROP_MASK		BIT(24)
+-#define QDMA_DESC_LEN_MASK		GENMASK(15, 0)
+-/* DATA */
+-#define QDMA_DESC_NEXT_ID_MASK		GENMASK(15, 0)
+-/* TX MSG0 */
+-#define QDMA_ETH_TXMSG_MIC_IDX_MASK	BIT(30)
+-#define QDMA_ETH_TXMSG_SP_TAG_MASK	GENMASK(29, 14)
+-#define QDMA_ETH_TXMSG_ICO_MASK		BIT(13)
+-#define QDMA_ETH_TXMSG_UCO_MASK		BIT(12)
+-#define QDMA_ETH_TXMSG_TCO_MASK		BIT(11)
+-#define QDMA_ETH_TXMSG_TSO_MASK		BIT(10)
+-#define QDMA_ETH_TXMSG_FAST_MASK	BIT(9)
+-#define QDMA_ETH_TXMSG_OAM_MASK		BIT(8)
+-#define QDMA_ETH_TXMSG_CHAN_MASK	GENMASK(7, 3)
+-#define QDMA_ETH_TXMSG_QUEUE_MASK	GENMASK(2, 0)
+-/* TX MSG1 */
+-#define QDMA_ETH_TXMSG_NO_DROP		BIT(31)
+-#define QDMA_ETH_TXMSG_METER_MASK	GENMASK(30, 24)	/* 0x7f no meters */
+-#define QDMA_ETH_TXMSG_FPORT_MASK	GENMASK(23, 20)
+-#define QDMA_ETH_TXMSG_NBOQ_MASK	GENMASK(19, 15)
+-#define QDMA_ETH_TXMSG_HWF_MASK		BIT(14)
+-#define QDMA_ETH_TXMSG_HOP_MASK		BIT(13)
+-#define QDMA_ETH_TXMSG_PTP_MASK		BIT(12)
+-#define QDMA_ETH_TXMSG_ACNT_G1_MASK	GENMASK(10, 6)	/* 0x1f do not count */
+-#define QDMA_ETH_TXMSG_ACNT_G0_MASK	GENMASK(5, 0)	/* 0x3f do not count */
+-
+-/* RX MSG1 */
+-#define QDMA_ETH_RXMSG_DEI_MASK		BIT(31)
+-#define QDMA_ETH_RXMSG_IP6_MASK		BIT(30)
+-#define QDMA_ETH_RXMSG_IP4_MASK		BIT(29)
+-#define QDMA_ETH_RXMSG_IP4F_MASK	BIT(28)
+-#define QDMA_ETH_RXMSG_L4_VALID_MASK	BIT(27)
+-#define QDMA_ETH_RXMSG_L4F_MASK		BIT(26)
+-#define QDMA_ETH_RXMSG_SPORT_MASK	GENMASK(25, 21)
+-#define QDMA_ETH_RXMSG_CRSN_MASK	GENMASK(20, 16)
+-#define QDMA_ETH_RXMSG_PPE_ENTRY_MASK	GENMASK(15, 0)
+-
+-struct airoha_qdma_desc {
+-	__le32 rsv;
+-	__le32 ctrl;
+-	__le32 addr;
+-	__le32 data;
+-	__le32 msg0;
+-	__le32 msg1;
+-	__le32 msg2;
+-	__le32 msg3;
+-};
+-
+-/* CTRL0 */
+-#define QDMA_FWD_DESC_CTX_MASK		BIT(31)
+-#define QDMA_FWD_DESC_RING_MASK		GENMASK(30, 28)
+-#define QDMA_FWD_DESC_IDX_MASK		GENMASK(27, 16)
+-#define QDMA_FWD_DESC_LEN_MASK		GENMASK(15, 0)
+-/* CTRL1 */
+-#define QDMA_FWD_DESC_FIRST_IDX_MASK	GENMASK(15, 0)
+-/* CTRL2 */
+-#define QDMA_FWD_DESC_MORE_PKT_NUM_MASK	GENMASK(2, 0)
+-
+-struct airoha_qdma_fwd_desc {
+-	__le32 addr;
+-	__le32 ctrl0;
+-	__le32 ctrl1;
+-	__le32 ctrl2;
+-	__le32 msg0;
+-	__le32 msg1;
+-	__le32 rsv0;
+-	__le32 rsv1;
+-};
+-
+ u32 airoha_rr(void __iomem *base, u32 offset)
+ {
+ 	return readl(base + offset);
+--- /dev/null
++++ b/drivers/net/ethernet/airoha/airoha_regs.h
+@@ -0,0 +1,670 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++/*
++ * Copyright (c) 2024 AIROHA Inc
++ * Author: Lorenzo Bianconi <lorenzo@kernel.org>
++ */
++
++#ifndef AIROHA_REGS_H
++#define AIROHA_REGS_H
++
++#include <linux/types.h>
++
++/* FE */
++#define PSE_BASE			0x0100
++#define CSR_IFC_BASE			0x0200
++#define CDM1_BASE			0x0400
++#define GDM1_BASE			0x0500
++#define PPE1_BASE			0x0c00
++
++#define CDM2_BASE			0x1400
++#define GDM2_BASE			0x1500
++
++#define GDM3_BASE			0x1100
++#define GDM4_BASE			0x2500
++
++#define GDM_BASE(_n)			\
++	((_n) == 4 ? GDM4_BASE :	\
++	 (_n) == 3 ? GDM3_BASE :	\
++	 (_n) == 2 ? GDM2_BASE : GDM1_BASE)
++
++#define REG_FE_DMA_GLO_CFG		0x0000
++#define FE_DMA_GLO_L2_SPACE_MASK	GENMASK(7, 4)
++#define FE_DMA_GLO_PG_SZ_MASK		BIT(3)
++
++#define REG_FE_RST_GLO_CFG		0x0004
++#define FE_RST_GDM4_MBI_ARB_MASK	BIT(3)
++#define FE_RST_GDM3_MBI_ARB_MASK	BIT(2)
++#define FE_RST_CORE_MASK		BIT(0)
++
++#define REG_FE_WAN_MAC_H		0x0030
++#define REG_FE_LAN_MAC_H		0x0040
++
++#define REG_FE_MAC_LMIN(_n)		((_n) + 0x04)
++#define REG_FE_MAC_LMAX(_n)		((_n) + 0x08)
++
++#define REG_FE_CDM1_OQ_MAP0		0x0050
++#define REG_FE_CDM1_OQ_MAP1		0x0054
++#define REG_FE_CDM1_OQ_MAP2		0x0058
++#define REG_FE_CDM1_OQ_MAP3		0x005c
++
++#define REG_FE_PCE_CFG			0x0070
++#define PCE_DPI_EN_MASK			BIT(2)
++#define PCE_KA_EN_MASK			BIT(1)
++#define PCE_MC_EN_MASK			BIT(0)
++
++#define REG_FE_PSE_QUEUE_CFG_WR		0x0080
++#define PSE_CFG_PORT_ID_MASK		GENMASK(27, 24)
++#define PSE_CFG_QUEUE_ID_MASK		GENMASK(20, 16)
++#define PSE_CFG_WR_EN_MASK		BIT(8)
++#define PSE_CFG_OQRSV_SEL_MASK		BIT(0)
++
++#define REG_FE_PSE_QUEUE_CFG_VAL	0x0084
++#define PSE_CFG_OQ_RSV_MASK		GENMASK(13, 0)
++
++#define PSE_FQ_CFG			0x008c
++#define PSE_FQ_LIMIT_MASK		GENMASK(14, 0)
++
++#define REG_FE_PSE_BUF_SET		0x0090
++#define PSE_SHARE_USED_LTHD_MASK	GENMASK(31, 16)
++#define PSE_ALLRSV_MASK			GENMASK(14, 0)
++
++#define REG_PSE_SHARE_USED_THD		0x0094
++#define PSE_SHARE_USED_MTHD_MASK	GENMASK(31, 16)
++#define PSE_SHARE_USED_HTHD_MASK	GENMASK(15, 0)
++
++#define REG_GDM_MISC_CFG		0x0148
++#define GDM2_RDM_ACK_WAIT_PREF_MASK	BIT(9)
++#define GDM2_CHN_VLD_MODE_MASK		BIT(5)
++
++#define REG_FE_CSR_IFC_CFG		CSR_IFC_BASE
++#define FE_IFC_EN_MASK			BIT(0)
++
++#define REG_FE_VIP_PORT_EN		0x01f0
++#define REG_FE_IFC_PORT_EN		0x01f4
++
++#define REG_PSE_IQ_REV1			(PSE_BASE + 0x08)
++#define PSE_IQ_RES1_P2_MASK		GENMASK(23, 16)
++
++#define REG_PSE_IQ_REV2			(PSE_BASE + 0x0c)
++#define PSE_IQ_RES2_P5_MASK		GENMASK(15, 8)
++#define PSE_IQ_RES2_P4_MASK		GENMASK(7, 0)
++
++#define REG_FE_VIP_EN(_n)		(0x0300 + ((_n) << 3))
++#define PATN_FCPU_EN_MASK		BIT(7)
++#define PATN_SWP_EN_MASK		BIT(6)
++#define PATN_DP_EN_MASK			BIT(5)
++#define PATN_SP_EN_MASK			BIT(4)
++#define PATN_TYPE_MASK			GENMASK(3, 1)
++#define PATN_EN_MASK			BIT(0)
++
++#define REG_FE_VIP_PATN(_n)		(0x0304 + ((_n) << 3))
++#define PATN_DP_MASK			GENMASK(31, 16)
++#define PATN_SP_MASK			GENMASK(15, 0)
++
++#define REG_CDM1_VLAN_CTRL		CDM1_BASE
++#define CDM1_VLAN_MASK			GENMASK(31, 16)
++
++#define REG_CDM1_FWD_CFG		(CDM1_BASE + 0x08)
++#define CDM1_VIP_QSEL_MASK		GENMASK(24, 20)
++
++#define REG_CDM1_CRSN_QSEL(_n)		(CDM1_BASE + 0x10 + ((_n) << 2))
++#define CDM1_CRSN_QSEL_REASON_MASK(_n)	\
++	GENMASK(4 + (((_n) % 4) << 3),	(((_n) % 4) << 3))
++
++#define REG_CDM2_FWD_CFG		(CDM2_BASE + 0x08)
++#define CDM2_OAM_QSEL_MASK		GENMASK(31, 27)
++#define CDM2_VIP_QSEL_MASK		GENMASK(24, 20)
++
++#define REG_CDM2_CRSN_QSEL(_n)		(CDM2_BASE + 0x10 + ((_n) << 2))
++#define CDM2_CRSN_QSEL_REASON_MASK(_n)	\
++	GENMASK(4 + (((_n) % 4) << 3),	(((_n) % 4) << 3))
++
++#define REG_GDM_FWD_CFG(_n)		GDM_BASE(_n)
++#define GDM_DROP_CRC_ERR		BIT(23)
++#define GDM_IP4_CKSUM			BIT(22)
++#define GDM_TCP_CKSUM			BIT(21)
++#define GDM_UDP_CKSUM			BIT(20)
++#define GDM_UCFQ_MASK			GENMASK(15, 12)
++#define GDM_BCFQ_MASK			GENMASK(11, 8)
++#define GDM_MCFQ_MASK			GENMASK(7, 4)
++#define GDM_OCFQ_MASK			GENMASK(3, 0)
++
++#define REG_GDM_INGRESS_CFG(_n)		(GDM_BASE(_n) + 0x10)
++#define GDM_INGRESS_FC_EN_MASK		BIT(1)
++#define GDM_STAG_EN_MASK		BIT(0)
++
++#define REG_GDM_LEN_CFG(_n)		(GDM_BASE(_n) + 0x14)
++#define GDM_SHORT_LEN_MASK		GENMASK(13, 0)
++#define GDM_LONG_LEN_MASK		GENMASK(29, 16)
++
++#define REG_FE_CPORT_CFG		(GDM1_BASE + 0x40)
++#define FE_CPORT_PAD			BIT(26)
++#define FE_CPORT_PORT_XFC_MASK		BIT(25)
++#define FE_CPORT_QUEUE_XFC_MASK		BIT(24)
++
++#define REG_FE_GDM_MIB_CLEAR(_n)	(GDM_BASE(_n) + 0xf0)
++#define FE_GDM_MIB_RX_CLEAR_MASK	BIT(1)
++#define FE_GDM_MIB_TX_CLEAR_MASK	BIT(0)
++
++#define REG_FE_GDM1_MIB_CFG		(GDM1_BASE + 0xf4)
++#define FE_STRICT_RFC2819_MODE_MASK	BIT(31)
++#define FE_GDM1_TX_MIB_SPLIT_EN_MASK	BIT(17)
++#define FE_GDM1_RX_MIB_SPLIT_EN_MASK	BIT(16)
++#define FE_TX_MIB_ID_MASK		GENMASK(15, 8)
++#define FE_RX_MIB_ID_MASK		GENMASK(7, 0)
++
++#define REG_FE_GDM_TX_OK_PKT_CNT_L(_n)		(GDM_BASE(_n) + 0x104)
++#define REG_FE_GDM_TX_OK_BYTE_CNT_L(_n)		(GDM_BASE(_n) + 0x10c)
++#define REG_FE_GDM_TX_ETH_PKT_CNT_L(_n)		(GDM_BASE(_n) + 0x110)
++#define REG_FE_GDM_TX_ETH_BYTE_CNT_L(_n)	(GDM_BASE(_n) + 0x114)
++#define REG_FE_GDM_TX_ETH_DROP_CNT(_n)		(GDM_BASE(_n) + 0x118)
++#define REG_FE_GDM_TX_ETH_BC_CNT(_n)		(GDM_BASE(_n) + 0x11c)
++#define REG_FE_GDM_TX_ETH_MC_CNT(_n)		(GDM_BASE(_n) + 0x120)
++#define REG_FE_GDM_TX_ETH_RUNT_CNT(_n)		(GDM_BASE(_n) + 0x124)
++#define REG_FE_GDM_TX_ETH_LONG_CNT(_n)		(GDM_BASE(_n) + 0x128)
++#define REG_FE_GDM_TX_ETH_E64_CNT_L(_n)		(GDM_BASE(_n) + 0x12c)
++#define REG_FE_GDM_TX_ETH_L64_CNT_L(_n)		(GDM_BASE(_n) + 0x130)
++#define REG_FE_GDM_TX_ETH_L127_CNT_L(_n)	(GDM_BASE(_n) + 0x134)
++#define REG_FE_GDM_TX_ETH_L255_CNT_L(_n)	(GDM_BASE(_n) + 0x138)
++#define REG_FE_GDM_TX_ETH_L511_CNT_L(_n)	(GDM_BASE(_n) + 0x13c)
++#define REG_FE_GDM_TX_ETH_L1023_CNT_L(_n)	(GDM_BASE(_n) + 0x140)
++
++#define REG_FE_GDM_RX_OK_PKT_CNT_L(_n)		(GDM_BASE(_n) + 0x148)
++#define REG_FE_GDM_RX_FC_DROP_CNT(_n)		(GDM_BASE(_n) + 0x14c)
++#define REG_FE_GDM_RX_RC_DROP_CNT(_n)		(GDM_BASE(_n) + 0x150)
++#define REG_FE_GDM_RX_OVERFLOW_DROP_CNT(_n)	(GDM_BASE(_n) + 0x154)
++#define REG_FE_GDM_RX_ERROR_DROP_CNT(_n)	(GDM_BASE(_n) + 0x158)
++#define REG_FE_GDM_RX_OK_BYTE_CNT_L(_n)		(GDM_BASE(_n) + 0x15c)
++#define REG_FE_GDM_RX_ETH_PKT_CNT_L(_n)		(GDM_BASE(_n) + 0x160)
++#define REG_FE_GDM_RX_ETH_BYTE_CNT_L(_n)	(GDM_BASE(_n) + 0x164)
++#define REG_FE_GDM_RX_ETH_DROP_CNT(_n)		(GDM_BASE(_n) + 0x168)
++#define REG_FE_GDM_RX_ETH_BC_CNT(_n)		(GDM_BASE(_n) + 0x16c)
++#define REG_FE_GDM_RX_ETH_MC_CNT(_n)		(GDM_BASE(_n) + 0x170)
++#define REG_FE_GDM_RX_ETH_CRC_ERR_CNT(_n)	(GDM_BASE(_n) + 0x174)
++#define REG_FE_GDM_RX_ETH_FRAG_CNT(_n)		(GDM_BASE(_n) + 0x178)
++#define REG_FE_GDM_RX_ETH_JABBER_CNT(_n)	(GDM_BASE(_n) + 0x17c)
++#define REG_FE_GDM_RX_ETH_RUNT_CNT(_n)		(GDM_BASE(_n) + 0x180)
++#define REG_FE_GDM_RX_ETH_LONG_CNT(_n)		(GDM_BASE(_n) + 0x184)
++#define REG_FE_GDM_RX_ETH_E64_CNT_L(_n)		(GDM_BASE(_n) + 0x188)
++#define REG_FE_GDM_RX_ETH_L64_CNT_L(_n)		(GDM_BASE(_n) + 0x18c)
++#define REG_FE_GDM_RX_ETH_L127_CNT_L(_n)	(GDM_BASE(_n) + 0x190)
++#define REG_FE_GDM_RX_ETH_L255_CNT_L(_n)	(GDM_BASE(_n) + 0x194)
++#define REG_FE_GDM_RX_ETH_L511_CNT_L(_n)	(GDM_BASE(_n) + 0x198)
++#define REG_FE_GDM_RX_ETH_L1023_CNT_L(_n)	(GDM_BASE(_n) + 0x19c)
++
++#define REG_PPE1_TB_HASH_CFG		(PPE1_BASE + 0x250)
++#define PPE1_SRAM_TABLE_EN_MASK		BIT(0)
++#define PPE1_SRAM_HASH1_EN_MASK		BIT(8)
++#define PPE1_DRAM_TABLE_EN_MASK		BIT(16)
++#define PPE1_DRAM_HASH1_EN_MASK		BIT(24)
++
++#define REG_FE_GDM_TX_OK_PKT_CNT_H(_n)		(GDM_BASE(_n) + 0x280)
++#define REG_FE_GDM_TX_OK_BYTE_CNT_H(_n)		(GDM_BASE(_n) + 0x284)
++#define REG_FE_GDM_TX_ETH_PKT_CNT_H(_n)		(GDM_BASE(_n) + 0x288)
++#define REG_FE_GDM_TX_ETH_BYTE_CNT_H(_n)	(GDM_BASE(_n) + 0x28c)
++
++#define REG_FE_GDM_RX_OK_PKT_CNT_H(_n)		(GDM_BASE(_n) + 0x290)
++#define REG_FE_GDM_RX_OK_BYTE_CNT_H(_n)		(GDM_BASE(_n) + 0x294)
++#define REG_FE_GDM_RX_ETH_PKT_CNT_H(_n)		(GDM_BASE(_n) + 0x298)
++#define REG_FE_GDM_RX_ETH_BYTE_CNT_H(_n)	(GDM_BASE(_n) + 0x29c)
++#define REG_FE_GDM_TX_ETH_E64_CNT_H(_n)		(GDM_BASE(_n) + 0x2b8)
++#define REG_FE_GDM_TX_ETH_L64_CNT_H(_n)		(GDM_BASE(_n) + 0x2bc)
++#define REG_FE_GDM_TX_ETH_L127_CNT_H(_n)	(GDM_BASE(_n) + 0x2c0)
++#define REG_FE_GDM_TX_ETH_L255_CNT_H(_n)	(GDM_BASE(_n) + 0x2c4)
++#define REG_FE_GDM_TX_ETH_L511_CNT_H(_n)	(GDM_BASE(_n) + 0x2c8)
++#define REG_FE_GDM_TX_ETH_L1023_CNT_H(_n)	(GDM_BASE(_n) + 0x2cc)
++#define REG_FE_GDM_RX_ETH_E64_CNT_H(_n)		(GDM_BASE(_n) + 0x2e8)
++#define REG_FE_GDM_RX_ETH_L64_CNT_H(_n)		(GDM_BASE(_n) + 0x2ec)
++#define REG_FE_GDM_RX_ETH_L127_CNT_H(_n)	(GDM_BASE(_n) + 0x2f0)
++#define REG_FE_GDM_RX_ETH_L255_CNT_H(_n)	(GDM_BASE(_n) + 0x2f4)
++#define REG_FE_GDM_RX_ETH_L511_CNT_H(_n)	(GDM_BASE(_n) + 0x2f8)
++#define REG_FE_GDM_RX_ETH_L1023_CNT_H(_n)	(GDM_BASE(_n) + 0x2fc)
++
++#define REG_GDM2_CHN_RLS		(GDM2_BASE + 0x20)
++#define MBI_RX_AGE_SEL_MASK		GENMASK(26, 25)
++#define MBI_TX_AGE_SEL_MASK		GENMASK(18, 17)
++
++#define REG_GDM3_FWD_CFG		GDM3_BASE
++#define GDM3_PAD_EN_MASK		BIT(28)
++
++#define REG_GDM4_FWD_CFG		GDM4_BASE
++#define GDM4_PAD_EN_MASK		BIT(28)
++#define GDM4_SPORT_OFFSET0_MASK		GENMASK(11, 8)
++
++#define REG_GDM4_SRC_PORT_SET		(GDM4_BASE + 0x23c)
++#define GDM4_SPORT_OFF2_MASK		GENMASK(19, 16)
++#define GDM4_SPORT_OFF1_MASK		GENMASK(15, 12)
++#define GDM4_SPORT_OFF0_MASK		GENMASK(11, 8)
++
++#define REG_IP_FRAG_FP			0x2010
++#define IP_ASSEMBLE_PORT_MASK		GENMASK(24, 21)
++#define IP_ASSEMBLE_NBQ_MASK		GENMASK(20, 16)
++#define IP_FRAGMENT_PORT_MASK		GENMASK(8, 5)
++#define IP_FRAGMENT_NBQ_MASK		GENMASK(4, 0)
++
++#define REG_MC_VLAN_EN			0x2100
++#define MC_VLAN_EN_MASK			BIT(0)
++
++#define REG_MC_VLAN_CFG			0x2104
++#define MC_VLAN_CFG_CMD_DONE_MASK	BIT(31)
++#define MC_VLAN_CFG_TABLE_ID_MASK	GENMASK(21, 16)
++#define MC_VLAN_CFG_PORT_ID_MASK	GENMASK(11, 8)
++#define MC_VLAN_CFG_TABLE_SEL_MASK	BIT(4)
++#define MC_VLAN_CFG_RW_MASK		BIT(0)
++
++#define REG_MC_VLAN_DATA		0x2108
++
++#define REG_CDM5_RX_OQ1_DROP_CNT	0x29d4
++
++/* QDMA */
++#define REG_QDMA_GLOBAL_CFG			0x0004
++#define GLOBAL_CFG_RX_2B_OFFSET_MASK		BIT(31)
++#define GLOBAL_CFG_DMA_PREFERENCE_MASK		GENMASK(30, 29)
++#define GLOBAL_CFG_CPU_TXR_RR_MASK		BIT(28)
++#define GLOBAL_CFG_DSCP_BYTE_SWAP_MASK		BIT(27)
++#define GLOBAL_CFG_PAYLOAD_BYTE_SWAP_MASK	BIT(26)
++#define GLOBAL_CFG_MULTICAST_MODIFY_FP_MASK	BIT(25)
++#define GLOBAL_CFG_OAM_MODIFY_MASK		BIT(24)
++#define GLOBAL_CFG_RESET_MASK			BIT(23)
++#define GLOBAL_CFG_RESET_DONE_MASK		BIT(22)
++#define GLOBAL_CFG_MULTICAST_EN_MASK		BIT(21)
++#define GLOBAL_CFG_IRQ1_EN_MASK			BIT(20)
++#define GLOBAL_CFG_IRQ0_EN_MASK			BIT(19)
++#define GLOBAL_CFG_LOOPCNT_EN_MASK		BIT(18)
++#define GLOBAL_CFG_RD_BYPASS_WR_MASK		BIT(17)
++#define GLOBAL_CFG_QDMA_LOOPBACK_MASK		BIT(16)
++#define GLOBAL_CFG_LPBK_RXQ_SEL_MASK		GENMASK(13, 8)
++#define GLOBAL_CFG_CHECK_DONE_MASK		BIT(7)
++#define GLOBAL_CFG_TX_WB_DONE_MASK		BIT(6)
++#define GLOBAL_CFG_MAX_ISSUE_NUM_MASK		GENMASK(5, 4)
++#define GLOBAL_CFG_RX_DMA_BUSY_MASK		BIT(3)
++#define GLOBAL_CFG_RX_DMA_EN_MASK		BIT(2)
++#define GLOBAL_CFG_TX_DMA_BUSY_MASK		BIT(1)
++#define GLOBAL_CFG_TX_DMA_EN_MASK		BIT(0)
++
++#define REG_FWD_DSCP_BASE			0x0010
++#define REG_FWD_BUF_BASE			0x0014
++
++#define REG_HW_FWD_DSCP_CFG			0x0018
++#define HW_FWD_DSCP_PAYLOAD_SIZE_MASK		GENMASK(29, 28)
++#define HW_FWD_DSCP_SCATTER_LEN_MASK		GENMASK(17, 16)
++#define HW_FWD_DSCP_MIN_SCATTER_LEN_MASK	GENMASK(15, 0)
++
++#define REG_INT_STATUS(_n)		\
++	(((_n) == 4) ? 0x0730 :		\
++	 ((_n) == 3) ? 0x0724 :		\
++	 ((_n) == 2) ? 0x0720 :		\
++	 ((_n) == 1) ? 0x0024 : 0x0020)
++
++#define REG_INT_ENABLE(_n)		\
++	(((_n) == 4) ? 0x0750 :		\
++	 ((_n) == 3) ? 0x0744 :		\
++	 ((_n) == 2) ? 0x0740 :		\
++	 ((_n) == 1) ? 0x002c : 0x0028)
++
++/* QDMA_CSR_INT_ENABLE1 */
++#define RX15_COHERENT_INT_MASK		BIT(31)
++#define RX14_COHERENT_INT_MASK		BIT(30)
++#define RX13_COHERENT_INT_MASK		BIT(29)
++#define RX12_COHERENT_INT_MASK		BIT(28)
++#define RX11_COHERENT_INT_MASK		BIT(27)
++#define RX10_COHERENT_INT_MASK		BIT(26)
++#define RX9_COHERENT_INT_MASK		BIT(25)
++#define RX8_COHERENT_INT_MASK		BIT(24)
++#define RX7_COHERENT_INT_MASK		BIT(23)
++#define RX6_COHERENT_INT_MASK		BIT(22)
++#define RX5_COHERENT_INT_MASK		BIT(21)
++#define RX4_COHERENT_INT_MASK		BIT(20)
++#define RX3_COHERENT_INT_MASK		BIT(19)
++#define RX2_COHERENT_INT_MASK		BIT(18)
++#define RX1_COHERENT_INT_MASK		BIT(17)
++#define RX0_COHERENT_INT_MASK		BIT(16)
++#define TX7_COHERENT_INT_MASK		BIT(15)
++#define TX6_COHERENT_INT_MASK		BIT(14)
++#define TX5_COHERENT_INT_MASK		BIT(13)
++#define TX4_COHERENT_INT_MASK		BIT(12)
++#define TX3_COHERENT_INT_MASK		BIT(11)
++#define TX2_COHERENT_INT_MASK		BIT(10)
++#define TX1_COHERENT_INT_MASK		BIT(9)
++#define TX0_COHERENT_INT_MASK		BIT(8)
++#define CNT_OVER_FLOW_INT_MASK		BIT(7)
++#define IRQ1_FULL_INT_MASK		BIT(5)
++#define IRQ1_INT_MASK			BIT(4)
++#define HWFWD_DSCP_LOW_INT_MASK		BIT(3)
++#define HWFWD_DSCP_EMPTY_INT_MASK	BIT(2)
++#define IRQ0_FULL_INT_MASK		BIT(1)
++#define IRQ0_INT_MASK			BIT(0)
++
++#define TX_DONE_INT_MASK(_n)					\
++	((_n) ? IRQ1_INT_MASK | IRQ1_FULL_INT_MASK		\
++	      : IRQ0_INT_MASK | IRQ0_FULL_INT_MASK)
++
++#define INT_TX_MASK						\
++	(IRQ1_INT_MASK | IRQ1_FULL_INT_MASK |			\
++	 IRQ0_INT_MASK | IRQ0_FULL_INT_MASK)
++
++#define INT_IDX0_MASK						\
++	(TX0_COHERENT_INT_MASK | TX1_COHERENT_INT_MASK |	\
++	 TX2_COHERENT_INT_MASK | TX3_COHERENT_INT_MASK |	\
++	 TX4_COHERENT_INT_MASK | TX5_COHERENT_INT_MASK |	\
++	 TX6_COHERENT_INT_MASK | TX7_COHERENT_INT_MASK |	\
++	 RX0_COHERENT_INT_MASK | RX1_COHERENT_INT_MASK |	\
++	 RX2_COHERENT_INT_MASK | RX3_COHERENT_INT_MASK |	\
++	 RX4_COHERENT_INT_MASK | RX7_COHERENT_INT_MASK |	\
++	 RX8_COHERENT_INT_MASK | RX9_COHERENT_INT_MASK |	\
++	 RX15_COHERENT_INT_MASK | INT_TX_MASK)
++
++/* QDMA_CSR_INT_ENABLE2 */
++#define RX15_NO_CPU_DSCP_INT_MASK	BIT(31)
++#define RX14_NO_CPU_DSCP_INT_MASK	BIT(30)
++#define RX13_NO_CPU_DSCP_INT_MASK	BIT(29)
++#define RX12_NO_CPU_DSCP_INT_MASK	BIT(28)
++#define RX11_NO_CPU_DSCP_INT_MASK	BIT(27)
++#define RX10_NO_CPU_DSCP_INT_MASK	BIT(26)
++#define RX9_NO_CPU_DSCP_INT_MASK	BIT(25)
++#define RX8_NO_CPU_DSCP_INT_MASK	BIT(24)
++#define RX7_NO_CPU_DSCP_INT_MASK	BIT(23)
++#define RX6_NO_CPU_DSCP_INT_MASK	BIT(22)
++#define RX5_NO_CPU_DSCP_INT_MASK	BIT(21)
++#define RX4_NO_CPU_DSCP_INT_MASK	BIT(20)
++#define RX3_NO_CPU_DSCP_INT_MASK	BIT(19)
++#define RX2_NO_CPU_DSCP_INT_MASK	BIT(18)
++#define RX1_NO_CPU_DSCP_INT_MASK	BIT(17)
++#define RX0_NO_CPU_DSCP_INT_MASK	BIT(16)
++#define RX15_DONE_INT_MASK		BIT(15)
++#define RX14_DONE_INT_MASK		BIT(14)
++#define RX13_DONE_INT_MASK		BIT(13)
++#define RX12_DONE_INT_MASK		BIT(12)
++#define RX11_DONE_INT_MASK		BIT(11)
++#define RX10_DONE_INT_MASK		BIT(10)
++#define RX9_DONE_INT_MASK		BIT(9)
++#define RX8_DONE_INT_MASK		BIT(8)
++#define RX7_DONE_INT_MASK		BIT(7)
++#define RX6_DONE_INT_MASK		BIT(6)
++#define RX5_DONE_INT_MASK		BIT(5)
++#define RX4_DONE_INT_MASK		BIT(4)
++#define RX3_DONE_INT_MASK		BIT(3)
++#define RX2_DONE_INT_MASK		BIT(2)
++#define RX1_DONE_INT_MASK		BIT(1)
++#define RX0_DONE_INT_MASK		BIT(0)
++
++#define RX_DONE_INT_MASK					\
++	(RX0_DONE_INT_MASK | RX1_DONE_INT_MASK |		\
++	 RX2_DONE_INT_MASK | RX3_DONE_INT_MASK |		\
++	 RX4_DONE_INT_MASK | RX7_DONE_INT_MASK |		\
++	 RX8_DONE_INT_MASK | RX9_DONE_INT_MASK |		\
++	 RX15_DONE_INT_MASK)
++#define INT_IDX1_MASK						\
++	(RX_DONE_INT_MASK |					\
++	 RX0_NO_CPU_DSCP_INT_MASK | RX1_NO_CPU_DSCP_INT_MASK |	\
++	 RX2_NO_CPU_DSCP_INT_MASK | RX3_NO_CPU_DSCP_INT_MASK |	\
++	 RX4_NO_CPU_DSCP_INT_MASK | RX7_NO_CPU_DSCP_INT_MASK |	\
++	 RX8_NO_CPU_DSCP_INT_MASK | RX9_NO_CPU_DSCP_INT_MASK |	\
++	 RX15_NO_CPU_DSCP_INT_MASK)
++
++/* QDMA_CSR_INT_ENABLE5 */
++#define TX31_COHERENT_INT_MASK		BIT(31)
++#define TX30_COHERENT_INT_MASK		BIT(30)
++#define TX29_COHERENT_INT_MASK		BIT(29)
++#define TX28_COHERENT_INT_MASK		BIT(28)
++#define TX27_COHERENT_INT_MASK		BIT(27)
++#define TX26_COHERENT_INT_MASK		BIT(26)
++#define TX25_COHERENT_INT_MASK		BIT(25)
++#define TX24_COHERENT_INT_MASK		BIT(24)
++#define TX23_COHERENT_INT_MASK		BIT(23)
++#define TX22_COHERENT_INT_MASK		BIT(22)
++#define TX21_COHERENT_INT_MASK		BIT(21)
++#define TX20_COHERENT_INT_MASK		BIT(20)
++#define TX19_COHERENT_INT_MASK		BIT(19)
++#define TX18_COHERENT_INT_MASK		BIT(18)
++#define TX17_COHERENT_INT_MASK		BIT(17)
++#define TX16_COHERENT_INT_MASK		BIT(16)
++#define TX15_COHERENT_INT_MASK		BIT(15)
++#define TX14_COHERENT_INT_MASK		BIT(14)
++#define TX13_COHERENT_INT_MASK		BIT(13)
++#define TX12_COHERENT_INT_MASK		BIT(12)
++#define TX11_COHERENT_INT_MASK		BIT(11)
++#define TX10_COHERENT_INT_MASK		BIT(10)
++#define TX9_COHERENT_INT_MASK		BIT(9)
++#define TX8_COHERENT_INT_MASK		BIT(8)
++
++#define INT_IDX4_MASK						\
++	(TX8_COHERENT_INT_MASK | TX9_COHERENT_INT_MASK |	\
++	 TX10_COHERENT_INT_MASK | TX11_COHERENT_INT_MASK |	\
++	 TX12_COHERENT_INT_MASK | TX13_COHERENT_INT_MASK |	\
++	 TX14_COHERENT_INT_MASK | TX15_COHERENT_INT_MASK |	\
++	 TX16_COHERENT_INT_MASK | TX17_COHERENT_INT_MASK |	\
++	 TX18_COHERENT_INT_MASK | TX19_COHERENT_INT_MASK |	\
++	 TX20_COHERENT_INT_MASK | TX21_COHERENT_INT_MASK |	\
++	 TX22_COHERENT_INT_MASK | TX23_COHERENT_INT_MASK |	\
++	 TX24_COHERENT_INT_MASK | TX25_COHERENT_INT_MASK |	\
++	 TX26_COHERENT_INT_MASK | TX27_COHERENT_INT_MASK |	\
++	 TX28_COHERENT_INT_MASK | TX29_COHERENT_INT_MASK |	\
++	 TX30_COHERENT_INT_MASK | TX31_COHERENT_INT_MASK)
++
++#define REG_TX_IRQ_BASE(_n)		((_n) ? 0x0048 : 0x0050)
++
++#define REG_TX_IRQ_CFG(_n)		((_n) ? 0x004c : 0x0054)
++#define TX_IRQ_THR_MASK			GENMASK(27, 16)
++#define TX_IRQ_DEPTH_MASK		GENMASK(11, 0)
++
++#define REG_IRQ_CLEAR_LEN(_n)		((_n) ? 0x0064 : 0x0058)
++#define IRQ_CLEAR_LEN_MASK		GENMASK(7, 0)
++
++#define REG_IRQ_STATUS(_n)		((_n) ? 0x0068 : 0x005c)
++#define IRQ_ENTRY_LEN_MASK		GENMASK(27, 16)
++#define IRQ_HEAD_IDX_MASK		GENMASK(11, 0)
++
++#define REG_TX_RING_BASE(_n)	\
++	(((_n) < 8) ? 0x0100 + ((_n) << 5) : 0x0b00 + (((_n) - 8) << 5))
++
++#define REG_TX_RING_BLOCKING(_n)	\
++	(((_n) < 8) ? 0x0104 + ((_n) << 5) : 0x0b04 + (((_n) - 8) << 5))
++
++#define TX_RING_IRQ_BLOCKING_MAP_MASK			BIT(6)
++#define TX_RING_IRQ_BLOCKING_CFG_MASK			BIT(4)
++#define TX_RING_IRQ_BLOCKING_TX_DROP_EN_MASK		BIT(2)
++#define TX_RING_IRQ_BLOCKING_MAX_TH_TXRING_EN_MASK	BIT(1)
++#define TX_RING_IRQ_BLOCKING_MIN_TH_TXRING_EN_MASK	BIT(0)
++
++#define REG_TX_CPU_IDX(_n)	\
++	(((_n) < 8) ? 0x0108 + ((_n) << 5) : 0x0b08 + (((_n) - 8) << 5))
++
++#define TX_RING_CPU_IDX_MASK		GENMASK(15, 0)
++
++#define REG_TX_DMA_IDX(_n)	\
++	(((_n) < 8) ? 0x010c + ((_n) << 5) : 0x0b0c + (((_n) - 8) << 5))
++
++#define TX_RING_DMA_IDX_MASK		GENMASK(15, 0)
++
++#define IRQ_RING_IDX_MASK		GENMASK(20, 16)
++#define IRQ_DESC_IDX_MASK		GENMASK(15, 0)
++
++#define REG_RX_RING_BASE(_n)	\
++	(((_n) < 16) ? 0x0200 + ((_n) << 5) : 0x0e00 + (((_n) - 16) << 5))
++
++#define REG_RX_RING_SIZE(_n)	\
++	(((_n) < 16) ? 0x0204 + ((_n) << 5) : 0x0e04 + (((_n) - 16) << 5))
++
++#define RX_RING_THR_MASK		GENMASK(31, 16)
++#define RX_RING_SIZE_MASK		GENMASK(15, 0)
++
++#define REG_RX_CPU_IDX(_n)	\
++	(((_n) < 16) ? 0x0208 + ((_n) << 5) : 0x0e08 + (((_n) - 16) << 5))
++
++#define RX_RING_CPU_IDX_MASK		GENMASK(15, 0)
++
++#define REG_RX_DMA_IDX(_n)	\
++	(((_n) < 16) ? 0x020c + ((_n) << 5) : 0x0e0c + (((_n) - 16) << 5))
++
++#define REG_RX_DELAY_INT_IDX(_n)	\
++	(((_n) < 16) ? 0x0210 + ((_n) << 5) : 0x0e10 + (((_n) - 16) << 5))
++
++#define RX_DELAY_INT_MASK		GENMASK(15, 0)
++
++#define RX_RING_DMA_IDX_MASK		GENMASK(15, 0)
++
++#define REG_INGRESS_TRTCM_CFG		0x0070
++#define INGRESS_TRTCM_EN_MASK		BIT(31)
++#define INGRESS_TRTCM_MODE_MASK		BIT(30)
++#define INGRESS_SLOW_TICK_RATIO_MASK	GENMASK(29, 16)
++#define INGRESS_FAST_TICK_MASK		GENMASK(15, 0)
++
++#define REG_QUEUE_CLOSE_CFG(_n)		(0x00a0 + ((_n) & 0xfc))
++#define TXQ_DISABLE_CHAN_QUEUE_MASK(_n, _m)	BIT((_m) + (((_n) & 0x3) << 3))
++
++#define REG_TXQ_DIS_CFG_BASE(_n)	((_n) ? 0x20a0 : 0x00a0)
++#define REG_TXQ_DIS_CFG(_n, _m)		(REG_TXQ_DIS_CFG_BASE((_n)) + (_m) << 2)
++
++#define REG_CNTR_CFG(_n)		(0x0400 + ((_n) << 3))
++#define CNTR_EN_MASK			BIT(31)
++#define CNTR_ALL_CHAN_EN_MASK		BIT(30)
++#define CNTR_ALL_QUEUE_EN_MASK		BIT(29)
++#define CNTR_ALL_DSCP_RING_EN_MASK	BIT(28)
++#define CNTR_SRC_MASK			GENMASK(27, 24)
++#define CNTR_DSCP_RING_MASK		GENMASK(20, 16)
++#define CNTR_CHAN_MASK			GENMASK(7, 3)
++#define CNTR_QUEUE_MASK			GENMASK(2, 0)
++
++#define REG_CNTR_VAL(_n)		(0x0404 + ((_n) << 3))
++
++#define REG_LMGR_INIT_CFG		0x1000
++#define LMGR_INIT_START			BIT(31)
++#define LMGR_SRAM_MODE_MASK		BIT(30)
++#define HW_FWD_PKTSIZE_OVERHEAD_MASK	GENMASK(27, 20)
++#define HW_FWD_DESC_NUM_MASK		GENMASK(16, 0)
++
++#define REG_FWD_DSCP_LOW_THR		0x1004
++#define FWD_DSCP_LOW_THR_MASK		GENMASK(17, 0)
++
++#define REG_EGRESS_RATE_METER_CFG		0x100c
++#define EGRESS_RATE_METER_EN_MASK		BIT(31)
++#define EGRESS_RATE_METER_EQ_RATE_EN_MASK	BIT(17)
++#define EGRESS_RATE_METER_WINDOW_SZ_MASK	GENMASK(16, 12)
++#define EGRESS_RATE_METER_TIMESLICE_MASK	GENMASK(10, 0)
++
++#define REG_EGRESS_TRTCM_CFG		0x1010
++#define EGRESS_TRTCM_EN_MASK		BIT(31)
++#define EGRESS_TRTCM_MODE_MASK		BIT(30)
++#define EGRESS_SLOW_TICK_RATIO_MASK	GENMASK(29, 16)
++#define EGRESS_FAST_TICK_MASK		GENMASK(15, 0)
++
++#define TRTCM_PARAM_RW_MASK		BIT(31)
++#define TRTCM_PARAM_RW_DONE_MASK	BIT(30)
++#define TRTCM_PARAM_TYPE_MASK		GENMASK(29, 28)
++#define TRTCM_METER_GROUP_MASK		GENMASK(27, 26)
++#define TRTCM_PARAM_INDEX_MASK		GENMASK(23, 17)
++#define TRTCM_PARAM_RATE_TYPE_MASK	BIT(16)
++
++#define REG_TRTCM_CFG_PARAM(_n)		((_n) + 0x4)
++#define REG_TRTCM_DATA_LOW(_n)		((_n) + 0x8)
++#define REG_TRTCM_DATA_HIGH(_n)		((_n) + 0xc)
++
++#define REG_TXWRR_MODE_CFG		0x1020
++#define TWRR_WEIGHT_SCALE_MASK		BIT(31)
++#define TWRR_WEIGHT_BASE_MASK		BIT(3)
++
++#define REG_TXWRR_WEIGHT_CFG		0x1024
++#define TWRR_RW_CMD_MASK		BIT(31)
++#define TWRR_RW_CMD_DONE		BIT(30)
++#define TWRR_CHAN_IDX_MASK		GENMASK(23, 19)
++#define TWRR_QUEUE_IDX_MASK		GENMASK(18, 16)
++#define TWRR_VALUE_MASK			GENMASK(15, 0)
++
++#define REG_PSE_BUF_USAGE_CFG		0x1028
++#define PSE_BUF_ESTIMATE_EN_MASK	BIT(29)
++
++#define REG_CHAN_QOS_MODE(_n)		(0x1040 + ((_n) << 2))
++#define CHAN_QOS_MODE_MASK(_n)		GENMASK(2 + ((_n) << 2), (_n) << 2)
++
++#define REG_GLB_TRTCM_CFG		0x1080
++#define GLB_TRTCM_EN_MASK		BIT(31)
++#define GLB_TRTCM_MODE_MASK		BIT(30)
++#define GLB_SLOW_TICK_RATIO_MASK	GENMASK(29, 16)
++#define GLB_FAST_TICK_MASK		GENMASK(15, 0)
++
++#define REG_TXQ_CNGST_CFG		0x10a0
++#define TXQ_CNGST_DROP_EN		BIT(31)
++#define TXQ_CNGST_DEI_DROP_EN		BIT(30)
++
++#define REG_SLA_TRTCM_CFG		0x1150
++#define SLA_TRTCM_EN_MASK		BIT(31)
++#define SLA_TRTCM_MODE_MASK		BIT(30)
++#define SLA_SLOW_TICK_RATIO_MASK	GENMASK(29, 16)
++#define SLA_FAST_TICK_MASK		GENMASK(15, 0)
++
++/* CTRL */
++#define QDMA_DESC_DONE_MASK		BIT(31)
++#define QDMA_DESC_DROP_MASK		BIT(30) /* tx: drop - rx: overflow */
++#define QDMA_DESC_MORE_MASK		BIT(29) /* more SG elements */
++#define QDMA_DESC_DEI_MASK		BIT(25)
++#define QDMA_DESC_NO_DROP_MASK		BIT(24)
++#define QDMA_DESC_LEN_MASK		GENMASK(15, 0)
++/* DATA */
++#define QDMA_DESC_NEXT_ID_MASK		GENMASK(15, 0)
++/* TX MSG0 */
++#define QDMA_ETH_TXMSG_MIC_IDX_MASK	BIT(30)
++#define QDMA_ETH_TXMSG_SP_TAG_MASK	GENMASK(29, 14)
++#define QDMA_ETH_TXMSG_ICO_MASK		BIT(13)
++#define QDMA_ETH_TXMSG_UCO_MASK		BIT(12)
++#define QDMA_ETH_TXMSG_TCO_MASK		BIT(11)
++#define QDMA_ETH_TXMSG_TSO_MASK		BIT(10)
++#define QDMA_ETH_TXMSG_FAST_MASK	BIT(9)
++#define QDMA_ETH_TXMSG_OAM_MASK		BIT(8)
++#define QDMA_ETH_TXMSG_CHAN_MASK	GENMASK(7, 3)
++#define QDMA_ETH_TXMSG_QUEUE_MASK	GENMASK(2, 0)
++/* TX MSG1 */
++#define QDMA_ETH_TXMSG_NO_DROP		BIT(31)
++#define QDMA_ETH_TXMSG_METER_MASK	GENMASK(30, 24)	/* 0x7f no meters */
++#define QDMA_ETH_TXMSG_FPORT_MASK	GENMASK(23, 20)
++#define QDMA_ETH_TXMSG_NBOQ_MASK	GENMASK(19, 15)
++#define QDMA_ETH_TXMSG_HWF_MASK		BIT(14)
++#define QDMA_ETH_TXMSG_HOP_MASK		BIT(13)
++#define QDMA_ETH_TXMSG_PTP_MASK		BIT(12)
++#define QDMA_ETH_TXMSG_ACNT_G1_MASK	GENMASK(10, 6)	/* 0x1f do not count */
++#define QDMA_ETH_TXMSG_ACNT_G0_MASK	GENMASK(5, 0)	/* 0x3f do not count */
++
++/* RX MSG1 */
++#define QDMA_ETH_RXMSG_DEI_MASK		BIT(31)
++#define QDMA_ETH_RXMSG_IP6_MASK		BIT(30)
++#define QDMA_ETH_RXMSG_IP4_MASK		BIT(29)
++#define QDMA_ETH_RXMSG_IP4F_MASK	BIT(28)
++#define QDMA_ETH_RXMSG_L4_VALID_MASK	BIT(27)
++#define QDMA_ETH_RXMSG_L4F_MASK		BIT(26)
++#define QDMA_ETH_RXMSG_SPORT_MASK	GENMASK(25, 21)
++#define QDMA_ETH_RXMSG_CRSN_MASK	GENMASK(20, 16)
++#define QDMA_ETH_RXMSG_PPE_ENTRY_MASK	GENMASK(15, 0)
++
++struct airoha_qdma_desc {
++	__le32 rsv;
++	__le32 ctrl;
++	__le32 addr;
++	__le32 data;
++	__le32 msg0;
++	__le32 msg1;
++	__le32 msg2;
++	__le32 msg3;
++};
++
++/* CTRL0 */
++#define QDMA_FWD_DESC_CTX_MASK		BIT(31)
++#define QDMA_FWD_DESC_RING_MASK		GENMASK(30, 28)
++#define QDMA_FWD_DESC_IDX_MASK		GENMASK(27, 16)
++#define QDMA_FWD_DESC_LEN_MASK		GENMASK(15, 0)
++/* CTRL1 */
++#define QDMA_FWD_DESC_FIRST_IDX_MASK	GENMASK(15, 0)
++/* CTRL2 */
++#define QDMA_FWD_DESC_MORE_PKT_NUM_MASK	GENMASK(2, 0)
++
++struct airoha_qdma_fwd_desc {
++	__le32 addr;
++	__le32 ctrl0;
++	__le32 ctrl1;
++	__le32 ctrl2;
++	__le32 msg0;
++	__le32 msg1;
++	__le32 rsv0;
++	__le32 rsv1;
++};
++
++#endif /* AIROHA_REGS_H */
diff --git a/target/linux/airoha/patches-6.6/048-05-v6.15-net-airoha-Move-DSA-tag-in-DMA-descriptor.patch b/target/linux/airoha/patches-6.6/048-05-v6.15-net-airoha-Move-DSA-tag-in-DMA-descriptor.patch
new file mode 100644
index 00000000000000..61e889f3d2ad99
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/048-05-v6.15-net-airoha-Move-DSA-tag-in-DMA-descriptor.patch
@@ -0,0 +1,287 @@
+From af3cf757d5c99011b9b94ea8d78aeaccc0153fdc Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 28 Feb 2025 11:54:13 +0100
+Subject: [PATCH 05/15] net: airoha: Move DSA tag in DMA descriptor
+
+Packet Processor Engine (PPE) module reads DSA tags from the DMA descriptor
+and requires untagged DSA packets to properly parse them. Move DSA tag
+in the DMA descriptor on TX side and read DSA tag from DMA descriptor
+on RX side. In order to avoid skb reallocation, store tag in skb_dst on
+RX side.
+This is a preliminary patch to enable netfilter flowtable hw offloading
+on EN7581 SoC.
+
+Tested-by: Sayantan Nandy <sayantan.nandy@airoha.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/airoha/airoha_eth.c  | 125 ++++++++++++++++++++--
+ drivers/net/ethernet/airoha/airoha_eth.h  |   7 ++
+ drivers/net/ethernet/airoha/airoha_regs.h |   2 +
+ 3 files changed, 128 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/airoha/airoha_eth.c
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -9,6 +9,7 @@
+ #include <linux/tcp.h>
+ #include <linux/u64_stats_sync.h>
+ #include <net/dsa.h>
++#include <net/dst_metadata.h>
+ #include <net/page_pool/helpers.h>
+ #include <net/pkt_cls.h>
+ #include <uapi/linux/ppp_defs.h>
+@@ -656,6 +657,7 @@ static int airoha_qdma_rx_process(struct
+ 		struct airoha_qdma_desc *desc = &q->desc[q->tail];
+ 		dma_addr_t dma_addr = le32_to_cpu(desc->addr);
+ 		u32 desc_ctrl = le32_to_cpu(desc->ctrl);
++		struct airoha_gdm_port *port;
+ 		struct sk_buff *skb;
+ 		int len, p;
+ 
+@@ -683,6 +685,7 @@ static int airoha_qdma_rx_process(struct
+ 			continue;
+ 		}
+ 
++		port = eth->ports[p];
+ 		skb = napi_build_skb(e->buf, q->buf_size);
+ 		if (!skb) {
+ 			page_pool_put_full_page(q->page_pool,
+@@ -694,10 +697,26 @@ static int airoha_qdma_rx_process(struct
+ 		skb_reserve(skb, 2);
+ 		__skb_put(skb, len);
+ 		skb_mark_for_recycle(skb);
+-		skb->dev = eth->ports[p]->dev;
++		skb->dev = port->dev;
+ 		skb->protocol = eth_type_trans(skb, skb->dev);
+ 		skb->ip_summed = CHECKSUM_UNNECESSARY;
+ 		skb_record_rx_queue(skb, qid);
++
++		if (netdev_uses_dsa(port->dev)) {
++			/* PPE module requires untagged packets to work
++			 * properly and it provides DSA port index via the
++			 * DMA descriptor. Report DSA tag to the DSA stack
++			 * via skb dst info.
++			 */
++			u32 sptag = FIELD_GET(QDMA_ETH_RXMSG_SPTAG,
++					      le32_to_cpu(desc->msg0));
++
++			if (sptag < ARRAY_SIZE(port->dsa_meta) &&
++			    port->dsa_meta[sptag])
++				skb_dst_set_noref(skb,
++						  &port->dsa_meta[sptag]->dst);
++		}
++
+ 		napi_gro_receive(&q->napi, skb);
+ 
+ 		done++;
+@@ -1637,25 +1656,76 @@ static u16 airoha_dev_select_queue(struc
+ 	return queue < dev->num_tx_queues ? queue : 0;
+ }
+ 
++static u32 airoha_get_dsa_tag(struct sk_buff *skb, struct net_device *dev)
++{
++#if IS_ENABLED(CONFIG_NET_DSA)
++	struct ethhdr *ehdr;
++	struct dsa_port *dp;
++	u8 xmit_tpid;
++	u16 tag;
++
++	if (!netdev_uses_dsa(dev))
++		return 0;
++
++	dp = dev->dsa_ptr;
++	if (IS_ERR(dp))
++		return 0;
++
++	if (dp->tag_ops->proto != DSA_TAG_PROTO_MTK)
++		return 0;
++
++	if (skb_cow_head(skb, 0))
++		return 0;
++
++	ehdr = (struct ethhdr *)skb->data;
++	tag = be16_to_cpu(ehdr->h_proto);
++	xmit_tpid = tag >> 8;
++
++	switch (xmit_tpid) {
++	case MTK_HDR_XMIT_TAGGED_TPID_8100:
++		ehdr->h_proto = cpu_to_be16(ETH_P_8021Q);
++		tag &= ~(MTK_HDR_XMIT_TAGGED_TPID_8100 << 8);
++		break;
++	case MTK_HDR_XMIT_TAGGED_TPID_88A8:
++		ehdr->h_proto = cpu_to_be16(ETH_P_8021AD);
++		tag &= ~(MTK_HDR_XMIT_TAGGED_TPID_88A8 << 8);
++		break;
++	default:
++		/* PPE module requires untagged DSA packets to work properly,
++		 * so move DSA tag to DMA descriptor.
++		 */
++		memmove(skb->data + MTK_HDR_LEN, skb->data, 2 * ETH_ALEN);
++		__skb_pull(skb, MTK_HDR_LEN);
++		break;
++	}
++
++	return tag;
++#else
++	return 0;
++#endif
++}
++
+ static netdev_tx_t airoha_dev_xmit(struct sk_buff *skb,
+ 				   struct net_device *dev)
+ {
+ 	struct airoha_gdm_port *port = netdev_priv(dev);
+-	u32 nr_frags = 1 + skb_shinfo(skb)->nr_frags;
+-	u32 msg0, msg1, len = skb_headlen(skb);
+ 	struct airoha_qdma *qdma = port->qdma;
++	u32 nr_frags, tag, msg0, msg1, len;
+ 	struct netdev_queue *txq;
+ 	struct airoha_queue *q;
+-	void *data = skb->data;
++	void *data;
+ 	int i, qid;
+ 	u16 index;
+ 	u8 fport;
+ 
+ 	qid = skb_get_queue_mapping(skb) % ARRAY_SIZE(qdma->q_tx);
++	tag = airoha_get_dsa_tag(skb, dev);
++
+ 	msg0 = FIELD_PREP(QDMA_ETH_TXMSG_CHAN_MASK,
+ 			  qid / AIROHA_NUM_QOS_QUEUES) |
+ 	       FIELD_PREP(QDMA_ETH_TXMSG_QUEUE_MASK,
+-			  qid % AIROHA_NUM_QOS_QUEUES);
++			  qid % AIROHA_NUM_QOS_QUEUES) |
++	       FIELD_PREP(QDMA_ETH_TXMSG_SP_TAG_MASK, tag);
+ 	if (skb->ip_summed == CHECKSUM_PARTIAL)
+ 		msg0 |= FIELD_PREP(QDMA_ETH_TXMSG_TCO_MASK, 1) |
+ 			FIELD_PREP(QDMA_ETH_TXMSG_UCO_MASK, 1) |
+@@ -1686,6 +1756,8 @@ static netdev_tx_t airoha_dev_xmit(struc
+ 	spin_lock_bh(&q->lock);
+ 
+ 	txq = netdev_get_tx_queue(dev, qid);
++	nr_frags = 1 + skb_shinfo(skb)->nr_frags;
++
+ 	if (q->queued + nr_frags > q->ndesc) {
+ 		/* not enough space in the queue */
+ 		netif_tx_stop_queue(txq);
+@@ -1693,7 +1765,10 @@ static netdev_tx_t airoha_dev_xmit(struc
+ 		return NETDEV_TX_BUSY;
+ 	}
+ 
++	len = skb_headlen(skb);
++	data = skb->data;
+ 	index = q->head;
++
+ 	for (i = 0; i < nr_frags; i++) {
+ 		struct airoha_qdma_desc *desc = &q->desc[index];
+ 		struct airoha_queue_entry *e = &q->entry[index];
+@@ -2224,6 +2299,37 @@ static const struct ethtool_ops airoha_e
+ 	.get_rmon_stats		= airoha_ethtool_get_rmon_stats,
+ };
+ 
++static int airoha_metadata_dst_alloc(struct airoha_gdm_port *port)
++{
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(port->dsa_meta); i++) {
++		struct metadata_dst *md_dst;
++
++		md_dst = metadata_dst_alloc(0, METADATA_HW_PORT_MUX,
++					    GFP_KERNEL);
++		if (!md_dst)
++			return -ENOMEM;
++
++		md_dst->u.port_info.port_id = i;
++		port->dsa_meta[i] = md_dst;
++	}
++
++	return 0;
++}
++
++static void airoha_metadata_dst_free(struct airoha_gdm_port *port)
++{
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(port->dsa_meta); i++) {
++		if (!port->dsa_meta[i])
++			continue;
++
++		metadata_dst_free(port->dsa_meta[i]);
++	}
++}
++
+ static int airoha_alloc_gdm_port(struct airoha_eth *eth, struct device_node *np)
+ {
+ 	const __be32 *id_ptr = of_get_property(np, "reg", NULL);
+@@ -2296,6 +2402,10 @@ static int airoha_alloc_gdm_port(struct
+ 	port->id = id;
+ 	eth->ports[index] = port;
+ 
++	err = airoha_metadata_dst_alloc(port);
++	if (err)
++		return err;
++
+ 	return register_netdev(dev);
+ }
+ 
+@@ -2388,8 +2498,10 @@ error_hw_cleanup:
+ 	for (i = 0; i < ARRAY_SIZE(eth->ports); i++) {
+ 		struct airoha_gdm_port *port = eth->ports[i];
+ 
+-		if (port && port->dev->reg_state == NETREG_REGISTERED)
++		if (port && port->dev->reg_state == NETREG_REGISTERED) {
+ 			unregister_netdev(port->dev);
++			airoha_metadata_dst_free(port);
++		}
+ 	}
+ 	free_netdev(eth->napi_dev);
+ 	platform_set_drvdata(pdev, NULL);
+@@ -2415,6 +2527,7 @@ static void airoha_remove(struct platfor
+ 
+ 		airoha_dev_stop(port->dev);
+ 		unregister_netdev(port->dev);
++		airoha_metadata_dst_free(port);
+ 	}
+ 	free_netdev(eth->napi_dev);
+ 
+--- a/drivers/net/ethernet/airoha/airoha_eth.h
++++ b/drivers/net/ethernet/airoha/airoha_eth.h
+@@ -15,6 +15,7 @@
+ 
+ #define AIROHA_MAX_NUM_GDM_PORTS	1
+ #define AIROHA_MAX_NUM_QDMA		2
++#define AIROHA_MAX_DSA_PORTS		7
+ #define AIROHA_MAX_NUM_RSTS		3
+ #define AIROHA_MAX_NUM_XSI_RSTS		5
+ #define AIROHA_MAX_MTU			2000
+@@ -43,6 +44,10 @@
+ #define QDMA_METER_IDX(_n)		((_n) & 0xff)
+ #define QDMA_METER_GROUP(_n)		(((_n) >> 8) & 0x3)
+ 
++#define MTK_HDR_LEN			4
++#define MTK_HDR_XMIT_TAGGED_TPID_8100	1
++#define MTK_HDR_XMIT_TAGGED_TPID_88A8	2
++
+ enum {
+ 	QDMA_INT_REG_IDX0,
+ 	QDMA_INT_REG_IDX1,
+@@ -231,6 +236,8 @@ struct airoha_gdm_port {
+ 	/* qos stats counters */
+ 	u64 cpu_tx_packets;
+ 	u64 fwd_tx_packets;
++
++	struct metadata_dst *dsa_meta[AIROHA_MAX_DSA_PORTS];
+ };
+ 
+ struct airoha_eth {
+--- a/drivers/net/ethernet/airoha/airoha_regs.h
++++ b/drivers/net/ethernet/airoha/airoha_regs.h
+@@ -624,6 +624,8 @@
+ #define QDMA_ETH_TXMSG_ACNT_G1_MASK	GENMASK(10, 6)	/* 0x1f do not count */
+ #define QDMA_ETH_TXMSG_ACNT_G0_MASK	GENMASK(5, 0)	/* 0x3f do not count */
+ 
++/* RX MSG0 */
++#define QDMA_ETH_RXMSG_SPTAG		GENMASK(21, 14)
+ /* RX MSG1 */
+ #define QDMA_ETH_RXMSG_DEI_MASK		BIT(31)
+ #define QDMA_ETH_RXMSG_IP6_MASK		BIT(30)
diff --git a/target/linux/airoha/patches-6.6/048-06-v6.15-net-dsa-mt7530-Enable-Rx-sptag-for-EN7581-SoC.patch b/target/linux/airoha/patches-6.6/048-06-v6.15-net-dsa-mt7530-Enable-Rx-sptag-for-EN7581-SoC.patch
new file mode 100644
index 00000000000000..27956d553af05a
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/048-06-v6.15-net-dsa-mt7530-Enable-Rx-sptag-for-EN7581-SoC.patch
@@ -0,0 +1,46 @@
+From ab667db1e6014634c6607ebdddc16c1b8394a935 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 28 Feb 2025 11:54:14 +0100
+Subject: [PATCH 06/15] net: dsa: mt7530: Enable Rx sptag for EN7581 SoC
+
+Packet Processor Engine (PPE) module used for hw acceleration on EN7581
+mac block, in order to properly parse packets, requires DSA untagged
+packets on TX side and read DSA tag from DMA descriptor on RX side.
+For this reason, enable RX Special Tag (SPTAG) for EN7581 SoC.
+This is a preliminary patch to enable netfilter flowtable hw offloading
+on EN7581 SoC.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/dsa/mt7530.c | 5 +++++
+ drivers/net/dsa/mt7530.h | 4 ++++
+ 2 files changed, 9 insertions(+)
+
+--- a/drivers/net/dsa/mt7530.c
++++ b/drivers/net/dsa/mt7530.c
+@@ -2588,6 +2588,11 @@ mt7531_setup_common(struct dsa_switch *d
+ 	/* Allow mirroring frames received on the local port (monitor port). */
+ 	mt7530_set(priv, MT753X_AGC, LOCAL_EN);
+ 
++	/* Enable Special Tag for rx frames */
++	if (priv->id == ID_EN7581)
++		mt7530_write(priv, MT753X_CPORT_SPTAG_CFG,
++			     CPORT_SW2FE_STAG_EN | CPORT_FE2SW_STAG_EN);
++
+ 	/* Flush the FDB table */
+ 	ret = mt7530_fdb_cmd(priv, MT7530_FDB_FLUSH, NULL);
+ 	if (ret < 0)
+--- a/drivers/net/dsa/mt7530.h
++++ b/drivers/net/dsa/mt7530.h
+@@ -615,6 +615,10 @@ enum mt7531_xtal_fsel {
+ #define  MT7531_GPIO12_RG_RXD3_MASK	GENMASK(19, 16)
+ #define  MT7531_EXT_P_MDIO_12		(2 << 16)
+ 
++#define MT753X_CPORT_SPTAG_CFG		0x7c10
++#define  CPORT_SW2FE_STAG_EN		BIT(1)
++#define  CPORT_FE2SW_STAG_EN		BIT(0)
++
+ /* Registers for LED GPIO control (MT7530 only)
+  * All registers follow this pattern:
+  * [ 2: 0]  port 0
diff --git a/target/linux/airoha/patches-6.6/048-07-v6.15-net-airoha-Enable-support-for-multiple-net_devices.patch b/target/linux/airoha/patches-6.6/048-07-v6.15-net-airoha-Enable-support-for-multiple-net_devices.patch
new file mode 100644
index 00000000000000..af4fa78c90958c
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/048-07-v6.15-net-airoha-Enable-support-for-multiple-net_devices.patch
@@ -0,0 +1,144 @@
+From 80369686737fe07c233a1152da0b84372dabdcd6 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 28 Feb 2025 11:54:15 +0100
+Subject: [PATCH 07/15] net: airoha: Enable support for multiple net_devices
+
+In the current codebase airoha_eth driver supports just a single
+net_device connected to the Packet Switch Engine (PSE) lan port (GDM1).
+As shown in commit 23020f049327 ("net: airoha: Introduce ethernet
+support for EN7581 SoC"), PSE can switch packets between four GDM ports.
+Enable the capability to create a net_device for each GDM port of the
+PSE module. Moreover, since the QDMA blocks can be shared between
+net_devices, do not stop TX/RX DMA in airoha_dev_stop() if there are
+active net_devices for this QDMA block.
+This is a preliminary patch to enable flowtable hw offloading for EN7581
+SoC.
+
+Co-developed-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/airoha/airoha_eth.c | 35 ++++++++++++++----------
+ drivers/net/ethernet/airoha/airoha_eth.h |  4 ++-
+ 2 files changed, 24 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/ethernet/airoha/airoha_eth.c
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -1563,6 +1563,7 @@ static int airoha_dev_open(struct net_de
+ 	airoha_qdma_set(qdma, REG_QDMA_GLOBAL_CFG,
+ 			GLOBAL_CFG_TX_DMA_EN_MASK |
+ 			GLOBAL_CFG_RX_DMA_EN_MASK);
++	atomic_inc(&qdma->users);
+ 
+ 	return 0;
+ }
+@@ -1578,16 +1579,20 @@ static int airoha_dev_stop(struct net_de
+ 	if (err)
+ 		return err;
+ 
+-	airoha_qdma_clear(qdma, REG_QDMA_GLOBAL_CFG,
+-			  GLOBAL_CFG_TX_DMA_EN_MASK |
+-			  GLOBAL_CFG_RX_DMA_EN_MASK);
++	for (i = 0; i < ARRAY_SIZE(qdma->q_tx); i++)
++		netdev_tx_reset_subqueue(dev, i);
+ 
+-	for (i = 0; i < ARRAY_SIZE(qdma->q_tx); i++) {
+-		if (!qdma->q_tx[i].ndesc)
+-			continue;
++	if (atomic_dec_and_test(&qdma->users)) {
++		airoha_qdma_clear(qdma, REG_QDMA_GLOBAL_CFG,
++				  GLOBAL_CFG_TX_DMA_EN_MASK |
++				  GLOBAL_CFG_RX_DMA_EN_MASK);
++
++		for (i = 0; i < ARRAY_SIZE(qdma->q_tx); i++) {
++			if (!qdma->q_tx[i].ndesc)
++				continue;
+ 
+-		airoha_qdma_cleanup_tx_queue(&qdma->q_tx[i]);
+-		netdev_tx_reset_subqueue(dev, i);
++			airoha_qdma_cleanup_tx_queue(&qdma->q_tx[i]);
++		}
+ 	}
+ 
+ 	return 0;
+@@ -2330,13 +2335,14 @@ static void airoha_metadata_dst_free(str
+ 	}
+ }
+ 
+-static int airoha_alloc_gdm_port(struct airoha_eth *eth, struct device_node *np)
++static int airoha_alloc_gdm_port(struct airoha_eth *eth,
++				 struct device_node *np, int index)
+ {
+ 	const __be32 *id_ptr = of_get_property(np, "reg", NULL);
+ 	struct airoha_gdm_port *port;
+ 	struct airoha_qdma *qdma;
+ 	struct net_device *dev;
+-	int err, index;
++	int err, p;
+ 	u32 id;
+ 
+ 	if (!id_ptr) {
+@@ -2345,14 +2351,14 @@ static int airoha_alloc_gdm_port(struct
+ 	}
+ 
+ 	id = be32_to_cpup(id_ptr);
+-	index = id - 1;
++	p = id - 1;
+ 
+ 	if (!id || id > ARRAY_SIZE(eth->ports)) {
+ 		dev_err(eth->dev, "invalid gdm port id: %d\n", id);
+ 		return -EINVAL;
+ 	}
+ 
+-	if (eth->ports[index]) {
++	if (eth->ports[p]) {
+ 		dev_err(eth->dev, "duplicate gdm port id: %d\n", id);
+ 		return -EINVAL;
+ 	}
+@@ -2400,7 +2406,7 @@ static int airoha_alloc_gdm_port(struct
+ 	port->qdma = qdma;
+ 	port->dev = dev;
+ 	port->id = id;
+-	eth->ports[index] = port;
++	eth->ports[p] = port;
+ 
+ 	err = airoha_metadata_dst_alloc(port);
+ 	if (err)
+@@ -2472,6 +2478,7 @@ static int airoha_probe(struct platform_
+ 	for (i = 0; i < ARRAY_SIZE(eth->qdma); i++)
+ 		airoha_qdma_start_napi(&eth->qdma[i]);
+ 
++	i = 0;
+ 	for_each_child_of_node(pdev->dev.of_node, np) {
+ 		if (!of_device_is_compatible(np, "airoha,eth-mac"))
+ 			continue;
+@@ -2479,7 +2486,7 @@ static int airoha_probe(struct platform_
+ 		if (!of_device_is_available(np))
+ 			continue;
+ 
+-		err = airoha_alloc_gdm_port(eth, np);
++		err = airoha_alloc_gdm_port(eth, np, i++);
+ 		if (err) {
+ 			of_node_put(np);
+ 			goto error_napi_stop;
+--- a/drivers/net/ethernet/airoha/airoha_eth.h
++++ b/drivers/net/ethernet/airoha/airoha_eth.h
+@@ -13,7 +13,7 @@
+ #include <linux/netdevice.h>
+ #include <linux/reset.h>
+ 
+-#define AIROHA_MAX_NUM_GDM_PORTS	1
++#define AIROHA_MAX_NUM_GDM_PORTS	4
+ #define AIROHA_MAX_NUM_QDMA		2
+ #define AIROHA_MAX_DSA_PORTS		7
+ #define AIROHA_MAX_NUM_RSTS		3
+@@ -212,6 +212,8 @@ struct airoha_qdma {
+ 	u32 irqmask[QDMA_INT_REG_MAX];
+ 	int irq;
+ 
++	atomic_t users;
++
+ 	struct airoha_tx_irq_queue q_tx_irq[AIROHA_NUM_TX_IRQ];
+ 
+ 	struct airoha_queue q_tx[AIROHA_NUM_TX_RING];
diff --git a/target/linux/airoha/patches-6.6/048-08-v6.15-net-airoha-Move-REG_GDM_FWD_CFG-initialization-in-ai.patch b/target/linux/airoha/patches-6.6/048-08-v6.15-net-airoha-Move-REG_GDM_FWD_CFG-initialization-in-ai.patch
new file mode 100644
index 00000000000000..8bc0f856577cd4
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/048-08-v6.15-net-airoha-Move-REG_GDM_FWD_CFG-initialization-in-ai.patch
@@ -0,0 +1,77 @@
+From 67fde5d58cd43d129a979e918ec9cd5d2e2fbcfb Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 28 Feb 2025 11:54:16 +0100
+Subject: [PATCH 08/15] net: airoha: Move REG_GDM_FWD_CFG() initialization in
+ airoha_dev_init()
+
+Move REG_GDM_FWD_CFG() register initialization in airoha_dev_init
+routine. Moreover, always send traffic PPE module in order to be
+processed by hw accelerator.
+This is a preliminary patch to enable netfilter flowtable hw offloading
+on EN7581 SoC.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/airoha/airoha_eth.c | 14 ++++----------
+ 1 file changed, 4 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/airoha/airoha_eth.c
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -107,25 +107,20 @@ static void airoha_set_gdm_port_fwd_cfg(
+ 
+ static int airoha_set_gdm_port(struct airoha_eth *eth, int port, bool enable)
+ {
+-	u32 val = enable ? FE_PSE_PORT_PPE1 : FE_PSE_PORT_DROP;
+-	u32 vip_port, cfg_addr;
++	u32 vip_port;
+ 
+ 	switch (port) {
+ 	case XSI_PCIE0_PORT:
+ 		vip_port = XSI_PCIE0_VIP_PORT_MASK;
+-		cfg_addr = REG_GDM_FWD_CFG(3);
+ 		break;
+ 	case XSI_PCIE1_PORT:
+ 		vip_port = XSI_PCIE1_VIP_PORT_MASK;
+-		cfg_addr = REG_GDM_FWD_CFG(3);
+ 		break;
+ 	case XSI_USB_PORT:
+ 		vip_port = XSI_USB_VIP_PORT_MASK;
+-		cfg_addr = REG_GDM_FWD_CFG(4);
+ 		break;
+ 	case XSI_ETH_PORT:
+ 		vip_port = XSI_ETH_VIP_PORT_MASK;
+-		cfg_addr = REG_GDM_FWD_CFG(4);
+ 		break;
+ 	default:
+ 		return -EINVAL;
+@@ -139,8 +134,6 @@ static int airoha_set_gdm_port(struct ai
+ 		airoha_fe_clear(eth, REG_FE_IFC_PORT_EN, vip_port);
+ 	}
+ 
+-	airoha_set_gdm_port_fwd_cfg(eth, cfg_addr, val);
+-
+ 	return 0;
+ }
+ 
+@@ -177,8 +170,6 @@ static void airoha_fe_maccr_init(struct
+ 		airoha_fe_set(eth, REG_GDM_FWD_CFG(p),
+ 			      GDM_TCP_CKSUM | GDM_UDP_CKSUM | GDM_IP4_CKSUM |
+ 			      GDM_DROP_CRC_ERR);
+-		airoha_set_gdm_port_fwd_cfg(eth, REG_GDM_FWD_CFG(p),
+-					    FE_PSE_PORT_CDM1);
+ 		airoha_fe_rmw(eth, REG_GDM_LEN_CFG(p),
+ 			      GDM_SHORT_LEN_MASK | GDM_LONG_LEN_MASK,
+ 			      FIELD_PREP(GDM_SHORT_LEN_MASK, 60) |
+@@ -1615,8 +1606,11 @@ static int airoha_dev_set_macaddr(struct
+ static int airoha_dev_init(struct net_device *dev)
+ {
+ 	struct airoha_gdm_port *port = netdev_priv(dev);
++	struct airoha_eth *eth = port->qdma->eth;
+ 
+ 	airoha_set_macaddr(port, dev->dev_addr);
++	airoha_set_gdm_port_fwd_cfg(eth, REG_GDM_FWD_CFG(port->id),
++				    FE_PSE_PORT_PPE1);
+ 
+ 	return 0;
+ }
diff --git a/target/linux/airoha/patches-6.6/048-09-v6.15-net-airoha-Rename-airoha_set_gdm_port_fwd_cfg-in-air.patch b/target/linux/airoha/patches-6.6/048-09-v6.15-net-airoha-Rename-airoha_set_gdm_port_fwd_cfg-in-air.patch
new file mode 100644
index 00000000000000..11f879de1c407f
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/048-09-v6.15-net-airoha-Rename-airoha_set_gdm_port_fwd_cfg-in-air.patch
@@ -0,0 +1,120 @@
+From c28b8375f6d02ef3b5e8c51234cc3f6d47d9fb7f Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 28 Feb 2025 11:54:17 +0100
+Subject: [PATCH 09/15] net: airoha: Rename airoha_set_gdm_port_fwd_cfg() in
+ airoha_set_vip_for_gdm_port()
+
+Rename airoha_set_gdm_port() in airoha_set_vip_for_gdm_port().
+Get rid of airoha_set_gdm_ports routine.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/airoha/airoha_eth.c | 49 ++++++------------------
+ drivers/net/ethernet/airoha/airoha_eth.h |  8 ----
+ 2 files changed, 11 insertions(+), 46 deletions(-)
+
+--- a/drivers/net/ethernet/airoha/airoha_eth.c
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -105,25 +105,23 @@ static void airoha_set_gdm_port_fwd_cfg(
+ 		      FIELD_PREP(GDM_UCFQ_MASK, val));
+ }
+ 
+-static int airoha_set_gdm_port(struct airoha_eth *eth, int port, bool enable)
++static int airoha_set_vip_for_gdm_port(struct airoha_gdm_port *port,
++				       bool enable)
+ {
++	struct airoha_eth *eth = port->qdma->eth;
+ 	u32 vip_port;
+ 
+-	switch (port) {
+-	case XSI_PCIE0_PORT:
++	switch (port->id) {
++	case 3:
++		/* FIXME: handle XSI_PCIE1_PORT */
+ 		vip_port = XSI_PCIE0_VIP_PORT_MASK;
+ 		break;
+-	case XSI_PCIE1_PORT:
+-		vip_port = XSI_PCIE1_VIP_PORT_MASK;
+-		break;
+-	case XSI_USB_PORT:
+-		vip_port = XSI_USB_VIP_PORT_MASK;
+-		break;
+-	case XSI_ETH_PORT:
++	case 4:
++		/* FIXME: handle XSI_USB_PORT */
+ 		vip_port = XSI_ETH_VIP_PORT_MASK;
+ 		break;
+ 	default:
+-		return -EINVAL;
++		return 0;
+ 	}
+ 
+ 	if (enable) {
+@@ -137,31 +135,6 @@ static int airoha_set_gdm_port(struct ai
+ 	return 0;
+ }
+ 
+-static int airoha_set_gdm_ports(struct airoha_eth *eth, bool enable)
+-{
+-	const int port_list[] = {
+-		XSI_PCIE0_PORT,
+-		XSI_PCIE1_PORT,
+-		XSI_USB_PORT,
+-		XSI_ETH_PORT
+-	};
+-	int i, err;
+-
+-	for (i = 0; i < ARRAY_SIZE(port_list); i++) {
+-		err = airoha_set_gdm_port(eth, port_list[i], enable);
+-		if (err)
+-			goto error;
+-	}
+-
+-	return 0;
+-
+-error:
+-	for (i--; i >= 0; i--)
+-		airoha_set_gdm_port(eth, port_list[i], false);
+-
+-	return err;
+-}
+-
+ static void airoha_fe_maccr_init(struct airoha_eth *eth)
+ {
+ 	int p;
+@@ -1540,7 +1513,7 @@ static int airoha_dev_open(struct net_de
+ 	int err;
+ 
+ 	netif_tx_start_all_queues(dev);
+-	err = airoha_set_gdm_ports(qdma->eth, true);
++	err = airoha_set_vip_for_gdm_port(port, true);
+ 	if (err)
+ 		return err;
+ 
+@@ -1566,7 +1539,7 @@ static int airoha_dev_stop(struct net_de
+ 	int i, err;
+ 
+ 	netif_tx_disable(dev);
+-	err = airoha_set_gdm_ports(qdma->eth, false);
++	err = airoha_set_vip_for_gdm_port(port, false);
+ 	if (err)
+ 		return err;
+ 
+--- a/drivers/net/ethernet/airoha/airoha_eth.h
++++ b/drivers/net/ethernet/airoha/airoha_eth.h
+@@ -58,14 +58,6 @@ enum {
+ };
+ 
+ enum {
+-	XSI_PCIE0_PORT,
+-	XSI_PCIE1_PORT,
+-	XSI_USB_PORT,
+-	XSI_AE_PORT,
+-	XSI_ETH_PORT,
+-};
+-
+-enum {
+ 	XSI_PCIE0_VIP_PORT_MASK	= BIT(22),
+ 	XSI_PCIE1_VIP_PORT_MASK	= BIT(23),
+ 	XSI_USB_VIP_PORT_MASK	= BIT(25),
diff --git a/target/linux/airoha/patches-6.6/048-12-v6.15-net-airoha-Introduce-Airoha-NPU-support.patch b/target/linux/airoha/patches-6.6/048-12-v6.15-net-airoha-Introduce-Airoha-NPU-support.patch
new file mode 100644
index 00000000000000..41c5622304096f
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/048-12-v6.15-net-airoha-Introduce-Airoha-NPU-support.patch
@@ -0,0 +1,627 @@
+From 23290c7bc190def4e1ca61610992d9b7c32e33f3 Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 28 Feb 2025 11:54:20 +0100
+Subject: [PATCH 12/15] net: airoha: Introduce Airoha NPU support
+
+Packet Processor Engine (PPE) module available on EN7581 SoC populates
+the PPE table with 5-tuples flower rules learned from traffic forwarded
+between the GDM ports connected to the Packet Switch Engine (PSE) module.
+The airoha_eth driver can enable hw acceleration of learned 5-tuples
+rules if the user configure them in netfilter flowtable (netfilter
+flowtable support will be added with subsequent patches).
+airoha_eth driver configures and collects data from the PPE module via a
+Network Processor Unit (NPU) RISC-V module available on the EN7581 SoC.
+Introduce basic support for Airoha NPU module.
+
+Tested-by: Sayantan Nandy <sayantan.nandy@airoha.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/airoha/Kconfig      |   9 +
+ drivers/net/ethernet/airoha/Makefile     |   1 +
+ drivers/net/ethernet/airoha/airoha_eth.h |   2 +
+ drivers/net/ethernet/airoha/airoha_npu.c | 520 +++++++++++++++++++++++
+ drivers/net/ethernet/airoha/airoha_npu.h |  34 ++
+ 5 files changed, 566 insertions(+)
+ create mode 100644 drivers/net/ethernet/airoha/airoha_npu.c
+ create mode 100644 drivers/net/ethernet/airoha/airoha_npu.h
+
+--- a/drivers/net/ethernet/airoha/Kconfig
++++ b/drivers/net/ethernet/airoha/Kconfig
+@@ -7,9 +7,18 @@ config NET_VENDOR_AIROHA
+ 
+ if NET_VENDOR_AIROHA
+ 
++config NET_AIROHA_NPU
++	tristate "Airoha NPU support"
++	select WANT_DEV_COREDUMP
++	select REGMAP_MMIO
++	help
++	  This driver supports Airoha Network Processor (NPU) available
++	  on the Airoha Soc family.
++
+ config NET_AIROHA
+ 	tristate "Airoha SoC Gigabit Ethernet support"
+ 	depends on NET_DSA || !NET_DSA
++	select NET_AIROHA_NPU
+ 	select PAGE_POOL
+ 	help
+ 	  This driver supports the gigabit ethernet MACs in the
+--- a/drivers/net/ethernet/airoha/Makefile
++++ b/drivers/net/ethernet/airoha/Makefile
+@@ -4,3 +4,4 @@
+ #
+ 
+ obj-$(CONFIG_NET_AIROHA) += airoha_eth.o
++obj-$(CONFIG_NET_AIROHA_NPU) += airoha_npu.o
+--- a/drivers/net/ethernet/airoha/airoha_eth.h
++++ b/drivers/net/ethernet/airoha/airoha_eth.h
+@@ -240,6 +240,8 @@ struct airoha_eth {
+ 	unsigned long state;
+ 	void __iomem *fe_regs;
+ 
++	struct airoha_npu __rcu *npu;
++
+ 	struct reset_control_bulk_data rsts[AIROHA_MAX_NUM_RSTS];
+ 	struct reset_control_bulk_data xsi_rsts[AIROHA_MAX_NUM_XSI_RSTS];
+ 
+--- /dev/null
++++ b/drivers/net/ethernet/airoha/airoha_npu.c
+@@ -0,0 +1,520 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Copyright (c) 2025 AIROHA Inc
++ * Author: Lorenzo Bianconi <lorenzo@kernel.org>
++ */
++
++#include <linux/devcoredump.h>
++#include <linux/firmware.h>
++#include <linux/platform_device.h>
++#include <linux/of_net.h>
++#include <linux/of_platform.h>
++#include <linux/of_reserved_mem.h>
++#include <linux/regmap.h>
++
++#include "airoha_npu.h"
++
++#define NPU_EN7581_FIRMWARE_DATA		"airoha/en7581_npu_data.bin"
++#define NPU_EN7581_FIRMWARE_RV32		"airoha/en7581_npu_rv32.bin"
++#define NPU_EN7581_FIRMWARE_RV32_MAX_SIZE	0x200000
++#define NPU_EN7581_FIRMWARE_DATA_MAX_SIZE	0x10000
++#define NPU_DUMP_SIZE				512
++
++#define REG_NPU_LOCAL_SRAM		0x0
++
++#define NPU_PC_BASE_ADDR		0x305000
++#define REG_PC_DBG(_n)			(0x305000 + ((_n) * 0x100))
++
++#define NPU_CLUSTER_BASE_ADDR		0x306000
++
++#define REG_CR_BOOT_TRIGGER		(NPU_CLUSTER_BASE_ADDR + 0x000)
++#define REG_CR_BOOT_CONFIG		(NPU_CLUSTER_BASE_ADDR + 0x004)
++#define REG_CR_BOOT_BASE(_n)		(NPU_CLUSTER_BASE_ADDR + 0x020 + ((_n) << 2))
++
++#define NPU_MBOX_BASE_ADDR		0x30c000
++
++#define REG_CR_MBOX_INT_STATUS		(NPU_MBOX_BASE_ADDR + 0x000)
++#define MBOX_INT_STATUS_MASK		BIT(8)
++
++#define REG_CR_MBOX_INT_MASK(_n)	(NPU_MBOX_BASE_ADDR + 0x004 + ((_n) << 2))
++#define REG_CR_MBQ0_CTRL(_n)		(NPU_MBOX_BASE_ADDR + 0x030 + ((_n) << 2))
++#define REG_CR_MBQ8_CTRL(_n)		(NPU_MBOX_BASE_ADDR + 0x0b0 + ((_n) << 2))
++#define REG_CR_NPU_MIB(_n)		(NPU_MBOX_BASE_ADDR + 0x140 + ((_n) << 2))
++
++#define NPU_TIMER_BASE_ADDR		0x310100
++#define REG_WDT_TIMER_CTRL(_n)		(NPU_TIMER_BASE_ADDR + ((_n) * 0x100))
++#define WDT_EN_MASK			BIT(25)
++#define WDT_INTR_MASK			BIT(21)
++
++enum {
++	NPU_OP_SET = 1,
++	NPU_OP_SET_NO_WAIT,
++	NPU_OP_GET,
++	NPU_OP_GET_NO_WAIT,
++};
++
++enum {
++	NPU_FUNC_WIFI,
++	NPU_FUNC_TUNNEL,
++	NPU_FUNC_NOTIFY,
++	NPU_FUNC_DBA,
++	NPU_FUNC_TR471,
++	NPU_FUNC_PPE,
++};
++
++enum {
++	NPU_MBOX_ERROR,
++	NPU_MBOX_SUCCESS,
++};
++
++enum {
++	PPE_FUNC_SET_WAIT,
++	PPE_FUNC_SET_WAIT_HWNAT_INIT,
++	PPE_FUNC_SET_WAIT_HWNAT_DEINIT,
++	PPE_FUNC_SET_WAIT_API,
++};
++
++enum {
++	PPE2_SRAM_SET_ENTRY,
++	PPE_SRAM_SET_ENTRY,
++	PPE_SRAM_SET_VAL,
++	PPE_SRAM_RESET_VAL,
++};
++
++enum {
++	QDMA_WAN_ETHER = 1,
++	QDMA_WAN_PON_XDSL,
++};
++
++#define MBOX_MSG_FUNC_ID	GENMASK(14, 11)
++#define MBOX_MSG_STATIC_BUF	BIT(5)
++#define MBOX_MSG_STATUS		GENMASK(4, 2)
++#define MBOX_MSG_DONE		BIT(1)
++#define MBOX_MSG_WAIT_RSP	BIT(0)
++
++#define PPE_TYPE_L2B_IPV4	2
++#define PPE_TYPE_L2B_IPV4_IPV6	3
++
++struct ppe_mbox_data {
++	u32 func_type;
++	u32 func_id;
++	union {
++		struct {
++			u8 cds;
++			u8 xpon_hal_api;
++			u8 wan_xsi;
++			u8 ct_joyme4;
++			int ppe_type;
++			int wan_mode;
++			int wan_sel;
++		} init_info;
++		struct {
++			int func_id;
++			u32 size;
++			u32 data;
++		} set_info;
++	};
++};
++
++static int airoha_npu_send_msg(struct airoha_npu *npu, int func_id,
++			       void *p, int size)
++{
++	u16 core = 0; /* FIXME */
++	u32 val, offset = core << 4;
++	dma_addr_t dma_addr;
++	void *addr;
++	int ret;
++
++	addr = kmemdup(p, size, GFP_ATOMIC);
++	if (!addr)
++		return -ENOMEM;
++
++	dma_addr = dma_map_single(npu->dev, addr, size, DMA_TO_DEVICE);
++	ret = dma_mapping_error(npu->dev, dma_addr);
++	if (ret)
++		goto out;
++
++	spin_lock_bh(&npu->cores[core].lock);
++
++	regmap_write(npu->regmap, REG_CR_MBQ0_CTRL(0) + offset, dma_addr);
++	regmap_write(npu->regmap, REG_CR_MBQ0_CTRL(1) + offset, size);
++	regmap_read(npu->regmap, REG_CR_MBQ0_CTRL(2) + offset, &val);
++	regmap_write(npu->regmap, REG_CR_MBQ0_CTRL(2) + offset, val + 1);
++	val = FIELD_PREP(MBOX_MSG_FUNC_ID, func_id) | MBOX_MSG_WAIT_RSP;
++	regmap_write(npu->regmap, REG_CR_MBQ0_CTRL(3) + offset, val);
++
++	ret = regmap_read_poll_timeout_atomic(npu->regmap,
++					      REG_CR_MBQ0_CTRL(3) + offset,
++					      val, (val & MBOX_MSG_DONE),
++					      100, 100 * MSEC_PER_SEC);
++	if (!ret && FIELD_GET(MBOX_MSG_STATUS, val) != NPU_MBOX_SUCCESS)
++		ret = -EINVAL;
++
++	spin_unlock_bh(&npu->cores[core].lock);
++
++	dma_unmap_single(npu->dev, dma_addr, size, DMA_TO_DEVICE);
++out:
++	kfree(addr);
++
++	return ret;
++}
++
++static int airoha_npu_run_firmware(struct device *dev, void __iomem *base,
++				   struct reserved_mem *rmem)
++{
++	const struct firmware *fw;
++	void __iomem *addr;
++	int ret;
++
++	ret = request_firmware(&fw, NPU_EN7581_FIRMWARE_RV32, dev);
++	if (ret)
++		return ret == -ENOENT ? -EPROBE_DEFER : ret;
++
++	if (fw->size > NPU_EN7581_FIRMWARE_RV32_MAX_SIZE) {
++		dev_err(dev, "%s: fw size too overlimit (%zu)\n",
++			NPU_EN7581_FIRMWARE_RV32, fw->size);
++		ret = -E2BIG;
++		goto out;
++	}
++
++	addr = devm_ioremap(dev, rmem->base, rmem->size);
++	if (!addr) {
++		ret = -ENOMEM;
++		goto out;
++	}
++
++	memcpy_toio(addr, fw->data, fw->size);
++	release_firmware(fw);
++
++	ret = request_firmware(&fw, NPU_EN7581_FIRMWARE_DATA, dev);
++	if (ret)
++		return ret == -ENOENT ? -EPROBE_DEFER : ret;
++
++	if (fw->size > NPU_EN7581_FIRMWARE_DATA_MAX_SIZE) {
++		dev_err(dev, "%s: fw size too overlimit (%zu)\n",
++			NPU_EN7581_FIRMWARE_DATA, fw->size);
++		ret = -E2BIG;
++		goto out;
++	}
++
++	memcpy_toio(base + REG_NPU_LOCAL_SRAM, fw->data, fw->size);
++out:
++	release_firmware(fw);
++
++	return ret;
++}
++
++static irqreturn_t airoha_npu_mbox_handler(int irq, void *npu_instance)
++{
++	struct airoha_npu *npu = npu_instance;
++
++	/* clear mbox interrupt status */
++	regmap_write(npu->regmap, REG_CR_MBOX_INT_STATUS,
++		     MBOX_INT_STATUS_MASK);
++
++	/* acknowledge npu */
++	regmap_update_bits(npu->regmap, REG_CR_MBQ8_CTRL(3),
++			   MBOX_MSG_STATUS | MBOX_MSG_DONE, MBOX_MSG_DONE);
++
++	return IRQ_HANDLED;
++}
++
++static void airoha_npu_wdt_work(struct work_struct *work)
++{
++	struct airoha_npu_core *core;
++	struct airoha_npu *npu;
++	void *dump;
++	u32 val[3];
++	int c;
++
++	core = container_of(work, struct airoha_npu_core, wdt_work);
++	npu = core->npu;
++
++	dump = vzalloc(NPU_DUMP_SIZE);
++	if (!dump)
++		return;
++
++	c = core - &npu->cores[0];
++	regmap_bulk_read(npu->regmap, REG_PC_DBG(c), val, ARRAY_SIZE(val));
++	snprintf(dump, NPU_DUMP_SIZE, "PC: %08x SP: %08x LR: %08x\n",
++		 val[0], val[1], val[2]);
++
++	dev_coredumpv(npu->dev, dump, NPU_DUMP_SIZE, GFP_KERNEL);
++}
++
++static irqreturn_t airoha_npu_wdt_handler(int irq, void *core_instance)
++{
++	struct airoha_npu_core *core = core_instance;
++	struct airoha_npu *npu = core->npu;
++	int c = core - &npu->cores[0];
++	u32 val;
++
++	regmap_set_bits(npu->regmap, REG_WDT_TIMER_CTRL(c), WDT_INTR_MASK);
++	if (!regmap_read(npu->regmap, REG_WDT_TIMER_CTRL(c), &val) &&
++	    FIELD_GET(WDT_EN_MASK, val))
++		schedule_work(&core->wdt_work);
++
++	return IRQ_HANDLED;
++}
++
++static int airoha_npu_ppe_init(struct airoha_npu *npu)
++{
++	struct ppe_mbox_data ppe_data = {
++		.func_type = NPU_OP_SET,
++		.func_id = PPE_FUNC_SET_WAIT_HWNAT_INIT,
++		.init_info = {
++			.ppe_type = PPE_TYPE_L2B_IPV4_IPV6,
++			.wan_mode = QDMA_WAN_ETHER,
++		},
++	};
++
++	return airoha_npu_send_msg(npu, NPU_FUNC_PPE, &ppe_data,
++				   sizeof(struct ppe_mbox_data));
++}
++
++static int airoha_npu_ppe_deinit(struct airoha_npu *npu)
++{
++	struct ppe_mbox_data ppe_data = {
++		.func_type = NPU_OP_SET,
++		.func_id = PPE_FUNC_SET_WAIT_HWNAT_DEINIT,
++	};
++
++	return airoha_npu_send_msg(npu, NPU_FUNC_PPE, &ppe_data,
++				   sizeof(struct ppe_mbox_data));
++}
++
++static int airoha_npu_ppe_flush_sram_entries(struct airoha_npu *npu,
++					     dma_addr_t foe_addr,
++					     int sram_num_entries)
++{
++	struct ppe_mbox_data ppe_data = {
++		.func_type = NPU_OP_SET,
++		.func_id = PPE_FUNC_SET_WAIT_API,
++		.set_info = {
++			.func_id = PPE_SRAM_RESET_VAL,
++			.data = foe_addr,
++			.size = sram_num_entries,
++		},
++	};
++
++	return airoha_npu_send_msg(npu, NPU_FUNC_PPE, &ppe_data,
++				   sizeof(struct ppe_mbox_data));
++}
++
++static int airoha_npu_foe_commit_entry(struct airoha_npu *npu,
++				       dma_addr_t foe_addr,
++				       u32 entry_size, u32 hash, bool ppe2)
++{
++	struct ppe_mbox_data ppe_data = {
++		.func_type = NPU_OP_SET,
++		.func_id = PPE_FUNC_SET_WAIT_API,
++		.set_info = {
++			.data = foe_addr,
++			.size = entry_size,
++		},
++	};
++	int err;
++
++	ppe_data.set_info.func_id = ppe2 ? PPE2_SRAM_SET_ENTRY
++					 : PPE_SRAM_SET_ENTRY;
++
++	err = airoha_npu_send_msg(npu, NPU_FUNC_PPE, &ppe_data,
++				  sizeof(struct ppe_mbox_data));
++	if (err)
++		return err;
++
++	ppe_data.set_info.func_id = PPE_SRAM_SET_VAL;
++	ppe_data.set_info.data = hash;
++	ppe_data.set_info.size = sizeof(u32);
++
++	return airoha_npu_send_msg(npu, NPU_FUNC_PPE, &ppe_data,
++				   sizeof(struct ppe_mbox_data));
++}
++
++struct airoha_npu *airoha_npu_get(struct device *dev)
++{
++	struct platform_device *pdev;
++	struct device_node *np;
++	struct airoha_npu *npu;
++
++	np = of_parse_phandle(dev->of_node, "airoha,npu", 0);
++	if (!np)
++		return ERR_PTR(-ENODEV);
++
++	pdev = of_find_device_by_node(np);
++	of_node_put(np);
++
++	if (!pdev) {
++		dev_err(dev, "cannot find device node %s\n", np->name);
++		return ERR_PTR(-ENODEV);
++	}
++
++	if (!try_module_get(THIS_MODULE)) {
++		dev_err(dev, "failed to get the device driver module\n");
++		npu = ERR_PTR(-ENODEV);
++		goto error_pdev_put;
++	}
++
++	npu = platform_get_drvdata(pdev);
++	if (!npu) {
++		npu = ERR_PTR(-ENODEV);
++		goto error_module_put;
++	}
++
++	if (!device_link_add(dev, &pdev->dev, DL_FLAG_AUTOREMOVE_SUPPLIER)) {
++		dev_err(&pdev->dev,
++			"failed to create device link to consumer %s\n",
++			dev_name(dev));
++		npu = ERR_PTR(-EINVAL);
++		goto error_module_put;
++	}
++
++	return npu;
++
++error_module_put:
++	module_put(THIS_MODULE);
++error_pdev_put:
++	platform_device_put(pdev);
++
++	return npu;
++}
++EXPORT_SYMBOL_GPL(airoha_npu_get);
++
++void airoha_npu_put(struct airoha_npu *npu)
++{
++	module_put(THIS_MODULE);
++	put_device(npu->dev);
++}
++EXPORT_SYMBOL_GPL(airoha_npu_put);
++
++static const struct of_device_id of_airoha_npu_match[] = {
++	{ .compatible = "airoha,en7581-npu" },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, of_airoha_npu_match);
++
++static const struct regmap_config regmap_config = {
++	.name			= "npu",
++	.reg_bits		= 32,
++	.val_bits		= 32,
++	.reg_stride		= 4,
++	.disable_locking	= true,
++};
++
++static int airoha_npu_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct reserved_mem *rmem;
++	struct airoha_npu *npu;
++	struct device_node *np;
++	void __iomem *base;
++	int i, irq, err;
++
++	base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(base))
++		return PTR_ERR(base);
++
++	npu = devm_kzalloc(dev, sizeof(*npu), GFP_KERNEL);
++	if (!npu)
++		return -ENOMEM;
++
++	npu->dev = dev;
++	npu->ops.ppe_init = airoha_npu_ppe_init;
++	npu->ops.ppe_deinit = airoha_npu_ppe_deinit;
++	npu->ops.ppe_flush_sram_entries = airoha_npu_ppe_flush_sram_entries;
++	npu->ops.ppe_foe_commit_entry = airoha_npu_foe_commit_entry;
++
++	npu->regmap = devm_regmap_init_mmio(dev, base, &regmap_config);
++	if (IS_ERR(npu->regmap))
++		return PTR_ERR(npu->regmap);
++
++	np = of_parse_phandle(dev->of_node, "memory-region", 0);
++	if (!np)
++		return -ENODEV;
++
++	rmem = of_reserved_mem_lookup(np);
++	of_node_put(np);
++
++	if (!rmem)
++		return -ENODEV;
++
++	irq = platform_get_irq(pdev, 0);
++	if (irq < 0)
++		return irq;
++
++	err = devm_request_irq(dev, irq, airoha_npu_mbox_handler,
++			       IRQF_SHARED, "airoha-npu-mbox", npu);
++	if (err)
++		return err;
++
++	for (i = 0; i < ARRAY_SIZE(npu->cores); i++) {
++		struct airoha_npu_core *core = &npu->cores[i];
++
++		spin_lock_init(&core->lock);
++		core->npu = npu;
++
++		irq = platform_get_irq(pdev, i + 1);
++		if (irq < 0)
++			return irq;
++
++		err = devm_request_irq(dev, irq, airoha_npu_wdt_handler,
++				       IRQF_SHARED, "airoha-npu-wdt", core);
++		if (err)
++			return err;
++
++		INIT_WORK(&core->wdt_work, airoha_npu_wdt_work);
++	}
++
++	err = dma_set_coherent_mask(dev, DMA_BIT_MASK(32));
++	if (err)
++		return err;
++
++	err = airoha_npu_run_firmware(dev, base, rmem);
++	if (err)
++		return dev_err_probe(dev, err, "failed to run npu firmware\n");
++
++	regmap_write(npu->regmap, REG_CR_NPU_MIB(10),
++		     rmem->base + NPU_EN7581_FIRMWARE_RV32_MAX_SIZE);
++	regmap_write(npu->regmap, REG_CR_NPU_MIB(11), 0x40000); /* SRAM 256K */
++	regmap_write(npu->regmap, REG_CR_NPU_MIB(12), 0);
++	regmap_write(npu->regmap, REG_CR_NPU_MIB(21), 1);
++	msleep(100);
++
++	/* setting booting address */
++	for (i = 0; i < NPU_NUM_CORES; i++)
++		regmap_write(npu->regmap, REG_CR_BOOT_BASE(i), rmem->base);
++	usleep_range(1000, 2000);
++
++	/* enable NPU cores */
++	/* do not start core3 since it is used for WiFi offloading */
++	regmap_write(npu->regmap, REG_CR_BOOT_CONFIG, 0xf7);
++	regmap_write(npu->regmap, REG_CR_BOOT_TRIGGER, 0x1);
++	msleep(100);
++
++	platform_set_drvdata(pdev, npu);
++
++	return 0;
++}
++
++static void airoha_npu_remove(struct platform_device *pdev)
++{
++	struct airoha_npu *npu = platform_get_drvdata(pdev);
++	int i;
++
++	for (i = 0; i < ARRAY_SIZE(npu->cores); i++)
++		cancel_work_sync(&npu->cores[i].wdt_work);
++}
++
++static struct platform_driver airoha_npu_driver = {
++	.probe = airoha_npu_probe,
++	.remove_new = airoha_npu_remove,
++	.driver = {
++		.name = "airoha-npu",
++		.of_match_table = of_airoha_npu_match,
++	},
++};
++module_platform_driver(airoha_npu_driver);
++
++MODULE_LICENSE("GPL");
++MODULE_AUTHOR("Lorenzo Bianconi <lorenzo@kernel.org>");
++MODULE_DESCRIPTION("Airoha Network Processor Unit driver");
+--- /dev/null
++++ b/drivers/net/ethernet/airoha/airoha_npu.h
+@@ -0,0 +1,34 @@
++/* SPDX-License-Identifier: GPL-2.0-only */
++/*
++ * Copyright (c) 2025 AIROHA Inc
++ * Author: Lorenzo Bianconi <lorenzo@kernel.org>
++ */
++
++#define NPU_NUM_CORES		8
++
++struct airoha_npu {
++	struct device *dev;
++	struct regmap *regmap;
++
++	struct airoha_npu_core {
++		struct airoha_npu *npu;
++		/* protect concurrent npu memory accesses */
++		spinlock_t lock;
++		struct work_struct wdt_work;
++	} cores[NPU_NUM_CORES];
++
++	struct {
++		int (*ppe_init)(struct airoha_npu *npu);
++		int (*ppe_deinit)(struct airoha_npu *npu);
++		int (*ppe_flush_sram_entries)(struct airoha_npu *npu,
++					      dma_addr_t foe_addr,
++					      int sram_num_entries);
++		int (*ppe_foe_commit_entry)(struct airoha_npu *npu,
++					    dma_addr_t foe_addr,
++					    u32 entry_size, u32 hash,
++					    bool ppe2);
++	} ops;
++};
++
++struct airoha_npu *airoha_npu_get(struct device *dev);
++void airoha_npu_put(struct airoha_npu *npu);
diff --git a/target/linux/airoha/patches-6.6/048-13-v6.15-net-airoha-Introduce-flowtable-offload-support.patch b/target/linux/airoha/patches-6.6/048-13-v6.15-net-airoha-Introduce-flowtable-offload-support.patch
new file mode 100644
index 00000000000000..225165fca5ab39
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/048-13-v6.15-net-airoha-Introduce-flowtable-offload-support.patch
@@ -0,0 +1,1481 @@
+From 00a7678310fe3d3f408513e55d9a0b67f0db380f Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 28 Feb 2025 11:54:21 +0100
+Subject: [PATCH 13/15] net: airoha: Introduce flowtable offload support
+
+Introduce netfilter flowtable integration in order to allow airoha_eth
+driver to offload 5-tuple flower rules learned by the PPE module if the
+user accelerates them using a nft configuration similar to the one reported
+below:
+
+table inet filter {
+	flowtable ft {
+		hook ingress priority filter
+		devices = { lan1, lan2, lan3, lan4, eth1 }
+		flags offload;
+	}
+	chain forward {
+		type filter hook forward priority filter; policy accept;
+		meta l4proto { tcp, udp } flow add @ft
+	}
+}
+
+Tested-by: Sayantan Nandy <sayantan.nandy@airoha.com>
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/airoha/Makefile      |   3 +-
+ drivers/net/ethernet/airoha/airoha_eth.c  |  60 +-
+ drivers/net/ethernet/airoha/airoha_eth.h  | 250 ++++++
+ drivers/net/ethernet/airoha/airoha_ppe.c  | 901 ++++++++++++++++++++++
+ drivers/net/ethernet/airoha/airoha_regs.h | 107 ++-
+ 5 files changed, 1314 insertions(+), 7 deletions(-)
+ create mode 100644 drivers/net/ethernet/airoha/airoha_ppe.c
+
+--- a/drivers/net/ethernet/airoha/Makefile
++++ b/drivers/net/ethernet/airoha/Makefile
+@@ -3,5 +3,6 @@
+ # Airoha for the Mediatek SoCs built-in ethernet macs
+ #
+ 
+-obj-$(CONFIG_NET_AIROHA) += airoha_eth.o
++obj-$(CONFIG_NET_AIROHA) += airoha-eth.o
++airoha-eth-y := airoha_eth.o airoha_ppe.o
+ obj-$(CONFIG_NET_AIROHA_NPU) += airoha_npu.o
+--- a/drivers/net/ethernet/airoha/airoha_eth.c
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -8,7 +8,6 @@
+ #include <linux/platform_device.h>
+ #include <linux/tcp.h>
+ #include <linux/u64_stats_sync.h>
+-#include <net/dsa.h>
+ #include <net/dst_metadata.h>
+ #include <net/page_pool/helpers.h>
+ #include <net/pkt_cls.h>
+@@ -619,6 +618,7 @@ static int airoha_qdma_rx_process(struct
+ 	while (done < budget) {
+ 		struct airoha_queue_entry *e = &q->entry[q->tail];
+ 		struct airoha_qdma_desc *desc = &q->desc[q->tail];
++		u32 hash, reason, msg1 = le32_to_cpu(desc->msg1);
+ 		dma_addr_t dma_addr = le32_to_cpu(desc->addr);
+ 		u32 desc_ctrl = le32_to_cpu(desc->ctrl);
+ 		struct airoha_gdm_port *port;
+@@ -681,6 +681,15 @@ static int airoha_qdma_rx_process(struct
+ 						  &port->dsa_meta[sptag]->dst);
+ 		}
+ 
++		hash = FIELD_GET(AIROHA_RXD4_FOE_ENTRY, msg1);
++		if (hash != AIROHA_RXD4_FOE_ENTRY)
++			skb_set_hash(skb, jhash_1word(hash, 0),
++				     PKT_HASH_TYPE_L4);
++
++		reason = FIELD_GET(AIROHA_RXD4_PPE_CPU_REASON, msg1);
++		if (reason == PPE_CPU_REASON_HIT_UNBIND_RATE_REACHED)
++			airoha_ppe_check_skb(eth->ppe, hash);
++
+ 		napi_gro_receive(&q->napi, skb);
+ 
+ 		done++;
+@@ -1302,6 +1311,10 @@ static int airoha_hw_init(struct platfor
+ 			return err;
+ 	}
+ 
++	err = airoha_ppe_init(eth);
++	if (err)
++		return err;
++
+ 	set_bit(DEV_STATE_INITIALIZED, &eth->state);
+ 
+ 	return 0;
+@@ -2166,6 +2179,47 @@ static int airoha_tc_htb_alloc_leaf_queu
+ 	return 0;
+ }
+ 
++static int airoha_dev_setup_tc_block(struct airoha_gdm_port *port,
++				     struct flow_block_offload *f)
++{
++	flow_setup_cb_t *cb = airoha_ppe_setup_tc_block_cb;
++	static LIST_HEAD(block_cb_list);
++	struct flow_block_cb *block_cb;
++
++	if (f->binder_type != FLOW_BLOCK_BINDER_TYPE_CLSACT_INGRESS)
++		return -EOPNOTSUPP;
++
++	f->driver_block_list = &block_cb_list;
++	switch (f->command) {
++	case FLOW_BLOCK_BIND:
++		block_cb = flow_block_cb_lookup(f->block, cb, port->dev);
++		if (block_cb) {
++			flow_block_cb_incref(block_cb);
++			return 0;
++		}
++		block_cb = flow_block_cb_alloc(cb, port->dev, port->dev, NULL);
++		if (IS_ERR(block_cb))
++			return PTR_ERR(block_cb);
++
++		flow_block_cb_incref(block_cb);
++		flow_block_cb_add(block_cb, f);
++		list_add_tail(&block_cb->driver_list, &block_cb_list);
++		return 0;
++	case FLOW_BLOCK_UNBIND:
++		block_cb = flow_block_cb_lookup(f->block, cb, port->dev);
++		if (!block_cb)
++			return -ENOENT;
++
++		if (!flow_block_cb_decref(block_cb)) {
++			flow_block_cb_remove(block_cb, f);
++			list_del(&block_cb->driver_list);
++		}
++		return 0;
++	default:
++		return -EOPNOTSUPP;
++	}
++}
++
+ static void airoha_tc_remove_htb_queue(struct airoha_gdm_port *port, int queue)
+ {
+ 	struct net_device *dev = port->dev;
+@@ -2249,6 +2303,9 @@ static int airoha_dev_tc_setup(struct ne
+ 		return airoha_tc_setup_qdisc_ets(port, type_data);
+ 	case TC_SETUP_QDISC_HTB:
+ 		return airoha_tc_setup_qdisc_htb(port, type_data);
++	case TC_SETUP_BLOCK:
++	case TC_SETUP_FT:
++		return airoha_dev_setup_tc_block(port, type_data);
+ 	default:
+ 		return -EOPNOTSUPP;
+ 	}
+@@ -2505,6 +2562,7 @@ static void airoha_remove(struct platfor
+ 	}
+ 	free_netdev(eth->napi_dev);
+ 
++	airoha_ppe_deinit(eth);
+ 	platform_set_drvdata(pdev, NULL);
+ }
+ 
+--- a/drivers/net/ethernet/airoha/airoha_eth.h
++++ b/drivers/net/ethernet/airoha/airoha_eth.h
+@@ -12,6 +12,7 @@
+ #include <linux/kernel.h>
+ #include <linux/netdevice.h>
+ #include <linux/reset.h>
++#include <net/dsa.h>
+ 
+ #define AIROHA_MAX_NUM_GDM_PORTS	4
+ #define AIROHA_MAX_NUM_QDMA		2
+@@ -44,6 +45,15 @@
+ #define QDMA_METER_IDX(_n)		((_n) & 0xff)
+ #define QDMA_METER_GROUP(_n)		(((_n) >> 8) & 0x3)
+ 
++#define PPE_NUM				2
++#define PPE1_SRAM_NUM_ENTRIES		(8 * 1024)
++#define PPE_SRAM_NUM_ENTRIES		(2 * PPE1_SRAM_NUM_ENTRIES)
++#define PPE_DRAM_NUM_ENTRIES		(16 * 1024)
++#define PPE_NUM_ENTRIES			(PPE_SRAM_NUM_ENTRIES + PPE_DRAM_NUM_ENTRIES)
++#define PPE_HASH_MASK			(PPE_NUM_ENTRIES - 1)
++#define PPE_ENTRY_SIZE			80
++#define PPE_RAM_NUM_ENTRIES_SHIFT(_n)	(__ffs((_n) >> 10))
++
+ #define MTK_HDR_LEN			4
+ #define MTK_HDR_XMIT_TAGGED_TPID_8100	1
+ #define MTK_HDR_XMIT_TAGGED_TPID_88A8	2
+@@ -195,6 +205,224 @@ struct airoha_hw_stats {
+ 	u64 rx_len[7];
+ };
+ 
++enum {
++	PPE_CPU_REASON_HIT_UNBIND_RATE_REACHED = 0x0f,
++};
++
++enum {
++	AIROHA_FOE_STATE_INVALID,
++	AIROHA_FOE_STATE_UNBIND,
++	AIROHA_FOE_STATE_BIND,
++	AIROHA_FOE_STATE_FIN
++};
++
++enum {
++	PPE_PKT_TYPE_IPV4_HNAPT = 0,
++	PPE_PKT_TYPE_IPV4_ROUTE = 1,
++	PPE_PKT_TYPE_BRIDGE = 2,
++	PPE_PKT_TYPE_IPV4_DSLITE = 3,
++	PPE_PKT_TYPE_IPV6_ROUTE_3T = 4,
++	PPE_PKT_TYPE_IPV6_ROUTE_5T = 5,
++	PPE_PKT_TYPE_IPV6_6RD = 7,
++};
++
++#define AIROHA_FOE_MAC_SMAC_ID		GENMASK(20, 16)
++#define AIROHA_FOE_MAC_PPPOE_ID		GENMASK(15, 0)
++
++struct airoha_foe_mac_info_common {
++	u16 vlan1;
++	u16 etype;
++
++	u32 dest_mac_hi;
++
++	u16 vlan2;
++	u16 dest_mac_lo;
++
++	u32 src_mac_hi;
++};
++
++struct airoha_foe_mac_info {
++	struct airoha_foe_mac_info_common common;
++
++	u16 pppoe_id;
++	u16 src_mac_lo;
++};
++
++#define AIROHA_FOE_IB1_UNBIND_PREBIND		BIT(24)
++#define AIROHA_FOE_IB1_UNBIND_PACKETS		GENMASK(23, 8)
++#define AIROHA_FOE_IB1_UNBIND_TIMESTAMP		GENMASK(7, 0)
++
++#define AIROHA_FOE_IB1_BIND_STATIC		BIT(31)
++#define AIROHA_FOE_IB1_BIND_UDP			BIT(30)
++#define AIROHA_FOE_IB1_BIND_STATE		GENMASK(29, 28)
++#define AIROHA_FOE_IB1_BIND_PACKET_TYPE		GENMASK(27, 25)
++#define AIROHA_FOE_IB1_BIND_TTL			BIT(24)
++#define AIROHA_FOE_IB1_BIND_TUNNEL_DECAP	BIT(23)
++#define AIROHA_FOE_IB1_BIND_PPPOE		BIT(22)
++#define AIROHA_FOE_IB1_BIND_VPM			GENMASK(21, 20)
++#define AIROHA_FOE_IB1_BIND_VLAN_LAYER		GENMASK(19, 16)
++#define AIROHA_FOE_IB1_BIND_KEEPALIVE		BIT(15)
++#define AIROHA_FOE_IB1_BIND_TIMESTAMP		GENMASK(14, 0)
++
++#define AIROHA_FOE_IB2_DSCP			GENMASK(31, 24)
++#define AIROHA_FOE_IB2_PORT_AG			GENMASK(23, 13)
++#define AIROHA_FOE_IB2_PCP			BIT(12)
++#define AIROHA_FOE_IB2_MULTICAST		BIT(11)
++#define AIROHA_FOE_IB2_FAST_PATH		BIT(10)
++#define AIROHA_FOE_IB2_PSE_QOS			BIT(9)
++#define AIROHA_FOE_IB2_PSE_PORT			GENMASK(8, 5)
++#define AIROHA_FOE_IB2_NBQ			GENMASK(4, 0)
++
++#define AIROHA_FOE_ACTDP			GENMASK(31, 24)
++#define AIROHA_FOE_SHAPER_ID			GENMASK(23, 16)
++#define AIROHA_FOE_CHANNEL			GENMASK(15, 11)
++#define AIROHA_FOE_QID				GENMASK(10, 8)
++#define AIROHA_FOE_DPI				BIT(7)
++#define AIROHA_FOE_TUNNEL			BIT(6)
++#define AIROHA_FOE_TUNNEL_ID			GENMASK(5, 0)
++
++struct airoha_foe_bridge {
++	u32 dest_mac_hi;
++
++	u16 src_mac_hi;
++	u16 dest_mac_lo;
++
++	u32 src_mac_lo;
++
++	u32 ib2;
++
++	u32 rsv[5];
++
++	u32 data;
++
++	struct airoha_foe_mac_info l2;
++};
++
++struct airoha_foe_ipv4_tuple {
++	u32 src_ip;
++	u32 dest_ip;
++	union {
++		struct {
++			u16 dest_port;
++			u16 src_port;
++		};
++		struct {
++			u8 protocol;
++			u8 _pad[3]; /* fill with 0xa5a5a5 */
++		};
++		u32 ports;
++	};
++};
++
++struct airoha_foe_ipv4 {
++	struct airoha_foe_ipv4_tuple orig_tuple;
++
++	u32 ib2;
++
++	struct airoha_foe_ipv4_tuple new_tuple;
++
++	u32 rsv[2];
++
++	u32 data;
++
++	struct airoha_foe_mac_info l2;
++};
++
++struct airoha_foe_ipv4_dslite {
++	struct airoha_foe_ipv4_tuple ip4;
++
++	u32 ib2;
++
++	u8 flow_label[3];
++	u8 priority;
++
++	u32 rsv[4];
++
++	u32 data;
++
++	struct airoha_foe_mac_info l2;
++};
++
++struct airoha_foe_ipv6 {
++	u32 src_ip[4];
++	u32 dest_ip[4];
++
++	union {
++		struct {
++			u16 dest_port;
++			u16 src_port;
++		};
++		struct {
++			u8 protocol;
++			u8 pad[3];
++		};
++		u32 ports;
++	};
++
++	u32 data;
++
++	u32 ib2;
++
++	struct airoha_foe_mac_info_common l2;
++};
++
++struct airoha_foe_entry {
++	union {
++		struct {
++			u32 ib1;
++			union {
++				struct airoha_foe_bridge bridge;
++				struct airoha_foe_ipv4 ipv4;
++				struct airoha_foe_ipv4_dslite dslite;
++				struct airoha_foe_ipv6 ipv6;
++				DECLARE_FLEX_ARRAY(u32, d);
++			};
++		};
++		u8 data[PPE_ENTRY_SIZE];
++	};
++};
++
++struct airoha_flow_data {
++	struct ethhdr eth;
++
++	union {
++		struct {
++			__be32 src_addr;
++			__be32 dst_addr;
++		} v4;
++
++		struct {
++			struct in6_addr src_addr;
++			struct in6_addr dst_addr;
++		} v6;
++	};
++
++	__be16 src_port;
++	__be16 dst_port;
++
++	struct {
++		struct {
++			u16 id;
++			__be16 proto;
++		} hdr[2];
++		u8 num;
++	} vlan;
++	struct {
++		u16 sid;
++		u8 num;
++	} pppoe;
++};
++
++struct airoha_flow_table_entry {
++	struct hlist_node list;
++
++	struct airoha_foe_entry data;
++	u32 hash;
++
++	struct rhash_head node;
++	unsigned long cookie;
++};
++
+ struct airoha_qdma {
+ 	struct airoha_eth *eth;
+ 	void __iomem *regs;
+@@ -234,6 +462,19 @@ struct airoha_gdm_port {
+ 	struct metadata_dst *dsa_meta[AIROHA_MAX_DSA_PORTS];
+ };
+ 
++#define AIROHA_RXD4_PPE_CPU_REASON	GENMASK(20, 16)
++#define AIROHA_RXD4_FOE_ENTRY		GENMASK(15, 0)
++
++struct airoha_ppe {
++	struct airoha_eth *eth;
++
++	void *foe;
++	dma_addr_t foe_dma;
++
++	struct hlist_head *foe_flow;
++	u16 foe_check_time[PPE_NUM_ENTRIES];
++};
++
+ struct airoha_eth {
+ 	struct device *dev;
+ 
+@@ -242,6 +483,9 @@ struct airoha_eth {
+ 
+ 	struct airoha_npu __rcu *npu;
+ 
++	struct airoha_ppe *ppe;
++	struct rhashtable flow_table;
++
+ 	struct reset_control_bulk_data rsts[AIROHA_MAX_NUM_RSTS];
+ 	struct reset_control_bulk_data xsi_rsts[AIROHA_MAX_NUM_XSI_RSTS];
+ 
+@@ -277,4 +521,10 @@ u32 airoha_rmw(void __iomem *base, u32 o
+ #define airoha_qdma_clear(qdma, offset, val)			\
+ 	airoha_rmw((qdma)->regs, (offset), (val), 0)
+ 
++void airoha_ppe_check_skb(struct airoha_ppe *ppe, u16 hash);
++int airoha_ppe_setup_tc_block_cb(enum tc_setup_type type, void *type_data,
++				 void *cb_priv);
++int airoha_ppe_init(struct airoha_eth *eth);
++void airoha_ppe_deinit(struct airoha_eth *eth);
++
+ #endif /* AIROHA_ETH_H */
+--- /dev/null
++++ b/drivers/net/ethernet/airoha/airoha_ppe.c
+@@ -0,0 +1,901 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Copyright (c) 2025 AIROHA Inc
++ * Author: Lorenzo Bianconi <lorenzo@kernel.org>
++ */
++
++#include <linux/ip.h>
++#include <linux/ipv6.h>
++#include <linux/rhashtable.h>
++#include <net/ipv6.h>
++#include <net/pkt_cls.h>
++
++#include "airoha_npu.h"
++#include "airoha_regs.h"
++#include "airoha_eth.h"
++
++static DEFINE_MUTEX(flow_offload_mutex);
++static DEFINE_SPINLOCK(ppe_lock);
++
++static const struct rhashtable_params airoha_flow_table_params = {
++	.head_offset = offsetof(struct airoha_flow_table_entry, node),
++	.key_offset = offsetof(struct airoha_flow_table_entry, cookie),
++	.key_len = sizeof(unsigned long),
++	.automatic_shrinking = true,
++};
++
++static bool airoha_ppe2_is_enabled(struct airoha_eth *eth)
++{
++	return airoha_fe_rr(eth, REG_PPE_GLO_CFG(1)) & PPE_GLO_CFG_EN_MASK;
++}
++
++static u32 airoha_ppe_get_timestamp(struct airoha_ppe *ppe)
++{
++	u16 timestamp = airoha_fe_rr(ppe->eth, REG_FE_FOE_TS);
++
++	return FIELD_GET(AIROHA_FOE_IB1_BIND_TIMESTAMP, timestamp);
++}
++
++static void airoha_ppe_hw_init(struct airoha_ppe *ppe)
++{
++	u32 sram_tb_size, sram_num_entries, dram_num_entries;
++	struct airoha_eth *eth = ppe->eth;
++	int i;
++
++	sram_tb_size = PPE_SRAM_NUM_ENTRIES * sizeof(struct airoha_foe_entry);
++	dram_num_entries = PPE_RAM_NUM_ENTRIES_SHIFT(PPE_DRAM_NUM_ENTRIES);
++
++	for (i = 0; i < PPE_NUM; i++) {
++		int p;
++
++		airoha_fe_wr(eth, REG_PPE_TB_BASE(i),
++			     ppe->foe_dma + sram_tb_size);
++
++		airoha_fe_rmw(eth, REG_PPE_BND_AGE0(i),
++			      PPE_BIND_AGE0_DELTA_NON_L4 |
++			      PPE_BIND_AGE0_DELTA_UDP,
++			      FIELD_PREP(PPE_BIND_AGE0_DELTA_NON_L4, 1) |
++			      FIELD_PREP(PPE_BIND_AGE0_DELTA_UDP, 12));
++		airoha_fe_rmw(eth, REG_PPE_BND_AGE1(i),
++			      PPE_BIND_AGE1_DELTA_TCP_FIN |
++			      PPE_BIND_AGE1_DELTA_TCP,
++			      FIELD_PREP(PPE_BIND_AGE1_DELTA_TCP_FIN, 1) |
++			      FIELD_PREP(PPE_BIND_AGE1_DELTA_TCP, 7));
++
++		airoha_fe_rmw(eth, REG_PPE_TB_HASH_CFG(i),
++			      PPE_SRAM_TABLE_EN_MASK |
++			      PPE_SRAM_HASH1_EN_MASK |
++			      PPE_DRAM_TABLE_EN_MASK |
++			      PPE_SRAM_HASH0_MODE_MASK |
++			      PPE_SRAM_HASH1_MODE_MASK |
++			      PPE_DRAM_HASH0_MODE_MASK |
++			      PPE_DRAM_HASH1_MODE_MASK,
++			      FIELD_PREP(PPE_SRAM_TABLE_EN_MASK, 1) |
++			      FIELD_PREP(PPE_SRAM_HASH1_EN_MASK, 1) |
++			      FIELD_PREP(PPE_SRAM_HASH1_MODE_MASK, 1) |
++			      FIELD_PREP(PPE_DRAM_HASH1_MODE_MASK, 3));
++
++		airoha_fe_rmw(eth, REG_PPE_TB_CFG(i),
++			      PPE_TB_CFG_SEARCH_MISS_MASK |
++			      PPE_TB_ENTRY_SIZE_MASK,
++			      FIELD_PREP(PPE_TB_CFG_SEARCH_MISS_MASK, 3) |
++			      FIELD_PREP(PPE_TB_ENTRY_SIZE_MASK, 0));
++
++		airoha_fe_wr(eth, REG_PPE_HASH_SEED(i), PPE_HASH_SEED);
++
++		for (p = 0; p < ARRAY_SIZE(eth->ports); p++)
++			airoha_fe_rmw(eth, REG_PPE_MTU(i, p),
++				      FP0_EGRESS_MTU_MASK |
++				      FP1_EGRESS_MTU_MASK,
++				      FIELD_PREP(FP0_EGRESS_MTU_MASK,
++						 AIROHA_MAX_MTU) |
++				      FIELD_PREP(FP1_EGRESS_MTU_MASK,
++						 AIROHA_MAX_MTU));
++	}
++
++	if (airoha_ppe2_is_enabled(eth)) {
++		sram_num_entries =
++			PPE_RAM_NUM_ENTRIES_SHIFT(PPE1_SRAM_NUM_ENTRIES);
++		airoha_fe_rmw(eth, REG_PPE_TB_CFG(0),
++			      PPE_SRAM_TB_NUM_ENTRY_MASK |
++			      PPE_DRAM_TB_NUM_ENTRY_MASK,
++			      FIELD_PREP(PPE_SRAM_TB_NUM_ENTRY_MASK,
++					 sram_num_entries) |
++			      FIELD_PREP(PPE_DRAM_TB_NUM_ENTRY_MASK,
++					 dram_num_entries));
++		airoha_fe_rmw(eth, REG_PPE_TB_CFG(1),
++			      PPE_SRAM_TB_NUM_ENTRY_MASK |
++			      PPE_DRAM_TB_NUM_ENTRY_MASK,
++			      FIELD_PREP(PPE_SRAM_TB_NUM_ENTRY_MASK,
++					 sram_num_entries) |
++			      FIELD_PREP(PPE_DRAM_TB_NUM_ENTRY_MASK,
++					 dram_num_entries));
++	} else {
++		sram_num_entries =
++			PPE_RAM_NUM_ENTRIES_SHIFT(PPE_SRAM_NUM_ENTRIES);
++		airoha_fe_rmw(eth, REG_PPE_TB_CFG(0),
++			      PPE_SRAM_TB_NUM_ENTRY_MASK |
++			      PPE_DRAM_TB_NUM_ENTRY_MASK,
++			      FIELD_PREP(PPE_SRAM_TB_NUM_ENTRY_MASK,
++					 sram_num_entries) |
++			      FIELD_PREP(PPE_DRAM_TB_NUM_ENTRY_MASK,
++					 dram_num_entries));
++	}
++}
++
++static void airoha_ppe_flow_mangle_eth(const struct flow_action_entry *act, void *eth)
++{
++	void *dest = eth + act->mangle.offset;
++	const void *src = &act->mangle.val;
++
++	if (act->mangle.offset > 8)
++		return;
++
++	if (act->mangle.mask == 0xffff) {
++		src += 2;
++		dest += 2;
++	}
++
++	memcpy(dest, src, act->mangle.mask ? 2 : 4);
++}
++
++static int airoha_ppe_flow_mangle_ports(const struct flow_action_entry *act,
++					struct airoha_flow_data *data)
++{
++	u32 val = be32_to_cpu((__force __be32)act->mangle.val);
++
++	switch (act->mangle.offset) {
++	case 0:
++		if ((__force __be32)act->mangle.mask == ~cpu_to_be32(0xffff))
++			data->dst_port = cpu_to_be16(val);
++		else
++			data->src_port = cpu_to_be16(val >> 16);
++		break;
++	case 2:
++		data->dst_port = cpu_to_be16(val);
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int airoha_ppe_flow_mangle_ipv4(const struct flow_action_entry *act,
++				       struct airoha_flow_data *data)
++{
++	__be32 *dest;
++
++	switch (act->mangle.offset) {
++	case offsetof(struct iphdr, saddr):
++		dest = &data->v4.src_addr;
++		break;
++	case offsetof(struct iphdr, daddr):
++		dest = &data->v4.dst_addr;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	memcpy(dest, &act->mangle.val, sizeof(u32));
++
++	return 0;
++}
++
++static int airoha_get_dsa_port(struct net_device **dev)
++{
++#if IS_ENABLED(CONFIG_NET_DSA)
++	struct dsa_port *dp = dsa_port_from_netdev(*dev);
++
++	if (IS_ERR(dp))
++		return -ENODEV;
++
++	*dev = dsa_port_to_master(dp);
++	return dp->index;
++#else
++	return -ENODEV;
++#endif
++}
++
++static int airoha_ppe_foe_entry_prepare(struct airoha_foe_entry *hwe,
++					struct net_device *dev, int type,
++					struct airoha_flow_data *data,
++					int l4proto)
++{
++	int dsa_port = airoha_get_dsa_port(&dev);
++	struct airoha_foe_mac_info_common *l2;
++	u32 qdata, ports_pad, val;
++
++	memset(hwe, 0, sizeof(*hwe));
++
++	val = FIELD_PREP(AIROHA_FOE_IB1_BIND_STATE, AIROHA_FOE_STATE_BIND) |
++	      FIELD_PREP(AIROHA_FOE_IB1_BIND_PACKET_TYPE, type) |
++	      FIELD_PREP(AIROHA_FOE_IB1_BIND_UDP, l4proto == IPPROTO_UDP) |
++	      FIELD_PREP(AIROHA_FOE_IB1_BIND_VLAN_LAYER, data->vlan.num) |
++	      FIELD_PREP(AIROHA_FOE_IB1_BIND_VPM, data->vlan.num) |
++	      AIROHA_FOE_IB1_BIND_TTL;
++	hwe->ib1 = val;
++
++	val = FIELD_PREP(AIROHA_FOE_IB2_PORT_AG, 0x1f);
++	if (dsa_port >= 0)
++		val |= FIELD_PREP(AIROHA_FOE_IB2_NBQ, dsa_port);
++
++	if (dev) {
++		struct airoha_gdm_port *port = netdev_priv(dev);
++		u8 pse_port;
++
++		pse_port = port->id == 4 ? FE_PSE_PORT_GDM4 : port->id;
++		val |= FIELD_PREP(AIROHA_FOE_IB2_PSE_PORT, pse_port);
++	}
++
++	/* FIXME: implement QoS support setting pse_port to 2 (loopback)
++	 * for uplink and setting qos bit in ib2
++	 */
++
++	if (is_multicast_ether_addr(data->eth.h_dest))
++		val |= AIROHA_FOE_IB2_MULTICAST;
++
++	ports_pad = 0xa5a5a500 | (l4proto & 0xff);
++	if (type == PPE_PKT_TYPE_IPV4_ROUTE)
++		hwe->ipv4.orig_tuple.ports = ports_pad;
++	if (type == PPE_PKT_TYPE_IPV6_ROUTE_3T)
++		hwe->ipv6.ports = ports_pad;
++
++	qdata = FIELD_PREP(AIROHA_FOE_SHAPER_ID, 0x7f);
++	if (type == PPE_PKT_TYPE_BRIDGE) {
++		hwe->bridge.dest_mac_hi = get_unaligned_be32(data->eth.h_dest);
++		hwe->bridge.dest_mac_lo =
++			get_unaligned_be16(data->eth.h_dest + 4);
++		hwe->bridge.src_mac_hi =
++			get_unaligned_be16(data->eth.h_source);
++		hwe->bridge.src_mac_lo =
++			get_unaligned_be32(data->eth.h_source + 2);
++		hwe->bridge.data = qdata;
++		hwe->bridge.ib2 = val;
++		l2 = &hwe->bridge.l2.common;
++	} else if (type >= PPE_PKT_TYPE_IPV6_ROUTE_3T) {
++		hwe->ipv6.data = qdata;
++		hwe->ipv6.ib2 = val;
++		l2 = &hwe->ipv6.l2;
++	} else {
++		hwe->ipv4.data = qdata;
++		hwe->ipv4.ib2 = val;
++		l2 = &hwe->ipv4.l2.common;
++	}
++
++	l2->dest_mac_hi = get_unaligned_be32(data->eth.h_dest);
++	l2->dest_mac_lo = get_unaligned_be16(data->eth.h_dest + 4);
++	if (type <= PPE_PKT_TYPE_IPV4_DSLITE) {
++		l2->src_mac_hi = get_unaligned_be32(data->eth.h_source);
++		hwe->ipv4.l2.src_mac_lo =
++			get_unaligned_be16(data->eth.h_source + 4);
++	} else {
++		l2->src_mac_hi = FIELD_PREP(AIROHA_FOE_MAC_SMAC_ID, 0xf);
++	}
++
++	if (data->vlan.num) {
++		l2->etype = dsa_port >= 0 ? BIT(dsa_port) : 0;
++		l2->vlan1 = data->vlan.hdr[0].id;
++		if (data->vlan.num == 2)
++			l2->vlan2 = data->vlan.hdr[1].id;
++	} else if (dsa_port >= 0) {
++		l2->etype = BIT(15) | BIT(dsa_port);
++	} else if (type >= PPE_PKT_TYPE_IPV6_ROUTE_3T) {
++		l2->etype = ETH_P_IPV6;
++	} else {
++		l2->etype = ETH_P_IP;
++	}
++
++	return 0;
++}
++
++static int airoha_ppe_foe_entry_set_ipv4_tuple(struct airoha_foe_entry *hwe,
++					       struct airoha_flow_data *data,
++					       bool egress)
++{
++	int type = FIELD_GET(AIROHA_FOE_IB1_BIND_PACKET_TYPE, hwe->ib1);
++	struct airoha_foe_ipv4_tuple *t;
++
++	switch (type) {
++	case PPE_PKT_TYPE_IPV4_HNAPT:
++		if (egress) {
++			t = &hwe->ipv4.new_tuple;
++			break;
++		}
++		fallthrough;
++	case PPE_PKT_TYPE_IPV4_DSLITE:
++	case PPE_PKT_TYPE_IPV4_ROUTE:
++		t = &hwe->ipv4.orig_tuple;
++		break;
++	default:
++		WARN_ON_ONCE(1);
++		return -EINVAL;
++	}
++
++	t->src_ip = be32_to_cpu(data->v4.src_addr);
++	t->dest_ip = be32_to_cpu(data->v4.dst_addr);
++
++	if (type != PPE_PKT_TYPE_IPV4_ROUTE) {
++		t->src_port = be16_to_cpu(data->src_port);
++		t->dest_port = be16_to_cpu(data->dst_port);
++	}
++
++	return 0;
++}
++
++static int airoha_ppe_foe_entry_set_ipv6_tuple(struct airoha_foe_entry *hwe,
++					       struct airoha_flow_data *data)
++
++{
++	int type = FIELD_GET(AIROHA_FOE_IB1_BIND_PACKET_TYPE, hwe->ib1);
++	u32 *src, *dest;
++
++	switch (type) {
++	case PPE_PKT_TYPE_IPV6_ROUTE_5T:
++	case PPE_PKT_TYPE_IPV6_6RD:
++		hwe->ipv6.src_port = be16_to_cpu(data->src_port);
++		hwe->ipv6.dest_port = be16_to_cpu(data->dst_port);
++		fallthrough;
++	case PPE_PKT_TYPE_IPV6_ROUTE_3T:
++		src = hwe->ipv6.src_ip;
++		dest = hwe->ipv6.dest_ip;
++		break;
++	default:
++		WARN_ON_ONCE(1);
++		return -EINVAL;
++	}
++
++	ipv6_addr_be32_to_cpu(src, data->v6.src_addr.s6_addr32);
++	ipv6_addr_be32_to_cpu(dest, data->v6.dst_addr.s6_addr32);
++
++	return 0;
++}
++
++static u32 airoha_ppe_foe_get_entry_hash(struct airoha_foe_entry *hwe)
++{
++	int type = FIELD_GET(AIROHA_FOE_IB1_BIND_PACKET_TYPE, hwe->ib1);
++	u32 hash, hv1, hv2, hv3;
++
++	switch (type) {
++	case PPE_PKT_TYPE_IPV4_ROUTE:
++	case PPE_PKT_TYPE_IPV4_HNAPT:
++		hv1 = hwe->ipv4.orig_tuple.ports;
++		hv2 = hwe->ipv4.orig_tuple.dest_ip;
++		hv3 = hwe->ipv4.orig_tuple.src_ip;
++		break;
++	case PPE_PKT_TYPE_IPV6_ROUTE_3T:
++	case PPE_PKT_TYPE_IPV6_ROUTE_5T:
++		hv1 = hwe->ipv6.src_ip[3] ^ hwe->ipv6.dest_ip[3];
++		hv1 ^= hwe->ipv6.ports;
++
++		hv2 = hwe->ipv6.src_ip[2] ^ hwe->ipv6.dest_ip[2];
++		hv2 ^= hwe->ipv6.dest_ip[0];
++
++		hv3 = hwe->ipv6.src_ip[1] ^ hwe->ipv6.dest_ip[1];
++		hv3 ^= hwe->ipv6.src_ip[0];
++		break;
++	case PPE_PKT_TYPE_IPV4_DSLITE:
++	case PPE_PKT_TYPE_IPV6_6RD:
++	default:
++		WARN_ON_ONCE(1);
++		return PPE_HASH_MASK;
++	}
++
++	hash = (hv1 & hv2) | ((~hv1) & hv3);
++	hash = (hash >> 24) | ((hash & 0xffffff) << 8);
++	hash ^= hv1 ^ hv2 ^ hv3;
++	hash ^= hash >> 16;
++	hash &= PPE_NUM_ENTRIES - 1;
++
++	return hash;
++}
++
++static struct airoha_foe_entry *
++airoha_ppe_foe_get_entry(struct airoha_ppe *ppe, u32 hash)
++{
++	if (hash < PPE_SRAM_NUM_ENTRIES) {
++		u32 *hwe = ppe->foe + hash * sizeof(struct airoha_foe_entry);
++		struct airoha_eth *eth = ppe->eth;
++		bool ppe2;
++		u32 val;
++		int i;
++
++		ppe2 = airoha_ppe2_is_enabled(ppe->eth) &&
++		       hash >= PPE1_SRAM_NUM_ENTRIES;
++		airoha_fe_wr(ppe->eth, REG_PPE_RAM_CTRL(ppe2),
++			     FIELD_PREP(PPE_SRAM_CTRL_ENTRY_MASK, hash) |
++			     PPE_SRAM_CTRL_REQ_MASK);
++		if (read_poll_timeout_atomic(airoha_fe_rr, val,
++					     val & PPE_SRAM_CTRL_ACK_MASK,
++					     10, 100, false, eth,
++					     REG_PPE_RAM_CTRL(ppe2)))
++			return NULL;
++
++		for (i = 0; i < sizeof(struct airoha_foe_entry) / 4; i++)
++			hwe[i] = airoha_fe_rr(eth,
++					      REG_PPE_RAM_ENTRY(ppe2, i));
++	}
++
++	return ppe->foe + hash * sizeof(struct airoha_foe_entry);
++}
++
++static bool airoha_ppe_foe_compare_entry(struct airoha_flow_table_entry *e,
++					 struct airoha_foe_entry *hwe)
++{
++	int type = FIELD_GET(AIROHA_FOE_IB1_BIND_PACKET_TYPE, e->data.ib1);
++	int len;
++
++	if ((hwe->ib1 ^ e->data.ib1) & AIROHA_FOE_IB1_BIND_UDP)
++		return false;
++
++	if (type > PPE_PKT_TYPE_IPV4_DSLITE)
++		len = offsetof(struct airoha_foe_entry, ipv6.data);
++	else
++		len = offsetof(struct airoha_foe_entry, ipv4.ib2);
++
++	return !memcmp(&e->data.d, &hwe->d, len - sizeof(hwe->ib1));
++}
++
++static int airoha_ppe_foe_commit_entry(struct airoha_ppe *ppe,
++				       struct airoha_foe_entry *e,
++				       u32 hash)
++{
++	struct airoha_foe_entry *hwe = ppe->foe + hash * sizeof(*hwe);
++	u32 ts = airoha_ppe_get_timestamp(ppe);
++	struct airoha_eth *eth = ppe->eth;
++
++	memcpy(&hwe->d, &e->d, sizeof(*hwe) - sizeof(hwe->ib1));
++	wmb();
++
++	e->ib1 &= ~AIROHA_FOE_IB1_BIND_TIMESTAMP;
++	e->ib1 |= FIELD_PREP(AIROHA_FOE_IB1_BIND_TIMESTAMP, ts);
++	hwe->ib1 = e->ib1;
++
++	if (hash < PPE_SRAM_NUM_ENTRIES) {
++		dma_addr_t addr = ppe->foe_dma + hash * sizeof(*hwe);
++		bool ppe2 = airoha_ppe2_is_enabled(eth) &&
++			    hash >= PPE1_SRAM_NUM_ENTRIES;
++		struct airoha_npu *npu;
++		int err = -ENODEV;
++
++		rcu_read_lock();
++		npu = rcu_dereference(eth->npu);
++		if (npu)
++			err = npu->ops.ppe_foe_commit_entry(npu, addr,
++							    sizeof(*hwe), hash,
++							    ppe2);
++		rcu_read_unlock();
++
++		return err;
++	}
++
++	return 0;
++}
++
++static void airoha_ppe_foe_insert_entry(struct airoha_ppe *ppe, u32 hash)
++{
++	struct airoha_flow_table_entry *e;
++	struct airoha_foe_entry *hwe;
++	struct hlist_node *n;
++	u32 index, state;
++
++	spin_lock_bh(&ppe_lock);
++
++	hwe = airoha_ppe_foe_get_entry(ppe, hash);
++	if (!hwe)
++		goto unlock;
++
++	state = FIELD_GET(AIROHA_FOE_IB1_BIND_STATE, hwe->ib1);
++	if (state == AIROHA_FOE_STATE_BIND)
++		goto unlock;
++
++	index = airoha_ppe_foe_get_entry_hash(hwe);
++	hlist_for_each_entry_safe(e, n, &ppe->foe_flow[index], list) {
++		if (airoha_ppe_foe_compare_entry(e, hwe)) {
++			airoha_ppe_foe_commit_entry(ppe, &e->data, hash);
++			e->hash = hash;
++			break;
++		}
++	}
++unlock:
++	spin_unlock_bh(&ppe_lock);
++}
++
++static int airoha_ppe_foe_flow_commit_entry(struct airoha_ppe *ppe,
++					    struct airoha_flow_table_entry *e)
++{
++	u32 hash = airoha_ppe_foe_get_entry_hash(&e->data);
++
++	e->hash = 0xffff;
++
++	spin_lock_bh(&ppe_lock);
++	hlist_add_head(&e->list, &ppe->foe_flow[hash]);
++	spin_unlock_bh(&ppe_lock);
++
++	return 0;
++}
++
++static void airoha_ppe_foe_flow_remove_entry(struct airoha_ppe *ppe,
++					     struct airoha_flow_table_entry *e)
++{
++	spin_lock_bh(&ppe_lock);
++
++	hlist_del_init(&e->list);
++	if (e->hash != 0xffff) {
++		e->data.ib1 &= ~AIROHA_FOE_IB1_BIND_STATE;
++		e->data.ib1 |= FIELD_PREP(AIROHA_FOE_IB1_BIND_STATE,
++					  AIROHA_FOE_STATE_INVALID);
++		airoha_ppe_foe_commit_entry(ppe, &e->data, e->hash);
++		e->hash = 0xffff;
++	}
++
++	spin_unlock_bh(&ppe_lock);
++}
++
++static int airoha_ppe_flow_offload_replace(struct airoha_gdm_port *port,
++					   struct flow_cls_offload *f)
++{
++	struct flow_rule *rule = flow_cls_offload_flow_rule(f);
++	struct airoha_eth *eth = port->qdma->eth;
++	struct airoha_flow_table_entry *e;
++	struct airoha_flow_data data = {};
++	struct net_device *odev = NULL;
++	struct flow_action_entry *act;
++	struct airoha_foe_entry hwe;
++	int err, i, offload_type;
++	u16 addr_type = 0;
++	u8 l4proto = 0;
++
++	if (rhashtable_lookup(&eth->flow_table, &f->cookie,
++			      airoha_flow_table_params))
++		return -EEXIST;
++
++	if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_META))
++		return -EOPNOTSUPP;
++
++	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_CONTROL)) {
++		struct flow_match_control match;
++
++		flow_rule_match_control(rule, &match);
++		addr_type = match.key->addr_type;
++		if (flow_rule_has_control_flags(match.mask->flags,
++						f->common.extack))
++			return -EOPNOTSUPP;
++	} else {
++		return -EOPNOTSUPP;
++	}
++
++	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_BASIC)) {
++		struct flow_match_basic match;
++
++		flow_rule_match_basic(rule, &match);
++		l4proto = match.key->ip_proto;
++	} else {
++		return -EOPNOTSUPP;
++	}
++
++	switch (addr_type) {
++	case 0:
++		offload_type = PPE_PKT_TYPE_BRIDGE;
++		if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_ETH_ADDRS)) {
++			struct flow_match_eth_addrs match;
++
++			flow_rule_match_eth_addrs(rule, &match);
++			memcpy(data.eth.h_dest, match.key->dst, ETH_ALEN);
++			memcpy(data.eth.h_source, match.key->src, ETH_ALEN);
++		} else {
++			return -EOPNOTSUPP;
++		}
++		break;
++	case FLOW_DISSECTOR_KEY_IPV4_ADDRS:
++		offload_type = PPE_PKT_TYPE_IPV4_HNAPT;
++		break;
++	case FLOW_DISSECTOR_KEY_IPV6_ADDRS:
++		offload_type = PPE_PKT_TYPE_IPV6_ROUTE_5T;
++		break;
++	default:
++		return -EOPNOTSUPP;
++	}
++
++	flow_action_for_each(i, act, &rule->action) {
++		switch (act->id) {
++		case FLOW_ACTION_MANGLE:
++			if (offload_type == PPE_PKT_TYPE_BRIDGE)
++				return -EOPNOTSUPP;
++
++			if (act->mangle.htype == FLOW_ACT_MANGLE_HDR_TYPE_ETH)
++				airoha_ppe_flow_mangle_eth(act, &data.eth);
++			break;
++		case FLOW_ACTION_REDIRECT:
++			odev = act->dev;
++			break;
++		case FLOW_ACTION_CSUM:
++			break;
++		case FLOW_ACTION_VLAN_PUSH:
++			if (data.vlan.num == 2 ||
++			    act->vlan.proto != htons(ETH_P_8021Q))
++				return -EOPNOTSUPP;
++
++			data.vlan.hdr[data.vlan.num].id = act->vlan.vid;
++			data.vlan.hdr[data.vlan.num].proto = act->vlan.proto;
++			data.vlan.num++;
++			break;
++		case FLOW_ACTION_VLAN_POP:
++			break;
++		case FLOW_ACTION_PPPOE_PUSH:
++			break;
++		default:
++			return -EOPNOTSUPP;
++		}
++	}
++
++	if (!is_valid_ether_addr(data.eth.h_source) ||
++	    !is_valid_ether_addr(data.eth.h_dest))
++		return -EINVAL;
++
++	err = airoha_ppe_foe_entry_prepare(&hwe, odev, offload_type,
++					   &data, l4proto);
++	if (err)
++		return err;
++
++	if (flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_PORTS)) {
++		struct flow_match_ports ports;
++
++		if (offload_type == PPE_PKT_TYPE_BRIDGE)
++			return -EOPNOTSUPP;
++
++		flow_rule_match_ports(rule, &ports);
++		data.src_port = ports.key->src;
++		data.dst_port = ports.key->dst;
++	} else if (offload_type != PPE_PKT_TYPE_BRIDGE) {
++		return -EOPNOTSUPP;
++	}
++
++	if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS) {
++		struct flow_match_ipv4_addrs addrs;
++
++		flow_rule_match_ipv4_addrs(rule, &addrs);
++		data.v4.src_addr = addrs.key->src;
++		data.v4.dst_addr = addrs.key->dst;
++		airoha_ppe_foe_entry_set_ipv4_tuple(&hwe, &data, false);
++	}
++
++	if (addr_type == FLOW_DISSECTOR_KEY_IPV6_ADDRS) {
++		struct flow_match_ipv6_addrs addrs;
++
++		flow_rule_match_ipv6_addrs(rule, &addrs);
++
++		data.v6.src_addr = addrs.key->src;
++		data.v6.dst_addr = addrs.key->dst;
++		airoha_ppe_foe_entry_set_ipv6_tuple(&hwe, &data);
++	}
++
++	flow_action_for_each(i, act, &rule->action) {
++		if (act->id != FLOW_ACTION_MANGLE)
++			continue;
++
++		if (offload_type == PPE_PKT_TYPE_BRIDGE)
++			return -EOPNOTSUPP;
++
++		switch (act->mangle.htype) {
++		case FLOW_ACT_MANGLE_HDR_TYPE_TCP:
++		case FLOW_ACT_MANGLE_HDR_TYPE_UDP:
++			err = airoha_ppe_flow_mangle_ports(act, &data);
++			break;
++		case FLOW_ACT_MANGLE_HDR_TYPE_IP4:
++			err = airoha_ppe_flow_mangle_ipv4(act, &data);
++			break;
++		case FLOW_ACT_MANGLE_HDR_TYPE_ETH:
++			/* handled earlier */
++			break;
++		default:
++			return -EOPNOTSUPP;
++		}
++
++		if (err)
++			return err;
++	}
++
++	if (addr_type == FLOW_DISSECTOR_KEY_IPV4_ADDRS) {
++		err = airoha_ppe_foe_entry_set_ipv4_tuple(&hwe, &data, true);
++		if (err)
++			return err;
++	}
++
++	e = kzalloc(sizeof(*e), GFP_KERNEL);
++	if (!e)
++		return -ENOMEM;
++
++	e->cookie = f->cookie;
++	memcpy(&e->data, &hwe, sizeof(e->data));
++
++	err = airoha_ppe_foe_flow_commit_entry(eth->ppe, e);
++	if (err)
++		goto free_entry;
++
++	err = rhashtable_insert_fast(&eth->flow_table, &e->node,
++				     airoha_flow_table_params);
++	if (err < 0)
++		goto remove_foe_entry;
++
++	return 0;
++
++remove_foe_entry:
++	airoha_ppe_foe_flow_remove_entry(eth->ppe, e);
++free_entry:
++	kfree(e);
++
++	return err;
++}
++
++static int airoha_ppe_flow_offload_destroy(struct airoha_gdm_port *port,
++					   struct flow_cls_offload *f)
++{
++	struct airoha_eth *eth = port->qdma->eth;
++	struct airoha_flow_table_entry *e;
++
++	e = rhashtable_lookup(&eth->flow_table, &f->cookie,
++			      airoha_flow_table_params);
++	if (!e)
++		return -ENOENT;
++
++	airoha_ppe_foe_flow_remove_entry(eth->ppe, e);
++	rhashtable_remove_fast(&eth->flow_table, &e->node,
++			       airoha_flow_table_params);
++	kfree(e);
++
++	return 0;
++}
++
++static int airoha_ppe_flow_offload_cmd(struct airoha_gdm_port *port,
++				       struct flow_cls_offload *f)
++{
++	switch (f->command) {
++	case FLOW_CLS_REPLACE:
++		return airoha_ppe_flow_offload_replace(port, f);
++	case FLOW_CLS_DESTROY:
++		return airoha_ppe_flow_offload_destroy(port, f);
++	default:
++		break;
++	}
++
++	return -EOPNOTSUPP;
++}
++
++static int airoha_ppe_flush_sram_entries(struct airoha_ppe *ppe,
++					 struct airoha_npu *npu)
++{
++	int i, sram_num_entries = PPE_SRAM_NUM_ENTRIES;
++	struct airoha_foe_entry *hwe = ppe->foe;
++
++	if (airoha_ppe2_is_enabled(ppe->eth))
++		sram_num_entries = sram_num_entries / 2;
++
++	for (i = 0; i < sram_num_entries; i++)
++		memset(&hwe[i], 0, sizeof(*hwe));
++
++	return npu->ops.ppe_flush_sram_entries(npu, ppe->foe_dma,
++					       PPE_SRAM_NUM_ENTRIES);
++}
++
++static struct airoha_npu *airoha_ppe_npu_get(struct airoha_eth *eth)
++{
++	struct airoha_npu *npu = airoha_npu_get(eth->dev);
++
++	if (IS_ERR(npu)) {
++		request_module("airoha-npu");
++		npu = airoha_npu_get(eth->dev);
++	}
++
++	return npu;
++}
++
++static int airoha_ppe_offload_setup(struct airoha_eth *eth)
++{
++	struct airoha_npu *npu = airoha_ppe_npu_get(eth);
++	int err;
++
++	if (IS_ERR(npu))
++		return PTR_ERR(npu);
++
++	err = npu->ops.ppe_init(npu);
++	if (err)
++		goto error_npu_put;
++
++	airoha_ppe_hw_init(eth->ppe);
++	err = airoha_ppe_flush_sram_entries(eth->ppe, npu);
++	if (err)
++		goto error_npu_put;
++
++	rcu_assign_pointer(eth->npu, npu);
++	synchronize_rcu();
++
++	return 0;
++
++error_npu_put:
++	airoha_npu_put(npu);
++
++	return err;
++}
++
++int airoha_ppe_setup_tc_block_cb(enum tc_setup_type type, void *type_data,
++				 void *cb_priv)
++{
++	struct flow_cls_offload *cls = type_data;
++	struct net_device *dev = cb_priv;
++	struct airoha_gdm_port *port = netdev_priv(dev);
++	struct airoha_eth *eth = port->qdma->eth;
++	int err = 0;
++
++	if (!tc_can_offload(dev) || type != TC_SETUP_CLSFLOWER)
++		return -EOPNOTSUPP;
++
++	mutex_lock(&flow_offload_mutex);
++
++	if (!eth->npu)
++		err = airoha_ppe_offload_setup(eth);
++	if (!err)
++		err = airoha_ppe_flow_offload_cmd(port, cls);
++
++	mutex_unlock(&flow_offload_mutex);
++
++	return err;
++}
++
++void airoha_ppe_check_skb(struct airoha_ppe *ppe, u16 hash)
++{
++	u16 now, diff;
++
++	if (hash > PPE_HASH_MASK)
++		return;
++
++	now = (u16)jiffies;
++	diff = now - ppe->foe_check_time[hash];
++	if (diff < HZ / 10)
++		return;
++
++	ppe->foe_check_time[hash] = now;
++	airoha_ppe_foe_insert_entry(ppe, hash);
++}
++
++int airoha_ppe_init(struct airoha_eth *eth)
++{
++	struct airoha_ppe *ppe;
++	int foe_size;
++
++	ppe = devm_kzalloc(eth->dev, sizeof(*ppe), GFP_KERNEL);
++	if (!ppe)
++		return -ENOMEM;
++
++	foe_size = PPE_NUM_ENTRIES * sizeof(struct airoha_foe_entry);
++	ppe->foe = dmam_alloc_coherent(eth->dev, foe_size, &ppe->foe_dma,
++				       GFP_KERNEL);
++	if (!ppe->foe)
++		return -ENOMEM;
++
++	ppe->eth = eth;
++	eth->ppe = ppe;
++
++	ppe->foe_flow = devm_kzalloc(eth->dev,
++				     PPE_NUM_ENTRIES * sizeof(*ppe->foe_flow),
++				     GFP_KERNEL);
++	if (!ppe->foe_flow)
++		return -ENOMEM;
++
++	return rhashtable_init(&eth->flow_table, &airoha_flow_table_params);
++}
++
++void airoha_ppe_deinit(struct airoha_eth *eth)
++{
++	struct airoha_npu *npu;
++
++	rcu_read_lock();
++	npu = rcu_dereference(eth->npu);
++	if (npu) {
++		npu->ops.ppe_deinit(npu);
++		airoha_npu_put(npu);
++	}
++	rcu_read_unlock();
++
++	rhashtable_destroy(&eth->flow_table);
++}
+--- a/drivers/net/ethernet/airoha/airoha_regs.h
++++ b/drivers/net/ethernet/airoha/airoha_regs.h
+@@ -15,6 +15,7 @@
+ #define CDM1_BASE			0x0400
+ #define GDM1_BASE			0x0500
+ #define PPE1_BASE			0x0c00
++#define PPE2_BASE			0x1c00
+ 
+ #define CDM2_BASE			0x1400
+ #define GDM2_BASE			0x1500
+@@ -36,6 +37,7 @@
+ #define FE_RST_GDM3_MBI_ARB_MASK	BIT(2)
+ #define FE_RST_CORE_MASK		BIT(0)
+ 
++#define REG_FE_FOE_TS			0x0010
+ #define REG_FE_WAN_MAC_H		0x0030
+ #define REG_FE_LAN_MAC_H		0x0040
+ 
+@@ -192,11 +194,106 @@
+ #define REG_FE_GDM_RX_ETH_L511_CNT_L(_n)	(GDM_BASE(_n) + 0x198)
+ #define REG_FE_GDM_RX_ETH_L1023_CNT_L(_n)	(GDM_BASE(_n) + 0x19c)
+ 
+-#define REG_PPE1_TB_HASH_CFG		(PPE1_BASE + 0x250)
+-#define PPE1_SRAM_TABLE_EN_MASK		BIT(0)
+-#define PPE1_SRAM_HASH1_EN_MASK		BIT(8)
+-#define PPE1_DRAM_TABLE_EN_MASK		BIT(16)
+-#define PPE1_DRAM_HASH1_EN_MASK		BIT(24)
++#define REG_PPE_GLO_CFG(_n)			(((_n) ? PPE2_BASE : PPE1_BASE) + 0x200)
++#define PPE_GLO_CFG_BUSY_MASK			BIT(31)
++#define PPE_GLO_CFG_FLOW_DROP_UPDATE_MASK	BIT(9)
++#define PPE_GLO_CFG_PSE_HASH_OFS_MASK		BIT(6)
++#define PPE_GLO_CFG_PPE_BSWAP_MASK		BIT(5)
++#define PPE_GLO_CFG_TTL_DROP_MASK		BIT(4)
++#define PPE_GLO_CFG_IP4_CS_DROP_MASK		BIT(3)
++#define PPE_GLO_CFG_IP4_L4_CS_DROP_MASK		BIT(2)
++#define PPE_GLO_CFG_EN_MASK			BIT(0)
++
++#define REG_PPE_PPE_FLOW_CFG(_n)		(((_n) ? PPE2_BASE : PPE1_BASE) + 0x204)
++#define PPE_FLOW_CFG_IP6_HASH_GRE_KEY_MASK	BIT(20)
++#define PPE_FLOW_CFG_IP4_HASH_GRE_KEY_MASK	BIT(19)
++#define PPE_FLOW_CFG_IP4_HASH_FLOW_LABEL_MASK	BIT(18)
++#define PPE_FLOW_CFG_IP4_NAT_FRAG_MASK		BIT(17)
++#define PPE_FLOW_CFG_IP_PROTO_BLACKLIST_MASK	BIT(16)
++#define PPE_FLOW_CFG_IP4_DSLITE_MASK		BIT(14)
++#define PPE_FLOW_CFG_IP4_NAPT_MASK		BIT(13)
++#define PPE_FLOW_CFG_IP4_NAT_MASK		BIT(12)
++#define PPE_FLOW_CFG_IP6_6RD_MASK		BIT(10)
++#define PPE_FLOW_CFG_IP6_5T_ROUTE_MASK		BIT(9)
++#define PPE_FLOW_CFG_IP6_3T_ROUTE_MASK		BIT(8)
++#define PPE_FLOW_CFG_IP4_UDP_FRAG_MASK		BIT(7)
++#define PPE_FLOW_CFG_IP4_TCP_FRAG_MASK		BIT(6)
++
++#define REG_PPE_IP_PROTO_CHK(_n)		(((_n) ? PPE2_BASE : PPE1_BASE) + 0x208)
++#define PPE_IP_PROTO_CHK_IPV4_MASK		GENMASK(15, 0)
++#define PPE_IP_PROTO_CHK_IPV6_MASK		GENMASK(31, 16)
++
++#define REG_PPE_TB_CFG(_n)			(((_n) ? PPE2_BASE : PPE1_BASE) + 0x21c)
++#define PPE_SRAM_TB_NUM_ENTRY_MASK		GENMASK(26, 24)
++#define PPE_TB_CFG_KEEPALIVE_MASK		GENMASK(13, 12)
++#define PPE_TB_CFG_AGE_TCP_FIN_MASK		BIT(11)
++#define PPE_TB_CFG_AGE_UDP_MASK			BIT(10)
++#define PPE_TB_CFG_AGE_TCP_MASK			BIT(9)
++#define PPE_TB_CFG_AGE_UNBIND_MASK		BIT(8)
++#define PPE_TB_CFG_AGE_NON_L4_MASK		BIT(7)
++#define PPE_TB_CFG_AGE_PREBIND_MASK		BIT(6)
++#define PPE_TB_CFG_SEARCH_MISS_MASK		GENMASK(5, 4)
++#define PPE_TB_ENTRY_SIZE_MASK			BIT(3)
++#define PPE_DRAM_TB_NUM_ENTRY_MASK		GENMASK(2, 0)
++
++#define REG_PPE_TB_BASE(_n)			(((_n) ? PPE2_BASE : PPE1_BASE) + 0x220)
++
++#define REG_PPE_BIND_RATE(_n)			(((_n) ? PPE2_BASE : PPE1_BASE) + 0x228)
++#define PPE_BIND_RATE_L2B_BIND_MASK		GENMASK(31, 16)
++#define PPE_BIND_RATE_BIND_MASK			GENMASK(15, 0)
++
++#define REG_PPE_BIND_LIMIT0(_n)			(((_n) ? PPE2_BASE : PPE1_BASE) + 0x22c)
++#define PPE_BIND_LIMIT0_HALF_MASK		GENMASK(29, 16)
++#define PPE_BIND_LIMIT0_QUARTER_MASK		GENMASK(13, 0)
++
++#define REG_PPE_BIND_LIMIT1(_n)			(((_n) ? PPE2_BASE : PPE1_BASE) + 0x230)
++#define PPE_BIND_LIMIT1_NON_L4_MASK		GENMASK(23, 16)
++#define PPE_BIND_LIMIT1_FULL_MASK		GENMASK(13, 0)
++
++#define REG_PPE_BND_AGE0(_n)			(((_n) ? PPE2_BASE : PPE1_BASE) + 0x23c)
++#define PPE_BIND_AGE0_DELTA_NON_L4		GENMASK(30, 16)
++#define PPE_BIND_AGE0_DELTA_UDP			GENMASK(14, 0)
++
++#define REG_PPE_UNBIND_AGE(_n)			(((_n) ? PPE2_BASE : PPE1_BASE) + 0x238)
++#define PPE_UNBIND_AGE_MIN_PACKETS_MASK		GENMASK(31, 16)
++#define PPE_UNBIND_AGE_DELTA_MASK		GENMASK(7, 0)
++
++#define REG_PPE_BND_AGE1(_n)			(((_n) ? PPE2_BASE : PPE1_BASE) + 0x240)
++#define PPE_BIND_AGE1_DELTA_TCP_FIN		GENMASK(30, 16)
++#define PPE_BIND_AGE1_DELTA_TCP			GENMASK(14, 0)
++
++#define REG_PPE_HASH_SEED(_n)			(((_n) ? PPE2_BASE : PPE1_BASE) + 0x244)
++#define PPE_HASH_SEED				0x12345678
++
++#define REG_PPE_DFT_CPORT0(_n)			(((_n) ? PPE2_BASE : PPE1_BASE) + 0x248)
++
++#define REG_PPE_DFT_CPORT1(_n)			(((_n) ? PPE2_BASE : PPE1_BASE) + 0x24c)
++
++#define REG_PPE_TB_HASH_CFG(_n)			(((_n) ? PPE2_BASE : PPE1_BASE) + 0x250)
++#define PPE_DRAM_HASH1_MODE_MASK		GENMASK(31, 28)
++#define PPE_DRAM_HASH1_EN_MASK			BIT(24)
++#define PPE_DRAM_HASH0_MODE_MASK		GENMASK(23, 20)
++#define PPE_DRAM_TABLE_EN_MASK			BIT(16)
++#define PPE_SRAM_HASH1_MODE_MASK		GENMASK(15, 12)
++#define PPE_SRAM_HASH1_EN_MASK			BIT(8)
++#define PPE_SRAM_HASH0_MODE_MASK		GENMASK(7, 4)
++#define PPE_SRAM_TABLE_EN_MASK			BIT(0)
++
++#define REG_PPE_MTU_BASE(_n)			(((_n) ? PPE2_BASE : PPE1_BASE) + 0x304)
++#define REG_PPE_MTU(_m, _n)			(REG_PPE_MTU_BASE(_m) + ((_n) << 2))
++#define FP1_EGRESS_MTU_MASK			GENMASK(29, 16)
++#define FP0_EGRESS_MTU_MASK			GENMASK(13, 0)
++
++#define REG_PPE_RAM_CTRL(_n)			(((_n) ? PPE2_BASE : PPE1_BASE) + 0x31c)
++#define PPE_SRAM_CTRL_ACK_MASK			BIT(31)
++#define PPE_SRAM_CTRL_DUAL_SUCESS_MASK		BIT(30)
++#define PPE_SRAM_CTRL_ENTRY_MASK		GENMASK(23, 8)
++#define PPE_SRAM_WR_DUAL_DIRECTION_MASK		BIT(2)
++#define PPE_SRAM_CTRL_WR_MASK			BIT(1)
++#define PPE_SRAM_CTRL_REQ_MASK			BIT(0)
++
++#define REG_PPE_RAM_BASE(_n)			(((_n) ? PPE2_BASE : PPE1_BASE) + 0x320)
++#define REG_PPE_RAM_ENTRY(_m, _n)		(REG_PPE_RAM_BASE(_m) + ((_n) << 2))
+ 
+ #define REG_FE_GDM_TX_OK_PKT_CNT_H(_n)		(GDM_BASE(_n) + 0x280)
+ #define REG_FE_GDM_TX_OK_BYTE_CNT_H(_n)		(GDM_BASE(_n) + 0x284)
diff --git a/target/linux/airoha/patches-6.6/048-14-v6.15-net-airoha-Add-loopback-support-for-GDM2.patch b/target/linux/airoha/patches-6.6/048-14-v6.15-net-airoha-Add-loopback-support-for-GDM2.patch
new file mode 100644
index 00000000000000..224fe04f4472b2
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/048-14-v6.15-net-airoha-Add-loopback-support-for-GDM2.patch
@@ -0,0 +1,210 @@
+From 9cd451d414f6e29f507a216fb3b19fa68c011f8c Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 28 Feb 2025 11:54:22 +0100
+Subject: [PATCH 14/15] net: airoha: Add loopback support for GDM2
+
+Enable hw redirection for traffic received on GDM2 port to GDM{3,4}.
+This is required to apply Qdisc offloading (HTB or ETS) for traffic to
+and from GDM{3,4} port.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/airoha/airoha_eth.c  | 71 ++++++++++++++++++++++-
+ drivers/net/ethernet/airoha/airoha_eth.h  |  7 +++
+ drivers/net/ethernet/airoha/airoha_ppe.c  | 12 ++--
+ drivers/net/ethernet/airoha/airoha_regs.h | 29 +++++++++
+ 4 files changed, 111 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/airoha/airoha_eth.c
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -1589,14 +1589,81 @@ static int airoha_dev_set_macaddr(struct
+ 	return 0;
+ }
+ 
++static void airhoha_set_gdm2_loopback(struct airoha_gdm_port *port)
++{
++	u32 pse_port = port->id == 3 ? FE_PSE_PORT_GDM3 : FE_PSE_PORT_GDM4;
++	struct airoha_eth *eth = port->qdma->eth;
++	u32 chan = port->id == 3 ? 4 : 0;
++
++	/* Forward the traffic to the proper GDM port */
++	airoha_set_gdm_port_fwd_cfg(eth, REG_GDM_FWD_CFG(2), pse_port);
++	airoha_fe_clear(eth, REG_GDM_FWD_CFG(2), GDM_STRIP_CRC);
++
++	/* Enable GDM2 loopback */
++	airoha_fe_wr(eth, REG_GDM_TXCHN_EN(2), 0xffffffff);
++	airoha_fe_wr(eth, REG_GDM_RXCHN_EN(2), 0xffff);
++	airoha_fe_rmw(eth, REG_GDM_LPBK_CFG(2),
++		      LPBK_CHAN_MASK | LPBK_MODE_MASK | LPBK_EN_MASK,
++		      FIELD_PREP(LPBK_CHAN_MASK, chan) | LPBK_EN_MASK);
++	airoha_fe_rmw(eth, REG_GDM_LEN_CFG(2),
++		      GDM_SHORT_LEN_MASK | GDM_LONG_LEN_MASK,
++		      FIELD_PREP(GDM_SHORT_LEN_MASK, 60) |
++		      FIELD_PREP(GDM_LONG_LEN_MASK, AIROHA_MAX_MTU));
++
++	/* Disable VIP and IFC for GDM2 */
++	airoha_fe_clear(eth, REG_FE_VIP_PORT_EN, BIT(2));
++	airoha_fe_clear(eth, REG_FE_IFC_PORT_EN, BIT(2));
++
++	if (port->id == 3) {
++		/* FIXME: handle XSI_PCE1_PORT */
++		airoha_fe_wr(eth, REG_PPE_DFT_CPORT0(0),  0x5500);
++		airoha_fe_rmw(eth, REG_FE_WAN_PORT,
++			      WAN1_EN_MASK | WAN1_MASK | WAN0_MASK,
++			      FIELD_PREP(WAN0_MASK, HSGMII_LAN_PCIE0_SRCPORT));
++		airoha_fe_rmw(eth,
++			      REG_SP_DFT_CPORT(HSGMII_LAN_PCIE0_SRCPORT >> 3),
++			      SP_CPORT_PCIE0_MASK,
++			      FIELD_PREP(SP_CPORT_PCIE0_MASK,
++					 FE_PSE_PORT_CDM2));
++	} else {
++		/* FIXME: handle XSI_USB_PORT */
++		airoha_fe_rmw(eth, REG_SRC_PORT_FC_MAP6,
++			      FC_ID_OF_SRC_PORT24_MASK,
++			      FIELD_PREP(FC_ID_OF_SRC_PORT24_MASK, 2));
++		airoha_fe_rmw(eth, REG_FE_WAN_PORT,
++			      WAN1_EN_MASK | WAN1_MASK | WAN0_MASK,
++			      FIELD_PREP(WAN0_MASK, HSGMII_LAN_ETH_SRCPORT));
++		airoha_fe_rmw(eth,
++			      REG_SP_DFT_CPORT(HSGMII_LAN_ETH_SRCPORT >> 3),
++			      SP_CPORT_ETH_MASK,
++			      FIELD_PREP(SP_CPORT_ETH_MASK, FE_PSE_PORT_CDM2));
++	}
++}
++
+ static int airoha_dev_init(struct net_device *dev)
+ {
+ 	struct airoha_gdm_port *port = netdev_priv(dev);
+ 	struct airoha_eth *eth = port->qdma->eth;
++	u32 pse_port;
+ 
+ 	airoha_set_macaddr(port, dev->dev_addr);
+-	airoha_set_gdm_port_fwd_cfg(eth, REG_GDM_FWD_CFG(port->id),
+-				    FE_PSE_PORT_PPE1);
++
++	switch (port->id) {
++	case 3:
++	case 4:
++		/* If GDM2 is active we can't enable loopback */
++		if (!eth->ports[1])
++			airhoha_set_gdm2_loopback(port);
++		fallthrough;
++	case 2:
++		pse_port = FE_PSE_PORT_PPE2;
++		break;
++	default:
++		pse_port = FE_PSE_PORT_PPE1;
++		break;
++	}
++
++	airoha_set_gdm_port_fwd_cfg(eth, REG_GDM_FWD_CFG(port->id), pse_port);
+ 
+ 	return 0;
+ }
+--- a/drivers/net/ethernet/airoha/airoha_eth.h
++++ b/drivers/net/ethernet/airoha/airoha_eth.h
+@@ -68,6 +68,13 @@ enum {
+ };
+ 
+ enum {
++	HSGMII_LAN_PCIE0_SRCPORT = 0x16,
++	HSGMII_LAN_PCIE1_SRCPORT,
++	HSGMII_LAN_ETH_SRCPORT,
++	HSGMII_LAN_USB_SRCPORT,
++};
++
++enum {
+ 	XSI_PCIE0_VIP_PORT_MASK	= BIT(22),
+ 	XSI_PCIE1_VIP_PORT_MASK	= BIT(23),
+ 	XSI_USB_VIP_PORT_MASK	= BIT(25),
+--- a/drivers/net/ethernet/airoha/airoha_ppe.c
++++ b/drivers/net/ethernet/airoha/airoha_ppe.c
+@@ -216,7 +216,8 @@ static int airoha_ppe_foe_entry_prepare(
+ 	      AIROHA_FOE_IB1_BIND_TTL;
+ 	hwe->ib1 = val;
+ 
+-	val = FIELD_PREP(AIROHA_FOE_IB2_PORT_AG, 0x1f);
++	val = FIELD_PREP(AIROHA_FOE_IB2_PORT_AG, 0x1f) |
++	      AIROHA_FOE_IB2_PSE_QOS;
+ 	if (dsa_port >= 0)
+ 		val |= FIELD_PREP(AIROHA_FOE_IB2_NBQ, dsa_port);
+ 
+@@ -224,14 +225,13 @@ static int airoha_ppe_foe_entry_prepare(
+ 		struct airoha_gdm_port *port = netdev_priv(dev);
+ 		u8 pse_port;
+ 
+-		pse_port = port->id == 4 ? FE_PSE_PORT_GDM4 : port->id;
++		if (dsa_port >= 0)
++			pse_port = port->id == 4 ? FE_PSE_PORT_GDM4 : port->id;
++		else
++			pse_port = 2; /* uplink relies on GDM2 loopback */
+ 		val |= FIELD_PREP(AIROHA_FOE_IB2_PSE_PORT, pse_port);
+ 	}
+ 
+-	/* FIXME: implement QoS support setting pse_port to 2 (loopback)
+-	 * for uplink and setting qos bit in ib2
+-	 */
+-
+ 	if (is_multicast_ether_addr(data->eth.h_dest))
+ 		val |= AIROHA_FOE_IB2_MULTICAST;
+ 
+--- a/drivers/net/ethernet/airoha/airoha_regs.h
++++ b/drivers/net/ethernet/airoha/airoha_regs.h
+@@ -38,6 +38,12 @@
+ #define FE_RST_CORE_MASK		BIT(0)
+ 
+ #define REG_FE_FOE_TS			0x0010
++
++#define REG_FE_WAN_PORT			0x0024
++#define WAN1_EN_MASK			BIT(16)
++#define WAN1_MASK			GENMASK(12, 8)
++#define WAN0_MASK			GENMASK(4, 0)
++
+ #define REG_FE_WAN_MAC_H		0x0030
+ #define REG_FE_LAN_MAC_H		0x0040
+ 
+@@ -126,6 +132,7 @@
+ #define GDM_IP4_CKSUM			BIT(22)
+ #define GDM_TCP_CKSUM			BIT(21)
+ #define GDM_UDP_CKSUM			BIT(20)
++#define GDM_STRIP_CRC			BIT(16)
+ #define GDM_UCFQ_MASK			GENMASK(15, 12)
+ #define GDM_BCFQ_MASK			GENMASK(11, 8)
+ #define GDM_MCFQ_MASK			GENMASK(7, 4)
+@@ -139,6 +146,16 @@
+ #define GDM_SHORT_LEN_MASK		GENMASK(13, 0)
+ #define GDM_LONG_LEN_MASK		GENMASK(29, 16)
+ 
++#define REG_GDM_LPBK_CFG(_n)		(GDM_BASE(_n) + 0x1c)
++#define LPBK_GAP_MASK			GENMASK(31, 24)
++#define LPBK_LEN_MASK			GENMASK(23, 10)
++#define LPBK_CHAN_MASK			GENMASK(8, 4)
++#define LPBK_MODE_MASK			GENMASK(3, 1)
++#define LPBK_EN_MASK			BIT(0)
++
++#define REG_GDM_TXCHN_EN(_n)		(GDM_BASE(_n) + 0x24)
++#define REG_GDM_RXCHN_EN(_n)		(GDM_BASE(_n) + 0x28)
++
+ #define REG_FE_CPORT_CFG		(GDM1_BASE + 0x40)
+ #define FE_CPORT_PAD			BIT(26)
+ #define FE_CPORT_PORT_XFC_MASK		BIT(25)
+@@ -351,6 +368,18 @@
+ 
+ #define REG_MC_VLAN_DATA		0x2108
+ 
++#define REG_SP_DFT_CPORT(_n)		(0x20e0 + ((_n) << 2))
++#define SP_CPORT_PCIE1_MASK		GENMASK(31, 28)
++#define SP_CPORT_PCIE0_MASK		GENMASK(27, 24)
++#define SP_CPORT_USB_MASK		GENMASK(7, 4)
++#define SP_CPORT_ETH_MASK		GENMASK(7, 4)
++
++#define REG_SRC_PORT_FC_MAP6		0x2298
++#define FC_ID_OF_SRC_PORT27_MASK	GENMASK(28, 24)
++#define FC_ID_OF_SRC_PORT26_MASK	GENMASK(20, 16)
++#define FC_ID_OF_SRC_PORT25_MASK	GENMASK(12, 8)
++#define FC_ID_OF_SRC_PORT24_MASK	GENMASK(4, 0)
++
+ #define REG_CDM5_RX_OQ1_DROP_CNT	0x29d4
+ 
+ /* QDMA */
diff --git a/target/linux/airoha/patches-6.6/048-15-v6.15-net-airoha-Introduce-PPE-debugfs-support.patch b/target/linux/airoha/patches-6.6/048-15-v6.15-net-airoha-Introduce-PPE-debugfs-support.patch
new file mode 100644
index 00000000000000..50d7fa12668f9d
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/048-15-v6.15-net-airoha-Introduce-PPE-debugfs-support.patch
@@ -0,0 +1,291 @@
+From 3fe15c640f3808c3faf235553c67c867d1389e5c Mon Sep 17 00:00:00 2001
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Fri, 28 Feb 2025 11:54:23 +0100
+Subject: [PATCH 15/15] net: airoha: Introduce PPE debugfs support
+
+Similar to PPE support for Mediatek devices, introduce PPE debugfs
+in order to dump binded and unbinded flows.
+
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/airoha/Makefile          |   1 +
+ drivers/net/ethernet/airoha/airoha_eth.h      |  14 ++
+ drivers/net/ethernet/airoha/airoha_ppe.c      |  17 +-
+ .../net/ethernet/airoha/airoha_ppe_debugfs.c  | 181 ++++++++++++++++++
+ 4 files changed, 209 insertions(+), 4 deletions(-)
+ create mode 100644 drivers/net/ethernet/airoha/airoha_ppe_debugfs.c
+
+--- a/drivers/net/ethernet/airoha/Makefile
++++ b/drivers/net/ethernet/airoha/Makefile
+@@ -5,4 +5,5 @@
+ 
+ obj-$(CONFIG_NET_AIROHA) += airoha-eth.o
+ airoha-eth-y := airoha_eth.o airoha_ppe.o
++airoha-eth-$(CONFIG_DEBUG_FS) += airoha_ppe_debugfs.o
+ obj-$(CONFIG_NET_AIROHA_NPU) += airoha_npu.o
+--- a/drivers/net/ethernet/airoha/airoha_eth.h
++++ b/drivers/net/ethernet/airoha/airoha_eth.h
+@@ -7,6 +7,7 @@
+ #ifndef AIROHA_ETH_H
+ #define AIROHA_ETH_H
+ 
++#include <linux/debugfs.h>
+ #include <linux/etherdevice.h>
+ #include <linux/iopoll.h>
+ #include <linux/kernel.h>
+@@ -480,6 +481,8 @@ struct airoha_ppe {
+ 
+ 	struct hlist_head *foe_flow;
+ 	u16 foe_check_time[PPE_NUM_ENTRIES];
++
++	struct dentry *debugfs_dir;
+ };
+ 
+ struct airoha_eth {
+@@ -533,5 +536,16 @@ int airoha_ppe_setup_tc_block_cb(enum tc
+ 				 void *cb_priv);
+ int airoha_ppe_init(struct airoha_eth *eth);
+ void airoha_ppe_deinit(struct airoha_eth *eth);
++struct airoha_foe_entry *airoha_ppe_foe_get_entry(struct airoha_ppe *ppe,
++						  u32 hash);
++
++#if CONFIG_DEBUG_FS
++int airoha_ppe_debugfs_init(struct airoha_ppe *ppe);
++#else
++static inline int airoha_ppe_debugfs_init(struct airoha_ppe *ppe)
++{
++	return 0;
++}
++#endif
+ 
+ #endif /* AIROHA_ETH_H */
+--- a/drivers/net/ethernet/airoha/airoha_ppe.c
++++ b/drivers/net/ethernet/airoha/airoha_ppe.c
+@@ -390,8 +390,8 @@ static u32 airoha_ppe_foe_get_entry_hash
+ 	return hash;
+ }
+ 
+-static struct airoha_foe_entry *
+-airoha_ppe_foe_get_entry(struct airoha_ppe *ppe, u32 hash)
++struct airoha_foe_entry *airoha_ppe_foe_get_entry(struct airoha_ppe *ppe,
++						  u32 hash)
+ {
+ 	if (hash < PPE_SRAM_NUM_ENTRIES) {
+ 		u32 *hwe = ppe->foe + hash * sizeof(struct airoha_foe_entry);
+@@ -861,7 +861,7 @@ void airoha_ppe_check_skb(struct airoha_
+ int airoha_ppe_init(struct airoha_eth *eth)
+ {
+ 	struct airoha_ppe *ppe;
+-	int foe_size;
++	int foe_size, err;
+ 
+ 	ppe = devm_kzalloc(eth->dev, sizeof(*ppe), GFP_KERNEL);
+ 	if (!ppe)
+@@ -882,7 +882,15 @@ int airoha_ppe_init(struct airoha_eth *e
+ 	if (!ppe->foe_flow)
+ 		return -ENOMEM;
+ 
+-	return rhashtable_init(&eth->flow_table, &airoha_flow_table_params);
++	err = rhashtable_init(&eth->flow_table, &airoha_flow_table_params);
++	if (err)
++		return err;
++
++	err = airoha_ppe_debugfs_init(ppe);
++	if (err)
++		rhashtable_destroy(&eth->flow_table);
++
++	return err;
+ }
+ 
+ void airoha_ppe_deinit(struct airoha_eth *eth)
+@@ -898,4 +906,5 @@ void airoha_ppe_deinit(struct airoha_eth
+ 	rcu_read_unlock();
+ 
+ 	rhashtable_destroy(&eth->flow_table);
++	debugfs_remove(eth->ppe->debugfs_dir);
+ }
+--- /dev/null
++++ b/drivers/net/ethernet/airoha/airoha_ppe_debugfs.c
+@@ -0,0 +1,181 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Copyright (c) 2025 AIROHA Inc
++ * Author: Lorenzo Bianconi <lorenzo@kernel.org>
++ */
++
++#include "airoha_eth.h"
++
++static void airoha_debugfs_ppe_print_tuple(struct seq_file *m,
++					   void *src_addr, void *dest_addr,
++					   u16 *src_port, u16 *dest_port,
++					   bool ipv6)
++{
++	__be32 n_addr[IPV6_ADDR_WORDS];
++
++	if (ipv6) {
++		ipv6_addr_cpu_to_be32(n_addr, src_addr);
++		seq_printf(m, "%pI6", n_addr);
++	} else {
++		seq_printf(m, "%pI4h", src_addr);
++	}
++	if (src_port)
++		seq_printf(m, ":%d", *src_port);
++
++	seq_puts(m, "->");
++
++	if (ipv6) {
++		ipv6_addr_cpu_to_be32(n_addr, dest_addr);
++		seq_printf(m, "%pI6", n_addr);
++	} else {
++		seq_printf(m, "%pI4h", dest_addr);
++	}
++	if (dest_port)
++		seq_printf(m, ":%d", *dest_port);
++}
++
++static int airoha_ppe_debugfs_foe_show(struct seq_file *m, void *private,
++				       bool bind)
++{
++	static const char *const ppe_type_str[] = {
++		[PPE_PKT_TYPE_IPV4_HNAPT] = "IPv4 5T",
++		[PPE_PKT_TYPE_IPV4_ROUTE] = "IPv4 3T",
++		[PPE_PKT_TYPE_BRIDGE] = "L2B",
++		[PPE_PKT_TYPE_IPV4_DSLITE] = "DS-LITE",
++		[PPE_PKT_TYPE_IPV6_ROUTE_3T] = "IPv6 3T",
++		[PPE_PKT_TYPE_IPV6_ROUTE_5T] = "IPv6 5T",
++		[PPE_PKT_TYPE_IPV6_6RD] = "6RD",
++	};
++	static const char *const ppe_state_str[] = {
++		[AIROHA_FOE_STATE_INVALID] = "INV",
++		[AIROHA_FOE_STATE_UNBIND] = "UNB",
++		[AIROHA_FOE_STATE_BIND] = "BND",
++		[AIROHA_FOE_STATE_FIN] = "FIN",
++	};
++	struct airoha_ppe *ppe = m->private;
++	int i;
++
++	for (i = 0; i < PPE_NUM_ENTRIES; i++) {
++		const char *state_str, *type_str = "UNKNOWN";
++		void *src_addr = NULL, *dest_addr = NULL;
++		u16 *src_port = NULL, *dest_port = NULL;
++		struct airoha_foe_mac_info_common *l2;
++		unsigned char h_source[ETH_ALEN] = {};
++		unsigned char h_dest[ETH_ALEN];
++		struct airoha_foe_entry *hwe;
++		u32 type, state, ib2, data;
++		bool ipv6 = false;
++
++		hwe = airoha_ppe_foe_get_entry(ppe, i);
++		if (!hwe)
++			continue;
++
++		state = FIELD_GET(AIROHA_FOE_IB1_BIND_STATE, hwe->ib1);
++		if (!state)
++			continue;
++
++		if (bind && state != AIROHA_FOE_STATE_BIND)
++			continue;
++
++		state_str = ppe_state_str[state % ARRAY_SIZE(ppe_state_str)];
++		type = FIELD_GET(AIROHA_FOE_IB1_BIND_PACKET_TYPE, hwe->ib1);
++		if (type < ARRAY_SIZE(ppe_type_str) && ppe_type_str[type])
++			type_str = ppe_type_str[type];
++
++		seq_printf(m, "%05x %s %7s", i, state_str, type_str);
++
++		switch (type) {
++		case PPE_PKT_TYPE_IPV4_HNAPT:
++		case PPE_PKT_TYPE_IPV4_DSLITE:
++			src_port = &hwe->ipv4.orig_tuple.src_port;
++			dest_port = &hwe->ipv4.orig_tuple.dest_port;
++			fallthrough;
++		case PPE_PKT_TYPE_IPV4_ROUTE:
++			src_addr = &hwe->ipv4.orig_tuple.src_ip;
++			dest_addr = &hwe->ipv4.orig_tuple.dest_ip;
++			break;
++		case PPE_PKT_TYPE_IPV6_ROUTE_5T:
++			src_port = &hwe->ipv6.src_port;
++			dest_port = &hwe->ipv6.dest_port;
++			fallthrough;
++		case PPE_PKT_TYPE_IPV6_ROUTE_3T:
++		case PPE_PKT_TYPE_IPV6_6RD:
++			src_addr = &hwe->ipv6.src_ip;
++			dest_addr = &hwe->ipv6.dest_ip;
++			ipv6 = true;
++			break;
++		default:
++			break;
++		}
++
++		if (src_addr && dest_addr) {
++			seq_puts(m, " orig=");
++			airoha_debugfs_ppe_print_tuple(m, src_addr, dest_addr,
++						       src_port, dest_port, ipv6);
++		}
++
++		switch (type) {
++		case PPE_PKT_TYPE_IPV4_HNAPT:
++		case PPE_PKT_TYPE_IPV4_DSLITE:
++			src_port = &hwe->ipv4.new_tuple.src_port;
++			dest_port = &hwe->ipv4.new_tuple.dest_port;
++			fallthrough;
++		case PPE_PKT_TYPE_IPV4_ROUTE:
++			src_addr = &hwe->ipv4.new_tuple.src_ip;
++			dest_addr = &hwe->ipv4.new_tuple.dest_ip;
++			seq_puts(m, " new=");
++			airoha_debugfs_ppe_print_tuple(m, src_addr, dest_addr,
++						       src_port, dest_port,
++						       ipv6);
++			break;
++		default:
++			break;
++		}
++
++		if (type >= PPE_PKT_TYPE_IPV6_ROUTE_3T) {
++			data = hwe->ipv6.data;
++			ib2 = hwe->ipv6.ib2;
++			l2 = &hwe->ipv6.l2;
++		} else {
++			data = hwe->ipv4.data;
++			ib2 = hwe->ipv4.ib2;
++			l2 = &hwe->ipv4.l2.common;
++			*((__be16 *)&h_source[4]) =
++				cpu_to_be16(hwe->ipv4.l2.src_mac_lo);
++		}
++
++		*((__be32 *)h_dest) = cpu_to_be32(l2->dest_mac_hi);
++		*((__be16 *)&h_dest[4]) = cpu_to_be16(l2->dest_mac_lo);
++		*((__be32 *)h_source) = cpu_to_be32(l2->src_mac_hi);
++
++		seq_printf(m, " eth=%pM->%pM etype=%04x data=%08x"
++			      " vlan=%d,%d ib1=%08x ib2=%08x\n",
++			   h_source, h_dest, l2->etype, data,
++			   l2->vlan1, l2->vlan2, hwe->ib1, ib2);
++	}
++
++	return 0;
++}
++
++static int airoha_ppe_debugfs_foe_all_show(struct seq_file *m, void *private)
++{
++	return airoha_ppe_debugfs_foe_show(m, private, false);
++}
++DEFINE_SHOW_ATTRIBUTE(airoha_ppe_debugfs_foe_all);
++
++static int airoha_ppe_debugfs_foe_bind_show(struct seq_file *m, void *private)
++{
++	return airoha_ppe_debugfs_foe_show(m, private, true);
++}
++DEFINE_SHOW_ATTRIBUTE(airoha_ppe_debugfs_foe_bind);
++
++int airoha_ppe_debugfs_init(struct airoha_ppe *ppe)
++{
++	ppe->debugfs_dir = debugfs_create_dir("ppe", NULL);
++	debugfs_create_file("entries", 0444, ppe->debugfs_dir, ppe,
++			    &airoha_ppe_debugfs_foe_all_fops);
++	debugfs_create_file("bind", 0444, ppe->debugfs_dir, ppe,
++			    &airoha_ppe_debugfs_foe_bind_fops);
++
++	return 0;
++}
diff --git a/target/linux/airoha/patches-6.6/100-cpufreq-airoha-Add-EN7581-Cpufreq-SMC-driver.patch b/target/linux/airoha/patches-6.6/100-cpufreq-airoha-Add-EN7581-Cpufreq-SMC-driver.patch
deleted file mode 100644
index 0276a4ee8114cb..00000000000000
--- a/target/linux/airoha/patches-6.6/100-cpufreq-airoha-Add-EN7581-Cpufreq-SMC-driver.patch
+++ /dev/null
@@ -1,247 +0,0 @@
-From 5296da64f77ef6c809b715cdecf308977a08acb9 Mon Sep 17 00:00:00 2001
-From: Christian Marangi <ansuelsmth@gmail.com>
-Date: Wed, 16 Oct 2024 18:00:57 +0200
-Subject: [PATCH] cpufreq: airoha: Add EN7581 Cpufreq SMC driver
-
-Add simple Cpufreq driver for Airoha EN7581 SoC that control CPU
-frequency scaling with SMC APIs.
-
-All CPU share the same frequency and can't be controlled independently.
-Current shared CPU frequency is returned by the related SMC command.
-
-Add SoC compatible to cpufreq-dt-plat block list as a dedicated cpufreq
-driver is needed with OPP v2 nodes declared in DTS.
-
-Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
----
- drivers/cpufreq/Kconfig.arm          |   8 ++
- drivers/cpufreq/Makefile             |   1 +
- drivers/cpufreq/airoha-cpufreq.c     | 183 +++++++++++++++++++++++++++
- drivers/cpufreq/cpufreq-dt-platdev.c |   2 +
- 4 files changed, 194 insertions(+)
- create mode 100644 drivers/cpufreq/airoha-cpufreq.c
-
---- a/drivers/cpufreq/Kconfig.arm
-+++ b/drivers/cpufreq/Kconfig.arm
-@@ -41,6 +41,14 @@ config ARM_ALLWINNER_SUN50I_CPUFREQ_NVME
- 	  To compile this driver as a module, choose M here: the
- 	  module will be called sun50i-cpufreq-nvmem.
- 
-+config ARM_AIROHA_SOC_CPUFREQ
-+	tristate "Airoha EN7581 SoC CPUFreq support"
-+	depends on ARCH_AIROHA || COMPILE_TEST
-+	select PM_OPP
-+	default ARCH_AIROHA
-+	help
-+	  This adds the CPUFreq driver for Airoha EN7581 SoCs.
-+
- config ARM_APPLE_SOC_CPUFREQ
- 	tristate "Apple Silicon SoC CPUFreq support"
- 	depends on ARCH_APPLE || (COMPILE_TEST && 64BIT)
---- a/drivers/cpufreq/Makefile
-+++ b/drivers/cpufreq/Makefile
-@@ -52,6 +52,7 @@ obj-$(CONFIG_X86_AMD_FREQ_SENSITIVITY)	+
- 
- ##################################################################################
- # ARM SoC drivers
-+obj-$(CONFIG_ARM_AIROHA_SOC_CPUFREQ)	+= airoha-cpufreq.o
- obj-$(CONFIG_ARM_APPLE_SOC_CPUFREQ)	+= apple-soc-cpufreq.o
- obj-$(CONFIG_ARM_ARMADA_37XX_CPUFREQ)	+= armada-37xx-cpufreq.o
- obj-$(CONFIG_ARM_ARMADA_8K_CPUFREQ)	+= armada-8k-cpufreq.o
---- /dev/null
-+++ b/drivers/cpufreq/airoha-cpufreq.c
-@@ -0,0 +1,183 @@
-+// SPDX-License-Identifier: GPL-2.0
-+
-+#include <linux/cpufreq.h>
-+#include <linux/module.h>
-+#include <linux/arm-smccc.h>
-+
-+#define AIROHA_SIP_AVS_HANDLE			0x82000301
-+#define AIROHA_AVS_OP_BASE			0xddddddd0
-+#define AIROHA_AVS_OP_MASK			GENMASK(1, 0)
-+#define AIROHA_AVS_OP_FREQ_DYN_ADJ		(AIROHA_AVS_OP_BASE | \
-+						 FIELD_PREP(AIROHA_AVS_OP_MASK, 0x1))
-+#define AIROHA_AVS_OP_GET_FREQ			(AIROHA_AVS_OP_BASE | \
-+						 FIELD_PREP(AIROHA_AVS_OP_MASK, 0x2))
-+
-+struct airoha_cpufreq_priv {
-+	struct list_head list;
-+
-+	cpumask_var_t cpus;
-+	struct device *cpu_dev;
-+	struct cpufreq_frequency_table *freq_table;
-+};
-+
-+static LIST_HEAD(priv_list);
-+
-+static unsigned int airoha_cpufreq_get(unsigned int cpu)
-+{
-+	const struct arm_smccc_1_2_regs args = {
-+		.a0 = AIROHA_SIP_AVS_HANDLE,
-+		.a1 = AIROHA_AVS_OP_GET_FREQ,
-+	};
-+	struct arm_smccc_1_2_regs res;
-+
-+	arm_smccc_1_2_smc(&args, &res);
-+
-+	return (int)(res.a0 * 1000);
-+}
-+
-+static int airoha_cpufreq_set_target(struct cpufreq_policy *policy, unsigned int index)
-+{
-+	const struct arm_smccc_1_2_regs args = {
-+		.a0 = AIROHA_SIP_AVS_HANDLE,
-+		.a1 = AIROHA_AVS_OP_FREQ_DYN_ADJ,
-+		.a3 = index,
-+	};
-+	struct arm_smccc_1_2_regs res;
-+
-+	arm_smccc_1_2_smc(&args, &res);
-+
-+	/* SMC signal correct apply by unsetting BIT 0 */
-+	return res.a0 & BIT(0) ? -EINVAL : 0;
-+}
-+
-+static struct airoha_cpufreq_priv *airoha_cpufreq_find_data(int cpu)
-+{
-+	struct airoha_cpufreq_priv *priv;
-+
-+	list_for_each_entry(priv, &priv_list, list) {
-+		if (cpumask_test_cpu(cpu, priv->cpus))
-+			return priv;
-+	}
-+
-+	return NULL;
-+}
-+
-+static int airoha_cpufreq_init(struct cpufreq_policy *policy)
-+{
-+	struct airoha_cpufreq_priv *priv;
-+	struct device *cpu_dev;
-+
-+	priv = airoha_cpufreq_find_data(policy->cpu);
-+	if (!priv)
-+		return -ENODEV;
-+
-+	cpu_dev = priv->cpu_dev;
-+	cpumask_copy(policy->cpus, priv->cpus);
-+	policy->driver_data = priv;
-+	policy->freq_table = priv->freq_table;
-+
-+	return 0;
-+}
-+
-+static struct cpufreq_driver airoha_cpufreq_driver = {
-+	.flags		= CPUFREQ_NEED_INITIAL_FREQ_CHECK |
-+			  CPUFREQ_IS_COOLING_DEV,
-+	.verify		= cpufreq_generic_frequency_table_verify,
-+	.target_index	= airoha_cpufreq_set_target,
-+	.get		= airoha_cpufreq_get,
-+	.init		= airoha_cpufreq_init,
-+	.attr		= cpufreq_generic_attr,
-+	.name		= "airoha-cpufreq",
-+};
-+
-+static int airoha_cpufreq_driver_init_cpu(int cpu)
-+{
-+	struct airoha_cpufreq_priv *priv;
-+	struct device *cpu_dev;
-+	int ret;
-+
-+	cpu_dev = get_cpu_device(cpu);
-+	if (!cpu_dev)
-+		return -EPROBE_DEFER;
-+
-+	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
-+	if (!priv)
-+		return -ENOMEM;
-+
-+	if (!zalloc_cpumask_var(&priv->cpus, GFP_KERNEL))
-+		return -ENOMEM;
-+
-+	cpumask_set_cpu(cpu, priv->cpus);
-+	priv->cpu_dev = cpu_dev;
-+
-+	ret = dev_pm_opp_of_get_sharing_cpus(cpu_dev, priv->cpus);
-+	if (ret)
-+		goto err;
-+
-+	ret = dev_pm_opp_of_cpumask_add_table(priv->cpus);
-+	if (ret)
-+		goto err;
-+
-+	ret = dev_pm_opp_init_cpufreq_table(cpu_dev, &priv->freq_table);
-+	if (ret)
-+		goto err;
-+
-+	list_add(&priv->list, &priv_list);
-+
-+	return 0;
-+
-+err:
-+	dev_pm_opp_of_cpumask_remove_table(priv->cpus);
-+	free_cpumask_var(priv->cpus);
-+
-+	return ret;
-+}
-+
-+static void airoha_cpufreq_release(void)
-+{
-+	struct airoha_cpufreq_priv *priv, *tmp;
-+
-+	list_for_each_entry_safe(priv, tmp, &priv_list, list) {
-+		dev_pm_opp_free_cpufreq_table(priv->cpu_dev, &priv->freq_table);
-+		dev_pm_opp_of_cpumask_remove_table(priv->cpus);
-+		free_cpumask_var(priv->cpus);
-+		list_del(&priv->list);
-+		kfree(priv);
-+	}
-+}
-+
-+static int __init airoha_cpufreq_driver_probe(void)
-+{
-+	int cpu, ret;
-+
-+	if (!of_machine_is_compatible("airoha,en7581"))
-+		return -ENODEV;
-+
-+	for_each_possible_cpu(cpu) {
-+		ret = airoha_cpufreq_driver_init_cpu(cpu);
-+		if (ret)
-+			goto err;
-+	}
-+
-+	ret = cpufreq_register_driver(&airoha_cpufreq_driver);
-+	if (ret)
-+		goto err;
-+
-+	return 0;
-+
-+err:
-+	airoha_cpufreq_release();
-+	return ret;
-+}
-+module_init(airoha_cpufreq_driver_probe);
-+
-+static void __exit airoha_cpufreq_driver_remove(void)
-+{
-+	cpufreq_unregister_driver(&airoha_cpufreq_driver);
-+	airoha_cpufreq_release();
-+}
-+module_exit(airoha_cpufreq_driver_remove);
-+
-+MODULE_AUTHOR("Christian Marangi <ansuelsmth@gmail.com>");
-+MODULE_DESCRIPTION("CPUfreq driver for Airoha SoCs");
-+MODULE_LICENSE("GPL");
---- a/drivers/cpufreq/cpufreq-dt-platdev.c
-+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
-@@ -103,6 +103,8 @@ static const struct of_device_id allowli
-  * platforms using "operating-points-v2" property.
-  */
- static const struct of_device_id blocklist[] __initconst = {
-+	{ .compatible = "airoha,en7581", },
-+
- 	{ .compatible = "allwinner,sun50i-h6", },
- 
- 	{ .compatible = "apple,arm-platform", },
diff --git a/target/linux/airoha/patches-6.6/101-01-thermal-of-Add-devm_thermal_of_zone_register_with_pa.patch b/target/linux/airoha/patches-6.6/101-01-thermal-of-Add-devm_thermal_of_zone_register_with_pa.patch
index e69f57d27309c0..d646e05170368a 100644
--- a/target/linux/airoha/patches-6.6/101-01-thermal-of-Add-devm_thermal_of_zone_register_with_pa.patch
+++ b/target/linux/airoha/patches-6.6/101-01-thermal-of-Add-devm_thermal_of_zone_register_with_pa.patch
@@ -40,7 +40,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 
 --- a/drivers/thermal/thermal_of.c
 +++ b/drivers/thermal/thermal_of.c
-@@ -249,7 +249,7 @@ static void thermal_of_parameters_init(s
+@@ -246,7 +246,7 @@ static void thermal_of_parameters_init(s
  {
  	int coef[2];
  	int ncoef = ARRAY_SIZE(coef);
@@ -49,7 +49,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
  
  	tzp->no_hwmon = true;
  
-@@ -261,14 +261,11 @@ static void thermal_of_parameters_init(s
+@@ -258,14 +258,11 @@ static void thermal_of_parameters_init(s
  	 * thermal zone. Thus, we are considering only the first two
  	 * values as slope and offset.
  	 */
@@ -67,7 +67,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
  }
  
  static struct device_node *thermal_of_zone_get_by_name(struct thermal_zone_device *tz)
-@@ -462,10 +459,15 @@ static void thermal_of_zone_unregister(s
+@@ -459,10 +456,15 @@ static void thermal_of_zone_unregister(s
   * zone properties and registers new thermal zone with those
   * properties.
   *
@@ -83,7 +83,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
   *
   * Return: a valid thermal zone structure pointer on success.
   * 	- EINVAL: if the device tree thermal description is malformed
-@@ -473,11 +475,11 @@ static void thermal_of_zone_unregister(s
+@@ -470,11 +472,11 @@ static void thermal_of_zone_unregister(s
   *	- Other negative errors are returned by the underlying called functions
   */
  static struct thermal_zone_device *thermal_of_zone_register(struct device_node *sensor, int id, void *data,
@@ -181,7 +181,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
   * @dev: Device for which which resource was allocated.
 --- a/include/linux/thermal.h
 +++ b/include/linux/thermal.h
-@@ -261,6 +261,10 @@ struct thermal_zone_params {
+@@ -263,6 +263,10 @@ struct thermal_zone_params {
  #ifdef CONFIG_THERMAL_OF
  struct thermal_zone_device *devm_thermal_of_zone_register(struct device *dev, int id, void *data,
  							  const struct thermal_zone_device_ops *ops);
@@ -192,7 +192,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
  
  void devm_thermal_of_zone_unregister(struct device *dev, struct thermal_zone_device *tz);
  
-@@ -272,6 +276,15 @@ struct thermal_zone_device *devm_thermal
+@@ -274,6 +278,15 @@ struct thermal_zone_device *devm_thermal
  {
  	return ERR_PTR(-ENOTSUPP);
  }
diff --git a/target/linux/airoha/patches-6.6/105-uart-add-en7523-support.patch b/target/linux/airoha/patches-6.6/105-uart-add-en7523-support.patch
index 38611b907ce982..9ea355370bbd45 100644
--- a/target/linux/airoha/patches-6.6/105-uart-add-en7523-support.patch
+++ b/target/linux/airoha/patches-6.6/105-uart-add-en7523-support.patch
@@ -122,7 +122,7 @@
  };
  
  /* Uart divisor latch read */
-@@ -2880,6 +2888,12 @@ serial8250_do_set_termios(struct uart_po
+@@ -2888,6 +2896,12 @@ serial8250_do_set_termios(struct uart_po
  
  	serial8250_set_divisor(port, baud, quot, frac);
  
diff --git a/target/linux/airoha/patches-6.6/108-pwm-airoha-Add-support-for-EN7581-SoC.patch b/target/linux/airoha/patches-6.6/108-pwm-airoha-Add-support-for-EN7581-SoC.patch
index 8f83c696c4f558..0b114d5f53b6fe 100644
--- a/target/linux/airoha/patches-6.6/108-pwm-airoha-Add-support-for-EN7581-SoC.patch
+++ b/target/linux/airoha/patches-6.6/108-pwm-airoha-Add-support-for-EN7581-SoC.patch
@@ -48,7 +48,7 @@ Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
  obj-$(CONFIG_PWM_ATMEL_HLCDC_PWM)	+= pwm-atmel-hlcdc.o
 --- /dev/null
 +++ b/drivers/pwm/pwm-airoha.c
-@@ -0,0 +1,400 @@
+@@ -0,0 +1,388 @@
 +// SPDX-License-Identifier: GPL-2.0
 +/*
 + * Copyright 2022 Markus Gothe <markus.gothe@genexis.eu>
@@ -414,18 +414,7 @@ Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
 +	if (IS_ERR(pc->regmap))
 +		return PTR_ERR(pc->regmap);
 +
-+	platform_set_drvdata(pdev, pc);
-+
-+	return pwmchip_add(&pc->chip);
-+}
-+
-+static int airoha_pwm_remove(struct platform_device *pdev)
-+{
-+	struct airoha_pwm *pc = platform_get_drvdata(pdev);
-+
-+	pwmchip_remove(&pc->chip);
-+
-+	return 0;
++	return devm_pwmchip_add(&pdev->dev, &pc->chip);
 +}
 +
 +static const struct of_device_id airoha_pwm_of_match[] = {
@@ -440,7 +429,6 @@ Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
 +		.of_match_table = airoha_pwm_of_match,
 +	},
 +	.probe = airoha_pwm_probe,
-+	.remove = airoha_pwm_remove,
 +};
 +module_platform_driver(airoha_pwm_driver);
 +
diff --git a/target/linux/airoha/patches-6.6/113-net-airoha-Fix-channel-configuration-for-ETS-Qdisc.patch b/target/linux/airoha/patches-6.6/113-net-airoha-Fix-channel-configuration-for-ETS-Qdisc.patch
new file mode 100644
index 00000000000000..21896d7fa998a5
--- /dev/null
+++ b/target/linux/airoha/patches-6.6/113-net-airoha-Fix-channel-configuration-for-ETS-Qdisc.patch
@@ -0,0 +1,104 @@
+From patchwork Tue Jan  7 22:26:28 2025
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Lorenzo Bianconi <lorenzo@kernel.org>
+X-Patchwork-Id: 13929634
+X-Patchwork-Delegate: kuba@kernel.org
+Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org
+ [10.30.226.201])
+	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
+	(No client certificate requested)
+	by smtp.subspace.kernel.org (Postfix) with ESMTPS id A82271A3035
+	for <netdev@vger.kernel.org>; Tue,  7 Jan 2025 22:27:02 +0000 (UTC)
+Authentication-Results: smtp.subspace.kernel.org;
+ arc=none smtp.client-ip=10.30.226.201
+ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
+	t=1736288822; cv=none;
+ b=XZhiaYPBxLiUvOxWeE7zfuFI3fOmu5SLoHdLPFXNXBtvmZWWIohKA8AeGI37v/l+0Du9JwGRKMkb19v/IxDJtMXkyTJXHHKYhXWaNFpj/pFRk9C4WsIa29OCqanfA+yXUQLJyGVopMLsxfcbzznozIANWbaO0NVBHyZZSH9eaYU=
+ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org;
+	s=arc-20240116; t=1736288822; c=relaxed/simple;
+	bh=/BuvRwLGk+7by7QeOu7n+QgJ5Sk03TO9WCsGbgTs3sE=;
+	h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc;
+ b=jHXwJfD+6o5WvM5xaeL35BI6hshOViNtg+mSqf5q8jH9l3k6FctngCkEYdxJzcYaw9aEEigC8/FZiHoPrIXGyJA29kTWkYSjj7rtagL1aSIWPGAuSJaaAUv2Bj8jxUmIlJxb23wTleEv/Pwnz+1oSf3yZ7g46h9gv4RZaU8yySg=
+ARC-Authentication-Results: i=1; smtp.subspace.kernel.org;
+ dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org
+ header.b=Gx3FMrdJ; arc=none smtp.client-ip=10.30.226.201
+Authentication-Results: smtp.subspace.kernel.org;
+	dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org
+ header.b="Gx3FMrdJ"
+Received: by smtp.kernel.org (Postfix) with ESMTPSA id E1A57C4CED6;
+	Tue,  7 Jan 2025 22:27:01 +0000 (UTC)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;
+	s=k20201202; t=1736288822;
+	bh=/BuvRwLGk+7by7QeOu7n+QgJ5Sk03TO9WCsGbgTs3sE=;
+	h=From:Date:Subject:To:Cc:From;
+	b=Gx3FMrdJH+xaen2jSRnu523A40ZOBBFaj896IwBv1PeosUm+eiUCx+K3Qz9CAisX0
+	 Bj4ohheTiHZDQHZelhKF3ZFTfVQUyYiLiard4x5QdylW2YZA0cpwJe64TMf7CsHbrT
+	 NHCF7nrJPJUwOhDoS/YVdeTw/bb9DlM95aKGSfyH0cy7Kdmjz55No3Im9bCSKcgyaX
+	 Y/lcRZglFjbLyiC3LS06AtM0KOyhUxQKrH+ZWpx5E/sdOEj3SRTJ/I+K8o3m75Kzsn
+	 wKRft5pBwfhGEIrJXrFR4f73QwnxJ6eSUrfjYV8k4mFQpH3nB0hKLi2DpvYPim5dj/
+	 ADsdcP6QPwokg==
+From: Lorenzo Bianconi <lorenzo@kernel.org>
+Date: Tue, 07 Jan 2025 23:26:28 +0100
+Subject: [PATCH net-next] net: airoha: Fix channel configuration for ETS
+ Qdisc
+Precedence: bulk
+X-Mailing-List: netdev@vger.kernel.org
+List-Id: <netdev.vger.kernel.org>
+List-Subscribe: <mailto:netdev+subscribe@vger.kernel.org>
+List-Unsubscribe: <mailto:netdev+unsubscribe@vger.kernel.org>
+MIME-Version: 1.0
+Message-Id: <20250107-airoha-ets-fix-chan-v1-1-97f66ed3a068@kernel.org>
+X-B4-Tracking: v=1; b=H4sIABOqfWcC/x2MSwqAMAwFryJZG6ifVvAq4qLUaLNRaUSE0rsbX
+ Q5v3mQQSkwCY5Uh0c3Cx67Q1BWE6PeNkBdlaE1rTWMG9JyO6JEuwZUf/CSkzobgw+AW14M+z0S
+ 6/dVpLuUFNrlCSGUAAAA=
+X-Change-ID: 20250107-airoha-ets-fix-chan-e35ccac76d64
+To: Felix Fietkau <nbd@nbd.name>, Sean Wang <sean.wang@mediatek.com>,
+ Mark Lee <Mark-MC.Lee@mediatek.com>, Andrew Lunn <andrew+netdev@lunn.ch>,
+ "David S. Miller" <davem@davemloft.net>, Eric Dumazet <edumazet@google.com>,
+ Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
+ Matthias Brugger <matthias.bgg@gmail.com>,
+ AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Cc: linux-arm-kernel@lists.infradead.org,
+ linux-mediatek@lists.infradead.org, netdev@vger.kernel.org,
+ Lorenzo Bianconi <lorenzo@kernel.org>
+X-Mailer: b4 0.14.2
+X-Patchwork-Delegate: kuba@kernel.org
+
+Limit ETS QoS channel to AIROHA_NUM_QOS_CHANNELS in
+airoha_tc_setup_qdisc_ets() in order to align the configured channel to
+the value set in airoha_dev_select_queue().
+
+Fixes: 20bf7d07c956 ("net: airoha: Add sched ETS offload support")
+Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+---
+ drivers/net/ethernet/mediatek/airoha_eth.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+
+---
+base-commit: a1942da8a38717ddd9b4c132f59e1657c85c1432
+change-id: 20250107-airoha-ets-fix-chan-e35ccac76d64
+
+Best regards,
+
+--- a/drivers/net/ethernet/airoha/airoha_eth.c
++++ b/drivers/net/ethernet/airoha/airoha_eth.c
+@@ -2064,11 +2064,14 @@ static int airoha_qdma_get_tx_ets_stats(
+ static int airoha_tc_setup_qdisc_ets(struct airoha_gdm_port *port,
+ 				     struct tc_ets_qopt_offload *opt)
+ {
+-	int channel = TC_H_MAJ(opt->handle) >> 16;
++	int channel;
+ 
+ 	if (opt->parent == TC_H_ROOT)
+ 		return -EINVAL;
+ 
++	channel = TC_H_MAJ(opt->handle) >> 16;
++	channel = channel % AIROHA_NUM_QOS_CHANNELS;
++
+ 	switch (opt->command) {
+ 	case TC_ETS_REPLACE:
+ 		return airoha_qdma_set_tx_ets_sched(port, channel, opt);
diff --git a/target/linux/airoha/patches-6.6/200-spinlock-extend-guard-with-spinlock_bh-variants.patch b/target/linux/airoha/patches-6.6/200-spinlock-extend-guard-with-spinlock_bh-variants.patch
index e613b69f81f304..d4905d5fff6fa1 100644
--- a/target/linux/airoha/patches-6.6/200-spinlock-extend-guard-with-spinlock_bh-variants.patch
+++ b/target/linux/airoha/patches-6.6/200-spinlock-extend-guard-with-spinlock_bh-variants.patch
@@ -12,9 +12,9 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 
 --- a/include/linux/spinlock.h
 +++ b/include/linux/spinlock.h
-@@ -515,6 +515,10 @@ DEFINE_LOCK_GUARD_1(raw_spinlock_irq, ra
- 		    raw_spin_lock_irq(_T->lock),
- 		    raw_spin_unlock_irq(_T->lock))
+@@ -519,6 +519,10 @@ DEFINE_LOCK_GUARD_1(raw_spinlock_irq, ra
+ 
+ DEFINE_LOCK_GUARD_1_COND(raw_spinlock_irq, _try, raw_spin_trylock_irq(_T->lock))
  
 +DEFINE_LOCK_GUARD_1(raw_spinlock_bh, raw_spinlock_t,
 +		    raw_spin_lock_bh(_T->lock),
@@ -23,9 +23,9 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
  DEFINE_LOCK_GUARD_1(raw_spinlock_irqsave, raw_spinlock_t,
  		    raw_spin_lock_irqsave(_T->lock, _T->flags),
  		    raw_spin_unlock_irqrestore(_T->lock, _T->flags),
-@@ -528,6 +532,10 @@ DEFINE_LOCK_GUARD_1(spinlock_irq, spinlo
- 		    spin_lock_irq(_T->lock),
- 		    spin_unlock_irq(_T->lock))
+@@ -540,6 +544,10 @@ DEFINE_LOCK_GUARD_1(spinlock_irq, spinlo
+ DEFINE_LOCK_GUARD_1_COND(spinlock_irq, _try,
+ 			 spin_trylock_irq(_T->lock))
  
 +DEFINE_LOCK_GUARD_1(spinlock_bh, spinlock_t,
 +		    spin_lock_bh(_T->lock),
diff --git a/target/linux/airoha/patches-6.6/901-snand-mtk-bmt-support.patch b/target/linux/airoha/patches-6.6/901-snand-mtk-bmt-support.patch
index de8e8806433c60..90619d971ea406 100644
--- a/target/linux/airoha/patches-6.6/901-snand-mtk-bmt-support.patch
+++ b/target/linux/airoha/patches-6.6/901-snand-mtk-bmt-support.patch
@@ -8,7 +8,7 @@
  
  static int spinand_read_reg_op(struct spinand_device *spinand, u8 reg, u8 *val)
  {
-@@ -1346,6 +1347,7 @@ static int spinand_probe(struct spi_mem
+@@ -1352,6 +1353,7 @@ static int spinand_probe(struct spi_mem
  	if (ret)
  		return ret;
  
@@ -16,7 +16,7 @@
  	ret = mtd_device_register(mtd, NULL, 0);
  	if (ret)
  		goto err_spinand_cleanup;
-@@ -1353,6 +1355,7 @@ static int spinand_probe(struct spi_mem
+@@ -1359,6 +1361,7 @@ static int spinand_probe(struct spi_mem
  	return 0;
  
  err_spinand_cleanup:
@@ -24,7 +24,7 @@
  	spinand_cleanup(spinand);
  
  	return ret;
-@@ -1371,6 +1374,7 @@ static int spinand_remove(struct spi_mem
+@@ -1377,6 +1380,7 @@ static int spinand_remove(struct spi_mem
  	if (ret)
  		return ret;
  
diff --git a/target/linux/airoha/patches-6.6/902-mtd-parser-add-support-for-Airoha-parser.patch b/target/linux/airoha/patches-6.6/902-mtd-parser-add-support-for-Airoha-parser.patch
deleted file mode 100644
index 590d0d9faa26d4..00000000000000
--- a/target/linux/airoha/patches-6.6/902-mtd-parser-add-support-for-Airoha-parser.patch
+++ /dev/null
@@ -1,170 +0,0 @@
-From ca46c5834ba3a74595a93d7a491fa9c943be7c30 Mon Sep 17 00:00:00 2001
-From: Christian Marangi <ansuelsmth@gmail.com>
-Date: Sun, 28 Jul 2024 12:15:53 +0200
-Subject: [PATCH 3/3] mtd: parser: add support for Airoha parser
-
-Add support for Airoha parser based on a post parse ofpart function.
-
-Airoha partition table follow normal fixed-partition implementation
-with a special implementation for the ART partition. This is always the
-past partition and is placed from the end of the flash - the partition
-size.
-
-To enable this special implementation for ART partition, the relevant
-node require the "airoha,dynamic-art" compatible. With that declared,
-offset value is ignored and real offset is updated with the calculated
-value.
-
-Due to usage of specific bad block management driver, the MTD size might
-vary hence the ART partition offset needs to be dynamically parsed and
-can't be declared statically.
-
-Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
----
- drivers/mtd/parsers/Kconfig         | 10 ++++++
- drivers/mtd/parsers/Makefile        |  1 +
- drivers/mtd/parsers/ofpart_airoha.c | 56 +++++++++++++++++++++++++++++
- drivers/mtd/parsers/ofpart_airoha.h | 18 ++++++++++
- drivers/mtd/parsers/ofpart_core.c   |  6 ++++
- 5 files changed, 91 insertions(+)
- create mode 100644 drivers/mtd/parsers/ofpart_airoha.c
- create mode 100644 drivers/mtd/parsers/ofpart_airoha.h
-
---- a/drivers/mtd/parsers/Kconfig
-+++ b/drivers/mtd/parsers/Kconfig
-@@ -93,6 +93,16 @@ config MTD_OF_PARTS
- 	  flash memory node, as described in
- 	  Documentation/devicetree/bindings/mtd/mtd.yaml.
- 
-+config MTD_OF_PARTS_AIROHA
-+	bool "Airoha EN7815 partitioning support"
-+	depends on MTD_OF_PARTS && (ARCH_AIROHA || COMPILE_TEST)
-+	default ARCH_AIROHA
-+	help
-+	  This provides partitions parser for Airoha EN7815 family devices
-+	  that can have dynamic "ART" partition at the end of the flash.
-+	  It takes care of finding the correct offset and update property
-+	  with it.
-+
- config MTD_OF_PARTS_BCM4908
- 	bool "BCM4908 partitioning support"
- 	depends on MTD_OF_PARTS && (ARCH_BCMBCA || COMPILE_TEST)
---- a/drivers/mtd/parsers/Makefile
-+++ b/drivers/mtd/parsers/Makefile
-@@ -7,6 +7,7 @@ obj-$(CONFIG_MTD_CMDLINE_PARTS)		+= cmdl
- obj-$(CONFIG_MTD_MYLOADER_PARTS)		+= myloader.o
- obj-$(CONFIG_MTD_OF_PARTS)		+= ofpart.o
- ofpart-y				+= ofpart_core.o
-+ofpart-$(CONFIG_MTD_OF_PARTS_AIROHA)	+= ofpart_airoha.o
- ofpart-$(CONFIG_MTD_OF_PARTS_BCM4908)	+= ofpart_bcm4908.o
- ofpart-$(CONFIG_MTD_OF_PARTS_LINKSYS_NS)+= ofpart_linksys_ns.o
- obj-$(CONFIG_MTD_PARSER_IMAGETAG)	+= parser_imagetag.o
---- /dev/null
-+++ b/drivers/mtd/parsers/ofpart_airoha.c
-@@ -0,0 +1,56 @@
-+// SPDX-License-Identifier: GPL-2.0
-+/*
-+ * Copyright (C) 2024 Christian Marangi <ansuelsmth@gmail.com>
-+ */
-+
-+#include <linux/mtd/mtd.h>
-+#include <linux/mtd/partitions.h>
-+
-+#include "ofpart_airoha.h"
-+
-+int airoha_partitions_post_parse(struct mtd_info *mtd,
-+				 struct mtd_partition *parts,
-+				 int nr_parts)
-+{
-+	struct mtd_partition *part;
-+	int len, a_cells, s_cells;
-+	struct device_node *pp;
-+	struct property *prop;
-+	const __be32 *reg;
-+	__be32 *new_reg;
-+
-+	part = &parts[nr_parts - 1];
-+	pp = part->of_node;
-+
-+	/* Skip if ART partition have a valid offset instead of a dynamic one */
-+	if (!of_device_is_compatible(pp, "airoha,dynamic-art"))
-+		return 0;
-+
-+	/* ART partition is set at the end of flash - size */
-+	part->offset = mtd->size - part->size;
-+
-+	/* Update the offset with the new calculate value in DT */
-+	prop = kzalloc(sizeof(*prop), GFP_KERNEL);
-+	if (!prop)
-+		return -ENOMEM;
-+
-+	/* Reg already validated by fixed-partition parser */
-+	reg = of_get_property(pp, "reg", &len);
-+
-+	/* Fixed partition */
-+	a_cells = of_n_addr_cells(pp);
-+	s_cells = of_n_size_cells(pp);
-+
-+	prop->name = "reg";
-+	prop->length = (a_cells + s_cells) * sizeof(__be32);
-+	prop->value = kmemdup(reg, (a_cells + s_cells) * sizeof(__be32),
-+			      GFP_KERNEL);
-+	new_reg = prop->value;
-+	memset(new_reg, 0, a_cells * sizeof(__be32));
-+	new_reg[a_cells - 1] = cpu_to_be32(part->offset);
-+	if (a_cells > 1)
-+		new_reg[0] = cpu_to_be32(part->offset >> 32);
-+	of_update_property(pp, prop);
-+
-+	return 0;
-+}
---- /dev/null
-+++ b/drivers/mtd/parsers/ofpart_airoha.h
-@@ -0,0 +1,18 @@
-+/* SPDX-License-Identifier: GPL-2.0 */
-+#ifndef __OFPART_AIROHA_H
-+#define __OFPART_AIROHA_H
-+
-+#ifdef CONFIG_MTD_OF_PARTS_AIROHA
-+int airoha_partitions_post_parse(struct mtd_info *mtd,
-+				 struct mtd_partition *parts,
-+				 int nr_parts);
-+#else
-+static inline int airoha_partitions_post_parse(struct mtd_info *mtd,
-+					       struct mtd_partition *parts,
-+					       int nr_parts)
-+{
-+	return -EOPNOTSUPP;
-+}
-+#endif
-+
-+#endif
---- a/drivers/mtd/parsers/ofpart_core.c
-+++ b/drivers/mtd/parsers/ofpart_core.c
-@@ -16,6 +16,7 @@
- #include <linux/slab.h>
- #include <linux/mtd/partitions.h>
- 
-+#include "ofpart_airoha.h"
- #include "ofpart_bcm4908.h"
- #include "ofpart_linksys_ns.h"
- 
-@@ -23,6 +24,10 @@ struct fixed_partitions_quirks {
- 	int (*post_parse)(struct mtd_info *mtd, struct mtd_partition *parts, int nr_parts);
- };
- 
-+static struct fixed_partitions_quirks airoha_partitions_quirks = {
-+	.post_parse = airoha_partitions_post_parse,
-+};
-+
- static struct fixed_partitions_quirks bcm4908_partitions_quirks = {
- 	.post_parse = bcm4908_partitions_post_parse,
- };
-@@ -192,6 +197,7 @@ static const struct of_device_id parse_o
- 	/* Generic */
- 	{ .compatible = "fixed-partitions" },
- 	/* Customized */
-+	{ .compatible = "airoha,fixed-partitions", .data = &airoha_partitions_quirks, },
- 	{ .compatible = "brcm,bcm4908-partitions", .data = &bcm4908_partitions_quirks, },
- 	{ .compatible = "linksys,ns-partitions", .data = &linksys_ns_partitions_quirks, },
- 	{},
diff --git a/target/linux/apm821xx/base-files/etc/uci-defaults/05_fix-compat-version b/target/linux/apm821xx/base-files/etc/uci-defaults/05_fix-compat-version
index 00d3954e5f481b..11af63c9e7ce28 100644
--- a/target/linux/apm821xx/base-files/etc/uci-defaults/05_fix-compat-version
+++ b/target/linux/apm821xx/base-files/etc/uci-defaults/05_fix-compat-version
@@ -2,12 +2,15 @@
 
 case "$(board_name)" in
 meraki,mx60|\
-netgear,wndap620|\
-netgear,wndap660|\
 netgear,wndr4700)
 	uci set system.@system[0].compat_version="3.0"
 	uci commit system
 	;;
+netgear,wndap620|\
+netgear,wndap660)
+	uci set system.@system[0].compat_version="2.0"
+	uci commit system
+	;;
 esac
 
 exit 0
diff --git a/target/linux/apm821xx/config-6.6 b/target/linux/apm821xx/config-6.6
index 33e586632cd762..a9c9a952c8c50b 100644
--- a/target/linux/apm821xx/config-6.6
+++ b/target/linux/apm821xx/config-6.6
@@ -34,8 +34,6 @@ CONFIG_BOOKE=y
 CONFIG_BOOKE_OR_40x=y
 CONFIG_BOOKE_WDT=y
 # CONFIG_CANYONLANDS is not set
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CMDLINE="rootfstype=squashfs noinitrd"
 CONFIG_CMDLINE_FROM_BOOTLOADER=y
@@ -83,7 +81,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_BUG=y
diff --git a/target/linux/apm821xx/image/nand.mk b/target/linux/apm821xx/image/nand.mk
index 92bdaa87d03372..7b3945183e5baf 100644
--- a/target/linux/apm821xx/image/nand.mk
+++ b/target/linux/apm821xx/image/nand.mk
@@ -89,9 +89,6 @@ endef
 TARGET_DEVICES += netgear_wndap660
 
 define Device/netgear_wndr4700
-  DEVICE_COMPAT_VERSION := 3.0
-  DEVICE_COMPAT_MESSAGE := Network swconfig configuration cannot be upgraded to DSA. \
-       Upgrade via sysupgrade mechanism is not possible.
   DEVICE_VENDOR := NETGEAR
   DEVICE_MODEL := Centria N900 WNDR4700
   DEVICE_ALT0_VENDOR := NETGEAR
@@ -123,8 +120,9 @@ define Device/netgear_wndr4700
   NETGEAR_HW_ID := 29763875+128+256
   UBINIZE_OPTS := -E 5
   SUPPORTED_DEVICES += wndr4700
-  DEVICE_COMPAT_VERSION := 2.0
+  DEVICE_COMPAT_VERSION := 3.0
   DEVICE_COMPAT_MESSAGE := kernel and ubi partitions had to be resized. \
+       Network swconfig configuration cannot be upgraded to DSA. \
        Upgrade via sysupgrade mechanism is not possible.
 endef
 TARGET_DEVICES += netgear_wndr4700
diff --git a/target/linux/apm821xx/patches-6.6/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch b/target/linux/apm821xx/patches-6.6/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch
index 3ea4faf20258e7..dcc82546a29972 100644
--- a/target/linux/apm821xx/patches-6.6/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch
+++ b/target/linux/apm821xx/patches-6.6/900-powerpc-bootwrapper-force-gzip-as-mkimage-s-compress.patch
@@ -18,7 +18,7 @@ Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
 
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
-@@ -276,7 +276,7 @@ compressor-$(CONFIG_KERNEL_LZO) := lzo
+@@ -277,7 +277,7 @@ compressor-$(CONFIG_KERNEL_LZO) := lzo
  
  # args (to if_changed): 1 = (this rule), 2 = platform, 3 = dts 4=dtb 5=initrd
  quiet_cmd_wrap	= WRAP    $@
diff --git a/target/linux/archs38/config-6.6 b/target/linux/archs38/config-6.6
index 6298ce9e462c5c..dab1b855b9cb5d 100644
--- a/target/linux/archs38/config-6.6
+++ b/target/linux/archs38/config-6.6
@@ -47,8 +47,6 @@ CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
 CONFIG_BLK_DEV_SD=y
 CONFIG_BUFFER_HEAD=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLK_HSDK=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_COMMON_CLK=y
@@ -103,7 +101,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CSUM=y
diff --git a/target/linux/armsr/README b/target/linux/armsr/README
index b4b9012826a2ca..04f01f8e305228 100644
--- a/target/linux/armsr/README
+++ b/target/linux/armsr/README
@@ -49,7 +49,7 @@ With a EDKII or U-Boot binary for the QEMU ARM virtual machines, you can use the
 images in EFI mode:
 
 32-bit:
-gunzip -c bin/targets/armsr/armv7/openwrt-armsr-armv7-generic-ext4-combined.img.gz > openwrt-arm-32.img
+gunzip -c bin/targets/armsr/armv7/openwrt-armsr-armv7-generic-ext4-combined-efi.img.gz > openwrt-arm-32.img
 qemu-system-arm -nographic \
     -cpu cortex-a15 -machine virt \
     -bios bin/targets/armsr/armv7/u-boot-qemu_armv7/u-boot.bin \
@@ -60,7 +60,7 @@ qemu-system-arm -nographic \
     -netdev user,id=testwan -net nic,netdev=testwan
 
 64-bit:
-gunzip -c bin/targets/armsr/armv8/openwrt-armsr-armv8-generic-ext4-combined.img.gz > openwrt-arm-64.img
+gunzip -c bin/targets/armsr/armv8/openwrt-armsr-armv8-generic-ext4-combined-efi.img.gz > openwrt-arm-64.img
 qemu-system-aarch64 -nographic \
     -cpu cortex-a53 -machine virt \
     -bios bin/targets/armsr/armv8/u-boot-qemu_armv8/u-boot.bin \
diff --git a/target/linux/armsr/image/Makefile b/target/linux/armsr/image/Makefile
index 09c37beeec43ec..79173e67dac1be 100644
--- a/target/linux/armsr/image/Makefile
+++ b/target/linux/armsr/image/Makefile
@@ -12,7 +12,6 @@ GRUB_TERMINAL_CONFIG =
 GRUB_CONSOLE_CMDLINE = earlycon
 
 ifneq ($(CONFIG_GRUB_CONSOLE),)
-  GRUB_CONSOLE_CMDLINE += console=tty1
   GRUB_TERMINALS += console
 endif
 
@@ -74,18 +73,18 @@ DEVICE_VARS += GRUB2_VARIANT UBOOT
 define Device/efi-default
   IMAGE/rootfs.img := append-rootfs | pad-to $(ROOTFS_PARTSIZE)
   IMAGE/rootfs.img.gz := append-rootfs | pad-to $(ROOTFS_PARTSIZE) | gzip
-  IMAGE/combined.img := grub-config efi | combined efi | grub-install efi | append-metadata
-  IMAGE/combined.img.gz := grub-config efi | combined efi | grub-install efi | gzip | append-metadata
-  IMAGE/combined.vmdk := grub-config efi | combined efi | grub-install efi | qemu-image vmdk
+  IMAGE/combined-efi.img := grub-config efi | combined efi | grub-install efi | append-metadata
+  IMAGE/combined-efi.img.gz := grub-config efi | combined efi | grub-install efi | gzip | append-metadata
+  IMAGE/combined-efi.vmdk := grub-config efi | combined efi | grub-install efi | qemu-image vmdk
  ifeq ($(CONFIG_TARGET_IMAGES_GZIP),y)
     IMAGES-y := rootfs.img.gz
-    IMAGES-y += combined.img.gz
+    IMAGES-y += combined-efi.img.gz
   else
     IMAGES-y := rootfs.img
-    IMAGES-y += combined.img
+    IMAGES-y += combined-efi.img
   endif
   ifeq ($(CONFIG_VMDK_IMAGES),y)
-    IMAGES-y += combined.vmdk
+    IMAGES-y += combined-efi.vmdk
   endif
   KERNEL := kernel-bin
   KERNEL_INSTALL := 1
diff --git a/target/linux/armsr/patches-6.6/300-printk-always-setup-default-consoles.patch b/target/linux/armsr/patches-6.6/300-printk-always-setup-default-consoles.patch
new file mode 100644
index 00000000000000..076bfd21dadeca
--- /dev/null
+++ b/target/linux/armsr/patches-6.6/300-printk-always-setup-default-consoles.patch
@@ -0,0 +1,47 @@
+From 0059efbd0f9c291795078fb4e50722641d525f38 Mon Sep 17 00:00:00 2001
+From: Mathew McBride <matt@traverse.com.au>
+Date: Thu, 16 Jan 2025 11:48:44 +1100
+Subject: [PATCH] printk: always setup default (tty0 + stdout / SPCR) consoles
+ when no console= present
+
+(This is a hack specific to OpenWrt's armsr target)
+
+This change resolves a difference in behaviour between arm64 ACPI
+and DT systems.
+Our usecase is to ensure the system console is always present
+regardless of display mode (serial port or screen).
+
+Both ACPI and DT have mechanisms to setup a serial console from
+information passed by firmware (SPCR and stdout-path respectively).
+
+On ACPI systems, the SPCR table is parsed very early on in the kernel
+boot which prevents the screen console (tty0) from appearing if it is
+not explicitly set.
+
+We would like to avoid specifying console= arguments as there are many
+possible configurations on the serial side (like ttyS0, ttyAMA0, ttymxc0
+etc.).
+
+If the kernel does not consume the serial port in SPCR/stdout-path,
+then the 'default' settings from the firmware (baud rate etc.) are lost.
+
+If the system administrator explicitly specifies a console= argument,
+then the old behaviour is returned.
+
+Signed-off-by: Mathew McBride <matt@traverse.com.au>
+Link: https://github.com/openwrt/openwrt/pull/17012#issuecomment-2591751115
+---
+ kernel/printk/printk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -3515,7 +3515,7 @@ void register_console(struct console *ne
+ 	 * Note that a console with tty binding will have CON_CONSDEV
+ 	 * flag set and will be first in the list.
+ 	 */
+-	if (preferred_console < 0) {
++	if (!console_set_on_cmdline) {
+ 		if (hlist_empty(&console_list) || !console_first()->device ||
+ 		    console_first()->flags & CON_BOOT) {
+ 			try_enable_default_console(newcon);
diff --git a/target/linux/at91/sam9x/config-6.6 b/target/linux/at91/sam9x/config-6.6
index d5cfa5f753933f..2631f0feea15f7 100644
--- a/target/linux/at91/sam9x/config-6.6
+++ b/target/linux/at91/sam9x/config-6.6
@@ -44,8 +44,6 @@ CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
 CONFIG_BLK_PM=y
 CONFIG_BUFFER_HEAD=y
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_COMMON_CLK=y
 CONFIG_COMMON_CLK_AT91=y
@@ -109,7 +107,6 @@ CONFIG_FWNODE_MDIO=y
 CONFIG_FW_CACHE=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_BUG=y
diff --git a/target/linux/at91/sama5/config-6.6 b/target/linux/at91/sama5/config-6.6
index 04eee7a210f354..d04e10f9e15849 100644
--- a/target/linux/at91/sama5/config-6.6
+++ b/target/linux/at91/sama5/config-6.6
@@ -54,8 +54,6 @@ CONFIG_BLK_PM=y
 CONFIG_BUFFER_HEAD=y
 CONFIG_CACHE_L2X0=y
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CMA=y
 CONFIG_CMA_ALIGNMENT=8
@@ -181,7 +179,6 @@ CONFIG_FWNODE_MDIO=y
 CONFIG_FW_CACHE=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_BUG=y
 CONFIG_GENERIC_CLOCKEVENTS=y
diff --git a/target/linux/at91/sama7/config-6.6 b/target/linux/at91/sama7/config-6.6
index e3455c5e379f27..c69cbdf7671c0e 100644
--- a/target/linux/at91/sama7/config-6.6
+++ b/target/linux/at91/sama7/config-6.6
@@ -45,8 +45,6 @@ CONFIG_BUFFER_HEAD=y
 # CONFIG_CACHE_L2X0 is not set
 CONFIG_CAN=y
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CMA=y
 CONFIG_CMA_ALIGNMENT=9
@@ -162,7 +160,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_BUG=y
 CONFIG_GENERIC_CLOCKEVENTS=y
diff --git a/target/linux/ath79/config-6.6 b/target/linux/ath79/config-6.6
index 92057c343c09d1..c43dbfd7194dad 100644
--- a/target/linux/ath79/config-6.6
+++ b/target/linux/ath79/config-6.6
@@ -14,8 +14,6 @@ CONFIG_AT803X_PHY=y
 CONFIG_ATH79=y
 CONFIG_ATH79_WDT=y
 CONFIG_BLK_MQ_PCI=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CMDLINE="rootfstype=squashfs,jffs2"
@@ -58,7 +56,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CMOS_UPDATE=y
diff --git a/target/linux/ath79/dts/ar7240_tplink_tl-wa.dtsi b/target/linux/ath79/dts/ar7240_tplink_tl-wa.dtsi
index 1f46e77423cd24..94d2570c6c1e54 100644
--- a/target/linux/ath79/dts/ar7240_tplink_tl-wa.dtsi
+++ b/target/linux/ath79/dts/ar7240_tplink_tl-wa.dtsi
@@ -17,7 +17,7 @@
 };
 
 &eth1 {
-	nvmem-cells = <&macaddr_uboot_1fc00>;
+	nvmem-cells = <&macaddr_uboot_1fc00 0>;
 	nvmem-cell-names = "mac-address";
 };
 
diff --git a/target/linux/ath79/dts/ar9132_buffalo_wzr-hp-g300nh.dtsi b/target/linux/ath79/dts/ar9132_buffalo_wzr-hp-g300nh.dtsi
index a82546c1c1395e..474d0fa80f74cd 100644
--- a/target/linux/ath79/dts/ar9132_buffalo_wzr-hp-g300nh.dtsi
+++ b/target/linux/ath79/dts/ar9132_buffalo_wzr-hp-g300nh.dtsi
@@ -145,7 +145,7 @@
 					#size-cells = <1>;
 
 					cal_art_11000: calibration@11000 {
-						reg = <0x11000 0x440>;
+						reg = <0x11000 0xeb8>;
 					};
 
 					macaddr_art_1120c: macaddr@1120c {
diff --git a/target/linux/ath79/dts/ar9132_tplink_tl-wa901nd-v2.dts b/target/linux/ath79/dts/ar9132_tplink_tl-wa901nd-v2.dts
index ed4ca5297e7f5c..3fcc4073fea630 100644
--- a/target/linux/ath79/dts/ar9132_tplink_tl-wa901nd-v2.dts
+++ b/target/linux/ath79/dts/ar9132_tplink_tl-wa901nd-v2.dts
@@ -104,7 +104,7 @@
 					#size-cells = <1>;
 
 					cal_art_1000: calibration@1000 {
-						reg = <0x1000 0x440>;
+						reg = <0x1000 0xeb8>;
 					};
 				};
 			};
diff --git a/target/linux/ath79/dts/ar9132_tplink_tl-wr1043nd-v1.dts b/target/linux/ath79/dts/ar9132_tplink_tl-wr1043nd-v1.dts
index 8958ddd3a83b3f..847d4d4c47def9 100644
--- a/target/linux/ath79/dts/ar9132_tplink_tl-wr1043nd-v1.dts
+++ b/target/linux/ath79/dts/ar9132_tplink_tl-wr1043nd-v1.dts
@@ -131,7 +131,7 @@
 					#size-cells = <1>;
 
 					cal_art_1000: calibration@1000 {
-						reg = <0x1000 0x440>;
+						reg = <0x1000 0xeb8>;
 					};
 				};
 			};
diff --git a/target/linux/ath79/dts/ar9132_tplink_tl-wr941-v2.dts b/target/linux/ath79/dts/ar9132_tplink_tl-wr941-v2.dts
index d3f189479a8b8e..3ad058e9597350 100644
--- a/target/linux/ath79/dts/ar9132_tplink_tl-wr941-v2.dts
+++ b/target/linux/ath79/dts/ar9132_tplink_tl-wr941-v2.dts
@@ -153,7 +153,7 @@
 					#size-cells = <1>;
 
 					cal_art_1000: calibration@1000 {
-						reg = <0x1000 0x440>;
+						reg = <0x1000 0xeb8>;
 					};
 				};
 			};
diff --git a/target/linux/ath79/dts/ar9331_teltonika_rut230-v1.dts b/target/linux/ath79/dts/ar9331_teltonika_rut230-v1.dts
index c2c54b466295cb..73a6cc52ca59cd 100644
--- a/target/linux/ath79/dts/ar9331_teltonika_rut230-v1.dts
+++ b/target/linux/ath79/dts/ar9331_teltonika_rut230-v1.dts
@@ -36,6 +36,7 @@
 
 		sim-tray {
 			label = "sim-tray";
+			linux,input-type = <EV_SW>;
 			linux,code = <BTN_1>;
 			gpios = <&gpio 20 GPIO_ACTIVE_LOW>;
 			debounce-interval = <60>;
@@ -68,7 +69,7 @@
 		};
 
 		signal-strength-4 {
-			label = "green:signal-strength4";
+			label = "green:signal-strength-4";
 			gpios = <&gpio 27 GPIO_ACTIVE_HIGH>;
 		};
 
diff --git a/target/linux/ath79/dts/ar9342_mikrotik_routerboard-911g-xhpnd.dts b/target/linux/ath79/dts/ar9342_mikrotik_routerboard-911g-xhpnd.dts
index 5fa44b4412ca78..655c590f8c9bda 100644
--- a/target/linux/ath79/dts/ar9342_mikrotik_routerboard-911g-xhpnd.dts
+++ b/target/linux/ath79/dts/ar9342_mikrotik_routerboard-911g-xhpnd.dts
@@ -9,3 +9,7 @@
 	compatible = "mikrotik,routerboard-911g-xhpnd", "qca,ar9342";
 	model = "MikroTik RouterBOARD 911G-(2,5)HPnD";
 };
+
+&ref {
+	clock-frequency = <25000000>;
+};
diff --git a/target/linux/ath79/dts/ar9342_mikrotik_routerboard-911g.dtsi b/target/linux/ath79/dts/ar9342_mikrotik_routerboard-911g.dtsi
index 0c98a6634ee4b7..3a8c60456f8f8e 100644
--- a/target/linux/ath79/dts/ar9342_mikrotik_routerboard-911g.dtsi
+++ b/target/linux/ath79/dts/ar9342_mikrotik_routerboard-911g.dtsi
@@ -146,10 +146,6 @@
 	};
 };
 
-&ref {
-	clock-frequency = <40000000>;
-};
-
 &spi {
 	status = "okay";
 
diff --git a/target/linux/ath79/dts/ar9342_mikrotik_routerboard-912uag-2hpnd.dts b/target/linux/ath79/dts/ar9342_mikrotik_routerboard-912uag-2hpnd.dts
index 81d7284b3da1e0..4cf62349f5bbd6 100644
--- a/target/linux/ath79/dts/ar9342_mikrotik_routerboard-912uag-2hpnd.dts
+++ b/target/linux/ath79/dts/ar9342_mikrotik_routerboard-912uag-2hpnd.dts
@@ -10,6 +10,10 @@
 	model = "MikroTik RouterBOARD 912UAG-(2,5)HPnD";
 };
 
+&ref {
+	clock-frequency = <40000000>;
+};
+
 &pcie {
 	status = "okay";
 };
diff --git a/target/linux/ath79/dts/qca9531_comfast_cf-ew71-v2.dts b/target/linux/ath79/dts/qca9531_comfast_cf-ew71-v2.dts
index 22776465001456..0c1e301c512c8a 100644
--- a/target/linux/ath79/dts/qca9531_comfast_cf-ew71-v2.dts
+++ b/target/linux/ath79/dts/qca9531_comfast_cf-ew71-v2.dts
@@ -32,13 +32,13 @@
 		led_wan: wan {
 			function = LED_FUNCTION_WAN;
 			color = <LED_COLOR_ID_BLUE>;
-			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
 		};
 
 		wlan {
 			function = LED_FUNCTION_WLAN;
 			color = <LED_COLOR_ID_BLUE>;
-			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
 			linux,default-trigger = "phy0tpt";
 		};
 	};
diff --git a/target/linux/ath79/dts/qca9557_sophos_ap15c.dts b/target/linux/ath79/dts/qca9557_sophos_ap15c.dts
new file mode 100644
index 00000000000000..68d02e97a54a14
--- /dev/null
+++ b/target/linux/ath79/dts/qca9557_sophos_ap15c.dts
@@ -0,0 +1,159 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca955x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "sophos,ap15c", "qca,qca9557";
+	model = "Sophos AP15C";
+
+	aliases {
+		led-boot = &led_status_green;
+		led-failsafe = &led_status_yellow;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_yellow;
+		label-mac-device = &eth0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200n8";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_green: status_green {
+			function = LED_FUNCTION_STATUS;
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+
+		led_status_yellow: status_yellow {
+			function = LED_FUNCTION_STATUS;
+			color = <LED_COLOR_ID_YELLOW>;
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "u-boot-env";
+				reg = <0x040000 0x010000>;
+			};
+
+			partition@50000 {
+				label = "art";
+				reg = <0x050000 0x010000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					cal_art_1000: calibration@1000 {
+						reg = <0x1000 0x440>;
+					};
+				};
+			};
+
+			partition@60000 {
+				label = "config";
+				reg = <0x060000 0x010000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_config_201a: macaddr@201a {
+						reg = <0x201a 0x6>;
+					};
+				};
+			};
+
+			partition@70000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x070000 0xf90000>;
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy-mask = <0x10>;
+
+	phy4: ethernet-phy@4 {
+		reg = <4>;
+		eee-broken-100tx;
+		eee-broken-1000t;
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	pll-data = <0xa6000000 0xa0000101 0xa0001313>;
+
+	nvmem-cells = <&macaddr_config_201a>;
+	nvmem-cell-names = "mac-address";
+
+	phy-mode = "rgmii-id";
+	phy-handle = <&phy4>;
+
+	gmac_config: gmac-config {
+		device = <&gmac>;
+
+		rgmii-enabled = <1>;
+
+		rxdv-delay = <3>;
+		rxd-delay = <3>;
+		txen-delay = <3>;
+		txd-delay = <3>;
+	};
+};
+
+&wmac {
+	status = "okay";
+
+	nvmem-cells = <&cal_art_1000>;
+	nvmem-cell-names = "calibration";
+};
diff --git a/target/linux/ath79/dts/qca9558_buffalo_wzr-450hp2.dts b/target/linux/ath79/dts/qca9558_buffalo_wzr-450hp2.dts
new file mode 100644
index 00000000000000..8f19907dfeea9d
--- /dev/null
+++ b/target/linux/ath79/dts/qca9558_buffalo_wzr-450hp2.dts
@@ -0,0 +1,179 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca955x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "buffalo,wzr-450hp2", "qca,qca9558";
+	model = "Buffalo WZR-450HP2/WZR-450HP2D";
+
+	aliases {
+		led-boot = &led_status_green;
+		led-failsafe = &led_status_green;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_green;
+		label-mac-device = &eth0;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_green: status_green {
+			function = LED_FUNCTION_STATUS;
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&gpio 20 GPIO_ACTIVE_LOW>;
+			default-state = "on";
+		};
+
+		led_wlan_green: wlan_green {
+			function = LED_FUNCTION_WLAN;
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led_wps_green: wps_green {
+			function = LED_FUNCTION_WPS;
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "Reset button";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		rfkill {
+		       label = "RFKILL button";
+		       linux,code = <KEY_RFKILL>;
+		       gpios = <&gpio 21 GPIO_ACTIVE_LOW>;
+		       debounce-interval = <60>;
+		};
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x40000>;
+				read-only;
+			};
+
+			partition@40000 {
+				reg = <0x40000 0x10000>;
+				label = "u-boot-env";
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				reg = <0x50000 0xf90000>;
+				label = "firmware";
+			};
+
+			partition@fe0000 {
+				reg = <0xfe0000 0x10000>;
+				label = "user_property";
+				read-only;
+			};
+
+			art: partition@ff0000 {
+				label = "art";
+				reg = <0xff0000 0x10000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_wan: macaddr@0 {
+						reg = <0x0 0x6>;
+					};
+
+					macaddr_lan: macaddr@6 {
+						reg = <0x6 0x6>;
+					};
+
+					cal_ath9k: cal_ath9k@1000 {
+						reg = <0x1000 0x440>;
+					};
+				};
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+
+		qca,ar8327-initvals = <
+			0x04 0x07600000 /* PORT0 PAD MODE CTRL: RGMII, to eth0 */
+			0x0c 0x00080080 /* PORT6 PAD MODE CTRL: SGMII, to eth1 */
+			0x10 0x81000080 /* POWER ON STRAP */
+			0x50 0xcc35cc35 /* LED_CTRL0 */
+			0x54 0xca35ca35 /* LED_CTRL1 */
+			0x58 0xc935c935 /* LED_CTRL2 */
+			0x5c 0x03ffff00 /* LED_CTRL3 */
+			0x7c 0x0000007e /* PORT0_STATUS */
+			0x94 0x0000007e /* PORT6_STATUS */
+		>;
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_wan>;
+	nvmem-cell-names = "mac-address";
+	phy-handle = <&phy0>;
+	pll-data = <0x56000000 0x00000101 0x00001616>;
+
+	gmac-config {
+		device = <&gmac>;
+		rgmii-enabled = <1>;
+	};
+};
+
+&eth1 {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_lan>;
+	nvmem-cell-names = "mac-address";
+	pll-data = <0x03000101 0x00000101 0x00001616>;
+
+	fixed-link {
+		speed = <1000>;
+		full-duplex;
+	};
+};
+
+&wmac {
+	status = "okay";
+
+	nvmem-cells = <&cal_ath9k>;
+	nvmem-cell-names = "calibration";
+};
diff --git a/target/linux/ath79/dts/qca9558_linksys_ea4500-v3.dts b/target/linux/ath79/dts/qca9558_linksys_ea4500-v3.dts
index 6c799efe33a54e..1da46d72145b10 100644
--- a/target/linux/ath79/dts/qca9558_linksys_ea4500-v3.dts
+++ b/target/linux/ath79/dts/qca9558_linksys_ea4500-v3.dts
@@ -123,7 +123,7 @@
 
 		partition@2c0000 {
 			label = "firmware";
-			reg = <0x2c0000 0x5000000>;
+			reg = <0x2c0000 0x7d40000>;
 
 			compatible = "fixed-partitions";
 			#address-cells = <1>;
@@ -136,7 +136,7 @@
 
 			partition@400000 {
 				label = "ubi";
-				reg = <0x400000 0x4c00000>;
+				reg = <0x400000 0x7940000>;
 			};
 
 			/* Original layout for secondary partitions */
@@ -151,11 +151,11 @@
 			}; */
 		};
 
-		partition@52c0000 {
+		/* Original layout for user data partition */
+		/* partition@52c0000 {
 			label = "syscfg";
 			reg = <0x52c0000 0x2d40000>;
-			read-only;
-		};
+		}; */
 	};
 };
 
diff --git a/target/linux/ath79/dts/qca9558_mikrotik_routerboard-96x.dtsi b/target/linux/ath79/dts/qca9558_mikrotik_routerboard-96x.dtsi
index 684ca8632a4852..4e219d167c1dba 100644
--- a/target/linux/ath79/dts/qca9558_mikrotik_routerboard-96x.dtsi
+++ b/target/linux/ath79/dts/qca9558_mikrotik_routerboard-96x.dtsi
@@ -44,7 +44,7 @@
 
 		usb_power {
 			gpio-export,name = "usb-power";
-			gpio-export,output = <0>;
+			gpio-export,output = <1>;
 			gpios = <&gpio 13 GPIO_ACTIVE_HIGH>;
 		};
 	};
diff --git a/target/linux/ath79/dts/qca955x_elecom_wab.dtsi b/target/linux/ath79/dts/qca955x_elecom_wab.dtsi
index 53bb5b0141254b..43e34c6029182d 100644
--- a/target/linux/ath79/dts/qca955x_elecom_wab.dtsi
+++ b/target/linux/ath79/dts/qca955x_elecom_wab.dtsi
@@ -8,7 +8,6 @@
 
 / {
 	aliases {
-		label-mac-device = &eth0;
 		led-boot = &led_status;
 		led-failsafe = &led_status;
 		led-upgrade = &led_status;
@@ -108,9 +107,6 @@
 	phy-mode = "rgmii-rxid";
 	pll-data = <0xae000000 0x80000101 0x80001313>;
 
-	nvmem-cells = <&macaddr_uboot_ethaddr 0>;
-	nvmem-cell-names = "mac-address";
-
 	gmac-config {
 		device = <&gmac>;
 
@@ -148,8 +144,8 @@
 	wifi@0,0 {
 		compatible = "qcom,ath10k";
 		reg = <0x0000 0 0 0 0>;
-		nvmem-cells = <&cal_art_5000>, <&macaddr_uboot_ethaddr 1>;
-		nvmem-cell-names = "calibration", "mac-address";
+		nvmem-cells = <&cal_art_5000>;
+		nvmem-cell-names = "calibration";
 	};
 };
 
@@ -173,14 +169,9 @@
 			};
 
 			partition@40000 {
-				compatible = "u-boot,env";
 				label = "u-boot-env";
 				reg = <0x40000 0x10000>;
 				read-only;
-
-				macaddr_uboot_ethaddr: ethaddr {
-					#nvmem-cell-cells = <1>;
-				};
 			};
 
 			partition@50000 {
@@ -261,6 +252,6 @@
 &wmac {
 	status = "okay";
 
-	nvmem-cells = <&cal_art_1000>, <&macaddr_uboot_ethaddr 0>;
-	nvmem-cell-names = "calibration", "mac-address";
+	nvmem-cells = <&cal_art_1000>;
+	nvmem-cell-names = "calibration";
 };
diff --git a/target/linux/ath79/dts/qca9563_kuwfi_n650.dts b/target/linux/ath79/dts/qca9563_kuwfi_n650.dts
new file mode 100644
index 00000000000000..03801dabb3ed6c
--- /dev/null
+++ b/target/linux/ath79/dts/qca9563_kuwfi_n650.dts
@@ -0,0 +1,178 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca956x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/mtd/partitions/uimage.h>
+
+/ {
+	model = "KuWFi N650";
+	compatible = "kuwfi,n650", "qca,qca9563";
+
+	aliases {
+		label-mac-device = &eth0;
+		led-boot = &led_green;
+		led-running = &led_green;
+		led-failsafe = &led_blue;
+		led-upgrade = &led_blue;
+	};
+
+	virtual_flash {
+		compatible = "mtd-concat";
+		devices = <&fwconcat0 &fwconcat1>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				reg = <0x0 0x0>;
+				label = "firmware";
+				compatible = "openwrt,uimage", "denx,uimage";
+				openwrt,ih-magic = <IH_MAGIC_OKLI>;
+			};
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "Reset button";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_blue: blue {
+			function = LED_FUNCTION_DEBUG;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&gpio 7 GPIO_ACTIVE_LOW>;
+		};
+
+		led_green: green {
+			function = LED_FUNCTION_POWER;
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <25000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x030000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x030000 0x010000>;
+			};
+
+			fwconcat0: partition@40000 {
+				label = "fwconcat0";
+				reg = <0x040000 0xd40000>;
+			};
+
+			partition@d80000 {
+				label = "loader";
+				reg = <0xd80000 0x10000>;
+			};
+
+			fwconcat1: partition@d90000 {
+				label = "fwconcat1";
+				reg = <0xd90000 0x160000>;
+			};
+
+			partition@ef0000 {
+				label = "log";
+				reg = <0xef0000 0x0f0000>;
+				read-only;
+			};
+
+			partition@fe0000 {
+				label = "nvram";
+				reg = <0xfe0000 0x010000>;
+				read-only;
+			};
+
+			partition@ff0000 {
+				label = "art";
+				reg = <0xff0000 0x10000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_art_0: macaddr@0 {
+						compatible = "mac-base";
+						reg = <0x0 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+
+					precal_art_5000: pre-calibration@5000 {
+						reg = <0x5000 0x2f20>;
+					};
+				};
+			};
+		};
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		phy-mode = "sgmii";
+		reset-gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+		qca,mib-poll-interval = <500>;
+
+		qca,ar8327-initvals = <
+			0x04 0x00080080 /* PORT0 PAD MODE CTRL */
+			0x7c 0x0000007e /* PORT0_STATUS */
+		>;
+	};
+};
+
+&eth0 {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_art_0 0>;
+	nvmem-cell-names = "mac-address";
+	phy-handle = <&phy0>;
+	phy-mode = "sgmii";
+};
+
+&pcie {
+	status = "okay";
+
+	wifi@0,0 {
+		compatible = "pci168c,0056";
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&precal_art_5000>, <&macaddr_art_0 1>;
+		nvmem-cell-names = "pre-calibration", "mac-address";
+	};
+};
diff --git a/target/linux/ath79/dts/qca9563_tplink_archer-c6-v2.dts b/target/linux/ath79/dts/qca9563_tplink_archer-c6-v2.dts
index 66ae2d1ffd52c7..36281f4caa137e 100644
--- a/target/linux/ath79/dts/qca9563_tplink_archer-c6-v2.dts
+++ b/target/linux/ath79/dts/qca9563_tplink_archer-c6-v2.dts
@@ -89,6 +89,7 @@
 		reg = <0x0000 0 0 0 0>;
 		nvmem-cells = <&precal_art_5000>, <&macaddr_info_8 (-1)>;
 		nvmem-cell-names = "pre-calibration", "mac-address";
+		qcom,ath10k-calibration-variant = "TP-Link-Archer-c6-v2";
 	};
 };
 
diff --git a/target/linux/ath79/dts/qca9563_tplink_cpe710-v1.dts b/target/linux/ath79/dts/qca9563_tplink_cpe710-v1.dts
index 6d1b58f95fae48..31e04232ab6c5a 100644
--- a/target/linux/ath79/dts/qca9563_tplink_cpe710-v1.dts
+++ b/target/linux/ath79/dts/qca9563_tplink_cpe710-v1.dts
@@ -1,151 +1,13 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
-#include "qca956x.dtsi"
-
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
-#include <dt-bindings/leds/common.h>
+#include "qca9563_tplink_cpe710.dtsi"
 
 / {
 	model = "TP-Link CPE710 v1";
 	compatible = "tplink,cpe710-v1", "qca,qca9563";
-
-	aliases {
-		label-mac-device = &eth0;
-		led-boot = &led_lan;
-		led-failsafe = &led_lan;
-		led-upgrade = &led_lan;
-	};
-
-	leds {
-		compatible = "gpio-leds";
-
-		led_lan: lan {
-			function = LED_FUNCTION_LAN;
-			color = <LED_COLOR_ID_BLUE>;
-			gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
-		};
-
-		wlan5g {
-			label = "blue:wlan5g";
-			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "phy0tpt";
-		};
-	};
-
-	keys {
-		compatible = "gpio-keys";
-
-		reset {
-			label = "Reset button";
-			linux,code = <KEY_RESTART>;
-			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
-		};
-	};
-};
-
-&pcie {
-	status = "okay";
-
-	wifi@0,0 {
-		compatible = "qcom,ath10k";
-		reg = <0x0000 0 0 0 0>;
-		nvmem-cells = <&precal_art_5000>, <&macaddr_info_8>;
-		nvmem-cell-names = "pre-calibration", "mac-address";
-	};
-};
-
-&spi {
-	status = "okay";
-
-	flash@0 {
-		compatible = "jedec,spi-nor";
-		reg = <0>;
-		spi-max-frequency = <40000000>;
-
-		partitions {
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			partition@0 {
-				label = "u-boot";
-				reg = <0x000000 0x040000>;
-				read-only;
-			};
-
-			partition@40000 {
-				label = "u-boot-env";
-				reg = <0x040000 0x010000>;
-			};
-
-			partition@50000 {
-				label = "partition-table";
-				reg = <0x050000 0x010000>;
-				read-only;
-			};
-
-			info: partition@60000 {
-				label = "info";
-				reg = <0x060000 0x010000>;
-				read-only;
-
-				nvmem-layout {
-					compatible = "fixed-layout";
-					#address-cells = <1>;
-					#size-cells = <1>;
-
-					macaddr_info_8: macaddr@8 {
-						reg = <0x8 0x6>;
-					};
-				};
-			};
-
-			partition@70000 {
-				compatible = "denx,uimage";
-				label = "firmware";
-				reg = <0x070000 0xf50000>;
-			};
-
-			partition@fc0000 {
-				label = "config";
-				reg = <0xfc0000 0x030000>;
-				read-only;
-			};
-
-			partition@ff0000 {
-				label = "art";
-				reg = <0xff0000 0x010000>;
-				read-only;
-
-				nvmem-layout {
-					compatible = "fixed-layout";
-					#address-cells = <1>;
-					#size-cells = <1>;
-
-					precal_art_5000: pre-calibration@5000 {
-						reg = <0x5000 0x2f20>;
-					};
-				};
-			};
-		};
-	};
-};
-
-&pinmux {
-	mdio_pins: mdio_pins {
-		/* GPIO 10 as MDIO(0x20), GPIO 8 as MDC(0x21) */
-		pinctrl-single,bits = <0x8 0x00200021 0x00ff00ff>;
-	};
 };
 
 &mdio0 {
-	status = "okay";
-
-	pinctrl-names = "default";
-	pinctrl-0 = <&mdio_pins>;
-
 	phy4: ethernet-phy@4 {
 		reg = <4>;
 		reset-gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
@@ -153,17 +15,6 @@
 };
 
 &eth0 {
-	status = "okay";
-
 	phy-handle = <&phy4>;
 	phy-mode = "sgmii";
-
-	nvmem-cells = <&macaddr_info_8>;
-	nvmem-cell-names = "mac-address";
-
-	qca956x-serdes-fixup;
-
-	gmac-config {
-		device = <&gmac>;
-	};
 };
diff --git a/target/linux/ath79/dts/qca9563_tplink_cpe710-v2.dts b/target/linux/ath79/dts/qca9563_tplink_cpe710-v2.dts
new file mode 100644
index 00000000000000..fe277fc549d5b5
--- /dev/null
+++ b/target/linux/ath79/dts/qca9563_tplink_cpe710-v2.dts
@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca9563_tplink_cpe710.dtsi"
+
+/ {
+	model = "TP-Link CPE710 v2";
+	compatible = "tplink,cpe710-v2", "qca,qca9563";
+};
+
+&mdio0 {
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		reset-gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&eth0 {
+	phy-handle = <&phy0>;
+	phy-mode = "sgmii";
+};
diff --git a/target/linux/ath79/dts/qca9563_tplink_cpe710.dtsi b/target/linux/ath79/dts/qca9563_tplink_cpe710.dtsi
new file mode 100644
index 00000000000000..9de36f3b6635f5
--- /dev/null
+++ b/target/linux/ath79/dts/qca9563_tplink_cpe710.dtsi
@@ -0,0 +1,160 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "qca956x.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	aliases {
+		led-boot = &led_lan;
+		led-failsafe = &led_lan;
+		led-upgrade = &led_lan;
+		label-mac-device = &eth0;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_lan: lan {
+			function = LED_FUNCTION_LAN;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
+		};
+
+		wlan5g {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WLAN_5GHZ;
+			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "Reset button";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+
+	wifi@0,0 {
+		compatible = "qcom,ath10k";
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&precal_art_5000>, <&macaddr_info_8>;
+		nvmem-cell-names = "pre-calibration", "mac-address";
+	};
+};
+
+&spi {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <40000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x000000 0x040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "u-boot-env";
+				reg = <0x040000 0x010000>;
+				read-only;
+			};
+
+			partition@50000 {
+				label = "partition-table";
+				reg = <0x050000 0x010000>;
+				read-only;
+			};
+
+			partition@60000 {
+				label = "info";
+				reg = <0x060000 0x010000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_info_8: macaddr@8 {
+						reg = <0x8 0x6>;
+					};
+				};
+			};
+
+			partition@70000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x070000 0xf50000>;
+			};
+
+			partition@fc0000 {
+				label = "config";
+				reg = <0xfc0000 0x030000>;
+				read-only;
+			};
+
+			partition@ff0000 {
+				label = "art";
+				reg = <0xff0000 0x010000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					precal_art_5000: pre-calibration@5000 {
+						reg = <0x5000 0x2f20>;
+					};
+				};
+			};
+		};
+	};
+};
+
+&pinmux {
+	mdio_pins: mdio_pins {
+		/* GPIO 10 as MDIO(0x20), GPIO 8 as MDC(0x21) */
+		pinctrl-single,bits = <0x8 0x00200021 0x00ff00ff>;
+	};
+};
+
+&mdio0 {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio_pins>;
+};
+
+&eth0 {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_info_8>;
+	nvmem-cell-names = "mac-address";
+
+	qca956x-serdes-fixup;
+
+	gmac-config {
+		device = <&gmac>;
+	};
+};
diff --git a/target/linux/ath79/dts/qca9563_xiaomi_aiot-ac2350.dts b/target/linux/ath79/dts/qca9563_xiaomi_aiot-ac2350.dts
index cff567e497f413..69d75e9b553743 100644
--- a/target/linux/ath79/dts/qca9563_xiaomi_aiot-ac2350.dts
+++ b/target/linux/ath79/dts/qca9563_xiaomi_aiot-ac2350.dts
@@ -201,5 +201,6 @@
 		reg = <0x0000 0 0 0 0>;
 		nvmem-cells = <&precal_art_5000>;
 		nvmem-cell-names = "pre-calibration";
+		qcom,ath10k-calibration-variant = "Xiaomi-AIoT-AC2350";
 	};
 };
diff --git a/target/linux/ath79/files/drivers/gpio/gpio-latch-mikrotik.c b/target/linux/ath79/files/drivers/gpio/gpio-latch-mikrotik.c
index 6e3f0f9690e75c..a0759fe9e37172 100644
--- a/target/linux/ath79/files/drivers/gpio/gpio-latch-mikrotik.c
+++ b/target/linux/ath79/files/drivers/gpio/gpio-latch-mikrotik.c
@@ -28,11 +28,6 @@ struct gpio_latch_chip {
 	struct gpio_desc *gpios[GPIO_LATCH_LINES];
 };
 
-static inline struct gpio_latch_chip *to_gpio_latch_chip(struct gpio_chip *gc)
-{
-	return container_of(gc, struct gpio_latch_chip, gc);
-}
-
 static void gpio_latch_lock(struct gpio_latch_chip *glc, bool enable)
 {
 	mutex_lock(&glc->mutex);
@@ -58,7 +53,7 @@ static void gpio_latch_unlock(struct gpio_latch_chip *glc, bool disable)
 static int
 gpio_latch_get(struct gpio_chip *gc, unsigned offset)
 {
-	struct gpio_latch_chip *glc = to_gpio_latch_chip(gc);
+	struct gpio_latch_chip *glc = gpiochip_get_data(gc);
 	int ret;
 
 	gpio_latch_lock(glc, false);
@@ -71,7 +66,7 @@ gpio_latch_get(struct gpio_chip *gc, unsigned offset)
 static void
 gpio_latch_set(struct gpio_chip *gc, unsigned offset, int value)
 {
-	struct gpio_latch_chip *glc = to_gpio_latch_chip(gc);
+	struct gpio_latch_chip *glc = gpiochip_get_data(gc);
 	bool enable_latch = false;
 	bool disable_latch = false;
 
@@ -88,7 +83,7 @@ gpio_latch_set(struct gpio_chip *gc, unsigned offset, int value)
 static int
 gpio_latch_direction_output(struct gpio_chip *gc, unsigned offset, int value)
 {
-	struct gpio_latch_chip *glc = to_gpio_latch_chip(gc);
+	struct gpio_latch_chip *glc = gpiochip_get_data(gc);
 	bool enable_latch = false;
 	bool disable_latch = false;
 	int ret;
@@ -173,7 +168,6 @@ static struct platform_driver gpio_latch_driver = {
 	.probe = gpio_latch_probe,
 	.driver = {
 		.name = GPIO_LATCH_DRIVER_NAME,
-		.owner = THIS_MODULE,
 		.of_match_table = gpio_latch_match,
 	},
 };
diff --git a/target/linux/ath79/files/drivers/gpio/gpio-rb91x-key.c b/target/linux/ath79/files/drivers/gpio/gpio-rb91x-key.c
index b2c8e633051f52..d83b690afeccfd 100644
--- a/target/linux/ath79/files/drivers/gpio/gpio-rb91x-key.c
+++ b/target/linux/ath79/files/drivers/gpio/gpio-rb91x-key.c
@@ -41,14 +41,9 @@ struct gpio_rb91x_key {
 	struct gpio_desc *gpio;
 };
 
-static inline struct gpio_rb91x_key *to_gpio_rb91x_key(struct gpio_chip *gc)
-{
-	return container_of(gc, struct gpio_rb91x_key, gc);
-}
-
 static int gpio_rb91x_key_get(struct gpio_chip *gc, unsigned offset)
 {
-	struct gpio_rb91x_key *drvdata = to_gpio_rb91x_key(gc);
+	struct gpio_rb91x_key *drvdata = gpiochip_get_data(gc);
 	struct gpio_desc *gpio = drvdata->gpio;
 	int val, bak_val;
 
@@ -97,7 +92,7 @@ static int gpio_rb91x_key_direction_input(struct gpio_chip *gc, unsigned offset)
 
 static void gpio_rb91x_key_set(struct gpio_chip *gc, unsigned offset, int value)
 {
-	struct gpio_rb91x_key *drvdata = to_gpio_rb91x_key(gc);
+	struct gpio_rb91x_key *drvdata = gpiochip_get_data(gc);
 	struct gpio_desc *gpio = drvdata->gpio;
 
 	mutex_lock(&drvdata->mutex);
@@ -187,7 +182,6 @@ static struct platform_driver gpio_rb91x_key_driver = {
 	.probe = gpio_rb91x_key_probe,
 	.driver = {
 		.name = GPIO_RB91X_KEY_DRIVER_NAME,
-		.owner = THIS_MODULE,
 		.of_match_table = gpio_rb91x_key_match,
 	},
 };
diff --git a/target/linux/ath79/files/drivers/mtd/nand/raw/ar934x_nand.c b/target/linux/ath79/files/drivers/mtd/nand/raw/ar934x_nand.c
index d0d9e2090ba802..029142ca618abd 100644
--- a/target/linux/ath79/files/drivers/mtd/nand/raw/ar934x_nand.c
+++ b/target/linux/ath79/files/drivers/mtd/nand/raw/ar934x_nand.c
@@ -1478,7 +1478,6 @@ static struct platform_driver ar934x_nfc_driver = {
 	.remove		= ar934x_nfc_remove,
 	.driver = {
 		.name	= AR934X_NFC_DRIVER_NAME,
-		.owner	= THIS_MODULE,
 		.of_match_table = ar934x_nfc_match,
 	},
 };
diff --git a/target/linux/ath79/files/drivers/mtd/nand/raw/rb91x_nand.c b/target/linux/ath79/files/drivers/mtd/nand/raw/rb91x_nand.c
index 092cd85d82e117..cf2809bfa36678 100644
--- a/target/linux/ath79/files/drivers/mtd/nand/raw/rb91x_nand.c
+++ b/target/linux/ath79/files/drivers/mtd/nand/raw/rb91x_nand.c
@@ -356,7 +356,6 @@ static struct platform_driver rb91x_nand_driver = {
 	.remove	= rb91x_nand_remove,
 	.driver	= {
 		.name	= "rb91x-nand",
-		.owner	= THIS_MODULE,
 		.of_match_table = rb91x_nand_match,
 	},
 };
diff --git a/target/linux/ath79/generic/base-files/etc/board.d/01_leds b/target/linux/ath79/generic/base-files/etc/board.d/01_leds
index 0e5731dd743186..6409adb78ad825 100644
--- a/target/linux/ath79/generic/base-files/etc/board.d/01_leds
+++ b/target/linux/ath79/generic/base-files/etc/board.d/01_leds
@@ -222,7 +222,8 @@ openmesh,mr900-v1|\
 openmesh,mr900-v2|\
 openmesh,mr1750-v1|\
 openmesh,mr1750-v2|\
-tplink,cpe710-v1)
+tplink,cpe710-v1|\
+tplink,cpe710-v2)
 	ucidef_set_led_netdev "lan" "LAN" "blue:lan" "eth0"
 	;;
 compex,wpj344-16m|\
diff --git a/target/linux/ath79/generic/base-files/etc/board.d/02_network b/target/linux/ath79/generic/base-files/etc/board.d/02_network
index 8474c1c4c2df00..dedbaf05b8014a 100644
--- a/target/linux/ath79/generic/base-files/etc/board.d/02_network
+++ b/target/linux/ath79/generic/base-files/etc/board.d/02_network
@@ -76,6 +76,7 @@ ath79_setup_interfaces()
 	ruckus,zf7351|\
 	siemens,ws-ap3610|\
 	sophos,ap15|\
+	sophos,ap15c|\
 	sophos,ap55|\
 	sophos,ap55c|\
 	sophos,ap100|\
@@ -88,6 +89,7 @@ ath79_setup_interfaces()
 	tplink,cpe610-v1|\
 	tplink,cpe610-v2|\
 	tplink,cpe710-v1|\
+	tplink,cpe710-v2|\
 	tplink,eap225-outdoor-v1|\
 	tplink,eap225-outdoor-v3|\
 	tplink,eap225-v1|\
@@ -211,6 +213,10 @@ ath79_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0@eth1" "1:lan" "2:lan" "3:lan" "4:lan" "5:wan" "6@eth0"
 		;;
+	buffalo,wzr-450hp2)
+		ucidef_add_switch "switch0" \
+			"6@eth1" "1:lan" "2:lan" "3:lan" "4:lan" "5:wan" "0@eth0"
+		;;
 	buffalo,wzr-600dhp|\
 	buffalo,wzr-hp-ag300h|\
 	tplink,archer-c25-v1|\
@@ -399,6 +405,10 @@ ath79_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"0@eth0" "1:lan:2" "4:lan:1"
 		;;
+	kuwfi,n650)
+		ucidef_add_switch "switch0" \
+			"0@eth0" "2:lan:1" "3:lan:2"
+		;;
 	letv,lba-047-ch)
 		ucidef_set_interface_wan "eth0"
 		ucidef_add_switch "switch0" \
@@ -715,6 +725,9 @@ ath79_setup_macs()
 		lan_mac=$(mtd_get_mac_ascii devdata "lanmac")
 		wan_mac=$(mtd_get_mac_ascii devdata "wanmac")
 		;;
+	elecom,wab-i1750-ps|\
+	elecom,wab-s1167-ps|\
+	elecom,wab-s600-ps|\
 	engenius,ecb1200|\
 	engenius,ecb1750)
 		lan_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
diff --git a/target/linux/ath79/generic/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac b/target/linux/ath79/generic/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
index 6676e4d509873f..5155d240a825ac 100644
--- a/target/linux/ath79/generic/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
+++ b/target/linux/ath79/generic/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
@@ -42,6 +42,16 @@ case "$board" in
 		[ "$PHYNBR" -eq 1 ] && \
 			mtd_get_mac_ascii bdcfg "wlanmac" > /sys${DEVPATH}/macaddress
 		;;
+	elecom,wab-i1750-ps|\
+	elecom,wab-s1167-ps|\
+	elecom,wab-s600-ps)
+		# set the 5G MAC address (= ethaddr + 1)
+		[ "$PHYNBR" -eq 0 ] && \
+			macaddr_add "$(mtd_get_mac_ascii u-boot-env ethaddr)" 1 > /sys${DEVPATH}/macaddress
+		# set the 2.4G MAC address (= ethaddr)
+		[ "$PHYNBR" -eq 1 ] && \
+			mtd_get_mac_ascii u-boot-env "ethaddr" > /sys${DEVPATH}/macaddress
+		;;
 	engenius,ecb1200|\
 	engenius,ecb1750)
 		[ "$PHYNBR" -eq 0 ] && \
diff --git a/target/linux/ath79/image/Makefile b/target/linux/ath79/image/Makefile
index 5647200b4ba04c..1918a8a4318dfb 100644
--- a/target/linux/ath79/image/Makefile
+++ b/target/linux/ath79/image/Makefile
@@ -4,7 +4,7 @@ include $(INCLUDE_DIR)/image.mk
 KERNEL_LOADADDR = 0x80060000
 
 DEVICE_VARS += LOADER_FLASH_OFFS LOADER_TYPE
-DEVICE_VARS += LOADER_FLASH_MAX LOADER_KERNEL_MAGIC
+DEVICE_VARS += LOADER_FLASH_MAX LOADER_KERNEL_MAGIC LZMA_TEXT_START
 DEVICE_VARS += NETGEAR_BOARD_ID NETGEAR_HW_ID
 DEVICE_VARS += RAS_BOARD RAS_ROOTFS_SIZE RAS_VERSION
 DEVICE_VARS += SEAMA_SIGNATURE SEAMA_MTDBLOCK
@@ -14,6 +14,7 @@ define Build/loader-common
 	$(MAKE) -C lzma-loader \
 		PKG_BUILD_DIR="$@.src" \
 		TARGET_DIR="$(dir $@)" LOADER_NAME="$(notdir $@)" \
+		LZMA_TEXT_START=$(LZMA_TEXT_START) \
 		$(1) compile loader.$(LOADER_TYPE)
 	mv "$@.$(LOADER_TYPE)" "$@"
 	rm -rf $@.src
@@ -74,6 +75,7 @@ define Device/Default
   LOADER_FLASH_MAX :=
   LOADER_FLASH_OFFS :=
   LOADER_TYPE :=
+  LZMA_TEXT_START := 0x81800000
   COMPILE :=
   IMAGES := sysupgrade.bin
   IMAGE/sysupgrade.bin = append-kernel | pad-to $$$$(BLOCKSIZE) | \
diff --git a/target/linux/ath79/image/common-nec.mk b/target/linux/ath79/image/common-nec.mk
index 7981a72d8eed5c..23671e215de8d1 100644
--- a/target/linux/ath79/image/common-nec.mk
+++ b/target/linux/ath79/image/common-nec.mk
@@ -8,6 +8,7 @@ endef
 define Device/nec-netbsd-aterm
   DEVICE_VENDOR := NEC
   LOADER_TYPE := bin
+  LZMA_TEXT_START := 0x82800000
   KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | uImage none
   KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | uImage none
   ARTIFACTS := uboot.bin
diff --git a/target/linux/ath79/image/generic-tp-link.mk b/target/linux/ath79/image/generic-tp-link.mk
index 643de76f7c2ba7..9c1cf90a9196ca 100644
--- a/target/linux/ath79/image/generic-tp-link.mk
+++ b/target/linux/ath79/image/generic-tp-link.mk
@@ -104,7 +104,7 @@ define Device/tplink_archer-c6-v2
   DEVICE_MODEL := Archer C6
   DEVICE_VARIANT := v2 (EU/RU/JP)
   TPLINK_BOARD_ID := ARCHER-C6-V2
-  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9888-ct
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9888-ct -ath10k-board-qca9888 ipq-wifi-tplink_archer-c6-v2
 endef
 TARGET_DEVICES += tplink_archer-c6-v2
 
@@ -391,6 +391,17 @@ define Device/tplink_cpe710-v1
 endef
 TARGET_DEVICES += tplink_cpe710-v1
 
+define Device/tplink_cpe710-v2
+  $(Device/tplink-safeloader-uimage)
+  SOC := qca9563
+  IMAGE_SIZE := 15680k
+  DEVICE_MODEL := CPE710
+  DEVICE_VARIANT := v2
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9888-ct
+  TPLINK_BOARD_ID := CPE710V2
+endef
+TARGET_DEVICES += tplink_cpe710-v2
+
 define Device/tplink-eap2x5
   $(Device/tplink-safeloader)
   LOADER_TYPE := elf
diff --git a/target/linux/ath79/image/generic.mk b/target/linux/ath79/image/generic.mk
index c075f050db2298..e7aed14bd3e7ab 100644
--- a/target/linux/ath79/image/generic.mk
+++ b/target/linux/ath79/image/generic.mk
@@ -759,6 +759,18 @@ define Device/buffalo_wzr-hp-g450h
 endef
 TARGET_DEVICES += buffalo_wzr-hp-g450h
 
+define Device/buffalo_wzr-450hp2
+  $(Device/buffalo_common)
+  SOC := qca9558
+  DEVICE_MODEL := WZR-450HP2
+  DEVICE_ALT0_VENDOR := Buffalo
+  DEVICE_ALT0_MODEL := WZR-450HP2D
+  BUFFALO_PRODUCT := WZR-450HP2
+  IMAGE_SIZE := 15936k
+  SUPPORTED_DEVICES += wzr-450hp2
+endef
+TARGET_DEVICES += buffalo_wzr-450hp2
+
 define Device/comfast_cf-e110n-v2
   SOC := qca9533
   DEVICE_VENDOR := COMFAST
@@ -1963,6 +1975,25 @@ define Device/kuwfi_c910
 endef
 TARGET_DEVICES += kuwfi_c910
 
+define Device/kuwfi_n650
+  $(Device/loader-okli-uimage)
+  SOC := qca9563
+  DEVICE_VENDOR := KuWFi
+  DEVICE_MODEL := N650
+  DEVICE_PACKAGES += kmod-ath10k-ct ath10k-firmware-qca9888-ct
+  FACTORY_SIZE := 13632k
+  LOADER_FLASH_OFFS := 0x40000
+  KERNEL := kernel-bin | append-dtb | lzma | uImage lzma -M 0x4f4b4c49
+  IMAGE_SIZE := 15040k
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-kernel | pad-to $$$$(BLOCKSIZE) | \
+    append-rootfs | pad-rootfs | check-size | pad-to 13568k | \
+    append-loader-okli-uimage $(1) | pad-to 64k | check-size $$$$(FACTORY_SIZE)
+  ARTIFACTS := loader.bin
+  ARTIFACT/loader.bin := append-loader-okli-uimage $(1) | pad-to 64k
+endef
+TARGET_DEVICES += kuwfi_n650
+
 define Device/letv_lba-047-ch
   $(Device/loader-okli-uimage)
   SOC := qca9531
@@ -2972,6 +3003,14 @@ define Device/sophos_ap15
 endef
 TARGET_DEVICES += sophos_ap15
 
+define Device/sophos_ap15c
+  SOC := qca9557
+  DEVICE_VENDOR := Sophos
+  DEVICE_MODEL := AP15C
+  IMAGE_SIZE := 15936k
+endef
+TARGET_DEVICES += sophos_ap15c
+
 define Device/sophos_ap55
   SOC := qca9558
   DEVICE_VENDOR := Sophos
@@ -3224,7 +3263,7 @@ define Device/xiaomi_aiot-ac2350
   SOC := qca9563
   DEVICE_VENDOR := Xiaomi
   DEVICE_MODEL := AIoT AC2350
-  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9984-ct
+  DEVICE_PACKAGES := kmod-ath10k-ct ath10k-firmware-qca9984-ct ipq-wifi-xiaomi_aiot-ac2350
   IMAGE_SIZE := 14336k
 endef
 TARGET_DEVICES += xiaomi_aiot-ac2350
diff --git a/target/linux/ath79/image/lzma-loader/src/board.c b/target/linux/ath79/image/lzma-loader/src/board.c
index 14451085085ce1..294ca307d5d797 100644
--- a/target/linux/ath79/image/lzma-loader/src/board.c
+++ b/target/linux/ath79/image/lzma-loader/src/board.c
@@ -209,7 +209,7 @@ static inline void huawei_ap_init(void)
 #if defined(CONFIG_BOARD_HUAWEI_AP5030DN)
 	WRITEREG(gpiobase + AR934X_GPIO_REG_OUT_FUNC3,
 			reg | (QCA955X_GPIO_OUTSEL_CLK_OBS5 << 24));
-#else if defined(CONFIG_BOARD_HUAWEI_AP6010DN)
+#elif defined(CONFIG_BOARD_HUAWEI_AP6010DN)
 	WRITEREG(gpiobase + AR934X_GPIO_REG_OUT_FUNC3,
 			reg | (AR934X_GPIO_OUTSEL_CLK_OBS4 << 24));
 #endif
diff --git a/target/linux/ath79/image/nand.mk b/target/linux/ath79/image/nand.mk
index a3bdedaf6d53d5..68cb5431872f23 100644
--- a/target/linux/ath79/image/nand.mk
+++ b/target/linux/ath79/image/nand.mk
@@ -281,6 +281,12 @@ TARGET_DEVICES += glinet_gl-x1200-nor
 
 define Device/linksys_ea4500-v3
   SOC := qca9558
+  DEVICE_COMPAT_VERSION := 1.1
+  DEVICE_COMPAT_MESSAGE := Partition table has been changed. Please \
+	install kmod-mtd-rw and erase mtd8 (syscfg) before upgrade \
+	to keep configures, or forcibly flash factory image to mtd5 \
+	(firmware) partition with mtd tool to discard configures but \
+	claim additional space immediately.
   DEVICE_VENDOR := Linksys
   DEVICE_MODEL := EA4500
   DEVICE_VARIANT := v3
@@ -288,7 +294,7 @@ define Device/linksys_ea4500-v3
   BLOCKSIZE := 128k
   PAGESIZE := 2048
   KERNEL_SIZE := 4096k
-  IMAGE_SIZE := 81920k
+  IMAGE_SIZE := 128256k
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   LINKSYS_HWNAME := EA4500V3
   IMAGES += factory.img
@@ -307,10 +313,9 @@ define Device/meraki_mr18
   BLOCKSIZE := 128k
   PAGESIZE := 2048
   LOADER_TYPE := bin
+  LZMA_TEXT_START := 0x82800000
   KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | meraki-header MR18
-# Initramfs-build fails due to size issues
-# KERNEL_INITRAMFS := $$(KERNEL)
-  KERNEL_INITRAMFS :=
+  KERNEL_INITRAMFS := $$(KERNEL)
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   SUPPORTED_DEVICES += mr18
 endef
@@ -436,6 +441,10 @@ define Device/zte_mf28x_common
   DEVICE_PACKAGES := kmod-usb2 kmod-ath10k-ct
   BLOCKSIZE := 128k
   PAGESIZE := 2048
+  LOADER_TYPE := bin
+  LZMA_TEXT_START := 0x82800000
+  KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | uImage none
+  KERNEL_INITRAMFS := $$(KERNEL)
   KERNEL_SIZE := 4096k
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
 endef
diff --git a/target/linux/ath79/image/tiny-tp-link.mk b/target/linux/ath79/image/tiny-tp-link.mk
index 93cbc7d148cfd3..70c3ab4c7b5d54 100644
--- a/target/linux/ath79/image/tiny-tp-link.mk
+++ b/target/linux/ath79/image/tiny-tp-link.mk
@@ -481,6 +481,7 @@ define Device/tplink_tl-wr941-v2
   $(Device/tplink-4m)
   SOC := ar9132
   DEVICE_MODEL := TL-WR941ND
+  DEVICE_PACKAGES := kmod-dsa-mv88e6060
   DEVICE_VARIANT := v2/v3
   DEVICE_ALT0_VENDOR := TP-Link
   DEVICE_ALT0_MODEL := TL-WR941N
diff --git a/target/linux/ath79/nand/base-files/etc/board.d/05_compat-version b/target/linux/ath79/nand/base-files/etc/board.d/05_compat-version
index 238927aa7b474c..4d826d978d62ad 100644
--- a/target/linux/ath79/nand/base-files/etc/board.d/05_compat-version
+++ b/target/linux/ath79/nand/base-files/etc/board.d/05_compat-version
@@ -4,6 +4,7 @@
 board_config_update
 
 case "$(board_name)" in
+	linksys,ea4500-v3|\
 	netgear,wndr4300-v2|\
 	netgear,wndr4500-v3)
 		ucidef_set_compat_version "1.1"
diff --git a/target/linux/ath79/patches-6.6/101-reset-ath79-reset-ETH-switch-for-AR9344.patch b/target/linux/ath79/patches-6.6/101-reset-ath79-reset-ETH-switch-for-AR9344.patch
new file mode 100644
index 00000000000000..5d9daf1c1ce681
--- /dev/null
+++ b/target/linux/ath79/patches-6.6/101-reset-ath79-reset-ETH-switch-for-AR9344.patch
@@ -0,0 +1,105 @@
+From: David Bauer <mail@david-bauer.net>
+Date: Tue, 2 Jan 2025 19:22:40 +0100
+Subject: [PATCH] reset: ath79: reset ETH switch for AR9344
+
+According to datasheet, on AR9344 the switch and switch analog need to
+be reset first before initiating a full reset.
+
+Resetting these systems fixes spurious reset hangs on Atheros AR9344
+SoCs.
+
+Link: https://github.com/freifunk-gluon/gluon/issues/2904
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+
+--- a/drivers/reset/reset-ath79.c
++++ b/drivers/reset/reset-ath79.c
+@@ -12,8 +12,11 @@
+ #include <linux/platform_device.h>
+ #include <linux/reset-controller.h>
+ #include <linux/reboot.h>
++#include <linux/delay.h>
++#include <linux/of.h>
+ 
+ struct ath79_reset {
++	struct platform_device *pdev;
+ 	struct reset_controller_dev rcdev;
+ 	struct notifier_block restart_nb;
+ 	void __iomem *base;
+@@ -21,16 +24,13 @@ struct ath79_reset {
+ };
+ 
+ #define FULL_CHIP_RESET 24
++#define ETH_SWITCH_RESET 8
++#define ETH_SWITCH_ARESET 12
+ 
+-static int ath79_reset_update(struct reset_controller_dev *rcdev,
++static void __ath79_reset_update_unlocked(struct ath79_reset *ath79_reset,
+ 			unsigned long id, bool assert)
+ {
+-	struct ath79_reset *ath79_reset =
+-		container_of(rcdev, struct ath79_reset, rcdev);
+-	unsigned long flags;
+ 	u32 val;
+-
+-	spin_lock_irqsave(&ath79_reset->lock, flags);
+ 	val = readl(ath79_reset->base);
+ 	if (assert)
+ 		val |= BIT(id);
+@@ -39,6 +39,17 @@ static int ath79_reset_update(struct res
+ 	writel(val, ath79_reset->base);
+ 	/* Flush cache */
+ 	readl(ath79_reset->base);
++}
++
++static int ath79_reset_update(struct reset_controller_dev *rcdev,
++			unsigned long id, bool assert)
++{
++	struct ath79_reset *ath79_reset =
++		container_of(rcdev, struct ath79_reset, rcdev);
++	unsigned long flags;
++
++	spin_lock_irqsave(&ath79_reset->lock, flags);
++	__ath79_reset_update_unlocked(ath79_reset, id, assert);
+ 	spin_unlock_irqrestore(&ath79_reset->lock, flags);
+ 
+ 	return 0;
+@@ -79,8 +90,28 @@ static int ath79_reset_restart_handler(s
+ {
+ 	struct ath79_reset *ath79_reset =
+ 		container_of(nb, struct ath79_reset, restart_nb);
++	unsigned long flags;
+ 
+-	ath79_reset_assert(&ath79_reset->rcdev, FULL_CHIP_RESET);
++	spin_lock_irqsave(&ath79_reset->lock, flags);
++
++	if (of_device_is_compatible(ath79_reset->pdev->dev.of_node, "qca,ar9340-reset")) {
++		/**
++		 * AR9344 has been observed to hang on reboot in rare cases.
++		 *
++		 * Datasheet states to reset the ETH switch systems before asserting
++		 * full chip reset. See page 111 of the AR9344 datasheet.
++		 */
++		__ath79_reset_update_unlocked(ath79_reset, ETH_SWITCH_RESET, true);
++		mdelay(1);
++		__ath79_reset_update_unlocked(ath79_reset, ETH_SWITCH_ARESET, true);
++		mdelay(1);
++		__ath79_reset_update_unlocked(ath79_reset, FULL_CHIP_RESET, true);
++		mdelay(10);
++	} else {
++		__ath79_reset_update_unlocked(ath79_reset, FULL_CHIP_RESET, true);
++	}
++
++	spin_unlock_irqrestore(&ath79_reset->lock, flags);
+ 
+ 	return NOTIFY_DONE;
+ }
+@@ -95,6 +126,8 @@ static int ath79_reset_probe(struct plat
+ 	if (!ath79_reset)
+ 		return -ENOMEM;
+ 
++	ath79_reset->pdev = pdev;
++
+ 	ath79_reset->base = devm_platform_ioremap_resource(pdev, 0);
+ 	if (IS_ERR(ath79_reset->base))
+ 		return PTR_ERR(ath79_reset->base);
diff --git a/target/linux/ath79/patches-6.6/810-ath79-ignore-the-abused-interrupt-map-on-pcie-node.patch b/target/linux/ath79/patches-6.6/810-ath79-ignore-the-abused-interrupt-map-on-pcie-node.patch
index 330c0d139b33f8..b53461e37f65d0 100644
--- a/target/linux/ath79/patches-6.6/810-ath79-ignore-the-abused-interrupt-map-on-pcie-node.patch
+++ b/target/linux/ath79/patches-6.6/810-ath79-ignore-the-abused-interrupt-map-on-pcie-node.patch
@@ -22,7 +22,7 @@ Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
 
 --- a/drivers/of/irq.c
 +++ b/drivers/of/irq.c
-@@ -89,6 +89,8 @@ EXPORT_SYMBOL_GPL(of_irq_find_parent);
+@@ -94,6 +94,8 @@ EXPORT_SYMBOL_GPL(of_irq_find_parent);
   * drawing board.
   */
  static const char * const of_irq_imap_abusers[] = {
diff --git a/target/linux/ath79/patches-6.6/820-mfd-syscon-support-skip-reset-control-for-syscon-devices.patch b/target/linux/ath79/patches-6.6/820-mfd-syscon-support-skip-reset-control-for-syscon-devices.patch
index c73c8443b9f3eb..3bdc2faf3ff81a 100644
--- a/target/linux/ath79/patches-6.6/820-mfd-syscon-support-skip-reset-control-for-syscon-devices.patch
+++ b/target/linux/ath79/patches-6.6/820-mfd-syscon-support-skip-reset-control-for-syscon-devices.patch
@@ -16,16 +16,16 @@ Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
 
 --- a/drivers/mfd/syscon.c
 +++ b/drivers/mfd/syscon.c
-@@ -52,7 +52,7 @@ static struct syscon *of_syscon_register
+@@ -53,7 +53,7 @@ static struct syscon *of_syscon_register
  	int ret;
  	struct regmap_config syscon_config = syscon_regmap_config;
  	struct resource res;
 -	struct reset_control *reset;
 +	struct reset_control *reset = NULL;
  
- 	syscon = kzalloc(sizeof(*syscon), GFP_KERNEL);
- 	if (!syscon)
-@@ -134,7 +134,8 @@ static struct syscon *of_syscon_register
+ 	WARN_ON(!mutex_is_locked(&syscon_list_lock));
+ 
+@@ -133,7 +133,8 @@ static struct syscon *of_syscon_register
  				goto err_attach_clk;
  		}
  
diff --git a/target/linux/ath79/patches-6.6/900-unaligned_access_hacks.patch b/target/linux/ath79/patches-6.6/900-unaligned_access_hacks.patch
index c5b01b7daddfc4..2e574740bebdcf 100644
--- a/target/linux/ath79/patches-6.6/900-unaligned_access_hacks.patch
+++ b/target/linux/ath79/patches-6.6/900-unaligned_access_hacks.patch
@@ -259,7 +259,7 @@ SVN-Revision: 35130
  #include <linux/uaccess.h>
  #include <linux/ipv6.h>
  #include <linux/icmpv6.h>
-@@ -893,10 +894,10 @@ static void tcp_v6_send_response(const s
+@@ -891,10 +892,10 @@ static void tcp_v6_send_response(const s
  	topt = (__be32 *)(t1 + 1);
  
  	if (tsecr) {
@@ -323,7 +323,7 @@ SVN-Revision: 35130
  					 SKB_DROP_REASON_IP_INHDR);
 --- a/include/linux/types.h
 +++ b/include/linux/types.h
-@@ -244,5 +244,11 @@ typedef void (*swap_func_t)(void *a, voi
+@@ -245,5 +245,11 @@ typedef void (*swap_func_t)(void *a, voi
  typedef int (*cmp_r_func_t)(const void *a, const void *b, const void *priv);
  typedef int (*cmp_func_t)(const void *a, const void *b);
  
@@ -337,7 +337,7 @@ SVN-Revision: 35130
  #endif /* _LINUX_TYPES_H */
 --- a/net/ipv4/af_inet.c
 +++ b/net/ipv4/af_inet.c
-@@ -1508,8 +1508,8 @@ struct sk_buff *inet_gro_receive(struct
+@@ -1506,8 +1506,8 @@ struct sk_buff *inet_gro_receive(struct
  		goto out;
  
  	NAPI_GRO_CB(skb)->proto = proto;
@@ -350,7 +350,7 @@ SVN-Revision: 35130
  	list_for_each_entry(p, head, list) {
 --- a/net/ipv4/tcp_output.c
 +++ b/net/ipv4/tcp_output.c
-@@ -622,48 +622,53 @@ static void tcp_options_write(struct tcp
+@@ -625,48 +625,53 @@ static void tcp_options_write(struct tcp
  	u16 options = opts->options;	/* mungable copy */
  
  	if (unlikely(OPTION_MD5 & options)) {
@@ -427,7 +427,7 @@ SVN-Revision: 35130
  	}
  
  	if (unlikely(opts->num_sack_blocks)) {
-@@ -671,16 +676,17 @@ static void tcp_options_write(struct tcp
+@@ -674,16 +679,17 @@ static void tcp_options_write(struct tcp
  			tp->duplicate_sack : tp->selective_acks;
  		int this_sack;
  
@@ -451,7 +451,7 @@ SVN-Revision: 35130
  		}
  
  		tp->rx_opt.dsack = 0;
-@@ -693,13 +699,14 @@ static void tcp_options_write(struct tcp
+@@ -696,13 +702,14 @@ static void tcp_options_write(struct tcp
  
  		if (foc->exp) {
  			len = TCPOLEN_EXP_FASTOPEN_BASE + foc->len;
@@ -557,7 +557,7 @@ SVN-Revision: 35130
  static inline struct neighbour *__ipv6_neigh_lookup_noref(struct net_device *dev, const void *pkey)
 --- a/net/sched/cls_u32.c
 +++ b/net/sched/cls_u32.c
-@@ -157,7 +157,7 @@ next_knode:
+@@ -167,7 +167,7 @@ next_knode:
  			data = skb_header_pointer(skb, toff, 4, &hdata);
  			if (!data)
  				goto out;
@@ -566,7 +566,7 @@ SVN-Revision: 35130
  				n = rcu_dereference_bh(n->next);
  				goto next_knode;
  			}
-@@ -208,8 +208,8 @@ check_terminal:
+@@ -218,8 +218,8 @@ check_terminal:
  						  &hdata);
  			if (!data)
  				goto out;
@@ -579,7 +579,7 @@ SVN-Revision: 35130
  			goto next_ht;
 --- a/net/ipv6/ip6_offload.c
 +++ b/net/ipv6/ip6_offload.c
-@@ -273,7 +273,7 @@ INDIRECT_CALLABLE_SCOPE struct sk_buff *
+@@ -275,7 +275,7 @@ INDIRECT_CALLABLE_SCOPE struct sk_buff *
  			continue;
  
  		iph2 = (struct ipv6hdr *)(p->data + off);
@@ -751,7 +751,7 @@ SVN-Revision: 35130
  EXPORT_SYMBOL(xfrm_parse_spi);
 --- a/net/ipv4/tcp_input.c
 +++ b/net/ipv4/tcp_input.c
-@@ -4262,14 +4262,16 @@ static bool tcp_parse_aligned_timestamp(
+@@ -4283,14 +4283,16 @@ static bool tcp_parse_aligned_timestamp(
  {
  	const __be32 *ptr = (const __be32 *)(th + 1);
  
@@ -785,7 +785,7 @@ SVN-Revision: 35130
  
 --- a/include/net/neighbour.h
 +++ b/include/net/neighbour.h
-@@ -286,8 +286,10 @@ static inline bool neigh_key_eq128(const
+@@ -287,8 +287,10 @@ static inline bool neigh_key_eq128(const
  	const u32 *n32 = (const u32 *)n->primary_key;
  	const u32 *p32 = pkey;
  
@@ -858,7 +858,7 @@ SVN-Revision: 35130
  
 --- a/net/ipv4/tcp_offload.c
 +++ b/net/ipv4/tcp_offload.c
-@@ -63,7 +63,7 @@ static struct sk_buff *__tcpv4_gso_segme
+@@ -66,7 +66,7 @@ static struct sk_buff *__tcpv4_gso_segme
  	th2 = tcp_hdr(seg->next);
  	iph2 = ip_hdr(seg->next);
  
@@ -867,7 +867,7 @@ SVN-Revision: 35130
  	    iph->daddr == iph2->daddr && iph->saddr == iph2->saddr)
  		return segs;
  
-@@ -264,7 +264,7 @@ struct sk_buff *tcp_gro_lookup(struct li
+@@ -267,7 +267,7 @@ struct sk_buff *tcp_gro_lookup(struct li
  			continue;
  
  		th2 = tcp_hdr(p);
@@ -876,7 +876,7 @@ SVN-Revision: 35130
  			NAPI_GRO_CB(p)->same_flow = 0;
  			continue;
  		}
-@@ -330,8 +330,8 @@ struct sk_buff *tcp_gro_receive(struct l
+@@ -333,8 +333,8 @@ struct sk_buff *tcp_gro_receive(struct l
  		  ~(TCP_FLAG_CWR | TCP_FLAG_FIN | TCP_FLAG_PSH));
  	flush |= (__force int)(th->ack_seq ^ th2->ack_seq);
  	for (i = sizeof(*th); i < thlen; i += 4)
diff --git a/target/linux/ath79/tiny/config-default b/target/linux/ath79/tiny/config-default
index e47260df82056f..38fbe1b5228be3 100644
--- a/target/linux/ath79/tiny/config-default
+++ b/target/linux/ath79/tiny/config-default
@@ -1,9 +1,6 @@
 CONFIG_GRO_CELLS=y
 CONFIG_MTD_SPI_NOR_USE_4K_SECTORS=y
 CONFIG_NET_DEVLINK=y
-CONFIG_NET_DSA=y
-CONFIG_NET_DSA_MV88E6060=y
-CONFIG_NET_DSA_TAG_TRAILER=y
 CONFIG_NET_SWITCHDEV=y
 CONFIG_NVMEM_SYSFS=y
 CONFIG_NVMEM_U_BOOT_ENV=y
diff --git a/target/linux/bcm27xx/base-files/etc/board.d/02_network b/target/linux/bcm27xx/base-files/etc/board.d/02_network
index f246139c385bd8..e05c369d642db2 100644
--- a/target/linux/bcm27xx/base-files/etc/board.d/02_network
+++ b/target/linux/bcm27xx/base-files/etc/board.d/02_network
@@ -17,6 +17,8 @@ raspberrypi,3-model-b-plus |\
 raspberrypi,400 |\
 raspberrypi,4-compute-module |\
 raspberrypi,4-model-b |\
+raspberrypi,500 |\
+raspberrypi,5-compute-module |\
 raspberrypi,5-model-b |\
 raspberrypi,model-b |\
 raspberrypi,model-b-plus |\
diff --git a/target/linux/bcm27xx/base-files/lib/preinit/05_set_preinit_iface_brcm2708 b/target/linux/bcm27xx/base-files/lib/preinit/05_set_preinit_iface_brcm2708
index 120475b55dcda6..bce75d7119b29a 100644
--- a/target/linux/bcm27xx/base-files/lib/preinit/05_set_preinit_iface_brcm2708
+++ b/target/linux/bcm27xx/base-files/lib/preinit/05_set_preinit_iface_brcm2708
@@ -12,6 +12,8 @@ set_preinit_iface() {
 	raspberrypi,400 |\
 	raspberrypi,4-compute-module |\
 	raspberrypi,4-model-b |\
+	raspberrypi,500 |\
+	raspberrypi,5-compute-module |\
 	raspberrypi,5-model-b |\
 	raspberrypi,model-b |\
 	raspberrypi,model-b-plus |\
diff --git a/target/linux/bcm27xx/bcm2708/config-6.6 b/target/linux/bcm27xx/bcm2708/config-6.6
index 4872e44642f8f0..84be5f8d27365e 100644
--- a/target/linux/bcm27xx/bcm2708/config-6.6
+++ b/target/linux/bcm27xx/bcm2708/config-6.6
@@ -55,8 +55,6 @@ CONFIG_BRCM_CHAR_DRIVERS=y
 CONFIG_BUFFER_HEAD=y
 # CONFIG_CACHE_L2X0 is not set
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLK_BCM2711_DVP=y
 CONFIG_CLK_BCM2835=y
@@ -172,7 +170,6 @@ CONFIG_FWNODE_MDIO=y
 CONFIG_FW_CACHE=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_BUG=y
 CONFIG_GENERIC_CLOCKEVENTS=y
@@ -252,11 +249,11 @@ CONFIG_MFD_SYSCON=y
 CONFIG_MIGHT_HAVE_CACHE_L2X0=y
 CONFIG_MIGRATION=y
 CONFIG_MMC=y
-# CONFIG_MMC_BCM2835 is not set
+CONFIG_MMC_BCM2835=y
 CONFIG_MMC_BCM2835_DMA=y
 CONFIG_MMC_BCM2835_MMC=y
 CONFIG_MMC_BCM2835_PIO_DMA_BARRIER=2
-CONFIG_MMC_BCM2835_SDHOST=y
+# CONFIG_MMC_BCM2835_SDHOST is not set
 CONFIG_MMC_BLOCK=y
 CONFIG_MMC_BLOCK_MINORS=32
 CONFIG_MMC_HSQ=y
@@ -317,6 +314,7 @@ CONFIG_PRINTK_TIME=y
 CONFIG_PTP_1588_CLOCK_OPTIONAL=y
 CONFIG_PWM=y
 CONFIG_PWM_BCM2835=y
+CONFIG_PWM_GPIO=y
 CONFIG_PWM_SYSFS=y
 CONFIG_RANDSTRUCT_NONE=y
 CONFIG_RASPBERRYPI_FIRMWARE=y
@@ -349,6 +347,7 @@ CONFIG_SERIAL_DEV_BUS=y
 # CONFIG_SERIAL_DEV_CTRL_TTYPORT is not set
 CONFIG_SERIAL_MCTRL_GPIO=y
 CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_RPI_FW=y
 CONFIG_SG_POOL=y
 CONFIG_SMSC_PHY=y
 CONFIG_SOFTIRQ_ON_OWN_STACK=y
diff --git a/target/linux/bcm27xx/bcm2709/config-6.6 b/target/linux/bcm27xx/bcm2709/config-6.6
index 23e93241dfe3f5..747e3a6684e810 100644
--- a/target/linux/bcm27xx/bcm2709/config-6.6
+++ b/target/linux/bcm27xx/bcm2709/config-6.6
@@ -69,8 +69,6 @@ CONFIG_BROADCOM_PHY=y
 CONFIG_BUFFER_HEAD=y
 # CONFIG_CACHE_L2X0 is not set
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLK_BCM2711_DVP=y
 CONFIG_CLK_BCM2835=y
@@ -211,7 +209,6 @@ CONFIG_FWNODE_MDIO=y
 CONFIG_FW_CACHE=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
 CONFIG_GENERIC_BUG=y
@@ -315,11 +312,11 @@ CONFIG_MICROCHIP_PHY=y
 CONFIG_MIGHT_HAVE_CACHE_L2X0=y
 CONFIG_MIGRATION=y
 CONFIG_MMC=y
-# CONFIG_MMC_BCM2835 is not set
+CONFIG_MMC_BCM2835=y
 CONFIG_MMC_BCM2835_DMA=y
 CONFIG_MMC_BCM2835_MMC=y
 CONFIG_MMC_BCM2835_PIO_DMA_BARRIER=2
-CONFIG_MMC_BCM2835_SDHOST=y
+# CONFIG_MMC_BCM2835_SDHOST is not set
 CONFIG_MMC_BLOCK=y
 CONFIG_MMC_BLOCK_MINORS=32
 CONFIG_MMC_HSQ=y
@@ -401,6 +398,7 @@ CONFIG_PTP_1588_CLOCK=y
 CONFIG_PTP_1588_CLOCK_OPTIONAL=y
 CONFIG_PWM=y
 CONFIG_PWM_BCM2835=y
+CONFIG_PWM_GPIO=y
 CONFIG_PWM_SYSFS=y
 CONFIG_RANDSTRUCT_NONE=y
 CONFIG_RAS=y
@@ -438,6 +436,7 @@ CONFIG_SERIAL_DEV_BUS=y
 # CONFIG_SERIAL_DEV_CTRL_TTYPORT is not set
 CONFIG_SERIAL_MCTRL_GPIO=y
 CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_RPI_FW=y
 CONFIG_SG_POOL=y
 CONFIG_SMP=y
 CONFIG_SMP_ON_UP=y
diff --git a/target/linux/bcm27xx/bcm2710/config-6.6 b/target/linux/bcm27xx/bcm2710/config-6.6
index 5b7d6ae4f1032b..26565cd237a463 100644
--- a/target/linux/bcm27xx/bcm2710/config-6.6
+++ b/target/linux/bcm27xx/bcm2710/config-6.6
@@ -85,8 +85,6 @@ CONFIG_CAVIUM_ERRATUM_23154=y
 CONFIG_CAVIUM_ERRATUM_27456=y
 CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLK_BCM2711_DVP=y
 CONFIG_CLK_BCM2835=y
@@ -218,7 +216,6 @@ CONFIG_FWNODE_MDIO=y
 CONFIG_FW_CACHE=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
@@ -313,11 +310,11 @@ CONFIG_MICROCHIP_PHY=y
 CONFIG_MIGRATION=y
 # CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY is not set
 CONFIG_MMC=y
-# CONFIG_MMC_BCM2835 is not set
+CONFIG_MMC_BCM2835=y
 CONFIG_MMC_BCM2835_DMA=y
 CONFIG_MMC_BCM2835_MMC=y
 CONFIG_MMC_BCM2835_PIO_DMA_BARRIER=2
-CONFIG_MMC_BCM2835_SDHOST=y
+# CONFIG_MMC_BCM2835_SDHOST is not set
 CONFIG_MMC_BLOCK=y
 CONFIG_MMC_BLOCK_MINORS=32
 CONFIG_MMC_HSQ=y
@@ -392,6 +389,7 @@ CONFIG_PRINTK_TIME=y
 CONFIG_PTP_1588_CLOCK_OPTIONAL=y
 CONFIG_PWM=y
 CONFIG_PWM_BCM2835=y
+CONFIG_PWM_GPIO=y
 CONFIG_PWM_SYSFS=y
 CONFIG_QUEUED_RWLOCKS=y
 CONFIG_QUEUED_SPINLOCKS=y
@@ -431,6 +429,7 @@ CONFIG_SERIAL_DEV_BUS=y
 # CONFIG_SERIAL_DEV_CTRL_TTYPORT is not set
 CONFIG_SERIAL_MCTRL_GPIO=y
 CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_RPI_FW=y
 CONFIG_SG_POOL=y
 CONFIG_SMP=y
 CONFIG_SMSC_PHY=y
diff --git a/target/linux/bcm27xx/bcm2711/config-6.6 b/target/linux/bcm27xx/bcm2711/config-6.6
index 270763549a199e..7b37b67fb31b03 100644
--- a/target/linux/bcm27xx/bcm2711/config-6.6
+++ b/target/linux/bcm27xx/bcm2711/config-6.6
@@ -84,8 +84,6 @@ CONFIG_CAVIUM_ERRATUM_23154=y
 CONFIG_CAVIUM_ERRATUM_27456=y
 CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLK_BCM2711_DVP=y
 CONFIG_CLK_BCM2835=y
@@ -219,7 +217,6 @@ CONFIG_FWNODE_MDIO=y
 CONFIG_FW_CACHE=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_NUMA=y
@@ -316,11 +313,11 @@ CONFIG_MFD_CORE=y
 CONFIG_MFD_SYSCON=y
 CONFIG_MIGRATION=y
 CONFIG_MMC=y
-# CONFIG_MMC_BCM2835 is not set
+CONFIG_MMC_BCM2835=y
 CONFIG_MMC_BCM2835_DMA=y
 CONFIG_MMC_BCM2835_MMC=y
 CONFIG_MMC_BCM2835_PIO_DMA_BARRIER=2
-CONFIG_MMC_BCM2835_SDHOST=y
+# CONFIG_MMC_BCM2835_SDHOST is not set
 CONFIG_MMC_BLOCK=y
 CONFIG_MMC_BLOCK_MINORS=32
 CONFIG_MMC_HSQ=y
@@ -408,6 +405,7 @@ CONFIG_PTP_1588_CLOCK=y
 CONFIG_PTP_1588_CLOCK_OPTIONAL=y
 CONFIG_PWM=y
 CONFIG_PWM_BCM2835=y
+CONFIG_PWM_GPIO=y
 CONFIG_PWM_SYSFS=y
 CONFIG_QUEUED_RWLOCKS=y
 CONFIG_QUEUED_SPINLOCKS=y
@@ -448,6 +446,7 @@ CONFIG_SERIAL_DEV_BUS=y
 # CONFIG_SERIAL_DEV_CTRL_TTYPORT is not set
 CONFIG_SERIAL_MCTRL_GPIO=y
 CONFIG_SERIAL_OF_PLATFORM=y
+CONFIG_SERIAL_RPI_FW=y
 CONFIG_SG_POOL=y
 CONFIG_SMP=y
 CONFIG_SOCK_RX_QUEUE_MAPPING=y
diff --git a/target/linux/bcm27xx/bcm2712/config-6.6 b/target/linux/bcm27xx/bcm2712/config-6.6
index a5eb6c4d0e1f12..24f59326ae733d 100644
--- a/target/linux/bcm27xx/bcm2712/config-6.6
+++ b/target/linux/bcm27xx/bcm2712/config-6.6
@@ -110,8 +110,6 @@ CONFIG_BUFFER_HEAD=y
 CONFIG_BUILTIN_RETURN_ADDRESS_STRIPS_PAC=y
 CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLK_BCM2711_DVP=y
 CONFIG_CLK_BCM2835=y
@@ -130,7 +128,7 @@ CONFIG_CMA_SIZE_SEL_MBYTES=y
 # CONFIG_CMA_SYSFS is not set
 CONFIG_COMMON_CLK=y
 CONFIG_COMMON_CLK_RP1=y
-# CONFIG_COMMON_CLK_RP1_SDIO is not set
+CONFIG_COMMON_CLK_RP1_SDIO=y
 CONFIG_COMMON_CLK_XGENE=y
 CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
 # CONFIG_COMPAT_32BIT_TIME is not set
@@ -241,6 +239,7 @@ CONFIG_FB_DEVICE=y
 CONFIG_FB_IOMEM_FOPS=y
 CONFIG_FB_IOMEM_HELPERS=y
 CONFIG_FB_SIMPLE=y
+# CONFIG_FIRMWARE_RP1 is not set
 CONFIG_FIXED_PHY=y
 CONFIG_FIX_EARLYCON_MEM=y
 CONFIG_FONT_8x16=y
@@ -262,7 +261,6 @@ CONFIG_FWNODE_MDIO=y
 CONFIG_FW_CACHE=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_NUMA=y
@@ -322,13 +320,8 @@ CONFIG_HW_CONSOLE=y
 CONFIG_HW_RANDOM=y
 CONFIG_HW_RANDOM_IPROC_RNG200=y
 CONFIG_I2C=y
-CONFIG_I2C_ALGOBIT=y
 # CONFIG_I2C_BCM2708 is not set
-CONFIG_I2C_BCM2835=y
 CONFIG_I2C_BOARDINFO=y
-CONFIG_I2C_BRCMSTB=y
-CONFIG_I2C_DESIGNWARE_CORE=y
-CONFIG_I2C_DESIGNWARE_PLATFORM=y
 CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000
 CONFIG_INPUT=y
 CONFIG_INPUT_MOUSEDEV=y
@@ -374,6 +367,7 @@ CONFIG_MAGIC_SYSRQ=y
 CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1f6
 CONFIG_MAILBOX=y
 # CONFIG_MAILBOX_TEST is not set
+# CONFIG_MBOX_RP1 is not set
 CONFIG_MDIO_BCM_UNIMAC=y
 CONFIG_MDIO_BUS=y
 CONFIG_MDIO_DEVICE=y
@@ -392,11 +386,11 @@ CONFIG_MFD_SYSCON=y
 CONFIG_MICROCHIP_PHY=y
 CONFIG_MIGRATION=y
 CONFIG_MMC=y
-# CONFIG_MMC_BCM2835 is not set
+CONFIG_MMC_BCM2835=y
 CONFIG_MMC_BCM2835_DMA=y
 CONFIG_MMC_BCM2835_MMC=y
 CONFIG_MMC_BCM2835_PIO_DMA_BARRIER=2
-CONFIG_MMC_BCM2835_SDHOST=y
+# CONFIG_MMC_BCM2835_SDHOST is not set
 CONFIG_MMC_BLOCK=y
 CONFIG_MMC_BLOCK_MINORS=32
 CONFIG_MMC_CQHCI=y
@@ -514,6 +508,7 @@ CONFIG_PTP_1588_CLOCK_OPTIONAL=y
 CONFIG_PWM=y
 CONFIG_PWM_BCM2835=y
 CONFIG_PWM_BRCMSTB=y
+CONFIG_PWM_GPIO=y
 CONFIG_PWM_RP1=y
 CONFIG_PWM_SYSFS=y
 CONFIG_QUEUED_RWLOCKS=y
@@ -537,6 +532,7 @@ CONFIG_RESET_RASPBERRYPI=y
 CONFIG_RESET_SIMPLE=y
 CONFIG_RFS_ACCEL=y
 CONFIG_RODATA_FULL_DEFAULT_ENABLED=y
+# CONFIG_RP1_PIO is not set
 # CONFIG_RPI_POE_POWER is not set
 CONFIG_RPS=y
 CONFIG_RTC_CLASS=y
@@ -549,7 +545,7 @@ CONFIG_SCSI_COMMON=y
 # CONFIG_SCSI_LOWLEVEL is not set
 # CONFIG_SCSI_PROC_FS is not set
 CONFIG_SENSORS_RASPBERRYPI_HWMON=y
-CONFIG_SENSORS_RP1_ADC=y
+# CONFIG_SENSORS_RP1_ADC is not set
 CONFIG_SERIAL_8250_BCM2835AUX=y
 CONFIG_SERIAL_8250_BCM7271=y
 # CONFIG_SERIAL_8250_DMA is not set
@@ -577,6 +573,7 @@ CONFIG_SPARSEMEM_VMEMMAP=y
 CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
 CONFIG_SPARSE_IRQ=y
 CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU=y
+CONFIG_SRAM=y
 # CONFIG_STRIP_ASM_SYMS is not set
 CONFIG_SUSPEND=y
 CONFIG_SUSPEND_FREEZER=y
diff --git a/target/linux/bcm27xx/config-6.6 b/target/linux/bcm27xx/config-6.6
index b44aa9f8a9b35d..e69dbf5d74584d 100644
--- a/target/linux/bcm27xx/config-6.6
+++ b/target/linux/bcm27xx/config-6.6
@@ -1,6 +1,7 @@
 # CONFIG_BACKLIGHT_RPI is not set
 # CONFIG_BCM2712_MIP is not set
 # CONFIG_COMMON_CLK_RP1 is not set
+# CONFIG_COMMON_CLK_RP1_SDIO is not set
 # CONFIG_COMMON_CLK_RP1_SDIO  is not set
 # CONFIG_DRM_PANEL_ILITEK_ILI9806E is not set
 # CONFIG_DRM_PANEL_TPO_Y17P is not set
@@ -9,8 +10,10 @@
 # CONFIG_DRM_RP1_DSI is not set
 # CONFIG_DRM_RP1_VEC is not set
 # CONFIG_FB_RPISENSE is not set
+# CONFIG_FIRMWARE_RP1 is not set
 # CONFIG_GPIO_PWM is not set
 # CONFIG_INPUT_RASPBERRYPI_BUTTON is not set
+# CONFIG_MBOX_RP1 is not set
 # CONFIG_MEDIA_PCI_HAILO is not set
 # CONFIG_MFD_PM8921_CORE is not set
 # CONFIG_MFD_RASPBERRYPI_POE_HAT is not set
@@ -19,10 +22,14 @@
 # CONFIG_PHY_CADENCE_DP is not set
 # CONFIG_PINCTRL_BCM2712 is not set
 # CONFIG_PINCTRL_RP1 is not set
+# CONFIG_PWM_PIO_RP1 is not set
 # CONFIG_PWM_RP1 is not set
 # CONFIG_RASPBERRYPI_GPIOMEM is not set
 # CONFIG_REGULATOR_RASPBERRYPI_TOUCHSCREEN_V2 is not set
+# CONFIG_RP1_PIO is not set
 # CONFIG_SENSORS_RP1_ADC is not set
+# CONFIG_SERIAL_RPI_FW is not set
+# CONFIG_SND_PIMIDI is not set
 # CONFIG_SPI_RP2040_GPIO_BRIDGE is not set
 # CONFIG_VIDEO_AD5398 is not set
 # CONFIG_VIDEO_ARDUCAM_64MP is not set
@@ -39,3 +46,4 @@
 # CONFIG_VIDEO_OV64A40 is not set
 # CONFIG_VIDEO_RASPBERRYPI_PISP_BE is not set
 # CONFIG_VIDEO_RP1_CFE is not set
+# CONFIG_WS2812_PIO_RP1 is not set
diff --git a/target/linux/bcm27xx/image/Makefile b/target/linux/bcm27xx/image/Makefile
index 23bc3a35c9edd8..8320855573a455 100644
--- a/target/linux/bcm27xx/image/Makefile
+++ b/target/linux/bcm27xx/image/Makefile
@@ -88,7 +88,9 @@ define Device/rpi
   DEVICE_PACKAGES := \
 	cypress-firmware-43430-sdio \
 	brcmfmac-nvram-43430-sdio \
-	kmod-brcmfmac wpad-basic-mbedtls
+	kmod-brcmfmac wpad-basic-mbedtls \
+	kmod-i2c-bcm2835 kmod-spi-bcm2835 \
+	kmod-spi-bcm2835-aux
 endef
 ifeq ($(SUBTARGET),bcm2708)
   TARGET_DEVICES += rpi
@@ -127,7 +129,9 @@ define Device/rpi-2
 	brcmfmac-nvram-43430-sdio \
 	cypress-firmware-43455-sdio \
 	brcmfmac-nvram-43455-sdio \
-	kmod-brcmfmac wpad-basic-mbedtls
+	kmod-brcmfmac wpad-basic-mbedtls \
+	kmod-i2c-bcm2835 kmod-spi-bcm2835 \
+	kmod-spi-bcm2835-aux
   IMAGE/sysupgrade.img.gz := boot-common | boot-2708 | boot-2711 | sdcard-img | gzip | append-metadata
   IMAGE/factory.img.gz := boot-common | boot-2708 | boot-2711 | sdcard-img | gzip
 endef
@@ -161,7 +165,9 @@ define Device/rpi-3
 	brcmfmac-nvram-43430-sdio \
 	cypress-firmware-43455-sdio \
 	brcmfmac-nvram-43455-sdio \
-	kmod-brcmfmac wpad-basic-mbedtls
+	kmod-brcmfmac wpad-basic-mbedtls \
+	kmod-i2c-bcm2835 kmod-spi-bcm2835 \
+	kmod-spi-bcm2835-aux
 endef
 ifeq ($(SUBTARGET),bcm2710)
   TARGET_DEVICES += rpi-3
@@ -183,6 +189,9 @@ define Device/rpi-4
 	cypress-firmware-43455-sdio \
 	brcmfmac-nvram-43455-sdio \
 	kmod-brcmfmac wpad-basic-mbedtls \
+	kmod-i2c-bcm2835 kmod-spi-bcm2835 \
+	kmod-spi-bcm2835-aux \
+	kmod-i2c-brcmstb \
 	kmod-usb-net-lan78xx \
 	kmod-r8169
   IMAGE/sysupgrade.img.gz := boot-common | boot-2711 | sdcard-img | gzip | append-metadata
@@ -193,14 +202,26 @@ ifeq ($(SUBTARGET),bcm2711)
 endif
 
 define Device/rpi-5
-  DEVICE_MODEL := 5
+  DEVICE_MODEL := 5/500/CM5
   KERNEL_IMG := kernel_2712.img
-  DEVICE_DTS := broadcom/bcm2712-rpi-5-b
-  SUPPORTED_DEVICES := raspberrypi,5-model-b
+  DEVICE_DTS := \
+	broadcom/bcm2712-rpi-5-b \
+	broadcom/bcm2712-rpi-cm5-cm4io \
+	broadcom/bcm2712-rpi-cm5-cm5io \
+	broadcom/bcm2712-rpi-cm5l-cm4io \
+	broadcom/bcm2712-rpi-cm5l-cm5io \
+	broadcom/bcm2712d0-rpi-5-b
+  SUPPORTED_DEVICES := \
+	raspberrypi,500 \
+	raspberrypi,5-compute-module \
+	raspberrypi,5-model-b
   DEVICE_PACKAGES := \
 	cypress-firmware-43455-sdio \
 	brcmfmac-nvram-43455-sdio \
 	kmod-brcmfmac wpad-basic-mbedtls \
+	kmod-i2c-bcm2835 kmod-spi-bcm2835 \
+	kmod-i2c-brcmstb \
+	kmod-i2c-designware-platform kmod-spi-dw-mmio \
 	kmod-hwmon-pwmfan kmod-thermal
   IMAGE/sysupgrade.img.gz := boot-common | sdcard-img | gzip | append-metadata
   IMAGE/factory.img.gz := boot-common | sdcard-img | gzip
diff --git a/target/linux/bcm27xx/modules/hwmon.mk b/target/linux/bcm27xx/modules/hwmon.mk
index 0f1547cd4f802c..320b11708f9221 100644
--- a/target/linux/bcm27xx/modules/hwmon.mk
+++ b/target/linux/bcm27xx/modules/hwmon.mk
@@ -2,6 +2,23 @@
 #
 # Copyright (C) 2019 OpenWrt.org
 
+define KernelPackage/rp1-adc
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=RP1 ADC and temperature sensor driver
+  KCONFIG:=CONFIG_SENSORS_RP1_ADC
+  FILES:=$(LINUX_DIR)/drivers/hwmon/rp1-adc.ko
+  AUTOLOAD:=$(call AutoLoad,21,rp1-adc)
+  DEPENDS:=@TARGET_bcm27xx_bcm2712
+endef
+
+define KernelPackage/rp1-adc/description
+  Kernel module for RP1 silicon providing ADC and
+  temperature monitoring.
+endef
+
+$(eval $(call KernelPackage,rp1-adc))
+
+
 define KernelPackage/hwmon-raspberrypi
   TITLE:=Raspberry Pi voltage monitor
   KCONFIG:=CONFIG_SENSORS_RASPBERRYPI_HWMON
diff --git a/target/linux/bcm27xx/modules/i2c.mk b/target/linux/bcm27xx/modules/i2c.mk
index ba266b29f29bf9..0d44f1febcf49e 100644
--- a/target/linux/bcm27xx/modules/i2c.mk
+++ b/target/linux/bcm27xx/modules/i2c.mk
@@ -16,3 +16,19 @@ define KernelPackage/i2c-bcm2835/description
 endef
 
 $(eval $(call KernelPackage,i2c-bcm2835))
+
+
+I2C_BRCMSTB_MODULES:=\
+  CONFIG_I2C_BRCMSTB:drivers/i2c/busses/i2c-brcmstb
+
+define KernelPackage/i2c-brcmstb
+  $(call i2c_defaults,$(I2C_BRCMSTB_MODULES),59)
+  TITLE:=Broadcom BRCMSTB I2C master controller driver
+  DEPENDS:=@TARGET_bcm27xx +kmod-i2c-core
+endef
+
+define KernelPackage/i2c-brcmstb/description
+  This package contains the BRCM Settop/DSL I2C master controller driver
+endef
+
+$(eval $(call KernelPackage,i2c-brcmstb))
diff --git a/target/linux/bcm27xx/modules/other.mk b/target/linux/bcm27xx/modules/other.mk
index 99b71d4d695af1..7ec35c95f0b21c 100644
--- a/target/linux/bcm27xx/modules/other.mk
+++ b/target/linux/bcm27xx/modules/other.mk
@@ -53,3 +53,89 @@ define KernelPackage/smi-bcm2835-dev/description
 endef
 
 $(eval $(call KernelPackage,smi-bcm2835-dev))
+
+
+define KernelPackage/rp1
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=RP1 firmware
+  KCONFIG:=CONFIG_FIRMWARE_RP1
+  FILES:=$(LINUX_DIR)/drivers/firmware/rp1.ko
+  AUTOLOAD:=$(call AutoLoad,21,rp1)
+  DEPENDS:=@TARGET_bcm27xx_bcm2712
+endef
+
+define KernelPackage/rp1/description
+  This driver provides a firmware interface to the RP1 processor using shared
+  memory and a mailbox.
+endef
+
+$(eval $(call KernelPackage,rp1))
+
+
+define KernelPackage/rp1-pio
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=RP1 PIO block support
+  KCONFIG:=CONFIG_RP1_PIO
+  FILES:=$(LINUX_DIR)/drivers/misc/rp1-pio.ko
+  AUTOLOAD:=$(call AutoLoad,21,rp1-pio)
+  DEPENDS:=@TARGET_bcm27xx_bcm2712 +kmod-rp1
+endef
+
+define KernelPackage/rp1-pio/description
+  Driver providing control of the Raspberry Pi PIO block, as found in RP1
+endef
+
+$(eval $(call KernelPackage,rp1-pio))
+
+
+define KernelPackage/pwm-pio-rp1
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=RP1 PWM support
+  KCONFIG:=CONFIG_PWM_PIO_RP1
+  FILES:=$(LINUX_DIR)/drivers/pwm/pwm-pio-rp1.ko
+  AUTOLOAD:=$(call AutoLoad,21,pwm-pio-rp1)
+  DEPENDS:=@TARGET_bcm27xx_bcm2712 +kmod-rp1-pio
+endef
+
+define KernelPackage/pwm-pio-rp1/description
+  Enables precise control of PWM signals for tasks like motor control,
+  LED dimming, and audio signal generation. Leveraging PIO allows for
+  higher accuracy and flexibility in PWM signal generation compared
+  to traditional hardware timers.
+endef
+
+$(eval $(call KernelPackage,pwm-pio-rp1))
+
+
+define KernelPackage/ws2812-pio-rp1
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=RP1 PIO-base WS2812 driver
+  KCONFIG:=CONFIG_WS2812_PIO_RP1
+  FILES:=$(LINUX_DIR)/drivers/misc/ws2812-pio-rp1.ko
+  AUTOLOAD:=$(call AutoLoad,21,ws2812-pio-rp1)
+  DEPENDS:=@TARGET_bcm27xx_bcm2712 +kmod-rp1-pio
+endef
+
+define KernelPackage/ws2812-pio-rp1/description
+  Driver for the WS2812 (NeoPixel) LEDs using the RP1 PIO hardware.
+  The driver creates a character device to which rgbw pixels may be
+  written. Single-byte writes to offset 0 set the brightness at runtime.
+endef
+
+$(eval $(call KernelPackage,ws2812-pio-rp1))
+
+
+define KernelPackage/rp1-mailbox
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=RP1 mailbox IPC driver
+  KCONFIG:=CONFIG_MBOX_RP1
+  FILES:=$(LINUX_DIR)/drivers/mailbox/rp1-mailbox.ko
+  AUTOLOAD:=$(call AutoLoad,21,rp1-mailbox)
+  DEPENDS:=@TARGET_bcm27xx_bcm2712
+endef
+
+define KernelPackage/rp1-mailbox/description
+  This is a RP1 mailbox IPC driver.
+endef
+
+$(eval $(call KernelPackage,rp1-mailbox))
diff --git a/target/linux/bcm27xx/modules/video.mk b/target/linux/bcm27xx/modules/video.mk
index b9af0b3e0f8603..f8b39c71c4497c 100644
--- a/target/linux/bcm27xx/modules/video.mk
+++ b/target/linux/bcm27xx/modules/video.mk
@@ -115,3 +115,81 @@ define KernelPackage/vchiq-mmal-bcm2835/description
 endef
 
 $(eval $(call KernelPackage,vchiq-mmal-bcm2835))
+
+
+define KernelPackage/drm-rp1-dsi
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=RP1 Display Serial Interface for Video
+  KCONFIG:= \
+    CONFIG_DRM_RP1_DSI \
+    CONFIG_DRM_GEM_DMA_HELPER \
+    CONFIG_DRM_KMS_HELPER \
+    CONFIG_DRM_MIPI_DSI=y \
+    CONFIG_DRM_VRAM_HELPER=n \
+    CONFIG_DRM_TTM=n \
+    CONFIG_DRM_TTM_HELPER=n \
+    CONFIG_GENERIC_PHY_MIPI_DPHY=n \
+    CONFIG_DRM_WERROR=n
+  FILES:=$(LINUX_DIR)/drivers/gpu/drm/rp1/rp1-dsi/drm-rp1-dsi.ko
+  AUTOLOAD:=$(call AutoLoad,67,drm-rp1-dsi)
+  DEPENDS:=@TARGET_bcm27xx_bcm2712 +kmod-drm-vc4
+endef
+
+define KernelPackage/drm-rp1-dsi/description
+  This module manages the DSI for driving high-resolution LCD panels
+  such as the official Raspberry Pi displays or other screens that
+  use the DSI interface.
+endef
+
+$(eval $(call KernelPackage,drm-rp1-dsi))
+
+
+define KernelPackage/drm-rp1-dpi
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=RP1 Display Parallel Interface for Video
+  KCONFIG:= \
+    CONFIG_DRM_RP1_DPI \
+    CONFIG_DRM_GEM_DMA_HELPER \
+    CONFIG_DRM_KMS_HELPER \
+    CONFIG_DRM_VRAM_HELPER=n \
+    CONFIG_DRM_TTM=n \
+    CONFIG_DRM_TTM_HELPER=n
+  FILES:=$(LINUX_DIR)/drivers/gpu/drm/rp1/rp1-dpi/drm-rp1-dpi.ko
+  AUTOLOAD:=$(call AutoLoad,67,drm-rp1-dpi)
+  DEPENDS:=@TARGET_bcm27xx_bcm2712 +kmod-drm-vc4 +kmod-rp1-pio
+endef
+
+define KernelPackage/drm-rp1-dpi/description
+  This module is or driving displays using the DPI standard.
+  Useful for interfacing with custom or low-level LCD panels
+  that require parallel RGB signals.  Provides direct control
+  over the timing and signal driving of raw LCD panels.
+  Typically used in maker projects or with non-HDMI displays.
+endef
+
+$(eval $(call KernelPackage,drm-rp1-dpi))
+
+
+define KernelPackage/drm-rp1-vec
+  SUBMENU:=$(VIDEO_MENU)
+  TITLE:=RP1 Display Composite Video
+  KCONFIG:= \
+    CONFIG_DRM_RP1_VEC \
+    CONFIG_DRM_GEM_DMA_HELPER \
+    CONFIG_DRM_KMS_HELPER \
+    CONFIG_DRM_VRAM_HELPER=n \
+    CONFIG_DRM_TTM=n \
+    CONFIG_DRM_TTM_HELPER=n
+  FILES:=$(LINUX_DIR)/drivers/gpu/drm/rp1/rp1-vec/drm-rp1-vec.ko
+  AUTOLOAD:=$(call AutoLoad,67,drm-rp1-vec)
+  DEPENDS:=@TARGET_bcm27xx_bcm2712 +kmod-drm-vc4
+endef
+
+define KernelPackage/drm-rp1-vec/description
+  This module is used for composite video output, which is typically
+  transmitted through the RCA jack.  Primary use is onnecting older
+  TVs or monitors that rely on analog signals via a composite interface.
+  Handles standard-definition analog signals in NTSC and PAL.
+endef
+
+$(eval $(call KernelPackage,drm-rp1-vec))
diff --git a/target/linux/bcm27xx/patches-6.6/950-0007-drm-vc4-Add-firmware-kms-mode.patch b/target/linux/bcm27xx/patches-6.6/950-0007-drm-vc4-Add-firmware-kms-mode.patch
index c755e8143598e1..468420bdee0eac 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0007-drm-vc4-Add-firmware-kms-mode.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0007-drm-vc4-Add-firmware-kms-mode.patch
@@ -220,7 +220,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  
  	struct vc4_hang_state *hang_state;
  
-@@ -963,6 +967,9 @@ extern struct platform_driver vc4_dsi_dr
+@@ -964,6 +968,9 @@ extern struct platform_driver vc4_dsi_dr
  /* vc4_fence.c */
  extern const struct dma_fence_ops vc4_fence_ops;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0008-drm-vc4-Add-support-for-gamma-on-BCM2711.patch b/target/linux/bcm27xx/patches-6.6/950-0008-drm-vc4-Add-support-for-gamma-on-BCM2711.patch
index a4712310f2b7b2..10a09eb2c0c155 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0008-drm-vc4-Add-support-for-gamma-on-BCM2711.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0008-drm-vc4-Add-support-for-gamma-on-BCM2711.patch
@@ -83,7 +83,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  struct drm_device;
  struct drm_gem_object;
-@@ -494,6 +495,17 @@ struct drm_encoder *vc4_find_encoder_by_
+@@ -495,6 +496,17 @@ struct drm_encoder *vc4_find_encoder_by_
  	return NULL;
  }
  
@@ -101,7 +101,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  struct vc4_crtc_data {
  	const char *name;
  
-@@ -538,9 +550,19 @@ struct vc4_crtc {
+@@ -539,9 +551,19 @@ struct vc4_crtc {
  	/* Timestamp at start of vblank irq - unaffected by lock delays. */
  	ktime_t t_vblank;
  
@@ -126,7 +126,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -243,7 +243,8 @@ static void vc4_hvs_lut_load(struct vc4_
+@@ -248,7 +248,8 @@ static void vc4_hvs_lut_load(struct vc4_
  static void vc4_hvs_update_gamma_lut(struct vc4_hvs *hvs,
  				     struct vc4_crtc *vc4_crtc)
  {
@@ -136,7 +136,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	struct drm_color_lut *lut = crtc_state->gamma_lut->data;
  	u32 length = drm_color_lut_size(crtc_state->gamma_lut);
  	u32 i;
-@@ -257,6 +258,81 @@ static void vc4_hvs_update_gamma_lut(str
+@@ -262,6 +263,81 @@ static void vc4_hvs_update_gamma_lut(str
  	vc4_hvs_lut_load(hvs, vc4_crtc);
  }
  
@@ -218,7 +218,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  u8 vc4_hvs_get_fifo_frame_count(struct vc4_hvs *hvs, unsigned int fifo)
  {
  	struct drm_device *drm = &hvs->vc4->base;
-@@ -400,7 +476,10 @@ static int vc4_hvs_init_channel(struct v
+@@ -405,7 +481,10 @@ static int vc4_hvs_init_channel(struct v
  	/* Reload the LUT, since the SRAMs would have been disabled if
  	 * all CRTCs had SCALER_DISPBKGND_GAMMA unset at once.
  	 */
@@ -230,7 +230,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	drm_dev_exit(idx);
  
-@@ -646,7 +725,11 @@ void vc4_hvs_atomic_flush(struct drm_crt
+@@ -649,7 +728,11 @@ void vc4_hvs_atomic_flush(struct drm_crt
  		u32 dispbkgndx = HVS_READ(SCALER_DISPBKGNDX(channel));
  
  		if (crtc->state->gamma_lut) {
diff --git a/target/linux/bcm27xx/patches-6.6/950-0009-drm-vc4-Add-debugfs-node-that-dumps-the-vc5-gamma-PW.patch b/target/linux/bcm27xx/patches-6.6/950-0009-drm-vc4-Add-debugfs-node-that-dumps-the-vc5-gamma-PW.patch
index 24d0cd90f6e2f9..863ad82432d5df 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0009-drm-vc4-Add-debugfs-node-that-dumps-the-vc5-gamma-PW.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0009-drm-vc4-Add-debugfs-node-that-dumps-the-vc5-gamma-PW.patch
@@ -17,7 +17,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -143,6 +143,85 @@ static int vc4_hvs_debugfs_dlist(struct
+@@ -145,6 +145,85 @@ static int vc4_hvs_debugfs_dlist(struct
  	return 0;
  }
  
@@ -103,7 +103,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  /* The filter kernel is composed of dwords each containing 3 9-bit
   * signed integers packed next to each other.
   */
-@@ -850,11 +929,15 @@ int vc4_hvs_debugfs_init(struct drm_mino
+@@ -854,11 +933,15 @@ int vc4_hvs_debugfs_init(struct drm_mino
  	if (!vc4->hvs)
  		return -ENODEV;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0010-drm-vc4-hvs-Force-modeset-on-gamma-lut-change.patch b/target/linux/bcm27xx/patches-6.6/950-0010-drm-vc4-hvs-Force-modeset-on-gamma-lut-change.patch
index f49122dec27a11..b8847230af0841 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0010-drm-vc4-hvs-Force-modeset-on-gamma-lut-change.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0010-drm-vc4-hvs-Force-modeset-on-gamma-lut-change.patch
@@ -45,7 +45,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
 --- a/drivers/gpu/drm/vc4/vc4_drv.h
 +++ b/drivers/gpu/drm/vc4/vc4_drv.h
-@@ -613,6 +613,9 @@ vc4_crtc_to_vc4_pv_data(const struct vc4
+@@ -614,6 +614,9 @@ vc4_crtc_to_vc4_pv_data(const struct vc4
  	return container_of_const(data, struct vc4_pv_data, base);
  }
  
@@ -57,7 +57,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -596,6 +596,36 @@ out:
+@@ -599,6 +599,36 @@ out:
  	drm_dev_exit(idx);
  }
  
@@ -94,7 +94,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  int vc4_hvs_atomic_check(struct drm_crtc *crtc, struct drm_atomic_state *state)
  {
  	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
-@@ -626,7 +656,7 @@ int vc4_hvs_atomic_check(struct drm_crtc
+@@ -629,7 +659,7 @@ int vc4_hvs_atomic_check(struct drm_crtc
  	if (ret)
  		return ret;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0014-drm-vc4-Enable-gamma-block-only-when-required.patch b/target/linux/bcm27xx/patches-6.6/950-0014-drm-vc4-Enable-gamma-block-only-when-required.patch
index 76647cbd48889b..061b37797de7c8 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0014-drm-vc4-Enable-gamma-block-only-when-required.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0014-drm-vc4-Enable-gamma-block-only-when-required.patch
@@ -20,7 +20,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -548,8 +548,11 @@ static int vc4_hvs_init_channel(struct v
+@@ -553,8 +553,11 @@ static int vc4_hvs_init_channel(struct v
  	dispbkgndx &= ~SCALER_DISPBKGND_GAMMA;
  	dispbkgndx &= ~SCALER_DISPBKGND_INTERLACE;
  
@@ -33,7 +33,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  		  (interlace ? SCALER_DISPBKGND_INTERLACE : 0));
  
  	/* Reload the LUT, since the SRAMs would have been disabled if
-@@ -834,18 +837,25 @@ void vc4_hvs_atomic_flush(struct drm_crt
+@@ -837,18 +840,25 @@ void vc4_hvs_atomic_flush(struct drm_crt
  		u32 dispbkgndx = HVS_READ(SCALER_DISPBKGNDX(channel));
  
  		if (crtc->state->gamma_lut) {
diff --git a/target/linux/bcm27xx/patches-6.6/950-0016-drm-vc4-Validate-the-size-of-the-gamma_lut.patch b/target/linux/bcm27xx/patches-6.6/950-0016-drm-vc4-Validate-the-size-of-the-gamma_lut.patch
index fd0823aa136c89..7280b6e30c4a87 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0016-drm-vc4-Validate-the-size-of-the-gamma_lut.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0016-drm-vc4-Validate-the-size-of-the-gamma_lut.patch
@@ -13,7 +13,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -614,6 +614,16 @@ static int vc4_hvs_gamma_check(struct dr
+@@ -617,6 +617,16 @@ static int vc4_hvs_gamma_check(struct dr
  	if (!crtc_state->color_mgmt_changed)
  		return 0;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0020-vc4-drm-vc4_plane-Keep-fractional-source-coords-insi.patch b/target/linux/bcm27xx/patches-6.6/950-0020-vc4-drm-vc4_plane-Keep-fractional-source-coords-insi.patch
index 46a72e4ed92cbd..17dd4433e1ac47 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0020-vc4-drm-vc4_plane-Keep-fractional-source-coords-insi.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0020-vc4-drm-vc4_plane-Keep-fractional-source-coords-insi.patch
@@ -12,7 +12,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_drv.h
 +++ b/drivers/gpu/drm/vc4/vc4_drv.h
-@@ -408,7 +408,7 @@ struct vc4_plane_state {
+@@ -409,7 +409,7 @@ struct vc4_plane_state {
  
  	/* Clipped coordinates of the plane on the display. */
  	int crtc_x, crtc_y, crtc_w, crtc_h;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0024-drm-vc4-Force-trigger-of-dlist-update-on-margins-cha.patch b/target/linux/bcm27xx/patches-6.6/950-0024-drm-vc4-Force-trigger-of-dlist-update-on-margins-cha.patch
index 9779cd512c0078..06cb7094985b1f 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0024-drm-vc4-Force-trigger-of-dlist-update-on-margins-cha.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0024-drm-vc4-Force-trigger-of-dlist-update-on-margins-cha.patch
@@ -42,7 +42,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  
 --- a/drivers/gpu/drm/vc4/vc4_drv.h
 +++ b/drivers/gpu/drm/vc4/vc4_drv.h
-@@ -626,12 +626,7 @@ struct vc4_crtc_state {
+@@ -627,12 +627,7 @@ struct vc4_crtc_state {
  	bool txp_armed;
  	unsigned int assigned_channel;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0025-drm-atomic-helpers-remove-legacy_cursor_update-hacks.patch b/target/linux/bcm27xx/patches-6.6/950-0025-drm-atomic-helpers-remove-legacy_cursor_update-hacks.patch
index 97bc25b565ef9a..6655920b1ee13d 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0025-drm-atomic-helpers-remove-legacy_cursor_update-hacks.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0025-drm-atomic-helpers-remove-legacy_cursor_update-hacks.patch
@@ -60,7 +60,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/drm_atomic_helper.c
 +++ b/drivers/gpu/drm/drm_atomic_helper.c
-@@ -1653,13 +1653,6 @@ drm_atomic_helper_wait_for_vblanks(struc
+@@ -1681,13 +1681,6 @@ drm_atomic_helper_wait_for_vblanks(struc
  	int i, ret;
  	unsigned int crtc_mask = 0;
  
@@ -74,7 +74,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	for_each_oldnew_crtc_in_state(old_state, crtc, old_crtc_state, new_crtc_state, i) {
  		if (!new_crtc_state->active)
  			continue;
-@@ -2309,12 +2302,6 @@ int drm_atomic_helper_setup_commit(struc
+@@ -2337,12 +2330,6 @@ int drm_atomic_helper_setup_commit(struc
  			complete_all(&commit->flip_done);
  			continue;
  		}
@@ -89,7 +89,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  			commit->event = kzalloc(sizeof(*commit->event),
 --- a/drivers/gpu/drm/i915/display/intel_display.c
 +++ b/drivers/gpu/drm/i915/display/intel_display.c
-@@ -7280,6 +7280,19 @@ int intel_atomic_commit(struct drm_devic
+@@ -7297,6 +7297,19 @@ int intel_atomic_commit(struct drm_devic
  				state->base.legacy_cursor_update = false;
  	}
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0027-drm-vc4-hvs-Skip-DebugFS-Registration-for-FKMS.patch b/target/linux/bcm27xx/patches-6.6/950-0027-drm-vc4-hvs-Skip-DebugFS-Registration-for-FKMS.patch
index ba03cfb7b92fc9..fb8abd20caf596 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0027-drm-vc4-hvs-Skip-DebugFS-Registration-for-FKMS.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0027-drm-vc4-hvs-Skip-DebugFS-Registration-for-FKMS.patch
@@ -13,7 +13,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -976,6 +976,9 @@ int vc4_hvs_debugfs_init(struct drm_mino
+@@ -980,6 +980,9 @@ int vc4_hvs_debugfs_init(struct drm_mino
  	struct vc4_dev *vc4 = to_vc4_dev(drm);
  	struct vc4_hvs *hvs = vc4->hvs;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0028-drm-vc4_hdmi-Allow-hotplug-detect-to-be-forced.patch b/target/linux/bcm27xx/patches-6.6/950-0028-drm-vc4_hdmi-Allow-hotplug-detect-to-be-forced.patch
index 95b3ec7a248de5..5785fbf667b28b 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0028-drm-vc4_hdmi-Allow-hotplug-detect-to-be-forced.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0028-drm-vc4_hdmi-Allow-hotplug-detect-to-be-forced.patch
@@ -45,7 +45,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
  static const char * const output_format_str[] = {
  	[VC4_HDMI_OUTPUT_RGB]		= "RGB",
  	[VC4_HDMI_OUTPUT_YUV420]	= "YUV 4:2:0",
-@@ -478,7 +484,9 @@ static int vc4_hdmi_connector_detect_ctx
+@@ -482,7 +488,9 @@ static int vc4_hdmi_connector_detect_ctx
  		return connector_status_unknown;
  	}
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0029-vc4_hdmi-Avoid-log-spam-for-audio-start-failure.patch b/target/linux/bcm27xx/patches-6.6/950-0029-vc4_hdmi-Avoid-log-spam-for-audio-start-failure.patch
deleted file mode 100644
index 0baf803edf8d5f..00000000000000
--- a/target/linux/bcm27xx/patches-6.6/950-0029-vc4_hdmi-Avoid-log-spam-for-audio-start-failure.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-From 7508b889b8c8058e53ceeec90a1e3cc998897e16 Mon Sep 17 00:00:00 2001
-From: Dom Cobley <popcornmix@gmail.com>
-Date: Tue, 6 Dec 2022 15:05:56 +0000
-Subject: [PATCH 0029/1085] vc4_hdmi: Avoid log spam for audio start failure
-
-We regularly get dmesg error reports of:
-[   18.184066] hdmi-audio-codec hdmi-audio-codec.3.auto: ASoC: error at snd_soc_dai_startup on i2s-hifi: -19
-[   18.184098]  MAI: soc_pcm_open() failed (-19)
-
-Currently I get 30 of these when booting to desktop.
-We always say, ignore they are harmless, but removing them would be good.
-
-A bit of investigation shows, for me, the errors are all generated by second, unused hdmi interface.
-
-It shows as an alsa device, and pulseaudio attempts to open it (numerous times), generating a kernel
-error message each time.
-
-systemctl --user restart pulseaudio.service generates 6 additional error messages.
-
-The error messages all come through:
-https://github.com/raspberrypi/linux/blob/a009a9c0d79dfec114ee5102ec3d3325a172c952/sound/soc/soc-pcm.c#L39
-
-which suggests returning ENOTSUPP, rather that ENODEV will be quiet. And indeed it is.
-
-Note: earlier kernels do not have the quiet ENOTSUPP, so additional cherry-picks will be needed to backport
-Signed-off-by: Dom Cobley <popcornmix@gmail.com>
----
- drivers/gpu/drm/vc4/vc4_hdmi.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/gpu/drm/vc4/vc4_hdmi.c
-+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
-@@ -2400,7 +2400,7 @@ static int vc4_hdmi_audio_startup(struct
- 	}
- 
- 	if (!vc4_hdmi_audio_can_stream(vc4_hdmi)) {
--		ret = -ENODEV;
-+		ret = -ENOTSUPP;
- 		goto out_dev_exit;
- 	}
- 
diff --git a/target/linux/bcm27xx/patches-6.6/950-0030-drm-vc4-hvs-Defer-dlist-slots-deallocation.patch b/target/linux/bcm27xx/patches-6.6/950-0030-drm-vc4-hvs-Defer-dlist-slots-deallocation.patch
index a53dd1fa637e02..0d052868638180 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0030-drm-vc4-hvs-Defer-dlist-slots-deallocation.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0030-drm-vc4-hvs-Defer-dlist-slots-deallocation.patch
@@ -98,7 +98,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  }
 --- a/drivers/gpu/drm/vc4/vc4_drv.h
 +++ b/drivers/gpu/drm/vc4/vc4_drv.h
-@@ -332,6 +332,9 @@ struct vc4_hvs {
+@@ -333,6 +333,9 @@ struct vc4_hvs {
  	struct drm_mm lbm_mm;
  	spinlock_t mm_lock;
  
@@ -108,7 +108,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	struct drm_mm_node mitchell_netravali_filter;
  
  	struct debugfs_regset32 regset;
-@@ -619,10 +622,16 @@ struct drm_connector *vc4_get_crtc_conne
+@@ -620,10 +623,16 @@ struct drm_connector *vc4_get_crtc_conne
  struct drm_encoder *vc4_get_crtc_encoder(struct drm_crtc *crtc,
  					 struct drm_crtc_state *state);
  
@@ -127,7 +127,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	bool txp_armed;
  	unsigned int assigned_channel;
  
-@@ -1032,6 +1041,8 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+@@ -1033,6 +1042,8 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
  void vc4_hvs_stop_channel(struct vc4_hvs *hvs, unsigned int output);
  int vc4_hvs_get_fifo_from_output(struct vc4_hvs *hvs, unsigned int output);
  u8 vc4_hvs_get_fifo_frame_count(struct vc4_hvs *hvs, unsigned int fifo);
@@ -138,7 +138,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  void vc4_hvs_atomic_enable(struct drm_crtc *crtc, struct drm_atomic_state *state);
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -412,6 +412,152 @@ static void vc5_hvs_update_gamma_lut(str
+@@ -417,6 +417,152 @@ static void vc5_hvs_update_gamma_lut(str
  	vc5_hvs_lut_load(hvs, vc4_crtc);
  }
  
@@ -291,7 +291,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  u8 vc4_hvs_get_fifo_frame_count(struct vc4_hvs *hvs, unsigned int fifo)
  {
  	struct drm_device *drm = &hvs->vc4->base;
-@@ -643,13 +789,12 @@ int vc4_hvs_atomic_check(struct drm_crtc
+@@ -646,13 +792,12 @@ int vc4_hvs_atomic_check(struct drm_crtc
  {
  	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state, crtc);
  	struct vc4_crtc_state *vc4_state = to_vc4_crtc_state(crtc_state);
@@ -306,7 +306,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	/* The pixelvalve can only feed one encoder (and encoders are
  	 * 1:1 with connectors.)
-@@ -662,12 +807,11 @@ int vc4_hvs_atomic_check(struct drm_crtc
+@@ -665,12 +810,11 @@ int vc4_hvs_atomic_check(struct drm_crtc
  
  	dlist_count++; /* Account for SCALER_CTL0_END. */
  
@@ -324,7 +324,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	return vc4_hvs_gamma_check(crtc, state);
  }
-@@ -683,8 +827,9 @@ static void vc4_hvs_install_dlist(struct
+@@ -686,8 +830,9 @@ static void vc4_hvs_install_dlist(struct
  	if (!drm_dev_enter(dev, &idx))
  		return;
  
@@ -335,7 +335,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	drm_dev_exit(idx);
  }
-@@ -711,8 +856,10 @@ static void vc4_hvs_update_dlist(struct
+@@ -714,8 +859,10 @@ static void vc4_hvs_update_dlist(struct
  		spin_unlock_irqrestore(&dev->event_lock, flags);
  	}
  
@@ -347,7 +347,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	spin_unlock_irqrestore(&vc4_crtc->irq_lock, flags);
  }
  
-@@ -769,8 +916,7 @@ void vc4_hvs_atomic_flush(struct drm_crt
+@@ -772,8 +919,7 @@ void vc4_hvs_atomic_flush(struct drm_crt
  	struct vc4_plane_state *vc4_plane_state;
  	bool debug_dump_regs = false;
  	bool enable_bg_fill = false;
@@ -357,7 +357,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	unsigned int zpos = 0;
  	bool found = false;
  	int idx;
-@@ -788,6 +934,9 @@ void vc4_hvs_atomic_flush(struct drm_crt
+@@ -791,6 +937,9 @@ void vc4_hvs_atomic_flush(struct drm_crt
  		vc4_hvs_dump_state(hvs);
  	}
  
@@ -367,7 +367,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	/* Copy all the active planes' dlist contents to the hardware dlist. */
  	do {
  		found = false;
-@@ -821,7 +970,8 @@ void vc4_hvs_atomic_flush(struct drm_crt
+@@ -824,7 +973,8 @@ void vc4_hvs_atomic_flush(struct drm_crt
  	writel(SCALER_CTL0_END, dlist_next);
  	dlist_next++;
  
@@ -377,7 +377,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	if (enable_bg_fill)
  		/* This sets a black background color fill, as is the case
-@@ -960,6 +1110,11 @@ static irqreturn_t vc4_hvs_irq_handler(i
+@@ -964,6 +1114,11 @@ static irqreturn_t vc4_hvs_irq_handler(i
  
  			irqret = IRQ_HANDLED;
  		}
@@ -389,7 +389,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	}
  
  	/* Clear every per-channel interrupt flag. */
-@@ -1014,6 +1169,9 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+@@ -1018,6 +1173,9 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
  
  	spin_lock_init(&hvs->mm_lock);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0031-drm-vc4-hvs-Initialize-the-dlist-allocation-list-ent.patch b/target/linux/bcm27xx/patches-6.6/950-0031-drm-vc4-hvs-Initialize-the-dlist-allocation-list-ent.patch
index d250dd4e1e15bf..2fd7aa573de881 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0031-drm-vc4-hvs-Initialize-the-dlist-allocation-list-ent.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0031-drm-vc4-hvs-Initialize-the-dlist-allocation-list-ent.patch
@@ -19,7 +19,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -452,6 +452,8 @@ vc4_hvs_alloc_dlist_entry(struct vc4_hvs
+@@ -457,6 +457,8 @@ vc4_hvs_alloc_dlist_entry(struct vc4_hvs
  	if (!alloc)
  		return ERR_PTR(-ENOMEM);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0032-drm-vc4-hvs-Move-the-dlist-allocation-destruction-to.patch b/target/linux/bcm27xx/patches-6.6/950-0032-drm-vc4-hvs-Move-the-dlist-allocation-destruction-to.patch
index f6fe9e1a4c20b2..07fb255e66109f 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0032-drm-vc4-hvs-Move-the-dlist-allocation-destruction-to.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0032-drm-vc4-hvs-Move-the-dlist-allocation-destruction-to.patch
@@ -14,7 +14,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -466,6 +466,18 @@ vc4_hvs_alloc_dlist_entry(struct vc4_hvs
+@@ -471,6 +471,18 @@ vc4_hvs_alloc_dlist_entry(struct vc4_hvs
  	return alloc;
  }
  
@@ -33,7 +33,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  void vc4_hvs_mark_dlist_entry_stale(struct vc4_hvs *hvs,
  				    struct vc4_hvs_dlist_allocation *alloc)
  {
-@@ -553,9 +565,7 @@ static void vc4_hvs_dlist_free_work(stru
+@@ -558,9 +570,7 @@ static void vc4_hvs_dlist_free_work(stru
  		if (!vc4_hvs_frcnt_lte(cur->target_frame_count, frcnt))
  			continue;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0033-drm-vc4-hvs-Destroy-dlist-allocations-immediately-wh.patch b/target/linux/bcm27xx/patches-6.6/950-0033-drm-vc4-hvs-Destroy-dlist-allocations-immediately-wh.patch
index 6c8689e169cb46..ecfabf63b92a59 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0033-drm-vc4-hvs-Destroy-dlist-allocations-immediately-wh.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0033-drm-vc4-hvs-Destroy-dlist-allocations-immediately-wh.patch
@@ -27,7 +27,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -490,6 +490,18 @@ void vc4_hvs_mark_dlist_entry_stale(stru
+@@ -495,6 +495,18 @@ void vc4_hvs_mark_dlist_entry_stale(stru
  	if (!drm_mm_node_allocated(&alloc->mm_node))
  		return;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0035-drm-vc4-Calculate-bpc-based-on-max_requested_bpc.patch b/target/linux/bcm27xx/patches-6.6/950-0035-drm-vc4-Calculate-bpc-based-on-max_requested_bpc.patch
index f0fb3eb7d47eee..fbaa2619aa52b2 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0035-drm-vc4-Calculate-bpc-based-on-max_requested_bpc.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0035-drm-vc4-Calculate-bpc-based-on-max_requested_bpc.patch
@@ -18,7 +18,7 @@ Signed-off-by: Matthias Reichl <hias@horus.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_hdmi.c
 +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
-@@ -2132,7 +2132,7 @@ vc4_hdmi_encoder_compute_config(const st
+@@ -2136,7 +2136,7 @@ vc4_hdmi_encoder_compute_config(const st
  {
  	struct drm_device *dev = vc4_hdmi->connector.dev;
  	struct drm_connector_state *conn_state = &vc4_state->base;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0036-drm-vc4-Set-AXI-panic-modes-for-the-HVS.patch b/target/linux/bcm27xx/patches-6.6/950-0036-drm-vc4-Set-AXI-panic-modes-for-the-HVS.patch
index 996094739581f7..3ecea01fcd56a6 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0036-drm-vc4-Set-AXI-panic-modes-for-the-HVS.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0036-drm-vc4-Set-AXI-panic-modes-for-the-HVS.patch
@@ -19,7 +19,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -1363,6 +1363,17 @@ static int vc4_hvs_bind(struct device *d
+@@ -1379,6 +1379,17 @@ static int vc4_hvs_bind(struct device *d
  	dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC1);
  	dispctrl |= VC4_SET_FIELD(2, SCALER_DISPCTRL_PANIC2);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0037-drm-vc4-drop-unnecessary-and-harmful-HDMI-RGB-format.patch b/target/linux/bcm27xx/patches-6.6/950-0037-drm-vc4-drop-unnecessary-and-harmful-HDMI-RGB-format.patch
index b9fba16f695737..18b5b63b547870 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0037-drm-vc4-drop-unnecessary-and-harmful-HDMI-RGB-format.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0037-drm-vc4-drop-unnecessary-and-harmful-HDMI-RGB-format.patch
@@ -25,7 +25,7 @@ Signed-off-by: Matthias Reichl <hias@horus.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_hdmi.c
 +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
-@@ -1958,9 +1958,6 @@ vc4_hdmi_sink_supports_format_bpc(const
+@@ -1962,9 +1962,6 @@ vc4_hdmi_sink_supports_format_bpc(const
  	case VC4_HDMI_OUTPUT_RGB:
  		drm_dbg(dev, "RGB Format, checking the constraints.\n");
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0038-drm-vc4-Limit-max_bpc-to-8-on-Pi0-3.patch b/target/linux/bcm27xx/patches-6.6/950-0038-drm-vc4-Limit-max_bpc-to-8-on-Pi0-3.patch
index 2b86f419529670..b3b1c3d9e4348c 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0038-drm-vc4-Limit-max_bpc-to-8-on-Pi0-3.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0038-drm-vc4-Limit-max_bpc-to-8-on-Pi0-3.patch
@@ -13,7 +13,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_hdmi.c
 +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
-@@ -762,7 +762,6 @@ static int vc4_hdmi_connector_init(struc
+@@ -766,7 +766,6 @@ static int vc4_hdmi_connector_init(struc
  
  	drm_connector_attach_colorspace_property(connector);
  	drm_connector_attach_tv_margin_properties(connector);
@@ -21,7 +21,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  
  	connector->polled = (DRM_CONNECTOR_POLL_CONNECT |
  			     DRM_CONNECTOR_POLL_DISCONNECT);
-@@ -771,8 +770,12 @@ static int vc4_hdmi_connector_init(struc
+@@ -775,8 +774,12 @@ static int vc4_hdmi_connector_init(struc
  	connector->doublescan_allowed = 0;
  	connector->stereo_allowed = 1;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0039-arm64-setup-Fix-build-warning.patch b/target/linux/bcm27xx/patches-6.6/950-0039-arm64-setup-Fix-build-warning.patch
index a53c896daaaf65..75e552a7ef036c 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0039-arm64-setup-Fix-build-warning.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0039-arm64-setup-Fix-build-warning.patch
@@ -10,7 +10,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/arch/arm64/kernel/setup.c
 +++ b/arch/arm64/kernel/setup.c
-@@ -225,9 +225,9 @@ static void __init request_standard_reso
+@@ -229,9 +229,9 @@ static void __init request_standard_reso
  	size_t res_size;
  
  	kernel_code.start   = __pa_symbol(_stext);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0061-Revert-Revert-xhci-add-quirk-for-host-controllers-th.patch b/target/linux/bcm27xx/patches-6.6/950-0061-Revert-Revert-xhci-add-quirk-for-host-controllers-th.patch
index 1135b31d4f6222..3dce8aa62158b5 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0061-Revert-Revert-xhci-add-quirk-for-host-controllers-th.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0061-Revert-Revert-xhci-add-quirk-for-host-controllers-th.patch
@@ -14,21 +14,17 @@ We don't agree with upstream revert so undo it.
 
 --- a/drivers/usb/host/xhci-pci.c
 +++ b/drivers/usb/host/xhci-pci.c
-@@ -490,8 +490,10 @@ static void xhci_pci_quirks(struct devic
- 			pdev->device == 0x3432)
- 		xhci->quirks |= XHCI_BROKEN_STREAMS;
- 
--	if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == 0x3483)
-+	if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == 0x3483) {
+@@ -510,6 +510,7 @@ static void xhci_pci_quirks(struct devic
+ 	if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == PCI_DEVICE_ID_VIA_VL805) {
  		xhci->quirks |= XHCI_LPM_SUPPORT;
+ 		xhci->quirks |= XHCI_TRB_OVERFETCH;
 +		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
-+	}
+ 	}
  
  	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
- 		pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI) {
 --- a/drivers/usb/host/xhci-ring.c
 +++ b/drivers/usb/host/xhci-ring.c
-@@ -633,8 +633,11 @@ static int xhci_move_dequeue_past_td(str
+@@ -635,8 +635,11 @@ static int xhci_move_dequeue_past_td(str
  	struct xhci_ring *ep_ring;
  	struct xhci_command *cmd;
  	struct xhci_segment *new_seg;
@@ -40,7 +36,7 @@ We don't agree with upstream revert so undo it.
  	dma_addr_t addr;
  	u64 hw_dequeue;
  	bool cycle_found = false;
-@@ -672,7 +675,27 @@ static int xhci_move_dequeue_past_td(str
+@@ -674,7 +677,27 @@ static int xhci_move_dequeue_past_td(str
  	hw_dequeue = xhci_get_hw_deq(xhci, dev, ep_index, stream_id);
  	new_seg = ep_ring->deq_seg;
  	new_deq = ep_ring->dequeue;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0065-cgroup-Disable-cgroup-memory-by-default.patch b/target/linux/bcm27xx/patches-6.6/950-0065-cgroup-Disable-cgroup-memory-by-default.patch
index 8a06ec387e6ef6..5600e857341644 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0065-cgroup-Disable-cgroup-memory-by-default.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0065-cgroup-Disable-cgroup-memory-by-default.patch
@@ -17,7 +17,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/kernel/cgroup/cgroup.c
 +++ b/kernel/cgroup/cgroup.c
-@@ -6060,6 +6060,9 @@ int __init cgroup_init_early(void)
+@@ -6059,6 +6059,9 @@ int __init cgroup_init_early(void)
  	return 0;
  }
  
@@ -27,7 +27,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  /**
   * cgroup_init - cgroup initialization
   *
-@@ -6093,6 +6096,12 @@ int __init cgroup_init(void)
+@@ -6092,6 +6095,12 @@ int __init cgroup_init(void)
  
  	cgroup_unlock();
  
@@ -40,7 +40,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	for_each_subsys(ss, ssid) {
  		if (ss->early_init) {
  			struct cgroup_subsys_state *css =
-@@ -6733,6 +6742,10 @@ static int __init cgroup_disable(char *s
+@@ -6740,6 +6749,10 @@ static int __init cgroup_disable(char *s
  			    strcmp(token, ss->legacy_name))
  				continue;
  
@@ -51,7 +51,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  			static_branch_disable(cgroup_subsys_enabled_key[i]);
  			pr_info("Disabling %s control group subsystem\n",
  				ss->name);
-@@ -6751,6 +6764,31 @@ static int __init cgroup_disable(char *s
+@@ -6758,6 +6771,31 @@ static int __init cgroup_disable(char *s
  }
  __setup("cgroup_disable=", cgroup_disable);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0077-sound-Demote-deferral-errors-to-INFO-level.patch b/target/linux/bcm27xx/patches-6.6/950-0077-sound-Demote-deferral-errors-to-INFO-level.patch
index 623c859a43f69c..9255c4480f7886 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0077-sound-Demote-deferral-errors-to-INFO-level.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0077-sound-Demote-deferral-errors-to-INFO-level.patch
@@ -15,7 +15,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/sound/soc/soc-core.c
 +++ b/sound/soc/soc-core.c
-@@ -1080,7 +1080,7 @@ static int snd_soc_add_pcm_runtime(struc
+@@ -1083,7 +1083,7 @@ static int snd_soc_add_pcm_runtime(struc
  	for_each_link_cpus(dai_link, i, cpu) {
  		asoc_rtd_to_cpu(rtd, i) = snd_soc_find_dai(cpu);
  		if (!asoc_rtd_to_cpu(rtd, i)) {
@@ -24,7 +24,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  				 cpu->dai_name);
  			goto _err_defer;
  		}
-@@ -1091,7 +1091,7 @@ static int snd_soc_add_pcm_runtime(struc
+@@ -1094,7 +1094,7 @@ static int snd_soc_add_pcm_runtime(struc
  	for_each_link_codecs(dai_link, i, codec) {
  		asoc_rtd_to_codec(rtd, i) = snd_soc_find_dai(codec);
  		if (!asoc_rtd_to_codec(rtd, i)) {
diff --git a/target/linux/bcm27xx/patches-6.6/950-0081-lan78xx-Enable-LEDs-and-auto-negotiation.patch b/target/linux/bcm27xx/patches-6.6/950-0081-lan78xx-Enable-LEDs-and-auto-negotiation.patch
index 8735b0617017ad..fb248b08892ddb 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0081-lan78xx-Enable-LEDs-and-auto-negotiation.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0081-lan78xx-Enable-LEDs-and-auto-negotiation.patch
@@ -14,7 +14,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/net/usb/lan78xx.c
 +++ b/drivers/net/usb/lan78xx.c
-@@ -2883,6 +2883,11 @@ static int lan78xx_reset(struct lan78xx_
+@@ -2884,6 +2884,11 @@ static int lan78xx_reset(struct lan78xx_
  	int ret;
  	u32 buf;
  	u8 sig;
@@ -26,7 +26,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
  	ret = lan78xx_read_reg(dev, HW_CFG, &buf);
  	if (ret < 0)
-@@ -2947,6 +2952,10 @@ static int lan78xx_reset(struct lan78xx_
+@@ -2948,6 +2953,10 @@ static int lan78xx_reset(struct lan78xx_
  
  	buf |= HW_CFG_MEF_;
  
@@ -37,7 +37,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	ret = lan78xx_write_reg(dev, HW_CFG, buf);
  	if (ret < 0)
  		return ret;
-@@ -3046,6 +3055,9 @@ static int lan78xx_reset(struct lan78xx_
+@@ -3047,6 +3056,9 @@ static int lan78xx_reset(struct lan78xx_
  			buf |= MAC_CR_AUTO_DUPLEX_ | MAC_CR_AUTO_SPEED_;
  		}
  	}
diff --git a/target/linux/bcm27xx/patches-6.6/950-0083-amba_pl011-Add-cts-event-workaround-DT-property.patch b/target/linux/bcm27xx/patches-6.6/950-0083-amba_pl011-Add-cts-event-workaround-DT-property.patch
index 58910b861198a3..efee03dc801a74 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0083-amba_pl011-Add-cts-event-workaround-DT-property.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0083-amba_pl011-Add-cts-event-workaround-DT-property.patch
@@ -36,7 +36,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
    - reg
 --- a/drivers/tty/serial/amba-pl011.c
 +++ b/drivers/tty/serial/amba-pl011.c
-@@ -2808,6 +2808,11 @@ static int pl011_probe(struct amba_devic
+@@ -2815,6 +2815,11 @@ static int pl011_probe(struct amba_devic
  	if (IS_ERR(uap->clk))
  		return PTR_ERR(uap->clk);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0087-Add-dwc_otg-driver.patch b/target/linux/bcm27xx/patches-6.6/950-0087-Add-dwc_otg-driver.patch
index cb9fd4442a3481..0dd0c034003d85 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0087-Add-dwc_otg-driver.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0087-Add-dwc_otg-driver.patch
@@ -1189,7 +1189,7 @@ Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
  }
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
-@@ -5710,7 +5710,7 @@ static void port_event(struct usb_hub *h
+@@ -5751,7 +5751,7 @@ static void port_event(struct usb_hub *h
  		port_dev->over_current_count++;
  		port_over_current_notify(port_dev);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0092-MMC-added-alternative-MMC-driver.patch b/target/linux/bcm27xx/patches-6.6/950-0092-MMC-added-alternative-MMC-driver.patch
index aebb491f32af30..6dddd80026ac15 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0092-MMC-added-alternative-MMC-driver.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0092-MMC-added-alternative-MMC-driver.patch
@@ -344,7 +344,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  }
 --- a/drivers/mmc/core/quirks.h
 +++ b/drivers/mmc/core/quirks.h
-@@ -134,6 +134,14 @@ static const struct mmc_fixup __maybe_un
+@@ -50,6 +50,14 @@ static const struct mmc_fixup __maybe_un
  	MMC_FIXUP(CID_NAME_ANY, CID_MANFID_SANDISK_SD, 0x5344, add_quirk_sd,
  		  MMC_QUIRK_BROKEN_SD_DISCARD),
  
@@ -2013,10 +2013,10 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  		sdhci_dumpregs(host);
 --- a/include/linux/mmc/card.h
 +++ b/include/linux/mmc/card.h
-@@ -296,6 +296,7 @@ struct mmc_card {
- #define MMC_QUIRK_BROKEN_SD_DISCARD	(1<<14)	/* Disable broken SD discard support */
- #define MMC_QUIRK_BROKEN_SD_CACHE	(1<<15)	/* Disable broken SD cache support */
+@@ -298,6 +298,7 @@ struct mmc_card {
  #define MMC_QUIRK_BROKEN_CACHE_FLUSH	(1<<16)	/* Don't flush cache until the write has occurred */
+ #define MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY	(1<<17) /* Disable broken SD poweroff notify support */
+ #define MMC_QUIRK_NO_UHS_DDR50_TUNING	(1<<18) /* Disable DDR50 tuning */
 +#define MMC_QUIRK_ERASE_BROKEN	(1<<31)		/* Skip erase */
  
  	bool			written_flag;	/* Indicates eMMC has been written since power on */
diff --git a/target/linux/bcm27xx/patches-6.6/950-0106-Add-support-for-all-the-downstream-rpi-sound-card-dr.patch b/target/linux/bcm27xx/patches-6.6/950-0106-Add-support-for-all-the-downstream-rpi-sound-card-dr.patch
index 8685508ddf6af7..58aa9440874d4d 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0106-Add-support-for-all-the-downstream-rpi-sound-card-dr.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0106-Add-support-for-all-the-downstream-rpi-sound-card-dr.patch
@@ -14927,7 +14927,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  config SND_SOC_TFA989X
  	tristate "NXP/Goodix TFA989X (TFA1) amplifiers"
  	depends on I2C
-@@ -2404,4 +2422,8 @@ config SND_SOC_LPASS_TX_MACRO
+@@ -2405,4 +2423,8 @@ config SND_SOC_LPASS_TX_MACRO
  	select SND_SOC_LPASS_MACRO_COMMON
  	tristate "Qualcomm TX Macro in LPASS(Low Power Audio SubSystem)"
  
@@ -17546,7 +17546,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 +#endif  /* _TAS5713_H */
 --- a/sound/soc/soc-core.c
 +++ b/sound/soc/soc-core.c
-@@ -1316,7 +1316,15 @@ int snd_soc_runtime_set_dai_fmt(struct s
+@@ -1319,7 +1319,15 @@ int snd_soc_runtime_set_dai_fmt(struct s
  		return 0;
  
  	for_each_rtd_codec_dais(rtd, i, codec_dai) {
@@ -17583,7 +17583,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	 * For devices with more than one control interface, we assume the
 --- a/sound/usb/quirks.c
 +++ b/sound/usb/quirks.c
-@@ -2195,6 +2195,8 @@ static const struct usb_audio_quirk_flag
+@@ -2260,6 +2260,8 @@ static const struct usb_audio_quirk_flag
  		   QUIRK_FLAG_ALIGN_TRANSFER),
  	DEVICE_FLG(0x534d, 0x2109, /* MacroSilicon MS2109 */
  		   QUIRK_FLAG_ALIGN_TRANSFER),
diff --git a/target/linux/bcm27xx/patches-6.6/950-0120-lan78xx-Read-initial-EEE-status-from-DT.patch b/target/linux/bcm27xx/patches-6.6/950-0120-lan78xx-Read-initial-EEE-status-from-DT.patch
index 296ceae6c70c3a..7aa05b0abc4225 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0120-lan78xx-Read-initial-EEE-status-from-DT.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0120-lan78xx-Read-initial-EEE-status-from-DT.patch
@@ -15,7 +15,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/net/usb/lan78xx.c
 +++ b/drivers/net/usb/lan78xx.c
-@@ -3111,6 +3111,22 @@ static int lan78xx_open(struct net_devic
+@@ -3112,6 +3112,22 @@ static int lan78xx_open(struct net_devic
  
  	netif_dbg(dev, ifup, dev->net, "phy initialised successfully");
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0121-hid-Reduce-default-mouse-polling-interval-to-60Hz.patch b/target/linux/bcm27xx/patches-6.6/950-0121-hid-Reduce-default-mouse-polling-interval-to-60Hz.patch
index c3563ba402c85b..1584a946c533d6 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0121-hid-Reduce-default-mouse-polling-interval-to-60Hz.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0121-hid-Reduce-default-mouse-polling-interval-to-60Hz.patch
@@ -19,7 +19,7 @@ Reduces overhead when using X
  module_param_named(mousepoll, hid_mousepoll_interval, uint, 0644);
  MODULE_PARM_DESC(mousepoll, "Polling interval of mice");
  
-@@ -1112,7 +1112,9 @@ static int usbhid_start(struct hid_devic
+@@ -1115,7 +1115,9 @@ static int usbhid_start(struct hid_devic
  		 */
  		switch (hid->collection->usage) {
  		case HID_GD_MOUSE:
diff --git a/target/linux/bcm27xx/patches-6.6/950-0125-net-lan78xx-Disable-TCP-Segmentation-Offload-TSO.patch b/target/linux/bcm27xx/patches-6.6/950-0125-net-lan78xx-Disable-TCP-Segmentation-Offload-TSO.patch
index 7738bdb8da8688..1b6643508b38cc 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0125-net-lan78xx-Disable-TCP-Segmentation-Offload-TSO.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0125-net-lan78xx-Disable-TCP-Segmentation-Offload-TSO.patch
@@ -38,7 +38,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
  static int lan78xx_read_reg(struct lan78xx_net *dev, u32 index, u32 *data)
  {
  	u32 *buf;
-@@ -3471,8 +3480,14 @@ static int lan78xx_bind(struct lan78xx_n
+@@ -3472,8 +3481,14 @@ static int lan78xx_bind(struct lan78xx_n
  	if (DEFAULT_RX_CSUM_ENABLE)
  		dev->net->features |= NETIF_F_RXCSUM;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0127-lan78xx-Move-enabling-of-EEE-into-PHY-init-code.patch b/target/linux/bcm27xx/patches-6.6/950-0127-lan78xx-Move-enabling-of-EEE-into-PHY-init-code.patch
index f73106ab4bd8b4..f98d2c7dd63c18 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0127-lan78xx-Move-enabling-of-EEE-into-PHY-init-code.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0127-lan78xx-Move-enabling-of-EEE-into-PHY-init-code.patch
@@ -16,7 +16,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/net/usb/lan78xx.c
 +++ b/drivers/net/usb/lan78xx.c
-@@ -2419,6 +2419,22 @@ static int lan78xx_phy_init(struct lan78
+@@ -2420,6 +2420,22 @@ static int lan78xx_phy_init(struct lan78
  	mii_adv_to_linkmode_adv_t(fc, mii_adv);
  	linkmode_or(phydev->advertising, fc, phydev->advertising);
  
@@ -39,7 +39,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	if (phydev->mdio.dev.of_node) {
  		u32 reg;
  		int len;
-@@ -3120,22 +3136,6 @@ static int lan78xx_open(struct net_devic
+@@ -3121,22 +3137,6 @@ static int lan78xx_open(struct net_devic
  
  	netif_dbg(dev, ifup, dev->net, "phy initialised successfully");
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0130-serial-sc16is7xx-Don-t-spin-if-no-data-received.patch b/target/linux/bcm27xx/patches-6.6/950-0130-serial-sc16is7xx-Don-t-spin-if-no-data-received.patch
index eceba53aabdaa7..4ef34aeffc0b6a 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0130-serial-sc16is7xx-Don-t-spin-if-no-data-received.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0130-serial-sc16is7xx-Don-t-spin-if-no-data-received.patch
@@ -15,7 +15,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/drivers/tty/serial/sc16is7xx.c
 +++ b/drivers/tty/serial/sc16is7xx.c
-@@ -773,6 +773,8 @@ static bool sc16is7xx_port_irq(struct sc
+@@ -777,6 +777,8 @@ static bool sc16is7xx_port_irq(struct sc
  
  		if (rxlen)
  			sc16is7xx_handle_rx(port, rxlen, iir);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0131-net-lan78xx-Support-auto-downshift-to-100Mb-s.patch b/target/linux/bcm27xx/patches-6.6/950-0131-net-lan78xx-Support-auto-downshift-to-100Mb-s.patch
index acc0d7f3e86f59..0c6145ae51c71b 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0131-net-lan78xx-Support-auto-downshift-to-100Mb-s.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0131-net-lan78xx-Support-auto-downshift-to-100Mb-s.patch
@@ -31,7 +31,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
 --- a/drivers/net/phy/microchip.c
 +++ b/drivers/net/phy/microchip.c
-@@ -233,6 +233,7 @@ static int lan88xx_probe(struct phy_devi
+@@ -192,6 +192,7 @@ static int lan88xx_probe(struct phy_devi
  	struct device *dev = &phydev->mdio.dev;
  	struct lan88xx_priv *priv;
  	u32 led_modes[4];
@@ -39,7 +39,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	int len;
  
  	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
-@@ -262,6 +263,32 @@ static int lan88xx_probe(struct phy_devi
+@@ -221,6 +222,32 @@ static int lan88xx_probe(struct phy_devi
  		return -EINVAL;
  	}
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0133-lan78xx-Debounce-link-events-to-minimize-poll-storm.patch b/target/linux/bcm27xx/patches-6.6/950-0133-lan78xx-Debounce-link-events-to-minimize-poll-storm.patch
index dc411233dfa2ff..46bfe50f1aa490 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0133-lan78xx-Debounce-link-events-to-minimize-poll-storm.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0133-lan78xx-Debounce-link-events-to-minimize-poll-storm.patch
@@ -29,7 +29,7 @@ See: https://github.com/raspberrypi/linux/issues/2447
  static int lan78xx_read_reg(struct lan78xx_net *dev, u32 index, u32 *data)
  {
  	u32 *buf;
-@@ -4455,7 +4460,13 @@ static int lan78xx_probe(struct usb_inte
+@@ -4456,7 +4461,13 @@ static int lan78xx_probe(struct usb_inte
  	if (ret < 0)
  		goto out4;
  
@@ -42,5 +42,5 @@ See: https://github.com/raspberrypi/linux/issues/2447
 +	netif_notice(dev, probe, netdev, "int urb period %d\n", period);
 +
  	maxp = usb_maxpacket(dev->udev, dev->pipe_intr);
- 	buf = kmalloc(maxp, GFP_KERNEL);
- 	if (!buf) {
+ 
+ 	dev->urb_intr = usb_alloc_urb(0, GFP_KERNEL);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0134-lan78xx-EEE-support-is-now-a-PHY-property.patch b/target/linux/bcm27xx/patches-6.6/950-0134-lan78xx-EEE-support-is-now-a-PHY-property.patch
index df6c7e687fd7d3..b5e0095d97c01d 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0134-lan78xx-EEE-support-is-now-a-PHY-property.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0134-lan78xx-EEE-support-is-now-a-PHY-property.patch
@@ -15,7 +15,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/net/usb/lan78xx.c
 +++ b/drivers/net/usb/lan78xx.c
-@@ -2424,7 +2424,7 @@ static int lan78xx_phy_init(struct lan78
+@@ -2425,7 +2425,7 @@ static int lan78xx_phy_init(struct lan78
  	mii_adv_to_linkmode_adv_t(fc, mii_adv);
  	linkmode_or(phydev->advertising, fc, phydev->advertising);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0135-media-tc358743-Increase-FIFO-level-to-374.patch b/target/linux/bcm27xx/patches-6.6/950-0135-media-tc358743-Increase-FIFO-level-to-374.patch
deleted file mode 100644
index 79c13d562399ca..00000000000000
--- a/target/linux/bcm27xx/patches-6.6/950-0135-media-tc358743-Increase-FIFO-level-to-374.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From 1026232b9a7af3439c2d9cc9a793240028fbf9a4 Mon Sep 17 00:00:00 2001
-From: Dave Stevenson <dave.stevenson@raspberrypi.org>
-Date: Wed, 31 Oct 2018 14:56:59 +0000
-Subject: [PATCH 0135/1085] media: tc358743: Increase FIFO level to 374.
-
-The existing fixed value of 16 worked for UYVY 720P60 over
-2 lanes at 594MHz, or UYVY 1080P60 over 4 lanes. (RGB888
-1080P60 needs 6 lanes at 594MHz).
-It doesn't allow for lower resolutions to work as the FIFO
-underflows.
-
-374 is required for 1080P24-30 UYVY over 2 lanes @ 972Mbit/s, but
->374 means that the FIFO underflows on 1080P50 UYVY over 2 lanes
-@ 972Mbit/s.
-
-Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
----
- drivers/media/i2c/tc358743.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/media/i2c/tc358743.c
-+++ b/drivers/media/i2c/tc358743.c
-@@ -1933,7 +1933,7 @@ static int tc358743_probe_of(struct tc35
- 	state->pdata.ddc5v_delay = DDC5V_DELAY_100_MS;
- 	state->pdata.enable_hdcp = false;
- 	/* A FIFO level of 16 should be enough for 2-lane 720p60 at 594 MHz. */
--	state->pdata.fifo_level = 16;
-+	state->pdata.fifo_level = 374;
- 	/*
- 	 * The PLL input clock is obtained by dividing refclk by pll_prd.
- 	 * It must be between 6 MHz and 40 MHz, lower frequency is better.
diff --git a/target/linux/bcm27xx/patches-6.6/950-0136-media-tc358743-Add-support-for-972Mbit-s-link-freq.patch b/target/linux/bcm27xx/patches-6.6/950-0136-media-tc358743-Add-support-for-972Mbit-s-link-freq.patch
index 01337f7703a975..14955b948908c1 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0136-media-tc358743-Add-support-for-972Mbit-s-link-freq.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0136-media-tc358743-Add-support-for-972Mbit-s-link-freq.patch
@@ -14,7 +14,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
 
 --- a/drivers/media/i2c/tc358743.c
 +++ b/drivers/media/i2c/tc358743.c
-@@ -1953,6 +1953,7 @@ static int tc358743_probe_of(struct tc35
+@@ -1971,6 +1971,7 @@ static int tc358743_probe_of(struct tc35
  	/*
  	 * The CSI bps per lane must be between 62.5 Mbps and 1 Gbps.
  	 * The default is 594 Mbps for 4-lane 1080p60 or 2-lane 720p60.
@@ -22,7 +22,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
  	 */
  	bps_pr_lane = 2 * endpoint.link_frequencies[0];
  	if (bps_pr_lane < 62500000U || bps_pr_lane > 1000000000U) {
-@@ -1966,23 +1967,41 @@ static int tc358743_probe_of(struct tc35
+@@ -1984,23 +1985,41 @@ static int tc358743_probe_of(struct tc35
  			       state->pdata.refclk_hz * state->pdata.pll_prd;
  
  	/*
diff --git a/target/linux/bcm27xx/patches-6.6/950-0137-media-tc358743-Check-I2C-succeeded-during-probe.patch b/target/linux/bcm27xx/patches-6.6/950-0137-media-tc358743-Check-I2C-succeeded-during-probe.patch
deleted file mode 100644
index 710c72f897d6fe..00000000000000
--- a/target/linux/bcm27xx/patches-6.6/950-0137-media-tc358743-Check-I2C-succeeded-during-probe.patch
+++ /dev/null
@@ -1,98 +0,0 @@
-From 1bf7f627d378f9ef0d056d4a1f925bba810db6c7 Mon Sep 17 00:00:00 2001
-From: Dave Stevenson <dave.stevenson@raspberrypi.org>
-Date: Wed, 31 Oct 2018 14:57:34 +0000
-Subject: [PATCH 0137/1085] media: tc358743: Check I2C succeeded during probe.
-
-The probe for the TC358743 reads the CHIPID register from
-the device and compares it to the expected value of 0.
-If the I2C request fails then that also returns 0, so
-the driver loads thinking that the device is there.
-
-Generally I2C communications are reliable so there is
-limited need to check the return value on every transfer,
-therefore only amend the one read during probe to check
-for I2C errors.
-
-Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
----
- drivers/media/i2c/tc358743.c | 27 +++++++++++++++++++++++----
- 1 file changed, 23 insertions(+), 4 deletions(-)
-
---- a/drivers/media/i2c/tc358743.c
-+++ b/drivers/media/i2c/tc358743.c
-@@ -110,7 +110,7 @@ static inline struct tc358743_state *to_
- 
- /* --------------- I2C --------------- */
- 
--static void i2c_rd(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
-+static int i2c_rd(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
- {
- 	struct tc358743_state *state = to_state(sd);
- 	struct i2c_client *client = state->i2c_client;
-@@ -136,6 +136,7 @@ static void i2c_rd(struct v4l2_subdev *s
- 		v4l2_err(sd, "%s: reading register 0x%x from 0x%x failed: %d\n",
- 				__func__, reg, client->addr, err);
- 	}
-+	return err != ARRAY_SIZE(msgs);
- }
- 
- static void i2c_wr(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
-@@ -192,15 +193,24 @@ static void i2c_wr(struct v4l2_subdev *s
- 	}
- }
- 
--static noinline u32 i2c_rdreg(struct v4l2_subdev *sd, u16 reg, u32 n)
-+static noinline u32 i2c_rdreg_err(struct v4l2_subdev *sd, u16 reg, u32 n,
-+				  int *err)
- {
-+	int error;
- 	__le32 val = 0;
- 
--	i2c_rd(sd, reg, (u8 __force *)&val, n);
-+	error = i2c_rd(sd, reg, (u8 __force *)&val, n);
-+	if (err)
-+		*err = error;
- 
- 	return le32_to_cpu(val);
- }
- 
-+static inline u32 i2c_rdreg(struct v4l2_subdev *sd, u16 reg, u32 n)
-+{
-+	return i2c_rdreg_err(sd, reg, n, NULL);
-+}
-+
- static noinline void i2c_wrreg(struct v4l2_subdev *sd, u16 reg, u32 val, u32 n)
- {
- 	__le32 raw = cpu_to_le32(val);
-@@ -229,6 +239,13 @@ static u16 i2c_rd16(struct v4l2_subdev *
- 	return i2c_rdreg(sd, reg, 2);
- }
- 
-+static int i2c_rd16_err(struct v4l2_subdev *sd, u16 reg, u16 *value)
-+{
-+	int err;
-+	*value = i2c_rdreg_err(sd, reg, 2, &err);
-+	return err;
-+}
-+
- static void i2c_wr16(struct v4l2_subdev *sd, u16 reg, u16 val)
- {
- 	i2c_wrreg(sd, reg, val, 2);
-@@ -2040,6 +2057,7 @@ static int tc358743_probe(struct i2c_cli
- 	struct tc358743_platform_data *pdata = client->dev.platform_data;
- 	struct v4l2_subdev *sd;
- 	u16 irq_mask = MASK_HDMI_MSK | MASK_CSI_MSK;
-+	u16 chipid;
- 	int err;
- 
- 	if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE_DATA))
-@@ -2071,7 +2089,8 @@ static int tc358743_probe(struct i2c_cli
- 	sd->flags |= V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS;
- 
- 	/* i2c access */
--	if ((i2c_rd16(sd, CHIPID) & MASK_CHIPID) != 0) {
-+	if (i2c_rd16_err(sd, CHIPID, &chipid) ||
-+	    (chipid & MASK_CHIPID) != 0) {
- 		v4l2_info(sd, "not a TC358743 on address 0x%x\n",
- 			  client->addr << 1);
- 		return -ENODEV;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0138-media-adv7180-Default-to-the-first-valid-input.patch b/target/linux/bcm27xx/patches-6.6/950-0138-media-adv7180-Default-to-the-first-valid-input.patch
index 7669317e602295..181b69b807ec97 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0138-media-adv7180-Default-to-the-first-valid-input.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0138-media-adv7180-Default-to-the-first-valid-input.patch
@@ -16,7 +16,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
 
 --- a/drivers/media/i2c/adv7180.c
 +++ b/drivers/media/i2c/adv7180.c
-@@ -1340,6 +1340,7 @@ static const struct adv7180_chip_info ad
+@@ -1350,6 +1350,7 @@ static const struct adv7180_chip_info ad
  static int init_device(struct adv7180_state *state)
  {
  	int ret;
@@ -24,7 +24,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
  
  	mutex_lock(&state->mutex);
  
-@@ -1387,6 +1388,18 @@ static int init_device(struct adv7180_st
+@@ -1397,6 +1398,18 @@ static int init_device(struct adv7180_st
  			goto out_unlock;
  	}
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0139-media-adv7180-Add-YPrPb-support-for-ADV7282M.patch b/target/linux/bcm27xx/patches-6.6/950-0139-media-adv7180-Add-YPrPb-support-for-ADV7282M.patch
index faaf79f2ae0dd7..caa83f409f870f 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0139-media-adv7180-Add-YPrPb-support-for-ADV7282M.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0139-media-adv7180-Add-YPrPb-support-for-ADV7282M.patch
@@ -14,7 +14,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
 
 --- a/drivers/media/i2c/adv7180.c
 +++ b/drivers/media/i2c/adv7180.c
-@@ -1329,6 +1329,7 @@ static const struct adv7180_chip_info ad
+@@ -1339,6 +1339,7 @@ static const struct adv7180_chip_info ad
  		BIT(ADV7182_INPUT_SVIDEO_AIN1_AIN2) |
  		BIT(ADV7182_INPUT_SVIDEO_AIN3_AIN4) |
  		BIT(ADV7182_INPUT_SVIDEO_AIN7_AIN8) |
diff --git a/target/linux/bcm27xx/patches-6.6/950-0143-media-tc358743-Return-an-appropriate-colorspace-from.patch b/target/linux/bcm27xx/patches-6.6/950-0143-media-tc358743-Return-an-appropriate-colorspace-from.patch
deleted file mode 100644
index ca00c809491e77..00000000000000
--- a/target/linux/bcm27xx/patches-6.6/950-0143-media-tc358743-Return-an-appropriate-colorspace-from.patch
+++ /dev/null
@@ -1,98 +0,0 @@
-From a44571c8bd6d63caf3744d3e95a3a7492df15b6c Mon Sep 17 00:00:00 2001
-From: Dave Stevenson <dave.stevenson@raspberrypi.org>
-Date: Thu, 22 Nov 2018 17:31:06 +0000
-Subject: [PATCH 0143/1085] media: tc358743: Return an appropriate colorspace
- from tc358743_set_fmt
-
-When calling tc358743_set_fmt, the code was calling tc358743_get_fmt
-to choose a valid format. However that sets the colorspace
-based on what was read back from the chip. When you set the format,
-then the driver would choose and program the colorspace based
-on the format code.
-
-The result was that if you called try or set format for UYVY
-when the current format was RGB3 then you would get told sRGB,
-and try RGB3 when current was UYVY and you would get told
-SMPTE170M.
-
-The value programmed into the chip is determined by this driver,
-therefore there is no need to read back the value. Return the
-colorspace based on the format set/tried instead.
-
-Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
----
- drivers/media/i2c/tc358743.c | 40 +++++++++++++-----------------------
- 1 file changed, 14 insertions(+), 26 deletions(-)
-
---- a/drivers/media/i2c/tc358743.c
-+++ b/drivers/media/i2c/tc358743.c
-@@ -1668,12 +1668,23 @@ static int tc358743_enum_mbus_code(struc
- 	return 0;
- }
- 
-+static u32 tc358743_g_colorspace(u32 code)
-+{
-+	switch (code) {
-+	case MEDIA_BUS_FMT_RGB888_1X24:
-+		return V4L2_COLORSPACE_SRGB;
-+	case MEDIA_BUS_FMT_UYVY8_1X16:
-+		return V4L2_COLORSPACE_SMPTE170M;
-+	default:
-+		return 0;
-+	}
-+}
-+
- static int tc358743_get_fmt(struct v4l2_subdev *sd,
- 		struct v4l2_subdev_state *sd_state,
- 		struct v4l2_subdev_format *format)
- {
- 	struct tc358743_state *state = to_state(sd);
--	u8 vi_rep = i2c_rd8(sd, VI_REP);
- 
- 	if (format->pad != 0)
- 		return -EINVAL;
-@@ -1683,23 +1694,7 @@ static int tc358743_get_fmt(struct v4l2_
- 	format->format.height = state->timings.bt.height;
- 	format->format.field = V4L2_FIELD_NONE;
- 
--	switch (vi_rep & MASK_VOUT_COLOR_SEL) {
--	case MASK_VOUT_COLOR_RGB_FULL:
--	case MASK_VOUT_COLOR_RGB_LIMITED:
--		format->format.colorspace = V4L2_COLORSPACE_SRGB;
--		break;
--	case MASK_VOUT_COLOR_601_YCBCR_LIMITED:
--	case MASK_VOUT_COLOR_601_YCBCR_FULL:
--		format->format.colorspace = V4L2_COLORSPACE_SMPTE170M;
--		break;
--	case MASK_VOUT_COLOR_709_YCBCR_FULL:
--	case MASK_VOUT_COLOR_709_YCBCR_LIMITED:
--		format->format.colorspace = V4L2_COLORSPACE_REC709;
--		break;
--	default:
--		format->format.colorspace = 0;
--		break;
--	}
-+	format->format.colorspace = tc358743_g_colorspace(format->format.code);
- 
- 	return 0;
- }
-@@ -1714,18 +1709,11 @@ static int tc358743_set_fmt(struct v4l2_
- 	int ret = tc358743_get_fmt(sd, sd_state, format);
- 
- 	format->format.code = code;
-+	format->format.colorspace = tc358743_g_colorspace(code);
- 
- 	if (ret)
- 		return ret;
- 
--	switch (code) {
--	case MEDIA_BUS_FMT_RGB888_1X24:
--	case MEDIA_BUS_FMT_UYVY8_1X16:
--		break;
--	default:
--		return -EINVAL;
--	}
--
- 	if (format->which == V4L2_SUBDEV_FORMAT_TRY)
- 		return 0;
- 
diff --git a/target/linux/bcm27xx/patches-6.6/950-0161-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch b/target/linux/bcm27xx/patches-6.6/950-0161-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch
index f5eea9b47df860..2cf32f792b0cfb 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0161-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0161-xhci-implement-xhci_fixup_endpoint-for-interval-adju.patch
@@ -15,7 +15,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
 
 --- a/drivers/usb/host/xhci.c
 +++ b/drivers/usb/host/xhci.c
-@@ -1497,6 +1497,109 @@ command_cleanup:
+@@ -1526,6 +1526,109 @@ command_cleanup:
  }
  
  /*
@@ -125,7 +125,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
   * non-error returns are a promise to giveback() the urb later
   * we drop ownership so next owner (or urb unlink) can get it
   */
-@@ -5328,6 +5431,7 @@ static const struct hc_driver xhci_hc_dr
+@@ -5395,6 +5498,7 @@ static const struct hc_driver xhci_hc_dr
  	.endpoint_reset =	xhci_endpoint_reset,
  	.check_bandwidth =	xhci_check_bandwidth,
  	.reset_bandwidth =	xhci_reset_bandwidth,
diff --git a/target/linux/bcm27xx/patches-6.6/950-0162-usb-xhci-workaround-for-bogus-SET_DEQ_PENDING-endpoi.patch b/target/linux/bcm27xx/patches-6.6/950-0162-usb-xhci-workaround-for-bogus-SET_DEQ_PENDING-endpoi.patch
index 32681a1bc4b041..9d22d745101c4b 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0162-usb-xhci-workaround-for-bogus-SET_DEQ_PENDING-endpoi.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0162-usb-xhci-workaround-for-bogus-SET_DEQ_PENDING-endpoi.patch
@@ -26,7 +26,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/usb/host/xhci-ring.c
 +++ b/drivers/usb/host/xhci-ring.c
-@@ -738,9 +738,9 @@ deq_found:
+@@ -740,9 +740,9 @@ deq_found:
  	}
  
  	if ((ep->ep_state & SET_DEQ_PENDING)) {
diff --git a/target/linux/bcm27xx/patches-6.6/950-0163-usb-xhci-drop-and-add-the-endpoint-context-in-xhci_f.patch b/target/linux/bcm27xx/patches-6.6/950-0163-usb-xhci-drop-and-add-the-endpoint-context-in-xhci_f.patch
index 1e5bb6059d2762..b162b37cf48752 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0163-usb-xhci-drop-and-add-the-endpoint-context-in-xhci_f.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0163-usb-xhci-drop-and-add-the-endpoint-context-in-xhci_f.patch
@@ -19,7 +19,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/usb/host/xhci.c
 +++ b/drivers/usb/host/xhci.c
-@@ -1586,7 +1586,7 @@ static void xhci_fixup_endpoint(struct u
+@@ -1615,7 +1615,7 @@ static void xhci_fixup_endpoint(struct u
  		return;
  	}
  	ctrl_ctx->add_flags = xhci_get_endpoint_flag_from_index(ep_index);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0164-usbhid-call-usb_fixup_endpoint-after-mangling-interv.patch b/target/linux/bcm27xx/patches-6.6/950-0164-usbhid-call-usb_fixup_endpoint-after-mangling-interv.patch
index 3755d9116996ea..2f14a56f8e48fc 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0164-usbhid-call-usb_fixup_endpoint-after-mangling-interv.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0164-usbhid-call-usb_fixup_endpoint-after-mangling-interv.patch
@@ -13,7 +13,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
 
 --- a/drivers/hid/usbhid/hid-core.c
 +++ b/drivers/hid/usbhid/hid-core.c
-@@ -1126,6 +1126,7 @@ static int usbhid_start(struct hid_devic
+@@ -1129,6 +1129,7 @@ static int usbhid_start(struct hid_devic
  				interval = hid_kbpoll_interval;
  			break;
  		}
diff --git a/target/linux/bcm27xx/patches-6.6/950-0167-drm-v3d-Clock-V3D-down-when-not-in-use.patch b/target/linux/bcm27xx/patches-6.6/950-0167-drm-v3d-Clock-V3D-down-when-not-in-use.patch
index 031d8ab6b23db9..099cf75a817599 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0167-drm-v3d-Clock-V3D-down-when-not-in-use.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0167-drm-v3d-Clock-V3D-down-when-not-in-use.patch
@@ -25,7 +25,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/gpu/drm/v3d/v3d_drv.c
 +++ b/drivers/gpu/drm/v3d/v3d_drv.c
-@@ -256,6 +256,21 @@ static int v3d_platform_drm_probe(struct
+@@ -266,6 +266,21 @@ static int v3d_platform_drm_probe(struct
  		}
  	}
  
@@ -47,7 +47,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	if (v3d->ver < 41) {
  		ret = map_regs(v3d, &v3d->gca_regs, "gca");
  		if (ret)
-@@ -281,6 +296,9 @@ static int v3d_platform_drm_probe(struct
+@@ -292,6 +307,9 @@ static int v3d_platform_drm_probe(struct
  	if (ret)
  		goto irq_disable;
  
@@ -59,7 +59,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  irq_disable:
 --- a/drivers/gpu/drm/v3d/v3d_drv.h
 +++ b/drivers/gpu/drm/v3d/v3d_drv.h
-@@ -76,6 +76,12 @@ struct v3d_dev {
+@@ -84,6 +84,12 @@ struct v3d_dev {
  	void __iomem *bridge_regs;
  	void __iomem *gca_regs;
  	struct clk *clk;
@@ -130,7 +130,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  v3d_init_core(struct v3d_dev *v3d, int core)
  {
  	/* Set OVRTMUOUT, which means that the texture sampler uniform
-@@ -318,6 +360,7 @@ static void
+@@ -320,6 +362,7 @@ static void
  v3d_job_free(struct kref *ref)
  {
  	struct v3d_job *job = container_of(ref, struct v3d_job, refcount);
@@ -138,7 +138,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	int i;
  
  	if (job->bo) {
-@@ -329,6 +372,8 @@ v3d_job_free(struct kref *ref)
+@@ -331,6 +374,8 @@ v3d_job_free(struct kref *ref)
  	dma_fence_put(job->irq_fence);
  	dma_fence_put(job->done_fence);
  
@@ -147,7 +147,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	if (job->perfmon)
  		v3d_perfmon_put(job->perfmon);
  
-@@ -448,6 +493,7 @@ v3d_job_init(struct v3d_dev *v3d, struct
+@@ -450,6 +495,7 @@ v3d_job_init(struct v3d_dev *v3d, struct
  			goto fail_deps;
  	}
  
@@ -155,7 +155,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  	kref_init(&job->refcount);
  
  	return 0;
-@@ -1031,6 +1077,9 @@ v3d_gem_init(struct drm_device *dev)
+@@ -1033,6 +1079,9 @@ v3d_gem_init(struct drm_device *dev)
  	if (ret)
  		return ret;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0169-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch b/target/linux/bcm27xx/patches-6.6/950-0169-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch
index 5301066196f53b..96c04d52c7cdf0 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0169-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0169-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch
@@ -23,7 +23,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
 
 --- a/drivers/hid/hid-ids.h
 +++ b/drivers/hid/hid-ids.h
-@@ -242,6 +242,9 @@
+@@ -248,6 +248,9 @@
  #define USB_VENDOR_ID_BAANTO		0x2453
  #define USB_DEVICE_ID_BAANTO_MT_190W2	0x0100
  
@@ -33,7 +33,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
  #define USB_VENDOR_ID_BELKIN		0x050d
  #define USB_DEVICE_ID_FLIP_KVM		0x3201
  
-@@ -1404,6 +1407,9 @@
+@@ -1449,6 +1452,9 @@
  #define USB_VENDOR_ID_XIAOMI		0x2717
  #define USB_DEVICE_ID_MI_SILENT_MOUSE	0x5014
  
@@ -45,7 +45,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
  #define USB_DEVICE_ID_THT_2P_ARCADE		0x75e1
 --- a/drivers/hid/hid-quirks.c
 +++ b/drivers/hid/hid-quirks.c
-@@ -42,6 +42,7 @@ static const struct hid_device_id hid_qu
+@@ -44,6 +44,7 @@ static const struct hid_device_id hid_qu
  	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS682), HID_QUIRK_NOGET },
  	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS692), HID_QUIRK_NOGET },
  	{ HID_USB_DEVICE(USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_UC100KM), HID_QUIRK_NOGET },
@@ -53,7 +53,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
  	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_MULTI_TOUCH), HID_QUIRK_MULTI_INPUT },
  	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL },
  	{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE2), HID_QUIRK_ALWAYS_POLL },
-@@ -209,6 +210,7 @@ static const struct hid_device_id hid_qu
+@@ -213,6 +214,7 @@ static const struct hid_device_id hid_qu
  	{ HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_QUAD_USB_JOYPAD), HID_QUIRK_NOGET | HID_QUIRK_MULTI_INPUT },
  	{ HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE), HID_QUIRK_MULTI_INPUT },
  	{ HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_GROUP_AUDIO), HID_QUIRK_NOGET },
diff --git a/target/linux/bcm27xx/patches-6.6/950-0173-media-i2c-imx477-Support-for-the-Sony-IMX477-sensor.patch b/target/linux/bcm27xx/patches-6.6/950-0173-media-i2c-imx477-Support-for-the-Sony-IMX477-sensor.patch
index 03af7a9cb9e33f..264b3ca376ac59 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0173-media-i2c-imx477-Support-for-the-Sony-IMX477-sensor.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0173-media-i2c-imx477-Support-for-the-Sony-IMX477-sensor.patch
@@ -343,7 +343,7 @@ Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
 +...
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -20057,6 +20057,14 @@ T:	git git://linuxtv.org/media_tree.git
+@@ -20058,6 +20058,14 @@ T:	git git://linuxtv.org/media_tree.git
  F:	Documentation/devicetree/bindings/media/i2c/sony,imx415.yaml
  F:	drivers/media/i2c/imx415.c
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0174-media-i2c-imx519-Support-for-the-Sony-IMX519-sensor.patch b/target/linux/bcm27xx/patches-6.6/950-0174-media-i2c-imx519-Support-for-the-Sony-IMX519-sensor.patch
index 3dbfea8813957b..2ba00932c27735 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0174-media-i2c-imx519-Support-for-the-Sony-IMX519-sensor.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0174-media-i2c-imx519-Support-for-the-Sony-IMX519-sensor.patch
@@ -177,7 +177,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 +...
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -20065,6 +20065,14 @@ T:	git git://linuxtv.org/media_tree.git
+@@ -20066,6 +20066,14 @@ T:	git git://linuxtv.org/media_tree.git
  F:	Documentation/devicetree/bindings/media/i2c/imx477.yaml
  F:	drivers/media/i2c/imx477.c
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0175-Documentation-devicetree-Add-documentation-for-imx37.patch b/target/linux/bcm27xx/patches-6.6/950-0175-Documentation-devicetree-Add-documentation-for-imx37.patch
index b6df79f250563c..019ca418aebb1d 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0175-Documentation-devicetree-Add-documentation-for-imx37.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0175-Documentation-devicetree-Add-documentation-for-imx37.patch
@@ -132,7 +132,7 @@ Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
 +...
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -20062,6 +20062,7 @@ M:	Raspberry Pi Kernel Maintenance <kern
+@@ -20063,6 +20063,7 @@ M:	Raspberry Pi Kernel Maintenance <kern
  L:	linux-media@vger.kernel.org
  S:	Maintained
  T:	git git://linuxtv.org/media_tree.git
diff --git a/target/linux/bcm27xx/patches-6.6/950-0183-drm-v3d-Suppress-all-but-the-first-MMU-error.patch b/target/linux/bcm27xx/patches-6.6/950-0183-drm-v3d-Suppress-all-but-the-first-MMU-error.patch
index 31c7840e1444e0..d41fab9d94d9a4 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0183-drm-v3d-Suppress-all-but-the-first-MMU-error.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0183-drm-v3d-Suppress-all-but-the-first-MMU-error.patch
@@ -13,7 +13,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
 
 --- a/drivers/gpu/drm/v3d/v3d_irq.c
 +++ b/drivers/gpu/drm/v3d/v3d_irq.c
-@@ -177,6 +177,7 @@ v3d_hub_irq(int irq, void *arg)
+@@ -189,6 +189,7 @@ v3d_hub_irq(int irq, void *arg)
  			"GMP",
  		};
  		const char *client = "?";
@@ -21,7 +21,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  
  		V3D_WRITE(V3D_MMU_CTL, V3D_READ(V3D_MMU_CTL));
  
-@@ -186,6 +187,7 @@ v3d_hub_irq(int irq, void *arg)
+@@ -198,6 +199,7 @@ v3d_hub_irq(int irq, void *arg)
  				client = v3d41_axi_ids[axi_id];
  		}
  
@@ -29,7 +29,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.org>
  		dev_err(v3d->drm.dev, "MMU error from client %s (%d) at 0x%llx%s%s%s\n",
  			client, axi_id, (long long)vio_addr,
  			((intsts & V3D_HUB_INT_MMU_WRV) ?
-@@ -194,6 +196,7 @@ v3d_hub_irq(int irq, void *arg)
+@@ -206,6 +208,7 @@ v3d_hub_irq(int irq, void *arg)
  			 ", pte invalid" : ""),
  			((intsts & V3D_HUB_INT_MMU_CAP) ?
  			 ", cap exceeded" : ""));
diff --git a/target/linux/bcm27xx/patches-6.6/950-0184-staging-vchiq_arm-Register-vcsm-cma-as-a-platform-dr.patch b/target/linux/bcm27xx/patches-6.6/950-0184-staging-vchiq_arm-Register-vcsm-cma-as-a-platform-dr.patch
index 102931650446f4..6daa690dff2138 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0184-staging-vchiq_arm-Register-vcsm-cma-as-a-platform-dr.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0184-staging-vchiq_arm-Register-vcsm-cma-as-a-platform-dr.patch
@@ -22,7 +22,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  
  struct vchiq_drvdata {
  	const unsigned int cache_line_size;
-@@ -1838,6 +1839,7 @@ static int vchiq_probe(struct platform_d
+@@ -1824,6 +1825,7 @@ static int vchiq_probe(struct platform_d
  		goto error_exit;
  	}
  
@@ -30,7 +30,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  	bcm2835_camera = vchiq_register_child(pdev, "bcm2835-camera");
  	bcm2835_audio = vchiq_register_child(pdev, "bcm2835_audio");
  
-@@ -1853,6 +1855,7 @@ static void vchiq_remove(struct platform
+@@ -1839,6 +1841,7 @@ static void vchiq_remove(struct platform
  {
  	platform_device_unregister(bcm2835_audio);
  	platform_device_unregister(bcm2835_camera);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0185-staging-vchiq_arm-Register-bcm2835-codec-as-a-platfo.patch b/target/linux/bcm27xx/patches-6.6/950-0185-staging-vchiq_arm-Register-bcm2835-codec-as-a-platfo.patch
index ab4fb514d6dd28..5adc8c75afe0d0 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0185-staging-vchiq_arm-Register-bcm2835-codec-as-a-platfo.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0185-staging-vchiq_arm-Register-bcm2835-codec-as-a-platfo.patch
@@ -22,7 +22,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  static struct platform_device *vcsm_cma;
  
  struct vchiq_drvdata {
-@@ -1840,6 +1841,7 @@ static int vchiq_probe(struct platform_d
+@@ -1826,6 +1827,7 @@ static int vchiq_probe(struct platform_d
  	}
  
  	vcsm_cma = vchiq_register_child(pdev, "vcsm-cma");
@@ -30,7 +30,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  	bcm2835_camera = vchiq_register_child(pdev, "bcm2835-camera");
  	bcm2835_audio = vchiq_register_child(pdev, "bcm2835_audio");
  
-@@ -1855,6 +1857,7 @@ static void vchiq_remove(struct platform
+@@ -1841,6 +1843,7 @@ static void vchiq_remove(struct platform
  {
  	platform_device_unregister(bcm2835_audio);
  	platform_device_unregister(bcm2835_camera);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0187-v3d_drv-Handle-missing-clock-more-gracefully.patch b/target/linux/bcm27xx/patches-6.6/950-0187-v3d_drv-Handle-missing-clock-more-gracefully.patch
index d8a7c28bd673f1..dc601a66979858 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0187-v3d_drv-Handle-missing-clock-more-gracefully.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0187-v3d_drv-Handle-missing-clock-more-gracefully.patch
@@ -10,7 +10,7 @@ Signed-off-by: popcornmix <popcornmix@gmail.com>
 
 --- a/drivers/gpu/drm/v3d/v3d_drv.c
 +++ b/drivers/gpu/drm/v3d/v3d_drv.c
-@@ -257,10 +257,10 @@ static int v3d_platform_drm_probe(struct
+@@ -267,10 +267,10 @@ static int v3d_platform_drm_probe(struct
  	}
  
  	v3d->clk = devm_clk_get(dev, NULL);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0188-v3d_gem-Kick-the-clock-so-firmware-knows-we-are-usin.patch b/target/linux/bcm27xx/patches-6.6/950-0188-v3d_gem-Kick-the-clock-so-firmware-knows-we-are-usin.patch
index 19c0ddaf3e671e..7850e796fc311d 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0188-v3d_gem-Kick-the-clock-so-firmware-knows-we-are-usin.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0188-v3d_gem-Kick-the-clock-so-firmware-knows-we-are-usin.patch
@@ -14,7 +14,7 @@ Signed-off-by: popcornmix <popcornmix@gmail.com>
 
 --- a/drivers/gpu/drm/v3d/v3d_gem.c
 +++ b/drivers/gpu/drm/v3d/v3d_gem.c
-@@ -1080,6 +1080,10 @@ v3d_gem_init(struct drm_device *dev)
+@@ -1082,6 +1082,10 @@ v3d_gem_init(struct drm_device *dev)
  	mutex_init(&v3d->clk_lock);
  	INIT_DELAYED_WORK(&v3d->clk_down_work, v3d_clock_down_work);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0190-staging-vchiq_arm-Set-up-dma-ranges-on-child-devices.patch b/target/linux/bcm27xx/patches-6.6/950-0190-staging-vchiq_arm-Set-up-dma-ranges-on-child-devices.patch
index b008f909468268..525cb835e68df2 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0190-staging-vchiq_arm-Set-up-dma-ranges-on-child-devices.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0190-staging-vchiq_arm-Set-up-dma-ranges-on-child-devices.patch
@@ -18,7 +18,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
 
 --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
 +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
-@@ -1790,6 +1790,12 @@ vchiq_register_child(struct platform_dev
+@@ -1776,6 +1776,12 @@ vchiq_register_child(struct platform_dev
  		child = NULL;
  	}
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0191-staging-vchiq-Use-the-old-dma-controller-for-OF-conf.patch b/target/linux/bcm27xx/patches-6.6/950-0191-staging-vchiq-Use-the-old-dma-controller-for-OF-conf.patch
index 85d1174a60e553..5613a4100a9a1a 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0191-staging-vchiq-Use-the-old-dma-controller-for-OF-conf.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0191-staging-vchiq-Use-the-old-dma-controller-for-OF-conf.patch
@@ -17,7 +17,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
 
 --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
 +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
-@@ -1776,6 +1776,7 @@ vchiq_register_child(struct platform_dev
+@@ -1762,6 +1762,7 @@ vchiq_register_child(struct platform_dev
  {
  	struct platform_device_info pdevinfo;
  	struct platform_device *child;
@@ -25,7 +25,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
  
  	memset(&pdevinfo, 0, sizeof(pdevinfo));
  
-@@ -1791,10 +1792,20 @@ vchiq_register_child(struct platform_dev
+@@ -1777,10 +1778,20 @@ vchiq_register_child(struct platform_dev
  	}
  
  	/*
diff --git a/target/linux/bcm27xx/patches-6.6/950-0194-staging-vchiq_arm-Give-vchiq-children-DT-nodes.patch b/target/linux/bcm27xx/patches-6.6/950-0194-staging-vchiq_arm-Give-vchiq-children-DT-nodes.patch
index eab0710367f632..a75bd3da561d79 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0194-staging-vchiq_arm-Give-vchiq-children-DT-nodes.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0194-staging-vchiq_arm-Give-vchiq-children-DT-nodes.patch
@@ -16,7 +16,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
 +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
-@@ -1785,12 +1785,20 @@ vchiq_register_child(struct platform_dev
+@@ -1771,12 +1771,20 @@ vchiq_register_child(struct platform_dev
  	pdevinfo.id = PLATFORM_DEVID_NONE;
  	pdevinfo.dma_mask = DMA_BIT_MASK(32);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0204-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch b/target/linux/bcm27xx/patches-6.6/950-0204-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch
index 5398d85ef3e23a..7cbbeebf6de146 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0204-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0204-spi-Force-CS_HIGH-if-GPIO-descriptors-are-used.patch
@@ -32,7 +32,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/drivers/spi/spi.c
 +++ b/drivers/spi/spi.c
-@@ -3740,6 +3740,7 @@ static int spi_set_cs_timing(struct spi_
+@@ -3747,6 +3747,7 @@ static int spi_set_cs_timing(struct spi_
   */
  int spi_setup(struct spi_device *spi)
  {
@@ -40,7 +40,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	unsigned	bad_bits, ugly_bits;
  	int		status = 0;
  
-@@ -3760,6 +3761,14 @@ int spi_setup(struct spi_device *spi)
+@@ -3767,6 +3768,14 @@ int spi_setup(struct spi_device *spi)
  		(SPI_TX_DUAL | SPI_TX_QUAD | SPI_TX_OCTAL |
  		 SPI_RX_DUAL | SPI_RX_QUAD | SPI_RX_OCTAL)))
  		return -EINVAL;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0209-staging-vchiq-Load-bcm2835_isp-driver-from-vchiq.patch b/target/linux/bcm27xx/patches-6.6/950-0209-staging-vchiq-Load-bcm2835_isp-driver-from-vchiq.patch
index a33b39967f857f..5c1b37bfd95102 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0209-staging-vchiq-Load-bcm2835_isp-driver-from-vchiq.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0209-staging-vchiq-Load-bcm2835_isp-driver-from-vchiq.patch
@@ -21,7 +21,7 @@ Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
  
  struct vchiq_drvdata {
  	const unsigned int cache_line_size;
-@@ -1869,6 +1870,7 @@ static int vchiq_probe(struct platform_d
+@@ -1855,6 +1856,7 @@ static int vchiq_probe(struct platform_d
  	bcm2835_codec = vchiq_register_child(pdev, "bcm2835-codec");
  	bcm2835_camera = vchiq_register_child(pdev, "bcm2835-camera");
  	bcm2835_audio = vchiq_register_child(pdev, "bcm2835_audio");
@@ -29,7 +29,7 @@ Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
  
  	return 0;
  
-@@ -1880,6 +1882,7 @@ error_exit:
+@@ -1866,6 +1868,7 @@ error_exit:
  
  static void vchiq_remove(struct platform_device *pdev)
  {
diff --git a/target/linux/bcm27xx/patches-6.6/950-0210-media-i2c-tc358743-Fix-fallthrough-warning.patch b/target/linux/bcm27xx/patches-6.6/950-0210-media-i2c-tc358743-Fix-fallthrough-warning.patch
index 265e0c6cecf0fd..6b0296c5a5139d 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0210-media-i2c-tc358743-Fix-fallthrough-warning.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0210-media-i2c-tc358743-Fix-fallthrough-warning.patch
@@ -10,7 +10,7 @@ Signed-off-by: Jacko Dirks <jdirks.linuxdev@gmail.com>
 
 --- a/drivers/media/i2c/tc358743.c
 +++ b/drivers/media/i2c/tc358743.c
-@@ -1980,6 +1980,7 @@ static int tc358743_probe_of(struct tc35
+@@ -1993,6 +1993,7 @@ static int tc358743_probe_of(struct tc35
  	switch (bps_pr_lane) {
  	default:
  		dev_warn(dev, "untested bps per lane: %u bps\n", bps_pr_lane);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0215-PCI-brcmstb-Add-DT-property-to-control-L1SS.patch b/target/linux/bcm27xx/patches-6.6/950-0215-PCI-brcmstb-Add-DT-property-to-control-L1SS.patch
index f29ecab0712880..c6a5810fade4d2 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0215-PCI-brcmstb-Add-DT-property-to-control-L1SS.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0215-PCI-brcmstb-Add-DT-property-to-control-L1SS.patch
@@ -65,7 +65,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	writel(tmp, base + PCIE_MISC_HARD_PCIE_HARD_DEBUG);
  
  	return 0;
-@@ -1536,6 +1551,7 @@ static int brcm_pcie_probe(struct platfo
+@@ -1537,6 +1552,7 @@ static int brcm_pcie_probe(struct platfo
  	pcie->gen = (ret < 0) ? 0 : ret;
  
  	pcie->ssc = of_property_read_bool(np, "brcm,enable-ssc");
diff --git a/target/linux/bcm27xx/patches-6.6/950-0237-media-i2c-tc358743-Only-allow-supported-pixel-fmts-i.patch b/target/linux/bcm27xx/patches-6.6/950-0237-media-i2c-tc358743-Only-allow-supported-pixel-fmts-i.patch
deleted file mode 100644
index a8c881e732c001..00000000000000
--- a/target/linux/bcm27xx/patches-6.6/950-0237-media-i2c-tc358743-Only-allow-supported-pixel-fmts-i.patch
+++ /dev/null
@@ -1,30 +0,0 @@
-From dd2f62c0c0e9b0d882b50b7a1dbe8da680adb824 Mon Sep 17 00:00:00 2001
-From: Dave Stevenson <dave.stevenson@raspberrypi.com>
-Date: Fri, 10 Jul 2020 12:40:50 +0100
-Subject: [PATCH 0237/1085] media: i2c: tc358743: Only allow supported pixel
- fmts in set_fmt
-
-Fix commit "media: tc358743: Return an appropriate colorspace from
-tc358743_set_fmt" to ensure that the format passed in to set_fmt
-is checked to be valid, and reset to the current format if not.
-
-Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
----
- drivers/media/i2c/tc358743.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
---- a/drivers/media/i2c/tc358743.c
-+++ b/drivers/media/i2c/tc358743.c
-@@ -1708,8 +1708,10 @@ static int tc358743_set_fmt(struct v4l2_
- 	u32 code = format->format.code; /* is overwritten by get_fmt */
- 	int ret = tc358743_get_fmt(sd, sd_state, format);
- 
--	format->format.code = code;
--	format->format.colorspace = tc358743_g_colorspace(code);
-+	if (code == MEDIA_BUS_FMT_RGB888_1X24 ||
-+	    code == MEDIA_BUS_FMT_UYVY8_1X16)
-+		format->format.code = code;
-+	format->format.colorspace = tc358743_g_colorspace(format->format.code);
- 
- 	if (ret)
- 		return ret;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0243-staging-fbtft-Add-support-for-display-variants.patch b/target/linux/bcm27xx/patches-6.6/950-0243-staging-fbtft-Add-support-for-display-variants.patch
index f49c9a2b56a34c..fad8eb5a11c369 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0243-staging-fbtft-Add-support-for-display-variants.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0243-staging-fbtft-Add-support-for-display-variants.patch
@@ -95,7 +95,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  
  #include <video/mipi_display.h>
  
-@@ -1183,6 +1185,7 @@ static struct fbtft_platform_data *fbtft
+@@ -1184,6 +1186,7 @@ static struct fbtft_platform_data *fbtft
   * @display: Display properties
   * @sdev: SPI device
   * @pdev: Platform device
@@ -103,7 +103,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
   *
   * Allocates, initializes and registers a framebuffer
   *
-@@ -1192,12 +1195,15 @@ static struct fbtft_platform_data *fbtft
+@@ -1193,12 +1196,15 @@ static struct fbtft_platform_data *fbtft
   */
  int fbtft_probe_common(struct fbtft_display *display,
  		       struct spi_device *sdev,
@@ -120,7 +120,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	int ret;
  
  	if (sdev)
-@@ -1213,6 +1219,14 @@ int fbtft_probe_common(struct fbtft_disp
+@@ -1214,6 +1220,14 @@ int fbtft_probe_common(struct fbtft_disp
  		pdata = fbtft_properties_read(dev);
  		if (IS_ERR(pdata))
  			return PTR_ERR(pdata);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0260-phy-broadcom-split-out-the-BCM54213PE-from-the-BCM54.patch b/target/linux/bcm27xx/patches-6.6/950-0260-phy-broadcom-split-out-the-BCM54213PE-from-the-BCM54.patch
index 69008c65de0b39..b4133150918860 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0260-phy-broadcom-split-out-the-BCM54213PE-from-the-BCM54.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0260-phy-broadcom-split-out-the-BCM54213PE-from-the-BCM54.patch
@@ -26,7 +26,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
  		return;
  
  	val = bcm_phy_read_shadow(phydev, BCM54XX_SHD_SCR3);
-@@ -1021,7 +1022,7 @@ static struct phy_driver broadcom_driver
+@@ -1019,7 +1020,7 @@ static struct phy_driver broadcom_driver
  	.link_change_notify	= bcm54xx_link_change_notify,
  }, {
  	.phy_id		= PHY_ID_BCM54210E,
@@ -35,7 +35,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
  	.name		= "Broadcom BCM54210E",
  	/* PHY_GBIT_FEATURES */
  	.flags		= PHY_ALWAYS_CALL_SUSPEND,
-@@ -1039,6 +1040,13 @@ static struct phy_driver broadcom_driver
+@@ -1037,6 +1038,13 @@ static struct phy_driver broadcom_driver
  	.set_wol	= bcm54xx_phy_set_wol,
  	.led_brightness_set	= bcm_phy_led_brightness_set,
  }, {
diff --git a/target/linux/bcm27xx/patches-6.6/950-0262-Input-edt-ft5x06-Poll-the-device-if-no-interrupt-is-.patch b/target/linux/bcm27xx/patches-6.6/950-0262-Input-edt-ft5x06-Poll-the-device-if-no-interrupt-is-.patch
index bfb26e8f02850c..9369883fc6084f 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0262-Input-edt-ft5x06-Poll-the-device-if-no-interrupt-is-.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0262-Input-edt-ft5x06-Poll-the-device-if-no-interrupt-is-.patch
@@ -193,7 +193,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  		tsdata->tdata_offset + crclen;
  }
  
-@@ -1317,17 +1374,27 @@ static int edt_ft5x06_ts_probe(struct i2
+@@ -1335,17 +1392,27 @@ static int edt_ft5x06_ts_probe(struct i2
  		return error;
  	}
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0296-media-i2c-ov7251-Add-fwnode-properties-controls.patch b/target/linux/bcm27xx/patches-6.6/950-0296-media-i2c-ov7251-Add-fwnode-properties-controls.patch
index 06d19e63fb7765..b8adfd8a77cb23 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0296-media-i2c-ov7251-Add-fwnode-properties-controls.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0296-media-i2c-ov7251-Add-fwnode-properties-controls.patch
@@ -13,7 +13,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/media/i2c/ov7251.c
 +++ b/drivers/media/i2c/ov7251.c
-@@ -1541,7 +1541,7 @@ static int ov7251_init_ctrls(struct ov72
+@@ -1543,7 +1543,7 @@ static int ov7251_init_ctrls(struct ov72
  	s64 pixel_rate;
  	int hblank;
  
@@ -22,7 +22,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  	ov7251->ctrls.lock = &ov7251->lock;
  
  	v4l2_ctrl_new_std(&ov7251->ctrls, &ov7251_ctrl_ops,
-@@ -1600,6 +1600,7 @@ static int ov7251_init_ctrls(struct ov72
+@@ -1602,6 +1602,7 @@ static int ov7251_init_ctrls(struct ov72
  
  static int ov7251_probe(struct i2c_client *client)
  {
@@ -30,7 +30,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  	struct device *dev = &client->dev;
  	struct ov7251 *ov7251;
  	unsigned int rate = 0, clk_rate = 0;
-@@ -1690,6 +1691,15 @@ static int ov7251_probe(struct i2c_clien
+@@ -1692,6 +1693,15 @@ static int ov7251_probe(struct i2c_clien
  		goto destroy_mutex;
  	}
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0301-drm-panel-simple-Add-a-timing-for-the-Raspberry-Pi-7.patch b/target/linux/bcm27xx/patches-6.6/950-0301-drm-panel-simple-Add-a-timing-for-the-Raspberry-Pi-7.patch
index d5cee828b07630..d838b0f8527259 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0301-drm-panel-simple-Add-a-timing-for-the-Raspberry-Pi-7.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0301-drm-panel-simple-Add-a-timing-for-the-Raspberry-Pi-7.patch
@@ -15,7 +15,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/panel/panel-simple.c
 +++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -3376,6 +3376,31 @@ static const struct panel_desc rocktech_
+@@ -3377,6 +3377,31 @@ static const struct panel_desc rocktech_
  	.connector_type = DRM_MODE_CONNECTOR_DPI,
  };
  
@@ -47,7 +47,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  static const struct display_timing rocktech_rk070er9427_timing = {
  	.pixelclock = { 26400000, 33300000, 46800000 },
  	.hactive = { 800, 800, 800 },
-@@ -4427,6 +4452,9 @@ static const struct of_device_id platfor
+@@ -4453,6 +4478,9 @@ static const struct of_device_id platfor
  		.compatible = "rocktech,rk043fn48h",
  		.data = &rocktech_rk043fn48h,
  	}, {
diff --git a/target/linux/bcm27xx/patches-6.6/950-0302-Input-edt-ft54x6-Clean-up-timer-and-workqueue-on-rem.patch b/target/linux/bcm27xx/patches-6.6/950-0302-Input-edt-ft54x6-Clean-up-timer-and-workqueue-on-rem.patch
index 2b5abd258175b5..3486c2acaacfe0 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0302-Input-edt-ft54x6-Clean-up-timer-and-workqueue-on-rem.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0302-Input-edt-ft54x6-Clean-up-timer-and-workqueue-on-rem.patch
@@ -18,7 +18,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/input/touchscreen/edt-ft5x06.c
 +++ b/drivers/input/touchscreen/edt-ft5x06.c
-@@ -1420,6 +1420,10 @@ static void edt_ft5x06_ts_remove(struct
+@@ -1438,6 +1438,10 @@ static void edt_ft5x06_ts_remove(struct
  {
  	struct edt_ft5x06_ts_data *tsdata = i2c_get_clientdata(client);
  
@@ -27,5 +27,5 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 +		cancel_work_sync(&tsdata->work_i2c_poll);
 +	}
  	edt_ft5x06_ts_teardown_debugfs(tsdata);
- 	regmap_exit(tsdata->regmap);
  }
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-0327-media-i2c-ov7251-Make-the-enable-GPIO-optional.patch b/target/linux/bcm27xx/patches-6.6/950-0327-media-i2c-ov7251-Make-the-enable-GPIO-optional.patch
index c00fc4e09a45cf..abe16c51cc226b 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0327-media-i2c-ov7251-Make-the-enable-GPIO-optional.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0327-media-i2c-ov7251-Make-the-enable-GPIO-optional.patch
@@ -14,13 +14,13 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/media/i2c/ov7251.c
 +++ b/drivers/media/i2c/ov7251.c
-@@ -1676,7 +1676,8 @@ static int ov7251_probe(struct i2c_clien
+@@ -1678,7 +1678,8 @@ static int ov7251_probe(struct i2c_clien
  		return PTR_ERR(ov7251->analog_regulator);
  	}
  
--	ov7251->enable_gpio = devm_gpiod_get(dev, "enable", GPIOD_OUT_HIGH);
+-	ov7251->enable_gpio = devm_gpiod_get(dev, "enable", GPIOD_OUT_LOW);
 +	ov7251->enable_gpio = devm_gpiod_get_optional(dev, "enable",
-+						      GPIOD_OUT_HIGH);
++						      GPIOD_OUT_LOW);
  	if (IS_ERR(ov7251->enable_gpio)) {
  		dev_err(dev, "cannot get enable gpio\n");
  		return PTR_ERR(ov7251->enable_gpio);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0343-drm-panel-simple-add-Geekworm-MZP280-Panel.patch b/target/linux/bcm27xx/patches-6.6/950-0343-drm-panel-simple-add-Geekworm-MZP280-Panel.patch
index d5a071364a0ee7..5019e794e55f30 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0343-drm-panel-simple-add-Geekworm-MZP280-Panel.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0343-drm-panel-simple-add-Geekworm-MZP280-Panel.patch
@@ -13,7 +13,7 @@ Acked-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/panel/panel-simple.c
 +++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -2035,6 +2035,32 @@ static const struct panel_desc friendlya
+@@ -2036,6 +2036,32 @@ static const struct panel_desc friendlya
  	},
  };
  
@@ -46,7 +46,7 @@ Acked-by: Maxime Ripard <maxime@cerno.tech>
  static const struct drm_display_mode giantplus_gpg482739qs5_mode = {
  	.clock = 9000,
  	.hdisplay = 480,
-@@ -4302,6 +4328,9 @@ static const struct of_device_id platfor
+@@ -4328,6 +4354,9 @@ static const struct of_device_id platfor
  		.compatible = "friendlyarm,hd702e",
  		.data = &friendlyarm_hd702e,
  	}, {
diff --git a/target/linux/bcm27xx/patches-6.6/950-0350-media-i2c-ov7251-Reinstate-setting-ov7251_global_ini.patch b/target/linux/bcm27xx/patches-6.6/950-0350-media-i2c-ov7251-Reinstate-setting-ov7251_global_ini.patch
index 50c53c6a719ad1..ca9c0d2c26e44c 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0350-media-i2c-ov7251-Reinstate-setting-ov7251_global_ini.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0350-media-i2c-ov7251-Reinstate-setting-ov7251_global_ini.patch
@@ -15,7 +15,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/media/i2c/ov7251.c
 +++ b/drivers/media/i2c/ov7251.c
-@@ -1344,6 +1344,14 @@ static int ov7251_s_stream(struct v4l2_s
+@@ -1346,6 +1346,14 @@ static int ov7251_s_stream(struct v4l2_s
  		if (ret < 0)
  			goto err_power_down;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0359-mm-page_alloc-cma-introduce-a-customisable-threshold.patch b/target/linux/bcm27xx/patches-6.6/950-0359-mm-page_alloc-cma-introduce-a-customisable-threshold.patch
index 8c39ae9931e8ba..08eb5aa74251a5 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0359-mm-page_alloc-cma-introduce-a-customisable-threshold.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0359-mm-page_alloc-cma-introduce-a-customisable-threshold.patch
@@ -48,7 +48,7 @@ Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
  /*
   * A cached value of the page's pageblock's migratetype, used when the page is
   * put on a pcplist. Used to avoid the pageblock migratetype lookup when
-@@ -2095,12 +2116,13 @@ __rmqueue(struct zone *zone, unsigned in
+@@ -2108,12 +2129,13 @@ __rmqueue(struct zone *zone, unsigned in
  	if (IS_ENABLED(CONFIG_CMA)) {
  		/*
  		 * Balance movable allocations between regular and CMA areas by
diff --git a/target/linux/bcm27xx/patches-6.6/950-0371-hwmon-emc2305-fixups-for-driver-submitted-to-mailing.patch b/target/linux/bcm27xx/patches-6.6/950-0371-hwmon-emc2305-fixups-for-driver-submitted-to-mailing.patch
index 358500854360a2..60f4735d59f1ab 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0371-hwmon-emc2305-fixups-for-driver-submitted-to-mailing.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0371-hwmon-emc2305-fixups-for-driver-submitted-to-mailing.patch
@@ -166,7 +166,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  
  	if (IS_ERR(data->cdev_data[cdev_idx].cdev)) {
  		dev_err(dev, "Failed to register cooling device %s\n", emc2305_fan_name[idx]);
-@@ -350,9 +413,11 @@ static void emc2305_unset_tz(struct devi
+@@ -356,9 +419,11 @@ static void emc2305_unset_tz(struct devi
  	int i;
  
  	/* Unregister cooling device. */
@@ -181,7 +181,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  }
  
  static umode_t
-@@ -574,11 +639,18 @@ static int emc2305_probe(struct i2c_clie
+@@ -580,11 +645,18 @@ static int emc2305_probe(struct i2c_clie
  		data->pwm_separate = pdata->pwm_separate;
  		for (i = 0; i < EMC2305_PWM_MAX; i++)
  			data->pwm_min[i] = pdata->pwm_min[i];
@@ -200,7 +200,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  	}
  
  	data->hwmon_dev = devm_hwmon_device_register_with_info(dev, "emc2305", data,
-@@ -599,6 +671,12 @@ static int emc2305_probe(struct i2c_clie
+@@ -605,6 +677,12 @@ static int emc2305_probe(struct i2c_clie
  			return ret;
  	}
  
@@ -213,7 +213,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  	return 0;
  }
  
-@@ -614,6 +692,7 @@ static struct i2c_driver emc2305_driver
+@@ -620,6 +698,7 @@ static struct i2c_driver emc2305_driver
  	.class  = I2C_CLASS_HWMON,
  	.driver = {
  		.name = "emc2305",
diff --git a/target/linux/bcm27xx/patches-6.6/950-0376-drm-v3d-Switch-clock-setting-to-new-api.patch b/target/linux/bcm27xx/patches-6.6/950-0376-drm-v3d-Switch-clock-setting-to-new-api.patch
index 2670c4e27a2b8a..aa613e73dd5bfb 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0376-drm-v3d-Switch-clock-setting-to-new-api.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0376-drm-v3d-Switch-clock-setting-to-new-api.patch
@@ -34,7 +34,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	struct drm_device *drm;
  	struct v3d_dev *v3d;
  	int ret;
-@@ -262,7 +267,20 @@ static int v3d_platform_drm_probe(struct
+@@ -272,7 +277,20 @@ static int v3d_platform_drm_probe(struct
  			dev_err(dev, "Failed to get clock (%ld)\n", PTR_ERR(v3d->clk));
  		return PTR_ERR(v3d->clk);
  	}
@@ -56,7 +56,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	/* For downclocking, drop it to the minimum frequency we can get from
  	 * the CPRMAN clock generator dividing off our parent.  The divider is
  	 * 4 bits, but ask for just higher than that so that rounding doesn't
-@@ -296,7 +314,7 @@ static int v3d_platform_drm_probe(struct
+@@ -307,7 +325,7 @@ static int v3d_platform_drm_probe(struct
  	if (ret)
  		goto irq_disable;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0382-Populate-phy-driver-block-for-BCM54213PE.patch b/target/linux/bcm27xx/patches-6.6/950-0382-Populate-phy-driver-block-for-BCM54213PE.patch
index 218743e942ceed..e74d2d361d547f 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0382-Populate-phy-driver-block-for-BCM54213PE.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0382-Populate-phy-driver-block-for-BCM54213PE.patch
@@ -16,7 +16,7 @@ Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com>
 
 --- a/drivers/net/phy/broadcom.c
 +++ b/drivers/net/phy/broadcom.c
-@@ -1052,8 +1052,14 @@ static struct phy_driver broadcom_driver
+@@ -1050,8 +1050,14 @@ static struct phy_driver broadcom_driver
  	.phy_id_mask	= 0xffffffff,
  	.name		= "Broadcom BCM54213PE",
  	/* PHY_GBIT_FEATURES */
diff --git a/target/linux/bcm27xx/patches-6.6/950-0395-media-adv7180-Nasty-hack-to-allow-input-selection.patch b/target/linux/bcm27xx/patches-6.6/950-0395-media-adv7180-Nasty-hack-to-allow-input-selection.patch
index 75c37d357db045..22168e3c4e7345 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0395-media-adv7180-Nasty-hack-to-allow-input-selection.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0395-media-adv7180-Nasty-hack-to-allow-input-selection.patch
@@ -31,7 +31,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
  struct adv7180_state;
  
  #define ADV7180_FLAG_RESET_POWERED	BIT(0)
-@@ -406,10 +410,24 @@ out:
+@@ -407,10 +411,24 @@ out:
  	return ret;
  }
  
@@ -57,7 +57,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
  	if (ret)
  		return ret;
  
-@@ -435,7 +453,11 @@ static int adv7180_program_std(struct ad
+@@ -436,7 +454,11 @@ static int adv7180_program_std(struct ad
  static int adv7180_s_std(struct v4l2_subdev *sd, v4l2_std_id std)
  {
  	struct adv7180_state *state = to_state(sd);
@@ -70,7 +70,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
  
  	if (ret)
  		return ret;
-@@ -457,6 +479,8 @@ static int adv7180_g_std(struct v4l2_sub
+@@ -458,6 +480,8 @@ static int adv7180_g_std(struct v4l2_sub
  {
  	struct adv7180_state *state = to_state(sd);
  
@@ -79,7 +79,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.org>
  	*norm = state->curr_norm;
  
  	return 0;
-@@ -886,6 +910,8 @@ static int adv7180_s_stream(struct v4l2_
+@@ -891,6 +915,8 @@ static int adv7180_s_stream(struct v4l2_
  		return 0;
  	}
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0396-media-i2c-ov7251-Add-module-param-to-select-ext-trig.patch b/target/linux/bcm27xx/patches-6.6/950-0396-media-i2c-ov7251-Add-module-param-to-select-ext-trig.patch
index 09af88873c51d6..7bcd8e41ca789d 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0396-media-i2c-ov7251-Add-module-param-to-select-ext-trig.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0396-media-i2c-ov7251-Add-module-param-to-select-ext-trig.patch
@@ -62,7 +62,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  static const unsigned long supported_xclk_rates[] = {
  	[OV7251_19_2_MHZ] = 19200000,
  	[OV7251_24_MHZ] = 24000000,
-@@ -1372,6 +1384,23 @@ static int ov7251_s_stream(struct v4l2_s
+@@ -1374,6 +1386,23 @@ static int ov7251_s_stream(struct v4l2_s
  			dev_err(ov7251->dev, "could not sync v4l2 controls\n");
  			goto err_power_down;
  		}
diff --git a/target/linux/bcm27xx/patches-6.6/950-0401-drm-panel-simple-Add-Innolux-AT056tN53V1-5.6-VGA.patch b/target/linux/bcm27xx/patches-6.6/950-0401-drm-panel-simple-Add-Innolux-AT056tN53V1-5.6-VGA.patch
index d8376a3fe598cc..3ca1f8c520f457 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0401-drm-panel-simple-Add-Innolux-AT056tN53V1-5.6-VGA.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0401-drm-panel-simple-Add-Innolux-AT056tN53V1-5.6-VGA.patch
@@ -126,7 +126,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
        - MEDIA_BUS_FMT_RGB666_1X24_CPADHI
 --- a/drivers/gpu/drm/panel/panel-simple.c
 +++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -2241,6 +2241,38 @@ static const struct panel_desc innolux_a
+@@ -2242,6 +2242,38 @@ static const struct panel_desc innolux_a
  	.bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE,
  };
  
@@ -165,7 +165,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  static const struct drm_display_mode innolux_at070tn92_mode = {
  	.clock = 33333,
  	.hdisplay = 800,
-@@ -4352,6 +4384,9 @@ static const struct of_device_id platfor
+@@ -4378,6 +4410,9 @@ static const struct of_device_id platfor
  		.compatible = "innolux,at043tn24",
  		.data = &innolux_at043tn24,
  	}, {
diff --git a/target/linux/bcm27xx/patches-6.6/950-0407-dtbindings-media-i2c-Add-IMX708-CMOS-sensor-binding.patch b/target/linux/bcm27xx/patches-6.6/950-0407-dtbindings-media-i2c-Add-IMX708-CMOS-sensor-binding.patch
index 06d744a82b5d55..5962bb3fbb9046 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0407-dtbindings-media-i2c-Add-IMX708-CMOS-sensor-binding.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0407-dtbindings-media-i2c-Add-IMX708-CMOS-sensor-binding.patch
@@ -138,7 +138,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 +...
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -20106,6 +20106,14 @@ T:	git git://linuxtv.org/media_tree.git
+@@ -20107,6 +20107,14 @@ T:	git git://linuxtv.org/media_tree.git
  F:	Documentation/devicetree/bindings/media/i2c/imx519.yaml
  F:	drivers/media/i2c/imx519.c
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0416-gpio-pca953x-Add-ti-tca9554-compatible-string.patch b/target/linux/bcm27xx/patches-6.6/950-0416-gpio-pca953x-Add-ti-tca9554-compatible-string.patch
index aa11729b717915..9f1ac40c21741e 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0416-gpio-pca953x-Add-ti-tca9554-compatible-string.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0416-gpio-pca953x-Add-ti-tca9554-compatible-string.patch
@@ -10,7 +10,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/drivers/gpio/gpio-pca953x.c
 +++ b/drivers/gpio/gpio-pca953x.c
-@@ -1347,6 +1347,7 @@ static const struct of_device_id pca953x
+@@ -1312,6 +1312,7 @@ static const struct of_device_id pca953x
  	{ .compatible = "ti,tca6424", .data = OF_953X(24, PCA_INT), },
  	{ .compatible = "ti,tca9538", .data = OF_953X( 8, PCA_INT), },
  	{ .compatible = "ti,tca9539", .data = OF_953X(16, PCA_INT), },
diff --git a/target/linux/bcm27xx/patches-6.6/950-0423-media-i2c-imx219-Correct-the-minimum-vblanking-value.patch b/target/linux/bcm27xx/patches-6.6/950-0423-media-i2c-imx219-Correct-the-minimum-vblanking-value.patch
deleted file mode 100644
index ab2e9dda8c6f51..00000000000000
--- a/target/linux/bcm27xx/patches-6.6/950-0423-media-i2c-imx219-Correct-the-minimum-vblanking-value.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 4b249d9f2436af70ed9a8c2a34be0786f3fe026c Mon Sep 17 00:00:00 2001
-From: David Plowman <david.plowman@raspberrypi.com>
-Date: Tue, 25 Jan 2022 15:48:53 +0000
-Subject: [PATCH 0423/1085] media: i2c: imx219: Correct the minimum vblanking
- value
-
-The datasheet for this sensor documents the minimum vblanking as being
-32 lines. It does fix some problems with occasional black lines at the
-bottom of images (tested on Raspberry Pi).
-
-Signed-off-by: David Plowman <david.plowman@raspberrypi.com>
----
- drivers/media/i2c/imx219.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/media/i2c/imx219.c
-+++ b/drivers/media/i2c/imx219.c
-@@ -77,7 +77,7 @@
- #define IMX219_VTS_30FPS_640x480	0x06e3
- #define IMX219_VTS_MAX			0xffff
- 
--#define IMX219_VBLANK_MIN		4
-+#define IMX219_VBLANK_MIN		32
- 
- /*Frame Length Line*/
- #define IMX219_FLL_MIN			0x08a6
diff --git a/target/linux/bcm27xx/patches-6.6/950-0434-dt-bindings-media-i2c-Replace-IMX708-sensor-binding-.patch b/target/linux/bcm27xx/patches-6.6/950-0434-dt-bindings-media-i2c-Replace-IMX708-sensor-binding-.patch
index a01247a1c3505d..5c8457c8690b4a 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0434-dt-bindings-media-i2c-Replace-IMX708-sensor-binding-.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0434-dt-bindings-media-i2c-Replace-IMX708-sensor-binding-.patch
@@ -271,7 +271,7 @@ Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
 +...
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -20111,7 +20111,7 @@ M:	Raspberry Pi Kernel Maintenance <kern
+@@ -20112,7 +20112,7 @@ M:	Raspberry Pi Kernel Maintenance <kern
  L:	linux-media@vger.kernel.org
  S:	Maintained
  T:	git git://linuxtv.org/media_tree.git
diff --git a/target/linux/bcm27xx/patches-6.6/950-0441-Bluetooth-hci_sync-Add-fallback-bd-address-prop.patch b/target/linux/bcm27xx/patches-6.6/950-0441-Bluetooth-hci_sync-Add-fallback-bd-address-prop.patch
index 0e404906be64a7..27acfe21b7e686 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0441-Bluetooth-hci_sync-Add-fallback-bd-address-prop.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0441-Bluetooth-hci_sync-Add-fallback-bd-address-prop.patch
@@ -20,7 +20,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/net/bluetooth/hci_sync.c
 +++ b/net/bluetooth/hci_sync.c
-@@ -4861,6 +4861,7 @@ static const struct {
+@@ -4927,6 +4927,7 @@ static const struct {
   */
  static int hci_dev_setup_sync(struct hci_dev *hdev)
  {
@@ -28,7 +28,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	int ret = 0;
  	bool invalid_bdaddr;
  	size_t i;
-@@ -4889,7 +4890,8 @@ static int hci_dev_setup_sync(struct hci
+@@ -4955,7 +4956,8 @@ static int hci_dev_setup_sync(struct hci
  			 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
  	if (!ret) {
  		if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks) &&
diff --git a/target/linux/bcm27xx/patches-6.6/950-0460-dt-bindings-media-imx258-Rename-to-include-vendor-pr.patch b/target/linux/bcm27xx/patches-6.6/950-0460-dt-bindings-media-imx258-Rename-to-include-vendor-pr.patch
index b9793de4370c9c..9a10fe73151c7e 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0460-dt-bindings-media-imx258-Rename-to-include-vendor-pr.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0460-dt-bindings-media-imx258-Rename-to-include-vendor-pr.patch
@@ -291,7 +291,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 +    };
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -20012,7 +20012,7 @@ M:	Sakari Ailus <sakari.ailus@linux.inte
+@@ -20013,7 +20013,7 @@ M:	Sakari Ailus <sakari.ailus@linux.inte
  L:	linux-media@vger.kernel.org
  S:	Maintained
  T:	git git://linuxtv.org/media_tree.git
diff --git a/target/linux/bcm27xx/patches-6.6/950-0464-drm-v3d-New-debugfs-end-points-to-query-GPU-usage-st.patch b/target/linux/bcm27xx/patches-6.6/950-0464-drm-v3d-New-debugfs-end-points-to-query-GPU-usage-st.patch
index aef90564b8f391..edf49764b7193c 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0464-drm-v3d-New-debugfs-end-points-to-query-GPU-usage-st.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0464-drm-v3d-New-debugfs-end-points-to-query-GPU-usage-st.patch
@@ -201,7 +201,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  /* Performance monitor object. The perform lifetime is controlled by userspace
   * using perfmon related ioctls. A perfmon can be attached to a submit_cl
   * request, and when this is the case, HW perf counters will be activated just
-@@ -147,6 +198,8 @@ struct v3d_dev {
+@@ -155,6 +206,8 @@ struct v3d_dev {
  		u32 num_allocated;
  		u32 pages_allocated;
  	} bo_stats;
@@ -210,7 +210,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  };
  
  static inline struct v3d_dev *
-@@ -244,6 +297,11 @@ struct v3d_job {
+@@ -252,6 +305,11 @@ struct v3d_job {
  	 */
  	struct v3d_perfmon *perfmon;
  
@@ -222,7 +222,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  	/* Callback for the freeing of the job on refcount going to 0. */
  	void (*free)(struct kref *ref);
  };
-@@ -408,6 +466,7 @@ void v3d_mmu_remove_ptes(struct v3d_bo *
+@@ -416,6 +474,7 @@ void v3d_mmu_remove_ptes(struct v3d_bo *
  /* v3d_sched.c */
  int v3d_sched_init(struct v3d_dev *v3d);
  void v3d_sched_fini(struct v3d_dev *v3d);
@@ -232,7 +232,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  void v3d_perfmon_get(struct v3d_perfmon *perfmon);
 --- a/drivers/gpu/drm/v3d/v3d_gem.c
 +++ b/drivers/gpu/drm/v3d/v3d_gem.c
-@@ -460,6 +460,7 @@ v3d_job_init(struct v3d_dev *v3d, struct
+@@ -462,6 +462,7 @@ v3d_job_init(struct v3d_dev *v3d, struct
  	job = *container;
  	job->v3d = v3d;
  	job->free = free;
@@ -257,31 +257,31 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
 +		v3d->gpu_queue_stats[V3D_BIN].last_exec_end = local_clock();
  
  		trace_v3d_bcl_irq(&v3d->drm, fence->seqno);
- 		dma_fence_signal(&fence->base);
-@@ -109,6 +111,7 @@ v3d_irq(int irq, void *arg)
+ 
+@@ -112,6 +114,7 @@ v3d_irq(int irq, void *arg)
  	if (intsts & V3D_INT_FRDONE) {
  		struct v3d_fence *fence =
  			to_v3d_fence(v3d->render_job->base.irq_fence);
 +		v3d->gpu_queue_stats[V3D_RENDER].last_exec_end = local_clock();
  
  		trace_v3d_rcl_irq(&v3d->drm, fence->seqno);
- 		dma_fence_signal(&fence->base);
-@@ -118,6 +121,7 @@ v3d_irq(int irq, void *arg)
+ 
+@@ -124,6 +127,7 @@ v3d_irq(int irq, void *arg)
  	if (intsts & V3D_INT_CSDDONE) {
  		struct v3d_fence *fence =
  			to_v3d_fence(v3d->csd_job->base.irq_fence);
 +		v3d->gpu_queue_stats[V3D_CSD].last_exec_end = local_clock();
  
  		trace_v3d_csd_irq(&v3d->drm, fence->seqno);
- 		dma_fence_signal(&fence->base);
-@@ -154,6 +158,7 @@ v3d_hub_irq(int irq, void *arg)
+ 
+@@ -163,6 +167,7 @@ v3d_hub_irq(int irq, void *arg)
  	if (intsts & V3D_HUB_INT_TFUC) {
  		struct v3d_fence *fence =
  			to_v3d_fence(v3d->tfu_job->base.irq_fence);
 +		v3d->gpu_queue_stats[V3D_TFU].last_exec_end = local_clock();
  
  		trace_v3d_tfu_irq(&v3d->drm, fence->seqno);
- 		dma_fence_signal(&fence->base);
+ 
 --- a/drivers/gpu/drm/v3d/v3d_sched.c
 +++ b/drivers/gpu/drm/v3d/v3d_sched.c
 @@ -19,6 +19,7 @@
@@ -423,7 +423,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  	v3d_switch_perfmon(v3d, &job->base);
  
  	/* XXX: Set the QCFG */
-@@ -190,6 +301,7 @@ v3d_tfu_job_run(struct drm_sched_job *sc
+@@ -194,6 +305,7 @@ v3d_tfu_job_run(struct drm_sched_job *sc
  
  	trace_v3d_submit_tfu(dev, to_v3d_fence(fence)->seqno);
  
@@ -431,7 +431,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  	V3D_WRITE(V3D_TFU_IIA, job->args.iia);
  	V3D_WRITE(V3D_TFU_IIS, job->args.iis);
  	V3D_WRITE(V3D_TFU_ICA, job->args.ica);
-@@ -231,6 +343,7 @@ v3d_csd_job_run(struct drm_sched_job *sc
+@@ -238,6 +350,7 @@ v3d_csd_job_run(struct drm_sched_job *sc
  
  	trace_v3d_submit_csd(dev, to_v3d_fence(fence)->seqno);
  
@@ -439,7 +439,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  	v3d_switch_perfmon(v3d, &job->base);
  
  	for (i = 1; i <= 6; i++)
-@@ -247,7 +360,10 @@ v3d_cache_clean_job_run(struct drm_sched
+@@ -254,7 +367,10 @@ v3d_cache_clean_job_run(struct drm_sched
  	struct v3d_job *job = to_v3d_job(sched_job);
  	struct v3d_dev *v3d = job->v3d;
  
@@ -450,7 +450,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  
  	return NULL;
  }
-@@ -385,8 +501,18 @@ v3d_sched_init(struct v3d_dev *v3d)
+@@ -406,8 +522,18 @@ v3d_sched_init(struct v3d_dev *v3d)
  	int hw_jobs_limit = 1;
  	int job_hang_limit = 0;
  	int hang_limit_ms = 500;
@@ -469,7 +469,7 @@ Signed-off-by: Jose Maria Casanova Crespo <jmcasanova@igalia.com>
  	ret = drm_sched_init(&v3d->queue[V3D_BIN].sched,
  			     &v3d_bin_sched_ops,
  			     hw_jobs_limit, job_hang_limit,
-@@ -440,9 +566,20 @@ void
+@@ -461,9 +587,20 @@ void
  v3d_sched_fini(struct v3d_dev *v3d)
  {
  	enum v3d_queue q;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0466-mmc-bcm2835-Use-phys-addresses-for-slave-DMA-config.patch b/target/linux/bcm27xx/patches-6.6/950-0466-mmc-bcm2835-Use-phys-addresses-for-slave-DMA-config.patch
index 96bbaf1ffaeae8..48a592e35c87c2 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0466-mmc-bcm2835-Use-phys-addresses-for-slave-DMA-config.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0466-mmc-bcm2835-Use-phys-addresses-for-slave-DMA-config.patch
@@ -23,7 +23,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  #include <linux/of_irq.h>
  #include <linux/platform_device.h>
  #include <linux/scatterlist.h>
-@@ -1347,8 +1346,8 @@ static int bcm2835_probe(struct platform
+@@ -1348,8 +1347,8 @@ static int bcm2835_probe(struct platform
  	struct device *dev = &pdev->dev;
  	struct clk *clk;
  	struct bcm2835_host *host;
@@ -33,7 +33,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	int ret;
  
  	dev_dbg(dev, "%s\n", __func__);
-@@ -1361,23 +1360,13 @@ static int bcm2835_probe(struct platform
+@@ -1362,23 +1361,13 @@ static int bcm2835_probe(struct platform
  	host->pdev = pdev;
  	spin_lock_init(&host->lock);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0468-drm-vc4-hdmi-Increase-MAI-fifo-dreq-threshold.patch b/target/linux/bcm27xx/patches-6.6/950-0468-drm-vc4-hdmi-Increase-MAI-fifo-dreq-threshold.patch
index a0c1eba931041b..f43df7ca3f7176 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0468-drm-vc4-hdmi-Increase-MAI-fifo-dreq-threshold.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0468-drm-vc4-hdmi-Increase-MAI-fifo-dreq-threshold.patch
@@ -16,7 +16,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_hdmi.c
 +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
-@@ -2527,6 +2527,7 @@ static int vc4_hdmi_audio_prepare(struct
+@@ -2531,6 +2531,7 @@ static int vc4_hdmi_audio_prepare(struct
  {
  	struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev);
  	struct drm_device *drm = vc4_hdmi->connector.dev;
@@ -24,7 +24,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
  	struct drm_encoder *encoder = &vc4_hdmi->encoder.base;
  	unsigned int sample_rate = params->sample_rate;
  	unsigned int channels = params->channels;
-@@ -2585,11 +2586,18 @@ static int vc4_hdmi_audio_prepare(struct
+@@ -2589,11 +2590,18 @@ static int vc4_hdmi_audio_prepare(struct
  					     VC4_HDMI_AUDIO_PACKET_CEA_MASK);
  
  	/* Set the MAI threshold */
diff --git a/target/linux/bcm27xx/patches-6.6/950-0472-pps-Compatibility-hack-should-be-X86-specific.patch b/target/linux/bcm27xx/patches-6.6/950-0472-pps-Compatibility-hack-should-be-X86-specific.patch
index 4cc2e594ba2cd2..04a2da5b419673 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0472-pps-Compatibility-hack-should-be-X86-specific.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0472-pps-Compatibility-hack-should-be-X86-specific.patch
@@ -22,7 +22,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/drivers/pps/pps.c
 +++ b/drivers/pps/pps.c
-@@ -249,12 +249,13 @@ static long pps_cdev_ioctl(struct file *
+@@ -254,12 +254,13 @@ static long pps_cdev_ioctl(struct file *
  static long pps_cdev_compat_ioctl(struct file *file,
  		unsigned int cmd, unsigned long arg)
  {
@@ -38,7 +38,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  		struct pps_fdata_compat compat;
  		struct pps_fdata fdata;
  		int err;
-@@ -289,6 +290,7 @@ static long pps_cdev_compat_ioctl(struct
+@@ -296,6 +297,7 @@ static long pps_cdev_compat_ioctl(struct
  		return copy_to_user(uarg, &compat,
  				sizeof(struct pps_fdata_compat)) ? -EFAULT : 0;
  	}
diff --git a/target/linux/bcm27xx/patches-6.6/950-0475-serial-sc16is7xx-Read-modem-line-state-at-startup.patch b/target/linux/bcm27xx/patches-6.6/950-0475-serial-sc16is7xx-Read-modem-line-state-at-startup.patch
index 08c1bd17ce7293..0149501e777b1c 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0475-serial-sc16is7xx-Read-modem-line-state-at-startup.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0475-serial-sc16is7xx-Read-modem-line-state-at-startup.patch
@@ -16,7 +16,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/drivers/tty/serial/sc16is7xx.c
 +++ b/drivers/tty/serial/sc16is7xx.c
-@@ -1206,6 +1206,9 @@ static int sc16is7xx_startup(struct uart
+@@ -1210,6 +1210,9 @@ static int sc16is7xx_startup(struct uart
  	      SC16IS7XX_IER_MSI_BIT;
  	sc16is7xx_port_write(port, SC16IS7XX_IER_REG, val);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0481-xhci-Use-more-event-ring-segment-table-entries.patch b/target/linux/bcm27xx/patches-6.6/950-0481-xhci-Use-more-event-ring-segment-table-entries.patch
deleted file mode 100644
index 27a43828dd4698..00000000000000
--- a/target/linux/bcm27xx/patches-6.6/950-0481-xhci-Use-more-event-ring-segment-table-entries.patch
+++ /dev/null
@@ -1,66 +0,0 @@
-From d631e7354399aa2fb6079b72f515acd6d080c203 Mon Sep 17 00:00:00 2001
-From: Jonathan Bell <jonathan@raspberrypi.com>
-Date: Thu, 13 Jul 2023 14:43:21 +0100
-Subject: [PATCH 0481/1085] xhci: Use more event ring segment table entries
-
-Users have reported log spam created by "Event Ring Full" xHC event
-TRBs. These are caused by interrupt latency in conjunction with a very
-busy set of devices on the bus. The errors are benign, but throughput
-will suffer as the xHC will pause processing of transfers until the
-event ring is drained by the kernel. Expand the number of event TRB slots
-available by increasing the number of event ring segments in the ERST.
-
-Controllers have a hardware-defined limit as to the number of ERST
-entries they can process, so make the actual number in use
-min(ERST_MAX_SEGS, hw_max).
-
-Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
----
- drivers/usb/host/xhci-mem.c | 9 +++++++--
- drivers/usb/host/xhci.h     | 5 +++--
- 2 files changed, 10 insertions(+), 4 deletions(-)
-
---- a/drivers/usb/host/xhci-mem.c
-+++ b/drivers/usb/host/xhci-mem.c
-@@ -2241,12 +2241,17 @@ xhci_alloc_interrupter(struct xhci_hcd *
- 	struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
- 	struct xhci_interrupter *ir;
- 	int ret;
-+	unsigned int nr_event_segs;
- 
- 	ir = kzalloc_node(sizeof(*ir), flags, dev_to_node(dev));
- 	if (!ir)
- 		return NULL;
- 
--	ir->event_ring = xhci_ring_alloc(xhci, ERST_NUM_SEGS, 1, TYPE_EVENT,
-+	nr_event_segs = min_t(unsigned int,
-+			      1 << HCS_ERST_MAX(xhci->hcs_params2),
-+			      ERST_MAX_SEGS);
-+
-+	ir->event_ring = xhci_ring_alloc(xhci, nr_event_segs, 1, TYPE_EVENT,
- 					0, flags);
- 	if (!ir->event_ring) {
- 		xhci_warn(xhci, "Failed to allocate interrupter event ring\n");
-@@ -2283,7 +2288,7 @@ xhci_add_interrupter(struct xhci_hcd *xh
- 	/* set ERST count with the number of entries in the segment table */
- 	erst_size = readl(&ir->ir_set->erst_size);
- 	erst_size &= ERST_SIZE_MASK;
--	erst_size |= ERST_NUM_SEGS;
-+	erst_size |= ir->event_ring->num_segs;
- 	writel(erst_size, &ir->ir_set->erst_size);
- 
- 	erst_base = xhci_read_64(xhci, &ir->ir_set->erst_base);
---- a/drivers/usb/host/xhci.h
-+++ b/drivers/usb/host/xhci.h
-@@ -1681,8 +1681,9 @@ struct urb_priv {
-  * Each segment table entry is 4*32bits long.  1K seems like an ok size:
-  * (1K bytes * 8bytes/bit) / (4*32 bits) = 64 segment entries in the table,
-  * meaning 64 ring segments.
-- * Initial allocated size of the ERST, in number of entries */
--#define	ERST_NUM_SEGS	1
-+ */
-+/* Maximum number of segments in the ERST */
-+#define	ERST_MAX_SEGS	8
- /* Poll every 60 seconds */
- #define	POLL_TIMEOUT	60
- /* Stop endpoint command timeout (secs) for URB cancellation watchdog timer */
diff --git a/target/linux/bcm27xx/patches-6.6/950-0482-xhci-quirks-add-link-TRB-quirk-for-VL805.patch b/target/linux/bcm27xx/patches-6.6/950-0482-xhci-quirks-add-link-TRB-quirk-for-VL805.patch
index ca49ada4e79107..727f2996155853 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0482-xhci-quirks-add-link-TRB-quirk-for-VL805.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0482-xhci-quirks-add-link-TRB-quirk-for-VL805.patch
@@ -24,9 +24,9 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/usb/host/xhci-pci.c
 +++ b/drivers/usb/host/xhci-pci.c
-@@ -493,6 +493,7 @@ static void xhci_pci_quirks(struct devic
- 	if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == 0x3483) {
+@@ -511,6 +511,7 @@ static void xhci_pci_quirks(struct devic
  		xhci->quirks |= XHCI_LPM_SUPPORT;
+ 		xhci->quirks |= XHCI_TRB_OVERFETCH;
  		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
 +		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
  	}
@@ -34,7 +34,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
 --- a/drivers/usb/host/xhci-ring.c
 +++ b/drivers/usb/host/xhci-ring.c
-@@ -728,6 +728,15 @@ static int xhci_move_dequeue_past_td(str
+@@ -730,6 +730,15 @@ static int xhci_move_dequeue_past_td(str
  	} while (!cycle_found || !td_last_trb_found);
  
  deq_found:
@@ -52,9 +52,9 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	addr = xhci_trb_virt_to_dma(new_seg, new_deq);
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1918,6 +1918,9 @@ struct xhci_hcd {
- #define XHCI_WRITE_64_HI_LO	BIT_ULL(47)
- #define XHCI_CDNS_SCTX_QUIRK	BIT_ULL(48)
+@@ -1661,6 +1661,9 @@ struct xhci_hcd {
+ #define XHCI_ETRON_HOST	BIT_ULL(49)
+ #define XHCI_LIMIT_ENDPOINT_INTERVAL_9 BIT_ULL(50)
  
 +/* Downstream VLI fixes */
 +#define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(56)
diff --git a/target/linux/bcm27xx/patches-6.6/950-0483-usb-xhci-borrow-upstream-TRB_FETCH-quirk-on-VL805-ho.patch b/target/linux/bcm27xx/patches-6.6/950-0483-usb-xhci-borrow-upstream-TRB_FETCH-quirk-on-VL805-ho.patch
deleted file mode 100644
index e76a413d67f09d..00000000000000
--- a/target/linux/bcm27xx/patches-6.6/950-0483-usb-xhci-borrow-upstream-TRB_FETCH-quirk-on-VL805-ho.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From bab2f1e4e90675af7ea6b48b5c28eb94e22cecd7 Mon Sep 17 00:00:00 2001
-From: Jonathan Bell <jonathan@raspberrypi.com>
-Date: Thu, 13 Jul 2023 15:06:54 +0100
-Subject: [PATCH 0483/1085] usb: xhci: borrow upstream TRB_FETCH quirk on VL805
- hosts
-
-This reimplements 5a57342 usb: xhci: add VLI_TRB_CACHE_BUG quirk
-
-The downstream implementation required a fair bit of driver surgery to
-allow for truncated ring segments, which needed to shrink by a small
-amount to avoid the cache prefetcher from reading off the end of one
-segment and into another.
-
-An upstream implementation for a similar bug on a different controller
-just doubles the size of the memory allocated for ring segments, which
-is a bit more wasteful (+4K per allocation) but means less code churn.
-
-Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
----
- drivers/usb/host/xhci-pci.c | 1 +
- 1 file changed, 1 insertion(+)
-
---- a/drivers/usb/host/xhci-pci.c
-+++ b/drivers/usb/host/xhci-pci.c
-@@ -494,6 +494,7 @@ static void xhci_pci_quirks(struct devic
- 		xhci->quirks |= XHCI_LPM_SUPPORT;
- 		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
- 		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
-+		xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH;
- 	}
- 
- 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
diff --git a/target/linux/bcm27xx/patches-6.6/950-0484-usb-xhci-add-VLI_SS_BULK_OUT_BUG-quirk.patch b/target/linux/bcm27xx/patches-6.6/950-0484-usb-xhci-add-VLI_SS_BULK_OUT_BUG-quirk.patch
index a7d255db40adf8..f807be77eb8c88 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0484-usb-xhci-add-VLI_SS_BULK_OUT_BUG-quirk.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0484-usb-xhci-add-VLI_SS_BULK_OUT_BUG-quirk.patch
@@ -34,7 +34,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/usb/host/xhci-mem.c
 +++ b/drivers/usb/host/xhci-mem.c
-@@ -1400,6 +1400,7 @@ int xhci_endpoint_init(struct xhci_hcd *
+@@ -1407,6 +1407,7 @@ int xhci_endpoint_init(struct xhci_hcd *
  	unsigned int ep_index;
  	struct xhci_ep_ctx *ep_ctx;
  	struct xhci_ring *ep_ring;
@@ -42,7 +42,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	unsigned int max_packet;
  	enum xhci_ring_type ring_type;
  	u32 max_esit_payload;
-@@ -1409,6 +1410,8 @@ int xhci_endpoint_init(struct xhci_hcd *
+@@ -1416,6 +1417,8 @@ int xhci_endpoint_init(struct xhci_hcd *
  	unsigned int mult;
  	unsigned int avg_trb_len;
  	unsigned int err_count = 0;
@@ -51,7 +51,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  
  	ep_index = xhci_get_endpoint_index(&ep->desc);
  	ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index);
-@@ -1440,9 +1443,35 @@ int xhci_endpoint_init(struct xhci_hcd *
+@@ -1451,9 +1454,35 @@ int xhci_endpoint_init(struct xhci_hcd *
  
  	mult = xhci_get_endpoint_mult(udev, ep);
  	max_packet = usb_endpoint_maxp(&ep->desc);
@@ -90,17 +90,17 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	/* Allow 3 retries for everything but isoc, set CErr = 3 */
 --- a/drivers/usb/host/xhci-pci.c
 +++ b/drivers/usb/host/xhci-pci.c
-@@ -495,6 +495,7 @@ static void xhci_pci_quirks(struct devic
+@@ -512,6 +512,7 @@ static void xhci_pci_quirks(struct devic
+ 		xhci->quirks |= XHCI_TRB_OVERFETCH;
  		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
  		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
- 		xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH;
 +		xhci->quirks |= XHCI_VLI_SS_BULK_OUT_BUG;
  	}
  
  	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1920,6 +1920,7 @@ struct xhci_hcd {
+@@ -1663,6 +1663,7 @@ struct xhci_hcd {
  
  /* Downstream VLI fixes */
  #define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(56)
diff --git a/target/linux/bcm27xx/patches-6.6/950-0485-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch b/target/linux/bcm27xx/patches-6.6/950-0485-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch
index 935ed89c08faea..5bc3e8fda8641c 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0485-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0485-usb-xhci-add-XHCI_VLI_HUB_TT_QUIRK.patch
@@ -45,9 +45,9 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 +#define VL805_FW_VER_0138C0	0x0138C0
 +
  /* Device for a quirk */
- #define PCI_VENDOR_ID_FRESCO_LOGIC	0x1b73
- #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK	0x1000
-@@ -295,6 +297,16 @@ static int xhci_pci_reinit(struct xhci_h
+ #define PCI_VENDOR_ID_FRESCO_LOGIC		0x1b73
+ #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK		0x1000
+@@ -307,6 +309,16 @@ static int xhci_pci_reinit(struct xhci_h
  	return 0;
  }
  
@@ -64,9 +64,9 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
  {
  	struct pci_dev                  *pdev = to_pci_dev(dev);
-@@ -496,6 +508,8 @@ static void xhci_pci_quirks(struct devic
+@@ -513,6 +525,8 @@ static void xhci_pci_quirks(struct devic
+ 		xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
  		xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
- 		xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH;
  		xhci->quirks |= XHCI_VLI_SS_BULK_OUT_BUG;
 +		if (xhci_vl805_get_fw_version(pdev) < VL805_FW_VER_0138C0)
 +			xhci->quirks |= XHCI_VLI_HUB_TT_QUIRK;
@@ -75,7 +75,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
 --- a/drivers/usb/host/xhci-ring.c
 +++ b/drivers/usb/host/xhci-ring.c
-@@ -3671,6 +3671,48 @@ static int xhci_align_td(struct xhci_hcd
+@@ -3736,6 +3736,48 @@ static int xhci_align_td(struct xhci_hcd
  	return 1;
  }
  
@@ -124,7 +124,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  /* This is very similar to what ehci-q.c qtd_fill() does */
  int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
  		struct urb *urb, int slot_id, unsigned int ep_index)
-@@ -3827,6 +3869,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
+@@ -3892,6 +3934,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
  	}
  
  	check_trb_math(urb, enqd_len);
@@ -133,7 +133,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
  			start_cycle, start_trb);
  	return 0;
-@@ -3962,6 +4006,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *
+@@ -4041,6 +4085,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *
  			/* Event on completion */
  			field | TRB_IOC | TRB_TYPE(TRB_STATUS) | ep_ring->cycle_state);
  
@@ -144,7 +144,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	return 0;
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1921,6 +1921,7 @@ struct xhci_hcd {
+@@ -1664,6 +1664,7 @@ struct xhci_hcd {
  /* Downstream VLI fixes */
  #define XHCI_AVOID_DQ_ON_LINK	BIT_ULL(56)
  #define XHCI_VLI_SS_BULK_OUT_BUG	BIT_ULL(57)
diff --git a/target/linux/bcm27xx/patches-6.6/950-0487-drivers-media-imx296-Add-standby-delay-during-probe.patch b/target/linux/bcm27xx/patches-6.6/950-0487-drivers-media-imx296-Add-standby-delay-during-probe.patch
deleted file mode 100644
index 786ba7656ccc5f..00000000000000
--- a/target/linux/bcm27xx/patches-6.6/950-0487-drivers-media-imx296-Add-standby-delay-during-probe.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 7713ce38e6a26425ace3a57b3d03ba0125c16f89 Mon Sep 17 00:00:00 2001
-From: Naushir Patuck <naush@raspberrypi.com>
-Date: Fri, 28 Jul 2023 12:00:40 +0100
-Subject: [PATCH 0487/1085] drivers: media: imx296: Add standby delay during
- probe
-
-Add a 2-5ms delay when coming out of standby and before reading the
-sensor info register durning probe, as instructed by the datasheet. This
-standby delay is already present when the sensor starts streaming.
-
-Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
----
- drivers/media/i2c/imx296.c | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/drivers/media/i2c/imx296.c
-+++ b/drivers/media/i2c/imx296.c
-@@ -940,6 +940,8 @@ static int imx296_identify_model(struct
- 		return ret;
- 	}
- 
-+	usleep_range(2000, 5000);
-+
- 	ret = imx296_read(sensor, IMX296_SENSOR_INFO);
- 	if (ret < 0) {
- 		dev_err(sensor->dev, "failed to read sensor information (%d)\n",
diff --git a/target/linux/bcm27xx/patches-6.6/950-0509-gpio_brcmstb-Allow-to-build-for-ARCH_BCM2835.patch b/target/linux/bcm27xx/patches-6.6/950-0509-gpio_brcmstb-Allow-to-build-for-ARCH_BCM2835.patch
index a6a976257b9ef8..cef1bf42a11f88 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0509-gpio_brcmstb-Allow-to-build-for-ARCH_BCM2835.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0509-gpio_brcmstb-Allow-to-build-for-ARCH_BCM2835.patch
@@ -53,16 +53,16 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	help
 --- a/drivers/gpio/gpio-brcmstb.c
 +++ b/drivers/gpio/gpio-brcmstb.c
-@@ -639,6 +639,8 @@ static int brcmstb_gpio_probe(struct pla
+@@ -637,6 +637,8 @@ static int brcmstb_gpio_probe(struct pla
  #if defined(CONFIG_MIPS) && defined(__BIG_ENDIAN)
  	flags = BGPIOF_BIG_ENDIAN_BYTE_ORDER;
  #endif
 +	if (of_property_read_bool(np, "brcm,gpio-direct"))
 +	    flags |= BGPIOF_REG_DIRECT;
  
- 	of_property_for_each_u32(np, "brcm,gpio-bank-widths", prop, p,
- 			bank_width) {
-@@ -688,7 +690,9 @@ static int brcmstb_gpio_probe(struct pla
+ 	of_property_for_each_u32(np, "brcm,gpio-bank-widths", bank_width) {
+ 		struct brcmstb_gpio_bank *bank;
+@@ -685,7 +687,9 @@ static int brcmstb_gpio_probe(struct pla
  		}
  
  		gc->owner = THIS_MODULE;
@@ -73,7 +73,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  		if (!gc->label) {
  			err = -ENOMEM;
  			goto fail;
-@@ -697,7 +701,7 @@ static int brcmstb_gpio_probe(struct pla
+@@ -694,7 +698,7 @@ static int brcmstb_gpio_probe(struct pla
  		gc->of_gpio_n_cells = 2;
  		gc->of_xlate = brcmstb_gpio_of_xlate;
  		/* not all ngpio lines are valid, will use bank width later */
@@ -82,7 +82,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  		gc->offset = bank->id * MAX_GPIO_PER_BANK;
  		if (priv->parent_irq > 0)
  			gc->to_irq = brcmstb_gpio_to_irq;
-@@ -706,8 +710,10 @@ static int brcmstb_gpio_probe(struct pla
+@@ -703,8 +707,10 @@ static int brcmstb_gpio_probe(struct pla
  		 * Mask all interrupts by default, since wakeup interrupts may
  		 * be retained from S5 cold boot
  		 */
diff --git a/target/linux/bcm27xx/patches-6.6/950-0510-Allow-RESET_BRCMSTB-on-ARCH_BCM2835.patch b/target/linux/bcm27xx/patches-6.6/950-0510-Allow-RESET_BRCMSTB-on-ARCH_BCM2835.patch
deleted file mode 100644
index 3d408f1578ae96..00000000000000
--- a/target/linux/bcm27xx/patches-6.6/950-0510-Allow-RESET_BRCMSTB-on-ARCH_BCM2835.patch
+++ /dev/null
@@ -1,20 +0,0 @@
-From d72b490207c22065c3deac86ba5ddb1d62650e00 Mon Sep 17 00:00:00 2001
-From: Phil Elwell <phil@raspberrypi.com>
-Date: Thu, 27 May 2021 11:46:30 +0100
-Subject: [PATCH 0510/1085] Allow RESET_BRCMSTB on ARCH_BCM2835
-
----
- drivers/reset/Kconfig | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/reset/Kconfig
-+++ b/drivers/reset/Kconfig
-@@ -51,7 +51,7 @@ config RESET_BERLIN
- 
- config RESET_BRCMSTB
- 	tristate "Broadcom STB reset controller"
--	depends on ARCH_BRCMSTB || COMPILE_TEST
-+	depends on ARCH_BRCMSTB || ARCH_BCM2835 || COMPILE_TEST
- 	default ARCH_BRCMSTB
- 	help
- 	  This enables the reset controller driver for Broadcom STB SoCs using
diff --git a/target/linux/bcm27xx/patches-6.6/950-0518-net-macb-Also-set-DMA-coherent-mask.patch b/target/linux/bcm27xx/patches-6.6/950-0518-net-macb-Also-set-DMA-coherent-mask.patch
index cbfab3e4e6c12d..9abdb37960b1b5 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0518-net-macb-Also-set-DMA-coherent-mask.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0518-net-macb-Also-set-DMA-coherent-mask.patch
@@ -134,7 +134,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	struct napi_struct	napi_tx;
  
  	dma_addr_t		rx_ring_dma;
-@@ -1285,9 +1304,15 @@ struct macb {
+@@ -1287,9 +1306,15 @@ struct macb {
  
  	u32			caps;
  	unsigned int		dma_burst_length;
@@ -199,7 +199,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	snprintf(bp->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
  		 bp->pdev->name, bp->pdev->id);
  	bp->mii_bus->priv = bp;
-@@ -1648,6 +1665,11 @@ static int macb_rx(struct macb_queue *qu
+@@ -1641,6 +1658,11 @@ static int macb_rx(struct macb_queue *qu
  
  		macb_init_rx_ring(queue);
  		queue_writel(queue, RBQP, queue->rx_ring_dma);
@@ -211,7 +211,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  
  		macb_writel(bp, NCR, ctrl | MACB_BIT(RE));
  
-@@ -1948,8 +1970,9 @@ static irqreturn_t macb_interrupt(int ir
+@@ -1941,8 +1963,9 @@ static irqreturn_t macb_interrupt(int ir
  				queue_writel(queue, ISR, MACB_BIT(TCOMP) |
  							 MACB_BIT(TXUBR));
  
@@ -222,7 +222,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  				wmb(); // ensure softirq can see update
  			}
  
-@@ -2402,6 +2425,11 @@ static netdev_tx_t macb_start_xmit(struc
+@@ -2397,6 +2420,11 @@ static netdev_tx_t macb_start_xmit(struc
  	skb_tx_timestamp(skb);
  
  	spin_lock_irq(&bp->lock);
@@ -234,7 +234,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	macb_writel(bp, NCR, macb_readl(bp, NCR) | MACB_BIT(TSTART));
  	spin_unlock_irq(&bp->lock);
  
-@@ -2776,6 +2804,37 @@ static void macb_configure_dma(struct ma
+@@ -2771,6 +2799,37 @@ static void macb_configure_dma(struct ma
  	}
  }
  
@@ -272,7 +272,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  static void macb_init_hw(struct macb *bp)
  {
  	u32 config;
-@@ -2804,6 +2863,11 @@ static void macb_init_hw(struct macb *bp
+@@ -2799,6 +2858,11 @@ static void macb_init_hw(struct macb *bp
  	if (bp->caps & MACB_CAPS_JUMBO)
  		bp->rx_frm_len_mask = MACB_RX_JFRMLEN_MASK;
  
@@ -284,7 +284,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	macb_configure_dma(bp);
  
  	/* Enable RX partial store and forward and set watermark */
-@@ -3165,6 +3229,52 @@ static void gem_get_ethtool_strings(stru
+@@ -3163,6 +3227,52 @@ static void gem_get_ethtool_strings(stru
  	}
  }
  
@@ -365,9 +365,9 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 +	bp->use_aw2b_fill = device_property_read_bool(&pdev->dev, "cdns,use-aw2b-fill");
 +
  	spin_lock_init(&bp->lock);
+ 	spin_lock_init(&bp->stats_lock);
  
- 	/* setup capabilities */
-@@ -5117,6 +5236,21 @@ static int macb_probe(struct platform_de
+@@ -5122,6 +5241,21 @@ static int macb_probe(struct platform_de
  	else
  		bp->phy_interface = interface;
  
@@ -389,7 +389,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	/* IP specific init */
  	err = init(pdev);
  	if (err)
-@@ -5193,6 +5327,19 @@ static int macb_remove(struct platform_d
+@@ -5198,6 +5332,19 @@ static int macb_remove(struct platform_d
  	return 0;
  }
  
@@ -409,7 +409,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  static int __maybe_unused macb_suspend(struct device *dev)
  {
  	struct net_device *netdev = dev_get_drvdata(dev);
-@@ -5407,6 +5554,7 @@ static const struct dev_pm_ops macb_pm_o
+@@ -5412,6 +5559,7 @@ static const struct dev_pm_ops macb_pm_o
  static struct platform_driver macb_driver = {
  	.probe		= macb_probe,
  	.remove		= macb_remove,
diff --git a/target/linux/bcm27xx/patches-6.6/950-0521-PCI-brcmstb-Add-BCM2712-support.patch b/target/linux/bcm27xx/patches-6.6/950-0521-PCI-brcmstb-Add-BCM2712-support.patch
index c4c79ae4281fd4..7fdbc085f59c70 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0521-PCI-brcmstb-Add-BCM2712-support.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0521-PCI-brcmstb-Add-BCM2712-support.patch
@@ -341,17 +341,6 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	struct subdev_regulators *sr;
  	bool			ep_wakeup_capable;
  };
-@@ -286,8 +371,8 @@ static int brcm_pcie_encode_ibar_size(u6
- 	if (log2_in >= 12 && log2_in <= 15)
- 		/* Covers 4KB to 32KB (inclusive) */
- 		return (log2_in - 12) + 0x1c;
--	else if (log2_in >= 16 && log2_in <= 35)
--		/* Covers 64KB to 32GB, (inclusive) */
-+	else if (log2_in >= 16 && log2_in <= 36)
-+		/* Covers 64KB to 64GB, (inclusive) */
- 		return log2_in - 15;
- 	/* Something is awry so disable */
- 	return 0;
 @@ -376,6 +461,35 @@ static int brcm_pcie_set_ssc(struct brcm
  	return ssc && pll ? 0 : -EIO;
  }
@@ -831,7 +820,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	return 0;
  }
  
-@@ -1207,6 +1534,7 @@ static void brcm_pcie_enter_l23(struct b
+@@ -1208,6 +1535,7 @@ static void brcm_pcie_enter_l23(struct b
  
  static int brcm_phy_cntl(struct brcm_pcie *pcie, const int start)
  {
@@ -839,7 +828,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	static const u32 shifts[PCIE_DVT_PMU_PCIE_PHY_CTRL_DAST_NFLDS] = {
  		PCIE_DVT_PMU_PCIE_PHY_CTRL_DAST_PWRDN_SHIFT,
  		PCIE_DVT_PMU_PCIE_PHY_CTRL_DAST_RESET_SHIFT,
-@@ -1239,6 +1567,9 @@ static int brcm_phy_cntl(struct brcm_pci
+@@ -1240,6 +1568,9 @@ static int brcm_phy_cntl(struct brcm_pci
  		dev_err(pcie->dev, "failed to %s phy\n", (start ? "start" : "stop"));
  
  	return ret;
@@ -849,7 +838,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  }
  
  static inline int brcm_phy_start(struct brcm_pcie *pcie)
-@@ -1271,6 +1602,12 @@ static void brcm_pcie_turn_off(struct br
+@@ -1272,6 +1603,12 @@ static void brcm_pcie_turn_off(struct br
  	u32p_replace_bits(&tmp, 1, PCIE_MISC_HARD_PCIE_HARD_DEBUG_SERDES_IDDQ_MASK);
  	writel(tmp, base + PCIE_MISC_HARD_PCIE_HARD_DEBUG);
  
@@ -862,7 +851,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	/* Shutdown PCIe bridge */
  	pcie->bridge_sw_init_set(pcie, 1);
  }
-@@ -1301,9 +1638,9 @@ static int brcm_pcie_suspend_noirq(struc
+@@ -1302,9 +1639,9 @@ static int brcm_pcie_suspend_noirq(struc
  	if (brcm_phy_stop(pcie))
  		dev_err(dev, "Could not stop phy for suspend\n");
  
@@ -874,7 +863,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  		return ret;
  	}
  
-@@ -1398,7 +1735,7 @@ err_regulator:
+@@ -1399,7 +1736,7 @@ err_regulator:
  	if (pcie->sr)
  		regulator_bulk_disable(pcie->sr->num_supplies, pcie->sr->supplies);
  err_reset:
@@ -883,7 +872,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  err_disable_clk:
  	clk_disable_unprepare(pcie->clk);
  	return ret;
-@@ -1410,8 +1747,8 @@ static void __brcm_pcie_remove(struct br
+@@ -1411,8 +1748,8 @@ static void __brcm_pcie_remove(struct br
  	brcm_pcie_turn_off(pcie);
  	if (brcm_phy_stop(pcie))
  		dev_err(pcie->dev, "Could not stop phy\n");
@@ -894,7 +883,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	clk_disable_unprepare(pcie->clk);
  }
  
-@@ -1429,12 +1766,16 @@ static const int pcie_offsets[] = {
+@@ -1430,12 +1767,16 @@ static const int pcie_offsets[] = {
  	[RGR1_SW_INIT_1] = 0x9210,
  	[EXT_CFG_INDEX]  = 0x9000,
  	[EXT_CFG_DATA]   = 0x9004,
@@ -911,7 +900,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  };
  
  static const struct pcie_cfg_data generic_cfg = {
-@@ -1442,6 +1783,7 @@ static const struct pcie_cfg_data generi
+@@ -1443,6 +1784,7 @@ static const struct pcie_cfg_data generi
  	.type		= GENERIC,
  	.perst_set	= brcm_pcie_perst_set_generic,
  	.bridge_sw_init_set = brcm_pcie_bridge_sw_init_set_generic,
@@ -919,7 +908,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  };
  
  static const struct pcie_cfg_data bcm7425_cfg = {
-@@ -1449,6 +1791,7 @@ static const struct pcie_cfg_data bcm742
+@@ -1450,6 +1792,7 @@ static const struct pcie_cfg_data bcm742
  	.type		= BCM7425,
  	.perst_set	= brcm_pcie_perst_set_generic,
  	.bridge_sw_init_set = brcm_pcie_bridge_sw_init_set_generic,
@@ -927,7 +916,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  };
  
  static const struct pcie_cfg_data bcm7435_cfg = {
-@@ -1463,12 +1806,15 @@ static const struct pcie_cfg_data bcm490
+@@ -1464,12 +1807,15 @@ static const struct pcie_cfg_data bcm490
  	.type		= BCM4908,
  	.perst_set	= brcm_pcie_perst_set_4908,
  	.bridge_sw_init_set = brcm_pcie_bridge_sw_init_set_generic,
@@ -943,7 +932,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  };
  
  static const struct pcie_cfg_data bcm7278_cfg = {
-@@ -1476,6 +1822,7 @@ static const struct pcie_cfg_data bcm727
+@@ -1477,6 +1823,7 @@ static const struct pcie_cfg_data bcm727
  	.type		= BCM7278,
  	.perst_set	= brcm_pcie_perst_set_7278,
  	.bridge_sw_init_set = brcm_pcie_bridge_sw_init_set_7278,
@@ -951,7 +940,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  };
  
  static const struct pcie_cfg_data bcm2711_cfg = {
-@@ -1483,10 +1830,27 @@ static const struct pcie_cfg_data bcm271
+@@ -1484,10 +1831,27 @@ static const struct pcie_cfg_data bcm271
  	.type		= BCM2711,
  	.perst_set	= brcm_pcie_perst_set_generic,
  	.bridge_sw_init_set = brcm_pcie_bridge_sw_init_set_generic,
@@ -979,7 +968,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	{ .compatible = "brcm,bcm4908-pcie", .data = &bcm4908_cfg },
  	{ .compatible = "brcm,bcm7211-pcie", .data = &generic_cfg },
  	{ .compatible = "brcm,bcm7278-pcie", .data = &bcm7278_cfg },
-@@ -1527,7 +1891,7 @@ static int brcm_pcie_probe(struct platfo
+@@ -1528,7 +1892,7 @@ static int brcm_pcie_probe(struct platfo
  
  	data = of_device_get_match_data(&pdev->dev);
  	if (!data) {
@@ -988,7 +977,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  		return -EINVAL;
  	}
  
-@@ -1538,6 +1902,7 @@ static int brcm_pcie_probe(struct platfo
+@@ -1539,6 +1903,7 @@ static int brcm_pcie_probe(struct platfo
  	pcie->type = data->type;
  	pcie->perst_set = data->perst_set;
  	pcie->bridge_sw_init_set = data->bridge_sw_init_set;
@@ -996,7 +985,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  
  	pcie->base = devm_platform_ioremap_resource(pdev, 0);
  	if (IS_ERR(pcie->base))
-@@ -1568,14 +1933,20 @@ static int brcm_pcie_probe(struct platfo
+@@ -1569,14 +1934,20 @@ static int brcm_pcie_probe(struct platfo
  		clk_disable_unprepare(pcie->clk);
  		return PTR_ERR(pcie->perst_reset);
  	}
@@ -1019,41 +1008,47 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  		clk_disable_unprepare(pcie->clk);
  		return ret;
  	}
-@@ -1598,6 +1969,33 @@ static int brcm_pcie_probe(struct platfo
- 			dev_err(pcie->dev, "probe of internal MSI failed");
- 			goto fail;
- 		}
-+	} else if (pci_msi_enabled() && msi_np != pcie->np) {
-+		/* Use RC_BAR1 for MIP access */
-+		u64 msi_pci_addr;
-+		u64 msi_phys_addr;
-+
-+		if (of_property_read_u64(msi_np, "brcm,msi-pci-addr", &msi_pci_addr)) {
-+			dev_err(pcie->dev, "Unable to find MSI PCI address\n");
-+			ret = -EINVAL;
-+			goto fail;
-+		}
-+
-+		if (of_property_read_u64(msi_np, "reg", &msi_phys_addr)) {
-+			dev_err(pcie->dev, "Unable to find MSI physical address\n");
-+			ret = -EINVAL;
-+			goto fail;
+@@ -1595,8 +1966,38 @@ static int brcm_pcie_probe(struct platfo
+ 	if (pci_msi_enabled()) {
+ 		struct device_node *msi_np = of_parse_phandle(pcie->np, "msi-parent", 0);
+ 
+-		if (msi_np == pcie->np)
++		if (msi_np == pcie->np) {
+ 			ret = brcm_pcie_enable_msi(pcie);
++		} else {
++			/* Use RC_BAR1 for MIP access */
++			u64 msi_pci_addr;
++			u64 msi_phys_addr;
++
++			if (of_property_read_u64(msi_np, "brcm,msi-pci-addr", &msi_pci_addr)) {
++				dev_err(pcie->dev, "Unable to find MSI PCI address\n");
++				ret = -EINVAL;
++				of_node_put(msi_np);
++				goto fail;
++			}
++
++			if (of_property_read_u64(msi_np, "reg", &msi_phys_addr)) {
++				dev_err(pcie->dev, "Unable to find MSI physical address\n");
++				ret = -EINVAL;
++				of_node_put(msi_np);
++				goto fail;
++			}
++
++			writel(lower_32_bits(msi_pci_addr) | brcm_pcie_encode_ibar_size(0x1000),
++			       pcie->base + PCIE_MISC_RC_BAR1_CONFIG_LO);
++			writel(upper_32_bits(msi_pci_addr),
++			       pcie->base + PCIE_MISC_RC_BAR1_CONFIG_HI);
++
++			writel(lower_32_bits(msi_phys_addr) |
++			       PCIE_MISC_UBUS_BAR1_CONFIG_REMAP_ACCESS_ENABLE_MASK,
++			       pcie->base + PCIE_MISC_UBUS_BAR1_CONFIG_REMAP);
++			writel(upper_32_bits(msi_phys_addr),
++			       pcie->base + PCIE_MISC_UBUS_BAR1_CONFIG_REMAP_HI);
 +		}
-+
-+		writel(lower_32_bits(msi_pci_addr) | brcm_pcie_encode_ibar_size(0x1000),
-+		       pcie->base + PCIE_MISC_RC_BAR1_CONFIG_LO);
-+		writel(upper_32_bits(msi_pci_addr),
-+		       pcie->base + PCIE_MISC_RC_BAR1_CONFIG_HI);
-+
-+		writel(lower_32_bits(msi_phys_addr) |
-+		       PCIE_MISC_UBUS_BAR1_CONFIG_REMAP_ACCESS_ENABLE_MASK,
-+		       pcie->base + PCIE_MISC_UBUS_BAR1_CONFIG_REMAP);
-+		writel(upper_32_bits(msi_phys_addr),
-+		       pcie->base + PCIE_MISC_UBUS_BAR1_CONFIG_REMAP_HI);
- 	}
  
- 	bridge->ops = pcie->type == BCM7425 ? &brcm7425_pcie_ops : &brcm_pcie_ops;
-@@ -1614,6 +2012,8 @@ static int brcm_pcie_probe(struct platfo
+ 		of_node_put(msi_np);
+ 
+@@ -1620,6 +2021,8 @@ static int brcm_pcie_probe(struct platfo
  		return ret;
  	}
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0530-pinctrl-Add-rp1-driver.patch b/target/linux/bcm27xx/patches-6.6/950-0530-pinctrl-Add-rp1-driver.patch
index cd1473ab2ebc1a..de7cbe96f4072c 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0530-pinctrl-Add-rp1-driver.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0530-pinctrl-Add-rp1-driver.patch
@@ -17,7 +17,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/drivers/pinctrl/Kconfig
 +++ b/drivers/pinctrl/Kconfig
-@@ -505,6 +505,13 @@ config PINCTRL_MLXBF3
+@@ -506,6 +506,13 @@ config PINCTRL_MLXBF3
  	  each pin. This driver can also be built as a module called
  	  pinctrl-mlxbf3.
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0531-serial-pl011-rp1-uart-support.patch b/target/linux/bcm27xx/patches-6.6/950-0531-serial-pl011-rp1-uart-support.patch
index a36fbd2a597c4c..f916b5709d1cba 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0531-serial-pl011-rp1-uart-support.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0531-serial-pl011-rp1-uart-support.patch
@@ -31,7 +31,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  #ifdef CONFIG_ACPI_SPCR_TABLE
  static const struct vendor_data vendor_qdt_qdf2400_e44 = {
  	.reg_offset		= pl011_std_offsets,
-@@ -2979,6 +2993,86 @@ static struct platform_driver arm_sbsa_u
+@@ -2986,6 +3000,86 @@ static struct platform_driver arm_sbsa_u
  	},
  };
  
@@ -118,7 +118,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  static const struct amba_id pl011_ids[] = {
  	{
  		.id	= 0x00041011,
-@@ -3012,6 +3106,8 @@ static int __init pl011_init(void)
+@@ -3019,6 +3113,8 @@ static int __init pl011_init(void)
  
  	if (platform_driver_register(&arm_sbsa_uart_platform_driver))
  		pr_warn("could not register SBSA UART platform driver\n");
diff --git a/target/linux/bcm27xx/patches-6.6/950-0535-i2c-designware-Add-SMBUS-quick-command-support.patch b/target/linux/bcm27xx/patches-6.6/950-0535-i2c-designware-Add-SMBUS-quick-command-support.patch
index ed57365598ae6a..ff1c5ba890168b 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0535-i2c-designware-Add-SMBUS-quick-command-support.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0535-i2c-designware-Add-SMBUS-quick-command-support.patch
@@ -17,7 +17,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/drivers/i2c/busses/i2c-designware-core.h
 +++ b/drivers/i2c/busses/i2c-designware-core.h
-@@ -123,7 +123,9 @@
+@@ -124,7 +124,9 @@
  
  #define DW_IC_ERR_TX_ABRT			0x1
  
@@ -40,7 +40,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	regmap_update_bits(dev->map, DW_IC_CON, DW_IC_CON_10BITADDR_MASTER,
  			   ic_con);
  
-@@ -500,6 +504,14 @@ i2c_dw_xfer_msg(struct dw_i2c_dev *dev)
+@@ -501,6 +505,14 @@ i2c_dw_xfer_msg(struct dw_i2c_dev *dev)
  		regmap_read(dev->map, DW_IC_RXFLR, &flr);
  		rx_limit = dev->rx_fifo_depth - flr;
  
@@ -55,7 +55,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  		while (buf_len > 0 && tx_limit > 0 && rx_limit > 0) {
  			u32 cmd = 0;
  
-@@ -781,7 +793,7 @@ static const struct i2c_algorithm i2c_dw
+@@ -782,7 +794,7 @@ static const struct i2c_algorithm i2c_dw
  };
  
  static const struct i2c_adapter_quirks i2c_dw_quirks = {
@@ -64,7 +64,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  };
  
  static u32 i2c_dw_read_clear_intrbits(struct dw_i2c_dev *dev)
-@@ -914,7 +926,8 @@ void i2c_dw_configure_master(struct dw_i
+@@ -915,7 +927,8 @@ void i2c_dw_configure_master(struct dw_i
  {
  	struct i2c_timings *t = &dev->timings;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0545-ASoC-dwc-Support-set_bclk_ratio.patch b/target/linux/bcm27xx/patches-6.6/950-0545-ASoC-dwc-Support-set_bclk_ratio.patch
index 29077e0d1f6439..bc7cd7ddbaf430 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0545-ASoC-dwc-Support-set_bclk_ratio.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0545-ASoC-dwc-Support-set_bclk_ratio.patch
@@ -10,7 +10,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/sound/soc/dwc/dwc-i2s.c
 +++ b/sound/soc/dwc/dwc-i2s.c
-@@ -460,6 +460,40 @@ static int dw_i2s_set_tdm_slot(struct sn
+@@ -459,6 +459,40 @@ static int dw_i2s_set_tdm_slot(struct sn
  	return 0;
  }
  
@@ -51,7 +51,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  static int dw_i2s_dai_probe(struct snd_soc_dai *dai)
  {
  	struct dw_i2s_dev *dev = snd_soc_dai_get_drvdata(dai);
-@@ -476,6 +510,7 @@ static const struct snd_soc_dai_ops dw_i
+@@ -475,6 +509,7 @@ static const struct snd_soc_dai_ops dw_i
  	.trigger	= dw_i2s_trigger,
  	.set_fmt	= dw_i2s_set_fmt,
  	.set_tdm_slot	= dw_i2s_set_tdm_slot,
diff --git a/target/linux/bcm27xx/patches-6.6/950-0546-ASoC-dwc-Add-DMACR-handling.patch b/target/linux/bcm27xx/patches-6.6/950-0546-ASoC-dwc-Add-DMACR-handling.patch
index 6eba454d5c610f..bc577668ab9111 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0546-ASoC-dwc-Add-DMACR-handling.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0546-ASoC-dwc-Add-DMACR-handling.patch
@@ -14,7 +14,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/sound/soc/dwc/dwc-i2s.c
 +++ b/sound/soc/dwc/dwc-i2s.c
-@@ -248,7 +248,7 @@ static void dw_i2s_config(struct dw_i2s_
+@@ -247,7 +247,7 @@ static void dw_i2s_config(struct dw_i2s_
  {
  	u32 ch_reg;
  	struct i2s_clk_config_data *config = &dev->config;
@@ -23,7 +23,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  
  	i2s_disable_channels(dev, stream);
  
-@@ -260,6 +260,7 @@ static void dw_i2s_config(struct dw_i2s_
+@@ -259,6 +259,7 @@ static void dw_i2s_config(struct dw_i2s_
  				      dev->fifo_th - 1);
  			i2s_write_reg(dev->i2s_base, TER(ch_reg), TER_TXCHEN |
  				      dev->tdm_mask << TER_TXSLOT_SHIFT);
@@ -31,7 +31,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  		} else {
  			i2s_write_reg(dev->i2s_base, RCR(ch_reg),
  				      dev->xfer_resolution);
-@@ -267,9 +268,15 @@ static void dw_i2s_config(struct dw_i2s_
+@@ -266,9 +267,15 @@ static void dw_i2s_config(struct dw_i2s_
  				      dev->fifo_th - 1);
  			i2s_write_reg(dev->i2s_base, RER(ch_reg), RER_RXCHEN |
  				      dev->tdm_mask << RER_RXSLOT_SHIFT);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0547-ASOC-dwc-Improve-DMA-shutdown.patch b/target/linux/bcm27xx/patches-6.6/950-0547-ASOC-dwc-Improve-DMA-shutdown.patch
index bbe8c77488d723..f560b694bbd3f7 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0547-ASOC-dwc-Improve-DMA-shutdown.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0547-ASOC-dwc-Improve-DMA-shutdown.patch
@@ -22,7 +22,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  #include <sound/pcm.h>
  #include <sound/pcm_params.h>
  #include <sound/soc.h>
-@@ -208,15 +208,10 @@ static void i2s_start(struct dw_i2s_dev
+@@ -206,15 +206,10 @@ static void i2s_start(struct dw_i2s_dev
  	i2s_write_reg(dev->i2s_base, CER, 1);
  }
  
@@ -37,9 +37,9 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 -	else
 -		i2s_write_reg(dev->i2s_base, IRER, 0);
  
- 	if (dev->use_pio || dev->is_jh7110)
- 		i2s_disable_irqs(dev, substream->stream, 8);
-@@ -225,23 +220,15 @@ static void i2s_stop(struct dw_i2s_dev *
+ 	if (!(dev->use_pio || dev->is_jh7110))
+ 		i2s_disable_dma(dev, substream->stream);
+@@ -224,23 +219,15 @@ static void i2s_stop(struct dw_i2s_dev *
  
  	if (!dev->active) {
  		i2s_write_reg(dev->i2s_base, CER, 0);
@@ -67,7 +67,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  }
  
  static void dw_i2s_config(struct dw_i2s_dev *dev, int stream)
-@@ -354,6 +341,62 @@ static int dw_i2s_hw_params(struct snd_p
+@@ -353,6 +340,62 @@ static int dw_i2s_hw_params(struct snd_p
  	return 0;
  }
  
@@ -130,7 +130,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  static int dw_i2s_prepare(struct snd_pcm_substream *substream,
  			  struct snd_soc_dai *dai)
  {
-@@ -381,9 +424,12 @@ static int dw_i2s_trigger(struct snd_pcm
+@@ -380,9 +423,12 @@ static int dw_i2s_trigger(struct snd_pcm
  		i2s_start(dev, substream);
  		break;
  
@@ -144,7 +144,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  		dev->active--;
  		i2s_stop(dev, substream);
  		break;
-@@ -512,6 +558,7 @@ static int dw_i2s_dai_probe(struct snd_s
+@@ -511,6 +557,7 @@ static int dw_i2s_dai_probe(struct snd_s
  static const struct snd_soc_dai_ops dw_i2s_dai_ops = {
  	.probe		= dw_i2s_dai_probe,
  	.startup	= dw_i2s_startup,
diff --git a/target/linux/bcm27xx/patches-6.6/950-0548-ASOC-dwc-Fix-16-bit-audio-handling.patch b/target/linux/bcm27xx/patches-6.6/950-0548-ASOC-dwc-Fix-16-bit-audio-handling.patch
index b8a1849dbe01fc..d5f3adaf5b80dd 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0548-ASOC-dwc-Fix-16-bit-audio-handling.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0548-ASOC-dwc-Fix-16-bit-audio-handling.patch
@@ -22,7 +22,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/sound/soc/dwc/dwc-i2s.c
 +++ b/sound/soc/dwc/dwc-i2s.c
-@@ -271,23 +271,34 @@ static int dw_i2s_hw_params(struct snd_p
+@@ -270,23 +270,34 @@ static int dw_i2s_hw_params(struct snd_p
  {
  	struct dw_i2s_dev *dev = snd_soc_dai_get_drvdata(dai);
  	struct i2s_clk_config_data *config = &dev->config;
@@ -57,7 +57,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  		dev->ccr = 0x10;
  		dev->xfer_resolution = 0x05;
  		break;
-@@ -519,24 +530,21 @@ static int dw_i2s_set_bclk_ratio(struct
+@@ -518,24 +529,21 @@ static int dw_i2s_set_bclk_ratio(struct
  	struct dw_i2s_dev *dev = snd_soc_dai_get_drvdata(cpu_dai);
  	struct i2s_clk_config_data *config = &dev->config;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0555-drm-v3d-fix-up-register-addresses-for-V3D-7.x.patch b/target/linux/bcm27xx/patches-6.6/950-0555-drm-v3d-fix-up-register-addresses-for-V3D-7.x.patch
index 1466d2aadca296..b755c393b5650f 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0555-drm-v3d-fix-up-register-addresses-for-V3D-7.x.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0555-drm-v3d-fix-up-register-addresses-for-V3D-7.x.patch
@@ -295,7 +295,7 @@ v2: fix kernel panic with debug-fs interface to list registers
  
  static irqreturn_t
  v3d_hub_irq(int irq, void *arg);
-@@ -118,7 +119,8 @@ v3d_irq(int irq, void *arg)
+@@ -124,7 +125,8 @@ v3d_irq(int irq, void *arg)
  		status = IRQ_HANDLED;
  	}
  
@@ -305,7 +305,7 @@ v2: fix kernel panic with debug-fs interface to list registers
  		struct v3d_fence *fence =
  			to_v3d_fence(v3d->csd_job->base.irq_fence);
  		v3d->gpu_queue_stats[V3D_CSD].last_exec_end = local_clock();
-@@ -131,7 +133,7 @@ v3d_irq(int irq, void *arg)
+@@ -140,7 +142,7 @@ v3d_irq(int irq, void *arg)
  	/* We shouldn't be triggering these if we have GMP in
  	 * always-allowed mode.
  	 */
@@ -314,7 +314,7 @@ v2: fix kernel panic with debug-fs interface to list registers
  		dev_err(v3d->drm.dev, "GMP violation\n");
  
  	/* V3D 4.2 wires the hub and core IRQs together, so if we &
-@@ -205,6 +207,11 @@ v3d_hub_irq(int irq, void *arg)
+@@ -217,6 +219,11 @@ v3d_hub_irq(int irq, void *arg)
  		status = IRQ_HANDLED;
  	}
  
@@ -326,7 +326,7 @@ v2: fix kernel panic with debug-fs interface to list registers
  	return status;
  }
  
-@@ -219,8 +226,8 @@ v3d_irq_init(struct v3d_dev *v3d)
+@@ -231,8 +238,8 @@ v3d_irq_init(struct v3d_dev *v3d)
  	 * for us.
  	 */
  	for (core = 0; core < v3d->cores; core++)
@@ -335,9 +335,9 @@ v2: fix kernel panic with debug-fs interface to list registers
 +		V3D_CORE_WRITE(core, V3D_CTL_INT_CLR, V3D_CORE_IRQS(v3d->ver));
 +	V3D_WRITE(V3D_HUB_INT_CLR, V3D_HUB_IRQS(v3d->ver));
  
- 	irq1 = platform_get_irq_optional(v3d_to_pdev(v3d), 1);
- 	if (irq1 == -EPROBE_DEFER)
-@@ -264,12 +271,12 @@ v3d_irq_enable(struct v3d_dev *v3d)
+ 	irq = platform_get_irq_optional(v3d_to_pdev(v3d), 1);
+ 	if (irq == -EPROBE_DEFER)
+@@ -287,12 +294,12 @@ v3d_irq_enable(struct v3d_dev *v3d)
  
  	/* Enable our set of interrupts, masking out any others. */
  	for (core = 0; core < v3d->cores; core++) {
@@ -354,7 +354,7 @@ v2: fix kernel panic with debug-fs interface to list registers
  }
  
  void
-@@ -284,8 +291,8 @@ v3d_irq_disable(struct v3d_dev *v3d)
+@@ -313,8 +320,8 @@ v3d_irq_disable(struct v3d_dev *v3d)
  
  	/* Clear any pending interrupts we might have left. */
  	for (core = 0; core < v3d->cores; core++)
@@ -600,7 +600,7 @@ v2: fix kernel panic with debug-fs interface to list registers
  static struct dma_fence *
  v3d_tfu_job_run(struct drm_sched_job *sched_job)
  {
-@@ -302,20 +304,22 @@ v3d_tfu_job_run(struct drm_sched_job *sc
+@@ -306,20 +308,22 @@ v3d_tfu_job_run(struct drm_sched_job *sc
  	trace_v3d_submit_tfu(dev, to_v3d_fence(fence)->seqno);
  
  	v3d_sched_stats_add_job(&v3d->gpu_queue_stats[V3D_TFU], sched_job);
@@ -635,16 +635,16 @@ v2: fix kernel panic with debug-fs interface to list registers
  
  	return fence;
  }
-@@ -327,7 +331,7 @@ v3d_csd_job_run(struct drm_sched_job *sc
+@@ -331,7 +335,7 @@ v3d_csd_job_run(struct drm_sched_job *sc
  	struct v3d_dev *v3d = job->base.v3d;
  	struct drm_device *dev = &v3d->drm;
  	struct dma_fence *fence;
 -	int i;
 +	int i, csd_cfg0_reg, csd_cfg_reg_count;
  
- 	v3d->csd_job = job;
- 
-@@ -346,10 +350,12 @@ v3d_csd_job_run(struct drm_sched_job *sc
+ 	if (unlikely(job->base.base.s_fence->finished.error))
+ 		return NULL;
+@@ -353,10 +357,12 @@ v3d_csd_job_run(struct drm_sched_job *sc
  	v3d_sched_stats_add_job(&v3d->gpu_queue_stats[V3D_CSD], sched_job);
  	v3d_switch_perfmon(v3d, &job->base);
  
@@ -660,7 +660,7 @@ v2: fix kernel panic with debug-fs interface to list registers
  
  	return fence;
  }
-@@ -452,7 +458,8 @@ v3d_csd_job_timedout(struct drm_sched_jo
+@@ -471,7 +477,8 @@ v3d_csd_job_timedout(struct drm_sched_jo
  {
  	struct v3d_csd_job *job = to_csd_job(sched_job);
  	struct v3d_dev *v3d = job->base.v3d;
@@ -668,5 +668,5 @@ v2: fix kernel panic with debug-fs interface to list registers
 +	u32 batches = V3D_CORE_READ(0, (v3d->ver < 71 ? V3D_CSD_CURRENT_CFG4 :
 +							V3D_V7_CSD_CURRENT_CFG4));
  
- 	/* If we've made progress, skip reset and let the timer get
- 	 * rearmed.
+ 	/* If we've made progress, skip reset, add the job to the pending
+ 	 * list, and let the timer get rearmed.
diff --git a/target/linux/bcm27xx/patches-6.6/950-0567-drivers-iommu-Add-BCM2712-IOMMU.patch b/target/linux/bcm27xx/patches-6.6/950-0567-drivers-iommu-Add-BCM2712-IOMMU.patch
index 853224b71b02b1..d4fa6244f5f9ce 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0567-drivers-iommu-Add-BCM2712-IOMMU.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0567-drivers-iommu-Add-BCM2712-IOMMU.patch
@@ -31,7 +31,7 @@ Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
 
 --- a/drivers/iommu/Kconfig
 +++ b/drivers/iommu/Kconfig
-@@ -494,4 +494,11 @@ config SPRD_IOMMU
+@@ -493,4 +493,11 @@ config SPRD_IOMMU
  
  	  Say Y here if you want to use the multimedia devices listed above.
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0578-drm-vc4-hdmi-Enable-the-audio-clock.patch b/target/linux/bcm27xx/patches-6.6/950-0578-drm-vc4-hdmi-Enable-the-audio-clock.patch
index 79d040070f068d..ab082c6a1900cb 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0578-drm-vc4-hdmi-Enable-the-audio-clock.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0578-drm-vc4-hdmi-Enable-the-audio-clock.patch
@@ -18,7 +18,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_hdmi.c
 +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
-@@ -3595,6 +3595,7 @@ static int vc4_hdmi_runtime_suspend(stru
+@@ -3599,6 +3599,7 @@ static int vc4_hdmi_runtime_suspend(stru
  {
  	struct vc4_hdmi *vc4_hdmi = dev_get_drvdata(dev);
  
@@ -26,7 +26,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	clk_disable_unprepare(vc4_hdmi->hsm_clock);
  
  	return 0;
-@@ -3627,6 +3628,10 @@ static int vc4_hdmi_runtime_resume(struc
+@@ -3631,6 +3632,10 @@ static int vc4_hdmi_runtime_resume(struc
  		goto err_disable_clk;
  	}
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0580-drm-vc4-hvs-More-logging-for-dlist-generation.patch b/target/linux/bcm27xx/patches-6.6/950-0580-drm-vc4-hvs-More-logging-for-dlist-generation.patch
index 6c0a85d703dc09..69b36207c6ad76 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0580-drm-vc4-hvs-More-logging-for-dlist-generation.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0580-drm-vc4-hvs-More-logging-for-dlist-generation.patch
@@ -14,7 +14,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -826,11 +826,22 @@ int vc4_hvs_atomic_check(struct drm_crtc
+@@ -829,11 +829,22 @@ int vc4_hvs_atomic_check(struct drm_crtc
  	if (hweight32(crtc_state->connector_mask) > 1)
  		return -EINVAL;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0581-drm-vc4-hvs-Print-error-if-we-fail-an-allocation.patch b/target/linux/bcm27xx/patches-6.6/950-0581-drm-vc4-hvs-Print-error-if-we-fail-an-allocation.patch
index 3b30ea2f479ae3..eeed520f4b2b8d 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0581-drm-vc4-hvs-Print-error-if-we-fail-an-allocation.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0581-drm-vc4-hvs-Print-error-if-we-fail-an-allocation.patch
@@ -19,7 +19,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -441,6 +441,8 @@ vc4_hvs_alloc_dlist_entry(struct vc4_hvs
+@@ -446,6 +446,8 @@ vc4_hvs_alloc_dlist_entry(struct vc4_hvs
  			  unsigned int channel,
  			  size_t dlist_count)
  {
@@ -28,7 +28,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	struct vc4_hvs_dlist_allocation *alloc;
  	unsigned long flags;
  	int ret;
-@@ -458,8 +460,10 @@ vc4_hvs_alloc_dlist_entry(struct vc4_hvs
+@@ -463,8 +465,10 @@ vc4_hvs_alloc_dlist_entry(struct vc4_hvs
  	ret = drm_mm_insert_node(&hvs->dlist_mm, &alloc->mm_node,
  				 dlist_count);
  	spin_unlock_irqrestore(&hvs->mm_lock, flags);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0585-drm-vc4-Introduce-generation-number-enum.patch b/target/linux/bcm27xx/patches-6.6/950-0585-drm-vc4-Introduce-generation-number-enum.patch
index 0e810a1f4e11ac..f57aa6d1b79244 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0585-drm-vc4-Introduce-generation-number-enum.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0585-drm-vc4-Introduce-generation-number-enum.patch
@@ -22,7 +22,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  drivers/gpu/drm/vc4/vc4_drv.h              |  7 ++-
  drivers/gpu/drm/vc4/vc4_gem.c              | 24 +++++------
  drivers/gpu/drm/vc4/vc4_hdmi.c             |  2 +-
- drivers/gpu/drm/vc4/vc4_hvs.c              | 50 ++++++++++++----------
+ drivers/gpu/drm/vc4/vc4_hvs.c              | 52 ++++++++++++----------
  drivers/gpu/drm/vc4/vc4_irq.c              | 10 ++---
  drivers/gpu/drm/vc4/vc4_kms.c              | 14 +++---
  drivers/gpu/drm/vc4/vc4_perfmon.c          | 20 ++++-----
@@ -31,7 +31,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  drivers/gpu/drm/vc4/vc4_v3d.c              | 10 ++---
  drivers/gpu/drm/vc4/vc4_validate.c         |  8 ++--
  drivers/gpu/drm/vc4/vc4_validate_shaders.c |  2 +-
- 16 files changed, 126 insertions(+), 111 deletions(-)
+ 16 files changed, 127 insertions(+), 112 deletions(-)
 
 --- a/drivers/gpu/drm/vc4/tests/vc4_mock.c
 +++ b/drivers/gpu/drm/vc4/tests/vc4_mock.c
@@ -470,7 +470,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	switch (args->madv) {
 --- a/drivers/gpu/drm/vc4/vc4_hdmi.c
 +++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
-@@ -2586,7 +2586,7 @@ static int vc4_hdmi_audio_prepare(struct
+@@ -2590,7 +2590,7 @@ static int vc4_hdmi_audio_prepare(struct
  					     VC4_HDMI_AUDIO_PACKET_CEA_MASK);
  
  	/* Set the MAI threshold */
@@ -481,7 +481,16 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  			VC4_SET_FIELD(0x10, VC4_HD_MAI_THR_PANICLOW) |
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -416,7 +416,7 @@ static void vc4_hvs_irq_enable_eof(const
+@@ -303,7 +303,7 @@ static void vc4_hvs_lut_load(struct vc4_
+ 	if (!drm_dev_enter(drm, &idx))
+ 		return;
+ 
+-	if (hvs->vc4->is_vc5)
++	if (hvs->vc4->gen == VC4_GEN_5)  
+ 		return;
+ 
+ 	/* The LUT memory is laid out with each HVS channel in order,
+@@ -421,7 +421,7 @@ static void vc4_hvs_irq_enable_eof(const
  				   unsigned int channel)
  {
  	struct vc4_dev *vc4 = hvs->vc4;
@@ -490,7 +499,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  		SCALER5_DISPCTRL_DSPEIEOF(channel) :
  		SCALER_DISPCTRL_DSPEIEOF(channel);
  
-@@ -428,7 +428,7 @@ static void vc4_hvs_irq_clear_eof(const
+@@ -433,7 +433,7 @@ static void vc4_hvs_irq_clear_eof(const
  				  unsigned int channel)
  {
  	struct vc4_dev *vc4 = hvs->vc4;
@@ -499,7 +508,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  		SCALER5_DISPCTRL_DSPEIEOF(channel) :
  		SCALER_DISPCTRL_DSPEIEOF(channel);
  
-@@ -620,7 +620,7 @@ int vc4_hvs_get_fifo_from_output(struct
+@@ -625,7 +625,7 @@ int vc4_hvs_get_fifo_from_output(struct
  	u32 reg;
  	int ret;
  
@@ -508,7 +517,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  		return output;
  
  	/*
-@@ -701,7 +701,7 @@ static int vc4_hvs_init_channel(struct v
+@@ -706,7 +706,7 @@ static int vc4_hvs_init_channel(struct v
  	dispctrl = SCALER_DISPCTRLX_ENABLE;
  	dispbkgndx = HVS_READ(SCALER_DISPBKGNDX(chan));
  
@@ -517,7 +526,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  		dispctrl |= VC4_SET_FIELD(mode->hdisplay,
  					  SCALER_DISPCTRLX_WIDTH) |
  			    VC4_SET_FIELD(mode->vdisplay,
-@@ -732,7 +732,7 @@ static int vc4_hvs_init_channel(struct v
+@@ -737,7 +737,7 @@ static int vc4_hvs_init_channel(struct v
  	/* Reload the LUT, since the SRAMs would have been disabled if
  	 * all CRTCs had SCALER_DISPBKGND_GAMMA unset at once.
  	 */
@@ -526,7 +535,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  		vc4_hvs_lut_load(hvs, vc4_crtc);
  	else
  		vc5_hvs_lut_load(hvs, vc4_crtc);
-@@ -782,7 +782,7 @@ static int vc4_hvs_gamma_check(struct dr
+@@ -785,7 +785,7 @@ static int vc4_hvs_gamma_check(struct dr
  	struct drm_device *dev = crtc->dev;
  	struct vc4_dev *vc4 = to_vc4_dev(dev);
  
@@ -535,7 +544,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  		return 0;
  
  	if (!crtc_state->color_mgmt_changed)
-@@ -1036,7 +1036,7 @@ void vc4_hvs_atomic_flush(struct drm_crt
+@@ -1039,7 +1039,7 @@ void vc4_hvs_atomic_flush(struct drm_crt
  		u32 dispbkgndx = HVS_READ(SCALER_DISPBKGNDX(channel));
  
  		if (crtc->state->gamma_lut) {
@@ -544,7 +553,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  				vc4_hvs_update_gamma_lut(hvs, vc4_crtc);
  				dispbkgndx |= SCALER_DISPBKGND_GAMMA;
  			} else {
-@@ -1053,7 +1053,7 @@ void vc4_hvs_atomic_flush(struct drm_crt
+@@ -1056,7 +1056,7 @@ void vc4_hvs_atomic_flush(struct drm_crt
  			 * should already be disabling/enabling the pipeline
  			 * when gamma changes.
  			 */
@@ -553,7 +562,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  				dispbkgndx &= ~SCALER_DISPBKGND_GAMMA;
  		}
  		HVS_WRITE(SCALER_DISPBKGNDX(channel), dispbkgndx);
-@@ -1069,7 +1069,8 @@ void vc4_hvs_atomic_flush(struct drm_crt
+@@ -1073,7 +1073,8 @@ exit:
  
  void vc4_hvs_mask_underrun(struct vc4_hvs *hvs, int channel)
  {
@@ -563,7 +572,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	u32 dispctrl;
  	int idx;
  
-@@ -1077,8 +1078,9 @@ void vc4_hvs_mask_underrun(struct vc4_hv
+@@ -1081,8 +1082,9 @@ void vc4_hvs_mask_underrun(struct vc4_hv
  		return;
  
  	dispctrl = HVS_READ(SCALER_DISPCTRL);
@@ -575,7 +584,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	HVS_WRITE(SCALER_DISPCTRL, dispctrl);
  
-@@ -1087,7 +1089,8 @@ void vc4_hvs_mask_underrun(struct vc4_hv
+@@ -1091,7 +1093,8 @@ void vc4_hvs_mask_underrun(struct vc4_hv
  
  void vc4_hvs_unmask_underrun(struct vc4_hvs *hvs, int channel)
  {
@@ -585,7 +594,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	u32 dispctrl;
  	int idx;
  
-@@ -1095,8 +1098,9 @@ void vc4_hvs_unmask_underrun(struct vc4_
+@@ -1099,8 +1102,9 @@ void vc4_hvs_unmask_underrun(struct vc4_
  		return;
  
  	dispctrl = HVS_READ(SCALER_DISPCTRL);
@@ -597,7 +606,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	HVS_WRITE(SCALER_DISPSTAT,
  		  SCALER_DISPSTAT_EUFLOW(channel));
-@@ -1139,8 +1143,10 @@ static irqreturn_t vc4_hvs_irq_handler(i
+@@ -1143,8 +1147,10 @@ static irqreturn_t vc4_hvs_irq_handler(i
  	control = HVS_READ(SCALER_DISPCTRL);
  
  	for (channel = 0; channel < SCALER_CHANNELS_COUNT; channel++) {
@@ -610,7 +619,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  		/* Interrupt masking is not always honored, so check it here. */
  		if (status & SCALER_DISPSTAT_EUFLOW(channel) &&
  		    control & dspeislur) {
-@@ -1176,7 +1182,7 @@ int vc4_hvs_debugfs_init(struct drm_mino
+@@ -1180,7 +1186,7 @@ int vc4_hvs_debugfs_init(struct drm_mino
  	if (!vc4->hvs)
  		return -ENODEV;
  
@@ -619,7 +628,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  		debugfs_create_bool("hvs_load_tracker", S_IRUGO | S_IWUSR,
  				    minor->debugfs_root,
  				    &vc4->load_tracker_enabled);
-@@ -1225,7 +1231,7 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+@@ -1230,7 +1236,7 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
  	 * between planes when they don't overlap on the screen, but
  	 * for now we just allocate globally.
  	 */
@@ -628,7 +637,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  		/* 48k words of 2x12-bit pixels */
  		drm_mm_init(&hvs->lbm_mm, 0, 48 * 1024);
  	else
-@@ -1259,7 +1265,7 @@ static int vc4_hvs_bind(struct device *d
+@@ -1264,7 +1270,7 @@ static int vc4_hvs_bind(struct device *d
  	hvs->regset.regs = hvs_regs;
  	hvs->regset.nregs = ARRAY_SIZE(hvs_regs);
  
@@ -637,7 +646,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  		struct rpi_firmware *firmware;
  		struct device_node *node;
  		unsigned int max_rate;
-@@ -1297,7 +1303,7 @@ static int vc4_hvs_bind(struct device *d
+@@ -1302,7 +1308,7 @@ static int vc4_hvs_bind(struct device *d
  		}
  	}
  
@@ -646,7 +655,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  		hvs->dlist = hvs->regs + SCALER_DLIST_START;
  	else
  		hvs->dlist = hvs->regs + SCALER5_DLIST_START;
-@@ -1338,7 +1344,7 @@ static int vc4_hvs_bind(struct device *d
+@@ -1343,7 +1349,7 @@ static int vc4_hvs_bind(struct device *d
  		    SCALER_DISPCTRL_DISPEIRQ(1) |
  		    SCALER_DISPCTRL_DISPEIRQ(2);
  
@@ -655,7 +664,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  		dispctrl &= ~(SCALER_DISPCTRL_DMAEIRQ |
  			      SCALER_DISPCTRL_SLVWREIRQ |
  			      SCALER_DISPCTRL_SLVRDEIRQ |
-@@ -1393,7 +1399,7 @@ static int vc4_hvs_bind(struct device *d
+@@ -1409,7 +1415,7 @@ static int vc4_hvs_bind(struct device *d
  
  	/* Recompute Composite Output Buffer (COB) allocations for the displays
  	 */
diff --git a/target/linux/bcm27xx/patches-6.6/950-0587-drm-vc4-hvs-Use-switch-statement-to-simplify-vc4_hvs.patch b/target/linux/bcm27xx/patches-6.6/950-0587-drm-vc4-hvs-Use-switch-statement-to-simplify-vc4_hvs.patch
index e07e120ed098a3..db59ab5d5b4df7 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0587-drm-vc4-hvs-Use-switch-statement-to-simplify-vc4_hvs.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0587-drm-vc4-hvs-Use-switch-statement-to-simplify-vc4_hvs.patch
@@ -14,7 +14,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -620,57 +620,63 @@ int vc4_hvs_get_fifo_from_output(struct
+@@ -625,57 +625,63 @@ int vc4_hvs_get_fifo_from_output(struct
  	u32 reg;
  	int ret;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0588-drm-vc4-hvs-Use-switch-statement-to-simplify-enablin.patch b/target/linux/bcm27xx/patches-6.6/950-0588-drm-vc4-hvs-Use-switch-statement-to-simplify-enablin.patch
index 16810d5035d61f..0875383a0280fc 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0588-drm-vc4-hvs-Use-switch-statement-to-simplify-enablin.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0588-drm-vc4-hvs-Use-switch-statement-to-simplify-enablin.patch
@@ -15,7 +15,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -416,24 +416,46 @@ static void vc4_hvs_irq_enable_eof(const
+@@ -421,24 +421,46 @@ static void vc4_hvs_irq_enable_eof(const
  				   unsigned int channel)
  {
  	struct vc4_dev *vc4 = hvs->vc4;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0589-drm-vc4-hvs-Test-if-the-EOF-interrupts-are-enabled.patch b/target/linux/bcm27xx/patches-6.6/950-0589-drm-vc4-hvs-Test-if-the-EOF-interrupts-are-enabled.patch
index c16b1c1ca79c27..d8d2037350de02 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0589-drm-vc4-hvs-Test-if-the-EOF-interrupts-are-enabled.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0589-drm-vc4-hvs-Test-if-the-EOF-interrupts-are-enabled.patch
@@ -32,7 +32,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  struct vc4_hvs {
  	struct vc4_dev *vc4;
  	struct platform_device *pdev;
-@@ -327,6 +329,10 @@ struct vc4_hvs {
+@@ -328,6 +330,10 @@ struct vc4_hvs {
  
  	struct clk *core_clk;
  
@@ -43,7 +43,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	unsigned long max_core_rate;
  
  	/* Memory manager for CRTCs to allocate space in the display
-@@ -359,8 +365,6 @@ struct vc4_hvs {
+@@ -360,8 +366,6 @@ struct vc4_hvs {
  	bool vc5_hdmi_enable_4096by2160;
  };
  
@@ -54,7 +54,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	unsigned long core_clock_rate;
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -412,11 +412,14 @@ static void vc5_hvs_update_gamma_lut(str
+@@ -417,11 +417,14 @@ static void vc5_hvs_update_gamma_lut(str
  	vc5_hvs_lut_load(hvs, vc4_crtc);
  }
  
@@ -70,7 +70,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	switch (vc4->gen) {
  	case VC4_GEN_4:
  		HVS_WRITE(SCALER_DISPCTRL,
-@@ -433,13 +436,18 @@ static void vc4_hvs_irq_enable_eof(const
+@@ -438,13 +441,18 @@ static void vc4_hvs_irq_enable_eof(const
  	default:
  		break;
  	}
@@ -90,7 +90,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	switch (vc4->gen) {
  	case VC4_GEN_4:
  		HVS_WRITE(SCALER_DISPCTRL,
-@@ -456,6 +464,8 @@ static void vc4_hvs_irq_clear_eof(const
+@@ -461,6 +469,8 @@ static void vc4_hvs_irq_clear_eof(const
  	default:
  		break;
  	}
diff --git a/target/linux/bcm27xx/patches-6.6/950-0590-drm-vc4-hvs-Create-hw_init-function.patch b/target/linux/bcm27xx/patches-6.6/950-0590-drm-vc4-hvs-Create-hw_init-function.patch
index bd0b8903695d37..afa95ac2586112 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0590-drm-vc4-hvs-Create-hw_init-function.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0590-drm-vc4-hvs-Create-hw_init-function.patch
@@ -16,7 +16,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -1281,79 +1281,10 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+@@ -1286,79 +1286,10 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
  	return hvs;
  }
  
@@ -99,7 +99,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	reg = HVS_READ(SCALER_DISPECTRL);
  	reg &= ~SCALER_DISPECTRL_DSP2_MUX_MASK;
-@@ -1435,6 +1366,86 @@ static int vc4_hvs_bind(struct device *d
+@@ -1451,6 +1382,86 @@ static int vc4_hvs_bind(struct device *d
  
  	HVS_WRITE(SCALER_DISPCTRL, dispctrl);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0591-drm-vc4-hvs-Create-cob_init-function.patch b/target/linux/bcm27xx/patches-6.6/950-0591-drm-vc4-hvs-Create-cob_init-function.patch
index 157a474ce55c6a..00cefef2353917 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0591-drm-vc4-hvs-Create-cob_init-function.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0591-drm-vc4-hvs-Create-cob_init-function.patch
@@ -16,7 +16,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -1369,6 +1369,77 @@ static int vc4_hvs_hw_init(struct vc4_hv
+@@ -1385,6 +1385,77 @@ static int vc4_hvs_hw_init(struct vc4_hv
  	return 0;
  }
  
@@ -94,7 +94,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  static int vc4_hvs_bind(struct device *dev, struct device *master, void *data)
  {
  	struct platform_device *pdev = to_platform_device(dev);
-@@ -1376,7 +1447,6 @@ static int vc4_hvs_bind(struct device *d
+@@ -1392,7 +1463,6 @@ static int vc4_hvs_bind(struct device *d
  	struct vc4_dev *vc4 = to_vc4_dev(drm);
  	struct vc4_hvs *hvs = NULL;
  	int ret;
@@ -102,7 +102,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	hvs = __vc4_hvs_alloc(vc4, NULL);
  	if (IS_ERR(hvs))
-@@ -1446,59 +1516,9 @@ static int vc4_hvs_bind(struct device *d
+@@ -1462,59 +1532,9 @@ static int vc4_hvs_bind(struct device *d
  	if (ret)
  		return ret;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0592-drm-vc4-hvs-Rename-hvs_regs-list.patch b/target/linux/bcm27xx/patches-6.6/950-0592-drm-vc4-hvs-Rename-hvs_regs-list.patch
index 6719a445223f75..2ce5289a65414d 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0592-drm-vc4-hvs-Rename-hvs_regs-list.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0592-drm-vc4-hvs-Rename-hvs_regs-list.patch
@@ -25,7 +25,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	VC4_REG32(SCALER_DISPCTRL),
  	VC4_REG32(SCALER_DISPSTAT),
  	VC4_REG32(SCALER_DISPID),
-@@ -1457,8 +1457,8 @@ static int vc4_hvs_bind(struct device *d
+@@ -1473,8 +1473,8 @@ static int vc4_hvs_bind(struct device *d
  		return PTR_ERR(hvs->regs);
  
  	hvs->regset.base = hvs->regs;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0593-drm-vc4-plane-Change-ptr0_offset-to-an-array.patch b/target/linux/bcm27xx/patches-6.6/950-0593-drm-vc4-plane-Change-ptr0_offset-to-an-array.patch
index bc72a950217145..4fba060928c598 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0593-drm-vc4-plane-Change-ptr0_offset-to-an-array.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0593-drm-vc4-plane-Change-ptr0_offset-to-an-array.patch
@@ -25,7 +25,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  #include <drm/drm_gem_dma_helper.h>
  #include <drm/drm_managed.h>
  #include <drm/drm_mm.h>
-@@ -410,7 +411,7 @@ struct vc4_plane_state {
+@@ -411,7 +412,7 @@ struct vc4_plane_state {
  	 */
  	u32 pos0_offset;
  	u32 pos2_offset;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0595-drm-vc4-hvs-Change-prototype-of-__vc4_hvs_alloc-to-p.patch b/target/linux/bcm27xx/patches-6.6/950-0595-drm-vc4-hvs-Change-prototype-of-__vc4_hvs_alloc-to-p.patch
index 90f5d8a9b226af..e7a63dcfcb5a4b 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0595-drm-vc4-hvs-Change-prototype-of-__vc4_hvs_alloc-to-p.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0595-drm-vc4-hvs-Change-prototype-of-__vc4_hvs_alloc-to-p.patch
@@ -36,7 +36,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	drm = &vc4->base;
 --- a/drivers/gpu/drm/vc4/vc4_drv.h
 +++ b/drivers/gpu/drm/vc4/vc4_drv.h
-@@ -1047,7 +1047,9 @@ void vc4_irq_reset(struct drm_device *de
+@@ -1048,7 +1048,9 @@ void vc4_irq_reset(struct drm_device *de
  
  /* vc4_hvs.c */
  extern struct platform_driver vc4_hvs_driver;
@@ -49,7 +49,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  u8 vc4_hvs_get_fifo_frame_count(struct vc4_hvs *hvs, unsigned int fifo);
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -1238,7 +1238,9 @@ int vc4_hvs_debugfs_init(struct drm_mino
+@@ -1242,7 +1242,9 @@ int vc4_hvs_debugfs_init(struct drm_mino
  	return 0;
  }
  
@@ -60,7 +60,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  {
  	struct drm_device *drm = &vc4->base;
  	struct vc4_hvs *hvs;
-@@ -1248,6 +1250,7 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+@@ -1252,6 +1254,7 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
  		return ERR_PTR(-ENOMEM);
  
  	hvs->vc4 = vc4;
@@ -68,7 +68,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	hvs->pdev = pdev;
  
  	spin_lock_init(&hvs->mm_lock);
-@@ -1446,16 +1449,17 @@ static int vc4_hvs_bind(struct device *d
+@@ -1462,16 +1465,17 @@ static int vc4_hvs_bind(struct device *d
  	struct drm_device *drm = dev_get_drvdata(master);
  	struct vc4_dev *vc4 = to_vc4_dev(drm);
  	struct vc4_hvs *hvs = NULL;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0597-drm-vc4-hdmi-Avoid-hang-with-debug-registers-when-su.patch b/target/linux/bcm27xx/patches-6.6/950-0597-drm-vc4-hdmi-Avoid-hang-with-debug-registers-when-su.patch
deleted file mode 100644
index 9f58504abb1de1..00000000000000
--- a/target/linux/bcm27xx/patches-6.6/950-0597-drm-vc4-hdmi-Avoid-hang-with-debug-registers-when-su.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From db41506f785ad84895a31b01e8bd7c07bceabb3d Mon Sep 17 00:00:00 2001
-From: Dom Cobley <popcornmix@gmail.com>
-Date: Tue, 5 Sep 2023 19:38:24 +0100
-Subject: [PATCH 0597/1085] drm/vc4: hdmi: Avoid hang with debug registers when
- suspended
-
-Trying to read /sys/kernel/debug/dri/1/hdmi1_regs
-when the hdmi is disconnected results in a fatal system hang.
-
-This is due to the pm suspend code disabling the dvp clock.
-That is just a gate of the 108MHz clock in DVP_HT_RPI_MISC_CONFIG,
-which results in accesses hanging AXI bus.
-
-Protect against this.
-
-Signed-off-by: Dom Cobley <popcornmix@gmail.com>
----
- drivers/gpu/drm/vc4/vc4_hdmi.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
---- a/drivers/gpu/drm/vc4/vc4_hdmi.c
-+++ b/drivers/gpu/drm/vc4/vc4_hdmi.c
-@@ -185,6 +185,8 @@ static int vc4_hdmi_debugfs_regs(struct
- 	if (!drm_dev_enter(drm, &idx))
- 		return -ENODEV;
- 
-+	WARN_ON(pm_runtime_resume_and_get(&vc4_hdmi->pdev->dev));
-+
- 	drm_print_regset32(&p, &vc4_hdmi->hdmi_regset);
- 	drm_print_regset32(&p, &vc4_hdmi->hd_regset);
- 	drm_print_regset32(&p, &vc4_hdmi->cec_regset);
-@@ -194,6 +196,8 @@ static int vc4_hdmi_debugfs_regs(struct
- 	drm_print_regset32(&p, &vc4_hdmi->ram_regset);
- 	drm_print_regset32(&p, &vc4_hdmi->rm_regset);
- 
-+	pm_runtime_put(&vc4_hdmi->pdev->dev);
-+
- 	drm_dev_exit(idx);
- 
- 	return 0;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0598-drm-vc4-Move-the-buffer-offset-out-of-the-vc4_plane_.patch b/target/linux/bcm27xx/patches-6.6/950-0598-drm-vc4-Move-the-buffer-offset-out-of-the-vc4_plane_.patch
index ae069adc59381a..7a63bc65b50bf1 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0598-drm-vc4-Move-the-buffer-offset-out-of-the-vc4_plane_.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0598-drm-vc4-Move-the-buffer-offset-out-of-the-vc4_plane_.patch
@@ -23,7 +23,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_drv.h
 +++ b/drivers/gpu/drm/vc4/vc4_drv.h
-@@ -431,11 +431,6 @@ struct vc4_plane_state {
+@@ -432,11 +432,6 @@ struct vc4_plane_state {
  	bool is_unity;
  	bool is_yuv;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0599-drm-vc4-Fix-dlist-debug-not-resetting-the-next-entry.patch b/target/linux/bcm27xx/patches-6.6/950-0599-drm-vc4-Fix-dlist-debug-not-resetting-the-next-entry.patch
deleted file mode 100644
index bfaecc53caaf33..00000000000000
--- a/target/linux/bcm27xx/patches-6.6/950-0599-drm-vc4-Fix-dlist-debug-not-resetting-the-next-entry.patch
+++ /dev/null
@@ -1,34 +0,0 @@
-From d64998e5fc5894eb37f142b7259fa3bec091abbc Mon Sep 17 00:00:00 2001
-From: Dave Stevenson <dave.stevenson@raspberrypi.com>
-Date: Thu, 24 Aug 2023 15:36:21 +0100
-Subject: [PATCH 0599/1085] drm/vc4: Fix dlist debug not resetting the next
- entry pointer
-
-The debug function to display the dlists didn't reset next_entry_start
-when starting each display, so resulting in not stopping the
-list at the correct place.
-
-Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
----
- drivers/gpu/drm/vc4/vc4_hvs.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/drivers/gpu/drm/vc4/vc4_hvs.c
-+++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -110,7 +110,7 @@ static int vc4_hvs_debugfs_dlist(struct
- 	struct vc4_dev *vc4 = to_vc4_dev(dev);
- 	struct vc4_hvs *hvs = vc4->hvs;
- 	struct drm_printer p = drm_seq_file_printer(m);
--	unsigned int next_entry_start = 0;
-+	unsigned int next_entry_start;
- 	unsigned int i, j;
- 	u32 dlist_word, dispstat;
- 
-@@ -124,6 +124,7 @@ static int vc4_hvs_debugfs_dlist(struct
- 		}
- 
- 		drm_printf(&p, "HVS chan %u:\n", i);
-+		next_entry_start = 0;
- 
- 		for (j = HVS_READ(SCALER_DISPLISTX(i)); j < 256; j++) {
- 			dlist_word = readl((u32 __iomem *)vc4->hvs->dlist + j);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0600-drm-vc4-Remove-incorrect-limit-from-hvs_dlist-debugf.patch b/target/linux/bcm27xx/patches-6.6/950-0600-drm-vc4-Remove-incorrect-limit-from-hvs_dlist-debugf.patch
deleted file mode 100644
index a104d30b5a637a..00000000000000
--- a/target/linux/bcm27xx/patches-6.6/950-0600-drm-vc4-Remove-incorrect-limit-from-hvs_dlist-debugf.patch
+++ /dev/null
@@ -1,57 +0,0 @@
-From 480184600be75fd78dcff1502092901d32530cc6 Mon Sep 17 00:00:00 2001
-From: Dave Stevenson <dave.stevenson@raspberrypi.com>
-Date: Fri, 1 Sep 2023 13:45:08 +0100
-Subject: [PATCH 0600/1085] drm: vc4: Remove incorrect limit from hvs_dlist
- debugfs function
-
-The debugfs function to dump dlists aborted at 256 bytes,
-when actually the dlist memory is generally significantly
-larger but varies based on SoC.
-
-We already have the correct limit in __vc4_hvs_alloc, so
-store it for use in the debugfs dlist function.
-
-Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
----
- drivers/gpu/drm/vc4/vc4_drv.h | 1 +
- drivers/gpu/drm/vc4/vc4_hvs.c | 5 ++++-
- 2 files changed, 5 insertions(+), 1 deletion(-)
-
---- a/drivers/gpu/drm/vc4/vc4_drv.h
-+++ b/drivers/gpu/drm/vc4/vc4_drv.h
-@@ -327,6 +327,7 @@ struct vc4_hvs {
- 	struct platform_device *pdev;
- 	void __iomem *regs;
- 	u32 __iomem *dlist;
-+	unsigned int dlist_mem_size;
- 
- 	struct clk *core_clk;
- 
---- a/drivers/gpu/drm/vc4/vc4_hvs.c
-+++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -110,6 +110,7 @@ static int vc4_hvs_debugfs_dlist(struct
- 	struct vc4_dev *vc4 = to_vc4_dev(dev);
- 	struct vc4_hvs *hvs = vc4->hvs;
- 	struct drm_printer p = drm_seq_file_printer(m);
-+	unsigned int dlist_mem_size = hvs->dlist_mem_size;
- 	unsigned int next_entry_start;
- 	unsigned int i, j;
- 	u32 dlist_word, dispstat;
-@@ -126,7 +127,7 @@ static int vc4_hvs_debugfs_dlist(struct
- 		drm_printf(&p, "HVS chan %u:\n", i);
- 		next_entry_start = 0;
- 
--		for (j = HVS_READ(SCALER_DISPLISTX(i)); j < 256; j++) {
-+		for (j = HVS_READ(SCALER_DISPLISTX(i)); j < dlist_mem_size; j++) {
- 			dlist_word = readl((u32 __iomem *)vc4->hvs->dlist + j);
- 			drm_printf(&p, "dlist: %02d: 0x%08x\n", j,
- 				   dlist_word);
-@@ -1268,6 +1269,8 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
- 		    HVS_BOOTLOADER_DLIST_END,
- 		    (SCALER_DLIST_SIZE >> 2) - HVS_BOOTLOADER_DLIST_END);
- 
-+	hvs->dlist_mem_size = dlist_size;
-+
- 	/* Set up the HVS LBM memory manager.  We could have some more
- 	 * complicated data structure that allowed reuse of LBM areas
- 	 * between planes when they don't overlap on the screen, but
diff --git a/target/linux/bcm27xx/patches-6.6/950-0602-drm-vc4-Enable-SCALER_CONTROL-early-in-HVS-init.patch b/target/linux/bcm27xx/patches-6.6/950-0602-drm-vc4-Enable-SCALER_CONTROL-early-in-HVS-init.patch
index 56cd010972d09c..d694e865722a41 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0602-drm-vc4-Enable-SCALER_CONTROL-early-in-HVS-init.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0602-drm-vc4-Enable-SCALER_CONTROL-early-in-HVS-init.patch
@@ -15,7 +15,7 @@ Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -1293,6 +1293,10 @@ static int vc4_hvs_hw_init(struct vc4_hv
+@@ -1294,6 +1294,10 @@ static int vc4_hvs_hw_init(struct vc4_hv
  	struct vc4_dev *vc4 = hvs->vc4;
  	u32 dispctrl, reg;
  
@@ -26,7 +26,7 @@ Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
  	reg = HVS_READ(SCALER_DISPECTRL);
  	reg &= ~SCALER_DISPECTRL_DSP2_MUX_MASK;
  	HVS_WRITE(SCALER_DISPECTRL,
-@@ -1314,8 +1318,6 @@ static int vc4_hvs_hw_init(struct vc4_hv
+@@ -1315,8 +1319,6 @@ static int vc4_hvs_hw_init(struct vc4_hv
  		  reg | VC4_SET_FIELD(3, SCALER_DISPDITHER_DSP5_MUX));
  
  	dispctrl = HVS_READ(SCALER_DISPCTRL);
@@ -35,7 +35,7 @@ Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
  	dispctrl |= SCALER_DISPCTRL_DISPEIRQ(0) |
  		    SCALER_DISPCTRL_DISPEIRQ(1) |
  		    SCALER_DISPCTRL_DISPEIRQ(2);
-@@ -1511,6 +1513,10 @@ static int vc4_hvs_bind(struct device *d
+@@ -1523,6 +1525,10 @@ static int vc4_hvs_bind(struct device *d
  	else
  		hvs->dlist = hvs->regs + SCALER5_DLIST_START;
  
@@ -46,7 +46,7 @@ Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
  	/* Upload filter kernels.  We only have the one for now, so we
  	 * keep it around for the lifetime of the driver.
  	 */
-@@ -1520,10 +1526,6 @@ static int vc4_hvs_bind(struct device *d
+@@ -1532,10 +1538,6 @@ static int vc4_hvs_bind(struct device *d
  	if (ret)
  		return ret;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0610-drm-vc4-hvs-Support-BCM2712-HVS.patch b/target/linux/bcm27xx/patches-6.6/950-0610-drm-vc4-hvs-Support-BCM2712-HVS.patch
index 6065fc6e86b161..390d445497659f 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0610-drm-vc4-hvs-Support-BCM2712-HVS.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0610-drm-vc4-hvs-Support-BCM2712-HVS.patch
@@ -341,7 +341,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  static int vc5_hvs_debugfs_gamma(struct seq_file *m, void *data)
  {
  	struct drm_info_node *node = m->private;
-@@ -435,6 +558,10 @@ static void vc4_hvs_irq_enable_eof(struc
+@@ -438,6 +561,10 @@ static void vc4_hvs_irq_enable_eof(struc
  			  SCALER5_DISPCTRL_DSPEIEOF(channel));
  		break;
  
@@ -352,7 +352,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	default:
  		break;
  	}
-@@ -463,6 +590,10 @@ static void vc4_hvs_irq_clear_eof(struct
+@@ -466,6 +593,10 @@ static void vc4_hvs_irq_clear_eof(struct
  			  ~SCALER5_DISPCTRL_DSPEIEOF(channel));
  		break;
  
@@ -363,7 +363,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	default:
  		break;
  	}
-@@ -622,26 +753,32 @@ static void vc4_hvs_dlist_free_work(stru
+@@ -625,26 +756,32 @@ static void vc4_hvs_dlist_free_work(stru
  
  u8 vc4_hvs_get_fifo_frame_count(struct vc4_hvs *hvs, unsigned int fifo)
  {
@@ -410,7 +410,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	}
  
  	drm_dev_exit(idx);
-@@ -708,6 +845,23 @@ int vc4_hvs_get_fifo_from_output(struct
+@@ -711,6 +848,23 @@ int vc4_hvs_get_fifo_from_output(struct
  		default:
  			return -EPIPE;
  		}
@@ -434,7 +434,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	}
  
  	return -EPIPE;
-@@ -782,7 +936,41 @@ static int vc4_hvs_init_channel(struct v
+@@ -785,7 +939,41 @@ static int vc4_hvs_init_channel(struct v
  	return 0;
  }
  
@@ -477,7 +477,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  {
  	struct drm_device *drm = &hvs->vc4->base;
  	int idx;
-@@ -813,6 +1001,42 @@ out:
+@@ -814,6 +1002,42 @@ out:
  	drm_dev_exit(idx);
  }
  
@@ -520,7 +520,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  static int vc4_hvs_gamma_check(struct drm_crtc *crtc,
  			       struct drm_atomic_state *state)
  {
-@@ -907,8 +1131,14 @@ static void vc4_hvs_install_dlist(struct
+@@ -908,8 +1132,14 @@ static void vc4_hvs_install_dlist(struct
  		return;
  
  	WARN_ON(!vc4_state->mm);
@@ -537,7 +537,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	drm_dev_exit(idx);
  }
-@@ -965,7 +1195,11 @@ void vc4_hvs_atomic_enable(struct drm_cr
+@@ -966,7 +1196,11 @@ void vc4_hvs_atomic_enable(struct drm_cr
  
  	vc4_hvs_install_dlist(crtc);
  	vc4_hvs_update_dlist(crtc);
@@ -550,7 +550,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  }
  
  void vc4_hvs_atomic_disable(struct drm_crtc *crtc,
-@@ -1052,13 +1286,28 @@ void vc4_hvs_atomic_flush(struct drm_crt
+@@ -1053,13 +1287,28 @@ void vc4_hvs_atomic_flush(struct drm_crt
  	WARN_ON(!vc4_state->mm);
  	WARN_ON_ONCE(dlist_next - dlist_start != vc4_state->mm->mm_node.size);
  
@@ -583,7 +583,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	/* Only update DISPLIST if the CRTC was already running and is not
  	 * being disabled.
-@@ -1210,6 +1459,27 @@ static irqreturn_t vc4_hvs_irq_handler(i
+@@ -1212,6 +1461,27 @@ static irqreturn_t vc4_hvs_irq_handler(i
  	return irqret;
  }
  
@@ -611,7 +611,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  int vc4_hvs_debugfs_init(struct drm_minor *minor)
  {
  	struct drm_device *drm = minor->dev;
-@@ -1231,7 +1501,10 @@ int vc4_hvs_debugfs_init(struct drm_mino
+@@ -1233,7 +1503,10 @@ int vc4_hvs_debugfs_init(struct drm_mino
  				     NULL);
  	}
  
@@ -623,7 +623,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	drm_debugfs_add_file(drm, "hvs_underrun", vc4_hvs_debugfs_underrun, NULL);
  
-@@ -1246,6 +1519,9 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+@@ -1248,6 +1521,9 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
  {
  	struct drm_device *drm = &vc4->base;
  	struct vc4_hvs *hvs;
@@ -633,7 +633,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	hvs = drmm_kzalloc(drm, sizeof(*hvs), GFP_KERNEL);
  	if (!hvs)
-@@ -1260,14 +1536,39 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+@@ -1262,27 +1538,87 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
  	INIT_LIST_HEAD(&hvs->stale_dlist_entries);
  	INIT_WORK(&hvs->free_dlist_work, vc4_hvs_dlist_free_work);
  
@@ -642,9 +642,10 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 -	 * our 16K), since we don't want to scramble the screen when
 -	 * transitioning from the firmware's boot setup to runtime.
 -	 */
+-	hvs->dlist_mem_size = (SCALER_DLIST_SIZE >> 2) - HVS_BOOTLOADER_DLIST_END;
 -	drm_mm_init(&hvs->dlist_mm,
 -		    HVS_BOOTLOADER_DLIST_END,
--		    (SCALER_DLIST_SIZE >> 2) - HVS_BOOTLOADER_DLIST_END);
+-		    hvs->dlist_mem_size);
 +	switch (vc4->gen) {
 +	case VC4_GEN_4:
 +	case VC4_GEN_5:
@@ -678,10 +679,11 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
 +	}
 +
 +	drm_mm_init(&hvs->dlist_mm, dlist_start, dlist_size);
++
++	hvs->dlist_mem_size = dlist_size;
  
- 	hvs->dlist_mem_size = dlist_size;
- 
-@@ -1276,12 +1577,46 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+ 	/* Set up the HVS LBM memory manager.  We could have some more
+ 	 * complicated data structure that allowed reuse of LBM areas
  	 * between planes when they don't overlap on the screen, but
  	 * for now we just allocate globally.
  	 */
@@ -732,7 +734,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	vc4->hvs = hvs;
  
-@@ -1378,10 +1713,124 @@ static int vc4_hvs_hw_init(struct vc4_hv
+@@ -1390,10 +1726,124 @@ static int vc4_hvs_hw_init(struct vc4_hv
  	return 0;
  }
  
@@ -858,7 +860,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	/*
  	 * Recompute Composite Output Buffer (COB) allocations for the
-@@ -1442,6 +1891,31 @@ static int vc4_hvs_cob_init(struct vc4_h
+@@ -1454,6 +1904,31 @@ static int vc4_hvs_cob_init(struct vc4_h
  		HVS_WRITE(SCALER_DISPBASE0, reg);
  		break;
  
@@ -890,7 +892,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	default:
  		return -EINVAL;
  	}
-@@ -1467,10 +1941,16 @@ static int vc4_hvs_bind(struct device *d
+@@ -1479,10 +1954,16 @@ static int vc4_hvs_bind(struct device *d
  		return PTR_ERR(hvs);
  
  	hvs->regset.base = hvs->regs;
@@ -910,7 +912,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  		struct rpi_firmware *firmware;
  		struct device_node *node;
  		unsigned int max_rate;
-@@ -1484,12 +1964,20 @@ static int vc4_hvs_bind(struct device *d
+@@ -1496,12 +1977,20 @@ static int vc4_hvs_bind(struct device *d
  		if (!firmware)
  			return -EPROBE_DEFER;
  
@@ -932,7 +934,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  		max_rate = rpi_firmware_clk_get_max_rate(firmware,
  							 RPI_FIRMWARE_CORE_CLK_ID);
  		rpi_firmware_put(firmware);
-@@ -1506,14 +1994,51 @@ static int vc4_hvs_bind(struct device *d
+@@ -1518,14 +2007,51 @@ static int vc4_hvs_bind(struct device *d
  			dev_err(&pdev->dev, "Couldn't enable the core clock\n");
  			return ret;
  		}
@@ -988,7 +990,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	if (ret)
  		return ret;
  
-@@ -1530,10 +2055,12 @@ static int vc4_hvs_bind(struct device *d
+@@ -1542,10 +2068,12 @@ static int vc4_hvs_bind(struct device *d
  	if (ret)
  		return ret;
  
@@ -1005,7 +1007,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  
  	return 0;
  }
-@@ -1558,6 +2085,7 @@ static void vc4_hvs_unbind(struct device
+@@ -1570,6 +2098,7 @@ static void vc4_hvs_unbind(struct device
  		drm_mm_remove_node(node);
  	drm_mm_takedown(&vc4->hvs->lbm_mm);
  
@@ -1013,7 +1015,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	clk_disable_unprepare(hvs->core_clk);
  
  	vc4->hvs = NULL;
-@@ -1580,6 +2108,7 @@ static void vc4_hvs_dev_remove(struct pl
+@@ -1592,6 +2121,7 @@ static void vc4_hvs_dev_remove(struct pl
  
  static const struct of_device_id vc4_hvs_dt_match[] = {
  	{ .compatible = "brcm,bcm2711-hvs" },
diff --git a/target/linux/bcm27xx/patches-6.6/950-0622-drm-vc4-Add-additional-warn_on.patch b/target/linux/bcm27xx/patches-6.6/950-0622-drm-vc4-Add-additional-warn_on.patch
index 2fc6f3d033e065..8dd44970f8b9b9 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0622-drm-vc4-Add-additional-warn_on.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0622-drm-vc4-Add-additional-warn_on.patch
@@ -32,7 +32,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	if (!drm_dev_enter(drm, &idx))
  		return;
  
-@@ -758,6 +761,8 @@ u8 vc4_hvs_get_fifo_frame_count(struct v
+@@ -761,6 +764,8 @@ u8 vc4_hvs_get_fifo_frame_count(struct v
  	u8 field = 0;
  	int idx;
  
@@ -41,7 +41,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	if (!drm_dev_enter(drm, &idx))
  		return 0;
  
-@@ -791,6 +796,8 @@ int vc4_hvs_get_fifo_from_output(struct
+@@ -794,6 +799,8 @@ int vc4_hvs_get_fifo_from_output(struct
  	u32 reg;
  	int ret;
  
@@ -50,7 +50,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	switch (vc4->gen) {
  	case VC4_GEN_4:
  		return output;
-@@ -880,6 +887,8 @@ static int vc4_hvs_init_channel(struct v
+@@ -883,6 +890,8 @@ static int vc4_hvs_init_channel(struct v
  	u32 dispctrl;
  	int idx;
  
@@ -59,7 +59,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	if (!drm_dev_enter(drm, &idx))
  		return -ENODEV;
  
-@@ -947,6 +956,8 @@ static int vc6_hvs_init_channel(struct v
+@@ -950,6 +959,8 @@ static int vc6_hvs_init_channel(struct v
  	u32 disp_ctrl1;
  	int idx;
  
@@ -68,7 +68,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	if (!drm_dev_enter(drm, &idx))
  		return -ENODEV;
  
-@@ -972,9 +983,12 @@ static int vc6_hvs_init_channel(struct v
+@@ -975,9 +986,12 @@ static int vc6_hvs_init_channel(struct v
  
  static void __vc4_hvs_stop_channel(struct vc4_hvs *hvs, unsigned int chan)
  {
@@ -82,7 +82,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	if (!drm_dev_enter(drm, &idx))
  		return;
  
-@@ -1007,6 +1021,8 @@ static void __vc6_hvs_stop_channel(struc
+@@ -1008,6 +1022,8 @@ static void __vc6_hvs_stop_channel(struc
  	struct drm_device *drm = &vc4->base;
  	int idx;
  
@@ -91,7 +91,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	if (!drm_dev_enter(drm, &idx))
  		return;
  
-@@ -1234,6 +1250,8 @@ void vc4_hvs_atomic_flush(struct drm_crt
+@@ -1235,6 +1251,8 @@ void vc4_hvs_atomic_flush(struct drm_crt
  	bool found = false;
  	int idx;
  
@@ -100,7 +100,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	if (!drm_dev_enter(dev, &idx)) {
  		vc4_crtc_send_vblank(crtc);
  		return;
-@@ -1324,6 +1342,8 @@ void vc4_hvs_atomic_flush(struct drm_crt
+@@ -1325,6 +1343,8 @@ void vc4_hvs_atomic_flush(struct drm_crt
  	if (crtc->state->color_mgmt_changed) {
  		u32 dispbkgndx = HVS_READ(SCALER_DISPBKGNDX(channel));
  
@@ -109,7 +109,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  		if (crtc->state->gamma_lut) {
  			if (vc4->gen == VC4_GEN_4) {
  				vc4_hvs_update_gamma_lut(hvs, vc4_crtc);
-@@ -1363,6 +1383,8 @@ void vc4_hvs_mask_underrun(struct vc4_hv
+@@ -1365,6 +1385,8 @@ void vc4_hvs_mask_underrun(struct vc4_hv
  	u32 dispctrl;
  	int idx;
  
@@ -118,7 +118,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	if (!drm_dev_enter(drm, &idx))
  		return;
  
-@@ -1383,6 +1405,8 @@ void vc4_hvs_unmask_underrun(struct vc4_
+@@ -1385,6 +1407,8 @@ void vc4_hvs_unmask_underrun(struct vc4_
  	u32 dispctrl;
  	int idx;
  
@@ -127,7 +127,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	if (!drm_dev_enter(drm, &idx))
  		return;
  
-@@ -1417,6 +1441,8 @@ static irqreturn_t vc4_hvs_irq_handler(i
+@@ -1419,6 +1443,8 @@ static irqreturn_t vc4_hvs_irq_handler(i
  	u32 status;
  	u32 dspeislur;
  
@@ -136,7 +136,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	/*
  	 * NOTE: We don't need to protect the register access using
  	 * drm_dev_enter() there because the interrupt handler lifetime
-@@ -1466,6 +1492,8 @@ static irqreturn_t vc6_hvs_eof_irq_handl
+@@ -1468,6 +1494,8 @@ static irqreturn_t vc6_hvs_eof_irq_handl
  	struct vc4_hvs *hvs = vc4->hvs;
  	unsigned int i;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0624-drm-vc4-tests-Drop-drm-parameter-for-vc4_find_crtc_f.patch b/target/linux/bcm27xx/patches-6.6/950-0624-drm-vc4-tests-Drop-drm-parameter-for-vc4_find_crtc_f.patch
index 4c3046b0b8992e..ebc301871622c4 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0624-drm-vc4-tests-Drop-drm-parameter-for-vc4_find_crtc_f.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0624-drm-vc4-tests-Drop-drm-parameter-for-vc4_find_crtc_f.patch
@@ -32,24 +32,24 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  	KUNIT_ASSERT_EQ(test, hweight32(encoder->possible_crtcs), 1);
 --- a/drivers/gpu/drm/vc4/tests/vc4_mock_output.c
 +++ b/drivers/gpu/drm/vc4/tests/vc4_mock_output.c
-@@ -77,7 +77,7 @@ int vc4_mock_atomic_add_output(struct ku
- 	encoder = vc4_find_encoder_by_type(drm, type);
- 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, encoder);
+@@ -78,7 +78,7 @@ int vc4_mock_atomic_add_output(struct ku
+ 	if (!encoder)
+ 		return -ENODEV;
  
 -	crtc = vc4_find_crtc_for_encoder(test, drm, encoder);
 +	crtc = vc4_find_crtc_for_encoder(test, encoder);
- 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, crtc);
+ 	if (!crtc)
+ 		return -ENODEV;
  
- 	output = encoder_to_vc4_dummy_output(encoder);
-@@ -115,7 +115,7 @@ int vc4_mock_atomic_del_output(struct ku
- 	encoder = vc4_find_encoder_by_type(drm, type);
- 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, encoder);
+@@ -122,7 +122,7 @@ int vc4_mock_atomic_del_output(struct ku
+ 	if (!encoder)
+ 		return -ENODEV;
  
 -	crtc = vc4_find_crtc_for_encoder(test, drm, encoder);
 +	crtc = vc4_find_crtc_for_encoder(test, encoder);
- 	KUNIT_ASSERT_NOT_ERR_OR_NULL(test, crtc);
+ 	if (!crtc)
+ 		return -ENODEV;
  
- 	crtc_state = drm_atomic_get_crtc_state(state, crtc);
 --- a/drivers/gpu/drm/vc4/tests/vc4_test_pv_muxing.c
 +++ b/drivers/gpu/drm/vc4/tests/vc4_test_pv_muxing.c
 @@ -131,7 +131,7 @@ get_vc4_crtc_state_for_encoder(struct ku
diff --git a/target/linux/bcm27xx/patches-6.6/950-0625-drm-vc4-tests-Return-the-allocated-output.patch b/target/linux/bcm27xx/patches-6.6/950-0625-drm-vc4-tests-Return-the-allocated-output.patch
index 50291da98f7bf8..023da29375fbcb 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0625-drm-vc4-tests-Return-the-allocated-output.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0625-drm-vc4-tests-Return-the-allocated-output.patch
@@ -49,7 +49,7 @@ Signed-off-by: Maxime Ripard <maxime@cerno.tech>
  {
  	struct drm_device *drm = state->dev;
  	struct drm_connector_state *conn_state;
-@@ -96,7 +97,7 @@ int vc4_mock_atomic_add_output(struct ku
+@@ -102,7 +103,7 @@ int vc4_mock_atomic_add_output(struct ku
  
  	crtc_state->active = true;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0636-drm-panel-simple-Alter-the-timing-for-the-Pi-7-DSI-d.patch b/target/linux/bcm27xx/patches-6.6/950-0636-drm-panel-simple-Alter-the-timing-for-the-Pi-7-DSI-d.patch
index b72020d7e4173e..667841c8f56ab2 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0636-drm-panel-simple-Alter-the-timing-for-the-Pi-7-DSI-d.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0636-drm-panel-simple-Alter-the-timing-for-the-Pi-7-DSI-d.patch
@@ -16,7 +16,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/panel/panel-simple.c
 +++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -3438,11 +3438,11 @@ static const struct panel_desc rocktech_
+@@ -3439,11 +3439,11 @@ static const struct panel_desc rocktech_
  };
  
  static const struct drm_display_mode raspberrypi_7inch_mode = {
diff --git a/target/linux/bcm27xx/patches-6.6/950-0655-vc4-drm-Remove-the-clear-of-SCALER_DISPBKGND_FILL.patch b/target/linux/bcm27xx/patches-6.6/950-0655-vc4-drm-Remove-the-clear-of-SCALER_DISPBKGND_FILL.patch
index fa57c12cf62878..5b2ac385c16fdf 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0655-vc4-drm-Remove-the-clear-of-SCALER_DISPBKGND_FILL.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0655-vc4-drm-Remove-the-clear-of-SCALER_DISPBKGND_FILL.patch
@@ -25,7 +25,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -1304,27 +1304,25 @@ void vc4_hvs_atomic_flush(struct drm_crt
+@@ -1305,27 +1305,25 @@ void vc4_hvs_atomic_flush(struct drm_crt
  	WARN_ON(!vc4_state->mm);
  	WARN_ON_ONCE(dlist_next - dlist_start != vc4_state->mm->mm_node.size);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0661-gpio-brcmstb-Use-dynamic-GPIO-base-numbers.patch b/target/linux/bcm27xx/patches-6.6/950-0661-gpio-brcmstb-Use-dynamic-GPIO-base-numbers.patch
index 1f0907f39994fe..2886d9427fc80b 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0661-gpio-brcmstb-Use-dynamic-GPIO-base-numbers.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0661-gpio-brcmstb-Use-dynamic-GPIO-base-numbers.patch
@@ -61,8 +61,8 @@ Fixes: 3b0213d56eb7 ("gpio: Add GPIO support for Broadcom STB SoCs")
  	if (offset >= gc->ngpio || offset < 0)
  		return -EINVAL;
  
-@@ -598,8 +598,8 @@ static int brcmstb_gpio_probe(struct pla
- 	const __be32 *p;
+@@ -596,8 +596,8 @@ static int brcmstb_gpio_probe(struct pla
+ 	struct resource *res;
  	u32 bank_width;
  	int num_banks = 0;
 +	int num_gpios = 0;
@@ -71,7 +71,7 @@ Fixes: 3b0213d56eb7 ("gpio: Add GPIO support for Broadcom STB SoCs")
  	unsigned long flags = 0;
  	bool need_wakeup_event = false;
  
-@@ -613,7 +613,6 @@ static int brcmstb_gpio_probe(struct pla
+@@ -611,7 +611,6 @@ static int brcmstb_gpio_probe(struct pla
  	if (IS_ERR(reg_base))
  		return PTR_ERR(reg_base);
  
@@ -79,7 +79,7 @@ Fixes: 3b0213d56eb7 ("gpio: Add GPIO support for Broadcom STB SoCs")
  	priv->reg_base = reg_base;
  	priv->pdev = pdev;
  
-@@ -655,7 +654,7 @@ static int brcmstb_gpio_probe(struct pla
+@@ -652,7 +651,7 @@ static int brcmstb_gpio_probe(struct pla
  			dev_dbg(dev, "Width 0 found: Empty bank @ %d\n",
  				num_banks);
  			num_banks++;
@@ -88,7 +88,7 @@ Fixes: 3b0213d56eb7 ("gpio: Add GPIO support for Broadcom STB SoCs")
  			continue;
  		}
  
-@@ -697,7 +696,7 @@ static int brcmstb_gpio_probe(struct pla
+@@ -694,7 +693,7 @@ static int brcmstb_gpio_probe(struct pla
  			err = -ENOMEM;
  			goto fail;
  		}
@@ -97,7 +97,7 @@ Fixes: 3b0213d56eb7 ("gpio: Add GPIO support for Broadcom STB SoCs")
  		gc->of_gpio_n_cells = 2;
  		gc->of_xlate = brcmstb_gpio_of_xlate;
  		/* not all ngpio lines are valid, will use bank width later */
-@@ -721,7 +720,7 @@ static int brcmstb_gpio_probe(struct pla
+@@ -718,7 +717,7 @@ static int brcmstb_gpio_probe(struct pla
  					bank->id);
  			goto fail;
  		}
@@ -106,7 +106,7 @@ Fixes: 3b0213d56eb7 ("gpio: Add GPIO support for Broadcom STB SoCs")
  
  		dev_dbg(dev, "bank=%d, base=%d, ngpio=%d, width=%d\n", bank->id,
  			gc->base, gc->ngpio, bank->width);
-@@ -732,7 +731,7 @@ static int brcmstb_gpio_probe(struct pla
+@@ -729,7 +728,7 @@ static int brcmstb_gpio_probe(struct pla
  		num_banks++;
  	}
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0669-input-touchscreen-edt-ft5x06-Suppress-bogus-data-on-.patch b/target/linux/bcm27xx/patches-6.6/950-0669-input-touchscreen-edt-ft5x06-Suppress-bogus-data-on-.patch
index b3bf708ade9b56..9019a430493645 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0669-input-touchscreen-edt-ft5x06-Suppress-bogus-data-on-.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0669-input-touchscreen-edt-ft5x06-Suppress-bogus-data-on-.patch
@@ -58,7 +58,7 @@ Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
  		if (!error && num_points)
  			error = regmap_bulk_read(tsdata->regmap,
  						 tsdata->tdata_offset,
-@@ -1300,7 +1318,7 @@ static int edt_ft5x06_ts_probe(struct i2
+@@ -1318,7 +1336,7 @@ static int edt_ft5x06_ts_probe(struct i2
  	if (tsdata->reset_gpio) {
  		usleep_range(5000, 6000);
  		gpiod_set_value_cansleep(tsdata->reset_gpio, 0);
@@ -67,7 +67,7 @@ Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
  	}
  
  	input = devm_input_allocate_device(&client->dev);
-@@ -1389,11 +1407,12 @@ static int edt_ft5x06_ts_probe(struct i2
+@@ -1407,11 +1425,12 @@ static int edt_ft5x06_ts_probe(struct i2
  			return error;
  		}
  	} else {
diff --git a/target/linux/bcm27xx/patches-6.6/950-0678-fbdev-Allow-client-to-request-a-particular-dev-fbN-n.patch b/target/linux/bcm27xx/patches-6.6/950-0678-fbdev-Allow-client-to-request-a-particular-dev-fbN-n.patch
index ee15b7969c2f26..767ead3e2d05f8 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0678-fbdev-Allow-client-to-request-a-particular-dev-fbN-n.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0678-fbdev-Allow-client-to-request-a-particular-dev-fbN-n.patch
@@ -23,33 +23,40 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  #define for_each_registered_fb(i)		\
  	for (i = 0; i < FB_MAX; i++)		\
  		if (!registered_fb[i]) {} else
-@@ -938,10 +939,12 @@ static int do_register_framebuffer(struc
+@@ -939,9 +940,12 @@ static int do_register_framebuffer(struc
+ 	if (num_registered_fb == FB_MAX)
  		return -ENXIO;
  
- 	num_registered_fb++;
 -	for (i = 0 ; i < FB_MAX; i++)
 -		if (!registered_fb[i])
 -			break;
--	fb_info->node = i;
 +	if (!fb_info->custom_fb_num || fb_info->node >= FB_MAX || registered_fb[fb_info->node]) {
 +		for (i = min_dynamic_fb ; i < FB_MAX; i++)
 +			if (!registered_fb[i])
 +				break;
 +		fb_info->node = i;
 +	}
+ 
+ 	if (i >= FB_MAX)
+ 		return -ENXIO;
+@@ -954,7 +958,6 @@ static int do_register_framebuffer(struc
+ 	if (err < 0)
+ 		return err;
+ 
+-	fb_info->node = i;
  	refcount_set(&fb_info->count, 1);
  	mutex_init(&fb_info->lock);
  	mutex_init(&fb_info->mm_lock);
-@@ -976,7 +979,7 @@ static int do_register_framebuffer(struc
+@@ -985,7 +988,7 @@ static int do_register_framebuffer(struc
+ 		pm_vt_switch_required(fb_info->device, true);
  
- 	fb_var_to_videomode(&mode, &fb_info->var);
- 	fb_add_videomode(&mode, &fb_info->modelist);
+ 	num_registered_fb++;
 -	registered_fb[i] = fb_info;
 +	registered_fb[fb_info->node] = fb_info;
  
  #ifdef CONFIG_GUMSTIX_AM200EPD
  	{
-@@ -1037,6 +1040,12 @@ static void do_unregister_framebuffer(st
+@@ -1046,6 +1049,12 @@ static void do_unregister_framebuffer(st
  	put_fb_info(fb_info);
  }
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0679-drm-fb-helper-Look-up-preferred-fbdev-node-number-fr.patch b/target/linux/bcm27xx/patches-6.6/950-0679-drm-fb-helper-Look-up-preferred-fbdev-node-number-fr.patch
index f94efc25b24ea8..0b2b28b7f1c8d8 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0679-drm-fb-helper-Look-up-preferred-fbdev-node-number-fr.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0679-drm-fb-helper-Look-up-preferred-fbdev-node-number-fr.patch
@@ -15,7 +15,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/drm_fb_helper.c
 +++ b/drivers/gpu/drm/drm_fb_helper.c
-@@ -1851,7 +1851,7 @@ __drm_fb_helper_initial_config_and_unloc
+@@ -1853,7 +1853,7 @@ __drm_fb_helper_initial_config_and_unloc
  	struct drm_device *dev = fb_helper->dev;
  	struct fb_info *info;
  	unsigned int width, height;
@@ -24,7 +24,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  
  	width = dev->mode_config.max_width;
  	height = dev->mode_config.max_height;
-@@ -1879,6 +1879,15 @@ __drm_fb_helper_initial_config_and_unloc
+@@ -1881,6 +1881,15 @@ __drm_fb_helper_initial_config_and_unloc
  	 * register the fbdev emulation instance in kernel_fb_helper_list. */
  	mutex_unlock(&fb_helper->lock);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0684-drm-fb_helper-Change-query-for-FB-designation-from-d.patch b/target/linux/bcm27xx/patches-6.6/950-0684-drm-fb_helper-Change-query-for-FB-designation-from-d.patch
index 60cabdffc31653..a63bd11af4efbf 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0684-drm-fb_helper-Change-query-for-FB-designation-from-d.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0684-drm-fb_helper-Change-query-for-FB-designation-from-d.patch
@@ -12,7 +12,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/drm_fb_helper.c
 +++ b/drivers/gpu/drm/drm_fb_helper.c
-@@ -1879,11 +1879,11 @@ __drm_fb_helper_initial_config_and_unloc
+@@ -1881,11 +1881,11 @@ __drm_fb_helper_initial_config_and_unloc
  	 * register the fbdev emulation instance in kernel_fb_helper_list. */
  	mutex_unlock(&fb_helper->lock);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0695-PCI-brcmstb-Change-RCB_-MPS-64B-_MODE-bits.patch b/target/linux/bcm27xx/patches-6.6/950-0695-PCI-brcmstb-Change-RCB_-MPS-64B-_MODE-bits.patch
index dba20dc8544ae8..70d8229b4433ad 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0695-PCI-brcmstb-Change-RCB_-MPS-64B-_MODE-bits.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0695-PCI-brcmstb-Change-RCB_-MPS-64B-_MODE-bits.patch
@@ -45,7 +45,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	writel(tmp, base + PCIE_MISC_MISC_CTRL);
  
  	brcm_pcie_set_tc_qos(pcie);
-@@ -1917,6 +1918,7 @@ static int brcm_pcie_probe(struct platfo
+@@ -1918,6 +1919,7 @@ static int brcm_pcie_probe(struct platfo
  
  	pcie->ssc = of_property_read_bool(np, "brcm,enable-ssc");
  	pcie->l1ss = of_property_read_bool(np, "brcm,enable-l1ss");
diff --git a/target/linux/bcm27xx/patches-6.6/950-0697-drivers-pci-brcmstb-optionally-extend-Tperst_clk-tim.patch b/target/linux/bcm27xx/patches-6.6/950-0697-drivers-pci-brcmstb-optionally-extend-Tperst_clk-tim.patch
index a0006d6a5a1403..604cf21b10ad3e 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0697-drivers-pci-brcmstb-optionally-extend-Tperst_clk-tim.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0697-drivers-pci-brcmstb-optionally-extend-Tperst_clk-tim.patch
@@ -61,7 +61,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  
  	/*
  	 * Wait for 100ms after PERST# deassertion; see PCIe CEM specification
-@@ -1919,6 +1940,7 @@ static int brcm_pcie_probe(struct platfo
+@@ -1920,6 +1941,7 @@ static int brcm_pcie_probe(struct platfo
  	pcie->ssc = of_property_read_bool(np, "brcm,enable-ssc");
  	pcie->l1ss = of_property_read_bool(np, "brcm,enable-l1ss");
  	pcie->rcb_mps_mode = of_property_read_bool(np, "brcm,enable-mps-rcb");
diff --git a/target/linux/bcm27xx/patches-6.6/950-0708-drm-vc4-Correct-logic-on-stopping-an-HVS-channel.patch b/target/linux/bcm27xx/patches-6.6/950-0708-drm-vc4-Correct-logic-on-stopping-an-HVS-channel.patch
deleted file mode 100644
index 46b5afaa96b7d2..00000000000000
--- a/target/linux/bcm27xx/patches-6.6/950-0708-drm-vc4-Correct-logic-on-stopping-an-HVS-channel.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-From 48016174777294ea86103946f71e25bb04f647a1 Mon Sep 17 00:00:00 2001
-From: Dave Stevenson <dave.stevenson@raspberrypi.com>
-Date: Thu, 26 Oct 2023 17:46:13 +0100
-Subject: [PATCH 0708/1085] drm/vc4: Correct logic on stopping an HVS channel
-
-When factoring out __vc4_hvs_stop_channel, the logic got inverted from
-	if (condition)
-	  // stop channel
-to
-	if (condition)
-	  goto out
-	//stop channel
-	out:
-and also changed the exact register writes used to stop the channel.
-
-Correct the logic so that the channel is actually stopped, and revert
-to the original register writes.
-
-Fixes: 6d01a106b4c8 ("drm/vc4: crtc: Move HVS init and close to a function")
-Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
----
- drivers/gpu/drm/vc4/vc4_hvs.c | 10 ++++------
- 1 file changed, 4 insertions(+), 6 deletions(-)
-
---- a/drivers/gpu/drm/vc4/vc4_hvs.c
-+++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -992,13 +992,11 @@ static void __vc4_hvs_stop_channel(struc
- 	if (!drm_dev_enter(drm, &idx))
- 		return;
- 
--	if (HVS_READ(SCALER_DISPCTRLX(chan)) & SCALER_DISPCTRLX_ENABLE)
-+	if (!(HVS_READ(SCALER_DISPCTRLX(chan)) & SCALER_DISPCTRLX_ENABLE))
- 		goto out;
- 
--	HVS_WRITE(SCALER_DISPCTRLX(chan),
--		  HVS_READ(SCALER_DISPCTRLX(chan)) | SCALER_DISPCTRLX_RESET);
--	HVS_WRITE(SCALER_DISPCTRLX(chan),
--		  HVS_READ(SCALER_DISPCTRLX(chan)) & ~SCALER_DISPCTRLX_ENABLE);
-+	HVS_WRITE(SCALER_DISPCTRLX(chan), SCALER_DISPCTRLX_RESET);
-+	HVS_WRITE(SCALER_DISPCTRLX(chan), 0);
- 
- 	/* Once we leave, the scaler should be disabled and its fifo empty. */
- 	WARN_ON_ONCE(HVS_READ(SCALER_DISPCTRLX(chan)) & SCALER_DISPCTRLX_RESET);
-@@ -1026,7 +1024,7 @@ static void __vc6_hvs_stop_channel(struc
- 	if (!drm_dev_enter(drm, &idx))
- 		return;
- 
--	if (HVS_READ(SCALER6_DISPX_CTRL0(chan)) & SCALER6_DISPX_CTRL0_ENB)
-+	if (!(HVS_READ(SCALER6_DISPX_CTRL0(chan)) & SCALER6_DISPX_CTRL0_ENB))
- 		goto out;
- 
- 	HVS_WRITE(SCALER6_DISPX_CTRL0(chan),
diff --git a/target/linux/bcm27xx/patches-6.6/950-0709-drm-vc4-Drop-WARN-for-HVS-FIFOs-not-being-empty.patch b/target/linux/bcm27xx/patches-6.6/950-0709-drm-vc4-Drop-WARN-for-HVS-FIFOs-not-being-empty.patch
index 0d4f6a4ea905b6..d43ed3f7d76b31 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0709-drm-vc4-Drop-WARN-for-HVS-FIFOs-not-being-empty.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0709-drm-vc4-Drop-WARN-for-HVS-FIFOs-not-being-empty.patch
@@ -17,7 +17,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -1005,10 +1005,6 @@ static void __vc4_hvs_stop_channel(struc
+@@ -1008,10 +1008,6 @@ static void __vc4_hvs_stop_channel(struc
  				   SCALER_DISPSTATX_MODE) !=
  		     SCALER_DISPSTATX_MODE_DISABLED);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0710-drm-vc4-Free-all-stale-dlists-if-channel-is-disabled.patch b/target/linux/bcm27xx/patches-6.6/950-0710-drm-vc4-Free-all-stale-dlists-if-channel-is-disabled.patch
index 53f2684f3be612..6651fac56e1df9 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0710-drm-vc4-Free-all-stale-dlists-if-channel-is-disabled.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0710-drm-vc4-Free-all-stale-dlists-if-channel-is-disabled.patch
@@ -36,7 +36,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  	 * someone was waiting it.
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -697,7 +697,8 @@ static void vc4_hvs_schedule_dlist_sweep
+@@ -700,7 +700,8 @@ static void vc4_hvs_schedule_dlist_sweep
  	if (!list_empty(&hvs->stale_dlist_entries))
  		queue_work(system_unbound_wq, &hvs->free_dlist_work);
  
@@ -46,7 +46,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  
  	spin_unlock_irqrestore(&hvs->mm_lock, flags);
  }
-@@ -712,6 +713,27 @@ static bool vc4_hvs_frcnt_lte(u8 cnt1, u
+@@ -715,6 +716,27 @@ static bool vc4_hvs_frcnt_lte(u8 cnt1, u
  	return (s8)((cnt1 << 2) - (cnt2 << 2)) <= 0;
  }
  
@@ -74,7 +74,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  /*
   * Some atomic commits (legacy cursor updates, mostly) will not wait for
   * the next vblank and will just return once the commit has been pushed
-@@ -746,7 +768,8 @@ static void vc4_hvs_dlist_free_work(stru
+@@ -749,7 +771,8 @@ static void vc4_hvs_dlist_free_work(stru
  		u8 frcnt;
  
  		frcnt = vc4_hvs_get_fifo_frame_count(hvs, cur->channel);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0711-drm-vc4-Add-hvs_dlist_allocs-debugfs-function.patch b/target/linux/bcm27xx/patches-6.6/950-0711-drm-vc4-Add-hvs_dlist_allocs-debugfs-function.patch
index e8e93d5e80a88b..d8a60aadbfd0a4 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0711-drm-vc4-Add-hvs_dlist_allocs-debugfs-function.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0711-drm-vc4-Add-hvs_dlist_allocs-debugfs-function.patch
@@ -50,7 +50,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  /* The filter kernel is composed of dwords each containing 3 9-bit
   * signed integers packed next to each other.
   */
-@@ -1551,6 +1581,8 @@ int vc4_hvs_debugfs_init(struct drm_mino
+@@ -1555,6 +1585,8 @@ int vc4_hvs_debugfs_init(struct drm_mino
  
  	drm_debugfs_add_file(drm, "hvs_underrun", vc4_hvs_debugfs_underrun, NULL);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0712-drm-vc4-Log-the-size-of-the-dlist-allocation-that-wa.patch b/target/linux/bcm27xx/patches-6.6/950-0712-drm-vc4-Log-the-size-of-the-dlist-allocation-that-wa.patch
index 484d1e36763b55..65c02feda08c78 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0712-drm-vc4-Log-the-size-of-the-dlist-allocation-that-wa.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0712-drm-vc4-Log-the-size-of-the-dlist-allocation-that-wa.patch
@@ -11,7 +11,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -659,7 +659,8 @@ vc4_hvs_alloc_dlist_entry(struct vc4_hvs
+@@ -662,7 +662,8 @@ vc4_hvs_alloc_dlist_entry(struct vc4_hvs
  				 dlist_count);
  	spin_unlock_irqrestore(&hvs->mm_lock, flags);
  	if (ret) {
diff --git a/target/linux/bcm27xx/patches-6.6/950-0732-ASoC-dwc-Remove-check-in-set_bclk_ratio-handling.patch b/target/linux/bcm27xx/patches-6.6/950-0732-ASoC-dwc-Remove-check-in-set_bclk_ratio-handling.patch
index d6eb8cbbaa0a26..0112ecad7879e4 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0732-ASoC-dwc-Remove-check-in-set_bclk_ratio-handling.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0732-ASoC-dwc-Remove-check-in-set_bclk_ratio-handling.patch
@@ -18,7 +18,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/sound/soc/dwc/dwc-i2s.c
 +++ b/sound/soc/dwc/dwc-i2s.c
-@@ -528,11 +528,8 @@ static int dw_i2s_set_bclk_ratio(struct
+@@ -527,11 +527,8 @@ static int dw_i2s_set_bclk_ratio(struct
  				 unsigned int ratio)
  {
  	struct dw_i2s_dev *dev = snd_soc_dai_get_drvdata(cpu_dai);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0737-media-i2c-ov7251-Switch-from-V4L2_CID_GAIN-to-V4L2_C.patch b/target/linux/bcm27xx/patches-6.6/950-0737-media-i2c-ov7251-Switch-from-V4L2_CID_GAIN-to-V4L2_C.patch
index 31e1a5cfd4e203..f71ca4cdf75af0 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0737-media-i2c-ov7251-Switch-from-V4L2_CID_GAIN-to-V4L2_C.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0737-media-i2c-ov7251-Switch-from-V4L2_CID_GAIN-to-V4L2_C.patch
@@ -18,7 +18,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/media/i2c/ov7251.c
 +++ b/drivers/media/i2c/ov7251.c
-@@ -1063,7 +1063,7 @@ static int ov7251_s_ctrl(struct v4l2_ctr
+@@ -1065,7 +1065,7 @@ static int ov7251_s_ctrl(struct v4l2_ctr
  	case V4L2_CID_EXPOSURE:
  		ret = ov7251_set_exposure(ov7251, ctrl->val);
  		break;
@@ -27,7 +27,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  		ret = ov7251_set_gain(ov7251, ctrl->val);
  		break;
  	case V4L2_CID_TEST_PATTERN:
-@@ -1588,7 +1588,7 @@ static int ov7251_init_ctrls(struct ov72
+@@ -1590,7 +1590,7 @@ static int ov7251_init_ctrls(struct ov72
  	ov7251->exposure = v4l2_ctrl_new_std(&ov7251->ctrls, &ov7251_ctrl_ops,
  					     V4L2_CID_EXPOSURE, 1, 32, 1, 32);
  	ov7251->gain = v4l2_ctrl_new_std(&ov7251->ctrls, &ov7251_ctrl_ops,
diff --git a/target/linux/bcm27xx/patches-6.6/950-0740-drm-vc4-Free-the-dlist-alloc-immediately-if-it-never.patch b/target/linux/bcm27xx/patches-6.6/950-0740-drm-vc4-Free-the-dlist-alloc-immediately-if-it-never.patch
index dced86878d1eb8..b28ae3c4a1456b 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0740-drm-vc4-Free-the-dlist-alloc-immediately-if-it-never.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0740-drm-vc4-Free-the-dlist-alloc-immediately-if-it-never.patch
@@ -33,7 +33,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  struct vc4_crtc_state {
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -697,8 +697,11 @@ void vc4_hvs_mark_dlist_entry_stale(stru
+@@ -700,8 +700,11 @@ void vc4_hvs_mark_dlist_entry_stale(stru
  	 * Kunit tests run with a mock device and we consider any hardware
  	 * access a test failure. Let's free the dlist allocation right away if
  	 * we're running under kunit, we won't risk a dlist corruption anyway.
@@ -46,7 +46,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  		spin_lock_irqsave(&hvs->mm_lock, flags);
  		vc4_hvs_free_dlist_entry_locked(hvs, alloc);
  		spin_unlock_irqrestore(&hvs->mm_lock, flags);
-@@ -1195,6 +1198,7 @@ static void vc4_hvs_install_dlist(struct
+@@ -1198,6 +1201,7 @@ static void vc4_hvs_install_dlist(struct
  		return;
  
  	WARN_ON(!vc4_state->mm);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0750-ASoC-dwc-Permit-sample-rates-up-to-384kHz.patch b/target/linux/bcm27xx/patches-6.6/950-0750-ASoC-dwc-Permit-sample-rates-up-to-384kHz.patch
index 4a7aaad3a228fc..8bf58f54cfe0cc 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0750-ASoC-dwc-Permit-sample-rates-up-to-384kHz.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0750-ASoC-dwc-Permit-sample-rates-up-to-384kHz.patch
@@ -15,7 +15,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/sound/soc/dwc/dwc-i2s.c
 +++ b/sound/soc/dwc/dwc-i2s.c
-@@ -796,7 +796,7 @@ static int dw_configure_dai_by_dt(struct
+@@ -795,7 +795,7 @@ static int dw_configure_dai_by_dt(struct
  	u32 idx2;
  	int ret;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0752-ASoC-dwc-Fix-full-duplex-mode.patch b/target/linux/bcm27xx/patches-6.6/950-0752-ASoC-dwc-Fix-full-duplex-mode.patch
index cffdd3302722e9..d1814f55fa5c69 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0752-ASoC-dwc-Fix-full-duplex-mode.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0752-ASoC-dwc-Fix-full-duplex-mode.patch
@@ -15,7 +15,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/sound/soc/dwc/dwc-i2s.c
 +++ b/sound/soc/dwc/dwc-i2s.c
-@@ -235,10 +235,17 @@ static void dw_i2s_config(struct dw_i2s_
+@@ -234,10 +234,17 @@ static void dw_i2s_config(struct dw_i2s_
  {
  	u32 ch_reg;
  	struct i2s_clk_config_data *config = &dev->config;
@@ -34,7 +34,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	for (ch_reg = 0; ch_reg < (config->chan_nr / 2); ch_reg++) {
  		if (stream == SNDRV_PCM_STREAM_PLAYBACK) {
  			i2s_write_reg(dev->i2s_base, TCR(ch_reg),
-@@ -258,10 +265,6 @@ static void dw_i2s_config(struct dw_i2s_
+@@ -257,10 +264,6 @@ static void dw_i2s_config(struct dw_i2s_
  			dmacr |= (DMACR_DMAEN_RXCH0 << ch_reg);
  		}
  	}
@@ -45,7 +45,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  
  	i2s_write_reg(dev->i2s_base, I2S_DMACR, dmacr);
  }
-@@ -370,10 +373,13 @@ static int dw_i2s_startup(struct snd_pcm
+@@ -369,10 +372,13 @@ static int dw_i2s_startup(struct snd_pcm
  
  	dw_i2s_config(dev, substream->stream);
  	dmacr = i2s_read_reg(dev->i2s_base, I2S_DMACR);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0757-drm-panel-add-panel-dsi.patch b/target/linux/bcm27xx/patches-6.6/950-0757-drm-panel-add-panel-dsi.patch
index 989fe3315f7606..f62410aeaac6ac 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0757-drm-panel-add-panel-dsi.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0757-drm-panel-add-panel-dsi.patch
@@ -23,7 +23,7 @@ Signed-off-by: Timon Skerutsch <kernel@diodes-delight.com>
  
  /**
   * struct panel_desc - Describes a simple panel.
-@@ -4875,6 +4876,9 @@ static const struct panel_desc_dsi osd10
+@@ -4904,6 +4905,9 @@ static const struct panel_desc_dsi osd10
  	.lanes = 4,
  };
  
@@ -33,7 +33,7 @@ Signed-off-by: Timon Skerutsch <kernel@diodes-delight.com>
  static const struct of_device_id dsi_of_match[] = {
  	{
  		.compatible = "auo,b080uan01",
-@@ -4898,20 +4902,137 @@ static const struct of_device_id dsi_of_
+@@ -4927,20 +4931,137 @@ static const struct of_device_id dsi_of_
  		.compatible = "osddisplays,osd101t2045-53ts",
  		.data = &osd101t2045_53ts
  	}, {
diff --git a/target/linux/bcm27xx/patches-6.6/950-0767-media-dt-bindings-i2c-Add-Rohm-BU64754-bindings.patch b/target/linux/bcm27xx/patches-6.6/950-0767-media-dt-bindings-i2c-Add-Rohm-BU64754-bindings.patch
index 824258ff89c0e0..2d3259092717a1 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0767-media-dt-bindings-i2c-Add-Rohm-BU64754-bindings.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0767-media-dt-bindings-i2c-Add-Rohm-BU64754-bindings.patch
@@ -67,7 +67,7 @@ Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
 +...
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -18619,6 +18619,13 @@ S:	Supported
+@@ -18620,6 +18620,13 @@ S:	Supported
  F:	drivers/iio/light/rohm-bu27008.c
  F:	drivers/iio/light/rohm-bu27034.c
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0768-media-i2c-Add-driver-for-OmniVision-OV64A40.patch b/target/linux/bcm27xx/patches-6.6/950-0768-media-i2c-Add-driver-for-OmniVision-OV64A40.patch
index 986cc49deec8de..477ac8319ff89f 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0768-media-i2c-Add-driver-for-OmniVision-OV64A40.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0768-media-i2c-Add-driver-for-OmniVision-OV64A40.patch
@@ -16,7 +16,7 @@ Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
 
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -15871,6 +15871,14 @@ S:	Maintained
+@@ -15872,6 +15872,14 @@ S:	Maintained
  T:	git git://linuxtv.org/media_tree.git
  F:	drivers/media/i2c/ov5695.c
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0809-ASoC-dwc-Defer-bclk_ratio-handling-to-hw_params.patch b/target/linux/bcm27xx/patches-6.6/950-0809-ASoC-dwc-Defer-bclk_ratio-handling-to-hw_params.patch
index 49ca7d6337265e..17b1b32263b67f 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0809-ASoC-dwc-Defer-bclk_ratio-handling-to-hw_params.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0809-ASoC-dwc-Defer-bclk_ratio-handling-to-hw_params.patch
@@ -18,7 +18,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/sound/soc/dwc/dwc-i2s.c
 +++ b/sound/soc/dwc/dwc-i2s.c
-@@ -314,6 +314,25 @@ static int dw_i2s_hw_params(struct snd_p
+@@ -313,6 +313,25 @@ static int dw_i2s_hw_params(struct snd_p
  	if (dev->tdm_slots)
  		config->data_width = 32;
  
@@ -44,7 +44,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	config->chan_nr = params_channels(params);
  
  	switch (config->chan_nr) {
-@@ -537,23 +556,7 @@ static int dw_i2s_set_bclk_ratio(struct
+@@ -536,23 +555,7 @@ static int dw_i2s_set_bclk_ratio(struct
  
  	dev_dbg(dev->dev, "%s(%d)\n", __func__, ratio);
  
@@ -69,7 +69,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  
  	return 0;
  }
-@@ -1068,6 +1071,7 @@ static int dw_i2s_probe(struct platform_
+@@ -1067,6 +1070,7 @@ static int dw_i2s_probe(struct platform_
  		}
  	}
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0810-drm-vc4-Fix-reading-of-frame-count-on-GEN5-Pi4.patch b/target/linux/bcm27xx/patches-6.6/950-0810-drm-vc4-Fix-reading-of-frame-count-on-GEN5-Pi4.patch
index 849caa45390bf6..8fdd244a002c73 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0810-drm-vc4-Fix-reading-of-frame-count-on-GEN5-Pi4.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0810-drm-vc4-Fix-reading-of-frame-count-on-GEN5-Pi4.patch
@@ -16,7 +16,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -823,10 +823,28 @@ u8 vc4_hvs_get_fifo_frame_count(struct v
+@@ -826,10 +826,28 @@ u8 vc4_hvs_get_fifo_frame_count(struct v
  	if (!drm_dev_enter(drm, &idx))
  		return 0;
  
@@ -47,7 +47,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  		switch (fifo) {
  		case 0:
  			field = VC4_GET_FIELD(HVS_READ(SCALER_DISPSTAT1),
-@@ -841,6 +859,7 @@ u8 vc4_hvs_get_fifo_frame_count(struct v
+@@ -844,6 +862,7 @@ u8 vc4_hvs_get_fifo_frame_count(struct v
  					      SCALER_DISPSTAT2_FRCNT2);
  			break;
  		}
diff --git a/target/linux/bcm27xx/patches-6.6/950-0813-media-i2c-adv7180-Use-MEDIA_BUS_FMT_UYVY8_1X16-for-C.patch b/target/linux/bcm27xx/patches-6.6/950-0813-media-i2c-adv7180-Use-MEDIA_BUS_FMT_UYVY8_1X16-for-C.patch
index 10c014b3bf945e..efb0fad7fee584 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0813-media-i2c-adv7180-Use-MEDIA_BUS_FMT_UYVY8_1X16-for-C.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0813-media-i2c-adv7180-Use-MEDIA_BUS_FMT_UYVY8_1X16-for-C.patch
@@ -17,7 +17,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/media/i2c/adv7180.c
 +++ b/drivers/media/i2c/adv7180.c
-@@ -723,10 +723,15 @@ static int adv7180_enum_mbus_code(struct
+@@ -728,10 +728,15 @@ static int adv7180_enum_mbus_code(struct
  				  struct v4l2_subdev_state *sd_state,
  				  struct v4l2_subdev_mbus_code_enum *code)
  {
@@ -34,7 +34,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  
  	return 0;
  }
-@@ -736,7 +741,10 @@ static int adv7180_mbus_fmt(struct v4l2_
+@@ -741,7 +746,10 @@ static int adv7180_mbus_fmt(struct v4l2_
  {
  	struct adv7180_state *state = to_state(sd);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0814-media-i2c-adv7180-Add-support-for-V4L2_CID_LINK_FREQ.patch b/target/linux/bcm27xx/patches-6.6/950-0814-media-i2c-adv7180-Add-support-for-V4L2_CID_LINK_FREQ.patch
index e6d03342289f18..20de51aabbcc97 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0814-media-i2c-adv7180-Add-support-for-V4L2_CID_LINK_FREQ.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0814-media-i2c-adv7180-Add-support-for-V4L2_CID_LINK_FREQ.patch
@@ -33,7 +33,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  static int dbg_input;
  module_param(dbg_input, int, 0644);
  MODULE_PARM_DESC(dbg_input, "Input number (0-31)");
-@@ -227,6 +237,7 @@ struct adv7180_state {
+@@ -228,6 +238,7 @@ struct adv7180_state {
  	const struct adv7180_chip_info *chip_info;
  	enum v4l2_field		field;
  	bool			force_bt656_4;
@@ -41,7 +41,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  };
  #define to_adv7180_sd(_ctrl) (&container_of(_ctrl->handler,		\
  					    struct adv7180_state,	\
-@@ -620,6 +631,9 @@ static int adv7180_s_ctrl(struct v4l2_ct
+@@ -621,6 +632,9 @@ static int adv7180_s_ctrl(struct v4l2_ct
  
  	if (ret)
  		return ret;
@@ -51,7 +51,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  	val = ctrl->val;
  	switch (ctrl->id) {
  	case V4L2_CID_BRIGHTNESS:
-@@ -661,6 +675,7 @@ static int adv7180_s_ctrl(struct v4l2_ct
+@@ -662,6 +676,7 @@ static int adv7180_s_ctrl(struct v4l2_ct
  		ret = -EINVAL;
  	}
  
@@ -59,7 +59,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  	mutex_unlock(&state->mutex);
  	return ret;
  }
-@@ -681,7 +696,7 @@ static const struct v4l2_ctrl_config adv
+@@ -682,7 +697,7 @@ static const struct v4l2_ctrl_config adv
  
  static int adv7180_init_controls(struct adv7180_state *state)
  {
@@ -68,9 +68,9 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  
  	v4l2_ctrl_new_std(&state->ctrl_hdl, &adv7180_ctrl_ops,
  			  V4L2_CID_BRIGHTNESS, ADV7180_BRI_MIN,
-@@ -703,6 +718,17 @@ static int adv7180_init_controls(struct
- 				      0, ARRAY_SIZE(test_pattern_menu) - 1,
- 				      test_pattern_menu);
+@@ -708,6 +723,17 @@ static int adv7180_init_controls(struct
+ 					     test_pattern_menu);
+ 	}
  
 +	if (state->chip_info->flags & ADV7180_FLAG_MIPI_CSI2) {
 +		state->link_freq =
@@ -86,7 +86,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  	state->sd.ctrl_handler = &state->ctrl_hdl;
  	if (state->ctrl_hdl.error) {
  		int err = state->ctrl_hdl.error;
-@@ -835,6 +861,10 @@ static int adv7180_set_pad_format(struct
+@@ -840,6 +866,10 @@ static int adv7180_set_pad_format(struct
  			adv7180_set_power(state, false);
  			adv7180_set_field_mode(state);
  			adv7180_set_power(state, true);
diff --git a/target/linux/bcm27xx/patches-6.6/950-0829-vc4-hvs-Add-support-for-D0-register-changes.patch b/target/linux/bcm27xx/patches-6.6/950-0829-vc4-hvs-Add-support-for-D0-register-changes.patch
index 3d13a6a09c3928..82edd649c0ca56 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0829-vc4-hvs-Add-support-for-D0-register-changes.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0829-vc4-hvs-Add-support-for-D0-register-changes.patch
@@ -169,7 +169,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
  		next_entry_start = 0;
  
  		for (j = active_dlist; j < dlist_mem_size; j++) {
-@@ -760,7 +819,7 @@ bool vc4_hvs_check_channel_active(struct
+@@ -763,7 +822,7 @@ bool vc4_hvs_check_channel_active(struct
  		return 0;
  
  	if (vc4->gen >= VC4_GEN_6)
@@ -178,7 +178,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
  	else
  		enabled = HVS_READ(SCALER_DISPCTRLX(fifo)) & SCALER_DISPCTRLX_ENABLE;
  
-@@ -825,8 +884,8 @@ u8 vc4_hvs_get_fifo_frame_count(struct v
+@@ -828,8 +887,8 @@ u8 vc4_hvs_get_fifo_frame_count(struct v
  
  	switch (vc4->gen) {
  	case VC4_GEN_6:
@@ -189,7 +189,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
  		break;
  	case VC4_GEN_5:
  		switch (fifo) {
-@@ -1037,20 +1096,20 @@ static int vc6_hvs_init_channel(struct v
+@@ -1040,20 +1099,20 @@ static int vc6_hvs_init_channel(struct v
  	if (!drm_dev_enter(drm, &idx))
  		return -ENODEV;
  
@@ -219,12 +219,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
  
  	drm_dev_exit(idx);
  
-@@ -1096,18 +1155,18 @@ static void __vc6_hvs_stop_channel(struc
- 	if (!drm_dev_enter(drm, &idx))
- 		return;
- 
--	if (!(HVS_READ(SCALER6_DISPX_CTRL0(chan)) & SCALER6_DISPX_CTRL0_ENB))
-+	if (!(HVS_READ(SCALER6_DISPX_CTRL0(chan)) & SCALER6(DISPX_CTRL0_ENB)))
+@@ -1103,14 +1162,14 @@ static void __vc6_hvs_stop_channel(struc
  		goto out;
  
  	HVS_WRITE(SCALER6_DISPX_CTRL0(chan),
@@ -244,7 +239,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
  
  out:
  	drm_dev_exit(idx);
-@@ -1221,8 +1280,8 @@ static void vc4_hvs_install_dlist(struct
+@@ -1224,8 +1283,8 @@ static void vc4_hvs_install_dlist(struct
  
  	if (vc4->gen >= VC4_GEN_6)
  		HVS_WRITE(SCALER6_DISPX_LPTRS(vc4_state->assigned_channel),
@@ -255,7 +250,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
  	else
  		HVS_WRITE(SCALER_DISPLISTX(vc4_state->assigned_channel),
  			  vc4_state->mm->mm_node.start);
-@@ -1382,11 +1441,11 @@ void vc4_hvs_atomic_flush(struct drm_crt
+@@ -1385,11 +1444,11 @@ void vc4_hvs_atomic_flush(struct drm_crt
  		if (enable_bg_fill)
  			HVS_WRITE(SCALER6_DISPX_CTRL1(channel),
  				  HVS_READ(SCALER6_DISPX_CTRL1(channel)) |
@@ -269,7 +264,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
  	} else {
  		/* we can actually run with a lower core clock when background
  		 * fill is enabled on VC4_GEN_5 so leave it enabled always.
-@@ -1656,7 +1715,7 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
+@@ -1660,7 +1719,7 @@ struct vc4_hvs *__vc4_hvs_alloc(struct v
  		 * access a register. Use a plausible size then.
  		 */
  		if (!kunit_get_current_test())
@@ -278,7 +273,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
  		else
  			dlist_size = 4096;
  
-@@ -1890,14 +1949,17 @@ static int vc6_hvs_hw_init(struct vc4_hv
+@@ -1905,14 +1964,17 @@ static int vc6_hvs_hw_init(struct vc4_hv
  	const struct vc6_csc_coeff_entry *coeffs;
  	unsigned int i;
  
@@ -300,7 +295,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
  
  	for (i = 0; i < 6; i++) {
  		coeffs = &csc_coeffs[i / 3][i % 3];
-@@ -1996,21 +2058,21 @@ static int vc4_hvs_cob_init(struct vc4_h
+@@ -2011,21 +2073,21 @@ static int vc4_hvs_cob_init(struct vc4_h
  		reg = 0;
  		top = 3840;
  
@@ -325,7 +320,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
  			  VC4_SET_FIELD(top, SCALER6_DISPX_COB_TOP) |
  			  VC4_SET_FIELD(base, SCALER6_DISPX_COB_BASE));
  		break;
-@@ -2041,7 +2103,10 @@ static int vc4_hvs_bind(struct device *d
+@@ -2056,7 +2118,10 @@ static int vc4_hvs_bind(struct device *d
  
  	hvs->regset.base = hvs->regs;
  
@@ -337,7 +332,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
  		hvs->regset.regs = vc6_hvs_regs;
  		hvs->regset.nregs = ARRAY_SIZE(vc6_hvs_regs);
  	} else {
-@@ -2208,6 +2273,7 @@ static void vc4_hvs_dev_remove(struct pl
+@@ -2223,6 +2288,7 @@ static void vc4_hvs_dev_remove(struct pl
  static const struct of_device_id vc4_hvs_dt_match[] = {
  	{ .compatible = "brcm,bcm2711-hvs" },
  	{ .compatible = "brcm,bcm2712-hvs" },
diff --git a/target/linux/bcm27xx/patches-6.6/950-0830-vc4-hvs-Updates-to-support-D0-alpha-and-csc-changes.patch b/target/linux/bcm27xx/patches-6.6/950-0830-vc4-hvs-Updates-to-support-D0-alpha-and-csc-changes.patch
index d88e6a744cda16..ec7071c59502eb 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0830-vc4-hvs-Updates-to-support-D0-alpha-and-csc-changes.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0830-vc4-hvs-Updates-to-support-D0-alpha-and-csc-changes.patch
@@ -16,7 +16,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -1888,6 +1888,17 @@ static int vc4_hvs_hw_init(struct vc4_hv
+@@ -1903,6 +1903,17 @@ static int vc4_hvs_hw_init(struct vc4_hv
  #define CFC1_N_MA_CSC_COEFF_C23(x)	(0xa03c + ((x) * 0x3000))
  #define CFC1_N_MA_CSC_COEFF_C24(x)	(0xa040 + ((x) * 0x3000))
  
@@ -34,7 +34,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
  /* 4 S2.22 multiplication factors, and 1 S9.15 addititive element for each of 3
   * output components
   */
-@@ -1958,31 +1969,43 @@ static int vc6_hvs_hw_init(struct vc4_hv
+@@ -1973,31 +1984,43 @@ static int vc6_hvs_hw_init(struct vc4_hv
  	HVS_WRITE(SCALER6(PRI_MAP0), 0xffffffff);
  	HVS_WRITE(SCALER6(PRI_MAP1), 0xffffffff);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0836-drm-vc4-Optimise-vc4_hvs_dlist_free_work-to-only-rea.patch b/target/linux/bcm27xx/patches-6.6/950-0836-drm-vc4-Optimise-vc4_hvs_dlist_free_work-to-only-rea.patch
index ff589278b6678e..19442e421c35d3 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0836-drm-vc4-Optimise-vc4_hvs_dlist_free_work-to-only-rea.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0836-drm-vc4-Optimise-vc4_hvs_dlist_free_work-to-only-rea.patch
@@ -18,7 +18,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -855,14 +855,19 @@ static void vc4_hvs_dlist_free_work(stru
+@@ -858,14 +858,19 @@ static void vc4_hvs_dlist_free_work(stru
  	struct vc4_hvs *hvs = container_of(work, struct vc4_hvs, free_dlist_work);
  	struct vc4_hvs_dlist_allocation *cur, *next;
  	unsigned long flags;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0837-drm-vc4-Flush-stale-dlist-entries-if-allocation-fail.patch b/target/linux/bcm27xx/patches-6.6/950-0837-drm-vc4-Flush-stale-dlist-entries-if-allocation-fail.patch
index 67be70d9a28947..b12ce4c542b3de 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0837-drm-vc4-Flush-stale-dlist-entries-if-allocation-fail.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0837-drm-vc4-Flush-stale-dlist-entries-if-allocation-fail.patch
@@ -19,7 +19,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -693,6 +693,9 @@ static void vc4_hvs_irq_clear_eof(struct
+@@ -696,6 +696,9 @@ static void vc4_hvs_irq_clear_eof(struct
  	hvs->eof_irq[channel].enabled = false;
  }
  
@@ -29,7 +29,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  static struct vc4_hvs_dlist_allocation *
  vc4_hvs_alloc_dlist_entry(struct vc4_hvs *hvs,
  			  unsigned int channel,
-@@ -701,6 +704,7 @@ vc4_hvs_alloc_dlist_entry(struct vc4_hvs
+@@ -704,6 +707,7 @@ vc4_hvs_alloc_dlist_entry(struct vc4_hvs
  	struct vc4_dev *vc4 = hvs->vc4;
  	struct drm_device *dev = &vc4->base;
  	struct vc4_hvs_dlist_allocation *alloc;
@@ -37,7 +37,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  	unsigned long flags;
  	int ret;
  
-@@ -718,9 +722,26 @@ vc4_hvs_alloc_dlist_entry(struct vc4_hvs
+@@ -721,9 +725,26 @@ vc4_hvs_alloc_dlist_entry(struct vc4_hvs
  				 dlist_count);
  	spin_unlock_irqrestore(&hvs->mm_lock, flags);
  	if (ret) {
diff --git a/target/linux/bcm27xx/patches-6.6/950-0842-ARM-pl011-Add-rs485-to-the-RP1-support.patch b/target/linux/bcm27xx/patches-6.6/950-0842-ARM-pl011-Add-rs485-to-the-RP1-support.patch
index ed90f11920fdb5..75cdb63c6a4f47 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0842-ARM-pl011-Add-rs485-to-the-RP1-support.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0842-ARM-pl011-Add-rs485-to-the-RP1-support.patch
@@ -13,7 +13,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/drivers/tty/serial/amba-pl011.c
 +++ b/drivers/tty/serial/amba-pl011.c
-@@ -3033,6 +3033,8 @@ static int pl011_axi_probe(struct platfo
+@@ -3040,6 +3040,8 @@ static int pl011_axi_probe(struct platfo
  	uap->port.iotype = vendor->access_32b ? UPIO_MEM32 : UPIO_MEM;
  	uap->port.irq = irq;
  	uap->port.ops = &amba_pl011_pops;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0853-drivers-usb-dwc3-add-FS-LS-bus-instance-parkmode-dis.patch b/target/linux/bcm27xx/patches-6.6/950-0853-drivers-usb-dwc3-add-FS-LS-bus-instance-parkmode-dis.patch
index 557bb033eff250..77aebef467c2ee 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0853-drivers-usb-dwc3-add-FS-LS-bus-instance-parkmode-dis.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0853-drivers-usb-dwc3-add-FS-LS-bus-instance-parkmode-dis.patch
@@ -16,7 +16,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/usb/dwc3/core.c
 +++ b/drivers/usb/dwc3/core.c
-@@ -1372,6 +1372,9 @@ static int dwc3_core_init(struct dwc3 *d
+@@ -1367,6 +1367,9 @@ static int dwc3_core_init(struct dwc3 *d
  		if (dwc->parkmode_disable_hs_quirk)
  			reg |= DWC3_GUCTL1_PARKMODE_DISABLE_HS;
  
@@ -26,7 +26,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  		if (DWC3_VER_IS_WITHIN(DWC3, 290A, ANY) &&
  		    (dwc->maximum_speed == USB_SPEED_HIGH ||
  		     dwc->maximum_speed == USB_SPEED_FULL))
-@@ -1670,6 +1673,8 @@ static void dwc3_get_properties(struct d
+@@ -1634,6 +1637,8 @@ static void dwc3_get_properties(struct d
  				"snps,parkmode-disable-ss-quirk");
  	dwc->parkmode_disable_hs_quirk = device_property_read_bool(dev,
  				"snps,parkmode-disable-hs-quirk");
@@ -37,7 +37,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  
 --- a/drivers/usb/dwc3/core.h
 +++ b/drivers/usb/dwc3/core.h
-@@ -271,6 +271,7 @@
+@@ -268,6 +268,7 @@
  #define DWC3_GUCTL1_DEV_L1_EXIT_BY_HW		BIT(24)
  #define DWC3_GUCTL1_PARKMODE_DISABLE_SS		BIT(17)
  #define DWC3_GUCTL1_PARKMODE_DISABLE_HS		BIT(16)
@@ -45,7 +45,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  #define DWC3_GUCTL1_RESUME_OPMODE_HS_HOST	BIT(10)
  
  /* Global Status Register */
-@@ -1116,10 +1117,12 @@ struct dwc3_scratchpad_array {
+@@ -1118,10 +1119,12 @@ struct dwc3_scratchpad_array {
   *			generation after resume from suspend.
   * @ulpi_ext_vbus_drv: Set to confiure the upli chip to drives CPEN pin
   *			VBUS with an external supply.
@@ -62,7 +62,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
   * @tx_de_emphasis_quirk: set if we enable Tx de-emphasis quirk
   * @tx_de_emphasis: Tx de-emphasis value
   *	0	- -6dB de-emphasis
-@@ -1344,6 +1347,7 @@ struct dwc3 {
+@@ -1347,6 +1350,7 @@ struct dwc3 {
  	unsigned		ulpi_ext_vbus_drv:1;
  	unsigned		parkmode_disable_ss_quirk:1;
  	unsigned		parkmode_disable_hs_quirk:1;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0867-iommu-bcm2712-don-t-allow-building-as-module.patch b/target/linux/bcm27xx/patches-6.6/950-0867-iommu-bcm2712-don-t-allow-building-as-module.patch
index 36c7b844619bf3..f2bfb684440355 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0867-iommu-bcm2712-don-t-allow-building-as-module.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0867-iommu-bcm2712-don-t-allow-building-as-module.patch
@@ -17,7 +17,7 @@ Signed-off-by: Ratchanan Srirattanamet <peathot@hotmail.com>
 
 --- a/drivers/iommu/Kconfig
 +++ b/drivers/iommu/Kconfig
-@@ -495,7 +495,7 @@ config SPRD_IOMMU
+@@ -494,7 +494,7 @@ config SPRD_IOMMU
  	  Say Y here if you want to use the multimedia devices listed above.
  
  config BCM2712_IOMMU
diff --git a/target/linux/bcm27xx/patches-6.6/950-0923-drm-Add-DRM_MODE_TV_MODE_MONOCHROME.patch b/target/linux/bcm27xx/patches-6.6/950-0923-drm-Add-DRM_MODE_TV_MODE_MONOCHROME.patch
index 485196b15a9fde..2fd127848818c8 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0923-drm-Add-DRM_MODE_TV_MODE_MONOCHROME.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0923-drm-Add-DRM_MODE_TV_MODE_MONOCHROME.patch
@@ -21,7 +21,7 @@ Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
 
 --- a/drivers/gpu/drm/drm_connector.c
 +++ b/drivers/gpu/drm/drm_connector.c
-@@ -1049,6 +1049,7 @@ static const struct drm_prop_enum_list d
+@@ -1050,6 +1050,7 @@ static const struct drm_prop_enum_list d
  	{ DRM_MODE_TV_MODE_PAL_M, "PAL-M" },
  	{ DRM_MODE_TV_MODE_PAL_N, "PAL-N" },
  	{ DRM_MODE_TV_MODE_SECAM, "SECAM" },
@@ -29,7 +29,7 @@ Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
  };
  DRM_ENUM_NAME_FN(drm_get_tv_mode_name, drm_tv_mode_enum_list)
  
-@@ -1735,6 +1736,12 @@ EXPORT_SYMBOL(drm_connector_attach_dp_su
+@@ -1740,6 +1741,12 @@ EXPORT_SYMBOL(drm_connector_attach_dp_su
   *		TV Mode is CCIR System B (aka 625-lines) together with
   *		the SECAM Color Encoding.
   *
diff --git a/target/linux/bcm27xx/patches-6.6/950-0931-fixup-ASoC-dwc-Defer-bclk_ratio-handling-to-hw_param.patch b/target/linux/bcm27xx/patches-6.6/950-0931-fixup-ASoC-dwc-Defer-bclk_ratio-handling-to-hw_param.patch
index 9f5c2b3a48dee3..7174cf0a5ae708 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0931-fixup-ASoC-dwc-Defer-bclk_ratio-handling-to-hw_param.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0931-fixup-ASoC-dwc-Defer-bclk_ratio-handling-to-hw_param.patch
@@ -13,7 +13,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/sound/soc/dwc/dwc-i2s.c
 +++ b/sound/soc/dwc/dwc-i2s.c
-@@ -288,21 +288,18 @@ static int dw_i2s_hw_params(struct snd_p
+@@ -287,21 +287,18 @@ static int dw_i2s_hw_params(struct snd_p
  	case SNDRV_PCM_FORMAT_S16_LE:
  		config->data_width = 16;
  		dma_data->dt.addr_width = 2;
@@ -35,7 +35,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  		dev->xfer_resolution = 0x05;
  		break;
  
-@@ -314,25 +311,6 @@ static int dw_i2s_hw_params(struct snd_p
+@@ -313,25 +310,6 @@ static int dw_i2s_hw_params(struct snd_p
  	if (dev->tdm_slots)
  		config->data_width = 32;
  
@@ -61,7 +61,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	config->chan_nr = params_channels(params);
  
  	switch (config->chan_nr) {
-@@ -348,11 +326,31 @@ static int dw_i2s_hw_params(struct snd_p
+@@ -347,11 +325,31 @@ static int dw_i2s_hw_params(struct snd_p
  
  	dw_i2s_config(dev, substream->stream);
  
@@ -95,7 +95,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  		if (dev->i2s_clk_cfg) {
  			ret = dev->i2s_clk_cfg(config);
  			if (ret < 0) {
-@@ -360,8 +358,7 @@ static int dw_i2s_hw_params(struct snd_p
+@@ -359,8 +357,7 @@ static int dw_i2s_hw_params(struct snd_p
  				return ret;
  			}
  		} else {
@@ -105,7 +105,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  
  			ret = clk_set_rate(dev->clk, bitclk);
  			if (ret) {
-@@ -370,6 +367,8 @@ static int dw_i2s_hw_params(struct snd_p
+@@ -369,6 +366,8 @@ static int dw_i2s_hw_params(struct snd_p
  				return ret;
  			}
  		}
diff --git a/target/linux/bcm27xx/patches-6.6/950-0951-ASoC-dwc-Correct-channel-count-reporting.patch b/target/linux/bcm27xx/patches-6.6/950-0951-ASoC-dwc-Correct-channel-count-reporting.patch
index 8f54995dc05b06..aaf9e32b4022bb 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0951-ASoC-dwc-Correct-channel-count-reporting.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0951-ASoC-dwc-Correct-channel-count-reporting.patch
@@ -17,7 +17,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/sound/soc/dwc/dwc-i2s.c
 +++ b/sound/soc/dwc/dwc-i2s.c
-@@ -320,7 +320,7 @@ static int dw_i2s_hw_params(struct snd_p
+@@ -319,7 +319,7 @@ static int dw_i2s_hw_params(struct snd_p
  	case TWO_CHANNEL_SUPPORT:
  		break;
  	default:
@@ -26,7 +26,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  		return -EINVAL;
  	}
  
-@@ -708,7 +708,7 @@ static int dw_configure_dai(struct dw_i2
+@@ -707,7 +707,7 @@ static int dw_configure_dai(struct dw_i2
  			idx = 1;
  		dw_i2s_dai->playback.channels_min = MIN_CHANNEL_NUM;
  		dw_i2s_dai->playback.channels_max =
@@ -35,7 +35,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  		dw_i2s_dai->playback.formats = formats[idx];
  		dw_i2s_dai->playback.rates = rates;
  	}
-@@ -722,7 +722,7 @@ static int dw_configure_dai(struct dw_i2
+@@ -721,7 +721,7 @@ static int dw_configure_dai(struct dw_i2
  			idx = 1;
  		dw_i2s_dai->capture.channels_min = MIN_CHANNEL_NUM;
  		dw_i2s_dai->capture.channels_max =
diff --git a/target/linux/bcm27xx/patches-6.6/950-0980-drivers-mmc-add-SD-support-for-Command-Queueing.patch b/target/linux/bcm27xx/patches-6.6/950-0980-drivers-mmc-add-SD-support-for-Command-Queueing.patch
index 14eb62cfac89bd..c7c227e8afef51 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0980-drivers-mmc-add-SD-support-for-Command-Queueing.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0980-drivers-mmc-add-SD-support-for-Command-Queueing.patch
@@ -91,7 +91,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	cmd.flags       &= ~MMC_RSP_CRC; /* Ignore CRC */
 --- a/drivers/mmc/core/sd.c
 +++ b/drivers/mmc/core/sd.c
-@@ -1016,8 +1016,8 @@ static bool mmc_sd_card_using_v18(struct
+@@ -1032,8 +1032,8 @@ static bool mmc_sd_card_using_v18(struct
  	       (SD_MODE_UHS_SDR50 | SD_MODE_UHS_SDR104 | SD_MODE_UHS_DDR50);
  }
  
@@ -102,7 +102,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  {
  	struct mmc_host *host = card->host;
  	struct mmc_request mrq = {};
-@@ -1175,8 +1175,14 @@ static int sd_parse_ext_reg_perf(struct
+@@ -1191,8 +1191,14 @@ static int sd_parse_ext_reg_perf(struct
  		card->ext_perf.feature_support |= SD_EXT_PERF_CACHE;
  
  	/* Command queue support indicated via queue depth bits (0 to 4). */
@@ -118,7 +118,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  
  	card->ext_perf.fno = fno;
  	card->ext_perf.page = page;
-@@ -1563,13 +1569,41 @@ cont:
+@@ -1579,13 +1585,41 @@ cont:
  			goto free_card;
  	}
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0983-drivers-mmc-preallocate-a-block-for-SD-extension-reg.patch b/target/linux/bcm27xx/patches-6.6/950-0983-drivers-mmc-preallocate-a-block-for-SD-extension-reg.patch
index 4d90245f364ef8..c95bd1fc55079f 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0983-drivers-mmc-preallocate-a-block-for-SD-extension-reg.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0983-drivers-mmc-preallocate-a-block-for-SD-extension-reg.patch
@@ -19,7 +19,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/mmc/core/bus.c
 +++ b/drivers/mmc/core/bus.c
-@@ -264,6 +264,8 @@ static void mmc_release_card(struct devi
+@@ -266,6 +266,8 @@ static void mmc_release_card(struct devi
  
  	sdio_free_common_cis(card);
  
@@ -30,7 +30,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	kfree(card);
 --- a/drivers/mmc/core/sd.c
 +++ b/drivers/mmc/core/sd.c
-@@ -1026,9 +1026,8 @@ int sd_write_ext_reg(struct mmc_card *ca
+@@ -1042,9 +1042,8 @@ int sd_write_ext_reg(struct mmc_card *ca
  	struct scatterlist sg;
  	u8 *reg_buf;
  
@@ -42,7 +42,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  
  	mrq.cmd = &cmd;
  	mrq.data = &data;
-@@ -1060,8 +1059,6 @@ int sd_write_ext_reg(struct mmc_card *ca
+@@ -1076,8 +1075,6 @@ int sd_write_ext_reg(struct mmc_card *ca
  	mmc_set_data_timeout(&data, card);
  	mmc_wait_for_req(host, &mrq);
  
@@ -51,7 +51,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	/*
  	 * Note that, the SD card is allowed to signal busy on DAT0 up to 1s
  	 * after the CMD49. Although, let's leave this to be managed by the
-@@ -1102,9 +1099,7 @@ static int sd_parse_ext_reg_power(struct
+@@ -1118,9 +1115,7 @@ static int sd_parse_ext_reg_power(struct
  	int err;
  	u8 *reg_buf;
  
@@ -62,7 +62,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  
  	/* Read the extension register for power management function. */
  	err = sd_read_ext_reg(card, fno, page, offset, 512, reg_buf);
-@@ -1134,7 +1129,6 @@ static int sd_parse_ext_reg_power(struct
+@@ -1150,7 +1145,6 @@ static int sd_parse_ext_reg_power(struct
  	card->ext_power.offset = offset;
  
  out:
@@ -70,7 +70,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	return err;
  }
  
-@@ -1144,9 +1138,7 @@ static int sd_parse_ext_reg_perf(struct
+@@ -1160,9 +1154,7 @@ static int sd_parse_ext_reg_perf(struct
  	int err;
  	u8 *reg_buf;
  
@@ -81,7 +81,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  
  	err = sd_read_ext_reg(card, fno, page, offset, 512, reg_buf);
  	if (err) {
-@@ -1189,7 +1181,6 @@ static int sd_parse_ext_reg_perf(struct
+@@ -1205,7 +1197,6 @@ static int sd_parse_ext_reg_perf(struct
  	card->ext_perf.offset = offset;
  
  out:
@@ -89,7 +89,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	return err;
  }
  
-@@ -1260,6 +1251,12 @@ static int sd_read_ext_regs(struct mmc_c
+@@ -1276,6 +1267,12 @@ static int sd_read_ext_regs(struct mmc_c
  	if (!gen_info_buf)
  		return -ENOMEM;
  
@@ -102,7 +102,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	/*
  	 * Read 512 bytes of general info, which is found at function number 0,
  	 * at page 0 and with no offset.
-@@ -1326,9 +1323,7 @@ static int sd_flush_cache(struct mmc_hos
+@@ -1342,9 +1339,7 @@ static int sd_flush_cache(struct mmc_hos
  	if (!sd_cache_enabled(host))
  		return 0;
  
@@ -113,7 +113,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  
  	/*
  	 * Set Flush Cache at bit 0 in the performance enhancement register at
-@@ -1364,21 +1359,15 @@ static int sd_flush_cache(struct mmc_hos
+@@ -1380,21 +1375,15 @@ static int sd_flush_cache(struct mmc_hos
  	if (reg_buf[0] & BIT(0))
  		err = -ETIMEDOUT;
  out:
@@ -135,7 +135,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	/*
  	 * Set Cache Enable at bit 0 in the performance enhancement register at
  	 * 260 bytes offset.
-@@ -1397,7 +1386,6 @@ static int sd_enable_cache(struct mmc_ca
+@@ -1413,7 +1402,6 @@ static int sd_enable_cache(struct mmc_ca
  		card->ext_perf.feature_enabled |= SD_EXT_PERF_CACHE;
  
  out:
@@ -145,7 +145,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  
 --- a/include/linux/mmc/card.h
 +++ b/include/linux/mmc/card.h
-@@ -320,6 +320,7 @@ struct mmc_card {
+@@ -322,6 +322,7 @@ struct mmc_card {
  	struct sd_switch_caps	sw_caps;	/* switch (CMD6) caps */
  	struct sd_ext_reg	ext_power;	/* SD extension reg for PM */
  	struct sd_ext_reg	ext_perf;	/* SD extension reg for PERF */
diff --git a/target/linux/bcm27xx/patches-6.6/950-0989-drm-vc4-Enable-bg_fill-if-there-are-no-planes-enable.patch b/target/linux/bcm27xx/patches-6.6/950-0989-drm-vc4-Enable-bg_fill-if-there-are-no-planes-enable.patch
index 10d7f571194fc9..b34cff057eadab 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0989-drm-vc4-Enable-bg_fill-if-there-are-no-planes-enable.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0989-drm-vc4-Enable-bg_fill-if-there-are-no-planes-enable.patch
@@ -19,7 +19,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -1400,7 +1400,7 @@ void vc4_hvs_atomic_flush(struct drm_crt
+@@ -1403,7 +1403,7 @@ void vc4_hvs_atomic_flush(struct drm_crt
  	struct drm_plane *plane;
  	struct vc4_plane_state *vc4_plane_state;
  	bool debug_dump_regs = false;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0994-drivers-mmc-export-SD-extension-register-read-write-.patch b/target/linux/bcm27xx/patches-6.6/950-0994-drivers-mmc-export-SD-extension-register-read-write-.patch
index e2347ed9d2e98a..830b13e2d127b7 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0994-drivers-mmc-export-SD-extension-register-read-write-.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0994-drivers-mmc-export-SD-extension-register-read-write-.patch
@@ -16,7 +16,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/mmc/core/sd.c
 +++ b/drivers/mmc/core/sd.c
-@@ -1016,83 +1016,6 @@ static bool mmc_sd_card_using_v18(struct
+@@ -1032,83 +1032,6 @@ static bool mmc_sd_card_using_v18(struct
  	       (SD_MODE_UHS_SDR50 | SD_MODE_UHS_SDR104 | SD_MODE_UHS_DDR50);
  }
  
@@ -100,7 +100,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  static int sd_parse_ext_reg_power(struct mmc_card *card, u8 fno, u8 page,
  				  u16 offset)
  {
-@@ -1102,7 +1025,7 @@ static int sd_parse_ext_reg_power(struct
+@@ -1118,7 +1041,7 @@ static int sd_parse_ext_reg_power(struct
  	reg_buf = card->ext_reg_buf;
  
  	/* Read the extension register for power management function. */
@@ -109,7 +109,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	if (err) {
  		pr_warn("%s: error %d reading PM func of ext reg\n",
  			mmc_hostname(card->host), err);
-@@ -1140,7 +1063,7 @@ static int sd_parse_ext_reg_perf(struct
+@@ -1156,7 +1079,7 @@ static int sd_parse_ext_reg_perf(struct
  
  	reg_buf = card->ext_reg_buf;
  
@@ -118,7 +118,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	if (err) {
  		pr_warn("%s: error %d reading PERF func of ext reg\n",
  			mmc_hostname(card->host), err);
-@@ -1235,7 +1158,7 @@ static int sd_parse_ext_reg(struct mmc_c
+@@ -1251,7 +1174,7 @@ static int sd_parse_ext_reg(struct mmc_c
  	return 0;
  }
  
@@ -127,7 +127,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  {
  	int err, i;
  	u8 num_ext, *gen_info_buf;
-@@ -1261,7 +1184,7 @@ static int sd_read_ext_regs(struct mmc_c
+@@ -1277,7 +1200,7 @@ static int sd_read_ext_regs(struct mmc_c
  	 * Read 512 bytes of general info, which is found at function number 0,
  	 * at page 0 and with no offset.
  	 */
@@ -136,7 +136,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	if (err) {
  		pr_err("%s: error %d reading general info of SD ext reg\n",
  			mmc_hostname(card->host), err);
-@@ -1333,7 +1256,7 @@ static int sd_flush_cache(struct mmc_hos
+@@ -1349,7 +1272,7 @@ static int sd_flush_cache(struct mmc_hos
  	page = card->ext_perf.page;
  	offset = card->ext_perf.offset + 261;
  
@@ -145,7 +145,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	if (err) {
  		pr_warn("%s: error %d writing Cache Flush bit\n",
  			mmc_hostname(host), err);
-@@ -1349,7 +1272,7 @@ static int sd_flush_cache(struct mmc_hos
+@@ -1365,7 +1288,7 @@ static int sd_flush_cache(struct mmc_hos
  	 * Read the Flush Cache bit. The card shall reset it, to confirm that
  	 * it's has completed the flushing of the cache.
  	 */
@@ -154,7 +154,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	if (err) {
  		pr_warn("%s: error %d reading Cache Flush bit\n",
  			mmc_hostname(host), err);
-@@ -1372,7 +1295,7 @@ static int sd_enable_cache(struct mmc_ca
+@@ -1388,7 +1311,7 @@ static int sd_enable_cache(struct mmc_ca
  	 * Set Cache Enable at bit 0 in the performance enhancement register at
  	 * 260 bytes offset.
  	 */
@@ -163,7 +163,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  			       card->ext_perf.offset + 260, BIT(0));
  	if (err) {
  		pr_warn("%s: error %d writing Cache Enable bit\n",
-@@ -1545,7 +1468,7 @@ retry:
+@@ -1561,7 +1484,7 @@ retry:
  cont:
  	if (!oldcard) {
  		/* Read/parse the extension registers. */
@@ -172,7 +172,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  		if (err)
  			goto free_card;
  	}
-@@ -1672,7 +1595,7 @@ static int sd_busy_poweroff_notify_cb(vo
+@@ -1688,7 +1611,7 @@ static int sd_busy_poweroff_notify_cb(vo
  	 * one byte offset and is one byte long. The Power Off Notification
  	 * Ready is bit 0.
  	 */
@@ -181,7 +181,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  			      card->ext_power.offset + 1, 1, data->reg_buf);
  	if (err) {
  		pr_warn("%s: error %d reading status reg of PM func\n",
-@@ -1698,7 +1621,7 @@ static int sd_poweroff_notify(struct mmc
+@@ -1714,7 +1637,7 @@ static int sd_poweroff_notify(struct mmc
  	 * Set the Power Off Notification bit in the power management settings
  	 * register at 2 bytes offset.
  	 */
diff --git a/target/linux/bcm27xx/patches-6.6/950-0995-drivers-mmc-be-more-cautious-when-manipulating-Comma.patch b/target/linux/bcm27xx/patches-6.6/950-0995-drivers-mmc-be-more-cautious-when-manipulating-Comma.patch
index 6a855757ac0eb0..50138211fd6413 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0995-drivers-mmc-be-more-cautious-when-manipulating-Comma.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0995-drivers-mmc-be-more-cautious-when-manipulating-Comma.patch
@@ -17,7 +17,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/mmc/core/sd.c
 +++ b/drivers/mmc/core/sd.c
-@@ -1089,8 +1089,12 @@ static int sd_parse_ext_reg_perf(struct
+@@ -1105,8 +1105,12 @@ static int sd_parse_ext_reg_perf(struct
  	if ((reg_buf[4] & BIT(0)) && !mmc_card_broken_sd_cache(card))
  		card->ext_perf.feature_support |= SD_EXT_PERF_CACHE;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0996-drivers-mmc-add-debugfs-entries-for-SD-extension-reg.patch b/target/linux/bcm27xx/patches-6.6/950-0996-drivers-mmc-add-debugfs-entries-for-SD-extension-reg.patch
index c12229ece9d307..fc09f375e2f629 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0996-drivers-mmc-add-debugfs-entries-for-SD-extension-reg.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0996-drivers-mmc-add-debugfs-entries-for-SD-extension-reg.patch
@@ -27,7 +27,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  				pr_info("%s: Host Software Queue enabled\n",
 --- a/drivers/mmc/core/sd.c
 +++ b/drivers/mmc/core/sd.c
-@@ -715,7 +715,8 @@ MMC_DEV_ATTR(oemid, "0x%04x\n", card->ci
+@@ -731,7 +731,8 @@ MMC_DEV_ATTR(oemid, "0x%04x\n", card->ci
  MMC_DEV_ATTR(serial, "0x%08x\n", card->cid.serial);
  MMC_DEV_ATTR(ocr, "0x%08x\n", card->ocr);
  MMC_DEV_ATTR(rca, "0x%04x\n", card->rca);
@@ -37,7 +37,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  
  static ssize_t mmc_dsr_show(struct device *dev, struct device_attribute *attr,
  			    char *buf)
-@@ -777,6 +778,8 @@ static struct attribute *sd_std_attrs[]
+@@ -793,6 +794,8 @@ static struct attribute *sd_std_attrs[]
  	&dev_attr_ocr.attr,
  	&dev_attr_rca.attr,
  	&dev_attr_dsr.attr,
@@ -46,7 +46,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	NULL,
  };
  
-@@ -1512,8 +1515,8 @@ cont:
+@@ -1528,8 +1531,8 @@ cont:
  			host->cqe_enabled = true;
  
  			if (card->ext_csd.cmdq_en) {
diff --git a/target/linux/bcm27xx/patches-6.6/950-0997-drivers-mmc-handle-1024-byte-SD-General-Info-lengths.patch b/target/linux/bcm27xx/patches-6.6/950-0997-drivers-mmc-handle-1024-byte-SD-General-Info-lengths.patch
index 55b369d659a120..8af51d3a23966d 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0997-drivers-mmc-handle-1024-byte-SD-General-Info-lengths.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-0997-drivers-mmc-handle-1024-byte-SD-General-Info-lengths.patch
@@ -14,7 +14,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/mmc/core/sd.c
 +++ b/drivers/mmc/core/sd.c
-@@ -1177,7 +1177,7 @@ static int mmc_sd_read_ext_regs(struct m
+@@ -1193,7 +1193,7 @@ static int mmc_sd_read_ext_regs(struct m
  	if (!(card->scr.cmds & SD_SCR_CMD48_SUPPORT))
  		return 0;
  
@@ -23,7 +23,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	if (!gen_info_buf)
  		return -ENOMEM;
  
-@@ -1208,14 +1208,23 @@ static int mmc_sd_read_ext_regs(struct m
+@@ -1224,14 +1224,23 @@ static int mmc_sd_read_ext_regs(struct m
  	num_ext = gen_info_buf[4];
  
  	/*
diff --git a/target/linux/bcm27xx/patches-6.6/950-1021-module-Avoid-ABI-changes-when-debug-info-is-disabled.patch b/target/linux/bcm27xx/patches-6.6/950-1021-module-Avoid-ABI-changes-when-debug-info-is-disabled.patch
index 99b153d0bed020..8ea7e963866667 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1021-module-Avoid-ABI-changes-when-debug-info-is-disabled.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1021-module-Avoid-ABI-changes-when-debug-info-is-disabled.patch
@@ -15,7 +15,7 @@ Define these members unconditionally, so that there is no ABI change.
 
 --- a/include/linux/module.h
 +++ b/include/linux/module.h
-@@ -510,7 +510,7 @@ struct module {
+@@ -512,7 +512,7 @@ struct module {
  	unsigned int num_bpf_raw_events;
  	struct bpf_raw_event_map *bpf_raw_events;
  #endif
diff --git a/target/linux/bcm27xx/patches-6.6/950-1051-drm-panel-Add-and-initialise-an-orientation-field-to.patch b/target/linux/bcm27xx/patches-6.6/950-1051-drm-panel-Add-and-initialise-an-orientation-field-to.patch
index 694e2a0082feca..9dcdb585b1e1dc 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1051-drm-panel-Add-and-initialise-an-orientation-field-to.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1051-drm-panel-Add-and-initialise-an-orientation-field-to.patch
@@ -22,7 +22,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/drm_connector.c
 +++ b/drivers/gpu/drm/drm_connector.c
-@@ -2697,10 +2697,15 @@ int drm_connector_set_orientation_from_p
+@@ -2702,10 +2702,15 @@ int drm_connector_set_orientation_from_p
  {
  	enum drm_panel_orientation orientation;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-1069-drm-panel-simple-Fix-7inch-panel-mode-for-misalignme.patch b/target/linux/bcm27xx/patches-6.6/950-1069-drm-panel-simple-Fix-7inch-panel-mode-for-misalignme.patch
index 6a413ec90bfa33..eacc9c8b811a8e 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1069-drm-panel-simple-Fix-7inch-panel-mode-for-misalignme.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1069-drm-panel-simple-Fix-7inch-panel-mode-for-misalignme.patch
@@ -16,7 +16,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/panel/panel-simple.c
 +++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -3421,11 +3421,11 @@ static const struct drm_display_mode ras
+@@ -3422,11 +3422,11 @@ static const struct drm_display_mode ras
  	.hdisplay = 800,
  	.hsync_start = 800 + 59,
  	.hsync_end = 800 + 59 + 2,
diff --git a/target/linux/bcm27xx/patches-6.6/950-1070-drm-panel-simple-Increase-pixel-clock-on-Pi-7inch-pa.patch b/target/linux/bcm27xx/patches-6.6/950-1070-drm-panel-simple-Increase-pixel-clock-on-Pi-7inch-pa.patch
index 68129c8de9ef5b..9c1094bd9be173 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1070-drm-panel-simple-Increase-pixel-clock-on-Pi-7inch-pa.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1070-drm-panel-simple-Increase-pixel-clock-on-Pi-7inch-pa.patch
@@ -21,7 +21,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
 
 --- a/drivers/gpu/drm/panel/panel-simple.c
 +++ b/drivers/gpu/drm/panel/panel-simple.c
-@@ -3417,11 +3417,11 @@ static const struct panel_desc rocktech_
+@@ -3418,11 +3418,11 @@ static const struct panel_desc rocktech_
  };
  
  static const struct drm_display_mode raspberrypi_7inch_mode = {
diff --git a/target/linux/bcm27xx/patches-6.6/950-1128-pwm-Make-it-possible-to-apply-PWM-changes-in-atomic-.patch b/target/linux/bcm27xx/patches-6.6/950-1128-pwm-Make-it-possible-to-apply-PWM-changes-in-atomic-.patch
index 269bb7219a6e29..2441e8223e7247 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1128-pwm-Make-it-possible-to-apply-PWM-changes-in-atomic-.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1128-pwm-Make-it-possible-to-apply-PWM-changes-in-atomic-.patch
@@ -48,7 +48,7 @@ Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
  drivers cannot. If you rely on getting the inactive state, use .duty_cycle=0,
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -17437,7 +17437,7 @@ F:	drivers/video/backlight/pwm_bl.c
+@@ -17438,7 +17438,7 @@ F:	drivers/video/backlight/pwm_bl.c
  F:	include/dt-bindings/pwm/
  F:	include/linux/pwm.h
  F:	include/linux/pwm_backlight.h
diff --git a/target/linux/bcm27xx/patches-6.6/950-1149-media-uapi-Add-Raspberry-Pi-PiSP-Back-End-uAPI.patch b/target/linux/bcm27xx/patches-6.6/950-1149-media-uapi-Add-Raspberry-Pi-PiSP-Back-End-uAPI.patch
index a59bcb1e9708b5..a95742b475e026 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1149-media-uapi-Add-Raspberry-Pi-PiSP-Back-End-uAPI.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1149-media-uapi-Add-Raspberry-Pi-PiSP-Back-End-uAPI.patch
@@ -23,7 +23,7 @@ Signed-off-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
 
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -18032,6 +18032,13 @@ L:	linux-wireless@vger.kernel.org
+@@ -18033,6 +18033,13 @@ L:	linux-wireless@vger.kernel.org
  S:	Orphan
  F:	drivers/net/wireless/legacy/ray*
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-1152-media-dt-bindings-Add-bindings-for-Raspberry-Pi-PiSP.patch b/target/linux/bcm27xx/patches-6.6/950-1152-media-dt-bindings-Add-bindings-for-Raspberry-Pi-PiSP.patch
index 30c5cb35068d52..e6f15fa47151e8 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1152-media-dt-bindings-Add-bindings-for-Raspberry-Pi-PiSP.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1152-media-dt-bindings-Add-bindings-for-Raspberry-Pi-PiSP.patch
@@ -87,7 +87,7 @@ Reviewed-by: Naushir Patuck <naush@raspberrypi.com>
 +    };
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -18037,6 +18037,7 @@ M:	Jacopo Mondi <jacopo.mondi@ideasonboa
+@@ -18038,6 +18038,7 @@ M:	Jacopo Mondi <jacopo.mondi@ideasonboa
  L:	Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
  L:	linux-media@vger.kernel.org
  S:	Maintained
diff --git a/target/linux/bcm27xx/patches-6.6/950-1164-spi-dt-bindings-Add-RPI-RP2040-GPIO-Bridge.patch b/target/linux/bcm27xx/patches-6.6/950-1164-spi-dt-bindings-Add-RPI-RP2040-GPIO-Bridge.patch
index 487e508ea473be..abdf8157a5486d 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1164-spi-dt-bindings-Add-RPI-RP2040-GPIO-Bridge.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1164-spi-dt-bindings-Add-RPI-RP2040-GPIO-Bridge.patch
@@ -94,7 +94,7 @@ Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
 +
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -18027,6 +18027,11 @@ F:	drivers/ras/
+@@ -18028,6 +18028,11 @@ F:	drivers/ras/
  F:	include/linux/ras.h
  F:	include/ras/ras_event.h
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-1165-spi-Add-a-driver-for-the-RPI-RP2040-GPIO-bridge.patch b/target/linux/bcm27xx/patches-6.6/950-1165-spi-Add-a-driver-for-the-RPI-RP2040-GPIO-bridge.patch
index 68e2ef600778d8..3d977db80d3065 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1165-spi-Add-a-driver-for-the-RPI-RP2040-GPIO-bridge.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1165-spi-Add-a-driver-for-the-RPI-RP2040-GPIO-bridge.patch
@@ -25,7 +25,7 @@ Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
 
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -18031,6 +18031,7 @@ RASPBERRY PI RP2040 GPIO BRIDGE DRIVER
+@@ -18032,6 +18032,7 @@ RASPBERRY PI RP2040 GPIO BRIDGE DRIVER
  M:	Raspberry Pi Kernel Maintenance <kernel-list@raspberrypi.com>
  S:	Maintained
  F:	Documentation/devicetree/bindings/spi/raspberrypi,rp2040-gpio-bridge.yaml
diff --git a/target/linux/bcm27xx/patches-6.6/950-1167-mmc-restrict-posted-write-counts-for-SD-cards-in-CQ-.patch b/target/linux/bcm27xx/patches-6.6/950-1167-mmc-restrict-posted-write-counts-for-SD-cards-in-CQ-.patch
index 2ba494958ea0bb..5408d381e2c796 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1167-mmc-restrict-posted-write-counts-for-SD-cards-in-CQ-.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1167-mmc-restrict-posted-write-counts-for-SD-cards-in-CQ-.patch
@@ -129,7 +129,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	bool			busy;
 --- a/drivers/mmc/core/sd.c
 +++ b/drivers/mmc/core/sd.c
-@@ -1104,6 +1104,14 @@ static int sd_parse_ext_reg_perf(struct
+@@ -1120,6 +1120,14 @@ static int sd_parse_ext_reg_perf(struct
  		pr_debug("%s: Command Queue supported depth %u\n",
  			 mmc_hostname(card->host),
  			 card->ext_csd.cmdq_depth);
@@ -146,7 +146,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	card->ext_perf.fno = fno;
 --- a/include/linux/mmc/card.h
 +++ b/include/linux/mmc/card.h
-@@ -343,6 +343,8 @@ struct mmc_card {
+@@ -345,6 +345,8 @@ struct mmc_card {
  	unsigned int    nr_parts;
  
  	struct workqueue_struct *complete_wq;	/* Private workqueue */
diff --git a/target/linux/bcm27xx/patches-6.6/950-1168-fixup-mmc-restrict-posted-write-counts-for-SD-cards-.patch b/target/linux/bcm27xx/patches-6.6/950-1168-fixup-mmc-restrict-posted-write-counts-for-SD-cards-.patch
index b4f30b4b3c4666..150f93e762faf8 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1168-fixup-mmc-restrict-posted-write-counts-for-SD-cards-.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1168-fixup-mmc-restrict-posted-write-counts-for-SD-cards-.patch
@@ -39,7 +39,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  			return BLK_STS_RESOURCE;
 --- a/drivers/mmc/core/sd.c
 +++ b/drivers/mmc/core/sd.c
-@@ -1105,13 +1105,14 @@ static int sd_parse_ext_reg_perf(struct
+@@ -1121,13 +1121,14 @@ static int sd_parse_ext_reg_perf(struct
  			 mmc_hostname(card->host),
  			 card->ext_csd.cmdq_depth);
  		/*
@@ -60,7 +60,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	}
  
  	card->ext_perf.fno = fno;
-@@ -1375,6 +1376,7 @@ retry:
+@@ -1391,6 +1392,7 @@ retry:
  
  		card->ocr = ocr;
  		card->type = MMC_TYPE_SD;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1197-sound-soc-dwc-i2s-choose-FIFO-thresholds-based-on-DM.patch b/target/linux/bcm27xx/patches-6.6/950-1197-sound-soc-dwc-i2s-choose-FIFO-thresholds-based-on-DM.patch
index d0e3bc1fab0f1f..18bd7657013373 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1197-sound-soc-dwc-i2s-choose-FIFO-thresholds-based-on-DM.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1197-sound-soc-dwc-i2s-choose-FIFO-thresholds-based-on-DM.patch
@@ -22,7 +22,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/sound/soc/dwc/dwc-i2s.c
 +++ b/sound/soc/dwc/dwc-i2s.c
-@@ -236,6 +236,8 @@ static void dw_i2s_config(struct dw_i2s_
+@@ -235,6 +235,8 @@ static void dw_i2s_config(struct dw_i2s_
  	u32 ch_reg;
  	struct i2s_clk_config_data *config = &dev->config;
  	u32 dmacr;
@@ -31,7 +31,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  
  	i2s_disable_channels(dev, stream);
  
-@@ -251,7 +253,7 @@ static void dw_i2s_config(struct dw_i2s_
+@@ -250,7 +252,7 @@ static void dw_i2s_config(struct dw_i2s_
  			i2s_write_reg(dev->i2s_base, TCR(ch_reg),
  				      dev->xfer_resolution);
  			i2s_write_reg(dev->i2s_base, TFCR(ch_reg),
@@ -40,7 +40,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  			i2s_write_reg(dev->i2s_base, TER(ch_reg), TER_TXCHEN |
  				      dev->tdm_mask << TER_TXSLOT_SHIFT);
  			dmacr |= (DMACR_DMAEN_TXCH0 << ch_reg);
-@@ -783,8 +785,8 @@ static int dw_configure_dai_by_pd(struct
+@@ -782,8 +784,8 @@ static int dw_configure_dai_by_pd(struct
  		dev->capture_dma_data.pd.data = pdata->capture_dma_data;
  		dev->play_dma_data.pd.addr = res->start + I2S_TXDMA;
  		dev->capture_dma_data.pd.addr = res->start + I2S_RXDMA;
@@ -51,7 +51,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  		dev->play_dma_data.pd.addr_width = bus_widths[idx];
  		dev->capture_dma_data.pd.addr_width = bus_widths[idx];
  		dev->play_dma_data.pd.filter = pdata->filter;
-@@ -815,7 +817,10 @@ static int dw_configure_dai_by_dt(struct
+@@ -814,7 +816,10 @@ static int dw_configure_dai_by_dt(struct
  		dev->play_dma_data.dt.addr = res->start + I2S_TXDMA;
  		dev->play_dma_data.dt.fifo_size = fifo_depth *
  			(fifo_width[idx2]) >> 8;
@@ -63,7 +63,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	}
  	if (COMP1_RX_ENABLED(comp1)) {
  		idx2 = COMP2_RX_WORDSIZE_0(comp2);
-@@ -824,9 +829,14 @@ static int dw_configure_dai_by_dt(struct
+@@ -823,9 +828,14 @@ static int dw_configure_dai_by_dt(struct
  		dev->capture_dma_data.dt.addr = res->start + I2S_RXDMA;
  		dev->capture_dma_data.dt.fifo_size = fifo_depth *
  			(fifo_width[idx2] >> 8);
@@ -79,7 +79,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	return 0;
  
  }
-@@ -1070,6 +1080,7 @@ static int dw_i2s_probe(struct platform_
+@@ -1069,6 +1079,7 @@ static int dw_i2s_probe(struct platform_
  		}
  	}
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-1218-Bluetooth-hci_sync-Fix-crash-on-NULL-parent.patch b/target/linux/bcm27xx/patches-6.6/950-1218-Bluetooth-hci_sync-Fix-crash-on-NULL-parent.patch
index 272f711e632d88..d40b12792703c1 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1218-Bluetooth-hci_sync-Fix-crash-on-NULL-parent.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1218-Bluetooth-hci_sync-Fix-crash-on-NULL-parent.patch
@@ -15,7 +15,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/net/bluetooth/hci_sync.c
 +++ b/net/bluetooth/hci_sync.c
-@@ -4861,7 +4861,8 @@ static const struct {
+@@ -4927,7 +4927,8 @@ static const struct {
   */
  static int hci_dev_setup_sync(struct hci_dev *hdev)
  {
diff --git a/target/linux/bcm27xx/patches-6.6/950-1243-media-dt-bindings-i2c-Add-Sony-IMX500.patch b/target/linux/bcm27xx/patches-6.6/950-1243-media-dt-bindings-i2c-Add-Sony-IMX500.patch
index 82e58c12bc586b..cfd4b46d4ff6b7 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1243-media-dt-bindings-i2c-Add-Sony-IMX500.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1243-media-dt-bindings-i2c-Add-Sony-IMX500.patch
@@ -150,7 +150,7 @@ Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
 +
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -20127,6 +20127,13 @@ F:	Documentation/devicetree/bindings/med
+@@ -20128,6 +20128,13 @@ F:	Documentation/devicetree/bindings/med
  F:	Documentation/devicetree/bindings/media/i2c/imx477.yaml
  F:	drivers/media/i2c/imx477.c
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-1244-media-i2c-Add-driver-for-Sony-IMX500-sensor.patch b/target/linux/bcm27xx/patches-6.6/950-1244-media-i2c-Add-driver-for-Sony-IMX500-sensor.patch
index 331e5863a645cf..c6b9196a525267 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1244-media-i2c-Add-driver-for-Sony-IMX500-sensor.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1244-media-i2c-Add-driver-for-Sony-IMX500-sensor.patch
@@ -21,7 +21,7 @@ Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
 
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -20133,6 +20133,7 @@ L:	linux-media@vger.kernel.org
+@@ -20134,6 +20134,7 @@ L:	linux-media@vger.kernel.org
  S:	Maintained
  T:	git git://linuxtv.org/media_tree.git
  F:	Documentation/devicetree/bindings/media/i2c/sony,imx500.yaml
diff --git a/target/linux/bcm27xx/patches-6.6/950-1257-drm-vc4-Add-support-for-per-plane-scaling-filter-sel.patch b/target/linux/bcm27xx/patches-6.6/950-1257-drm-vc4-Add-support-for-per-plane-scaling-filter-sel.patch
index 5b3ae3c9101122..e4d2aace93b1db 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1257-drm-vc4-Add-support-for-per-plane-scaling-filter-sel.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1257-drm-vc4-Add-support-for-per-plane-scaling-filter-sel.patch
@@ -40,7 +40,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  
  static int vc4_hvs_upload_linear_kernel(struct vc4_hvs *hvs,
  					struct drm_mm_node *space,
-@@ -2255,14 +2258,19 @@ static int vc4_hvs_bind(struct device *d
+@@ -2270,14 +2273,19 @@ static int vc4_hvs_bind(struct device *d
  	if (ret)
  		return ret;
  
@@ -62,7 +62,7 @@ Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
  
  	ret = vc4_hvs_cob_init(hvs);
  	if (ret)
-@@ -2288,6 +2296,8 @@ static void vc4_hvs_unbind(struct device
+@@ -2303,6 +2311,8 @@ static void vc4_hvs_unbind(struct device
  
  	if (drm_mm_node_allocated(&vc4->hvs->mitchell_netravali_filter))
  		drm_mm_remove_node(&vc4->hvs->mitchell_netravali_filter);
diff --git a/target/linux/bcm27xx/patches-6.6/950-1260-drivers-mmc-disable-write-caching-on-Samsung-2023-mo.patch b/target/linux/bcm27xx/patches-6.6/950-1260-drivers-mmc-disable-write-caching-on-Samsung-2023-mo.patch
index 35607aacafba9e..1453bfa9e62079 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1260-drivers-mmc-disable-write-caching-on-Samsung-2023-mo.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1260-drivers-mmc-disable-write-caching-on-Samsung-2023-mo.patch
@@ -20,19 +20,19 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/mmc/core/card.h
 +++ b/drivers/mmc/core/card.h
-@@ -84,6 +84,7 @@ struct mmc_fixup {
- #define CID_MANFID_TOSHIBA      0x11
+@@ -85,6 +85,7 @@ struct mmc_fixup {
+ #define CID_MANFID_GIGASTONE    0x12
  #define CID_MANFID_MICRON       0x13
  #define CID_MANFID_SAMSUNG      0x15
 +#define CID_MANFID_SAMSUNG_SD	0x1b
  #define CID_MANFID_APACER       0x27
+ #define CID_MANFID_SWISSBIT     0x5D
  #define CID_MANFID_KINGSTON     0x70
- #define CID_MANFID_HYNIX	0x90
 --- a/drivers/mmc/core/quirks.h
 +++ b/drivers/mmc/core/quirks.h
-@@ -25,6 +25,14 @@ static const struct mmc_fixup __maybe_un
- 		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
- 		   MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
+@@ -58,6 +58,14 @@ static const struct mmc_fixup __maybe_un
+ 	MMC_FIXUP("SD32G", 0x41, 0x3432, add_quirk, MMC_QUIRK_ERASE_BROKEN),
+ 	MMC_FIXUP("SD64G", 0x41, 0x3432, add_quirk, MMC_QUIRK_ERASE_BROKEN),
  
 +	/*
 +	 * Samsung Pro Plus/EVO Plus/Pro Ultimate SD cards (2023) claim to cache
diff --git a/target/linux/bcm27xx/patches-6.6/950-1261-mm-vmscan-Maintain-TLB-coherency-in-LRU-code.patch b/target/linux/bcm27xx/patches-6.6/950-1261-mm-vmscan-Maintain-TLB-coherency-in-LRU-code.patch
index 70ece97505c72f..3c60865aa7fbf2 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1261-mm-vmscan-Maintain-TLB-coherency-in-LRU-code.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1261-mm-vmscan-Maintain-TLB-coherency-in-LRU-code.patch
@@ -16,7 +16,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/mm/vmscan.c
 +++ b/mm/vmscan.c
-@@ -4716,7 +4716,7 @@ void lru_gen_look_around(struct page_vma
+@@ -4723,7 +4723,7 @@ void lru_gen_look_around(struct page_vma
  		if (!folio)
  			continue;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-1282-tty-serial-pl011-Also-unregister-pl011_axi_platform_.patch b/target/linux/bcm27xx/patches-6.6/950-1282-tty-serial-pl011-Also-unregister-pl011_axi_platform_.patch
index 3a5f9f15c38faa..593d4a1e538468 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1282-tty-serial-pl011-Also-unregister-pl011_axi_platform_.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1282-tty-serial-pl011-Also-unregister-pl011_axi_platform_.patch
@@ -12,7 +12,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
 
 --- a/drivers/tty/serial/amba-pl011.c
 +++ b/drivers/tty/serial/amba-pl011.c
-@@ -3122,6 +3122,7 @@ static int __init pl011_init(void)
+@@ -3129,6 +3129,7 @@ static int __init pl011_init(void)
  static void __exit pl011_exit(void)
  {
  	platform_driver_unregister(&arm_sbsa_uart_platform_driver);
diff --git a/target/linux/bcm27xx/patches-6.6/950-1323-drm-vc4-Remove-request-for-min-clocks-when-hdmi-outp.patch b/target/linux/bcm27xx/patches-6.6/950-1323-drm-vc4-Remove-request-for-min-clocks-when-hdmi-outp.patch
index 9f4cf9d0336dab..cde586b126cc0f 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1323-drm-vc4-Remove-request-for-min-clocks-when-hdmi-outp.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1323-drm-vc4-Remove-request-for-min-clocks-when-hdmi-outp.patch
@@ -50,7 +50,7 @@ Signed-off-by: Dom Cobley <popcornmix@gmail.com>
  	return 0;
 --- a/drivers/gpu/drm/vc4/vc4_hvs.c
 +++ b/drivers/gpu/drm/vc4/vc4_hvs.c
-@@ -2308,7 +2308,10 @@ static void vc4_hvs_unbind(struct device
+@@ -2323,7 +2323,10 @@ static void vc4_hvs_unbind(struct device
  		drm_mm_remove_node(node);
  	drm_mm_takedown(&vc4->hvs->lbm_mm);
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-1333-mmc-quirks-disable-cache-on-more-known-bad-Sandisk-c.patch b/target/linux/bcm27xx/patches-6.6/950-1333-mmc-quirks-disable-cache-on-more-known-bad-Sandisk-c.patch
index 109c502e13f6d9..b079ae700d848e 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1333-mmc-quirks-disable-cache-on-more-known-bad-Sandisk-c.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1333-mmc-quirks-disable-cache-on-more-known-bad-Sandisk-c.patch
@@ -14,7 +14,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/mmc/core/quirks.h
 +++ b/drivers/mmc/core/quirks.h
-@@ -33,6 +33,18 @@ static const struct mmc_fixup __maybe_un
+@@ -66,6 +66,18 @@ static const struct mmc_fixup __maybe_un
  		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
  		   MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-1336-mmc-quirks-add-MMC_QUIRK_BROKEN_ERASE-for-Phison-Int.patch b/target/linux/bcm27xx/patches-6.6/950-1336-mmc-quirks-add-MMC_QUIRK_BROKEN_ERASE-for-Phison-Int.patch
index ba61b15ea15773..878c56b579775b 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1336-mmc-quirks-add-MMC_QUIRK_BROKEN_ERASE-for-Phison-Int.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1336-mmc-quirks-add-MMC_QUIRK_BROKEN_ERASE-for-Phison-Int.patch
@@ -15,9 +15,9 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
 
 --- a/drivers/mmc/core/quirks.h
 +++ b/drivers/mmc/core/quirks.h
-@@ -162,6 +162,15 @@ static const struct mmc_fixup __maybe_un
- 	MMC_FIXUP("SD32G", 0x41, 0x3432, add_quirk, MMC_QUIRK_ERASE_BROKEN),
- 	MMC_FIXUP("SD64G", 0x41, 0x3432, add_quirk, MMC_QUIRK_ERASE_BROKEN),
+@@ -181,6 +181,15 @@ static const struct mmc_fixup __maybe_un
+ 	MMC_FIXUP("M62704", CID_MANFID_KINGSTON, 0x0100, add_quirk_mmc,
+ 		  MMC_QUIRK_TRIM_BROKEN),
  
 +	/*
 +	 * Larger Integral SD cards using rebranded Phison controllers trash
diff --git a/target/linux/bcm27xx/patches-6.6/950-1340-mm-numa-Allow-override-of-kernel-s-default-NUMA-poli.patch b/target/linux/bcm27xx/patches-6.6/950-1340-mm-numa-Allow-override-of-kernel-s-default-NUMA-poli.patch
index f0de0ce9d59b1e..f2d7a91b77f9ee 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1340-mm-numa-Allow-override-of-kernel-s-default-NUMA-poli.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1340-mm-numa-Allow-override-of-kernel-s-default-NUMA-poli.patch
@@ -23,7 +23,7 @@ Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
 
 --- a/mm/mempolicy.c
 +++ b/mm/mempolicy.c
-@@ -2974,7 +2974,9 @@ void __init numa_policy_init(void)
+@@ -2947,7 +2947,9 @@ void __init numa_policy_init(void)
  /* Reset policy of current process to default */
  void numa_default_policy(void)
  {
@@ -34,7 +34,7 @@ Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
  }
  
  /*
-@@ -2992,7 +2994,6 @@ static const char * const policy_modes[]
+@@ -2965,7 +2967,6 @@ static const char * const policy_modes[]
  };
  
  
@@ -42,7 +42,7 @@ Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
  /**
   * mpol_parse_str - parse string to mempolicy, for tmpfs mpol mount option.
   * @str:  string containing mempolicy to parse
-@@ -3005,13 +3006,18 @@ static const char * const policy_modes[]
+@@ -2978,13 +2979,18 @@ static const char * const policy_modes[]
   */
  int mpol_parse_str(char *str, struct mempolicy **mpol)
  {
@@ -62,7 +62,7 @@ Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
  	if (flags)
  		*flags++ = '\0';	/* terminate mode string */
  
-@@ -3090,9 +3096,16 @@ int mpol_parse_str(char *str, struct mem
+@@ -3063,9 +3069,16 @@ int mpol_parse_str(char *str, struct mem
  			goto out;
  	}
  
@@ -82,7 +82,7 @@ Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
  
  	/*
  	 * Save nodes for mpol_to_str() to show the tmpfs mount options
-@@ -3125,7 +3138,29 @@ out:
+@@ -3098,7 +3111,29 @@ out:
  		*mpol = new;
  	return err;
  }
diff --git a/target/linux/bcm27xx/patches-6.6/950-1349-cgroup-Use-kernel-command-line-to-disable-memory-cgr.patch b/target/linux/bcm27xx/patches-6.6/950-1349-cgroup-Use-kernel-command-line-to-disable-memory-cgr.patch
index 46e0aeaf4ce6f6..b1ceaad71dee9e 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1349-cgroup-Use-kernel-command-line-to-disable-memory-cgr.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1349-cgroup-Use-kernel-command-line-to-disable-memory-cgr.patch
@@ -148,7 +148,7 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
  
 --- a/kernel/cgroup/cgroup.c
 +++ b/kernel/cgroup/cgroup.c
-@@ -6060,9 +6060,6 @@ int __init cgroup_init_early(void)
+@@ -6059,9 +6059,6 @@ int __init cgroup_init_early(void)
  	return 0;
  }
  
@@ -158,7 +158,7 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
  /**
   * cgroup_init - cgroup initialization
   *
-@@ -6096,12 +6093,6 @@ int __init cgroup_init(void)
+@@ -6095,12 +6092,6 @@ int __init cgroup_init(void)
  
  	cgroup_unlock();
  
@@ -171,7 +171,7 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
  	for_each_subsys(ss, ssid) {
  		if (ss->early_init) {
  			struct cgroup_subsys_state *css =
-@@ -6742,10 +6733,6 @@ static int __init cgroup_disable(char *s
+@@ -6749,10 +6740,6 @@ static int __init cgroup_disable(char *s
  			    strcmp(token, ss->legacy_name))
  				continue;
  
@@ -182,7 +182,7 @@ Signed-off-by: Maíra Canal <mcanal@igalia.com>
  			static_branch_disable(cgroup_subsys_enabled_key[i]);
  			pr_info("Disabling %s control group subsystem\n",
  				ss->name);
-@@ -6779,7 +6766,7 @@ static int __init cgroup_enable(char *st
+@@ -6786,7 +6773,7 @@ static int __init cgroup_enable(char *st
  			    strcmp(token, ss->legacy_name))
  				continue;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-1351-drivers-media-bcm2835_isp-Cache-LS-table-dmabuf.patch b/target/linux/bcm27xx/patches-6.6/950-1351-drivers-media-bcm2835_isp-Cache-LS-table-dmabuf.patch
new file mode 100644
index 00000000000000..1f5ed7545b0a5f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1351-drivers-media-bcm2835_isp-Cache-LS-table-dmabuf.patch
@@ -0,0 +1,141 @@
+From 25e6acfe00f589a5989ebd2c8d21a130fb3bf106 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Fri, 18 Oct 2024 09:18:10 +0100
+Subject: [PATCH] drivers: media: bcm2835_isp: Cache LS table dmabuf
+
+Clients such as libcamera do not change the LS table dmabuf on every
+frame. In such cases instead of mapping/remapping the same dmabuf on
+every frame to send to the firmware, cache the dmabuf once and only
+update and remap if the dmabuf has been changed by the userland client.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../bcm2835-isp/bcm2835-v4l2-isp.c            | 77 +++++++++++--------
+ 1 file changed, 46 insertions(+), 31 deletions(-)
+
+--- a/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
++++ b/drivers/staging/vc04_services/bcm2835-isp/bcm2835-v4l2-isp.c
+@@ -139,6 +139,8 @@ struct bcm2835_isp_dev {
+ 	/* Image pipeline controls. */
+ 	int r_gain;
+ 	int b_gain;
++	struct dma_buf *last_ls_dmabuf;
++	struct mmal_parameter_lens_shading_v2 ls;
+ };
+ 
+ struct bcm2835_isp_buffer {
+@@ -657,18 +659,18 @@ static void bcm2835_isp_node_stop_stream
+ 	atomic_dec(&dev->num_streaming);
+ 	/* If all ports disabled, then disable the component */
+ 	if (atomic_read(&dev->num_streaming) == 0) {
+-		struct bcm2835_isp_lens_shading ls;
+ 		/*
+ 		 * The ISP component on the firmware has a reference to the
+ 		 * dmabuf handle for the lens shading table.  Pass a null handle
+ 		 * to remove that reference now.
+ 		 */
+-		memset(&ls, 0, sizeof(ls));
++		memset(&dev->ls, 0, sizeof(dev->ls));
+ 		/* Must set a valid grid size for the FW */
+-		ls.grid_cell_size = 16;
++		dev->ls.grid_cell_size = 16;
+ 		set_isp_param(&dev->node[0],
+ 			      MMAL_PARAMETER_LENS_SHADING_OVERRIDE,
+-			      &ls, sizeof(ls));
++			      &dev->ls, sizeof(dev->ls));
++		dev->last_ls_dmabuf = NULL;
+ 
+ 		ret = vchiq_mmal_component_disable(dev->mmal_instance,
+ 						   dev->component);
+@@ -719,6 +721,36 @@ static inline unsigned int get_sizeimage
+ 	return (bpl * height * fmt->size_multiplier_x2) >> 1;
+ }
+ 
++static int map_ls_table(struct bcm2835_isp_dev *dev, struct dma_buf *dmabuf,
++			const struct bcm2835_isp_lens_shading *v4l2_ls)
++{
++	void *vcsm_handle;
++	int ret;
++
++	if (IS_ERR_OR_NULL(dmabuf))
++		return -EINVAL;
++
++	/*
++	 * struct bcm2835_isp_lens_shading and struct
++	 * mmal_parameter_lens_shading_v2 match so that we can do a
++	 * simple memcpy here.
++	 * Only the dmabuf to the actual table needs any manipulation.
++	 */
++	memcpy(&dev->ls, v4l2_ls, sizeof(dev->ls));
++	ret = vc_sm_cma_import_dmabuf(dmabuf, &vcsm_handle);
++	if (ret) {
++		dma_buf_put(dmabuf);
++		return ret;
++	}
++
++	dev->ls.mem_handle_table = vc_sm_cma_int_handle(vcsm_handle);
++	dev->last_ls_dmabuf = dmabuf;
++
++	vc_sm_cma_free(vcsm_handle);
++
++	return 0;
++}
++
+ static int bcm2835_isp_s_ctrl(struct v4l2_ctrl *ctrl)
+ {
+ 	struct bcm2835_isp_dev *dev =
+@@ -754,44 +786,27 @@ static int bcm2835_isp_s_ctrl(struct v4l
+ 	case V4L2_CID_USER_BCM2835_ISP_LENS_SHADING:
+ 	{
+ 		struct bcm2835_isp_lens_shading *v4l2_ls;
+-		struct mmal_parameter_lens_shading_v2 ls;
+-		struct dma_buf *dmabuf;
+-		void *vcsm_handle;
+ 
+ 		v4l2_ls = (struct bcm2835_isp_lens_shading *)ctrl->p_new.p_u8;
+-		/*
+-		 * struct bcm2835_isp_lens_shading and struct
+-		 * mmal_parameter_lens_shading_v2 match so that we can do a
+-		 * simple memcpy here.
+-		 * Only the dmabuf to the actual table needs any manipulation.
+-		 */
+-		memcpy(&ls, v4l2_ls, sizeof(ls));
++		struct dma_buf *dmabuf = dma_buf_get(v4l2_ls->dmabuf);
+ 
+-		dmabuf = dma_buf_get(v4l2_ls->dmabuf);
+-		if (IS_ERR_OR_NULL(dmabuf))
+-			return -EINVAL;
+-
+-		ret = vc_sm_cma_import_dmabuf(dmabuf, &vcsm_handle);
+-		if (ret) {
+-			dma_buf_put(dmabuf);
+-			return -EINVAL;
+-		}
++		if (dmabuf != dev->last_ls_dmabuf)
++			ret = map_ls_table(dev, dmabuf, v4l2_ls);
+ 
+-		ls.mem_handle_table = vc_sm_cma_int_handle(vcsm_handle);
+-		if (ls.mem_handle_table)
+-			/* The VPU will take a reference on the vcsm handle,
++		if (!ret && dev->ls.mem_handle_table)
++			/*
++			 * The VPU will take a reference on the vcsm handle,
+ 			 * which in turn will retain a reference on the dmabuf.
+ 			 * This code can therefore safely release all
+ 			 * references to the buffer.
+ 			 */
+-			ret = set_isp_param(node,
+-					    MMAL_PARAMETER_LENS_SHADING_OVERRIDE,
+-					    &ls,
+-					    sizeof(ls));
++			ret =
++			set_isp_param(node,
++				      MMAL_PARAMETER_LENS_SHADING_OVERRIDE,
++				      &dev->ls, sizeof(dev->ls));
+ 		else
+ 			ret = -EINVAL;
+ 
+-		vc_sm_cma_free(vcsm_handle);
+ 		dma_buf_put(dmabuf);
+ 		break;
+ 	}
diff --git a/target/linux/bcm27xx/patches-6.6/950-1353-pwm-Add-GPIO-PWM-driver.patch b/target/linux/bcm27xx/patches-6.6/950-1353-pwm-Add-GPIO-PWM-driver.patch
new file mode 100644
index 00000000000000..5b89f60bca8fee
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1353-pwm-Add-GPIO-PWM-driver.patch
@@ -0,0 +1,330 @@
+From 3ab72fc21ea8576e59f6aad10bd6b1a0eae6e5eb Mon Sep 17 00:00:00 2001
+From: Vincent Whitchurch <vincent.whitchurch@axis.com>
+Date: Tue, 4 Jun 2024 23:00:41 +0200
+Subject: [PATCH] pwm: Add GPIO PWM driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+commit 7f61257cd6e1ad4769b4b819668cab00f68f2556 upstream.
+
+Add a software PWM which toggles a GPIO from a high-resolution timer.
+
+This will naturally not be as accurate or as efficient as a hardware
+PWM, but it is useful in some cases.  I have for example used it for
+evaluating LED brightness handling (via leds-pwm) on a board where the
+LED was just hooked up to a GPIO, and for a simple verification of the
+timer frequency on another platform.
+
+Since high-resolution timers are used, sleeping GPIO chips are not
+supported and are rejected in the probe function.
+
+Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
+Co-developed-by: Stefan Wahren <wahrenst@gmx.net>
+Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
+Co-developed-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Reviewed-by: Dhruva Gole <d-gole@ti.com>
+Link: https://lore.kernel.org/r/20240604-pwm-gpio-v7-2-6b67cf60db92@linaro.org
+Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
+Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
+
+pwm: Backport pwm-gpio.c to rpi-6.6.y
+---
+ .../driver-api/gpio/drivers-on-gpio.rst       |   7 +-
+ drivers/pwm/Kconfig                           |  11 +
+ drivers/pwm/Makefile                          |   1 +
+ drivers/pwm/pwm-gpio.c                        | 240 ++++++++++++++++++
+ 4 files changed, 258 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/pwm/pwm-gpio.c
+
+--- a/Documentation/driver-api/gpio/drivers-on-gpio.rst
++++ b/Documentation/driver-api/gpio/drivers-on-gpio.rst
+@@ -27,7 +27,12 @@ hardware descriptions such as device tre
+   to the lines for a more permanent solution of this type.
+ 
+ - gpio-beeper: drivers/input/misc/gpio-beeper.c is used to provide a beep from
+-  an external speaker connected to a GPIO line.
++  an external speaker connected to a GPIO line. (If the beep is controlled by
++  off/on, for an actual PWM waveform, see pwm-gpio below.)
++
++- pwm-gpio: drivers/pwm/pwm-gpio.c is used to toggle a GPIO with a high
++  resolution timer producing a PWM waveform on the GPIO line, as well as
++  Linux high resolution timers can do.
+ 
+ - extcon-gpio: drivers/extcon/extcon-gpio.c is used when you need to read an
+   external connector status, such as a headset line for an audio driver or an
+--- a/drivers/pwm/Kconfig
++++ b/drivers/pwm/Kconfig
+@@ -217,6 +217,17 @@ config PWM_FSL_FTM
+ 	  To compile this driver as a module, choose M here: the module
+ 	  will be called pwm-fsl-ftm.
+ 
++config PWM_GPIO
++	tristate "GPIO PWM support"
++	depends on GPIOLIB
++	depends on HIGH_RES_TIMERS
++	help
++	  Generic PWM framework driver for software PWM toggling a GPIO pin
++	  from kernel high-resolution timers.
++
++	  To compile this driver as a module, choose M here: the module
++	  will be called pwm-gpio.
++
+ config PWM_HIBVT
+ 	tristate "HiSilicon BVT PWM support"
+ 	depends on ARCH_HISI || COMPILE_TEST
+--- a/drivers/pwm/Makefile
++++ b/drivers/pwm/Makefile
+@@ -18,6 +18,7 @@ obj-$(CONFIG_PWM_CROS_EC)	+= pwm-cros-ec
+ obj-$(CONFIG_PWM_DWC)		+= pwm-dwc.o
+ obj-$(CONFIG_PWM_EP93XX)	+= pwm-ep93xx.o
+ obj-$(CONFIG_PWM_FSL_FTM)	+= pwm-fsl-ftm.o
++obj-$(CONFIG_PWM_GPIO)		+= pwm-gpio.o
+ obj-$(CONFIG_PWM_HIBVT)		+= pwm-hibvt.o
+ obj-$(CONFIG_PWM_IMG)		+= pwm-img.o
+ obj-$(CONFIG_PWM_IMX1)		+= pwm-imx1.o
+--- /dev/null
++++ b/drivers/pwm/pwm-gpio.c
+@@ -0,0 +1,240 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Generic software PWM for modulating GPIOs
++ *
++ * Copyright (C) 2020 Axis Communications AB
++ * Copyright (C) 2020 Nicola Di Lieto
++ * Copyright (C) 2024 Stefan Wahren
++ * Copyright (C) 2024 Linus Walleij
++ */
++
++#include <linux/cleanup.h>
++#include <linux/container_of.h>
++#include <linux/device.h>
++#include <linux/err.h>
++#include <linux/gpio/consumer.h>
++#include <linux/hrtimer.h>
++#include <linux/math.h>
++#include <linux/module.h>
++#include <linux/mod_devicetable.h>
++#include <linux/platform_device.h>
++#include <linux/property.h>
++#include <linux/pwm.h>
++#include <linux/spinlock.h>
++#include <linux/time.h>
++#include <linux/types.h>
++
++struct pwm_gpio {
++	struct hrtimer gpio_timer;
++	struct gpio_desc *gpio;
++	struct pwm_state state;
++	struct pwm_state next_state;
++
++	/* Protect internal state between pwm_ops and hrtimer */
++	spinlock_t lock;
++
++	bool changing;
++	bool running;
++	bool level;
++	struct pwm_chip chip;
++};
++
++static void pwm_gpio_round(struct pwm_state *dest, const struct pwm_state *src)
++{
++	u64 dividend;
++	u32 remainder;
++
++	*dest = *src;
++
++	/* Round down to hrtimer resolution */
++	dividend = dest->period;
++	remainder = do_div(dividend, hrtimer_resolution);
++	dest->period -= remainder;
++
++	dividend = dest->duty_cycle;
++	remainder = do_div(dividend, hrtimer_resolution);
++	dest->duty_cycle -= remainder;
++}
++
++static u64 pwm_gpio_toggle(struct pwm_gpio *gpwm, bool level)
++{
++	const struct pwm_state *state = &gpwm->state;
++	bool invert = state->polarity == PWM_POLARITY_INVERSED;
++
++	gpwm->level = level;
++	gpiod_set_value(gpwm->gpio, gpwm->level ^ invert);
++
++	if (!state->duty_cycle || state->duty_cycle == state->period) {
++		gpwm->running = false;
++		return 0;
++	}
++
++	gpwm->running = true;
++	return level ? state->duty_cycle : state->period - state->duty_cycle;
++}
++
++static enum hrtimer_restart pwm_gpio_timer(struct hrtimer *gpio_timer)
++{
++	struct pwm_gpio *gpwm = container_of(gpio_timer, struct pwm_gpio,
++					     gpio_timer);
++	u64 next_toggle;
++	bool new_level;
++
++	guard(spinlock_irqsave)(&gpwm->lock);
++
++	/* Apply new state at end of current period */
++	if (!gpwm->level && gpwm->changing) {
++		gpwm->changing = false;
++		gpwm->state = gpwm->next_state;
++		new_level = !!gpwm->state.duty_cycle;
++	} else {
++		new_level = !gpwm->level;
++	}
++
++	next_toggle = pwm_gpio_toggle(gpwm, new_level);
++	if (next_toggle)
++		hrtimer_forward(gpio_timer, hrtimer_get_expires(gpio_timer),
++				ns_to_ktime(next_toggle));
++
++	return next_toggle ? HRTIMER_RESTART : HRTIMER_NORESTART;
++}
++
++static int pwm_gpio_apply(struct pwm_chip *chip, struct pwm_device *pwm,
++			  const struct pwm_state *state)
++{
++	struct pwm_gpio *gpwm = container_of(chip, struct pwm_gpio, chip);
++	bool invert = state->polarity == PWM_POLARITY_INVERSED;
++
++	if (state->duty_cycle && state->duty_cycle < hrtimer_resolution)
++		return -EINVAL;
++
++	if (state->duty_cycle != state->period &&
++	    (state->period - state->duty_cycle < hrtimer_resolution))
++		return -EINVAL;
++
++	if (!state->enabled) {
++		hrtimer_cancel(&gpwm->gpio_timer);
++	} else if (!gpwm->running) {
++		int ret;
++
++		/*
++		 * This just enables the output, but pwm_gpio_toggle()
++		 * really starts the duty cycle.
++		 */
++		ret = gpiod_direction_output(gpwm->gpio, invert);
++		if (ret)
++			return ret;
++	}
++
++	guard(spinlock_irqsave)(&gpwm->lock);
++
++	if (!state->enabled) {
++		pwm_gpio_round(&gpwm->state, state);
++		gpwm->running = false;
++		gpwm->changing = false;
++
++		gpiod_set_value(gpwm->gpio, invert);
++	} else if (gpwm->running) {
++		pwm_gpio_round(&gpwm->next_state, state);
++		gpwm->changing = true;
++	} else {
++		unsigned long next_toggle;
++
++		pwm_gpio_round(&gpwm->state, state);
++		gpwm->changing = false;
++
++		next_toggle = pwm_gpio_toggle(gpwm, !!state->duty_cycle);
++		if (next_toggle)
++			hrtimer_start(&gpwm->gpio_timer, next_toggle,
++				      HRTIMER_MODE_REL);
++	}
++
++	return 0;
++}
++
++static int pwm_gpio_get_state(struct pwm_chip *chip, struct pwm_device *pwm,
++			       struct pwm_state *state)
++{
++	struct pwm_gpio *gpwm = container_of(chip, struct pwm_gpio, chip);
++
++	guard(spinlock_irqsave)(&gpwm->lock);
++
++	if (gpwm->changing)
++		*state = gpwm->next_state;
++	else
++		*state = gpwm->state;
++
++	return 0;
++}
++
++static const struct pwm_ops pwm_gpio_ops = {
++	.apply = pwm_gpio_apply,
++	.get_state = pwm_gpio_get_state,
++};
++
++static void pwm_gpio_disable_hrtimer(void *data)
++{
++	struct pwm_gpio *gpwm = data;
++
++	hrtimer_cancel(&gpwm->gpio_timer);
++}
++
++static int pwm_gpio_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct pwm_chip *chip;
++	struct pwm_gpio *gpwm;
++	int ret;
++
++	gpwm = devm_kzalloc(&pdev->dev, sizeof(*gpwm), GFP_KERNEL);
++	if (IS_ERR(gpwm))
++		return PTR_ERR(gpwm);
++
++	chip = &gpwm->chip;
++
++	spin_lock_init(&gpwm->lock);
++
++	gpwm->gpio = devm_gpiod_get(dev, NULL, GPIOD_ASIS);
++	if (IS_ERR(gpwm->gpio))
++		return dev_err_probe(dev, PTR_ERR(gpwm->gpio),
++				     "%pfw: could not get gpio\n",
++				     dev_fwnode(dev));
++
++	if (gpiod_cansleep(gpwm->gpio))
++		return dev_err_probe(dev, -EINVAL,
++				     "%pfw: sleeping GPIO not supported\n",
++				     dev_fwnode(dev));
++
++	chip->dev = dev;
++	chip->ops = &pwm_gpio_ops;
++	chip->atomic = true;
++	chip->npwm = 1;
++
++	hrtimer_init(&gpwm->gpio_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
++	ret = devm_add_action_or_reset(dev, pwm_gpio_disable_hrtimer, gpwm);
++	if (ret)
++		return ret;
++
++	gpwm->gpio_timer.function = pwm_gpio_timer;
++
++	return devm_pwmchip_add(dev, chip);
++}
++
++static const struct of_device_id pwm_gpio_dt_ids[] = {
++	{ .compatible = "pwm-gpio" },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, pwm_gpio_dt_ids);
++
++static struct platform_driver pwm_gpio_driver = {
++	.driver = {
++		.name = "pwm-gpio",
++		.of_match_table = pwm_gpio_dt_ids,
++	},
++	.probe = pwm_gpio_probe,
++};
++module_platform_driver(pwm_gpio_driver);
++
++MODULE_DESCRIPTION("PWM GPIO driver");
++MODULE_AUTHOR("Vincent Whitchurch");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/bcm27xx/patches-6.6/950-1355-dtoverlay-Add-a-dtoverlay-for-pwm-gpio.patch b/target/linux/bcm27xx/patches-6.6/950-1355-dtoverlay-Add-a-dtoverlay-for-pwm-gpio.patch
new file mode 100644
index 00000000000000..65c6be6f3fd377
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1355-dtoverlay-Add-a-dtoverlay-for-pwm-gpio.patch
@@ -0,0 +1,79 @@
+From ff0fe12ab875d587348b6f2b9e73ae928049ebee Mon Sep 17 00:00:00 2001
+From: Tim Gover <tim.gover@raspberrypi.com>
+Date: Thu, 31 Oct 2024 16:12:54 +0000
+Subject: [PATCH] dtoverlay: Add a dtoverlay for pwm-gpio
+
+Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/Makefile           |  1 +
+ arch/arm/boot/dts/overlays/README             |  6 +++
+ .../boot/dts/overlays/pwm-gpio-overlay.dts    | 38 +++++++++++++++++++
+ 3 files changed, 45 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/pwm-gpio-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -217,6 +217,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	proto-codec.dtbo \
+ 	pwm.dtbo \
+ 	pwm-2chan.dtbo \
++	pwm-gpio.dtbo \
+ 	pwm-ir-tx.dtbo \
+ 	pwm1.dtbo \
+ 	qca7000.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -3903,6 +3903,12 @@ Params: pin                     Output p
+         clock                   PWM clock frequency (informational)
+ 
+ 
++Name:   pwm-gpio
++Info:   Configures the software PWM GPIO driver
++Load:   dtoverlay=pwm-gpio,<param>=<val>
++Params: gpio                    Output pin (default 4)
++
++
+ Name:   pwm-ir-tx
+ Info:   Use GPIO pin as pwm-assisted infrared transmitter output.
+         This is an alternative to "gpio-ir-tx". pwm-ir-tx makes use
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pwm-gpio-overlay.dts
+@@ -0,0 +1,38 @@
++// Device tree overlay for software GPIO PWM.
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			pwm_gpio_pins: pwm_gpio_pins@4 {
++				brcm,pins = <4>; /* gpio 4 */
++				brcm,function = <1>; /* output */
++				brcm,pull = <0>; /* pull-none */
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			pwm_gpio: pwm_gpio@4 {
++				  compatible = "pwm-gpio";
++				  pinctrl-names = "default";
++				  pinctrl-0 = <&pwm_gpio_pins>;
++				  gpios = <&gpio 4 0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		gpio = <&pwm_gpio>,"gpios:4",
++		       <&pwm_gpio_pins>,"brcm,pins:0",
++		       /* modify reg values to allow multiple instantiation */
++		       <&pwm_gpio>,"reg:0",
++		       <&pwm_gpio_pins>,"reg:0";
++	};
++};
diff --git a/target/linux/bcm27xx/patches-6.6/950-1356-dts-2712-Drop-some-numa-options-from-bootargs.patch b/target/linux/bcm27xx/patches-6.6/950-1356-dts-2712-Drop-some-numa-options-from-bootargs.patch
new file mode 100644
index 00000000000000..245c575e2df57f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1356-dts-2712-Drop-some-numa-options-from-bootargs.patch
@@ -0,0 +1,29 @@
+From 624eb357e1a16385b3d6171e9194e4c5f8d4fd5f Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Wed, 23 Oct 2024 19:09:18 +0100
+Subject: [PATCH] dts: 2712: Drop some numa options from bootargs
+
+iommu_dma_numa_policy=interleave is not valid in the current tree
+It generates an unknown setting will be passed to usespace warning
+
+system_heap.max_order=0 is wanted when numa is enabled, but may not
+be when it is disabled.
+
+Add it on firmware side when we know if numa=fake=<n> is used.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi
+@@ -99,7 +99,7 @@
+ 
+ / {
+ 	chosen: chosen {
+-		bootargs = "reboot=w coherent_pool=1M 8250.nr_uarts=1 pci=pcie_bus_safe cgroup_disable=memory numa_policy=interleave iommu_dma_numa_policy=interleave system_heap.max_order=0";
++		bootargs = "reboot=w coherent_pool=1M 8250.nr_uarts=1 pci=pcie_bus_safe cgroup_disable=memory numa_policy=interleave";
+ 		stdout-path = "serial10:115200n8";
+ 	};
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1357-mmc-quirks-add-more-broken-Kingston-Canvas-Go-SD-car.patch b/target/linux/bcm27xx/patches-6.6/950-1357-mmc-quirks-add-more-broken-Kingston-Canvas-Go-SD-car.patch
new file mode 100644
index 00000000000000..ef5a5a5dcb0c17
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1357-mmc-quirks-add-more-broken-Kingston-Canvas-Go-SD-car.patch
@@ -0,0 +1,42 @@
+From 74f3ca5e39586ea26201fe6eaf1b9e6793b101b7 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Tue, 29 Oct 2024 13:33:21 +0000
+Subject: [PATCH] mmc: quirks: add more broken Kingston Canvas Go! SD card date
+ ranges
+
+A user has reported that a card of this model from late 2021 doesn't
+work, so extend the date range and make it match on all card sizes.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/quirks.h | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -18,10 +18,22 @@
+ static const struct mmc_fixup __maybe_unused mmc_sd_fixups[] = {
+ 	/*
+ 	 * Kingston Canvas Go! Plus microSD cards never finish SD cache flush.
+-	 * This has so far only been observed on cards from 11/2019, while new
+-	 * cards from 2023/05 do not exhibit this behavior.
++	 * This has been observed on cards from 2019/11 and 2021/11, while new
++	 * cards from 2023/05 and 2024/08 do not exhibit this behavior.
+ 	 */
+-	_FIXUP_EXT("SD64G", CID_MANFID_KINGSTON_SD, 0x5449, 2019, 11,
++	_FIXUP_EXT(CID_NAME_ANY, CID_MANFID_KINGSTON_SD, 0x5449, 2019, CID_MONTH_ANY,
++		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
++		   MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
++
++	_FIXUP_EXT(CID_NAME_ANY, CID_MANFID_KINGSTON_SD, 0x5449, 2020, CID_MONTH_ANY,
++		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
++		   MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
++
++	_FIXUP_EXT(CID_NAME_ANY, CID_MANFID_KINGSTON_SD, 0x5449, 2021, CID_MONTH_ANY,
++		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
++		   MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
++
++	_FIXUP_EXT(CID_NAME_ANY, CID_MANFID_KINGSTON_SD, 0x5449, 2022, CID_MONTH_ANY,
+ 		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
+ 		   MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1358-dt-bindings-usb-snps-dwc3-add-FS-HS-periodic-NAK-pol.patch b/target/linux/bcm27xx/patches-6.6/950-1358-dt-bindings-usb-snps-dwc3-add-FS-HS-periodic-NAK-pol.patch
new file mode 100644
index 00000000000000..eaa340f24976a2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1358-dt-bindings-usb-snps-dwc3-add-FS-HS-periodic-NAK-pol.patch
@@ -0,0 +1,35 @@
+From 6c0f34fb0f83741f7f03f6bfd3fcbc89cb2c7cde Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 6 Nov 2024 10:26:55 +0000
+Subject: [PATCH] dt-bindings: usb: snps,dwc3: add FS/HS periodic NAK polling
+ quirk
+
+Add two quirk properties that control whether or not the controller
+issues many more handshakes to FS/HS Async endpoints in a single
+(micro)frame. Enabling these can significantly increase throughput for
+endpoints that frequently respond with NAKs.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ Documentation/devicetree/bindings/usb/snps,dwc3.yaml | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/Documentation/devicetree/bindings/usb/snps,dwc3.yaml
++++ b/Documentation/devicetree/bindings/usb/snps,dwc3.yaml
+@@ -231,6 +231,16 @@ properties:
+     description: When set, disable u2mac linestate check during HS transmit
+     type: boolean
+ 
++  snps,enhanced-nak-fs-quirk:
++    description:
++      When set, the controller schedules many more handshakes to Async FS
++      endpoints, improving throughput when they frequently respond with NAKs.
++
++  snps,enhanced-nak-hs-quirk:
++    description:
++      When set, the controller schedules many more handshakes to Async HS
++      endpoints, improving throughput when they frequently respond with NAKs.
++
+   snps,parkmode-disable-ss-quirk:
+     description:
+       When set, disable park mode for all Superspeed bus instances.
diff --git a/target/linux/bcm27xx/patches-6.6/950-1359-usb-dwc3-core-add-support-for-setting-NAK-enhancemen.patch b/target/linux/bcm27xx/patches-6.6/950-1359-usb-dwc3-core-add-support-for-setting-NAK-enhancemen.patch
new file mode 100644
index 00000000000000..db0cce8d59d1dd
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1359-usb-dwc3-core-add-support-for-setting-NAK-enhancemen.patch
@@ -0,0 +1,77 @@
+From bb53ca75f9e3631e753f397ccab704a8f975658b Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 6 Nov 2024 10:45:24 +0000
+Subject: [PATCH] usb: dwc3: core: add support for setting NAK enhancement bits
+ for FS/HS
+
+If a device frequently NAKs, it can exhaust the scheduled handshakes in
+a frame. It will then not get polled by the controller until the next
+frame interval. This is most noticeable on FS devices as the controller
+schedules a small set of transactions only once per full-speed frame.
+
+Setting the ENH_PER_NAK_FS/LS bits in the GUCTL1 register increases the
+number of transactions that can be scheduled to Async (Control/Bulk)
+endpoints in the respective frame time. In the FS case, this only
+applies to FS devices directly connected to root ports.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/dwc3/core.c | 10 ++++++++++
+ drivers/usb/dwc3/core.h |  6 ++++++
+ 2 files changed, 16 insertions(+)
+
+--- a/drivers/usb/dwc3/core.c
++++ b/drivers/usb/dwc3/core.c
+@@ -1361,6 +1361,12 @@ static int dwc3_core_init(struct dwc3 *d
+ 		if (dwc->dis_tx_ipgap_linecheck_quirk)
+ 			reg |= DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS;
+ 
++		if (dwc->enh_nak_fs_quirk)
++			reg |= DWC3_GUCTL1_NAK_PER_ENH_FS;
++
++		if (dwc->enh_nak_hs_quirk)
++			reg |= DWC3_GUCTL1_NAK_PER_ENH_HS;
++
+ 		if (dwc->parkmode_disable_ss_quirk)
+ 			reg |= DWC3_GUCTL1_PARKMODE_DISABLE_SS;
+ 
+@@ -1633,6 +1639,10 @@ static void dwc3_get_properties(struct d
+ 				"snps,resume-hs-terminations");
+ 	dwc->ulpi_ext_vbus_drv = device_property_read_bool(dev,
+ 				"snps,ulpi-ext-vbus-drv");
++	dwc->enh_nak_fs_quirk = device_property_read_bool(dev,
++				"snps,enhanced-nak-fs-quirk");
++	dwc->enh_nak_hs_quirk = device_property_read_bool(dev,
++				"snps,enhanced-nak-hs-quirk");
+ 	dwc->parkmode_disable_ss_quirk = device_property_read_bool(dev,
+ 				"snps,parkmode-disable-ss-quirk");
+ 	dwc->parkmode_disable_hs_quirk = device_property_read_bool(dev,
+--- a/drivers/usb/dwc3/core.h
++++ b/drivers/usb/dwc3/core.h
+@@ -266,6 +266,8 @@
+ #define DWC3_GUCTL1_TX_IPGAP_LINECHECK_DIS	BIT(28)
+ #define DWC3_GUCTL1_DEV_FORCE_20_CLK_FOR_30_CLK	BIT(26)
+ #define DWC3_GUCTL1_DEV_L1_EXIT_BY_HW		BIT(24)
++#define DWC3_GUCTL1_NAK_PER_ENH_FS		BIT(19)
++#define DWC3_GUCTL1_NAK_PER_ENH_HS		BIT(18)
+ #define DWC3_GUCTL1_PARKMODE_DISABLE_SS		BIT(17)
+ #define DWC3_GUCTL1_PARKMODE_DISABLE_HS		BIT(16)
+ #define DWC3_GUCTL1_PARKMODE_DISABLE_FSLS	BIT(15)
+@@ -1119,6 +1121,8 @@ struct dwc3_scratchpad_array {
+  *			generation after resume from suspend.
+  * @ulpi_ext_vbus_drv: Set to confiure the upli chip to drives CPEN pin
+  *			VBUS with an external supply.
++ * @enh_nak_fs_quirk: Set to schedule more handshakes to Async FS endpoints.
++ * @enh_nak_hs_quirk: Set to schedule more handshakes to Async HS endpoints.
+  * @parkmode_disable_ss_quirk: If set, disable park mode feature for all
+  *			Superspeed instances.
+  * @parkmode_disable_hs_quirk: If set, disable park mode feature for all
+@@ -1348,6 +1352,8 @@ struct dwc3 {
+ 	unsigned		dis_tx_ipgap_linecheck_quirk:1;
+ 	unsigned		resume_hs_terminations:1;
+ 	unsigned		ulpi_ext_vbus_drv:1;
++	unsigned		enh_nak_fs_quirk:1;
++	unsigned		enh_nak_hs_quirk:1;
+ 	unsigned		parkmode_disable_ss_quirk:1;
+ 	unsigned		parkmode_disable_hs_quirk:1;
+ 	unsigned		parkmode_disable_fsls_quirk:1;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1360-DTS-rp1-set-enhanced-FS-NAK-quirk-for-usb3-controlle.patch b/target/linux/bcm27xx/patches-6.6/950-1360-DTS-rp1-set-enhanced-FS-NAK-quirk-for-usb3-controlle.patch
new file mode 100644
index 00000000000000..a305dc13fd1da8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1360-DTS-rp1-set-enhanced-FS-NAK-quirk-for-usb3-controlle.patch
@@ -0,0 +1,30 @@
+From 803757627b48bdad9530b50053321fdea6dfcab4 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 6 Nov 2024 10:54:58 +0000
+Subject: [PATCH] DTS: rp1: set enhanced FS NAK quirk for usb3 controllers
+
+There seem to be only benefits, and no downsides.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/rp1.dtsi | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/rp1.dtsi
++++ b/arch/arm64/boot/dts/broadcom/rp1.dtsi
+@@ -1077,6 +1077,7 @@
+ 			usb3-lpm-capable;
+ 			snps,axi-pipe-limit = /bits/ 8 <8>;
+ 			snps,dis_rxdet_inp3_quirk;
++			snps,enhanced-nak-fs-quirk;
+ 			snps,parkmode-disable-ss-quirk;
+ 			snps,parkmode-disable-hs-quirk;
+ 			snps,parkmode-disable-fsls-quirk;
+@@ -1093,6 +1094,7 @@
+ 			usb3-lpm-capable;
+ 			snps,axi-pipe-limit = /bits/ 8 <8>;
+ 			snps,dis_rxdet_inp3_quirk;
++			snps,enhanced-nak-fs-quirk;
+ 			snps,parkmode-disable-ss-quirk;
+ 			snps,parkmode-disable-hs-quirk;
+ 			snps,parkmode-disable-fsls-quirk;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1361-drivers-usb-xhci-prevent-a-theoretical-race-on-non-c.patch b/target/linux/bcm27xx/patches-6.6/950-1361-drivers-usb-xhci-prevent-a-theoretical-race-on-non-c.patch
new file mode 100644
index 00000000000000..50819fc7f2070e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1361-drivers-usb-xhci-prevent-a-theoretical-race-on-non-c.patch
@@ -0,0 +1,50 @@
+From e9e852af347ae3ccee4e7abb01f9ef91387980f9 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 6 Nov 2024 11:07:55 +0000
+Subject: [PATCH] drivers: usb: xhci: prevent a theoretical race on
+ non-coherent platforms
+
+For platforms that have xHCI controllers attached over PCIe, and
+non-coherent routes to main memory, a theoretical race exists between
+posting new TRBs to a ring, and writing to the doorbell register.
+
+In a contended system, write traffic from the CPU may be stalled before
+the memory controller, whereas the CPU to Endpoint route is separate
+and not likely to be contended. Similarly, the DMA route from the
+endpoint to main memory may be separate and uncontended.
+
+Therefore the xHCI can receive a doorbell write and find a stale view
+of a transfer ring. In cases where only a single TRB is ping-ponged at
+a time, this can cause the endpoint to not get polled at all.
+
+Adding a readl() before the write forces a round-trip transaction
+across PCIe, definitively serialising the CPU along the PCI
+producer-consumer ordering rules.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-ring.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -507,6 +507,19 @@ void xhci_ring_ep_doorbell(struct xhci_h
+ 
+ 	trace_xhci_ring_ep_doorbell(slot_id, DB_VALUE(ep_index, stream_id));
+ 
++	/*
++	 * For non-coherent systems with PCIe DMA (such as Pi 4, Pi 5) there
++	 * is a theoretical race between the TRB write and barrier, which
++	 * is reported complete as soon as the write leaves the CPU domain,
++	 * the doorbell write, which may be reported as complete by the RC
++	 * at some arbitrary point, and the visibility of new TRBs in system
++	 * RAM by the endpoint DMA engine.
++	 *
++	 * This read before the write positively serialises the CPU state
++	 * by incurring a round-trip across the link.
++	 */
++	readl(db_addr);
++
+ 	writel(DB_VALUE(ep_index, stream_id), db_addr);
+ 	/* flush the write */
+ 	readl(db_addr);
diff --git a/target/linux/bcm27xx/patches-6.6/950-1362-iio-humidity-dht11-Allow-non-zero-decimals.patch b/target/linux/bcm27xx/patches-6.6/950-1362-iio-humidity-dht11-Allow-non-zero-decimals.patch
new file mode 100644
index 00000000000000..19935d0ea59500
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1362-iio-humidity-dht11-Allow-non-zero-decimals.patch
@@ -0,0 +1,32 @@
+From ce65ed02cb6707ae5c9f3a304f5b0124f4eed559 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 4 Nov 2024 14:10:53 +0000
+Subject: [PATCH] iio: humidity: dht11: Allow non-zero decimals
+
+The DHT11 datasheet is pretty cryptic, but it does suggest that after
+each integer value (humidity and temperature) there are "decimal"
+values. Validate these as integers in the range 0-9 and treat them as
+tenths of a unit.
+
+Link: https://github.com/raspberrypi/linux/issues/6220
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/iio/humidity/dht11.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/iio/humidity/dht11.c
++++ b/drivers/iio/humidity/dht11.c
+@@ -152,9 +152,9 @@ static int dht11_decode(struct dht11 *dh
+ 		dht11->temperature = (((temp_int & 0x7f) << 8) + temp_dec) *
+ 					((temp_int & 0x80) ? -100 : 100);
+ 		dht11->humidity = ((hum_int << 8) + hum_dec) * 100;
+-	} else if (temp_dec == 0 && hum_dec == 0) {  /* DHT11 */
+-		dht11->temperature = temp_int * 1000;
+-		dht11->humidity = hum_int * 1000;
++	} else if (temp_dec < 10 && hum_dec < 10) {  /* DHT11 */
++		dht11->temperature = temp_int * 1000 + temp_dec * 100;
++		dht11->humidity = hum_int * 1000 + hum_dec * 100;
+ 	} else {
+ 		dev_err(dht11->dev,
+ 			"Don't know how to decode data: %d %d %d %d\n",
diff --git a/target/linux/bcm27xx/patches-6.6/950-1363-drm-vc4-Correct-condition-for-ignoring-a-plane-to-sr.patch b/target/linux/bcm27xx/patches-6.6/950-1363-drm-vc4-Correct-condition-for-ignoring-a-plane-to-sr.patch
new file mode 100644
index 00000000000000..9b018248a501e7
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1363-drm-vc4-Correct-condition-for-ignoring-a-plane-to-sr.patch
@@ -0,0 +1,41 @@
+From c3393ac1098d1f191e37eed73bf366ebc88ac4ee Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 11 Sep 2024 14:49:05 +0100
+Subject: [PATCH] drm/vc4: Correct condition for ignoring a plane to src rect
+ =0, not <1.0
+
+The logic for dropping a plane less than zero didn't account for the
+possibility that a plane could be being upscaled with a src_rect with
+width/height < 1 pixel, but not 0 subpixels.
+
+Check for not 0 subpixels, not < 1, in both vc4 and vc6 paths.
+
+Fixes: dac616899f87 ("drm/vc4: Drop planes that have 0 destination size")
+Fixes: f73b18eb0d48 ("drm/vc4: Drop planes that are completely off-screen")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -1160,7 +1160,8 @@ static int vc4_plane_mode_set(struct drm
+ 	width = vc4_state->src_w[0] >> 16;
+ 	height = vc4_state->src_h[0] >> 16;
+ 
+-	if (!width || !height || !vc4_state->crtc_w || !vc4_state->crtc_h) {
++	if (!vc4_state->src_w[0] || !vc4_state->src_h[0] ||
++	    !vc4_state->crtc_w || !vc4_state->crtc_h) {
+ 		/* 0 source size probably means the plane is offscreen */
+ 		vc4_state->dlist_initialized = 1;
+ 		return 0;
+@@ -1698,7 +1699,8 @@ static int vc6_plane_mode_set(struct drm
+ 	width = vc4_state->src_w[0] >> 16;
+ 	height = vc4_state->src_h[0] >> 16;
+ 
+-	if (!width || !height || !vc4_state->crtc_w || !vc4_state->crtc_h) {
++	if (!vc4_state->src_w[0] || !vc4_state->src_h[0] ||
++	    !vc4_state->crtc_w || !vc4_state->crtc_h) {
+ 		/* 0 source size probably means the plane is offscreen.
+ 		 * 0 destination size is a redundant plane.
+ 		 */
diff --git a/target/linux/bcm27xx/patches-6.6/950-1364-drm-vc4-Use-the-TPZ-scaling-filter-for-1x1-source-im.patch b/target/linux/bcm27xx/patches-6.6/950-1364-drm-vc4-Use-the-TPZ-scaling-filter-for-1x1-source-im.patch
new file mode 100644
index 00000000000000..5a7b3e4c1ef289
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1364-drm-vc4-Use-the-TPZ-scaling-filter-for-1x1-source-im.patch
@@ -0,0 +1,59 @@
+From ca621585c573cae54dc1235d90822e8bcef2f73d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 11 Sep 2024 15:23:33 +0100
+Subject: [PATCH] drm/vc4: Use the TPZ scaling filter for 1x1 source images
+
+The documentation says that the TPZ filter can not upscale,
+and requesting a scaling factor > 1:1 will output the original
+image in the top left, and repeat the right/bottom most pixels
+thereafter.
+That fits perfectly with upscaling a 1x1 image which is done
+a fair amount by some compositors to give solid colour, and it
+saves a large amount of LBM (TPZ is based on src size, whilst
+PPF is based on dest size).
+
+Select TPZ filter for images with source rectangle <=1.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 21 +++++++++++++++------
+ 1 file changed, 15 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -265,7 +265,11 @@ static enum vc4_scaling_mode vc4_get_sca
+ {
+ 	if (dst == src >> 16)
+ 		return VC4_SCALING_NONE;
+-	if (3 * dst >= 2 * (src >> 16))
++
++	if (src <= (1 << 16))
++		/* Source rectangle <= 1 pixel can use TPZ for resize/upscale */
++		return VC4_SCALING_TPZ;
++	else if (3 * dst >= 2 * (src >> 16))
+ 		return VC4_SCALING_PPF;
+ 	else
+ 		return VC4_SCALING_TPZ;
+@@ -560,12 +564,17 @@ static void vc4_write_tpz(struct vc4_pla
+ 
+ 	WARN_ON_ONCE(vc4->gen > VC4_GEN_6);
+ 
+-	scale = src / dst;
++	if ((dst << 16) < src) {
++		scale = src / dst;
+ 
+-	/* The specs note that while the reciprocal would be defined
+-	 * as (1<<32)/scale, ~0 is close enough.
+-	 */
+-	recip = ~0 / scale;
++		/* The specs note that while the reciprocal would be defined
++		 * as (1<<32)/scale, ~0 is close enough.
++		 */
++		recip = ~0 / scale;
++	} else {
++		scale = (1 << 16) + 1;
++		recip = (1 << 16) - 1;
++	}
+ 
+ 	vc4_dlist_write(vc4_state,
+ 			/*
diff --git a/target/linux/bcm27xx/patches-6.6/950-1365-drm-Set-non-desktop-property-to-true-for-writeback-a.patch b/target/linux/bcm27xx/patches-6.6/950-1365-drm-Set-non-desktop-property-to-true-for-writeback-a.patch
new file mode 100644
index 00000000000000..a1ac849e3e1e09
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1365-drm-Set-non-desktop-property-to-true-for-writeback-a.patch
@@ -0,0 +1,30 @@
+From 68b0ff3549148e614e1733d773cee8e689c763c6 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 20 Aug 2024 16:25:10 +0100
+Subject: [PATCH] drm: Set non-desktop property to true for writeback and
+ virtual connectors
+
+The non-desktop property "Indicates the output should be ignored for
+purposes of displaying a standard desktop environment or console."
+
+That sounds like it should be true for all writeback and virtual
+connectors as you shouldn't render a desktop to them, so set it
+by default.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_connector.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_connector.c
++++ b/drivers/gpu/drm/drm_connector.c
+@@ -362,7 +362,8 @@ static int __drm_connector_init(struct d
+ 
+ 	drm_object_attach_property(&connector->base,
+ 				   config->non_desktop_property,
+-				   0);
++				   (connector_type != DRM_MODE_CONNECTOR_VIRTUAL &&
++				   connector_type != DRM_MODE_CONNECTOR_WRITEBACK) ? 0 : 1;
+ 	drm_object_attach_property(&connector->base,
+ 				   config->tile_property,
+ 				   0);
diff --git a/target/linux/bcm27xx/patches-6.6/950-1366-drm-Increase-plane_mask-to-64bit.patch b/target/linux/bcm27xx/patches-6.6/950-1366-drm-Increase-plane_mask-to-64bit.patch
new file mode 100644
index 00000000000000..f3ae9be4fdc279
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1366-drm-Increase-plane_mask-to-64bit.patch
@@ -0,0 +1,101 @@
+From 8181e682d6f4ef209845ec24f0a1eb37764d6731 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 21 Oct 2022 14:26:12 +0100
+Subject: [PATCH] drm: Increase plane_mask to 64bit.
+
+The limit of 32 planes per DRM device is dictated by the use
+of planes_mask returning a u32.
+
+Change to a u64 such that 64 planes can be supported by a device.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_atomic.c           | 2 +-
+ drivers/gpu/drm/drm_framebuffer.c      | 2 +-
+ drivers/gpu/drm/drm_mode_config.c      | 2 +-
+ drivers/gpu/drm/drm_plane.c            | 2 +-
+ drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c | 2 +-
+ include/drm/drm_crtc.h                 | 2 +-
+ include/drm/drm_plane.h                | 4 ++--
+ 7 files changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -451,7 +451,7 @@ static void drm_atomic_crtc_print_state(
+ 	drm_printf(p, "\tactive_changed=%d\n", state->active_changed);
+ 	drm_printf(p, "\tconnectors_changed=%d\n", state->connectors_changed);
+ 	drm_printf(p, "\tcolor_mgmt_changed=%d\n", state->color_mgmt_changed);
+-	drm_printf(p, "\tplane_mask=%x\n", state->plane_mask);
++	drm_printf(p, "\tplane_mask=%llx\n", state->plane_mask);
+ 	drm_printf(p, "\tconnector_mask=%x\n", state->connector_mask);
+ 	drm_printf(p, "\tencoder_mask=%x\n", state->encoder_mask);
+ 	drm_printf(p, "\tmode: " DRM_MODE_FMT "\n", DRM_MODE_ARG(&state->mode));
+--- a/drivers/gpu/drm/drm_framebuffer.c
++++ b/drivers/gpu/drm/drm_framebuffer.c
+@@ -986,7 +986,7 @@ static int atomic_remove_fb(struct drm_f
+ 	struct drm_connector *conn __maybe_unused;
+ 	struct drm_connector_state *conn_state;
+ 	int i, ret;
+-	unsigned plane_mask;
++	u64 plane_mask;
+ 	bool disable_crtcs = false;
+ 
+ retry_disable:
+--- a/drivers/gpu/drm/drm_mode_config.c
++++ b/drivers/gpu/drm/drm_mode_config.c
+@@ -636,7 +636,7 @@ void drm_mode_config_validate(struct drm
+ 	struct drm_encoder *encoder;
+ 	struct drm_crtc *crtc;
+ 	struct drm_plane *plane;
+-	u32 primary_with_crtc = 0, cursor_with_crtc = 0;
++	u64 primary_with_crtc = 0, cursor_with_crtc = 0;
+ 	unsigned int num_primary = 0;
+ 
+ 	if (!drm_core_check_feature(dev, DRIVER_MODESET))
+--- a/drivers/gpu/drm/drm_plane.c
++++ b/drivers/gpu/drm/drm_plane.c
+@@ -249,7 +249,7 @@ static int __drm_universal_plane_init(st
+ 	int ret;
+ 
+ 	/* plane index is used with 32bit bitmasks */
+-	if (WARN_ON(config->num_total_plane >= 32))
++	if (WARN_ON(config->num_total_plane >= 64))
+ 		return -EINVAL;
+ 
+ 	/*
+--- a/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
++++ b/drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
+@@ -230,7 +230,7 @@ static int ipu_crtc_atomic_check(struct
+ {
+ 	struct drm_crtc_state *crtc_state = drm_atomic_get_new_crtc_state(state,
+ 									  crtc);
+-	u32 primary_plane_mask = drm_plane_mask(crtc->primary);
++	u64 primary_plane_mask = drm_plane_mask(crtc->primary);
+ 
+ 	if (crtc_state->active && (primary_plane_mask & crtc_state->plane_mask) == 0)
+ 		return -EINVAL;
+--- a/include/drm/drm_crtc.h
++++ b/include/drm/drm_crtc.h
+@@ -192,7 +192,7 @@ struct drm_crtc_state {
+ 	 * @plane_mask: Bitmask of drm_plane_mask(plane) of planes attached to
+ 	 * this CRTC.
+ 	 */
+-	u32 plane_mask;
++	u64 plane_mask;
+ 
+ 	/**
+ 	 * @connector_mask: Bitmask of drm_connector_mask(connector) of
+--- a/include/drm/drm_plane.h
++++ b/include/drm/drm_plane.h
+@@ -915,9 +915,9 @@ static inline unsigned int drm_plane_ind
+  * drm_plane_mask - find the mask of a registered plane
+  * @plane: plane to find mask for
+  */
+-static inline u32 drm_plane_mask(const struct drm_plane *plane)
++static inline u64 drm_plane_mask(const struct drm_plane *plane)
+ {
+-	return 1 << drm_plane_index(plane);
++	return 1ULL << drm_plane_index(plane);
+ }
+ 
+ struct drm_plane * drm_plane_from_index(struct drm_device *dev, int idx);
diff --git a/target/linux/bcm27xx/patches-6.6/950-1367-drm-vc4-Increase-number-of-overlay-planes-from-16-to.patch b/target/linux/bcm27xx/patches-6.6/950-1367-drm-vc4-Increase-number-of-overlay-planes-from-16-to.patch
new file mode 100644
index 00000000000000..564d7abeb6a489
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1367-drm-vc4-Increase-number-of-overlay-planes-from-16-to.patch
@@ -0,0 +1,42 @@
+From 5dc4cef7d7fcda4ea59b9e456a835fa54336af6b Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 21 Oct 2022 14:27:45 +0100
+Subject: [PATCH] drm/vc4: Increase number of overlay planes from 16 to 48
+
+The HVS can accept an arbitrary number of planes, provided
+that the overall pixel read load is within limits, and
+the display list can fit into the dlist memory.
+
+Now that DRM will support 64 planes per device, increase
+the number of overlay planes from 16 to 48 so that the
+dlist complexity can be increased (eg 4x4 video wall on
+each of 3 displays).
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_connector.c | 2 +-
+ drivers/gpu/drm/vc4/vc4_plane.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/drm_connector.c
++++ b/drivers/gpu/drm/drm_connector.c
+@@ -363,7 +363,7 @@ static int __drm_connector_init(struct d
+ 	drm_object_attach_property(&connector->base,
+ 				   config->non_desktop_property,
+ 				   (connector_type != DRM_MODE_CONNECTOR_VIRTUAL &&
+-				   connector_type != DRM_MODE_CONNECTOR_WRITEBACK) ? 0 : 1;
++				   connector_type != DRM_MODE_CONNECTOR_WRITEBACK) ? 0 : 1);
+ 	drm_object_attach_property(&connector->base,
+ 				   config->tile_property,
+ 				   0);
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -2517,7 +2517,7 @@ struct drm_plane *vc4_plane_init(struct
+ 	return plane;
+ }
+ 
+-#define VC4_NUM_OVERLAY_PLANES	16
++#define VC4_NUM_OVERLAY_PLANES	48
+ 
+ int vc4_plane_create_additional_planes(struct drm_device *drm)
+ {
diff --git a/target/linux/bcm27xx/patches-6.6/950-1368-drm-vc4-Assign-32-overlay-planes-to-writeback-only.patch b/target/linux/bcm27xx/patches-6.6/950-1368-drm-vc4-Assign-32-overlay-planes-to-writeback-only.patch
new file mode 100644
index 00000000000000..40eff3cc1ffd80
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1368-drm-vc4-Assign-32-overlay-planes-to-writeback-only.patch
@@ -0,0 +1,71 @@
+From dd340cb082a020fbd42b794493ffd063dd8e15b4 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 15 Aug 2023 15:44:34 +0100
+Subject: [PATCH] drm/vc4: Assign 32 overlay planes to writeback only
+
+Instead of having 48 generic overlay planes, assign 32 to the
+writeback connector so that there is no ambiguity in wlroots
+when trying to find a plane for composition using the writeback
+connector vs display.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_plane.c | 34 +++++++++++++++++++++++++++++++--
+ 1 file changed, 32 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -2517,13 +2517,28 @@ struct drm_plane *vc4_plane_init(struct
+ 	return plane;
+ }
+ 
+-#define VC4_NUM_OVERLAY_PLANES	48
++#define VC4_NUM_OVERLAY_PLANES	16
++#define VC4_NUM_TXP_OVERLAY_PLANES 32
+ 
+ int vc4_plane_create_additional_planes(struct drm_device *drm)
+ {
+ 	struct drm_plane *cursor_plane;
+ 	struct drm_crtc *crtc;
+ 	unsigned int i;
++	struct drm_crtc *txp_crtc;
++	uint32_t non_txp_crtc_mask;
++
++	drm_for_each_crtc(crtc, drm) {
++		struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc);
++
++		if (vc4_crtc->feeds_txp) {
++			txp_crtc = crtc;
++			break;
++		}
++	}
++
++	non_txp_crtc_mask = GENMASK(drm->mode_config.num_crtc - 1, 0) -
++					drm_crtc_mask(txp_crtc);
+ 
+ 	/* Set up some arbitrary number of planes.  We're not limited
+ 	 * by a set number of physical registers, just the space in
+@@ -2537,7 +2552,22 @@ int vc4_plane_create_additional_planes(s
+ 	for (i = 0; i < VC4_NUM_OVERLAY_PLANES; i++) {
+ 		struct drm_plane *plane =
+ 			vc4_plane_init(drm, DRM_PLANE_TYPE_OVERLAY,
+-				       GENMASK(drm->mode_config.num_crtc - 1, 0));
++				       non_txp_crtc_mask);
++
++		if (IS_ERR(plane))
++			continue;
++
++		/* Create zpos property. Max of all the overlays + 1 primary +
++		 * 1 cursor plane on a crtc.
++		 */
++		drm_plane_create_zpos_property(plane, i + 1, 1,
++					       VC4_NUM_OVERLAY_PLANES + 1);
++	}
++
++	for (i = 0; i < VC4_NUM_TXP_OVERLAY_PLANES; i++) {
++		struct drm_plane *plane =
++			vc4_plane_init(drm, DRM_PLANE_TYPE_OVERLAY,
++				       drm_crtc_mask(txp_crtc));
+ 
+ 		if (IS_ERR(plane))
+ 			continue;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1369-drm-Add-a-DRM_MODE_TRANSPOSE-option-to-the-DRM-rotat.patch b/target/linux/bcm27xx/patches-6.6/950-1369-drm-Add-a-DRM_MODE_TRANSPOSE-option-to-the-DRM-rotat.patch
new file mode 100644
index 00000000000000..ccda8b05c2d1b3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1369-drm-Add-a-DRM_MODE_TRANSPOSE-option-to-the-DRM-rotat.patch
@@ -0,0 +1,47 @@
+From b3b3d12cf0734318a0fed0b33e13d714188369db Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 22 Oct 2024 17:17:31 +0100
+Subject: [PATCH] drm: Add a DRM_MODE_TRANSPOSE option to the DRM rotation
+ property
+
+Some hardware will implement transpose as a rotation operation,
+which when combined with X and Y reflect can result in a rotation,
+but is a discrete operation in its own right.
+
+Add an option for transpose only.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_blend.c | 3 +++
+ include/uapi/drm/drm_mode.h | 1 +
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/drm_blend.c
++++ b/drivers/gpu/drm/drm_blend.c
+@@ -263,6 +263,8 @@ EXPORT_SYMBOL(drm_plane_create_alpha_pro
+  * 	"reflect-x"
+  * DRM_MODE_REFLECT_Y:
+  * 	"reflect-y"
++ * DRM_MODE_TRANSPOSE:
++ * 	"transpose"
+  *
+  * Rotation is the specified amount in degrees in counter clockwise direction,
+  * the X and Y axis are within the source rectangle, i.e.  the X/Y axis before
+@@ -280,6 +282,7 @@ int drm_plane_create_rotation_property(s
+ 		{ __builtin_ffs(DRM_MODE_ROTATE_270) - 1, "rotate-270" },
+ 		{ __builtin_ffs(DRM_MODE_REFLECT_X) - 1,  "reflect-x" },
+ 		{ __builtin_ffs(DRM_MODE_REFLECT_Y) - 1,  "reflect-y" },
++		{ __builtin_ffs(DRM_MODE_TRANSPOSE) - 1,  "transpose" },
+ 	};
+ 	struct drm_property *prop;
+ 
+--- a/include/uapi/drm/drm_mode.h
++++ b/include/uapi/drm/drm_mode.h
+@@ -203,6 +203,7 @@ extern "C" {
+  */
+ #define DRM_MODE_REFLECT_X      (1<<4)
+ #define DRM_MODE_REFLECT_Y      (1<<5)
++#define DRM_MODE_TRANSPOSE      (1<<6)
+ 
+ /*
+  * DRM_MODE_REFLECT_MASK
diff --git a/target/linux/bcm27xx/patches-6.6/950-1370-drm-Add-a-rotation-parameter-to-connectors.patch b/target/linux/bcm27xx/patches-6.6/950-1370-drm-Add-a-rotation-parameter-to-connectors.patch
new file mode 100644
index 00000000000000..e803a7732f068e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1370-drm-Add-a-rotation-parameter-to-connectors.patch
@@ -0,0 +1,164 @@
+From 8fec3ff870499256f2c18fe7983f6ed3fea4faaf Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 22 Oct 2024 17:22:40 +0100
+Subject: [PATCH] drm: Add a rotation parameter to connectors.
+
+Some connectors, particularly writeback, can implement flip
+or transpose operations as writing back to memory.
+
+Add a connector rotation property to control this.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_atomic_uapi.c |  4 +++
+ drivers/gpu/drm/drm_blend.c       | 50 ++++++++++++++++++++++++-------
+ include/drm/drm_blend.h           |  5 ++++
+ include/drm/drm_connector.h       | 11 +++++++
+ 4 files changed, 60 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/drm_atomic_uapi.c
++++ b/drivers/gpu/drm/drm_atomic_uapi.c
+@@ -811,6 +811,8 @@ static int drm_atomic_connector_set_prop
+ 		state->max_requested_bpc = val;
+ 	} else if (property == connector->privacy_screen_sw_state_property) {
+ 		state->privacy_screen_sw_state = val;
++	} else if (property == connector->rotation_property) {
++		state->rotation = val;
+ 	} else if (connector->funcs->atomic_set_property) {
+ 		return connector->funcs->atomic_set_property(connector,
+ 				state, property, val);
+@@ -900,6 +902,8 @@ drm_atomic_connector_get_property(struct
+ 		*val = state->max_requested_bpc;
+ 	} else if (property == connector->privacy_screen_sw_state_property) {
+ 		*val = state->privacy_screen_sw_state;
++	} else if (property == connector->rotation_property) {
++		*val = state->rotation;
+ 	} else if (connector->funcs->atomic_get_property) {
+ 		return connector->funcs->atomic_get_property(connector,
+ 				state, property, val);
+--- a/drivers/gpu/drm/drm_blend.c
++++ b/drivers/gpu/drm/drm_blend.c
+@@ -235,6 +235,16 @@ int drm_plane_create_alpha_property(stru
+ }
+ EXPORT_SYMBOL(drm_plane_create_alpha_property);
+ 
++static const struct drm_prop_enum_list drm_rotate_props[] = {
++	{ __builtin_ffs(DRM_MODE_ROTATE_0) - 1,   "rotate-0" },
++	{ __builtin_ffs(DRM_MODE_ROTATE_90) - 1,  "rotate-90" },
++	{ __builtin_ffs(DRM_MODE_ROTATE_180) - 1, "rotate-180" },
++	{ __builtin_ffs(DRM_MODE_ROTATE_270) - 1, "rotate-270" },
++	{ __builtin_ffs(DRM_MODE_REFLECT_X) - 1,  "reflect-x" },
++	{ __builtin_ffs(DRM_MODE_REFLECT_Y) - 1,  "reflect-y" },
++	{ __builtin_ffs(DRM_MODE_TRANSPOSE) - 1,  "transpose" },
++};
++
+ /**
+  * drm_plane_create_rotation_property - create a new rotation property
+  * @plane: drm plane
+@@ -275,15 +285,6 @@ int drm_plane_create_rotation_property(s
+ 				       unsigned int rotation,
+ 				       unsigned int supported_rotations)
+ {
+-	static const struct drm_prop_enum_list props[] = {
+-		{ __builtin_ffs(DRM_MODE_ROTATE_0) - 1,   "rotate-0" },
+-		{ __builtin_ffs(DRM_MODE_ROTATE_90) - 1,  "rotate-90" },
+-		{ __builtin_ffs(DRM_MODE_ROTATE_180) - 1, "rotate-180" },
+-		{ __builtin_ffs(DRM_MODE_ROTATE_270) - 1, "rotate-270" },
+-		{ __builtin_ffs(DRM_MODE_REFLECT_X) - 1,  "reflect-x" },
+-		{ __builtin_ffs(DRM_MODE_REFLECT_Y) - 1,  "reflect-y" },
+-		{ __builtin_ffs(DRM_MODE_TRANSPOSE) - 1,  "transpose" },
+-	};
+ 	struct drm_property *prop;
+ 
+ 	WARN_ON((supported_rotations & DRM_MODE_ROTATE_MASK) == 0);
+@@ -291,7 +292,8 @@ int drm_plane_create_rotation_property(s
+ 	WARN_ON(rotation & ~supported_rotations);
+ 
+ 	prop = drm_property_create_bitmask(plane->dev, 0, "rotation",
+-					   props, ARRAY_SIZE(props),
++					   drm_rotate_props,
++					   ARRAY_SIZE(drm_rotate_props),
+ 					   supported_rotations);
+ 	if (!prop)
+ 		return -ENOMEM;
+@@ -307,6 +309,34 @@ int drm_plane_create_rotation_property(s
+ }
+ EXPORT_SYMBOL(drm_plane_create_rotation_property);
+ 
++int drm_connector_create_rotation_property(struct drm_connector *conn,
++					   unsigned int rotation,
++					   unsigned int supported_rotations)
++{
++	struct drm_property *prop;
++
++	WARN_ON((supported_rotations & DRM_MODE_ROTATE_MASK) == 0);
++	WARN_ON(!is_power_of_2(rotation & DRM_MODE_ROTATE_MASK));
++	WARN_ON(rotation & ~supported_rotations);
++
++	prop = drm_property_create_bitmask(conn->dev, 0, "rotation",
++					   drm_rotate_props,
++					   ARRAY_SIZE(drm_rotate_props),
++					   supported_rotations);
++	if (!prop)
++		return -ENOMEM;
++
++	drm_object_attach_property(&conn->base, prop, rotation);
++
++	if (conn->state)
++		conn->state->rotation = rotation;
++
++	conn->rotation_property = prop;
++
++	return 0;
++}
++EXPORT_SYMBOL(drm_connector_create_rotation_property);
++
+ /**
+  * drm_rotation_simplify() - Try to simplify the rotation
+  * @rotation: Rotation to be simplified
+--- a/include/drm/drm_blend.h
++++ b/include/drm/drm_blend.h
+@@ -34,6 +34,7 @@
+ struct drm_device;
+ struct drm_atomic_state;
+ struct drm_plane;
++struct drm_connector;
+ 
+ static inline bool drm_rotation_90_or_270(unsigned int rotation)
+ {
+@@ -58,4 +59,8 @@ int drm_atomic_normalize_zpos(struct drm
+ 			      struct drm_atomic_state *state);
+ int drm_plane_create_blend_mode_property(struct drm_plane *plane,
+ 					 unsigned int supported_modes);
++
++int drm_connector_create_rotation_property(struct drm_connector *conn,
++					   unsigned int rotation,
++					   unsigned int supported_rotations);
+ #endif
+--- a/include/drm/drm_connector.h
++++ b/include/drm/drm_connector.h
+@@ -1029,6 +1029,11 @@ struct drm_connector_state {
+ 	 * DRM blob property for HDR output metadata
+ 	 */
+ 	struct drm_property_blob *hdr_output_metadata;
++
++	/**
++	 * @rotation: Connector property to rotate the maximum output image.
++	 */
++	u32 rotation;
+ };
+ 
+ /**
+@@ -1696,6 +1701,12 @@ struct drm_connector {
+ 	 */
+ 	struct drm_property *privacy_screen_hw_state_property;
+ 
++	/**
++	 * @rotation_property: Optional DRM property controlling rotation of the
++	 * output.
++	 */
++	struct drm_property *rotation_property;
++
+ #define DRM_CONNECTOR_POLL_HPD (1 << 0)
+ #define DRM_CONNECTOR_POLL_CONNECT (1 << 1)
+ #define DRM_CONNECTOR_POLL_DISCONNECT (1 << 2)
diff --git a/target/linux/bcm27xx/patches-6.6/950-1371-drm-vc4-txp-Add-a-rotation-property-to-the-writeback.patch b/target/linux/bcm27xx/patches-6.6/950-1371-drm-vc4-txp-Add-a-rotation-property-to-the-writeback.patch
new file mode 100644
index 00000000000000..b0e5566ac13f7e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1371-drm-vc4-txp-Add-a-rotation-property-to-the-writeback.patch
@@ -0,0 +1,65 @@
+From 8346446098032c62d1de891a97c7f62264b18f81 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 14 Aug 2024 16:41:07 +0100
+Subject: [PATCH] drm/vc4: txp: Add a rotation property to the writeback
+ connector
+
+The txp block can implement transpose as it writes out the image
+data, so expose that through the new connector rotation property.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_txp.c | 21 +++++++++++++++++----
+ 1 file changed, 17 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -15,6 +15,7 @@
+ 
+ #include <drm/drm_atomic.h>
+ #include <drm/drm_atomic_helper.h>
++#include <drm/drm_blend.h>
+ #include <drm/drm_drv.h>
+ #include <drm/drm_edid.h>
+ #include <drm/drm_fb_dma_helper.h>
+@@ -259,10 +260,15 @@ static int vc4_txp_connector_atomic_chec
+ 	crtc_state = drm_atomic_get_new_crtc_state(state, conn_state->crtc);
+ 
+ 	fb = conn_state->writeback_job->fb;
+-	if (fb->width != crtc_state->mode.hdisplay ||
+-	    fb->height != crtc_state->mode.vdisplay) {
+-		DRM_DEBUG_KMS("Invalid framebuffer size %ux%u\n",
+-			      fb->width, fb->height);
++	if ((conn_state->rotation == DRM_MODE_ROTATE_0 &&
++	     fb->width != crtc_state->mode.hdisplay &&
++	     fb->height != crtc_state->mode.vdisplay) ||
++	    (conn_state->rotation == (DRM_MODE_ROTATE_0 | DRM_MODE_TRANSPOSE) &&
++	     fb->width != crtc_state->mode.vdisplay &&
++	     fb->height != crtc_state->mode.hdisplay)) {
++		DRM_DEBUG_KMS("Invalid framebuffer size %ux%u vs mode %ux%u\n",
++			      fb->width, fb->height,
++			      crtc_state->mode.hdisplay, crtc_state->mode.vdisplay);
+ 		return -EINVAL;
+ 	}
+ 
+@@ -330,6 +336,9 @@ static void vc4_txp_connector_atomic_com
+ 		 */
+ 		ctrl |= TXP_ALPHA_INVERT;
+ 
++	if (conn_state->rotation & DRM_MODE_TRANSPOSE)
++		ctrl |= TXP_TRANSPOSE;
++
+ 	if (!drm_dev_enter(drm, &idx))
+ 		return;
+ 
+@@ -608,6 +617,10 @@ static int vc4_txp_bind(struct device *d
+ 	if (ret)
+ 		return ret;
+ 
++	drm_connector_create_rotation_property(&txp->connector.base, DRM_MODE_ROTATE_0,
++					       DRM_MODE_ROTATE_0 |
++					       DRM_MODE_TRANSPOSE);
++
+ 	ret = devm_request_irq(dev, irq, vc4_txp_interrupt, 0,
+ 			       dev_name(dev), txp);
+ 	if (ret)
diff --git a/target/linux/bcm27xx/patches-6.6/950-1372-dmaengine-dw-axi-dmac-Allow-client-chosen-width.patch b/target/linux/bcm27xx/patches-6.6/950-1372-dmaengine-dw-axi-dmac-Allow-client-chosen-width.patch
new file mode 100644
index 00000000000000..90688668b874de
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1372-dmaengine-dw-axi-dmac-Allow-client-chosen-width.patch
@@ -0,0 +1,40 @@
+From a2fa911d90495762047c05dec4241308ae61ca36 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 19 Sep 2024 18:05:00 +0100
+Subject: [PATCH] dmaengine: dw-axi-dmac: Allow client-chosen width
+
+For devices where transfer lengths are not known upfront, there is a
+danger when the destination is wider than the source that partial words
+can be lost at the end of a transfer. Ideally the controller would be
+able to flush the residue, but it can't - it's not even possible to tell
+that there is any.
+
+Instead, allow the client driver to avoid the problem by setting a
+smaller width.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+@@ -724,6 +724,18 @@ static int dw_axi_dma_set_hw_desc(struct
+ 	case DMA_DEV_TO_MEM:
+ 		reg_burst_msize = axi_dma_encode_msize(chan->config.src_maxburst);
+ 		reg_width = __ffs(chan->config.src_addr_width);
++		/*
++		 * For devices where transfer lengths are not known upfront,
++		 * there is a danger when the destination is wider than the
++		 * source that partial words can be lost at the end of a transfer.
++		 * Ideally the controller would be able to flush the residue, but
++		 * it can't - it's not even possible to tell that there is any.
++		 * Instead, allow the client driver to avoid the problem by setting
++		 * a smaller width.
++		 */
++		if (chan->config.dst_addr_width &&
++		    (chan->config.dst_addr_width < mem_width))
++			mem_width = chan->config.dst_addr_width;
+ 		device_addr = phys_to_dma(chan->chip->dev, chan->config.src_addr);
+ 		ctllo = reg_width << CH_CTL_L_SRC_WIDTH_POS |
+ 			mem_width << CH_CTL_L_DST_WIDTH_POS |
diff --git a/target/linux/bcm27xx/patches-6.6/950-1373-spi-dw-Let-the-DMAC-set-the-transfer-widths.patch b/target/linux/bcm27xx/patches-6.6/950-1373-spi-dw-Let-the-DMAC-set-the-transfer-widths.patch
new file mode 100644
index 00000000000000..786af04036a3b6
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1373-spi-dw-Let-the-DMAC-set-the-transfer-widths.patch
@@ -0,0 +1,31 @@
+From 5cf7209c294a58029984880d4858e2d3c7e46a3c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 19 Sep 2024 18:12:12 +0100
+Subject: [PATCH] spi: dw: Let the DMAC set the transfer widths
+
+SPI transfers are of defined length, unlike some UART traffic, so it is
+safe to let the DMA controller choose a suitable memory width.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spi-dw-dma.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/spi/spi-dw-dma.c
++++ b/drivers/spi/spi-dw-dma.c
+@@ -330,7 +330,6 @@ static int dw_spi_dma_config_tx(struct d
+ 	txconf.direction = DMA_MEM_TO_DEV;
+ 	txconf.dst_addr = dws->dma_addr;
+ 	txconf.dst_maxburst = dws->txburst;
+-	txconf.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ 	txconf.dst_addr_width = dw_spi_dma_convert_width(dws->n_bytes);
+ 	txconf.device_fc = false;
+ 
+@@ -431,7 +430,6 @@ static int dw_spi_dma_config_rx(struct d
+ 	rxconf.direction = DMA_DEV_TO_MEM;
+ 	rxconf.src_addr = dws->dma_addr;
+ 	rxconf.src_maxburst = dws->rxburst;
+-	rxconf.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ 	rxconf.src_addr_width = dw_spi_dma_convert_width(dws->n_bytes);
+ 	rxconf.device_fc = false;
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1374-serial-pl011-Request-a-memory-width-of-1-byte.patch b/target/linux/bcm27xx/patches-6.6/950-1374-serial-pl011-Request-a-memory-width-of-1-byte.patch
new file mode 100644
index 00000000000000..860d35b2f3639d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1374-serial-pl011-Request-a-memory-width-of-1-byte.patch
@@ -0,0 +1,25 @@
+From 8894298105f4cb41dfa41e0b0d3c40c3f7b92c44 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 19 Sep 2024 18:22:24 +0100
+Subject: [PATCH] serial: pl011: Request a memory width of 1 byte
+
+In order to avoid losing residue bytes when a receive is terminated
+early, set the destination width to single bytes.
+
+Link: https://github.com/raspberrypi/linux/issues/6365
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/tty/serial/amba-pl011.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/tty/serial/amba-pl011.c
++++ b/drivers/tty/serial/amba-pl011.c
+@@ -468,6 +468,7 @@ static void pl011_dma_probe(struct uart_
+ 			.src_addr = uap->port.mapbase +
+ 				pl011_reg_to_offset(uap, REG_DR),
+ 			.src_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE,
++			.dst_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE,
+ 			.direction = DMA_DEV_TO_MEM,
+ 			.src_maxburst = uap->fifosize >> 2,
+ 			.device_fc = false,
diff --git a/target/linux/bcm27xx/patches-6.6/950-1377-drivers-usb-xhci-set-HID-bit-in-streaming-endpoint-c.patch b/target/linux/bcm27xx/patches-6.6/950-1377-drivers-usb-xhci-set-HID-bit-in-streaming-endpoint-c.patch
new file mode 100644
index 00000000000000..fc004dc57d34af
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1377-drivers-usb-xhci-set-HID-bit-in-streaming-endpoint-c.patch
@@ -0,0 +1,56 @@
+From 66aef6ce3557edd9d58d794e4a800c5be49ca0e7 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Mon, 11 Nov 2024 10:30:38 +0000
+Subject: [PATCH] drivers: usb: xhci: set HID bit in streaming endpoint
+ contexts
+
+The xHC may commence Host Initiated Data Moves for streaming endpoints -
+see USB3.2 spec s8.12.1.4.2.4. However, this behaviour is typically
+counterproductive as the submission of UAS URBs in {Status, Data,
+Command} order and 1 outstanding IO per stream ID means the device never
+enters Move Data after a HIMD for Status or Data stages with the same
+stream ID. For OUT transfers this is especially inefficient as the host
+will start transmitting multiple bulk packets as a burst, all of which
+get NAKed by the device - wasting bandwidth.
+
+Also, some buggy UAS adapters don't properly handle the EP flow control
+state this creates - e.g. RTL9210.
+
+Set Host Initiated Data Move Disable to always defer stream selection to
+the device. xHC implementations may treat this field as "don't care,
+forced to 1" anyway - xHCI 1.2 s4.12.1.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/usb/host/xhci-mem.c | 8 ++++++++
+ drivers/usb/host/xhci.h     | 2 ++
+ 2 files changed, 10 insertions(+)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -721,6 +721,14 @@ void xhci_setup_streams_ep_input_ctx(str
+ 	ep_ctx->ep_info &= cpu_to_le32(~EP_MAXPSTREAMS_MASK);
+ 	ep_ctx->ep_info |= cpu_to_le32(EP_MAXPSTREAMS(max_primary_streams)
+ 				       | EP_HAS_LSA);
++
++	/*
++	 * Set Host Initiated Data Move Disable to always defer stream
++	 * selection to the device. xHC implementations may treat this
++	 * field as "don't care, forced to 1" anyway - xHCI 1.2 s4.12.1.
++	 */
++	ep_ctx->ep_info2 |= EP_HID;
++
+ 	ep_ctx->deq  = cpu_to_le64(stream_info->ctx_array_dma);
+ }
+ 
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -492,6 +492,8 @@ struct xhci_ep_ctx {
+ #define CTX_TO_EP_MAXPSTREAMS(p)	(((p) & EP_MAXPSTREAMS_MASK) >> 10)
+ /* Endpoint is set up with a Linear Stream Array (vs. Secondary Stream Array) */
+ #define	EP_HAS_LSA		(1 << 15)
++/* Host initiated data move disable in info2 */
++#define EP_HID			(1 << 7)
+ /* hosts with LEC=1 use bits 31:24 as ESIT high bits. */
+ #define CTX_TO_MAX_ESIT_PAYLOAD_HI(p)	(((p) >> 24) & 0xff)
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1379-media-i2c-imx477-Add-options-for-slightly-modifying-.patch b/target/linux/bcm27xx/patches-6.6/950-1379-media-i2c-imx477-Add-options-for-slightly-modifying-.patch
new file mode 100644
index 00000000000000..ee060519576c89
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1379-media-i2c-imx477-Add-options-for-slightly-modifying-.patch
@@ -0,0 +1,199 @@
+From 35e50ee3d66e014d869f0d7a3468bef964d26d32 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 14 Nov 2024 13:14:02 +0000
+Subject: [PATCH] media: i2c: imx477: Add options for slightly modifying the
+ link freq
+
+The default link frequency of 450MHz has been noted to interfere
+with GPS if they are in close proximty.
+Add the option for 453 and 456MHz to move the signal slightly out
+of the band. (447MHz can not be offered as corruption is then observed
+on the 133x992 10bit mode).
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+
+fixup imx477 gps
+---
+ drivers/media/i2c/imx477.c | 86 +++++++++++++++++++++++++++++---------
+ 1 file changed, 67 insertions(+), 19 deletions(-)
+
+--- a/drivers/media/i2c/imx477.c
++++ b/drivers/media/i2c/imx477.c
+@@ -164,8 +164,48 @@ struct imx477_mode {
+ 	struct imx477_reg_list reg_list;
+ };
+ 
+-static const s64 imx477_link_freq_menu[] = {
+-	IMX477_DEFAULT_LINK_FREQ,
++/* Link frequency setup */
++enum {
++	IMX477_LINK_FREQ_450MHZ,
++	IMX477_LINK_FREQ_453MHZ,
++	IMX477_LINK_FREQ_456MHZ,
++};
++
++static const s64 link_freqs[] = {
++	[IMX477_LINK_FREQ_450MHZ] = 450000000,
++	[IMX477_LINK_FREQ_453MHZ] = 453000000,
++	[IMX477_LINK_FREQ_456MHZ] = 456000000,
++};
++
++/* 450MHz is the nominal "default" link frequency */
++static const struct imx477_reg link_450Mhz_regs[] = {
++	{0x030E, 0x00},
++	{0x030F, 0x96},
++};
++
++static const struct imx477_reg link_453Mhz_regs[] = {
++	{0x030E, 0x00},
++	{0x030F, 0x97},
++};
++
++static const struct imx477_reg link_456Mhz_regs[] = {
++	{0x030E, 0x00},
++	{0x030F, 0x98},
++};
++
++static const struct imx477_reg_list link_freq_regs[] = {
++	[IMX477_LINK_FREQ_450MHZ] = {
++		.regs = link_450Mhz_regs,
++		.num_of_regs = ARRAY_SIZE(link_450Mhz_regs)
++	},
++	[IMX477_LINK_FREQ_453MHZ] = {
++		.regs = link_453Mhz_regs,
++		.num_of_regs = ARRAY_SIZE(link_453Mhz_regs)
++	},
++	[IMX477_LINK_FREQ_456MHZ] = {
++		.regs = link_456Mhz_regs,
++		.num_of_regs = ARRAY_SIZE(link_456Mhz_regs)
++	},
+ };
+ 
+ static const struct imx477_reg mode_common_regs[] = {
+@@ -558,8 +598,6 @@ static const struct imx477_reg mode_4056
+ 	{0x0309, 0x0c},
+ 	{0x030b, 0x02},
+ 	{0x030d, 0x02},
+-	{0x030e, 0x00},
+-	{0x030f, 0x96},
+ 	{0x0310, 0x01},
+ 	{0x0820, 0x07},
+ 	{0x0821, 0x08},
+@@ -659,8 +697,6 @@ static const struct imx477_reg mode_2028
+ 	{0x0309, 0x0c},
+ 	{0x030b, 0x02},
+ 	{0x030d, 0x02},
+-	{0x030e, 0x00},
+-	{0x030f, 0x96},
+ 	{0x0310, 0x01},
+ 	{0x0820, 0x07},
+ 	{0x0821, 0x08},
+@@ -760,8 +796,6 @@ static const struct imx477_reg mode_2028
+ 	{0x0309, 0x0c},
+ 	{0x030b, 0x02},
+ 	{0x030d, 0x02},
+-	{0x030e, 0x00},
+-	{0x030f, 0x96},
+ 	{0x0310, 0x01},
+ 	{0x0820, 0x07},
+ 	{0x0821, 0x08},
+@@ -890,8 +924,6 @@ static const struct imx477_reg mode_1332
+ 	{0x0309, 0x0a},
+ 	{0x030b, 0x02},
+ 	{0x030d, 0x02},
+-	{0x030e, 0x00},
+-	{0x030f, 0x96},
+ 	{0x0310, 0x01},
+ 	{0x0820, 0x07},
+ 	{0x0821, 0x08},
+@@ -1121,6 +1153,8 @@ struct imx477 {
+ 	struct v4l2_ctrl *vblank;
+ 	struct v4l2_ctrl *hblank;
+ 
++	unsigned int link_freq_idx;
++
+ 	/* Current mode */
+ 	const struct imx477_mode *mode;
+ 
+@@ -1712,7 +1746,7 @@ static int imx477_get_selection(struct v
+ static int imx477_start_streaming(struct imx477 *imx477)
+ {
+ 	struct i2c_client *client = v4l2_get_subdevdata(&imx477->sd);
+-	const struct imx477_reg_list *reg_list;
++	const struct imx477_reg_list *reg_list, *freq_regs;
+ 	const struct imx477_reg_list *extra_regs;
+ 	int ret, tm;
+ 
+@@ -1725,6 +1759,13 @@ static int imx477_start_streaming(struct
+ 						extra_regs->num_of_regs);
+ 		}
+ 
++		if (!ret) {
++			/* Update the link frequency registers */
++			freq_regs = &link_freq_regs[imx477->link_freq_idx];
++			ret = imx477_write_regs(imx477, freq_regs->regs,
++						freq_regs->num_of_regs);
++		}
++
+ 		if (ret) {
+ 			dev_err(&client->dev, "%s failed to set common settings\n",
+ 				__func__);
+@@ -2010,9 +2051,8 @@ static int imx477_init_controls(struct i
+ 	/* LINK_FREQ is also read only */
+ 	imx477->link_freq =
+ 		v4l2_ctrl_new_int_menu(ctrl_hdlr, &imx477_ctrl_ops,
+-				       V4L2_CID_LINK_FREQ,
+-				       ARRAY_SIZE(imx477_link_freq_menu) - 1, 0,
+-				       imx477_link_freq_menu);
++				       V4L2_CID_LINK_FREQ, 1, 0,
++				       &link_freqs[imx477->link_freq_idx]);
+ 	if (imx477->link_freq)
+ 		imx477->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 
+@@ -2110,13 +2150,14 @@ static void imx477_free_controls(struct
+ 	mutex_destroy(&imx477->mutex);
+ }
+ 
+-static int imx477_check_hwcfg(struct device *dev)
++static int imx477_check_hwcfg(struct device *dev, struct imx477 *imx477)
+ {
+ 	struct fwnode_handle *endpoint;
+ 	struct v4l2_fwnode_endpoint ep_cfg = {
+ 		.bus_type = V4L2_MBUS_CSI2_DPHY
+ 	};
+ 	int ret = -EINVAL;
++	int i;
+ 
+ 	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
+ 	if (!endpoint) {
+@@ -2141,11 +2182,18 @@ static int imx477_check_hwcfg(struct dev
+ 		goto error_out;
+ 	}
+ 
+-	if (ep_cfg.nr_of_link_frequencies != 1 ||
+-	    ep_cfg.link_frequencies[0] != IMX477_DEFAULT_LINK_FREQ) {
++	for (i = 0; i < ARRAY_SIZE(link_freqs); i++) {
++		if (link_freqs[i] == ep_cfg.link_frequencies[0]) {
++			imx477->link_freq_idx = i;
++			break;
++		}
++	}
++
++	if (i == ARRAY_SIZE(link_freqs)) {
+ 		dev_err(dev, "Link frequency not supported: %lld\n",
+ 			ep_cfg.link_frequencies[0]);
+-		goto error_out;
++			ret = -EINVAL;
++			goto error_out;
+ 	}
+ 
+ 	ret = 0;
+@@ -2206,7 +2254,7 @@ static int imx477_probe(struct i2c_clien
+ 		(const struct imx477_compatible_data *)match->data;
+ 
+ 	/* Check the hardware configuration in device tree */
+-	if (imx477_check_hwcfg(dev))
++	if (imx477_check_hwcfg(dev, imx477))
+ 		return -EINVAL;
+ 
+ 	/* Default the trigger mode from OF to -1, which means invalid */
diff --git a/target/linux/bcm27xx/patches-6.6/950-1380-dtoverlays-Add-link-frequency-override-to-imx477-378.patch b/target/linux/bcm27xx/patches-6.6/950-1380-dtoverlays-Add-link-frequency-override-to-imx477-378.patch
new file mode 100644
index 00000000000000..47d3d392004a6d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1380-dtoverlays-Add-link-frequency-override-to-imx477-378.patch
@@ -0,0 +1,43 @@
+From 7e253a062d5a14de13ccfb410570975099c238be Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 14 Nov 2024 13:15:24 +0000
+Subject: [PATCH] dtoverlays: Add link-frequency override to imx477/378 overlay
+
+Copy of the imx708 change.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README                  | 4 ++++
+ arch/arm/boot/dts/overlays/imx477_378-overlay.dtsi | 1 +
+ 2 files changed, 5 insertions(+)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -2780,6 +2780,8 @@ Params: rotation                Mounting
+                                 camera clamping I/Os such as XVS to 0V.
+         sync-source             Configure as vsync source
+         sync-sink               Configure as vsync sink
++        link-frequency          Allowable link frequency values to use in Hz:
++                                450000000 (default), 453000000, 456000000.
+ 
+ 
+ Name:   imx462
+@@ -2822,6 +2824,8 @@ Params: rotation                Mounting
+                                 camera clamping I/Os such as XVS to 0V.
+         sync-source             Configure as vsync source
+         sync-sink               Configure as vsync sink
++        link-frequency          Allowable link frequency values to use in Hz:
++                                450000000 (default), 453000000, 456000000.
+ 
+ 
+ Name:   imx500
+--- a/arch/arm/boot/dts/overlays/imx477_378-overlay.dtsi
++++ b/arch/arm/boot/dts/overlays/imx477_378-overlay.dtsi
+@@ -80,6 +80,7 @@
+ 		       <&cam_node>, "clocks:0=",<&cam0_clk>,
+ 		       <&cam_node>, "VANA-supply:0=",<&cam0_reg>;
+ 		always-on = <0>, "+99";
++		link-frequency = <&cam_endpoint>,"link-frequencies#0";
+ 	};
+ };
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1381-dmaengine-dw-axi-dmac-Only-start-idle-channels.patch b/target/linux/bcm27xx/patches-6.6/950-1381-dmaengine-dw-axi-dmac-Only-start-idle-channels.patch
new file mode 100644
index 00000000000000..81b7f805f3323b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1381-dmaengine-dw-axi-dmac-Only-start-idle-channels.patch
@@ -0,0 +1,29 @@
+From 59a8855b51c1d8acf37d3c80f34782d71f474617 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 13 Nov 2024 10:37:22 +0000
+Subject: [PATCH] dmaengine: dw-axi-dmac: Only start idle channels
+
+Attempting to start a non-idle channel causes an error message to be
+logged, and is inefficient. Test for emptiness of the desc_issued list
+before doing so.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
++++ b/drivers/dma/dw-axi-dmac/dw-axi-dmac-platform.c
+@@ -536,9 +536,11 @@ static void dma_chan_issue_pending(struc
+ {
+ 	struct axi_dma_chan *chan = dchan_to_axi_dma_chan(dchan);
+ 	unsigned long flags;
++	bool was_empty;
+ 
+ 	spin_lock_irqsave(&chan->vc.lock, flags);
+-	if (vchan_issue_pending(&chan->vc))
++	was_empty = list_empty(&chan->vc.desc_issued);
++	if (vchan_issue_pending(&chan->vc) && was_empty)
+ 		axi_chan_start_first_queued(chan);
+ 	spin_unlock_irqrestore(&chan->vc.lock, flags);
+ }
diff --git a/target/linux/bcm27xx/patches-6.6/950-1382-mailbox-Add-RP1-mailbox-support.patch b/target/linux/bcm27xx/patches-6.6/950-1382-mailbox-Add-RP1-mailbox-support.patch
new file mode 100644
index 00000000000000..23bdb6a8fb0f6f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1382-mailbox-Add-RP1-mailbox-support.patch
@@ -0,0 +1,252 @@
+From 0d58d8cfb6f989f290d983552fcaa116e582e84a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 31 Oct 2024 17:33:38 +0000
+Subject: [PATCH] mailbox: Add RP1 mailbox support
+
+The Raspberry Pi RP1 includes 2 M3 cores running firmware. This driver
+adds a mailbox communication channel to them via a doorbell and some
+shared memory.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/mailbox/Kconfig       |   9 ++
+ drivers/mailbox/Makefile      |   2 +
+ drivers/mailbox/rp1-mailbox.c | 208 ++++++++++++++++++++++++++++++++++
+ 3 files changed, 219 insertions(+)
+ create mode 100644 drivers/mailbox/rp1-mailbox.c
+
+--- a/drivers/mailbox/Kconfig
++++ b/drivers/mailbox/Kconfig
+@@ -295,4 +295,13 @@ config QCOM_IPCC
+ 	  acts as an interrupt controller for receiving interrupts from clients.
+ 	  Say Y here if you want to build this driver.
+ 
++config MBOX_RP1
++	tristate "RP1 Mailbox"
++	depends on MFD_RP1
++	help
++	  An implementation of a mailbox interface to the Raspberry Pi RP1 I/O
++	  interface. Although written as a mailbox driver, the hardware only
++	  provides an array of 32 doorbells.
++	  Say Y here if you want to use the RP1 Mailbox.
++
+ endif
+--- a/drivers/mailbox/Makefile
++++ b/drivers/mailbox/Makefile
+@@ -62,3 +62,5 @@ obj-$(CONFIG_SPRD_MBOX)		+= sprd-mailbox
+ obj-$(CONFIG_QCOM_IPCC)		+= qcom-ipcc.o
+ 
+ obj-$(CONFIG_APPLE_MAILBOX)	+= apple-mailbox.o
++
++obj-$(CONFIG_MBOX_RP1)		+= rp1-mailbox.o
+--- /dev/null
++++ b/drivers/mailbox/rp1-mailbox.c
+@@ -0,0 +1,208 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ *  Copyright (C) 2023 Raspberry Pi Ltd.
++ *
++ * Parts of this driver are based on:
++ *  - bcm2835-mailbox.c
++ *    Copyright (C) 2010,2015 Broadcom
++ *    Copyright (C) 2013-2014 Lubomir Rintel
++ *    Copyright (C) 2013 Craig McGeachie
++ */
++
++#include <linux/compat.h>
++#include <linux/device.h>
++#include <linux/dma-mapping.h>
++#include <linux/err.h>
++#include <linux/interrupt.h>
++#include <linux/irq.h>
++#include <linux/kernel.h>
++#include <linux/mailbox_controller.h>
++#include <linux/miscdevice.h>
++#include <linux/module.h>
++#include <linux/of_address.h>
++#include <linux/of_irq.h>
++#include <linux/platform_device.h>
++
++/*
++ * RP1's PROC_EVENTS register can generate interrupts on the M3 cores (when
++ * enabled). The 32-bit register is treated as 32 events, all of which share a
++ * common interrupt. HOST_EVENTS is the same in the reverse direction.
++ */
++#define SYSCFG_PROC_EVENTS		0x00000008
++#define SYSCFG_HOST_EVENTS		0x0000000c
++#define SYSCFG_HOST_EVENT_IRQ_EN	0x00000010
++#define SYSCFG_HOST_EVENT_IRQ		0x00000014
++
++#define HW_SET_BITS			0x00002000
++#define HW_CLR_BITS			0x00003000
++
++#define MAX_CHANS	4 /* 32 is the hardware limit */
++
++struct rp1_mbox {
++	void __iomem *regs;
++	unsigned int irq;
++	struct mbox_controller controller;
++};
++
++static struct rp1_mbox *rp1_chan_mbox(struct mbox_chan *chan)
++{
++	return container_of(chan->mbox, struct rp1_mbox, controller);
++}
++
++static unsigned int rp1_chan_event(struct mbox_chan *chan)
++{
++	return (unsigned int)(uintptr_t)chan->con_priv;
++}
++
++static irqreturn_t rp1_mbox_irq(int irq, void *dev_id)
++{
++	struct rp1_mbox *mbox = dev_id;
++	struct mbox_chan *chan;
++	unsigned int doorbell;
++	unsigned int evs;
++
++	evs = readl(mbox->regs + SYSCFG_HOST_EVENT_IRQ);
++	writel(evs, mbox->regs + SYSCFG_HOST_EVENTS + HW_CLR_BITS);
++
++	while (evs) {
++		doorbell = __ffs(evs);
++		chan = &mbox->controller.chans[doorbell];
++		mbox_chan_received_data(chan, NULL);
++		evs &= ~(1 << doorbell);
++	}
++	return IRQ_HANDLED;
++}
++
++static int rp1_send_data(struct mbox_chan *chan, void *data)
++{
++	struct rp1_mbox *mbox = rp1_chan_mbox(chan);
++	unsigned int event = rp1_chan_event(chan);
++
++	writel(event, mbox->regs + SYSCFG_PROC_EVENTS + HW_SET_BITS);
++
++	return 0;
++}
++
++static int rp1_startup(struct mbox_chan *chan)
++{
++	struct rp1_mbox *mbox = rp1_chan_mbox(chan);
++	unsigned int event = rp1_chan_event(chan);
++
++	writel(event, mbox->regs + SYSCFG_HOST_EVENT_IRQ_EN + HW_SET_BITS);
++
++	return 0;
++}
++
++static void rp1_shutdown(struct mbox_chan *chan)
++{
++	struct rp1_mbox *mbox = rp1_chan_mbox(chan);
++	unsigned int event = rp1_chan_event(chan);
++
++	writel(event, mbox->regs + SYSCFG_HOST_EVENT_IRQ_EN + HW_CLR_BITS);
++}
++
++static bool rp1_last_tx_done(struct mbox_chan *chan)
++{
++	struct rp1_mbox *mbox = rp1_chan_mbox(chan);
++	unsigned int event = rp1_chan_event(chan);
++	unsigned int evs;
++
++	evs = readl(mbox->regs + SYSCFG_HOST_EVENT_IRQ);
++
++	return !(evs & event);
++}
++
++static const struct mbox_chan_ops rp1_mbox_chan_ops = {
++	.send_data	= rp1_send_data,
++	.startup	= rp1_startup,
++	.shutdown	= rp1_shutdown,
++	.last_tx_done	= rp1_last_tx_done
++};
++
++static struct mbox_chan *rp1_mbox_xlate(struct mbox_controller *mbox,
++					const struct of_phandle_args *spec)
++{
++	struct mbox_chan *chan;
++	unsigned int doorbell;
++
++	if (spec->args_count != 1)
++		return ERR_PTR(-EINVAL);
++
++	doorbell = spec->args[0];
++	if (doorbell >= MAX_CHANS)
++		return ERR_PTR(-EINVAL);
++
++	chan = &mbox->chans[doorbell];
++	if (chan->con_priv)
++		return ERR_PTR(-EBUSY);
++
++	chan->con_priv = (void *)(uintptr_t)(1 << doorbell);
++
++	return chan;
++}
++
++static int rp1_mbox_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct mbox_chan *chans;
++	struct rp1_mbox *mbox;
++	int ret = 0;
++
++	mbox = devm_kzalloc(dev, sizeof(*mbox), GFP_KERNEL);
++	if (mbox == NULL)
++		return -ENOMEM;
++
++	ret = devm_request_irq(dev, platform_get_irq(pdev, 0),
++			       rp1_mbox_irq, 0, dev_name(dev), mbox);
++	if (ret) {
++		dev_err(dev, "Failed to register a mailbox IRQ handler: %d\n",
++			ret);
++		return -ENODEV;
++	}
++
++	mbox->regs = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(mbox->regs)) {
++		ret = PTR_ERR(mbox->regs);
++		return ret;
++	}
++
++	chans = devm_kcalloc(dev, MAX_CHANS, sizeof(*chans), GFP_KERNEL);
++	if (!chans)
++		return -ENOMEM;
++
++	mbox->controller.txdone_poll = true;
++	mbox->controller.txpoll_period = 5;
++	mbox->controller.ops = &rp1_mbox_chan_ops;
++	mbox->controller.of_xlate = &rp1_mbox_xlate;
++	mbox->controller.dev = dev;
++	mbox->controller.num_chans = MAX_CHANS;
++	mbox->controller.chans = chans;
++
++	ret = devm_mbox_controller_register(dev, &mbox->controller);
++	if (ret)
++		return ret;
++
++	platform_set_drvdata(pdev, mbox);
++
++	return 0;
++}
++
++static const struct of_device_id rp1_mbox_of_match[] = {
++	{ .compatible = "raspberrypi,rp1-mbox", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, rp1_mbox_of_match);
++
++static struct platform_driver rp1_mbox_driver = {
++	.driver = {
++		.name = "rp1-mbox",
++		.of_match_table = rp1_mbox_of_match,
++	},
++	.probe = rp1_mbox_probe,
++};
++
++module_platform_driver(rp1_mbox_driver);
++
++MODULE_AUTHOR("Phil Elwell <phil@raspberrypi.com>");
++MODULE_DESCRIPTION("RP1 mailbox IPC driver");
++MODULE_LICENSE("GPL v2");
diff --git a/target/linux/bcm27xx/patches-6.6/950-1383-firmware-Add-an-RP1-firmware-interface-over-mbox.patch b/target/linux/bcm27xx/patches-6.6/950-1383-firmware-Add-an-RP1-firmware-interface-over-mbox.patch
new file mode 100644
index 00000000000000..87d3bdbe89afa5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1383-firmware-Add-an-RP1-firmware-interface-over-mbox.patch
@@ -0,0 +1,421 @@
+From 67daeadcaa7cee1f4b9df7aa108d199e73f35451 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 31 Oct 2024 17:36:54 +0000
+Subject: [PATCH] firmware: Add an RP1 firmware interface over mbox
+
+The RP1 firmware runs a simple communications channel over some shared
+memory and a mailbox. This driver provides access to that channel.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/firmware/Kconfig     |   9 +
+ drivers/firmware/Makefile    |   1 +
+ drivers/firmware/rp1.c       | 316 +++++++++++++++++++++++++++++++++++
+ include/linux/rp1-firmware.h |  53 ++++++
+ 4 files changed, 379 insertions(+)
+ create mode 100644 drivers/firmware/rp1.c
+ create mode 100644 include/linux/rp1-firmware.h
+
+--- a/drivers/firmware/Kconfig
++++ b/drivers/firmware/Kconfig
+@@ -152,6 +152,15 @@ config RASPBERRYPI_FIRMWARE
+ 	  This option enables support for communicating with the firmware on the
+ 	  Raspberry Pi.
+ 
++config FIRMWARE_RP1
++	tristate "RP1 Firmware Driver"
++	depends on MBOX_RP1
++	help
++	  The Raspberry Pi RP1 processor presents a firmware
++	  interface using shared memory and a mailbox. To enable
++	  the driver that communicates with it, say Y. Otherwise,
++	  say N.
++
+ config FW_CFG_SYSFS
+ 	tristate "QEMU fw_cfg device support in sysfs"
+ 	depends on SYSFS && (ARM || ARM64 || PARISC || PPC_PMAC || SPARC || X86)
+--- a/drivers/firmware/Makefile
++++ b/drivers/firmware/Makefile
+@@ -17,6 +17,7 @@ obj-$(CONFIG_ISCSI_IBFT)	+= iscsi_ibft.o
+ obj-$(CONFIG_FIRMWARE_MEMMAP)	+= memmap.o
+ obj-$(CONFIG_MTK_ADSP_IPC)	+= mtk-adsp-ipc.o
+ obj-$(CONFIG_RASPBERRYPI_FIRMWARE) += raspberrypi.o
++obj-$(CONFIG_FIRMWARE_RP1)	+= rp1.o
+ obj-$(CONFIG_FW_CFG_SYSFS)	+= qemu_fw_cfg.o
+ obj-$(CONFIG_QCOM_SCM)		+= qcom-scm.o
+ qcom-scm-objs += qcom_scm.o qcom_scm-smc.o qcom_scm-legacy.o
+--- /dev/null
++++ b/drivers/firmware/rp1.c
+@@ -0,0 +1,316 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ *  Copyright (C) 2023-24 Raspberry Pi Ltd.
++ *
++ * Parts of this driver are based on:
++ *  - raspberrypi.c, by Eric Anholt <eric@anholt.net>
++ *    Copyright (C) 2015 Broadcom
++ */
++
++#include <linux/dma-mapping.h>
++#include <linux/kref.h>
++#include <linux/mailbox_client.h>
++#include <linux/module.h>
++#include <linux/of_address.h>
++#include <linux/of_platform.h>
++#include <linux/platform_device.h>
++#include <linux/rp1-firmware.h>
++
++#define RP1_MAILBOX_FIRMWARE		0
++
++enum rp1_firmware_ops {
++	MBOX_SUCCESS		= 0x0000,
++	GET_FIRMWARE_VERSION	= 0x0001, // na -> 160-bit version
++	GET_FEATURE		= 0x0002, // FOURCC -> op base (0 == unsupported), op count
++
++	COMMON_COUNT
++};
++
++struct rp1_firmware {
++	struct mbox_client cl;
++	struct mbox_chan *chan;	/* The doorbell channel */
++	uint32_t __iomem *buf;	/* The shared buffer */
++	u32 buf_size;		/* The size of the shared buffer */
++	struct completion c;
++
++	struct kref consumers;
++};
++
++struct rp1_get_feature_resp {
++	uint32_t op_base;
++	uint32_t op_count;
++};
++
++static DEFINE_MUTEX(transaction_lock);
++
++static const struct of_device_id rp1_firmware_of_match[] = {
++	{ .compatible = "raspberrypi,rp1-firmware", },
++	{},
++};
++MODULE_DEVICE_TABLE(of, rp1_firmware_of_match);
++
++static void response_callback(struct mbox_client *cl, void *msg)
++{
++	struct rp1_firmware *fw = container_of(cl, struct rp1_firmware, cl);
++
++	complete(&fw->c);
++}
++
++/*
++ * Sends a request to the RP1 firmware and synchronously waits for the reply.
++ * Returns zero or a positive count of response bytes on success, negative on
++ * error.
++ */
++
++int rp1_firmware_message(struct rp1_firmware *fw, uint16_t op,
++			 const void *data, unsigned int data_len,
++			 void *resp, unsigned int resp_space)
++{
++	int ret;
++	u32 rc;
++
++	if (data_len + 4 > fw->buf_size)
++		return -EINVAL;
++
++	mutex_lock(&transaction_lock);
++
++	memcpy_toio(&fw->buf[1], data, data_len);
++	writel((op << 16) | data_len, fw->buf);
++
++	reinit_completion(&fw->c);
++	ret = mbox_send_message(fw->chan, NULL);
++	if (ret >= 0) {
++		if (wait_for_completion_timeout(&fw->c, HZ))
++			ret = 0;
++		else
++			ret = -ETIMEDOUT;
++	} else {
++		dev_err(fw->cl.dev, "mbox_send_message returned %d\n", ret);
++	}
++
++	if (ret == 0) {
++		rc = readl(fw->buf);
++		if (rc & 0x80000000) {
++			ret = (int32_t)rc;
++		} else {
++			ret = min(rc, resp_space);
++			memcpy_fromio(resp, &fw->buf[1], ret);
++		}
++	}
++
++	mutex_unlock(&transaction_lock);
++
++	return ret;
++}
++EXPORT_SYMBOL_GPL(rp1_firmware_message);
++
++static void rp1_firmware_delete(struct kref *kref)
++{
++	struct rp1_firmware *fw = container_of(kref, struct rp1_firmware, consumers);
++
++	mbox_free_channel(fw->chan);
++	kfree(fw);
++}
++
++void rp1_firmware_put(struct rp1_firmware *fw)
++{
++	kref_put(&fw->consumers, rp1_firmware_delete);
++}
++EXPORT_SYMBOL_GPL(rp1_firmware_put);
++
++int rp1_firmware_get_feature(struct rp1_firmware *fw, uint32_t fourcc,
++			     uint32_t *op_base, uint32_t *op_count)
++{
++	struct rp1_get_feature_resp resp;
++	int ret;
++
++	memset(&resp, 0, sizeof(resp));
++	ret = rp1_firmware_message(fw, GET_FEATURE,
++				   &fourcc, sizeof(fourcc),
++				   &resp, sizeof(resp));
++	*op_base = resp.op_base;
++	*op_count = resp.op_count;
++	if (ret < 0)
++		return ret;
++	if (ret < sizeof(resp) || !resp.op_base)
++		return -EOPNOTSUPP;
++	return 0;
++}
++EXPORT_SYMBOL_GPL(rp1_firmware_get_feature);
++
++static void devm_rp1_firmware_put(void *data)
++{
++	struct rp1_firmware *fw = data;
++
++	rp1_firmware_put(fw);
++}
++
++/**
++ * rp1_firmware_get - Get pointer to rp1_firmware structure.
++ *
++ * The reference to rp1_firmware has to be released with rp1_firmware_put().
++ *
++ * Returns an error pointer on failure.
++ */
++struct rp1_firmware *rp1_firmware_get(struct device_node *client)
++{
++	const char *match = rp1_firmware_of_match[0].compatible;
++	struct platform_device *pdev;
++	struct device_node *fwnode;
++	struct rp1_firmware *fw;
++
++	if (client) {
++		fwnode = of_parse_phandle(client, "firmware", 0);
++		if (!fwnode)
++			fwnode = of_get_parent(client);
++		if (fwnode && !of_device_is_compatible(fwnode, match)) {
++			of_node_put(fwnode);
++			fwnode = NULL;
++		}
++	}
++
++	if (!fwnode)
++		fwnode = of_find_matching_node(NULL, rp1_firmware_of_match);
++
++	if (!fwnode)
++		return ERR_PTR(-ENOENT);
++
++	pdev = of_find_device_by_node(fwnode);
++	of_node_put(fwnode);
++
++	if (!pdev)
++		return ERR_PTR(-EPROBE_DEFER);
++
++	fw = platform_get_drvdata(pdev);
++	if (!fw)
++		goto err_defer;
++
++	if (!kref_get_unless_zero(&fw->consumers))
++		goto err_defer;
++
++	put_device(&pdev->dev);
++
++	return fw;
++
++err_defer:
++	put_device(&pdev->dev);
++	return ERR_PTR(-EPROBE_DEFER);
++}
++EXPORT_SYMBOL_GPL(rp1_firmware_get);
++
++/**
++ * devm_rp1_firmware_get - Get pointer to rp1_firmware structure.
++ * @firmware_node:    Pointer to the firmware Device Tree node.
++ *
++ * Returns NULL is the firmware device is not ready.
++ */
++struct rp1_firmware *devm_rp1_firmware_get(struct device *dev, struct device_node *client)
++{
++	struct rp1_firmware *fw;
++	int ret;
++
++	fw = rp1_firmware_get(client);
++	if (IS_ERR(fw))
++		return fw;
++
++	ret = devm_add_action_or_reset(dev, devm_rp1_firmware_put, fw);
++	if (ret)
++		return ERR_PTR(ret);
++
++	return fw;
++}
++EXPORT_SYMBOL_GPL(devm_rp1_firmware_get);
++
++static int rp1_firmware_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct device_node *shmem;
++	struct rp1_firmware *fw;
++	struct resource res;
++	uint32_t version[5];
++	int ret;
++
++	shmem = of_parse_phandle(dev->of_node, "shmem", 0);
++	if (!of_device_is_compatible(shmem, "raspberrypi,rp1-shmem")) {
++		of_node_put(shmem);
++		return -ENXIO;
++	}
++
++	ret = of_address_to_resource(shmem, 0, &res);
++	of_node_put(shmem);
++	if (ret) {
++		dev_err(dev, "failed to get shared memory (%pOF) - %d\n", shmem, ret);
++		return ret;
++	}
++
++	/*
++	 * Memory will be freed by rp1_firmware_delete() once all users have
++	 * released their firmware handles. Don't use devm_kzalloc() here.
++	 */
++	fw = kzalloc(sizeof(*fw), GFP_KERNEL);
++	if (!fw)
++		return -ENOMEM;
++
++	fw->buf_size = resource_size(&res);
++	fw->buf = devm_ioremap(dev, res.start, fw->buf_size);
++	if (!fw->buf) {
++		dev_err(dev, "failed to ioremap shared memory\n");
++		kfree(fw);
++		return -EADDRNOTAVAIL;
++	}
++
++	fw->cl.dev = dev;
++	fw->cl.rx_callback = response_callback;
++	fw->cl.tx_block = false;
++
++	fw->chan = mbox_request_channel(&fw->cl, RP1_MAILBOX_FIRMWARE);
++	if (IS_ERR(fw->chan)) {
++		int ret = PTR_ERR(fw->chan);
++
++		if (ret != -EPROBE_DEFER)
++			dev_err(dev, "Failed to get mbox channel: %d\n", ret);
++		kfree(fw);
++		return ret;
++	}
++
++	init_completion(&fw->c);
++	kref_init(&fw->consumers);
++
++	platform_set_drvdata(pdev, fw);
++
++	ret = rp1_firmware_message(fw, GET_FIRMWARE_VERSION,
++				   NULL, 0, &version, sizeof(version));
++	if (ret == sizeof(version)) {
++		dev_info(dev, "RP1 Firmware version %08x%08x%08x%08x%08x\n",
++			 version[0], version[1], version[2], version[3], version[4]);
++		ret = 0;
++	} else if (ret >= 0) {
++		ret = -EIO;
++	}
++
++	return ret;
++}
++
++static int rp1_firmware_remove(struct platform_device *pdev)
++{
++	struct rp1_firmware *fw = platform_get_drvdata(pdev);
++
++	rp1_firmware_put(fw);
++
++	return 0;
++}
++
++static struct platform_driver rp1_firmware_driver = {
++	.driver = {
++		.name = "rp1-firmware",
++		.of_match_table = rp1_firmware_of_match,
++	},
++	.probe		= rp1_firmware_probe,
++	.remove		= rp1_firmware_remove,
++};
++
++module_platform_driver(rp1_firmware_driver);
++
++MODULE_AUTHOR("Phil Elwell <phil@raspberrypi.com>");
++MODULE_DESCRIPTION("RP1 firmware driver");
++MODULE_LICENSE("GPL v2");
+--- /dev/null
++++ b/include/linux/rp1-firmware.h
+@@ -0,0 +1,53 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ *  Copyright (C) 2023 2023-2024 Raspberry Pi Ltd.
++ */
++
++#ifndef __SOC_RP1_FIRMWARE_H__
++#define __SOC_RP1_FIRMWARE_H__
++
++#include <linux/types.h>
++#include <linux/of_device.h>
++
++#define RP1_FOURCC(s) ((uint32_t)((s[0] << 24) | (s[1] << 16) | (s[2] << 8) | (s[3] << 0)))
++
++struct rp1_firmware;
++
++#if IS_ENABLED(CONFIG_FIRMWARE_RP1)
++int rp1_firmware_message(struct rp1_firmware *fw, uint16_t op,
++			 const void *data, unsigned int data_len,
++			 void *resp, unsigned int resp_space);
++void rp1_firmware_put(struct rp1_firmware *fw);
++struct rp1_firmware *rp1_firmware_get(struct device_node *fwnode);
++struct rp1_firmware *devm_rp1_firmware_get(struct device *dev, struct device_node *fwnode);
++int rp1_firmware_get_feature(struct rp1_firmware *fw, uint32_t fourcc,
++			     uint32_t *op_base, uint32_t *op_count);
++#else
++static inline int rp1_firmware_message(struct rp1_firmware *fw, uint16_t op,
++				       const void *data, unsigned int data_len,
++				       void *resp, unsigned int resp_space)
++{
++	return -EOPNOTSUPP;
++}
++
++static inline void rp1_firmware_put(struct rp1_firmware *fw) { }
++
++static inline struct rp1_firmware *rp1_firmware_get(struct device_node *fwnode)
++{
++	return NULL;
++}
++
++static inline struct rp1_firmware *devm_rp1_firmware_get(struct device *dev,
++							 struct device_node *fwnode)
++{
++	return NULL;
++}
++
++static inline int rp1_firmware_get_feature(struct rp1_firmware *fw, uint32_t fourcc,
++					   uint32_t *op_base, uint32_t *op_count)
++{
++	return -EOPNOTSUPP;
++}
++#endif
++
++#endif /* __SOC_RP1_FIRMWARE_H__ */
diff --git a/target/linux/bcm27xx/patches-6.6/950-1384-misc-Add-RP1-PIO-driver.patch b/target/linux/bcm27xx/patches-6.6/950-1384-misc-Add-RP1-PIO-driver.patch
new file mode 100644
index 00000000000000..521129b919002a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1384-misc-Add-RP1-PIO-driver.patch
@@ -0,0 +1,1385 @@
+From 55fd5c9018e1520d45f08cf08630a493ec7dedea Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 31 Oct 2024 18:26:00 +0000
+Subject: [PATCH] misc: Add RP1 PIO driver
+
+Provide remote access to the PIO hardware in RP1. There is a single
+instance, with 4 state machines.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/Kconfig           |    8 +
+ drivers/misc/Makefile          |    1 +
+ drivers/misc/rp1-fw-pio.h      |   53 ++
+ drivers/misc/rp1-pio.c         | 1064 ++++++++++++++++++++++++++++++++
+ include/uapi/misc/rp1_pio_if.h |  212 +++++++
+ 5 files changed, 1338 insertions(+)
+ create mode 100644 drivers/misc/rp1-fw-pio.h
+ create mode 100644 drivers/misc/rp1-pio.c
+ create mode 100644 include/uapi/misc/rp1_pio_if.h
+
+--- a/drivers/misc/Kconfig
++++ b/drivers/misc/Kconfig
+@@ -17,6 +17,14 @@ config BCM2835_SMI
+ 		Driver for enabling and using Broadcom's Secondary/Slow Memory Interface.
+ 		Appears as /dev/bcm2835_smi. For ioctl interface see drivers/misc/bcm2835_smi.h
+ 
++config RP1_PIO
++	tristate "Raspberry Pi RP1 PIO driver"
++	select FIRMWARE_RP1
++	default n
++	help
++		Driver providing control of the Raspberry Pi PIO block, as found in
++		RP1.
++
+ config AD525X_DPOT
+ 	tristate "Analog Devices Digital Potentiometers"
+ 	depends on (I2C || SPI) && SYSFS
+--- a/drivers/misc/Makefile
++++ b/drivers/misc/Makefile
+@@ -18,6 +18,7 @@ obj-$(CONFIG_TIFM_7XX1)       	+= tifm_7
+ obj-$(CONFIG_PHANTOM)		+= phantom.o
+ obj-$(CONFIG_QCOM_COINCELL)	+= qcom-coincell.o
+ obj-$(CONFIG_QCOM_FASTRPC)	+= fastrpc.o
++obj-$(CONFIG_RP1_PIO)		+= rp1-pio.o
+ obj-$(CONFIG_SENSORS_BH1770)	+= bh1770glc.o
+ obj-$(CONFIG_SENSORS_APDS990X)	+= apds990x.o
+ obj-$(CONFIG_ENCLOSURE_SERVICES) += enclosure.o
+--- /dev/null
++++ b/drivers/misc/rp1-fw-pio.h
+@@ -0,0 +1,53 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ *  Copyright (C) 2023 2023-2024 Raspberry Pi Ltd.
++ */
++
++#ifndef __SOC_RP1_FIRMWARE_OPS_H__
++#define __SOC_RP1_FIRMWARE_OPS_H__
++
++#include <linux/rp1-firmware.h>
++
++#define FOURCC_PIO RP1_FOURCC("PIO ")
++
++enum rp1_pio_ops {
++	PIO_CAN_ADD_PROGRAM,	// u16 num_instrs, u16 origin -> origin
++	PIO_ADD_PROGRAM,	// u16 num_instrs, u16 origin, u16 prog[] -> rc
++	PIO_REMOVE_PROGRAM,	// u16 num_instrs, u16 origin
++	PIO_CLEAR_INSTR_MEM,	// -
++
++	PIO_SM_CLAIM,		// u16 mask -> sm
++	PIO_SM_UNCLAIM,		// u16 mask
++	PIO_SM_IS_CLAIMED,	// u16 mask -> claimed
++
++	PIO_SM_INIT,		// u16 sm, u16 initial_pc, u32 sm_config[4]
++	PIO_SM_SET_CONFIG,	// u16 sm, u16 rsvd, u32 sm_config[4]
++	PIO_SM_EXEC,		// u16 sm, u16 instr, u8 blocking, u8 rsvd
++	PIO_SM_CLEAR_FIFOS,	// u16 sm
++	PIO_SM_SET_CLKDIV,	// u16 sm, u16 div_int, u8 div_frac, u8 rsvd
++	PIO_SM_SET_PINS,	// u16 sm, u16 rsvd, u32 values, u32 mask
++	PIO_SM_SET_PINDIRS,	// u16 sm, u16 rsvd, u32 dirs, u32 mask
++	PIO_SM_SET_ENABLED,	// u16 mask, u8 enable, u8 rsvd
++	PIO_SM_RESTART,		// u16 mask
++	PIO_SM_CLKDIV_RESTART,	// u16 mask
++	PIO_SM_ENABLE_SYNC,	// u16 mask
++	PIO_SM_PUT,		// u16 sm, u8 blocking, u8 rsvd, u32 data
++	PIO_SM_GET,		// u16 sm, u8 blocking, u8 rsvd -> u32 data
++	PIO_SM_SET_DMACTRL,	// u16 sm, u16 is_tx, u32 ctrl
++
++	GPIO_INIT,		// u16 gpio
++	GPIO_SET_FUNCTION,	// u16 gpio, u16 fn
++	GPIO_SET_PULLS,		// u16 gpio, u8 up, u8 down
++	GPIO_SET_OUTOVER,	// u16 gpio, u16 value
++	GPIO_SET_INOVER,	// u16 gpio, u16 value
++	GPIO_SET_OEOVER,	// u16 gpio, u16 value
++	GPIO_SET_INPUT_ENABLED,	// u16 gpio, u16 value
++	GPIO_SET_DRIVE_STRENGTH,	// u16 gpio, u16 value
++
++	READ_HW,		// src address, len -> data bytes
++	WRITE_HW,		// dst address, data
++
++	PIO_COUNT
++};
++
++#endif
+--- /dev/null
++++ b/drivers/misc/rp1-pio.c
+@@ -0,0 +1,1064 @@
++// SPDX-License-Identifier: GPL-2.0
++// PIO driver for RP1
++//
++//  Copyright (C) 2023-2024 Raspberry Pi Ltd.
++//
++// Parts of this driver are based on:
++//  - vcio.c, by Noralf Trønnes
++//    Copyright (C) 2010 Broadcom
++//    Copyright (C) 2015 Noralf Trønnes
++//    Copyright (C) 2021 Raspberry Pi (Trading) Ltd.
++//  - bcm2835_smi.c & bcm2835_smi_dev.c by Luke Wren
++//    Copyright (c) 2015 Raspberry Pi (Trading) Ltd.
++
++#include <linux/cdev.h>
++#include <linux/compat.h>
++#include <linux/device.h>
++#include <linux/dmaengine.h>
++#include <linux/dma-mapping.h>
++#include <linux/fs.h>
++#include <linux/init.h>
++#include <linux/ioctl.h>
++#include <linux/module.h>
++#include <linux/rp1-firmware.h>
++#include <linux/semaphore.h>
++#include <linux/slab.h>
++#include <linux/spinlock.h>
++#include <linux/uaccess.h>
++#include <uapi/misc/rp1_pio_if.h>
++
++#include "rp1-fw-pio.h"
++
++#define DRIVER_NAME		"rp1-pio"
++
++#define RP1_PIO_SMS_COUNT	4
++#define RP1_PIO_INSTR_COUNT	32
++
++#define MAX_ARG_SIZE		256
++
++#define RP1_PIO_FIFO_TX0	0x00
++#define RP1_PIO_FIFO_TX1	0x04
++#define RP1_PIO_FIFO_TX2	0x08
++#define RP1_PIO_FIFO_TX3	0x0c
++#define RP1_PIO_FIFO_RX0	0x10
++#define RP1_PIO_FIFO_RX1	0x14
++#define RP1_PIO_FIFO_RX2	0x18
++#define RP1_PIO_FIFO_RX3	0x1c
++
++#define RP1_PIO_DMACTRL_DEFAULT	0x80000104
++
++#define HANDLER(_n, _f) \
++	[_IOC_NR(PIO_IOC_ ## _n)] = { #_n, rp1_pio_ ## _f, _IOC_SIZE(PIO_IOC_ ## _n) }
++
++
++#define ROUND_UP(x, y) (((x) + (y) - 1) - (((x) + (y) - 1) % (y)))
++
++#define DMA_BOUNCE_BUFFER_SIZE 0x1000
++#define DMA_BOUNCE_BUFFER_COUNT 4
++
++struct dma_buf_info {
++	void *buf;
++	dma_addr_t phys;
++	struct scatterlist sgl;
++};
++
++struct dma_info {
++	struct semaphore buf_sem;
++	struct dma_chan *chan;
++	size_t buf_size;
++	size_t buf_count;
++	unsigned int head_idx;
++	unsigned int tail_idx;
++	struct dma_buf_info bufs[DMA_BOUNCE_BUFFER_COUNT];
++};
++
++struct rp1_pio_device {
++	struct platform_device *pdev;
++	struct rp1_firmware *fw;
++	uint16_t fw_pio_base;
++	uint16_t fw_pio_count;
++	dev_t dev_num;
++	struct class *dev_class;
++	struct cdev cdev;
++	phys_addr_t phys_addr;
++	uint32_t claimed_sms;
++	uint32_t claimed_dmas;
++	spinlock_t lock;
++	struct mutex instr_mutex;
++	struct dma_info dma_configs[RP1_PIO_SMS_COUNT][RP1_PIO_DIR_COUNT];
++	uint32_t used_instrs;
++	uint8_t instr_refcounts[RP1_PIO_INSTR_COUNT];
++	uint16_t instrs[RP1_PIO_INSTR_COUNT];
++	uint client_count;
++};
++
++struct rp1_pio_client {
++	struct rp1_pio_device *pio;
++	uint32_t claimed_sms;
++	uint32_t claimed_instrs;
++	uint32_t claimed_dmas;
++};
++
++static struct rp1_pio_device *g_pio;
++
++static int rp1_pio_message(struct rp1_pio_device *pio,
++			   uint16_t op, const void *data, unsigned int data_len)
++{
++	uint32_t rc;
++	int ret;
++
++	if (op >= pio->fw_pio_count)
++		return -EOPNOTSUPP;
++	ret = rp1_firmware_message(pio->fw, pio->fw_pio_base + op,
++				   data, data_len,
++				   &rc, sizeof(rc));
++	if (ret == 4)
++		ret = rc;
++	return ret;
++}
++
++static int rp1_pio_message_resp(struct rp1_pio_device *pio,
++				uint16_t op, const void *data, unsigned int data_len,
++				void *resp, void __user *userbuf, unsigned int resp_len)
++{
++	uint32_t resp_buf[1 + 32];
++	int ret;
++
++	if (op >= pio->fw_pio_count)
++		return -EOPNOTSUPP;
++	if (resp_len + 4 >= sizeof(resp_buf))
++		return -EINVAL;
++	if (!resp && !userbuf)
++		return -EINVAL;
++	ret = rp1_firmware_message(pio->fw, pio->fw_pio_base + op,
++				   data, data_len,
++				   resp_buf, resp_len + 4);
++	if (ret >= 4 && !resp_buf[0]) {
++		ret -= 4;
++		if (resp)
++			memcpy(resp, &resp_buf[1], ret);
++		else if (copy_to_user(userbuf, &resp_buf[1], ret))
++			ret = -EFAULT;
++	} else if (ret >= 0) {
++		ret = -EIO;
++	}
++	return ret;
++}
++
++static int rp1_pio_read_hw(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_device *pio = client->pio;
++	struct rp1_access_hw_args *args = param;
++
++	return rp1_pio_message_resp(pio, READ_HW,
++				    args, 8, NULL, args->data, args->len);
++}
++
++static int rp1_pio_write_hw(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_device *pio = client->pio;
++	struct rp1_access_hw_args *args = param;
++	uint32_t write_buf[32 + 1];
++	int len;
++
++	len = min(args->len, sizeof(write_buf) - 4);
++	write_buf[0] = args->addr;
++	if (copy_from_user(&write_buf[1], args->data, len))
++		return -EFAULT;
++	return rp1_firmware_message(pio->fw, pio->fw_pio_base + WRITE_HW,
++				    write_buf, 4 + len, NULL, 0);
++}
++
++static int rp1_pio_find_program(struct rp1_pio_device *pio,
++				struct rp1_pio_add_program_args *prog)
++{
++	uint start, end, prog_size;
++	uint32_t used_mask;
++	uint i;
++
++	start = (prog->origin != RP1_PIO_ORIGIN_ANY) ? prog->origin : 0;
++	end = (prog->origin != RP1_PIO_ORIGIN_ANY) ? prog->origin :
++			(RP1_PIO_INSTRUCTION_COUNT - prog->num_instrs);
++	prog_size = sizeof(prog->instrs[0]) * prog->num_instrs;
++	used_mask = (uint32_t)(~0) >> (32 - prog->num_instrs);
++
++	/* Find the best match */
++	for (i = start; i <= end; i++) {
++		uint32_t mask = used_mask << i;
++
++		if ((pio->used_instrs & mask) != mask)
++			continue;
++		if (!memcmp(pio->instrs + i, prog->instrs, prog_size))
++			return i;
++	}
++
++	return -1;
++}
++
++static int rp1_pio_can_add_program(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_add_program_args *args = param;
++	struct rp1_pio_device *pio = client->pio;
++	int offset;
++
++	if (args->num_instrs > RP1_PIO_INSTR_COUNT ||
++		((args->origin != RP1_PIO_ORIGIN_ANY) &&
++		 (args->origin >= RP1_PIO_INSTR_COUNT ||
++		  ((args->origin + args->num_instrs) > RP1_PIO_INSTR_COUNT))))
++		return -EINVAL;
++
++	mutex_lock(&pio->instr_mutex);
++	offset = rp1_pio_find_program(pio, args);
++	mutex_unlock(&pio->instr_mutex);
++	if (offset >= 0)
++		return offset;
++
++	/* Don't send the instructions, just the header */
++	return rp1_pio_message(pio, PIO_CAN_ADD_PROGRAM, args,
++			       offsetof(struct rp1_pio_add_program_args, instrs));
++}
++
++static int rp1_pio_add_program(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_add_program_args *args = param;
++	struct rp1_pio_device *pio = client->pio;
++	int offset;
++	uint i;
++
++	if (args->num_instrs > RP1_PIO_INSTR_COUNT ||
++		((args->origin != RP1_PIO_ORIGIN_ANY) &&
++		 (args->origin >= RP1_PIO_INSTR_COUNT ||
++		  ((args->origin + args->num_instrs) > RP1_PIO_INSTR_COUNT))))
++		return -EINVAL;
++
++	mutex_lock(&pio->instr_mutex);
++	offset = rp1_pio_find_program(pio, args);
++	if (offset < 0)
++		offset = rp1_pio_message(client->pio, PIO_ADD_PROGRAM, args, sizeof(*args));
++
++	if (offset >= 0) {
++		uint32_t used_mask;
++		uint prog_size;
++
++		used_mask = ((uint32_t)(~0) >> (-args->num_instrs & 0x1f)) << offset;
++		prog_size = sizeof(args->instrs[0]) * args->num_instrs;
++
++		if ((pio->used_instrs & used_mask) != used_mask) {
++			pio->used_instrs |= used_mask;
++			memcpy(pio->instrs + offset, args->instrs, prog_size);
++		}
++		client->claimed_instrs |= used_mask;
++		for (i = 0; i < args->num_instrs; i++)
++			pio->instr_refcounts[offset + i]++;
++	}
++	mutex_unlock(&pio->instr_mutex);
++	return offset;
++}
++
++static void rp1_pio_remove_instrs(struct rp1_pio_device *pio, uint32_t mask)
++{
++	struct rp1_pio_remove_program_args args;
++	uint i;
++
++	mutex_lock(&pio->instr_mutex);
++	args.num_instrs = 0;
++	for (i = 0; ; i++, mask >>= 1) {
++		if ((mask & 1) && pio->instr_refcounts[i] && !--pio->instr_refcounts[i]) {
++			pio->used_instrs &= ~(1 << i);
++			args.num_instrs++;
++		} else if (args.num_instrs) {
++			args.origin = i - args.num_instrs;
++			rp1_pio_message(pio, PIO_REMOVE_PROGRAM, &args, sizeof(args));
++			args.num_instrs = 0;
++		}
++		if (!mask)
++			break;
++	}
++	mutex_unlock(&pio->instr_mutex);
++}
++
++static int rp1_pio_remove_program(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_remove_program_args *args = param;
++	uint32_t used_mask;
++	int ret = -ENOENT;
++
++	if (args->num_instrs > RP1_PIO_INSTR_COUNT ||
++		args->origin >= RP1_PIO_INSTR_COUNT ||
++		(args->origin + args->num_instrs) > RP1_PIO_INSTR_COUNT)
++		return -EINVAL;
++
++	used_mask = ((uint32_t)(~0) >> (32 - args->num_instrs)) << args->origin;
++	if ((client->claimed_instrs & used_mask) == used_mask) {
++		client->claimed_instrs &= ~used_mask;
++		rp1_pio_remove_instrs(client->pio, used_mask);
++		ret = 0;
++	}
++	return ret;
++}
++
++static int rp1_pio_clear_instr_mem(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_device *pio = client->pio;
++
++	mutex_lock(&pio->instr_mutex);
++	(void)rp1_pio_message(client->pio, PIO_CLEAR_INSTR_MEM, NULL, 0);
++	memset(pio->instr_refcounts, 0, sizeof(pio->instr_refcounts));
++	pio->used_instrs = 0;
++	client->claimed_instrs = 0;
++	mutex_unlock(&pio->instr_mutex);
++	return 0;
++}
++
++static int rp1_pio_sm_claim(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_claim_args *args = param;
++	struct rp1_pio_device *pio = client->pio;
++	int ret;
++
++	mutex_lock(&pio->instr_mutex);
++	ret = rp1_pio_message(client->pio, PIO_SM_CLAIM, args, sizeof(*args));
++	if (ret >= 0) {
++		if (args->mask)
++			client->claimed_sms |= args->mask;
++		else
++			client->claimed_sms |= (1 << ret);
++		pio->claimed_sms |= client->claimed_sms;
++	}
++	mutex_unlock(&pio->instr_mutex);
++	return ret;
++}
++
++static int rp1_pio_sm_unclaim(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_claim_args *args = param;
++	struct rp1_pio_device *pio = client->pio;
++
++	mutex_lock(&pio->instr_mutex);
++	(void)rp1_pio_message(client->pio, PIO_SM_UNCLAIM, args, sizeof(*args));
++	client->claimed_sms &= ~args->mask;
++	pio->claimed_sms &= ~args->mask;
++	mutex_unlock(&pio->instr_mutex);
++	return 0;
++}
++
++static int rp1_pio_sm_is_claimed(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_claim_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_IS_CLAIMED, args, sizeof(*args));
++}
++
++static int rp1_pio_sm_init(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_init_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_INIT, args, sizeof(*args));
++}
++
++static int rp1_pio_sm_set_config(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_set_config_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_SET_CONFIG, args, sizeof(*args));
++}
++
++static int rp1_pio_sm_exec(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_exec_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_EXEC, args, sizeof(*args));
++}
++
++static int rp1_pio_sm_clear_fifos(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_clear_fifos_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_CLEAR_FIFOS, args, sizeof(*args));
++}
++
++static int rp1_pio_sm_set_clkdiv(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_set_clkdiv_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_SET_CLKDIV, args, sizeof(*args));
++}
++
++static int rp1_pio_sm_set_pins(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_set_pins_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_SET_PINS, args, sizeof(*args));
++}
++
++static int rp1_pio_sm_set_pindirs(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_set_pindirs_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_SET_PINDIRS, args, sizeof(*args));
++}
++
++static int rp1_pio_sm_set_enabled(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_set_enabled_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_SET_ENABLED, args, sizeof(*args));
++}
++
++static int rp1_pio_sm_restart(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_restart_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_RESTART, args, sizeof(*args));
++}
++
++static int rp1_pio_sm_clkdiv_restart(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_restart_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_CLKDIV_RESTART, args, sizeof(*args));
++}
++
++static int rp1_pio_sm_enable_sync(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_enable_sync_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_ENABLE_SYNC, args, sizeof(*args));
++}
++
++static int rp1_pio_sm_put(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_put_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_PUT, args, sizeof(*args));
++}
++
++static int rp1_pio_sm_get(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_get_args *args = param;
++	int ret;
++
++	ret = rp1_pio_message_resp(client->pio, PIO_SM_GET, args, sizeof(*args),
++				   &args->data, NULL, sizeof(args->data));
++	if (ret >= 0)
++		return offsetof(struct rp1_pio_sm_get_args, data) + ret;
++	return ret;
++}
++
++static int rp1_pio_sm_set_dmactrl(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_set_dmactrl_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_SET_DMACTRL, args, sizeof(*args));
++}
++
++static int rp1_pio_gpio_init(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_gpio_init_args *args = param;
++
++	return rp1_pio_message(client->pio, GPIO_INIT, args, sizeof(*args));
++}
++
++static int rp1_pio_gpio_set_function(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_gpio_set_function_args *args = param;
++
++	return rp1_pio_message(client->pio, GPIO_SET_FUNCTION, args, sizeof(*args));
++}
++
++static int rp1_pio_gpio_set_pulls(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_gpio_set_pulls_args *args = param;
++
++	return rp1_pio_message(client->pio, GPIO_SET_PULLS, args, sizeof(*args));
++}
++
++static int rp1_pio_gpio_set_outover(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_gpio_set_args *args = param;
++
++	return rp1_pio_message(client->pio, GPIO_SET_OUTOVER, args, sizeof(*args));
++}
++
++static int rp1_pio_gpio_set_inover(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_gpio_set_args *args = param;
++
++	return rp1_pio_message(client->pio, GPIO_SET_INOVER, args, sizeof(*args));
++}
++
++static int rp1_pio_gpio_set_oeover(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_gpio_set_args *args = param;
++
++	return rp1_pio_message(client->pio, GPIO_SET_OEOVER, args, sizeof(*args));
++}
++
++static int rp1_pio_gpio_set_input_enabled(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_gpio_set_args *args = param;
++
++	return rp1_pio_message(client->pio, GPIO_SET_INPUT_ENABLED, args, sizeof(*args));
++}
++
++static int rp1_pio_gpio_set_drive_strength(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_gpio_set_args *args = param;
++
++	return rp1_pio_message(client->pio, GPIO_SET_DRIVE_STRENGTH, args, sizeof(*args));
++}
++
++static void rp1_pio_sm_dma_callback(void *param)
++{
++	struct dma_info *dma = param;
++
++	up(&dma->buf_sem);
++}
++
++static void rp1_pio_sm_dma_free(struct device *dev, struct dma_info *dma)
++{
++	dmaengine_terminate_all(dma->chan);
++	while (dma->buf_count > 0) {
++		dma->buf_count--;
++		dma_free_coherent(dev, ROUND_UP(dma->buf_size, PAGE_SIZE),
++				  dma->bufs[dma->buf_count].buf, dma->bufs[dma->buf_count].phys);
++	}
++
++	dma_release_channel(dma->chan);
++}
++
++static int rp1_pio_sm_config_xfer(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_config_xfer_args *args = param;
++	struct rp1_pio_sm_set_dmactrl_args set_dmactrl_args;
++	struct rp1_pio_device *pio = client->pio;
++	struct platform_device *pdev = pio->pdev;
++	struct device *dev = &pdev->dev;
++	struct dma_slave_config config = {};
++	phys_addr_t fifo_addr;
++	struct dma_info *dma;
++	uint32_t dma_mask;
++	char chan_name[4];
++	uint buf_size;
++	int ret = 0;
++
++	if (args->sm >= RP1_PIO_SMS_COUNT || args->dir >= RP1_PIO_DIR_COUNT ||
++	    !args->buf_size || (args->buf_size & 3) ||
++	    !args->buf_count || args->buf_count > DMA_BOUNCE_BUFFER_COUNT)
++		return -EINVAL;
++
++	dma_mask = 1 << (args->sm * 2 + args->dir);
++
++	dma = &pio->dma_configs[args->sm][args->dir];
++
++	spin_lock(&pio->lock);
++	if (pio->claimed_dmas & dma_mask)
++		rp1_pio_sm_dma_free(dev, dma);
++	pio->claimed_dmas |= dma_mask;
++	client->claimed_dmas |= dma_mask;
++	spin_unlock(&pio->lock);
++
++	dma->buf_size = args->buf_size;
++	/* Round up the allocations */
++	buf_size = ROUND_UP(args->buf_size, PAGE_SIZE);
++	sema_init(&dma->buf_sem, 0);
++
++	/* Allocate and configure a DMA channel */
++	/* Careful - each SM FIFO has its own DREQ value */
++	chan_name[0] = (args->dir == RP1_PIO_DIR_TO_SM) ? 't' : 'r';
++	chan_name[1] = 'x';
++	chan_name[2] = '0' + args->sm;
++	chan_name[3] = '\0';
++
++	dma->chan = dma_request_chan(dev, chan_name);
++	if (IS_ERR(dma->chan))
++		return PTR_ERR(dma->chan);
++
++	/* Alloc and map bounce buffers */
++	for (dma->buf_count = 0; dma->buf_count < args->buf_count; dma->buf_count++) {
++		struct dma_buf_info *dbi = &dma->bufs[dma->buf_count];
++
++		dbi->buf = dma_alloc_coherent(dma->chan->device->dev, buf_size,
++					      &dbi->phys, GFP_KERNEL);
++		if (!dbi->buf) {
++			ret = -ENOMEM;
++			goto err_dma_free;
++		}
++		sg_init_table(&dbi->sgl, 1);
++		sg_dma_address(&dbi->sgl) = dbi->phys;
++	}
++
++	fifo_addr = pio->phys_addr;
++	fifo_addr += args->sm * (RP1_PIO_FIFO_TX1 - RP1_PIO_FIFO_TX0);
++	fifo_addr += (args->dir == RP1_PIO_DIR_TO_SM) ? RP1_PIO_FIFO_TX0 : RP1_PIO_FIFO_RX0;
++
++	config.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++	config.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
++	config.src_addr = fifo_addr;
++	config.dst_addr = fifo_addr;
++	config.direction = (args->dir == RP1_PIO_DIR_TO_SM) ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM;
++
++	ret = dmaengine_slave_config(dma->chan, &config);
++	if (ret)
++		goto err_dma_free;
++
++	set_dmactrl_args.sm = args->sm;
++	set_dmactrl_args.is_tx = (args->dir == RP1_PIO_DIR_TO_SM);
++	set_dmactrl_args.ctrl = RP1_PIO_DMACTRL_DEFAULT;
++	if (args->dir == RP1_PIO_DIR_FROM_SM)
++		set_dmactrl_args.ctrl = (RP1_PIO_DMACTRL_DEFAULT & ~0x1f) | 1;
++
++	ret = rp1_pio_sm_set_dmactrl(client, &set_dmactrl_args);
++	if (ret)
++		goto err_dma_free;
++
++	return 0;
++
++err_dma_free:
++	rp1_pio_sm_dma_free(dev, dma);
++
++	spin_lock(&pio->lock);
++	client->claimed_dmas &= ~dma_mask;
++	pio->claimed_dmas &= ~dma_mask;
++	spin_unlock(&pio->lock);
++
++	return ret;
++}
++
++static int rp1_pio_sm_tx_user(struct rp1_pio_device *pio, struct dma_info *dma,
++			      const void __user *userbuf, size_t bytes)
++{
++	struct platform_device *pdev = pio->pdev;
++	struct dma_async_tx_descriptor *desc;
++	struct device *dev = &pdev->dev;
++	int ret = 0;
++
++	// Clean the slate - we're running synchronously
++	dma->head_idx = 0;
++	dma->tail_idx = 0;
++
++	while (bytes > 0) {
++		size_t copy_bytes = min(bytes, dma->buf_size);
++		struct dma_buf_info *dbi;
++
++		/* grab the next free buffer, waiting if they're all full */
++		if (dma->head_idx - dma->tail_idx == dma->buf_count) {
++			if (down_timeout(&dma->buf_sem,
++				msecs_to_jiffies(1000))) {
++				dev_err(dev, "DMA bounce timed out\n");
++				break;
++			}
++			dma->tail_idx++;
++		}
++
++		dbi = &dma->bufs[dma->head_idx % dma->buf_count];
++
++		sg_dma_len(&dbi->sgl) = copy_bytes;
++
++		ret = copy_from_user(dbi->buf, userbuf, copy_bytes);
++		if (ret < 0)
++			break;
++
++		userbuf += copy_bytes;
++
++		desc = dmaengine_prep_slave_sg(dma->chan, &dbi->sgl, 1,
++					       DMA_MEM_TO_DEV,
++					       DMA_PREP_INTERRUPT | DMA_CTRL_ACK |
++					       DMA_PREP_FENCE);
++		if (!desc) {
++			dev_err(dev, "DMA preparation failedzn");
++			ret = -EIO;
++			break;
++		}
++
++		desc->callback = rp1_pio_sm_dma_callback;
++		desc->callback_param = dma;
++
++		/* Submit the buffer - the callback will kick the semaphore */
++		ret = dmaengine_submit(desc);
++		if (ret < 0)
++			break;
++		ret = 0;
++
++		dma_async_issue_pending(dma->chan);
++
++		dma->head_idx++;
++		bytes -= copy_bytes;
++	}
++
++	// Block for completion
++	while (dma->tail_idx != dma->head_idx) {
++		if (down_timeout(&dma->buf_sem, msecs_to_jiffies(1000))) {
++			dev_err(dev, "DMA wait timed out\n");
++			ret = -ETIMEDOUT;
++			break;
++		}
++		dma->tail_idx++;
++	}
++
++	return ret;
++}
++
++static int rp1_pio_sm_rx_user(struct rp1_pio_device *pio, struct dma_info *dma,
++			      void __user *userbuf, size_t bytes)
++{
++	struct platform_device *pdev = pio->pdev;
++	struct dma_async_tx_descriptor *desc;
++	struct device *dev = &pdev->dev;
++	int ret = 0;
++
++	/* Clean the slate - we're running synchronously */
++	dma->head_idx = 0;
++	dma->tail_idx = 0;
++
++	while (bytes || dma->tail_idx != dma->head_idx) {
++		size_t copy_bytes = min(bytes, dma->buf_size);
++		struct dma_buf_info *dbi;
++
++		/*
++		 * wait for the next RX to complete if all the buffers are
++		 * outstanding or we're finishing up.
++		 */
++		if (!bytes || dma->head_idx - dma->tail_idx == dma->buf_count) {
++			if (down_timeout(&dma->buf_sem,
++				msecs_to_jiffies(1000))) {
++				dev_err(dev, "DMA wait timed out");
++				ret = -ETIMEDOUT;
++				break;
++			}
++
++			dbi = &dma->bufs[dma->tail_idx++ % dma->buf_count];
++			ret = copy_to_user(userbuf, dbi->buf, sg_dma_len(&dbi->sgl));
++			if (ret < 0)
++				break;
++			userbuf += sg_dma_len(&dbi->sgl);
++
++			if (!bytes)
++				continue;
++		}
++
++		dbi = &dma->bufs[dma->head_idx % dma->buf_count];
++		sg_dma_len(&dbi->sgl) = copy_bytes;
++		desc = dmaengine_prep_slave_sg(dma->chan, &dbi->sgl, 1,
++					       DMA_DEV_TO_MEM,
++					       DMA_PREP_INTERRUPT | DMA_CTRL_ACK |
++					       DMA_PREP_FENCE);
++		if (!desc) {
++			dev_err(dev, "DMA preparation failed");
++			ret = -EIO;
++			break;
++		}
++
++		desc->callback = rp1_pio_sm_dma_callback;
++		desc->callback_param = dma;
++
++		// Submit the buffer - the callback will kick the semaphore
++
++		ret = dmaengine_submit(desc);
++		if (ret < 0)
++			break;
++
++		dma_async_issue_pending(dma->chan);
++
++		dma->head_idx++;
++		bytes -= copy_bytes;
++	}
++
++	return ret;
++}
++
++static int rp1_pio_sm_xfer_data(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_xfer_data_args *args = param;
++	struct rp1_pio_device *pio = client->pio;
++	struct dma_info *dma;
++
++	if (args->sm >= RP1_PIO_SMS_COUNT || args->dir >= RP1_PIO_DIR_COUNT ||
++	    !args->data_bytes || !args->data)
++		return -EINVAL;
++
++	dma = &pio->dma_configs[args->sm][args->dir];
++
++	if (args->dir == RP1_PIO_DIR_TO_SM)
++		return rp1_pio_sm_tx_user(pio, dma, args->data, args->data_bytes);
++	else
++		return rp1_pio_sm_rx_user(pio, dma, args->data, args->data_bytes);
++}
++
++struct handler_info {
++	const char *name;
++	int (*func)(struct rp1_pio_client *client, void *param);
++	int argsize;
++} ioctl_handlers[] = {
++	HANDLER(SM_CONFIG_XFER, sm_config_xfer),
++	HANDLER(SM_XFER_DATA, sm_xfer_data),
++
++	HANDLER(CAN_ADD_PROGRAM, can_add_program),
++	HANDLER(ADD_PROGRAM, add_program),
++	HANDLER(REMOVE_PROGRAM, remove_program),
++	HANDLER(CLEAR_INSTR_MEM, clear_instr_mem),
++
++	HANDLER(SM_CLAIM, sm_claim),
++	HANDLER(SM_UNCLAIM, sm_unclaim),
++	HANDLER(SM_IS_CLAIMED, sm_is_claimed),
++
++	HANDLER(SM_INIT, sm_init),
++	HANDLER(SM_SET_CONFIG, sm_set_config),
++	HANDLER(SM_EXEC, sm_exec),
++	HANDLER(SM_CLEAR_FIFOS, sm_clear_fifos),
++	HANDLER(SM_SET_CLKDIV, sm_set_clkdiv),
++	HANDLER(SM_SET_PINS, sm_set_pins),
++	HANDLER(SM_SET_PINDIRS, sm_set_pindirs),
++	HANDLER(SM_SET_ENABLED, sm_set_enabled),
++	HANDLER(SM_RESTART, sm_restart),
++	HANDLER(SM_CLKDIV_RESTART, sm_clkdiv_restart),
++	HANDLER(SM_ENABLE_SYNC, sm_enable_sync),
++	HANDLER(SM_PUT, sm_put),
++	HANDLER(SM_GET, sm_get),
++	HANDLER(SM_SET_DMACTRL, sm_set_dmactrl),
++
++	HANDLER(GPIO_INIT, gpio_init),
++	HANDLER(GPIO_SET_FUNCTION, gpio_set_function),
++	HANDLER(GPIO_SET_PULLS, gpio_set_pulls),
++	HANDLER(GPIO_SET_OUTOVER, gpio_set_outover),
++	HANDLER(GPIO_SET_INOVER, gpio_set_inover),
++	HANDLER(GPIO_SET_OEOVER, gpio_set_oeover),
++	HANDLER(GPIO_SET_INPUT_ENABLED, gpio_set_input_enabled),
++	HANDLER(GPIO_SET_DRIVE_STRENGTH, gpio_set_drive_strength),
++
++	HANDLER(READ_HW, read_hw),
++	HANDLER(WRITE_HW, write_hw),
++};
++
++static int rp1_pio_open(struct inode *inode, struct file *filp)
++{
++	struct rp1_pio_device *pio = g_pio;
++	struct rp1_pio_client *client;
++
++	client = kzalloc(sizeof(*client), GFP_KERNEL);
++
++	client->pio = pio;
++	filp->private_data = client;
++
++	return 0;
++}
++
++static int rp1_pio_release(struct inode *inode, struct file *filp)
++{
++	struct rp1_pio_client *client = filp->private_data;
++	struct rp1_pio_device *pio = client->pio;
++	uint claimed_dmas = client->claimed_dmas;
++	int i;
++
++	/* Free any allocated resources */
++
++	for (i = 0; claimed_dmas; i++) {
++		uint mask = (1 << i);
++
++		if (claimed_dmas & mask) {
++			struct dma_info *dma = &pio->dma_configs[i >> 1][i & 1];
++
++			claimed_dmas &= ~mask;
++			rp1_pio_sm_dma_free(&pio->pdev->dev, dma);
++		}
++	}
++
++	spin_lock(&pio->lock);
++	pio->claimed_dmas &= ~client->claimed_dmas;
++	spin_unlock(&pio->lock);
++
++	if (client->claimed_sms) {
++		struct rp1_pio_sm_set_enabled_args se_args = {
++			.mask = client->claimed_sms, .enable = 0
++		};
++		struct rp1_pio_sm_claim_args uc_args = {
++			.mask = client->claimed_sms
++		};
++
++		rp1_pio_sm_set_enabled(client, &se_args);
++		rp1_pio_sm_unclaim(client, &uc_args);
++	}
++
++	if (client->claimed_instrs)
++		rp1_pio_remove_instrs(pio, client->claimed_instrs);
++
++	/* Reinitialise the SM? */
++
++	kfree(client);
++
++	return 0;
++}
++
++static long rp1_pio_ioctl(struct file *filp, unsigned int ioctl_num,
++			  unsigned long ioctl_param)
++{
++	struct rp1_pio_client *client = filp->private_data;
++	struct device *dev = &client->pio->pdev->dev;
++	void __user *argp = (void __user *)ioctl_param;
++	int nr = _IOC_NR(ioctl_num);
++	int sz = _IOC_SIZE(ioctl_num);
++	struct handler_info *hdlr = &ioctl_handlers[nr];
++	uint32_t argbuf[MAX_ARG_SIZE/sizeof(uint32_t)];
++	int ret;
++
++	if (nr >= ARRAY_SIZE(ioctl_handlers) || !hdlr->func) {
++		dev_err(dev, "unknown ioctl: %x\n", ioctl_num);
++		return -EOPNOTSUPP;
++	}
++
++	if (sz != hdlr->argsize) {
++		dev_err(dev, "wrong %s argsize (expected %d, got %d)\n",
++			hdlr->name, hdlr->argsize, sz);
++		return -EINVAL;
++	}
++
++	if (copy_from_user(argbuf, argp, sz))
++		return -EFAULT;
++
++	ret = (hdlr->func)(client, argbuf);
++	dev_dbg(dev, "%s: %s -> %d\n", __func__, hdlr->name, ret);
++	if (ret > 0) {
++		if (copy_to_user(argp, argbuf, ret))
++			ret = -EFAULT;
++	}
++
++	return ret;
++}
++
++const struct file_operations rp1_pio_fops = {
++	.owner =	THIS_MODULE,
++	.open =		rp1_pio_open,
++	.release =	rp1_pio_release,
++	.unlocked_ioctl = rp1_pio_ioctl,
++};
++
++static int rp1_pio_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct resource *ioresource;
++	struct rp1_pio_device *pio;
++	struct rp1_firmware *fw;
++	uint32_t op_count = 0;
++	uint32_t op_base = 0;
++	struct device *cdev;
++	char dev_name[16];
++	void *p;
++	int ret;
++	int i;
++
++	/* Run-time check for a build-time misconfiguration */
++	for (i = 0; i < ARRAY_SIZE(ioctl_handlers); i++) {
++		struct handler_info *hdlr = &ioctl_handlers[i];
++
++		if (WARN_ON(hdlr->argsize > MAX_ARG_SIZE))
++			return -EINVAL;
++	}
++
++	fw = devm_rp1_firmware_get(dev, dev->of_node);
++	if (IS_ERR(fw))
++		return PTR_ERR(fw);
++
++	ret = rp1_firmware_get_feature(fw, FOURCC_PIO, &op_base, &op_count);
++	if (ret < 0)
++		return ret;
++
++	pio = devm_kzalloc(&pdev->dev, sizeof(*pio), GFP_KERNEL);
++	if (!pio)
++		return -ENOMEM;
++
++	platform_set_drvdata(pdev, pio);
++	pio->fw_pio_base = op_base;
++	pio->fw_pio_count = op_count;
++	pio->pdev = pdev;
++	pio->fw = fw;
++	spin_lock_init(&pio->lock);
++	mutex_init(&pio->instr_mutex);
++
++	p = devm_platform_get_and_ioremap_resource(pdev, 0, &ioresource);
++	if (IS_ERR(p))
++		return PTR_ERR(p);
++
++	pio->phys_addr = ioresource->start;
++
++	ret = alloc_chrdev_region(&pio->dev_num, 0, 1, DRIVER_NAME);
++	if (ret < 0) {
++		dev_err(dev, "alloc_chrdev_region failed (rc=%d)\n", ret);
++		goto out_err;
++	}
++
++	cdev_init(&pio->cdev, &rp1_pio_fops);
++	ret = cdev_add(&pio->cdev, pio->dev_num, 1);
++	if (ret) {
++		dev_err(dev, "cdev_add failed (err %d)\n", ret);
++		goto out_unregister;
++	}
++
++	pio->dev_class = class_create(DRIVER_NAME);
++	if (IS_ERR(pio->dev_class)) {
++		ret = PTR_ERR(pio->dev_class);
++		dev_err(dev, "class_create failed (err %d)\n", ret);
++		goto out_cdev_del;
++	}
++	pdev->id = of_alias_get_id(pdev->dev.of_node, "pio");
++	if (pdev->id < 0) {
++		dev_err(dev, "alias is missing\n");
++		return -EINVAL;
++		goto out_class_destroy;
++	}
++	sprintf(dev_name, "pio%d", pdev->id);
++	cdev = device_create(pio->dev_class, NULL, pio->dev_num, NULL, dev_name);
++	if (IS_ERR(cdev)) {
++		ret = PTR_ERR(cdev);
++		dev_err(dev, "%s: device_create failed (err %d)\n", __func__, ret);
++		goto out_class_destroy;
++	}
++
++	g_pio = pio;
++
++	dev_info(dev, "Created instance as %s\n", dev_name);
++	return 0;
++
++out_class_destroy:
++	class_destroy(pio->dev_class);
++
++out_cdev_del:
++	cdev_del(&pio->cdev);
++
++out_unregister:
++	unregister_chrdev_region(pio->dev_num, 1);
++
++out_err:
++	return ret;
++}
++
++static void rp1_pio_remove(struct platform_device *pdev)
++{
++	struct rp1_pio_device *pio = platform_get_drvdata(pdev);
++
++	/* There should be no clients */
++
++	if (g_pio == pio)
++		g_pio = NULL;
++}
++
++static const struct of_device_id rp1_pio_ids[] = {
++	{ .compatible = "raspberrypi,rp1-pio" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, rp1_pio_ids);
++
++static struct platform_driver rp1_pio_driver = {
++	.driver	= {
++		.name		= "rp1-pio",
++		.of_match_table	= of_match_ptr(rp1_pio_ids),
++	},
++	.probe		= rp1_pio_probe,
++	.remove_new	= rp1_pio_remove,
++	.shutdown	= rp1_pio_remove,
++};
++
++module_platform_driver(rp1_pio_driver);
++
++MODULE_DESCRIPTION("PIO controller driver for Raspberry Pi RP1");
++MODULE_AUTHOR("Phil Elwell");
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/include/uapi/misc/rp1_pio_if.h
+@@ -0,0 +1,212 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Copyright (c) 2023-24 Raspberry Pi Ltd.
++ * All rights reserved.
++ */
++#ifndef _PIO_RP1_IF_H
++#define _PIO_RP1_IF_H
++
++#include <linux/ioctl.h>
++
++#define RP1_PIO_INSTRUCTION_COUNT   32
++#define RP1_PIO_SM_COUNT            4
++#define RP1_PIO_GPIO_COUNT          28
++#define RP1_GPIO_FUNC_PIO           7
++
++#define RP1_PIO_ORIGIN_ANY          ((uint16_t)(~0))
++
++#define RP1_PIO_DIR_TO_SM           0
++#define RP1_PIO_DIR_FROM_SM         1
++#define RP1_PIO_DIR_COUNT           2
++
++typedef struct {
++	uint32_t clkdiv;
++	uint32_t execctrl;
++	uint32_t shiftctrl;
++	uint32_t pinctrl;
++} rp1_pio_sm_config;
++
++struct rp1_pio_add_program_args {
++	uint16_t num_instrs;
++	uint16_t origin;
++	uint16_t instrs[RP1_PIO_INSTRUCTION_COUNT];
++};
++
++struct rp1_pio_remove_program_args {
++	uint16_t num_instrs;
++	uint16_t origin;
++};
++
++struct rp1_pio_sm_claim_args {
++	uint16_t mask;
++};
++
++struct rp1_pio_sm_init_args {
++	uint16_t sm;
++	uint16_t initial_pc;
++	rp1_pio_sm_config config;
++};
++
++struct rp1_pio_sm_set_config_args {
++	uint16_t sm;
++	uint16_t rsvd;
++	rp1_pio_sm_config config;
++};
++
++struct rp1_pio_sm_exec_args {
++	uint16_t sm;
++	uint16_t instr;
++	uint8_t blocking;
++	uint8_t rsvd;
++};
++
++struct rp1_pio_sm_clear_fifos_args {
++	uint16_t sm;
++};
++
++struct rp1_pio_sm_set_clkdiv_args {
++	uint16_t sm;
++	uint16_t div_int;
++	uint8_t div_frac;
++	uint8_t rsvd;
++};
++
++struct rp1_pio_sm_set_pins_args {
++	uint16_t sm;
++	uint16_t rsvd;
++	uint32_t values;
++	uint32_t mask;
++};
++
++struct rp1_pio_sm_set_pindirs_args {
++	uint16_t sm;
++	uint16_t rsvd;
++	uint32_t dirs;
++	uint32_t mask;
++};
++
++struct rp1_pio_sm_set_enabled_args {
++	uint16_t mask;
++	uint8_t enable;
++	uint8_t rsvd;
++};
++
++struct rp1_pio_sm_restart_args {
++	uint16_t mask;
++};
++
++struct rp1_pio_sm_clkdiv_restart_args {
++	uint16_t mask;
++};
++
++struct rp1_pio_sm_enable_sync_args {
++	uint16_t mask;
++};
++
++struct rp1_pio_sm_put_args {
++	uint16_t sm;
++	uint8_t blocking;
++	uint8_t rsvd;
++	uint32_t data;
++};
++
++struct rp1_pio_sm_get_args {
++	uint16_t sm;
++	uint8_t blocking;
++	uint8_t rsvd;
++	uint32_t data; /* IN/OUT */
++};
++
++struct rp1_pio_sm_set_dmactrl_args {
++	uint16_t sm;
++	uint8_t is_tx;
++	uint8_t rsvd;
++	uint32_t ctrl;
++};
++
++struct rp1_gpio_init_args {
++	uint16_t gpio;
++};
++
++struct rp1_gpio_set_function_args {
++	uint16_t gpio;
++	uint16_t fn;
++};
++
++struct rp1_gpio_set_pulls_args {
++	uint16_t gpio;
++	uint8_t up;
++	uint8_t down;
++};
++
++struct rp1_gpio_set_args {
++	uint16_t gpio;
++	uint16_t value;
++};
++
++struct rp1_pio_sm_config_xfer_args {
++	uint16_t sm;
++	uint16_t dir;
++	uint16_t buf_size;
++	uint16_t buf_count;
++};
++
++struct rp1_pio_sm_xfer_data_args {
++	uint16_t sm;
++	uint16_t dir;
++	uint16_t data_bytes;
++	void *data;
++};
++
++struct rp1_access_hw_args {
++	uint32_t addr;
++	uint32_t len;
++	void *data;
++};
++
++#define PIO_IOC_MAGIC 102
++
++#define PIO_IOC_SM_CONFIG_XFER _IOW(PIO_IOC_MAGIC, 0, struct rp1_pio_sm_config_xfer_args)
++#define PIO_IOC_SM_XFER_DATA _IOW(PIO_IOC_MAGIC, 1, struct rp1_pio_sm_xfer_data_args)
++
++#ifdef CONFIG_COMPAT
++//XXX #define PIO_IOC_SM_XFER_DATA32 _IOW(PIO_IOC_MAGIC, 2, struct pio_sm_xfer_data_args)
++#endif
++
++#define PIO_IOC_READ_HW _IOW(PIO_IOC_MAGIC, 8, struct rp1_access_hw_args)
++#define PIO_IOC_WRITE_HW _IOW(PIO_IOC_MAGIC, 9, struct rp1_access_hw_args)
++
++#define PIO_IOC_CAN_ADD_PROGRAM _IOW(PIO_IOC_MAGIC, 10, struct rp1_pio_add_program_args)
++#define PIO_IOC_ADD_PROGRAM _IOW(PIO_IOC_MAGIC, 11, struct rp1_pio_add_program_args)
++#define PIO_IOC_REMOVE_PROGRAM _IOW(PIO_IOC_MAGIC, 12, struct rp1_pio_remove_program_args)
++#define PIO_IOC_CLEAR_INSTR_MEM _IO(PIO_IOC_MAGIC, 13)
++
++#define PIO_IOC_SM_CLAIM _IOW(PIO_IOC_MAGIC, 20, struct rp1_pio_sm_claim_args)
++#define PIO_IOC_SM_UNCLAIM _IOW(PIO_IOC_MAGIC, 21, struct rp1_pio_sm_claim_args)
++#define PIO_IOC_SM_IS_CLAIMED _IOW(PIO_IOC_MAGIC, 22, struct rp1_pio_sm_claim_args)
++
++#define PIO_IOC_SM_INIT _IOW(PIO_IOC_MAGIC, 30, struct rp1_pio_sm_init_args)
++#define PIO_IOC_SM_SET_CONFIG _IOW(PIO_IOC_MAGIC, 31, struct rp1_pio_sm_set_config_args)
++#define PIO_IOC_SM_EXEC _IOW(PIO_IOC_MAGIC, 32, struct rp1_pio_sm_exec_args)
++#define PIO_IOC_SM_CLEAR_FIFOS _IOW(PIO_IOC_MAGIC, 33, struct rp1_pio_sm_clear_fifos_args)
++#define PIO_IOC_SM_SET_CLKDIV _IOW(PIO_IOC_MAGIC, 34, struct rp1_pio_sm_set_clkdiv_args)
++#define PIO_IOC_SM_SET_PINS _IOW(PIO_IOC_MAGIC, 35, struct rp1_pio_sm_set_pins_args)
++#define PIO_IOC_SM_SET_PINDIRS _IOW(PIO_IOC_MAGIC, 36, struct rp1_pio_sm_set_pindirs_args)
++#define PIO_IOC_SM_SET_ENABLED _IOW(PIO_IOC_MAGIC, 37, struct rp1_pio_sm_set_enabled_args)
++#define PIO_IOC_SM_RESTART _IOW(PIO_IOC_MAGIC, 38, struct rp1_pio_sm_restart_args)
++#define PIO_IOC_SM_CLKDIV_RESTART _IOW(PIO_IOC_MAGIC, 39, struct rp1_pio_sm_restart_args)
++#define PIO_IOC_SM_ENABLE_SYNC _IOW(PIO_IOC_MAGIC, 40, struct rp1_pio_sm_enable_sync_args)
++#define PIO_IOC_SM_PUT _IOW(PIO_IOC_MAGIC, 41, struct rp1_pio_sm_put_args)
++#define PIO_IOC_SM_GET _IOWR(PIO_IOC_MAGIC, 42, struct rp1_pio_sm_get_args)
++#define PIO_IOC_SM_SET_DMACTRL _IOW(PIO_IOC_MAGIC, 43, struct rp1_pio_sm_set_dmactrl_args)
++
++#define PIO_IOC_GPIO_INIT _IOW(PIO_IOC_MAGIC, 50, struct rp1_gpio_init_args)
++#define PIO_IOC_GPIO_SET_FUNCTION _IOW(PIO_IOC_MAGIC, 51, struct rp1_gpio_set_function_args)
++#define PIO_IOC_GPIO_SET_PULLS _IOW(PIO_IOC_MAGIC, 52, struct rp1_gpio_set_pulls_args)
++#define PIO_IOC_GPIO_SET_OUTOVER _IOW(PIO_IOC_MAGIC, 53, struct rp1_gpio_set_args)
++#define PIO_IOC_GPIO_SET_INOVER _IOW(PIO_IOC_MAGIC, 54, struct rp1_gpio_set_args)
++#define PIO_IOC_GPIO_SET_OEOVER _IOW(PIO_IOC_MAGIC, 55, struct rp1_gpio_set_args)
++#define PIO_IOC_GPIO_SET_INPUT_ENABLED _IOW(PIO_IOC_MAGIC, 56, struct rp1_gpio_set_args)
++#define PIO_IOC_GPIO_SET_DRIVE_STRENGTH _IOW(PIO_IOC_MAGIC, 57, struct rp1_gpio_set_args)
++
++#endif
diff --git a/target/linux/bcm27xx/patches-6.6/950-1386-dts-bcm2712-rpi-Add-RP1-firmware-and-mailboxes.patch b/target/linux/bcm27xx/patches-6.6/950-1386-dts-bcm2712-rpi-Add-RP1-firmware-and-mailboxes.patch
new file mode 100644
index 00000000000000..2afb809e5e9746
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1386-dts-bcm2712-rpi-Add-RP1-firmware-and-mailboxes.patch
@@ -0,0 +1,118 @@
+From 0b76dec8dfba8c1a4793dff0c86bf73d088a812e Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 1 Nov 2024 09:12:01 +0000
+Subject: [PATCH] dts: bcm2712-rpi: Add RP1 firmware and mailboxes
+
+Declare the communications channel to RP1.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ .../boot/dts/broadcom/bcm2712-rpi-5-b.dts     |  4 +--
+ .../boot/dts/broadcom/bcm2712-rpi-cm5.dtsi    |  4 +--
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi |  4 +++
+ arch/arm64/boot/dts/broadcom/rp1.dtsi         | 27 +++++++++++++++++++
+ 4 files changed, 35 insertions(+), 4 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts
+@@ -195,7 +195,7 @@ i2c_rp1boot: &_i2c3 { };
+ 	// This is the RP1 peripheral space
+ 	ranges = <0xc0 0x40000000
+ 		  0x02000000 0x00 0x00000000
+-		  0x00 0x00400000>;
++		  0x00 0x00410000>;
+ 
+ 	dma-ranges =
+ 	// inbound RP1 1x_xxxxxxxx -> PCIe 1x_xxxxxxxx
+@@ -207,7 +207,7 @@ i2c_rp1boot: &_i2c3 { };
+ 	// This allows the RP1 DMA controller to address RP1 hardware
+ 		     <0xc0 0x40000000
+ 		      0x02000000 0x0 0x00000000
+-		      0x0 0x00400000>,
++		      0x0 0x00410000>,
+ 
+ 	// inbound RP1 0x_xxxxxxxx -> PCIe 1x_xxxxxxxx
+ 		     <0x00 0x00000000
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
+@@ -176,7 +176,7 @@ i2c_rp1boot: &_i2c3 { };
+ 	// This is the RP1 peripheral space
+ 	ranges = <0xc0 0x40000000
+ 		  0x02000000 0x00 0x00000000
+-		  0x00 0x00400000>;
++		  0x00 0x00410000>;
+ 
+ 	dma-ranges =
+ 	// inbound RP1 1x_xxxxxxxx -> PCIe 1x_xxxxxxxx
+@@ -188,7 +188,7 @@ i2c_rp1boot: &_i2c3 { };
+ 	// This allows the RP1 DMA controller to address RP1 hardware
+ 		     <0xc0 0x40000000
+ 		      0x02000000 0x0 0x00000000
+-		      0x0 0x00400000>,
++		      0x0 0x00410000>,
+ 
+ 	// inbound RP1 0x_xxxxxxxx -> PCIe 1x_xxxxxxxx
+ 		     <0x00 0x00000000
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi
+@@ -294,6 +294,10 @@ pciex4: &pcie2 { };
+ 	status = "okay";
+ };
+ 
++&rp1_mbox {
++	status = "okay";
++};
++
+ /* Add some gpiomem nodes to make the devices accessible to userspace.
+  * /dev/gpiomem<n> should expose the registers for the interface with DT alias
+  * gpio<n>.
+--- a/arch/arm64/boot/dts/broadcom/rp1.dtsi
++++ b/arch/arm64/boot/dts/broadcom/rp1.dtsi
+@@ -13,6 +13,14 @@
+ 
+ 		// ranges and dma-ranges must be provided by the includer
+ 
++		rp1_mbox: mailbox@8000 {
++			compatible = "raspberrypi,rp1-mbox";
++			status = "disabled";
++			reg = <0xc0 0x40008000  0x0 0x4000>;  // SYSCFG
++			interrupts = <RP1_INT_SYSCFG IRQ_TYPE_LEVEL_HIGH>;
++			#mbox-cells = <1>;
++		};
++
+ 		rp1_clocks: clocks@18000 {
+ 			compatible = "raspberrypi,rp1-clocks";
+ 			#clock-cells = <1>;
+@@ -1183,6 +1191,19 @@
+ 			assigned-clocks        = <&rp1_clocks RP1_CLK_DPI>;
+ 			assigned-clock-parents = <&rp1_clocks RP1_PLL_VIDEO>;
+ 		};
++
++		sram: sram@400000 {
++			compatible = "mmio-sram";
++			reg = <0xc0 0x40400000  0x0 0x10000>;
++			#address-cells = <1>;
++			#size-cells = <1>;
++			ranges = <0  0xc0 0x40400000  0x10000>;
++
++			rp1_fw_shmem: shmem@ff00 {
++				compatible = "raspberrypi,rp1-shmem";
++				reg = <0xff00 0x100>; // firmware mailbox buffer
++			};
++		};
+ 	};
+ };
+ 
+@@ -1281,6 +1302,12 @@
+ };
+ 
+ / {
++	rp1_firmware: rp1_firmware {
++		compatible = "raspberrypi,rp1-firmware", "simple-mfd";
++		mboxes = <&rp1_mbox 0>;
++		shmem = <&rp1_fw_shmem>;
++	};
++
+ 	rp1_vdd_3v3: rp1_vdd_3v3 {
+ 		compatible = "regulator-fixed";
+ 		regulator-name = "vdd-3v3";
diff --git a/target/linux/bcm27xx/patches-6.6/950-1387-dts-bcm2712-rpi-Add-the-RP1-PIO-device.patch b/target/linux/bcm27xx/patches-6.6/950-1387-dts-bcm2712-rpi-Add-the-RP1-PIO-device.patch
new file mode 100644
index 00000000000000..29e54277c05531
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1387-dts-bcm2712-rpi-Add-the-RP1-PIO-device.patch
@@ -0,0 +1,55 @@
+From 3e3c1b9922b22d362a4a9133361597ac80b974bb Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 1 Nov 2024 09:13:53 +0000
+Subject: [PATCH] dts: bcm2712-rpi: Add the RP1 PIO device
+
+Declare the device that proxies RP1's PIO hardware.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi |  5 +++++
+ arch/arm64/boot/dts/broadcom/rp1.dtsi         | 12 ++++++++++++
+ 2 files changed, 17 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi.dtsi
+@@ -97,6 +97,10 @@
+ 	};
+ };
+ 
++pio: &rp1_pio {
++	status = "okay";
++};
++
+ / {
+ 	chosen: chosen {
+ 		bootargs = "reboot=w coherent_pool=1M 8250.nr_uarts=1 pci=pcie_bus_safe cgroup_disable=memory numa_policy=interleave";
+@@ -129,6 +133,7 @@
+ 		i2c12 = &i2c_rp1boot;
+ 		mailbox = &mailbox;
+ 		mmc0 = &sdio1;
++		pio0 = &pio;
+ 		serial0 = &uart0;
+ 		serial1 = &uart1;
+ 		serial10 = &uart10;
+--- a/arch/arm64/boot/dts/broadcom/rp1.dtsi
++++ b/arch/arm64/boot/dts/broadcom/rp1.dtsi
+@@ -1028,6 +1028,18 @@
+ 			status = "disabled";
+ 		};
+ 
++		rp1_pio: pio@178000 {
++			reg = <0xc0 0x40178000  0x0 0x20>;
++			compatible = "raspberrypi,rp1-pio";
++			firmware = <&rp1_firmware>;
++			dmas = <&rp1_dma RP1_DMA_PIO_CH0_TX>, <&rp1_dma RP1_DMA_PIO_CH0_RX>,
++				   <&rp1_dma RP1_DMA_PIO_CH1_TX>, <&rp1_dma RP1_DMA_PIO_CH1_RX>,
++				   <&rp1_dma RP1_DMA_PIO_CH2_TX>, <&rp1_dma RP1_DMA_PIO_CH2_RX>,
++				   <&rp1_dma RP1_DMA_PIO_CH3_TX>, <&rp1_dma RP1_DMA_PIO_CH3_RX>;
++			dma-names = "tx0", "rx0", "tx1", "rx1", "tx2", "rx2", "tx3", "rx3";
++			status = "disabled";
++		};
++
+ 		rp1_mmc0: mmc@180000 {
+ 			reg = <0xc0 0x40180000  0x0 0x100>;
+ 			compatible = "raspberrypi,rp1-dwcmshc";
diff --git a/target/linux/bcm27xx/patches-6.6/950-1388-misc-rp1-pio-Add-an-in-kernel-API.patch b/target/linux/bcm27xx/patches-6.6/950-1388-misc-rp1-pio-Add-an-in-kernel-API.patch
new file mode 100644
index 00000000000000..6accaf000eb503
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1388-misc-rp1-pio-Add-an-in-kernel-API.patch
@@ -0,0 +1,1797 @@
+From 2819a61eb000c207589c97eef9d69a237c6cfdf3 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 8 Nov 2024 09:31:38 +0000
+Subject: [PATCH] misc: rp1-pio: Add an in-kernel API
+
+The header file linux/pio_rp1.h adds a pico-sdk-like interface to the
+RP1 PIO subsystem for other drivers.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/rp1-pio.c           | 169 ++++--
+ include/linux/pio_instructions.h | 481 +++++++++++++++++
+ include/linux/pio_rp1.h          | 873 +++++++++++++++++++++++++++++++
+ 3 files changed, 1474 insertions(+), 49 deletions(-)
+ create mode 100644 include/linux/pio_instructions.h
+ create mode 100644 include/linux/pio_rp1.h
+
+--- a/drivers/misc/rp1-pio.c
++++ b/drivers/misc/rp1-pio.c
+@@ -1,15 +1,17 @@
+ // SPDX-License-Identifier: GPL-2.0
+-// PIO driver for RP1
+-//
+-//  Copyright (C) 2023-2024 Raspberry Pi Ltd.
+-//
+-// Parts of this driver are based on:
+-//  - vcio.c, by Noralf Trønnes
+-//    Copyright (C) 2010 Broadcom
+-//    Copyright (C) 2015 Noralf Trønnes
+-//    Copyright (C) 2021 Raspberry Pi (Trading) Ltd.
+-//  - bcm2835_smi.c & bcm2835_smi_dev.c by Luke Wren
+-//    Copyright (c) 2015 Raspberry Pi (Trading) Ltd.
++/*
++ * PIO driver for RP1
++ *
++ * Copyright (C) 2023-2024 Raspberry Pi Ltd.
++ *
++ * Parts of this driver are based on:
++ *  - vcio.c, by Noralf Trønnes
++ *    Copyright (C) 2010 Broadcom
++ *    Copyright (C) 2015 Noralf Trønnes
++ *    Copyright (C) 2021 Raspberry Pi (Trading) Ltd.
++ *  - bcm2835_smi.c & bcm2835_smi_dev.c by Luke Wren
++ *    Copyright (c) 2015 Raspberry Pi (Trading) Ltd.
++ */
+ 
+ #include <linux/cdev.h>
+ #include <linux/compat.h>
+@@ -97,6 +99,7 @@ struct rp1_pio_client {
+ 	uint32_t claimed_sms;
+ 	uint32_t claimed_instrs;
+ 	uint32_t claimed_dmas;
++	int error;
+ };
+ 
+ static struct rp1_pio_device *g_pio;
+@@ -195,7 +198,7 @@ static int rp1_pio_find_program(struct r
+ 	return -1;
+ }
+ 
+-static int rp1_pio_can_add_program(struct rp1_pio_client *client, void *param)
++int rp1_pio_can_add_program(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_add_program_args *args = param;
+ 	struct rp1_pio_device *pio = client->pio;
+@@ -217,8 +220,9 @@ static int rp1_pio_can_add_program(struc
+ 	return rp1_pio_message(pio, PIO_CAN_ADD_PROGRAM, args,
+ 			       offsetof(struct rp1_pio_add_program_args, instrs));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_can_add_program);
+ 
+-static int rp1_pio_add_program(struct rp1_pio_client *client, void *param)
++int rp1_pio_add_program(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_add_program_args *args = param;
+ 	struct rp1_pio_device *pio = client->pio;
+@@ -254,6 +258,7 @@ static int rp1_pio_add_program(struct rp
+ 	mutex_unlock(&pio->instr_mutex);
+ 	return offset;
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_add_program);
+ 
+ static void rp1_pio_remove_instrs(struct rp1_pio_device *pio, uint32_t mask)
+ {
+@@ -277,7 +282,7 @@ static void rp1_pio_remove_instrs(struct
+ 	mutex_unlock(&pio->instr_mutex);
+ }
+ 
+-static int rp1_pio_remove_program(struct rp1_pio_client *client, void *param)
++int rp1_pio_remove_program(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_remove_program_args *args = param;
+ 	uint32_t used_mask;
+@@ -296,8 +301,9 @@ static int rp1_pio_remove_program(struct
+ 	}
+ 	return ret;
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_remove_program);
+ 
+-static int rp1_pio_clear_instr_mem(struct rp1_pio_client *client, void *param)
++int rp1_pio_clear_instr_mem(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_device *pio = client->pio;
+ 
+@@ -309,8 +315,9 @@ static int rp1_pio_clear_instr_mem(struc
+ 	mutex_unlock(&pio->instr_mutex);
+ 	return 0;
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_clear_instr_mem);
+ 
+-static int rp1_pio_sm_claim(struct rp1_pio_client *client, void *param)
++int rp1_pio_sm_claim(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_claim_args *args = param;
+ 	struct rp1_pio_device *pio = client->pio;
+@@ -328,8 +335,9 @@ static int rp1_pio_sm_claim(struct rp1_p
+ 	mutex_unlock(&pio->instr_mutex);
+ 	return ret;
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_sm_claim);
+ 
+-static int rp1_pio_sm_unclaim(struct rp1_pio_client *client, void *param)
++int rp1_pio_sm_unclaim(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_claim_args *args = param;
+ 	struct rp1_pio_device *pio = client->pio;
+@@ -341,99 +349,113 @@ static int rp1_pio_sm_unclaim(struct rp1
+ 	mutex_unlock(&pio->instr_mutex);
+ 	return 0;
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_sm_unclaim);
+ 
+-static int rp1_pio_sm_is_claimed(struct rp1_pio_client *client, void *param)
++int rp1_pio_sm_is_claimed(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_claim_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, PIO_SM_IS_CLAIMED, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_sm_is_claimed);
+ 
+-static int rp1_pio_sm_init(struct rp1_pio_client *client, void *param)
++int rp1_pio_sm_init(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_init_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, PIO_SM_INIT, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_sm_init);
+ 
+-static int rp1_pio_sm_set_config(struct rp1_pio_client *client, void *param)
++int rp1_pio_sm_set_config(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_set_config_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, PIO_SM_SET_CONFIG, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_sm_set_config);
+ 
+-static int rp1_pio_sm_exec(struct rp1_pio_client *client, void *param)
++int rp1_pio_sm_exec(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_exec_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, PIO_SM_EXEC, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_sm_exec);
+ 
+-static int rp1_pio_sm_clear_fifos(struct rp1_pio_client *client, void *param)
++int rp1_pio_sm_clear_fifos(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_clear_fifos_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, PIO_SM_CLEAR_FIFOS, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_sm_clear_fifos);
+ 
+-static int rp1_pio_sm_set_clkdiv(struct rp1_pio_client *client, void *param)
++int rp1_pio_sm_set_clkdiv(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_set_clkdiv_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, PIO_SM_SET_CLKDIV, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_sm_set_clkdiv);
+ 
+-static int rp1_pio_sm_set_pins(struct rp1_pio_client *client, void *param)
++int rp1_pio_sm_set_pins(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_set_pins_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, PIO_SM_SET_PINS, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_sm_set_pins);
+ 
+-static int rp1_pio_sm_set_pindirs(struct rp1_pio_client *client, void *param)
++int rp1_pio_sm_set_pindirs(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_set_pindirs_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, PIO_SM_SET_PINDIRS, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_sm_set_pindirs);
+ 
+-static int rp1_pio_sm_set_enabled(struct rp1_pio_client *client, void *param)
++int rp1_pio_sm_set_enabled(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_set_enabled_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, PIO_SM_SET_ENABLED, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_sm_set_enabled);
+ 
+-static int rp1_pio_sm_restart(struct rp1_pio_client *client, void *param)
++int rp1_pio_sm_restart(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_restart_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, PIO_SM_RESTART, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_sm_restart);
+ 
+-static int rp1_pio_sm_clkdiv_restart(struct rp1_pio_client *client, void *param)
++int rp1_pio_sm_clkdiv_restart(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_restart_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, PIO_SM_CLKDIV_RESTART, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_sm_clkdiv_restart);
+ 
+-static int rp1_pio_sm_enable_sync(struct rp1_pio_client *client, void *param)
++int rp1_pio_sm_enable_sync(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_enable_sync_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, PIO_SM_ENABLE_SYNC, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_sm_enable_sync);
+ 
+-static int rp1_pio_sm_put(struct rp1_pio_client *client, void *param)
++int rp1_pio_sm_put(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_put_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, PIO_SM_PUT, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_sm_put);
+ 
+-static int rp1_pio_sm_get(struct rp1_pio_client *client, void *param)
++int rp1_pio_sm_get(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_get_args *args = param;
+ 	int ret;
+@@ -444,69 +466,79 @@ static int rp1_pio_sm_get(struct rp1_pio
+ 		return offsetof(struct rp1_pio_sm_get_args, data) + ret;
+ 	return ret;
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_sm_get);
+ 
+-static int rp1_pio_sm_set_dmactrl(struct rp1_pio_client *client, void *param)
++int rp1_pio_sm_set_dmactrl(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_set_dmactrl_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, PIO_SM_SET_DMACTRL, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_sm_set_dmactrl);
+ 
+-static int rp1_pio_gpio_init(struct rp1_pio_client *client, void *param)
++int rp1_pio_gpio_init(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_gpio_init_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, GPIO_INIT, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_gpio_init);
+ 
+-static int rp1_pio_gpio_set_function(struct rp1_pio_client *client, void *param)
++int rp1_pio_gpio_set_function(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_gpio_set_function_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, GPIO_SET_FUNCTION, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_gpio_set_function);
+ 
+-static int rp1_pio_gpio_set_pulls(struct rp1_pio_client *client, void *param)
++int rp1_pio_gpio_set_pulls(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_gpio_set_pulls_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, GPIO_SET_PULLS, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_gpio_set_pulls);
+ 
+-static int rp1_pio_gpio_set_outover(struct rp1_pio_client *client, void *param)
++int rp1_pio_gpio_set_outover(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_gpio_set_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, GPIO_SET_OUTOVER, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_gpio_set_outover);
+ 
+-static int rp1_pio_gpio_set_inover(struct rp1_pio_client *client, void *param)
++int rp1_pio_gpio_set_inover(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_gpio_set_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, GPIO_SET_INOVER, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_gpio_set_inover);
+ 
+-static int rp1_pio_gpio_set_oeover(struct rp1_pio_client *client, void *param)
++int rp1_pio_gpio_set_oeover(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_gpio_set_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, GPIO_SET_OEOVER, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_gpio_set_oeover);
+ 
+-static int rp1_pio_gpio_set_input_enabled(struct rp1_pio_client *client, void *param)
++int rp1_pio_gpio_set_input_enabled(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_gpio_set_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, GPIO_SET_INPUT_ENABLED, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_gpio_set_input_enabled);
+ 
+-static int rp1_pio_gpio_set_drive_strength(struct rp1_pio_client *client, void *param)
++int rp1_pio_gpio_set_drive_strength(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_gpio_set_args *args = param;
+ 
+ 	return rp1_pio_message(client->pio, GPIO_SET_DRIVE_STRENGTH, args, sizeof(*args));
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_gpio_set_drive_strength);
+ 
+ static void rp1_pio_sm_dma_callback(void *param)
+ {
+@@ -633,7 +665,7 @@ static int rp1_pio_sm_tx_user(struct rp1
+ 	struct device *dev = &pdev->dev;
+ 	int ret = 0;
+ 
+-	// Clean the slate - we're running synchronously
++	/* Clean the slate - we're running synchronously */
+ 	dma->head_idx = 0;
+ 	dma->tail_idx = 0;
+ 
+@@ -686,7 +718,7 @@ static int rp1_pio_sm_tx_user(struct rp1
+ 		bytes -= copy_bytes;
+ 	}
+ 
+-	// Block for completion
++	/* Block for completion */
+ 	while (dma->tail_idx != dma->head_idx) {
+ 		if (down_timeout(&dma->buf_sem, msecs_to_jiffies(1000))) {
+ 			dev_err(dev, "DMA wait timed out\n");
+@@ -830,22 +862,22 @@ struct handler_info {
+ 	HANDLER(WRITE_HW, write_hw),
+ };
+ 
+-static int rp1_pio_open(struct inode *inode, struct file *filp)
++struct rp1_pio_client *pio_open(void)
+ {
+-	struct rp1_pio_device *pio = g_pio;
+ 	struct rp1_pio_client *client;
+ 
+ 	client = kzalloc(sizeof(*client), GFP_KERNEL);
++	if (!client)
++		return ERR_PTR(-ENOMEM);
+ 
+-	client->pio = pio;
+-	filp->private_data = client;
++	client->pio = g_pio;
+ 
+-	return 0;
++	return client;
+ }
++EXPORT_SYMBOL_GPL(pio_open);
+ 
+-static int rp1_pio_release(struct inode *inode, struct file *filp)
++void pio_close(struct rp1_pio_client *client)
+ {
+-	struct rp1_pio_client *client = filp->private_data;
+ 	struct rp1_pio_device *pio = client->pio;
+ 	uint claimed_dmas = client->claimed_dmas;
+ 	int i;
+@@ -885,6 +917,45 @@ static int rp1_pio_release(struct inode
+ 	/* Reinitialise the SM? */
+ 
+ 	kfree(client);
++}
++EXPORT_SYMBOL_GPL(pio_close);
++
++void pio_set_error(struct rp1_pio_client *client, int err)
++{
++	client->error = err;
++}
++EXPORT_SYMBOL_GPL(pio_set_error);
++
++int pio_get_error(const struct rp1_pio_client *client)
++{
++	return client->error;
++}
++EXPORT_SYMBOL_GPL(pio_get_error);
++
++void pio_clear_error(struct rp1_pio_client *client)
++{
++	client->error = 0;
++}
++EXPORT_SYMBOL_GPL(pio_clear_error);
++
++static int rp1_pio_open(struct inode *inode, struct file *filp)
++{
++	struct rp1_pio_client *client;
++
++	client = pio_open();
++	if (IS_ERR(client))
++		return PTR_ERR(client);
++
++	filp->private_data = client;
++
++	return 0;
++}
++
++static int rp1_pio_release(struct inode *inode, struct file *filp)
++{
++	struct rp1_pio_client *client = filp->private_data;
++
++	pio_close(client);
+ 
+ 	return 0;
+ }
+--- /dev/null
++++ b/include/linux/pio_instructions.h
+@@ -0,0 +1,481 @@
++/* SPDX-License-Identifier: BSD-3-Clause */
++/*
++ * Copyright (c) 2020 Raspberry Pi (Trading) Ltd.
++ */
++
++#ifndef _HARDWARE_PIO_INSTRUCTIONS_H
++#define _HARDWARE_PIO_INSTRUCTIONS_H
++
++/** \brief PIO instruction encoding
++ *  \defgroup pio_instructions pio_instructions
++ *  \ingroup hardware_pio
++ *
++ * Functions for generating PIO instruction encodings programmatically. In debug builds
++ *`PARAM_ASSERTIONS_ENABLED_PIO_INSTRUCTIONS` can be set to 1 to enable validation of encoding function
++ * parameters.
++ *
++ * For fuller descriptions of the instructions in question see the "RP2040 Datasheet"
++ */
++
++// PICO_CONFIG: PARAM_ASSERTIONS_ENABLED_PIO_INSTRUCTIONS, Enable/disable assertions in the PIO instructions, type=bool, default=0, group=pio_instructions
++#ifndef PARAM_ASSERTIONS_ENABLED_PIO_INSTRUCTIONS
++#define PARAM_ASSERTIONS_ENABLED_PIO_INSTRUCTIONS 0
++#endif
++
++#ifdef __cplusplus
++extern "C" {
++#endif
++
++enum pio_instr_bits {
++    pio_instr_bits_jmp = 0x0000,
++    pio_instr_bits_wait = 0x2000,
++    pio_instr_bits_in = 0x4000,
++    pio_instr_bits_out = 0x6000,
++    pio_instr_bits_push = 0x8000,
++    pio_instr_bits_pull = 0x8080,
++    pio_instr_bits_mov = 0xa000,
++    pio_instr_bits_irq = 0xc000,
++    pio_instr_bits_set = 0xe000,
++};
++
++#ifndef NDEBUG
++#define _PIO_INVALID_IN_SRC    0x08u
++#define _PIO_INVALID_OUT_DEST 0x10u
++#define _PIO_INVALID_SET_DEST 0x20u
++#define _PIO_INVALID_MOV_SRC  0x40u
++#define _PIO_INVALID_MOV_DEST 0x80u
++#else
++#define _PIO_INVALID_IN_SRC    0u
++#define _PIO_INVALID_OUT_DEST 0u
++#define _PIO_INVALID_SET_DEST 0u
++#define _PIO_INVALID_MOV_SRC  0u
++#define _PIO_INVALID_MOV_DEST 0u
++#endif
++
++/*! \brief Enumeration of values to pass for source/destination args for instruction encoding functions
++ *  \ingroup pio_instructions
++ *
++ * \note Not all values are suitable for all functions. Validity is only checked in debug mode when
++ * `PARAM_ASSERTIONS_ENABLED_PIO_INSTRUCTIONS` is 1
++ */
++enum pio_src_dest {
++    pio_pins = 0u,
++    pio_x = 1u,
++    pio_y = 2u,
++    pio_null = 3u | _PIO_INVALID_SET_DEST | _PIO_INVALID_MOV_DEST,
++    pio_pindirs = 4u | _PIO_INVALID_IN_SRC | _PIO_INVALID_MOV_SRC | _PIO_INVALID_MOV_DEST,
++    pio_exec_mov = 4u | _PIO_INVALID_IN_SRC | _PIO_INVALID_OUT_DEST | _PIO_INVALID_SET_DEST | _PIO_INVALID_MOV_SRC,
++    pio_status = 5u | _PIO_INVALID_IN_SRC | _PIO_INVALID_OUT_DEST | _PIO_INVALID_SET_DEST | _PIO_INVALID_MOV_DEST,
++    pio_pc = 5u | _PIO_INVALID_IN_SRC | _PIO_INVALID_SET_DEST | _PIO_INVALID_MOV_SRC,
++    pio_isr = 6u | _PIO_INVALID_SET_DEST,
++    pio_osr = 7u | _PIO_INVALID_OUT_DEST | _PIO_INVALID_SET_DEST,
++    pio_exec_out = 7u | _PIO_INVALID_IN_SRC | _PIO_INVALID_SET_DEST | _PIO_INVALID_MOV_SRC | _PIO_INVALID_MOV_DEST,
++};
++
++static inline uint _pio_major_instr_bits(uint instr) {
++    return instr & 0xe000u;
++}
++
++static inline uint _pio_encode_instr_and_args(enum pio_instr_bits instr_bits, uint arg1, uint arg2) {
++    valid_params_if(PIO_INSTRUCTIONS, arg1 <= 0x7);
++#if PARAM_ASSERTIONS_ENABLED(PIO_INSTRUCTIONS)
++    uint32_t major = _pio_major_instr_bits(instr_bits);
++    if (major == pio_instr_bits_in || major == pio_instr_bits_out) {
++        assert(arg2 && arg2 <= 32);
++    } else {
++        assert(arg2 <= 31);
++    }
++#endif
++    return instr_bits | (arg1 << 5u) | (arg2 & 0x1fu);
++}
++
++static inline uint _pio_encode_instr_and_src_dest(enum pio_instr_bits instr_bits, enum pio_src_dest dest, uint value) {
++    return _pio_encode_instr_and_args(instr_bits, dest & 7u, value);
++}
++
++/*! \brief Encode just the delay slot bits of an instruction
++ *  \ingroup pio_instructions
++ *
++ * \note This function does not return a valid instruction encoding; instead it returns an encoding of the delay
++ * slot suitable for `OR`ing with the result of an encoding function for an actual instruction. Care should be taken when
++ * combining the results of this function with the results of \ref pio_encode_sideset and \ref pio_encode_sideset_opt
++ * as they share the same bits within the instruction encoding.
++ *
++ * \param cycles the number of cycles 0-31 (or less if side set is being used)
++ * \return the delay slot bits to be ORed with an instruction encoding
++ */
++static inline uint pio_encode_delay(uint cycles) {
++    // note that the maximum cycles will be smaller if sideset_bit_count > 0
++    valid_params_if(PIO_INSTRUCTIONS, cycles <= 0x1f);
++    return cycles << 8u;
++}
++
++/*! \brief Encode just the side set bits of an instruction (in non optional side set mode)
++ *  \ingroup pio_instructions
++ *
++ * \note This function does not return a valid instruction encoding; instead it returns an encoding of the side set bits
++ * suitable for `OR`ing with the result of an encoding function for an actual instruction. Care should be taken when
++ * combining the results of this function with the results of \ref pio_encode_delay as they share the same bits
++ * within the instruction encoding.
++ *
++ * \param sideset_bit_count number of side set bits as would be specified via `.sideset` in pioasm
++ * \param value the value to sideset on the pins
++ * \return the side set bits to be ORed with an instruction encoding
++ */
++static inline uint pio_encode_sideset(uint sideset_bit_count, uint value) {
++    valid_params_if(PIO_INSTRUCTIONS, sideset_bit_count >= 1 && sideset_bit_count <= 5);
++    valid_params_if(PIO_INSTRUCTIONS, value <= ((1u << sideset_bit_count) - 1));
++    return value << (13u - sideset_bit_count);
++}
++
++/*! \brief Encode just the side set bits of an instruction (in optional -`opt` side set mode)
++ *  \ingroup pio_instructions
++ *
++ * \note This function does not return a valid instruction encoding; instead it returns an encoding of the side set bits
++ * suitable for `OR`ing with the result of an encoding function for an actual instruction. Care should be taken when
++ * combining the results of this function with the results of \ref pio_encode_delay as they share the same bits
++ * within the instruction encoding.
++ *
++ * \param sideset_bit_count number of side set bits as would be specified via `.sideset <n> opt` in pioasm
++ * \param value the value to sideset on the pins
++ * \return the side set bits to be ORed with an instruction encoding
++ */
++static inline uint pio_encode_sideset_opt(uint sideset_bit_count, uint value) {
++    valid_params_if(PIO_INSTRUCTIONS, sideset_bit_count >= 1 && sideset_bit_count <= 4);
++    valid_params_if(PIO_INSTRUCTIONS, value <= ((1u << sideset_bit_count) - 1));
++    return 0x1000u | value << (12u - sideset_bit_count);
++}
++
++/*! \brief Encode an unconditional JMP instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `JMP <addr>`
++ *
++ * \param addr The target address 0-31 (an absolute address within the PIO instruction memory)
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_jmp(uint addr) {
++    return _pio_encode_instr_and_args(pio_instr_bits_jmp, 0, addr);
++}
++
++/*! \brief Encode a conditional JMP if scratch X zero instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `JMP !X <addr>`
++ *
++ * \param addr The target address 0-31 (an absolute address within the PIO instruction memory)
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_jmp_not_x(uint addr) {
++    return _pio_encode_instr_and_args(pio_instr_bits_jmp, 1, addr);
++}
++
++/*! \brief Encode a conditional JMP if scratch X non-zero (and post-decrement X) instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `JMP X-- <addr>`
++ *
++ * \param addr The target address 0-31 (an absolute address within the PIO instruction memory)
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_jmp_x_dec(uint addr) {
++    return _pio_encode_instr_and_args(pio_instr_bits_jmp, 2, addr);
++}
++
++/*! \brief Encode a conditional JMP if scratch Y zero instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `JMP !Y <addr>`
++ *
++ * \param addr The target address 0-31 (an absolute address within the PIO instruction memory)
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_jmp_not_y(uint addr) {
++    return _pio_encode_instr_and_args(pio_instr_bits_jmp, 3, addr);
++}
++
++/*! \brief Encode a conditional JMP if scratch Y non-zero (and post-decrement Y) instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `JMP Y-- <addr>`
++ *
++ * \param addr The target address 0-31 (an absolute address within the PIO instruction memory)
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_jmp_y_dec(uint addr) {
++    return _pio_encode_instr_and_args(pio_instr_bits_jmp, 4, addr);
++}
++
++/*! \brief Encode a conditional JMP if scratch X not equal scratch Y instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `JMP X!=Y <addr>`
++ *
++ * \param addr The target address 0-31 (an absolute address within the PIO instruction memory)
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_jmp_x_ne_y(uint addr) {
++    return _pio_encode_instr_and_args(pio_instr_bits_jmp, 5, addr);
++}
++
++/*! \brief Encode a conditional JMP if input pin high instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `JMP PIN <addr>`
++ *
++ * \param addr The target address 0-31 (an absolute address within the PIO instruction memory)
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_jmp_pin(uint addr) {
++    return _pio_encode_instr_and_args(pio_instr_bits_jmp, 6, addr);
++}
++
++/*! \brief Encode a conditional JMP if output shift register not empty instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `JMP !OSRE <addr>`
++ *
++ * \param addr The target address 0-31 (an absolute address within the PIO instruction memory)
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_jmp_not_osre(uint addr) {
++    return _pio_encode_instr_and_args(pio_instr_bits_jmp, 7, addr);
++}
++
++static inline uint _pio_encode_irq(bool relative, uint irq) {
++    valid_params_if(PIO_INSTRUCTIONS, irq <= 7);
++    return (relative ? 0x10u : 0x0u) | irq;
++}
++
++/*! \brief Encode a WAIT for GPIO pin instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `WAIT <polarity> GPIO <gpio>`
++ *
++ * \param polarity true for `WAIT 1`, false for `WAIT 0`
++ * \param gpio The real GPIO number 0-31
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_wait_gpio(bool polarity, uint gpio) {
++    return _pio_encode_instr_and_args(pio_instr_bits_wait, 0u | (polarity ? 4u : 0u), gpio);
++}
++
++/*! \brief Encode a WAIT for pin instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `WAIT <polarity> PIN <pin>`
++ *
++ * \param polarity true for `WAIT 1`, false for `WAIT 0`
++ * \param pin The pin number 0-31 relative to the executing SM's input pin mapping
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_wait_pin(bool polarity, uint pin) {
++    return _pio_encode_instr_and_args(pio_instr_bits_wait, 1u | (polarity ? 4u : 0u), pin);
++}
++
++/*! \brief Encode a WAIT for IRQ instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `WAIT <polarity> IRQ <irq> <relative>`
++ *
++ * \param polarity true for `WAIT 1`, false for `WAIT 0`
++ * \param relative true for a `WAIT IRQ <irq> REL`, false for regular `WAIT IRQ <irq>`
++ * \param irq the irq number 0-7
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_wait_irq(bool polarity, bool relative, uint irq) {
++    valid_params_if(PIO_INSTRUCTIONS, irq <= 7);
++    return _pio_encode_instr_and_args(pio_instr_bits_wait, 2u | (polarity ? 4u : 0u), _pio_encode_irq(relative, irq));
++}
++
++/*! \brief Encode an IN instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `IN <src>, <count>`
++ *
++ * \param src The source to take data from
++ * \param count The number of bits 1-32
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_in(enum pio_src_dest src, uint count) {
++    valid_params_if(PIO_INSTRUCTIONS, !(src & _PIO_INVALID_IN_SRC));
++    return _pio_encode_instr_and_src_dest(pio_instr_bits_in, src, count);
++}
++
++/*! \brief Encode an OUT instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `OUT <src>, <count>`
++ *
++ * \param dest The destination to write data to
++ * \param count The number of bits 1-32
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_out(enum pio_src_dest dest, uint count) {
++    valid_params_if(PIO_INSTRUCTIONS, !(dest & _PIO_INVALID_OUT_DEST));
++    return _pio_encode_instr_and_src_dest(pio_instr_bits_out, dest, count);
++}
++
++/*! \brief Encode a PUSH instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `PUSH <if_full>, <block>`
++ *
++ * \param if_full true for `PUSH IF_FULL ...`, false for `PUSH ...`
++ * \param block true for `PUSH ... BLOCK`, false for `PUSH ...`
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_push(bool if_full, bool block) {
++    return _pio_encode_instr_and_args(pio_instr_bits_push, (if_full ? 2u : 0u) | (block ? 1u : 0u), 0);
++}
++
++/*! \brief Encode a PULL instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `PULL <if_empty>, <block>`
++ *
++ * \param if_empty true for `PULL IF_EMPTY ...`, false for `PULL ...`
++ * \param block true for `PULL ... BLOCK`, false for `PULL ...`
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_pull(bool if_empty, bool block) {
++    return _pio_encode_instr_and_args(pio_instr_bits_pull, (if_empty ? 2u : 0u) | (block ? 1u : 0u), 0);
++}
++
++/*! \brief Encode a MOV instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `MOV <dest>, <src>`
++ *
++ * \param dest The destination to write data to
++ * \param src The source to take data from
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_mov(enum pio_src_dest dest, enum pio_src_dest src) {
++    valid_params_if(PIO_INSTRUCTIONS, !(dest & _PIO_INVALID_MOV_DEST));
++    valid_params_if(PIO_INSTRUCTIONS, !(src & _PIO_INVALID_MOV_SRC));
++    return _pio_encode_instr_and_src_dest(pio_instr_bits_mov, dest, src & 7u);
++}
++
++/*! \brief Encode a MOV instruction with bit invert
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `MOV <dest>, ~<src>`
++ *
++ * \param dest The destination to write inverted data to
++ * \param src The source to take data from
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_mov_not(enum pio_src_dest dest, enum pio_src_dest src) {
++    valid_params_if(PIO_INSTRUCTIONS, !(dest & _PIO_INVALID_MOV_DEST));
++    valid_params_if(PIO_INSTRUCTIONS, !(src & _PIO_INVALID_MOV_SRC));
++    return _pio_encode_instr_and_src_dest(pio_instr_bits_mov, dest, (1u << 3u) | (src & 7u));
++}
++
++/*! \brief Encode a MOV instruction with bit reverse
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `MOV <dest>, ::<src>`
++ *
++ * \param dest The destination to write bit reversed data to
++ * \param src The source to take data from
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_mov_reverse(enum pio_src_dest dest, enum pio_src_dest src) {
++    valid_params_if(PIO_INSTRUCTIONS, !(dest & _PIO_INVALID_MOV_DEST));
++    valid_params_if(PIO_INSTRUCTIONS, !(src & _PIO_INVALID_MOV_SRC));
++    return _pio_encode_instr_and_src_dest(pio_instr_bits_mov, dest, (2u << 3u) | (src & 7u));
++}
++
++/*! \brief Encode a IRQ SET instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `IRQ SET <irq> <relative>`
++ *
++ * \param relative true for a `IRQ SET <irq> REL`, false for regular `IRQ SET <irq>`
++ * \param irq the irq number 0-7
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_irq_set(bool relative, uint irq) {
++    return _pio_encode_instr_and_args(pio_instr_bits_irq, 0, _pio_encode_irq(relative, irq));
++}
++
++/*! \brief Encode a IRQ WAIT instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `IRQ WAIT <irq> <relative>`
++ *
++ * \param relative true for a `IRQ WAIT <irq> REL`, false for regular `IRQ WAIT <irq>`
++ * \param irq the irq number 0-7
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_irq_wait(bool relative, uint irq) {
++    return _pio_encode_instr_and_args(pio_instr_bits_irq, 1, _pio_encode_irq(relative, irq));
++}
++
++/*! \brief Encode a IRQ CLEAR instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `IRQ CLEAR <irq> <relative>`
++ *
++ * \param relative true for a `IRQ CLEAR <irq> REL`, false for regular `IRQ CLEAR <irq>`
++ * \param irq the irq number 0-7
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_irq_clear(bool relative, uint irq) {
++    return _pio_encode_instr_and_args(pio_instr_bits_irq, 2, _pio_encode_irq(relative, irq));
++}
++
++/*! \brief Encode a SET instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `SET <dest>, <value>`
++ *
++ * \param dest The destination to apply the value to
++ * \param value The value 0-31
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_set(enum pio_src_dest dest, uint value) {
++    valid_params_if(PIO_INSTRUCTIONS, !(dest & _PIO_INVALID_SET_DEST));
++    return _pio_encode_instr_and_src_dest(pio_instr_bits_set, dest, value);
++}
++
++/*! \brief Encode a NOP instruction
++ *  \ingroup pio_instructions
++ *
++ * This is the equivalent of `NOP` which is itself encoded as `MOV y, y`
++ *
++ * \return The instruction encoding with 0 delay and no side set value
++ * \see pio_encode_delay, pio_encode_sideset, pio_encode_sideset_opt
++ */
++static inline uint pio_encode_nop(void) {
++    return pio_encode_mov(pio_y, pio_y);
++}
++
++#ifdef __cplusplus
++}
++#endif
++
++#endif
+--- /dev/null
++++ b/include/linux/pio_rp1.h
+@@ -0,0 +1,873 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * Copyright (c) 2024 Raspberry Pi Ltd.
++ * All rights reserved.
++ */
++
++#ifndef _PIO_RP1_H
++#define _PIO_RP1_H
++
++#include <uapi/misc/rp1_pio_if.h>
++
++#define PARAM_WARNINGS_ENABLED 1
++
++#ifdef DEBUG
++#define PARAM_WARNINGS_ENABLED 1
++#endif
++
++#ifndef PARAM_WARNINGS_ENABLED
++#define PARAM_WARNINGS_ENABLED 0
++#endif
++
++#define bad_params_if(client, test) \
++	({ bool f = (test); if (f) pio_set_error(client, -EINVAL); \
++		if (f && PARAM_WARNINGS_ENABLED) WARN_ON((test)); \
++		f; })
++
++#ifndef PARAM_ASSERTIONS_ENABLE_ALL
++#define PARAM_ASSERTIONS_ENABLE_ALL 0
++#endif
++
++#ifndef PARAM_ASSERTIONS_DISABLE_ALL
++#define PARAM_ASSERTIONS_DISABLE_ALL 0
++#endif
++
++#define PARAM_ASSERTIONS_ENABLED(x) \
++	((PARAM_ASSERTIONS_ENABLED_ ## x || PARAM_ASSERTIONS_ENABLE_ALL) && \
++	 !PARAM_ASSERTIONS_DISABLE_ALL)
++#define valid_params_if(x, test) ({if (PARAM_ASSERTIONS_ENABLED(x)) WARN_ON(test); })
++
++#include <linux/pio_instructions.h>
++
++#define NUM_PIO_STATE_MACHINES		4
++#define PIO_INSTRUCTION_COUNT		32
++#define PIO_ORIGIN_ANY			((uint)(~0))
++#define GPIOS_MASK			((1 << RP1_PIO_GPIO_COUNT) - 1)
++
++#define PICO_NO_HARDWARE		0
++
++#define pio0				pio_open_helper(0)
++
++#define PROC_PIO_SM0_PINCTRL_OUT_BASE_BITS	0x0000001f
++#define PROC_PIO_SM0_PINCTRL_OUT_BASE_LSB	0
++#define PROC_PIO_SM0_PINCTRL_OUT_COUNT_BITS	0x03f00000
++#define PROC_PIO_SM0_PINCTRL_OUT_COUNT_LSB	20
++#define PROC_PIO_SM0_PINCTRL_SET_BASE_BITS	0x000003e0
++#define PROC_PIO_SM0_PINCTRL_SET_BASE_LSB	5
++#define PROC_PIO_SM0_PINCTRL_SET_COUNT_BITS	0x1c000000
++#define PROC_PIO_SM0_PINCTRL_SET_COUNT_LSB	26
++#define PROC_PIO_SM0_PINCTRL_IN_BASE_BITS	0x000f8000
++#define PROC_PIO_SM0_PINCTRL_IN_BASE_LSB	15
++#define PROC_PIO_SM0_PINCTRL_SIDESET_BASE_BITS	0x00007c00
++#define PROC_PIO_SM0_PINCTRL_SIDESET_BASE_LSB	10
++#define PROC_PIO_SM0_PINCTRL_SIDESET_COUNT_BITS	0xe0000000
++#define PROC_PIO_SM0_PINCTRL_SIDESET_COUNT_LSB	29
++#define PROC_PIO_SM0_EXECCTRL_SIDE_EN_BITS	0x40000000
++#define PROC_PIO_SM0_EXECCTRL_SIDE_EN_LSB	30
++#define PROC_PIO_SM0_EXECCTRL_SIDE_PINDIR_BITS	0x20000000
++#define PROC_PIO_SM0_EXECCTRL_SIDE_PINDIR_LSB	29
++#define PROC_PIO_SM0_CLKDIV_INT_LSB		16
++#define PROC_PIO_SM0_CLKDIV_FRAC_LSB		8
++#define PROC_PIO_SM0_EXECCTRL_WRAP_TOP_BITS	0x0001f000
++#define PROC_PIO_SM0_EXECCTRL_WRAP_TOP_LSB	12
++#define PROC_PIO_SM0_EXECCTRL_WRAP_BOTTOM_BITS	0x00000f80
++#define PROC_PIO_SM0_EXECCTRL_WRAP_BOTTOM_LSB	7
++#define PROC_PIO_SM0_EXECCTRL_JMP_PIN_BITS	0x1f000000
++#define PROC_PIO_SM0_EXECCTRL_JMP_PIN_LSB	24
++#define PROC_PIO_SM0_SHIFTCTRL_IN_SHIFTDIR_BITS	0x00040000
++#define PROC_PIO_SM0_SHIFTCTRL_IN_SHIFTDIR_LSB	18
++#define PROC_PIO_SM0_SHIFTCTRL_AUTOPULL_BITS	0x00020000
++#define PROC_PIO_SM0_SHIFTCTRL_AUTOPULL_LSB	17
++#define PROC_PIO_SM0_SHIFTCTRL_AUTOPUSH_BITS	0x00010000
++#define PROC_PIO_SM0_SHIFTCTRL_AUTOPUSH_LSB	16
++#define PROC_PIO_SM0_SHIFTCTRL_PUSH_THRESH_BITS	0x01f00000
++#define PROC_PIO_SM0_SHIFTCTRL_PUSH_THRESH_LSB	20
++#define PROC_PIO_SM0_SHIFTCTRL_OUT_SHIFTDIR_BITS	0x00080000
++#define PROC_PIO_SM0_SHIFTCTRL_OUT_SHIFTDIR_LSB	19
++#define PROC_PIO_SM0_SHIFTCTRL_PULL_THRESH_BITS	0x3e000000
++#define PROC_PIO_SM0_SHIFTCTRL_PULL_THRESH_LSB	25
++#define PROC_PIO_SM0_SHIFTCTRL_FJOIN_TX_BITS	0x40000000
++#define PROC_PIO_SM0_SHIFTCTRL_FJOIN_TX_LSB	30
++#define PROC_PIO_SM0_SHIFTCTRL_FJOIN_RX_BITS	0x80000000
++#define PROC_PIO_SM0_SHIFTCTRL_FJOIN_RX_LSB	31
++#define PROC_PIO_SM0_EXECCTRL_OUT_STICKY_BITS	0x00020000
++#define PROC_PIO_SM0_EXECCTRL_OUT_STICKY_LSB	17
++#define PROC_PIO_SM0_EXECCTRL_INLINE_OUT_EN_BITS	0x00040000
++#define PROC_PIO_SM0_EXECCTRL_INLINE_OUT_EN_LSB	18
++#define PROC_PIO_SM0_EXECCTRL_OUT_EN_SEL_BITS	0x00f80000
++#define PROC_PIO_SM0_EXECCTRL_OUT_EN_SEL_LSB	19
++#define PROC_PIO_SM0_EXECCTRL_STATUS_SEL_BITS	0x00000020
++#define PROC_PIO_SM0_EXECCTRL_STATUS_SEL_LSB	5
++#define PROC_PIO_SM0_EXECCTRL_STATUS_N_BITS	0x0000001f
++#define PROC_PIO_SM0_EXECCTRL_STATUS_N_LSB	0
++
++enum pio_fifo_join {
++	PIO_FIFO_JOIN_NONE = 0,
++	PIO_FIFO_JOIN_TX = 1,
++	PIO_FIFO_JOIN_RX = 2,
++};
++
++enum pio_mov_status_type {
++	STATUS_TX_LESSTHAN = 0,
++	STATUS_RX_LESSTHAN = 1
++};
++
++enum pio_xfer_dir {
++	PIO_DIR_TO_SM,
++	PIO_DIR_FROM_SM,
++	PIO_DIR_COUNT
++};
++
++enum clock_index {
++	clk_sys = 5
++};
++
++typedef struct pio_program {
++	const uint16_t *instructions;
++	uint8_t length;
++	int8_t origin; // required instruction memory origin or -1
++} pio_program_t;
++
++enum gpio_function {
++	GPIO_FUNC_FSEL0 = 0,
++	GPIO_FUNC_FSEL1 = 1,
++	GPIO_FUNC_FSEL2 = 2,
++	GPIO_FUNC_FSEL3 = 3,
++	GPIO_FUNC_FSEL4 = 4,
++	GPIO_FUNC_FSEL5 = 5,
++	GPIO_FUNC_FSEL6 = 6,
++	GPIO_FUNC_FSEL7 = 7,
++	GPIO_FUNC_FSEL8 = 8,
++	GPIO_FUNC_NULL = 0x1f,
++
++	// Name a few
++	GPIO_FUNC_SYS_RIO = 5,
++	GPIO_FUNC_PROC_RIO = 6,
++	GPIO_FUNC_PIO = 7,
++};
++
++enum gpio_irq_level {
++	GPIO_IRQ_LEVEL_LOW = 0x1u,
++	GPIO_IRQ_LEVEL_HIGH = 0x2u,
++	GPIO_IRQ_EDGE_FALL = 0x4u,
++	GPIO_IRQ_EDGE_RISE = 0x8u,
++};
++
++enum gpio_override {
++	GPIO_OVERRIDE_NORMAL = 0,
++	GPIO_OVERRIDE_INVERT = 1,
++	GPIO_OVERRIDE_LOW = 2,
++	GPIO_OVERRIDE_HIGH = 3,
++};
++enum gpio_slew_rate {
++	GPIO_SLEW_RATE_SLOW = 0,
++	GPIO_SLEW_RATE_FAST = 1
++};
++
++enum gpio_drive_strength {
++	GPIO_DRIVE_STRENGTH_2MA = 0,
++	GPIO_DRIVE_STRENGTH_4MA = 1,
++	GPIO_DRIVE_STRENGTH_8MA = 2,
++	GPIO_DRIVE_STRENGTH_12MA = 3
++};
++
++typedef rp1_pio_sm_config pio_sm_config;
++
++typedef struct rp1_pio_client *PIO;
++
++void pio_set_error(struct rp1_pio_client *client, int err);
++int pio_get_error(struct rp1_pio_client *client);
++void pio_clear_error(struct rp1_pio_client *client);
++
++int rp1_pio_can_add_program(struct rp1_pio_client *client, void *param);
++int rp1_pio_add_program(struct rp1_pio_client *client, void *param);
++int rp1_pio_remove_program(struct rp1_pio_client *client, void *param);
++int rp1_pio_clear_instr_mem(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_claim(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_unclaim(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_is_claimed(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_init(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_set_config(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_exec(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_clear_fifos(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_set_clkdiv(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_set_pins(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_set_pindirs(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_set_enabled(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_restart(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_clkdiv_restart(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_enable_sync(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_put(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_get(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_set_dmactrl(struct rp1_pio_client *client, void *param);
++int rp1_pio_gpio_init(struct rp1_pio_client *client, void *param);
++int rp1_pio_gpio_set_function(struct rp1_pio_client *client, void *param);
++int rp1_pio_gpio_set_pulls(struct rp1_pio_client *client, void *param);
++int rp1_pio_gpio_set_outover(struct rp1_pio_client *client, void *param);
++int rp1_pio_gpio_set_inover(struct rp1_pio_client *client, void *param);
++int rp1_pio_gpio_set_oeover(struct rp1_pio_client *client, void *param);
++int rp1_pio_gpio_set_input_enabled(struct rp1_pio_client *client, void *param);
++int rp1_pio_gpio_set_drive_strength(struct rp1_pio_client *client, void *param);
++
++int pio_init(void);
++PIO pio_open(void);
++void pio_close(PIO pio);
++
++int pio_sm_config_xfer(PIO pio, uint sm, uint dir, uint buf_size, uint buf_count);
++int pio_sm_xfer_data(PIO pio, uint sm, uint dir, uint data_bytes, void *data);
++
++static inline bool pio_can_add_program(struct rp1_pio_client *client,
++				       const pio_program_t *program)
++{
++	struct rp1_pio_add_program_args args;
++
++	if (bad_params_if(client, program->length > PIO_INSTRUCTION_COUNT))
++		return false;
++	args.origin = (program->origin == -1) ? PIO_ORIGIN_ANY : program->origin;
++	args.num_instrs = program->length;
++
++	memcpy(args.instrs, program->instructions, args.num_instrs * sizeof(args.instrs[0]));
++	return rp1_pio_can_add_program(client, &args);
++}
++
++static inline bool pio_can_add_program_at_offset(struct rp1_pio_client *client,
++						 const pio_program_t *program, uint offset)
++{
++	struct rp1_pio_add_program_args args;
++
++	if (bad_params_if(client, program->length > PIO_INSTRUCTION_COUNT ||
++			  offset >= PIO_INSTRUCTION_COUNT))
++		return false;
++	args.origin = offset;
++	args.num_instrs = program->length;
++
++	memcpy(args.instrs, program->instructions, args.num_instrs * sizeof(args.instrs[0]));
++	return !rp1_pio_can_add_program(client, &args);
++}
++
++uint pio_add_program(struct rp1_pio_client *client, const pio_program_t *program)
++{
++	struct rp1_pio_add_program_args args;
++	int offset;
++
++	if (bad_params_if(client, program->length > PIO_INSTRUCTION_COUNT))
++		return PIO_ORIGIN_ANY;
++	args.origin = (program->origin == -1) ? PIO_ORIGIN_ANY : program->origin;
++	args.num_instrs = program->length;
++
++	memcpy(args.instrs, program->instructions, args.num_instrs * sizeof(args.instrs[0]));
++	offset = rp1_pio_add_program(client, &args);
++	return (offset >= 0) ? offset : PIO_ORIGIN_ANY;
++}
++
++static inline int pio_add_program_at_offset(struct rp1_pio_client *client,
++					    const pio_program_t *program, uint offset)
++{
++	struct rp1_pio_add_program_args args;
++
++	if (bad_params_if(client, program->length > PIO_INSTRUCTION_COUNT ||
++				  offset >= PIO_INSTRUCTION_COUNT))
++		return -EINVAL;
++	args.origin = offset;
++	args.num_instrs = program->length;
++
++	memcpy(args.instrs, program->instructions, args.num_instrs * sizeof(args.instrs[0]));
++	return rp1_pio_add_program(client, &args);
++}
++
++static inline int pio_remove_program(struct rp1_pio_client *client, const pio_program_t *program,
++				     uint loaded_offset)
++{
++	struct rp1_pio_remove_program_args args;
++
++	args.origin = loaded_offset;
++	args.num_instrs = program->length;
++
++	return rp1_pio_remove_program(client, &args);
++}
++
++static inline int pio_clear_instruction_memory(struct rp1_pio_client *client)
++{
++	return rp1_pio_clear_instr_mem(client, NULL);
++}
++
++static inline int pio_sm_claim(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_claim_args args = { .mask = 1 << sm };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++
++	return rp1_pio_sm_claim(client, &args);
++}
++
++static inline int pio_claim_sm_mask(struct rp1_pio_client *client, uint mask)
++{
++	struct rp1_pio_sm_claim_args args = { .mask = mask };
++
++	if (bad_params_if(client, mask >= (1 << NUM_PIO_STATE_MACHINES)))
++		return -EINVAL;
++
++	return rp1_pio_sm_claim(client, &args);
++}
++
++static inline int pio_sm_unclaim(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_claim_args args = { .mask = 1 << sm };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++
++	return rp1_pio_sm_claim(client, &args);
++}
++
++static inline int pio_claim_unused_sm(struct rp1_pio_client *client, bool required)
++{
++	struct rp1_pio_sm_claim_args args = { .mask = 0 };
++	int sm;
++
++	sm = rp1_pio_sm_claim(client, &args);
++	if (sm < 0 && required)
++		WARN_ON("No PIO state machines are available");
++	return sm;
++}
++
++static inline bool pio_sm_is_claimed(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_claim_args args = { .mask = (1 << sm) };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return true;
++	return rp1_pio_sm_is_claimed(client, &args);
++}
++
++static inline int pio_sm_init(struct rp1_pio_client *client, uint sm, uint initial_pc,
++			      const pio_sm_config *config)
++{
++	struct rp1_pio_sm_init_args args = { .sm = sm, .initial_pc = initial_pc,
++					     .config = *config };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES ||
++				  initial_pc >= PIO_INSTRUCTION_COUNT))
++		return -EINVAL;
++
++	return rp1_pio_sm_init(client, &args);
++}
++
++static inline int pio_sm_set_config(struct rp1_pio_client *client, uint sm,
++				    const pio_sm_config *config)
++{
++	struct rp1_pio_sm_init_args args = { .sm = sm, .config = *config };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++
++	return rp1_pio_sm_set_config(client, &args);
++}
++
++int pio_sm_exec(struct rp1_pio_client *client, uint sm, uint instr)
++{
++	struct rp1_pio_sm_exec_args args = { .sm = sm, .instr = instr, .blocking = false };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES || instr > (uint16_t)~0))
++		return -EINVAL;
++
++	return rp1_pio_sm_exec(client, &args);
++}
++
++int pio_sm_exec_wait_blocking(struct rp1_pio_client *client, uint sm, uint instr)
++{
++	struct rp1_pio_sm_exec_args args = { .sm = sm, .instr = instr, .blocking = true };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES || instr > (uint16_t)~0))
++		return -EINVAL;
++
++	return rp1_pio_sm_exec(client, &args);
++}
++
++static inline int pio_sm_clear_fifos(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_clear_fifos_args args = { .sm = sm };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_clear_fifos(client, &args);
++}
++
++static inline bool pio_calculate_clkdiv_from_float(float div, uint16_t *div_int,
++						   uint8_t *div_frac)
++{
++	if (bad_params_if(NULL, div < 1 || div > 65536))
++		return false;
++	*div_int = (uint16_t)div;
++	if (*div_int == 0)
++		*div_frac = 0;
++	else
++		*div_frac = (uint8_t)((div - (float)*div_int) * (1u << 8u));
++	return true;
++}
++
++static inline int pio_sm_set_clkdiv_int_frac(struct rp1_pio_client *client, uint sm,
++					     uint16_t div_int, uint8_t div_frac)
++{
++	struct rp1_pio_sm_set_clkdiv_args args = { .sm = sm, .div_int = div_int,
++						   .div_frac = div_frac };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES ||
++			  (div_int == 0 && div_frac != 0)))
++		return -EINVAL;
++	return rp1_pio_sm_set_clkdiv(client, &args);
++}
++
++static inline int pio_sm_set_clkdiv(struct rp1_pio_client *client, uint sm, float div)
++{
++	struct rp1_pio_sm_set_clkdiv_args args = { .sm = sm };
++
++	if (!pio_calculate_clkdiv_from_float(div, &args.div_int, &args.div_frac))
++		return -EINVAL;
++	return rp1_pio_sm_set_clkdiv(client, &args);
++}
++
++static inline int pio_sm_set_pins(struct rp1_pio_client *client, uint sm, uint32_t pin_values)
++{
++	struct rp1_pio_sm_set_pins_args args = { .sm = sm, .values = pin_values,
++						 .mask = GPIOS_MASK };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_set_pins(client, &args);
++}
++
++static inline int pio_sm_set_pins_with_mask(struct rp1_pio_client *client, uint sm,
++					    uint32_t pin_values, uint32_t pin_mask)
++{
++	struct rp1_pio_sm_set_pins_args args = { .sm = sm, .values = pin_values,
++						 .mask = pin_mask };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_set_pins(client, &args);
++}
++
++static inline int pio_sm_set_pindirs_with_mask(struct rp1_pio_client *client, uint sm,
++					       uint32_t pin_dirs, uint32_t pin_mask)
++{
++	struct rp1_pio_sm_set_pindirs_args args = { .sm = sm, .dirs = pin_dirs,
++						    .mask = pin_mask };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES ||
++			      (pin_dirs & GPIOS_MASK) != pin_dirs ||
++			      (pin_mask & pin_mask) != pin_mask))
++		return -EINVAL;
++	return rp1_pio_sm_set_pindirs(client, &args);
++}
++
++static inline int pio_sm_set_consecutive_pindirs(struct rp1_pio_client *client, uint sm,
++						 uint pin_base, uint pin_count, bool is_out)
++{
++	uint32_t mask = ((1 << pin_count) - 1) << pin_base;
++	struct rp1_pio_sm_set_pindirs_args args = { .sm = sm, .dirs = is_out ? mask : 0,
++						    .mask = mask };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES ||
++			      pin_base >= RP1_PIO_GPIO_COUNT ||
++			      pin_count > RP1_PIO_GPIO_COUNT ||
++			      (pin_base + pin_count) > RP1_PIO_GPIO_COUNT))
++		return -EINVAL;
++	return rp1_pio_sm_set_pindirs(client, &args);
++}
++
++static inline int pio_sm_set_enabled(struct rp1_pio_client *client, uint sm, bool enabled)
++{
++	struct rp1_pio_sm_set_enabled_args args = { .mask = (1 << sm), .enable = enabled };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_set_enabled(client, &args);
++}
++
++static inline int pio_set_sm_mask_enabled(struct rp1_pio_client *client, uint32_t mask,
++					  bool enabled)
++{
++	struct rp1_pio_sm_set_enabled_args args = { .mask = mask, .enable = enabled };
++
++	if (bad_params_if(client, mask >= (1 << NUM_PIO_STATE_MACHINES)))
++		return -EINVAL;
++	return rp1_pio_sm_set_enabled(client, &args);
++}
++
++static inline int pio_sm_restart(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_restart_args args = { .mask = (1 << sm) };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_restart(client, &args);
++}
++
++static inline int pio_restart_sm_mask(struct rp1_pio_client *client, uint32_t mask)
++{
++	struct rp1_pio_sm_restart_args args = { .mask = (uint16_t)mask };
++
++	if (bad_params_if(client, mask >= (1 << NUM_PIO_STATE_MACHINES)))
++		return -EINVAL;
++	return rp1_pio_sm_restart(client, &args);
++}
++
++static inline int pio_sm_clkdiv_restart(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_restart_args args = { .mask = (1 << sm) };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_clkdiv_restart(client, &args);
++}
++
++static inline int pio_clkdiv_restart_sm_mask(struct rp1_pio_client *client, uint32_t mask)
++{
++	struct rp1_pio_sm_restart_args args = { .mask = (uint16_t)mask };
++
++	if (bad_params_if(client, mask >= (1 << NUM_PIO_STATE_MACHINES)))
++		return -EINVAL;
++	return rp1_pio_sm_clkdiv_restart(client, &args);
++}
++
++static inline int pio_enable_sm_in_sync_mask(struct rp1_pio_client *client, uint32_t mask)
++{
++	struct rp1_pio_sm_enable_sync_args args = { .mask = (uint16_t)mask };
++
++	if (bad_params_if(client, mask >= (1 << NUM_PIO_STATE_MACHINES)))
++		return -EINVAL;
++	return rp1_pio_sm_enable_sync(client, &args);
++}
++
++static inline int pio_sm_set_dmactrl(struct rp1_pio_client *client, uint sm, bool is_tx,
++				     uint32_t ctrl)
++{
++	struct rp1_pio_sm_set_dmactrl_args args = { .sm = sm, .is_tx = is_tx, .ctrl = ctrl };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_set_dmactrl(client, &args);
++};
++
++static inline int pio_sm_put(struct rp1_pio_client *client, uint sm, uint32_t data)
++{
++	struct rp1_pio_sm_put_args args = { .sm = (uint16_t)sm, .blocking = false, .data = data };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_put(client, &args);
++}
++
++static inline int pio_sm_put_blocking(struct rp1_pio_client *client, uint sm, uint32_t data)
++{
++	struct rp1_pio_sm_put_args args = { .sm = (uint16_t)sm, .blocking = true, .data = data };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_put(client, &args);
++}
++
++static inline uint32_t pio_sm_get(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_get_args args = { .sm = (uint16_t)sm, .blocking = false };
++
++	if (!bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		rp1_pio_sm_get(client, &args);
++	return args.data;
++}
++
++static inline uint32_t pio_sm_get_blocking(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_get_args args = { .sm = (uint16_t)sm, .blocking = true };
++
++	if (!bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		rp1_pio_sm_get(client, &args);
++	return args.data;
++}
++
++static inline void sm_config_set_out_pins(pio_sm_config *c, uint out_base, uint out_count)
++{
++	if (bad_params_if(NULL, out_base >= RP1_PIO_GPIO_COUNT ||
++				    out_count > RP1_PIO_GPIO_COUNT))
++		return;
++
++	c->pinctrl = (c->pinctrl & ~(PROC_PIO_SM0_PINCTRL_OUT_BASE_BITS |
++				     PROC_PIO_SM0_PINCTRL_OUT_COUNT_BITS)) |
++			(out_base << PROC_PIO_SM0_PINCTRL_OUT_BASE_LSB) |
++			(out_count << PROC_PIO_SM0_PINCTRL_OUT_COUNT_LSB);
++}
++
++static inline void sm_config_set_set_pins(pio_sm_config *c, uint set_base, uint set_count)
++{
++	if (bad_params_if(NULL, set_base >= RP1_PIO_GPIO_COUNT ||
++				    set_count > 5))
++		return;
++
++	c->pinctrl = (c->pinctrl & ~(PROC_PIO_SM0_PINCTRL_SET_BASE_BITS |
++				     PROC_PIO_SM0_PINCTRL_SET_COUNT_BITS)) |
++			(set_base << PROC_PIO_SM0_PINCTRL_SET_BASE_LSB) |
++			(set_count << PROC_PIO_SM0_PINCTRL_SET_COUNT_LSB);
++}
++
++
++static inline void sm_config_set_in_pins(pio_sm_config *c, uint in_base)
++{
++	if (bad_params_if(NULL, in_base >= RP1_PIO_GPIO_COUNT))
++		return;
++
++	c->pinctrl = (c->pinctrl & ~PROC_PIO_SM0_PINCTRL_IN_BASE_BITS) |
++			(in_base << PROC_PIO_SM0_PINCTRL_IN_BASE_LSB);
++}
++
++static inline void sm_config_set_sideset_pins(pio_sm_config *c, uint sideset_base)
++{
++	if (bad_params_if(NULL, sideset_base >= RP1_PIO_GPIO_COUNT))
++		return;
++
++	c->pinctrl = (c->pinctrl & ~PROC_PIO_SM0_PINCTRL_SIDESET_BASE_BITS) |
++			(sideset_base << PROC_PIO_SM0_PINCTRL_SIDESET_BASE_LSB);
++}
++
++static inline void sm_config_set_sideset(pio_sm_config *c, uint bit_count, bool optional,
++					 bool pindirs)
++{
++	if (bad_params_if(NULL, bit_count > 5 ||
++				    (optional && (bit_count == 0))))
++		return;
++	c->pinctrl = (c->pinctrl & ~PROC_PIO_SM0_PINCTRL_SIDESET_COUNT_BITS) |
++			(bit_count << PROC_PIO_SM0_PINCTRL_SIDESET_COUNT_LSB);
++
++	c->execctrl = (c->execctrl & ~(PROC_PIO_SM0_EXECCTRL_SIDE_EN_BITS |
++				       PROC_PIO_SM0_EXECCTRL_SIDE_PINDIR_BITS)) |
++			(optional << PROC_PIO_SM0_EXECCTRL_SIDE_EN_LSB) |
++			(pindirs << PROC_PIO_SM0_EXECCTRL_SIDE_PINDIR_LSB);
++}
++
++static inline void sm_config_set_clkdiv_int_frac(pio_sm_config *c, uint16_t div_int,
++						 uint8_t div_frac)
++{
++	if (bad_params_if(NULL, div_int == 0 && div_frac != 0))
++		return;
++
++	c->clkdiv =
++		(((uint)div_frac) << PROC_PIO_SM0_CLKDIV_FRAC_LSB) |
++		(((uint)div_int) << PROC_PIO_SM0_CLKDIV_INT_LSB);
++}
++
++static inline void sm_config_set_clkdiv(pio_sm_config *c, float div)
++{
++	uint16_t div_int;
++	uint8_t div_frac;
++
++	pio_calculate_clkdiv_from_float(div, &div_int, &div_frac);
++	sm_config_set_clkdiv_int_frac(c, div_int, div_frac);
++}
++
++static inline void sm_config_set_wrap(pio_sm_config *c, uint wrap_target, uint wrap)
++{
++	if (bad_params_if(NULL, wrap >= PIO_INSTRUCTION_COUNT ||
++				    wrap_target >= PIO_INSTRUCTION_COUNT))
++		return;
++
++	c->execctrl = (c->execctrl & ~(PROC_PIO_SM0_EXECCTRL_WRAP_TOP_BITS |
++				       PROC_PIO_SM0_EXECCTRL_WRAP_BOTTOM_BITS)) |
++			(wrap_target << PROC_PIO_SM0_EXECCTRL_WRAP_BOTTOM_LSB) |
++			(wrap << PROC_PIO_SM0_EXECCTRL_WRAP_TOP_LSB);
++}
++
++static inline void sm_config_set_jmp_pin(pio_sm_config *c, uint pin)
++{
++	if (bad_params_if(NULL, pin >= RP1_PIO_GPIO_COUNT))
++		return;
++
++	c->execctrl = (c->execctrl & ~PROC_PIO_SM0_EXECCTRL_JMP_PIN_BITS) |
++		(pin << PROC_PIO_SM0_EXECCTRL_JMP_PIN_LSB);
++}
++
++static inline void sm_config_set_in_shift(pio_sm_config *c, bool shift_right, bool autopush,
++					  uint push_threshold)
++{
++	if (bad_params_if(NULL, push_threshold > 32))
++		return;
++
++	c->shiftctrl = (c->shiftctrl &
++		~(PROC_PIO_SM0_SHIFTCTRL_IN_SHIFTDIR_BITS |
++		PROC_PIO_SM0_SHIFTCTRL_AUTOPUSH_BITS |
++		PROC_PIO_SM0_SHIFTCTRL_PUSH_THRESH_BITS)) |
++		(shift_right << PROC_PIO_SM0_SHIFTCTRL_IN_SHIFTDIR_LSB) |
++		(autopush << PROC_PIO_SM0_SHIFTCTRL_AUTOPUSH_LSB) |
++		((push_threshold & 0x1fu) << PROC_PIO_SM0_SHIFTCTRL_PUSH_THRESH_LSB);
++}
++
++static inline void sm_config_set_out_shift(pio_sm_config *c, bool shift_right, bool autopull,
++					   uint pull_threshold)
++{
++	if (bad_params_if(NULL, pull_threshold > 32))
++		return;
++
++	c->shiftctrl = (c->shiftctrl &
++		~(PROC_PIO_SM0_SHIFTCTRL_OUT_SHIFTDIR_BITS |
++		PROC_PIO_SM0_SHIFTCTRL_AUTOPULL_BITS |
++		PROC_PIO_SM0_SHIFTCTRL_PULL_THRESH_BITS)) |
++		(shift_right << PROC_PIO_SM0_SHIFTCTRL_OUT_SHIFTDIR_LSB) |
++		(autopull << PROC_PIO_SM0_SHIFTCTRL_AUTOPULL_LSB) |
++		((pull_threshold & 0x1fu) << PROC_PIO_SM0_SHIFTCTRL_PULL_THRESH_LSB);
++}
++
++static inline void sm_config_set_fifo_join(pio_sm_config *c, enum pio_fifo_join join)
++{
++	if (bad_params_if(NULL, join != PIO_FIFO_JOIN_NONE &&
++				    join != PIO_FIFO_JOIN_TX &&
++				    join != PIO_FIFO_JOIN_RX))
++		return;
++
++	c->shiftctrl = (c->shiftctrl & (uint)~(PROC_PIO_SM0_SHIFTCTRL_FJOIN_TX_BITS |
++					       PROC_PIO_SM0_SHIFTCTRL_FJOIN_RX_BITS)) |
++		(((uint)join) << PROC_PIO_SM0_SHIFTCTRL_FJOIN_TX_LSB);
++}
++
++static inline void sm_config_set_out_special(pio_sm_config *c, bool sticky, bool has_enable_pin,
++					     uint enable_pin_index)
++{
++	c->execctrl = (c->execctrl &
++		(uint)~(PROC_PIO_SM0_EXECCTRL_OUT_STICKY_BITS |
++			PROC_PIO_SM0_EXECCTRL_INLINE_OUT_EN_BITS |
++		PROC_PIO_SM0_EXECCTRL_OUT_EN_SEL_BITS)) |
++		(sticky << PROC_PIO_SM0_EXECCTRL_OUT_STICKY_LSB) |
++		(has_enable_pin << PROC_PIO_SM0_EXECCTRL_INLINE_OUT_EN_LSB) |
++		((enable_pin_index << PROC_PIO_SM0_EXECCTRL_OUT_EN_SEL_LSB) &
++		 PROC_PIO_SM0_EXECCTRL_OUT_EN_SEL_BITS);
++}
++
++static inline void sm_config_set_mov_status(pio_sm_config *c, enum pio_mov_status_type status_sel,
++					    uint status_n)
++{
++	if (bad_params_if(NULL, status_sel != STATUS_TX_LESSTHAN &&
++				status_sel != STATUS_RX_LESSTHAN))
++		return;
++
++	c->execctrl = (c->execctrl
++		& ~(PROC_PIO_SM0_EXECCTRL_STATUS_SEL_BITS | PROC_PIO_SM0_EXECCTRL_STATUS_N_BITS))
++		| ((((uint)status_sel) << PROC_PIO_SM0_EXECCTRL_STATUS_SEL_LSB) &
++		   PROC_PIO_SM0_EXECCTRL_STATUS_SEL_BITS)
++		| ((status_n << PROC_PIO_SM0_EXECCTRL_STATUS_N_LSB) &
++		   PROC_PIO_SM0_EXECCTRL_STATUS_N_BITS);
++}
++
++static inline pio_sm_config pio_get_default_sm_config(void)
++{
++	pio_sm_config c = { 0 };
++
++	sm_config_set_clkdiv_int_frac(&c, 1, 0);
++	sm_config_set_wrap(&c, 0, 31);
++	sm_config_set_in_shift(&c, true, false, 32);
++	sm_config_set_out_shift(&c, true, false, 32);
++	return c;
++}
++
++static inline uint32_t clock_get_hz(enum clock_index clk_index)
++{
++	const uint32_t MHZ = 1000000;
++
++	if (bad_params_if(NULL, clk_index != clk_sys))
++		return 0;
++	return 200 * MHZ;
++}
++
++static inline int pio_gpio_set_function(struct rp1_pio_client *client, uint gpio,
++					enum gpio_function fn)
++{
++	struct rp1_gpio_set_function_args args = { .gpio = gpio, .fn = fn };
++
++	if (bad_params_if(client, gpio >= RP1_PIO_GPIO_COUNT))
++		return -EINVAL;
++	return rp1_pio_gpio_set_function(client, &args);
++}
++
++static inline int pio_gpio_init(struct rp1_pio_client *client, uint gpio)
++{
++	struct rp1_gpio_init_args args = { .gpio = gpio };
++	int ret;
++
++	if (bad_params_if(client, gpio >= RP1_PIO_GPIO_COUNT))
++		return -EINVAL;
++	ret = rp1_pio_gpio_init(client, &args);
++	if (ret)
++		return ret;
++	return pio_gpio_set_function(client, gpio, RP1_GPIO_FUNC_PIO);
++}
++
++static inline int pio_gpio_set_pulls(struct rp1_pio_client *client, uint gpio, bool up, bool down)
++{
++	struct rp1_gpio_set_pulls_args args = { .gpio = gpio, .up = up, .down = down };
++
++	if (bad_params_if(client, gpio >= RP1_PIO_GPIO_COUNT))
++		return -EINVAL;
++	return rp1_pio_gpio_set_pulls(client, &args);
++}
++
++static inline int pio_gpio_set_outover(struct rp1_pio_client *client, uint gpio, uint value)
++{
++	struct rp1_gpio_set_args args = { .gpio = gpio, .value = value };
++
++	if (bad_params_if(client, gpio >= RP1_PIO_GPIO_COUNT))
++		return -EINVAL;
++	return rp1_pio_gpio_set_outover(client, &args);
++}
++
++static inline int pio_gpio_set_inover(struct rp1_pio_client *client, uint gpio, uint value)
++{
++	struct rp1_gpio_set_args args = { .gpio = gpio, .value = value };
++
++	if (bad_params_if(client, gpio >= RP1_PIO_GPIO_COUNT))
++		return -EINVAL;
++	return rp1_pio_gpio_set_inover(client, &args);
++}
++
++static inline int pio_gpio_set_oeover(struct rp1_pio_client *client, uint gpio, uint value)
++{
++	struct rp1_gpio_set_args args = { .gpio = gpio, .value = value };
++
++	if (bad_params_if(client, gpio >= RP1_PIO_GPIO_COUNT))
++		return -EINVAL;
++	return rp1_pio_gpio_set_oeover(client, &args);
++}
++
++static inline int pio_gpio_set_input_enabled(struct rp1_pio_client *client, uint gpio,
++					     bool enabled)
++{
++	struct rp1_gpio_set_args args = { .gpio = gpio, .value = enabled };
++
++	if (bad_params_if(client, gpio >= RP1_PIO_GPIO_COUNT))
++		return -EINVAL;
++	return rp1_pio_gpio_set_input_enabled(client, &args);
++}
++
++static inline int pio_gpio_set_drive_strength(struct rp1_pio_client *client, uint gpio,
++					      enum gpio_drive_strength drive)
++{
++	struct rp1_gpio_set_args args = { .gpio = gpio, .value = drive };
++
++	if (bad_params_if(client, gpio >= RP1_PIO_GPIO_COUNT))
++		return -EINVAL;
++	return rp1_pio_gpio_set_drive_strength(client, &args);
++}
++
++static inline int pio_gpio_pull_up(struct rp1_pio_client *client, uint gpio)
++{
++	return pio_gpio_set_pulls(client, gpio, true, false);
++}
++
++static inline int pio_gpio_pull_down(struct rp1_pio_client *client, uint gpio)
++{
++	return pio_gpio_set_pulls(client, gpio, false, true);
++}
++
++static inline int pio_gpio_disable_pulls(struct rp1_pio_client *client, uint gpio)
++{
++	return pio_gpio_set_pulls(client, gpio, false, false);
++}
++
++#endif
diff --git a/target/linux/bcm27xx/patches-6.6/950-1389-pwm-Add-pwm-pio-rp1-driver.patch b/target/linux/bcm27xx/patches-6.6/950-1389-pwm-Add-pwm-pio-rp1-driver.patch
new file mode 100644
index 00000000000000..9eed5f568d4824
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1389-pwm-Add-pwm-pio-rp1-driver.patch
@@ -0,0 +1,299 @@
+From 4d20aadc3188ecfb62b309a9924ee9696a94fc33 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 8 Nov 2024 09:37:58 +0000
+Subject: [PATCH] pwm: Add pwm-pio-rp1 driver
+
+Use the PIO hardware on RP1 to implement a PWM interface.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/pwm/Kconfig       |  11 ++
+ drivers/pwm/Makefile      |   1 +
+ drivers/pwm/pwm-pio-rp1.c | 251 ++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 263 insertions(+)
+ create mode 100644 drivers/pwm/pwm-pio-rp1.c
+
+--- a/drivers/pwm/Kconfig
++++ b/drivers/pwm/Kconfig
+@@ -465,6 +465,17 @@ config PWM_PCA9685
+ 	  To compile this driver as a module, choose M here: the module
+ 	  will be called pwm-pca9685.
+ 
++config PWM_PIO_RP1
++	tristate "RP1 PIO PWM support"
++	depends on FIRMWARE_RP1 || COMPILE_TEST
++	help
++	  This is a PWM framework driver for Raspberry Pi 5, using the PIO
++	  hardware of RP1 to provide PWM functionality. Supports up to 4
++	  instances on GPIOs in bank 0.
++
++	  To compile this driver as a module, choose M here: the module
++	  will be called pwm-pio-rp1.
++
+ config PWM_PXA
+ 	tristate "PXA PWM support"
+ 	depends on ARCH_PXA || ARCH_MMP || COMPILE_TEST
+--- a/drivers/pwm/Makefile
++++ b/drivers/pwm/Makefile
+@@ -42,6 +42,7 @@ obj-$(CONFIG_PWM_MXS)		+= pwm-mxs.o
+ obj-$(CONFIG_PWM_NTXEC)		+= pwm-ntxec.o
+ obj-$(CONFIG_PWM_OMAP_DMTIMER)	+= pwm-omap-dmtimer.o
+ obj-$(CONFIG_PWM_PCA9685)	+= pwm-pca9685.o
++obj-$(CONFIG_PWM_PIO_RP1)	+= pwm-pio-rp1.o
+ obj-$(CONFIG_PWM_PXA)		+= pwm-pxa.o
+ obj-$(CONFIG_PWM_RASPBERRYPI_POE)	+= pwm-raspberrypi-poe.o
+ obj-$(CONFIG_PWM_RP1)		+= pwm-rp1.o
+--- /dev/null
++++ b/drivers/pwm/pwm-pio-rp1.c
+@@ -0,0 +1,251 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Raspberry Pi PIO PWM.
++ *
++ * Copyright (C) 2024 Raspberry Pi Ltd.
++ *
++ * Author: Phil Elwell (phil@raspberrypi.com)
++ *
++ * Based on the pwm-rp1 driver by:
++ *   Naushir Patuck <naush@raspberrypi.com>
++ * and on the pwm-gpio driver by:
++ *   Vincent Whitchurch <vincent.whitchurch@axis.com>
++ */
++
++#include <linux/err.h>
++#include <linux/gpio/consumer.h>
++#include <linux/module.h>
++#include <linux/mutex.h>
++#include <linux/of.h>
++#include <linux/pio_rp1.h>
++#include <linux/platform_device.h>
++#include <linux/pwm.h>
++
++struct pwm_pio_rp1 {
++	struct pwm_chip chip;
++	struct device *dev;
++	struct gpio_desc *gpiod;
++	struct mutex mutex;
++	PIO pio;
++	uint sm;
++	uint offset;
++	uint gpio;
++	uint32_t period;		/* In SM cycles */
++	uint32_t duty_cycle;		/* In SM cycles */
++	enum pwm_polarity polarity;
++	bool enabled;
++};
++
++/* Generated from pwm.pio by pioasm */
++#define pwm_wrap_target 0
++#define pwm_wrap 6
++#define pwm_loop_ticks 3
++
++static const uint16_t pwm_program_instructions[] = {
++		//     .wrap_target
++	0x9080, //  0: pull   noblock         side 0
++	0xa027, //  1: mov    x, osr
++	0xa046, //  2: mov    y, isr
++	0x00a5, //  3: jmp    x != y, 5
++	0x1806, //  4: jmp    6               side 1
++	0xa042, //  5: nop
++	0x0083, //  6: jmp    y--, 3
++		//     .wrap
++};
++
++static const struct pio_program pwm_program = {
++	.instructions = pwm_program_instructions,
++	.length = 7,
++	.origin = -1,
++};
++
++static unsigned int pwm_pio_resolution __read_mostly;
++
++static inline pio_sm_config pwm_program_get_default_config(uint offset)
++{
++	pio_sm_config c = pio_get_default_sm_config();
++
++	sm_config_set_wrap(&c, offset + pwm_wrap_target, offset + pwm_wrap);
++	sm_config_set_sideset(&c, 2, true, false);
++	return c;
++}
++
++static inline void pwm_program_init(PIO pio, uint sm, uint offset, uint pin)
++{
++	pio_gpio_init(pio, pin);
++
++	pio_sm_set_consecutive_pindirs(pio, sm, pin, 1, true);
++	pio_sm_config c = pwm_program_get_default_config(offset);
++
++	sm_config_set_sideset_pins(&c, pin);
++	pio_sm_init(pio, sm, offset, &c);
++}
++
++/* Write `period` to the input shift register - must be disabled */
++static void pio_pwm_set_period(PIO pio, uint sm, uint32_t period)
++{
++	pio_sm_put_blocking(pio, sm, period);
++	pio_sm_exec(pio, sm, pio_encode_pull(false, false));
++	pio_sm_exec(pio, sm, pio_encode_out(pio_isr, 32));
++}
++
++/* Write `level` to TX FIFO. State machine will copy this into X. */
++static void pio_pwm_set_level(PIO pio, uint sm, uint32_t level)
++{
++	pio_sm_put_blocking(pio, sm, level);
++}
++
++static int pwm_pio_rp1_apply(struct pwm_chip *chip, struct pwm_device *pwm,
++			  const struct pwm_state *state)
++{
++	struct pwm_pio_rp1 *ppwm = container_of(chip, struct pwm_pio_rp1, chip);
++	uint32_t new_duty_cycle;
++	uint32_t new_period;
++
++	if (state->duty_cycle && state->duty_cycle < pwm_pio_resolution)
++		return -EINVAL;
++
++	if (state->duty_cycle != state->period &&
++	    (state->period - state->duty_cycle < pwm_pio_resolution))
++		return -EINVAL;
++
++	new_period = state->period / pwm_pio_resolution;
++	new_duty_cycle = state->duty_cycle / pwm_pio_resolution;
++
++	mutex_lock(&ppwm->mutex);
++
++	if ((ppwm->enabled && !state->enabled) || new_period != ppwm->period) {
++		pio_sm_set_enabled(ppwm->pio, ppwm->sm, false);
++		ppwm->enabled = false;
++	}
++
++	if (new_period != ppwm->period) {
++		pio_pwm_set_period(ppwm->pio, ppwm->sm, new_period);
++		ppwm->period = new_period;
++	}
++
++	if (state->enabled && new_duty_cycle != ppwm->duty_cycle) {
++		pio_pwm_set_level(ppwm->pio, ppwm->sm, new_duty_cycle);
++		ppwm->duty_cycle = new_duty_cycle;
++	}
++
++	if (state->polarity != ppwm->polarity) {
++		pio_gpio_set_outover(ppwm->pio, ppwm->gpio,
++			(state->polarity == PWM_POLARITY_INVERSED) ?
++			GPIO_OVERRIDE_INVERT : GPIO_OVERRIDE_NORMAL);
++		ppwm->polarity = state->polarity;
++	}
++
++	if (!ppwm->enabled && state->enabled) {
++		pio_sm_set_enabled(ppwm->pio, ppwm->sm, true);
++		ppwm->enabled = true;
++	}
++
++	mutex_unlock(&ppwm->mutex);
++
++	return 0;
++}
++
++static const struct pwm_ops pwm_pio_rp1_ops = {
++	.apply = pwm_pio_rp1_apply,
++};
++
++static int pwm_pio_rp1_probe(struct platform_device *pdev)
++{
++	struct device_node *np = pdev->dev.of_node;
++	struct of_phandle_args of_args = { 0 };
++	struct device *dev = &pdev->dev;
++	struct pwm_pio_rp1 *ppwm;
++	struct pwm_chip *chip;
++	bool is_rp1;
++
++	ppwm = devm_kzalloc(dev, sizeof(*ppwm), GFP_KERNEL);
++	if (IS_ERR(ppwm))
++		return PTR_ERR(ppwm);
++
++	chip = &ppwm->chip;
++
++	mutex_init(&ppwm->mutex);
++
++	ppwm->gpiod = devm_gpiod_get(dev, NULL, GPIOD_ASIS);
++	/* Need to check that this is an RP1 GPIO in the first bank, and retrieve the offset */
++	/* Unfortunately I think this has to be done by parsing the gpios property */
++	if (IS_ERR(ppwm->gpiod))
++		return dev_err_probe(dev, PTR_ERR(ppwm->gpiod),
++				     "could not get a gpio\n");
++
++	/* This really shouldn't fail, given that we have a gpiod */
++	if (of_parse_phandle_with_args(np, "gpios", "#gpio-cells", 0, &of_args))
++		return dev_err_probe(dev, -EINVAL,
++				     "can't find gpio declaration\n");
++
++	is_rp1 = of_device_is_compatible(of_args.np, "raspberrypi,rp1-gpio");
++	of_node_put(of_args.np);
++	if (!is_rp1 || of_args.args_count != 2)
++		return dev_err_probe(dev, -EINVAL,
++				     "not an RP1 gpio\n");
++
++	ppwm->gpio = of_args.args[0];
++
++	ppwm->pio = pio_open();
++	if (IS_ERR(ppwm->pio))
++		return dev_err_probe(dev, PTR_ERR(ppwm->pio),
++				     "%pfw: could not open PIO\n",
++				     dev_fwnode(dev));
++
++	ppwm->sm = pio_claim_unused_sm(ppwm->pio, false);
++	if ((int)ppwm->sm < 0) {
++		pio_close(ppwm->pio);
++		return dev_err_probe(dev, -EBUSY,
++				     "%pfw: no free PIO SM\n",
++				     dev_fwnode(dev));
++	}
++
++	ppwm->offset = pio_add_program(ppwm->pio, &pwm_program);
++	if (ppwm->offset == PIO_ORIGIN_ANY) {
++		pio_close(ppwm->pio);
++		return dev_err_probe(dev, -EBUSY,
++				     "%pfw: not enough PIO program space\n",
++				     dev_fwnode(dev));
++	}
++
++	pwm_program_init(ppwm->pio, ppwm->sm, ppwm->offset, ppwm->gpio);
++
++	pwm_pio_resolution = (1000u * 1000 * 1000 * pwm_loop_ticks) / clock_get_hz(clk_sys);
++
++	chip->dev = dev;
++	chip->ops = &pwm_pio_rp1_ops;
++	chip->atomic = true;
++	chip->npwm = 1;
++
++	platform_set_drvdata(pdev, ppwm);
++
++	return devm_pwmchip_add(dev, chip);
++}
++
++static void pwm_pio_rp1_remove(struct platform_device *pdev)
++{
++	struct pwm_pio_rp1 *ppwm = platform_get_drvdata(pdev);
++
++	pio_close(ppwm->pio);
++}
++
++static const struct of_device_id pwm_pio_rp1_dt_ids[] = {
++	{ .compatible = "raspberrypi,pwm-pio-rp1" },
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, pwm_pio_rp1_dt_ids);
++
++static struct platform_driver pwm_pio_rp1_driver = {
++	.driver = {
++		.name = "pwm-pio-rp1",
++		.of_match_table = pwm_pio_rp1_dt_ids,
++	},
++	.probe = pwm_pio_rp1_probe,
++	.remove_new = pwm_pio_rp1_remove,
++};
++module_platform_driver(pwm_pio_rp1_driver);
++
++MODULE_DESCRIPTION("PWM PIO RP1 driver");
++MODULE_AUTHOR("Phil Elwell");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/bcm27xx/patches-6.6/950-1391-overlays-Add-pwm-pio-overlay.patch b/target/linux/bcm27xx/patches-6.6/950-1391-overlays-Add-pwm-pio-overlay.patch
new file mode 100644
index 00000000000000..bd6d633319964e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1391-overlays-Add-pwm-pio-overlay.patch
@@ -0,0 +1,99 @@
+From ba7e2e3d03a432acbc338c6c03e46dcd97cfa1b3 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 7 Nov 2024 11:41:33 +0000
+Subject: [PATCH] overlays: Add pwm-pio overlay
+
+Add an overlay to enable a single-channel PIO-assisted PWM interface on any
+header pin.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/Makefile           |  1 +
+ arch/arm/boot/dts/overlays/README             |  8 ++++
+ arch/arm/boot/dts/overlays/overlay_map.dts    |  4 ++
+ .../arm/boot/dts/overlays/pwm-pio-overlay.dts | 39 +++++++++++++++++++
+ 4 files changed, 52 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/pwm-pio-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -219,6 +219,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	pwm-2chan.dtbo \
+ 	pwm-gpio.dtbo \
+ 	pwm-ir-tx.dtbo \
++	pwm-pio.dtbo \
+ 	pwm1.dtbo \
+ 	qca7000.dtbo \
+ 	qca7000-uart0.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -3926,6 +3926,14 @@ Params: gpio_pin                Output G
+         func                    Pin function (default 2 = Alt5)
+ 
+ 
++Name:   pwm-pio
++Info:   Configures a GPIO pin as PIO-assisted PWM output. Unlike hardware PWM,
++        this can be used on any RP1 GPIO in bank 0 (0-27). Up to 4 are
++        supported, assuming nothing else is using PIO. Pi 5 only.
++Load:   dtoverlay=pwm-pio,<param>=<val>
++Params: gpio                    Output GPIO (0-27, default 4)
++
++
+ Name:   pwm1
+ Info:   Configures one or two PWM channel on PWM1 (BCM2711 only)
+         N.B.:
+--- a/arch/arm/boot/dts/overlays/overlay_map.dts
++++ b/arch/arm/boot/dts/overlays/overlay_map.dts
+@@ -240,6 +240,10 @@
+ 		bcm2712;
+ 	};
+ 
++	pwm-pio {
++		bcm2712;
++	};
++
+ 	pwm1 {
+ 		bcm2711;
+ 	};
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pwm-pio-overlay.dts
+@@ -0,0 +1,39 @@
++// SPDX-License-Identifier: GPL-2.0
++// Device tree overlay for RP1 PIO PWM.
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			pwm_pio_pins: pwm_pio_pins@4 {
++				brcm,pins = <4>; /* gpio 4 */
++				function = "pio";
++				bias-disable;
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			pwm_pio: pwm_pio@4 {
++				  compatible = "raspberrypi,pwm-pio-rp1";
++				  pinctrl-names = "default";
++				  pinctrl-0 = <&pwm_pio_pins>;
++				  gpios = <&gpio 4 0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		gpio = <&pwm_pio>,"gpios:4",
++		       <&pwm_pio_pins>,"brcm,pins:0",
++		       /* modify reg values to allow multiple instantiation */
++		       <&pwm_pio>,"reg:0",
++		       <&pwm_pio_pins>,"reg:0";
++	};
++};
diff --git a/target/linux/bcm27xx/patches-6.6/950-1392-fixup-misc-Add-RP1-PIO-driver.patch b/target/linux/bcm27xx/patches-6.6/950-1392-fixup-misc-Add-RP1-PIO-driver.patch
new file mode 100644
index 00000000000000..cd197f7a7b88e0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1392-fixup-misc-Add-RP1-PIO-driver.patch
@@ -0,0 +1,29 @@
+From 1b5acd42281ad102b79f4e1794f0a0cccdafda05 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Sat, 16 Nov 2024 16:53:31 +0000
+Subject: [PATCH] fixup! misc: Add RP1 PIO driver
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ include/uapi/misc/rp1_pio_if.h | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/include/uapi/misc/rp1_pio_if.h
++++ b/include/uapi/misc/rp1_pio_if.h
+@@ -1,4 +1,4 @@
+-/* SPDX-License-Identifier: GPL-2.0 */
++/* SPDX-License-Identifier: GPL-2.0 + WITH Linux-syscall-note */
+ /*
+  * Copyright (c) 2023-24 Raspberry Pi Ltd.
+  * All rights reserved.
+@@ -169,10 +169,6 @@ struct rp1_access_hw_args {
+ #define PIO_IOC_SM_CONFIG_XFER _IOW(PIO_IOC_MAGIC, 0, struct rp1_pio_sm_config_xfer_args)
+ #define PIO_IOC_SM_XFER_DATA _IOW(PIO_IOC_MAGIC, 1, struct rp1_pio_sm_xfer_data_args)
+ 
+-#ifdef CONFIG_COMPAT
+-//XXX #define PIO_IOC_SM_XFER_DATA32 _IOW(PIO_IOC_MAGIC, 2, struct pio_sm_xfer_data_args)
+-#endif
+-
+ #define PIO_IOC_READ_HW _IOW(PIO_IOC_MAGIC, 8, struct rp1_access_hw_args)
+ #define PIO_IOC_WRITE_HW _IOW(PIO_IOC_MAGIC, 9, struct rp1_access_hw_args)
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1394-misc-rp1-pio-Add-compat_ioctl-method.patch b/target/linux/bcm27xx/patches-6.6/950-1394-misc-rp1-pio-Add-compat_ioctl-method.patch
new file mode 100644
index 00000000000000..6862a74e21450b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1394-misc-rp1-pio-Add-compat_ioctl-method.patch
@@ -0,0 +1,91 @@
+From b4472d09b1ffdafd8132803ffbec62596e559fd8 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 18 Nov 2024 09:10:52 +0000
+Subject: [PATCH] misc: rp1-pio: Add compat_ioctl method
+
+Provide a compat_ioctl method, to support running a 64-bit kernel with
+a 32-bit userland.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/rp1-pio.c | 64 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 64 insertions(+)
+
+--- a/drivers/misc/rp1-pio.c
++++ b/drivers/misc/rp1-pio.c
+@@ -996,11 +996,75 @@ static long rp1_pio_ioctl(struct file *f
+ 	return ret;
+ }
+ 
++#ifdef CONFIG_COMPAT
++
++struct rp1_pio_sm_xfer_data_args_compat {
++	uint16_t sm;
++	uint16_t dir;
++	uint16_t data_bytes;
++	compat_uptr_t data;
++};
++
++struct rp1_access_hw_args_compat {
++	uint32_t addr;
++	uint32_t len;
++	compat_uptr_t data;
++};
++
++#define PIO_IOC_SM_XFER_DATA_COMPAT _IOW(PIO_IOC_MAGIC, 1, struct rp1_pio_sm_xfer_data_args_compat)
++#define PIO_IOC_READ_HW_COMPAT _IOW(PIO_IOC_MAGIC, 8, struct rp1_access_hw_args_compat)
++#define PIO_IOC_WRITE_HW_COMPAT _IOW(PIO_IOC_MAGIC, 9, struct rp1_access_hw_args_compat)
++
++static long rp1_pio_compat_ioctl(struct file *filp, unsigned int ioctl_num,
++				 unsigned long ioctl_param)
++{
++	struct rp1_pio_client *client = filp->private_data;
++
++	switch (ioctl_num) {
++	case PIO_IOC_SM_XFER_DATA_COMPAT:
++	{
++		struct rp1_pio_sm_xfer_data_args_compat compat_param;
++		struct rp1_pio_sm_xfer_data_args param;
++
++		if (copy_from_user(&compat_param, compat_ptr(ioctl_param), sizeof(compat_param)))
++			return -EFAULT;
++		param.sm = compat_param.sm;
++		param.dir = compat_param.dir;
++		param.data_bytes = compat_param.data_bytes;
++		param.data = compat_ptr(compat_param.data);
++		return rp1_pio_sm_xfer_data(client, &param);
++	}
++
++	case PIO_IOC_READ_HW_COMPAT:
++	case PIO_IOC_WRITE_HW_COMPAT:
++	{
++		struct rp1_access_hw_args_compat compat_param;
++		struct rp1_access_hw_args param;
++
++		if (copy_from_user(&compat_param, compat_ptr(ioctl_param), sizeof(compat_param)))
++			return -EFAULT;
++		param.addr = compat_param.addr;
++		param.len = compat_param.len;
++		param.data = compat_ptr(compat_param.data);
++		if (ioctl_num == PIO_IOC_READ_HW_COMPAT)
++			return rp1_pio_read_hw(client, &param);
++		else
++			return rp1_pio_write_hw(client, &param);
++	}
++	default:
++		return rp1_pio_ioctl(filp, ioctl_num, ioctl_param);
++	}
++}
++#else
++#define rp1_pio_compat_ioctl NULL
++#endif
++
+ const struct file_operations rp1_pio_fops = {
+ 	.owner =	THIS_MODULE,
+ 	.open =		rp1_pio_open,
+ 	.release =	rp1_pio_release,
+ 	.unlocked_ioctl = rp1_pio_ioctl,
++	.compat_ioctl = rp1_pio_compat_ioctl,
+ };
+ 
+ static int rp1_pio_probe(struct platform_device *pdev)
diff --git a/target/linux/bcm27xx/patches-6.6/950-0998-i2c-designware-Add-support-for-bus-clear-feature.patch b/target/linux/bcm27xx/patches-6.6/950-1396-i2c-designware-Add-support-for-bus-clear-feature.patch
similarity index 89%
rename from target/linux/bcm27xx/patches-6.6/950-0998-i2c-designware-Add-support-for-bus-clear-feature.patch
rename to target/linux/bcm27xx/patches-6.6/950-1396-i2c-designware-Add-support-for-bus-clear-feature.patch
index 5eb4bcc5d2a9de..0f08ef43e40bb5 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0998-i2c-designware-Add-support-for-bus-clear-feature.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1396-i2c-designware-Add-support-for-bus-clear-feature.patch
@@ -1,7 +1,7 @@
-From 24cb07b0c0724a22e474d12e7c2d5b834bf3b076 Mon Sep 17 00:00:00 2001
+From 0e4968617aad7d0f88e0a630499202eaae407a19 Mon Sep 17 00:00:00 2001
 From: Phil Elwell <phil@raspberrypi.com>
 Date: Tue, 26 Mar 2024 15:57:46 +0000
-Subject: [PATCH 0998/1085] i2c: designware: Add support for bus clear feature
+Subject: [PATCH] i2c: designware: Add support for bus clear feature
 
 Newer versions of the DesignWare I2C block support the detection of
 stuck signals, and a mechanism to recover from them. Add the required
@@ -33,7 +33,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  };
  
  static int dw_reg_read(void *context, unsigned int reg, unsigned int *val)
-@@ -607,8 +609,16 @@ int i2c_dw_wait_bus_not_busy(struct dw_i
+@@ -609,8 +611,16 @@ int i2c_dw_wait_bus_not_busy(struct dw_i
  int i2c_dw_handle_tx_abort(struct dw_i2c_dev *dev)
  {
  	unsigned long abort_source = dev->abort_source;
@@ -50,7 +50,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	if (abort_source & DW_IC_TX_ABRT_NOACK) {
  		for_each_set_bit(i, &abort_source, ARRAY_SIZE(abort_sources))
  			dev_dbg(dev->dev,
-@@ -623,6 +633,8 @@ int i2c_dw_handle_tx_abort(struct dw_i2c
+@@ -625,6 +635,8 @@ int i2c_dw_handle_tx_abort(struct dw_i2c
  		return -EAGAIN;
  	else if (abort_source & DW_IC_TX_ABRT_GCALL_READ)
  		return -EINVAL; /* wrong msgs[] data */
@@ -74,7 +74,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  #define DW_IC_COMP_TYPE				0xfc
  #define DW_IC_COMP_TYPE_VALUE			0x44570140 /* "DW" + 0x0140 */
  
-@@ -111,12 +114,14 @@
+@@ -111,6 +114,7 @@
  
  #define DW_IC_ENABLE_ENABLE			BIT(0)
  #define DW_IC_ENABLE_ABORT			BIT(1)
@@ -82,14 +82,15 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  
  #define DW_IC_STATUS_ACTIVITY			BIT(0)
  #define DW_IC_STATUS_TFE			BIT(2)
- #define DW_IC_STATUS_RFNE			BIT(3)
+@@ -118,6 +122,7 @@
  #define DW_IC_STATUS_MASTER_ACTIVITY		BIT(5)
  #define DW_IC_STATUS_SLAVE_ACTIVITY		BIT(6)
+ #define DW_IC_STATUS_MASTER_HOLD_TX_FIFO_EMPTY	BIT(7)
 +#define DW_IC_STATUS_SDA_STUCK_NOT_RECOVERED	BIT(11)
  
  #define DW_IC_SDA_HOLD_RX_SHIFT			16
  #define DW_IC_SDA_HOLD_RX_MASK			GENMASK(23, 16)
-@@ -164,6 +169,7 @@
+@@ -165,6 +170,7 @@
  #define ABRT_SLAVE_FLUSH_TXFIFO			13
  #define ABRT_SLAVE_ARBLOST			14
  #define ABRT_SLAVE_RD_INTX			15
@@ -97,7 +98,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  
  #define DW_IC_TX_ABRT_7B_ADDR_NOACK		BIT(ABRT_7B_ADDR_NOACK)
  #define DW_IC_TX_ABRT_10ADDR1_NOACK		BIT(ABRT_10ADDR1_NOACK)
-@@ -179,6 +185,7 @@
+@@ -180,6 +186,7 @@
  #define DW_IC_RX_ABRT_SLAVE_RD_INTX		BIT(ABRT_SLAVE_RD_INTX)
  #define DW_IC_RX_ABRT_SLAVE_ARBLOST		BIT(ABRT_SLAVE_ARBLOST)
  #define DW_IC_RX_ABRT_SLAVE_FLUSH_TXFIFO	BIT(ABRT_SLAVE_FLUSH_TXFIFO)
@@ -107,7 +108,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  						 DW_IC_TX_ABRT_10ADDR1_NOACK | \
 --- a/drivers/i2c/busses/i2c-designware-master.c
 +++ b/drivers/i2c/busses/i2c-designware-master.c
-@@ -212,6 +212,7 @@ static int i2c_dw_set_timings_master(str
+@@ -215,6 +215,7 @@ static int i2c_dw_set_timings_master(str
   */
  static int i2c_dw_init_master(struct dw_i2c_dev *dev)
  {
@@ -115,7 +116,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	int ret;
  
  	ret = i2c_dw_acquire_lock(dev);
-@@ -235,6 +236,17 @@ static int i2c_dw_init_master(struct dw_
+@@ -238,6 +239,17 @@ static int i2c_dw_init_master(struct dw_
  		regmap_write(dev->map, DW_IC_HS_SCL_LCNT, dev->hs_lcnt);
  	}
  
@@ -133,7 +134,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	/* Write SDA hold time if supported */
  	if (dev->sda_hold_time)
  		regmap_write(dev->map, DW_IC_SDA_HOLD, dev->sda_hold_time);
-@@ -1071,6 +1083,7 @@ int i2c_dw_probe_master(struct dw_i2c_de
+@@ -1050,6 +1062,7 @@ int i2c_dw_probe_master(struct dw_i2c_de
  	struct i2c_adapter *adap = &dev->adapter;
  	unsigned long irq_flags;
  	unsigned int ic_con;
@@ -141,7 +142,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	int ret;
  
  	init_completion(&dev->cmd_complete);
-@@ -1106,7 +1119,11 @@ int i2c_dw_probe_master(struct dw_i2c_de
+@@ -1084,7 +1097,11 @@ int i2c_dw_probe_master(struct dw_i2c_de
  	if (ret)
  		return ret;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-1397-drivers-media-pci-Update-Hailo-accelerator-device-dr.patch b/target/linux/bcm27xx/patches-6.6/950-1397-drivers-media-pci-Update-Hailo-accelerator-device-dr.patch
new file mode 100644
index 00000000000000..3ad28d688669e8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1397-drivers-media-pci-Update-Hailo-accelerator-device-dr.patch
@@ -0,0 +1,3592 @@
+From 32511f035b086bca254d8adab234cef3541492b4 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 17 Oct 2024 11:37:29 +0100
+Subject: [PATCH] drivers: media: pci: Update Hailo accelerator device driver
+ to v4.19
+
+Sourced from https://github.com/hailo-ai/hailort-drivers/
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ drivers/media/pci/hailo/Makefile              |   4 +-
+ drivers/media/pci/hailo/common/fw_operation.c |  50 ++-
+ drivers/media/pci/hailo/common/fw_operation.h |   8 +-
+ .../media/pci/hailo/common/fw_validation.c    |  10 +-
+ .../media/pci/hailo/common/fw_validation.h    |   7 +-
+ .../pci/hailo/common/hailo_ioctl_common.h     |  28 +-
+ .../media/pci/hailo/common/hailo_resource.c   |  23 +-
+ .../media/pci/hailo/common/hailo_resource.h   |   2 +-
+ drivers/media/pci/hailo/common/pcie_common.c  | 380 +++++++++---------
+ drivers/media/pci/hailo/common/pcie_common.h  |  38 +-
+ drivers/media/pci/hailo/common/soc_structs.h  |  79 ++++
+ drivers/media/pci/hailo/common/utils.h        |  23 +-
+ drivers/media/pci/hailo/common/vdma_common.c  |  93 +++--
+ drivers/media/pci/hailo/common/vdma_common.h  |  22 +-
+ drivers/media/pci/hailo/src/fops.c            | 284 ++-----------
+ drivers/media/pci/hailo/src/fops.h            |   5 +-
+ drivers/media/pci/hailo/src/nnc.c             | 299 ++++++++++++++
+ drivers/media/pci/hailo/src/nnc.h             |  22 +
+ drivers/media/pci/hailo/src/pci_soc_ioctl.c   | 155 -------
+ drivers/media/pci/hailo/src/pcie.c            | 166 +++-----
+ drivers/media/pci/hailo/src/pcie.h            |  26 +-
+ drivers/media/pci/hailo/src/soc.c             | 244 +++++++++++
+ .../pci/hailo/src/{pci_soc_ioctl.h => soc.h}  |  13 +-
+ drivers/media/pci/hailo/src/sysfs.c           |   2 +-
+ drivers/media/pci/hailo/src/sysfs.h           |   2 +-
+ drivers/media/pci/hailo/src/utils.c           |  26 --
+ drivers/media/pci/hailo/utils/compact.h       |   2 +-
+ drivers/media/pci/hailo/utils/fw_common.h     |   2 +-
+ .../pci/hailo/utils/integrated_nnc_utils.c    |  10 +-
+ .../pci/hailo/utils/integrated_nnc_utils.h    |   2 +-
+ drivers/media/pci/hailo/utils/logs.c          |   2 +-
+ drivers/media/pci/hailo/utils/logs.h          |   2 +-
+ drivers/media/pci/hailo/vdma/ioctl.c          |  18 +-
+ drivers/media/pci/hailo/vdma/ioctl.h          |   6 +-
+ drivers/media/pci/hailo/vdma/memory.c         |  12 +-
+ drivers/media/pci/hailo/vdma/memory.h         |   2 +-
+ drivers/media/pci/hailo/vdma/vdma.c           |  39 +-
+ drivers/media/pci/hailo/vdma/vdma.h           |   5 +-
+ 38 files changed, 1224 insertions(+), 889 deletions(-)
+ create mode 100644 drivers/media/pci/hailo/common/soc_structs.h
+ create mode 100644 drivers/media/pci/hailo/src/nnc.c
+ create mode 100644 drivers/media/pci/hailo/src/nnc.h
+ delete mode 100755 drivers/media/pci/hailo/src/pci_soc_ioctl.c
+ create mode 100644 drivers/media/pci/hailo/src/soc.c
+ rename drivers/media/pci/hailo/src/{pci_soc_ioctl.h => soc.h} (53%)
+ mode change 100755 => 100644
+ delete mode 100644 drivers/media/pci/hailo/src/utils.c
+
+--- a/drivers/media/pci/hailo/Makefile
++++ b/drivers/media/pci/hailo/Makefile
+@@ -8,9 +8,9 @@ obj-$(CONFIG_MEDIA_PCI_HAILO) := hailo_p
+ 
+ hailo_pci-objs += src/pcie.o
+ hailo_pci-objs += src/fops.o
+-hailo_pci-objs += src/utils.o
+ hailo_pci-objs += src/sysfs.o
+-hailo_pci-objs += src/pci_soc_ioctl.o
++hailo_pci-objs += src/nnc.o
++hailo_pci-objs += src/soc.o
+ 
+ hailo_pci-objs += $(COMMON_SRC_DIRECTORY)/fw_validation.o
+ hailo_pci-objs += $(COMMON_SRC_DIRECTORY)/fw_operation.o
+--- a/drivers/media/pci/hailo/common/fw_operation.c
++++ b/drivers/media/pci/hailo/common/fw_operation.c
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2022 Hailo Technologies Ltd. All rights reserved.
+-**/
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
++ **/
+ 
+ #include "fw_operation.h"
+ 
+@@ -15,7 +15,10 @@ typedef struct {
+     u32 chip_offset;
+ } FW_DEBUG_BUFFER_HEADER_t;
+ 
+-#define DEBUG_BUFFER_DATA_SIZE (DEBUG_BUFFER_TOTAL_SIZE - sizeof(FW_DEBUG_BUFFER_HEADER_t))
++#define DEBUG_BUFFER_DATA_SIZE              (DEBUG_BUFFER_TOTAL_SIZE - sizeof(FW_DEBUG_BUFFER_HEADER_t))
++#define PCIE_D2H_NOTIFICATION_SRAM_OFFSET   (0x640 + 0x640)
++#define PCIE_APP_CPU_DEBUG_OFFSET           (8*1024)
++#define PCIE_CORE_CPU_DEBUG_OFFSET          (PCIE_APP_CPU_DEBUG_OFFSET + DEBUG_BUFFER_TOTAL_SIZE)
+ 
+ int hailo_read_firmware_notification(struct hailo_resource *resource, struct hailo_d2h_notification *notification)
+ {
+@@ -35,6 +38,21 @@ int hailo_read_firmware_notification(str
+     return 0;
+ }
+ 
++int hailo_pcie_read_firmware_notification(struct hailo_resource *resource,
++    struct hailo_d2h_notification *notification)
++{
++    struct hailo_resource notification_resource;
++
++    if (PCIE_D2H_NOTIFICATION_SRAM_OFFSET > resource->size) {
++        return -EINVAL;
++    }
++
++    notification_resource.address = resource->address + PCIE_D2H_NOTIFICATION_SRAM_OFFSET,
++    notification_resource.size = sizeof(struct hailo_d2h_notification);
++
++    return hailo_read_firmware_notification(&notification_resource, notification);
++}
++
+ static inline size_t calculate_log_ready_to_read(FW_DEBUG_BUFFER_HEADER_t *header)
+ {
+     size_t ready_to_read = 0;
+@@ -100,4 +118,30 @@ long hailo_read_firmware_log(struct hail
+     
+     params->read_bytes = ready_to_read;
+     return 0;
++}
++
++long hailo_pcie_read_firmware_log(struct hailo_resource *resource, struct hailo_read_log_params *params)
++{
++    long err = 0;
++    struct hailo_resource log_resource = {resource->address, DEBUG_BUFFER_TOTAL_SIZE};
++
++    if (HAILO_CPU_ID_CPU0 == params->cpu_id) {
++        log_resource.address += PCIE_APP_CPU_DEBUG_OFFSET;
++    } else if (HAILO_CPU_ID_CPU1 == params->cpu_id) {
++        log_resource.address += PCIE_CORE_CPU_DEBUG_OFFSET;
++    } else {
++        return -EINVAL;
++    }
++
++    if (0 == params->buffer_size) {
++        params->read_bytes = 0;
++        return 0;
++    }
++
++    err = hailo_read_firmware_log(&log_resource, params);
++    if (0 != err) {
++        return err;
++    }
++
++    return 0;
+ }
+\ No newline at end of file
+--- a/drivers/media/pci/hailo/common/fw_operation.h
++++ b/drivers/media/pci/hailo/common/fw_operation.h
+@@ -1,7 +1,7 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2022 Hailo Technologies Ltd. All rights reserved.
+-**/
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
++ **/
+ 
+ #ifndef _HAILO_COMMON_FIRMWARE_OPERATION_H_
+ #define _HAILO_COMMON_FIRMWARE_OPERATION_H_
+@@ -16,8 +16,12 @@ extern "C" {
+ 
+ int hailo_read_firmware_notification(struct hailo_resource *resource, struct hailo_d2h_notification *notification);
+ 
++int hailo_pcie_read_firmware_notification(struct hailo_resource *resource, struct hailo_d2h_notification *notification);
++
+ long hailo_read_firmware_log(struct hailo_resource *fw_logger_resource, struct hailo_read_log_params *params);
+ 
++long hailo_pcie_read_firmware_log(struct hailo_resource *resource, struct hailo_read_log_params *params);
++
+ #ifdef __cplusplus
+ }
+ #endif
+--- a/drivers/media/pci/hailo/common/fw_validation.c
++++ b/drivers/media/pci/hailo/common/fw_validation.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include "fw_validation.h"
+@@ -85,15 +85,15 @@ exit:
+ }
+ 
+ int FW_VALIDATION__validate_cert_header(uintptr_t firmware_base_address,
+-    size_t firmware_size, u32 *outer_consumed_firmware_offset, secure_boot_certificate_t **out_firmware_cert)
++    size_t firmware_size, u32 *outer_consumed_firmware_offset, secure_boot_certificate_header_t **out_firmware_cert)
+ {
+ 
+-    secure_boot_certificate_t *firmware_cert = NULL;
++    secure_boot_certificate_header_t *firmware_cert = NULL;
+     int err = -EINVAL;
+     u32 consumed_firmware_offset = *outer_consumed_firmware_offset;
+ 
+-    firmware_cert = (secure_boot_certificate_t *) (firmware_base_address + consumed_firmware_offset);
+-    CONSUME_FIRMWARE(sizeof(secure_boot_certificate_t), -EINVAL);
++    firmware_cert = (secure_boot_certificate_header_t *) (firmware_base_address + consumed_firmware_offset);
++    CONSUME_FIRMWARE(sizeof(secure_boot_certificate_header_t), -EINVAL);
+ 
+     if ((MAXIMUM_FIRMWARE_CERT_KEY_SIZE < firmware_cert->key_size) ||
+         (MAXIMUM_FIRMWARE_CERT_CONTENT_SIZE < firmware_cert->content_size)) {
+--- a/drivers/media/pci/hailo/common/fw_validation.h
++++ b/drivers/media/pci/hailo/common/fw_validation.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef PCIE_COMMON_FIRMWARE_HEADER_UTILS_H_
+@@ -44,8 +44,7 @@ typedef struct {
+ typedef struct {
+     u32 key_size;
+     u32 content_size;
+-    u8 certificates_data[0];
+-} secure_boot_certificate_t;
++} secure_boot_certificate_header_t;
+ 
+ #ifdef _MSC_VER
+ #pragma warning(pop)
+@@ -60,6 +59,6 @@ int FW_VALIDATION__validate_fw_header(ui
+     firmware_header_t **out_firmware_header, enum hailo_board_type board_type);
+ 
+ int FW_VALIDATION__validate_cert_header(uintptr_t firmware_base_address,
+-    size_t firmware_size, u32 *outer_consumed_firmware_offset, secure_boot_certificate_t **out_firmware_cert);
++    size_t firmware_size, u32 *outer_consumed_firmware_offset, secure_boot_certificate_header_t **out_firmware_cert);
+ 
+ #endif
+\ No newline at end of file
+--- a/drivers/media/pci/hailo/common/hailo_ioctl_common.h
++++ b/drivers/media/pci/hailo/common/hailo_ioctl_common.h
+@@ -1,13 +1,13 @@
+ // SPDX-License-Identifier: (GPL-2.0 WITH Linux-syscall-note) AND MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_IOCTL_COMMON_H_
+ #define _HAILO_IOCTL_COMMON_H_
+ 
+ #define HAILO_DRV_VER_MAJOR 4
+-#define HAILO_DRV_VER_MINOR 18
++#define HAILO_DRV_VER_MINOR 19
+ #define HAILO_DRV_VER_REVISION 0
+ 
+ #define _STRINGIFY_EXPANDED( x ) #x
+@@ -17,10 +17,11 @@
+ 
+ // This value is not easily changeable.
+ // For example: the channel interrupts ioctls assume we have up to 32 channels
+-#define MAX_VDMA_CHANNELS_PER_ENGINE    (32)
+-#define MAX_VDMA_ENGINES                (3)
+-#define SIZE_OF_VDMA_DESCRIPTOR         (16)
+-#define VDMA_DEST_CHANNELS_START        (16)
++#define MAX_VDMA_CHANNELS_PER_ENGINE            (32)
++#define VDMA_CHANNELS_PER_ENGINE_PER_DIRECTION  (16)
++#define MAX_VDMA_ENGINES                        (3)
++#define SIZE_OF_VDMA_DESCRIPTOR                 (16)
++#define VDMA_DEST_CHANNELS_START                (16)
+ 
+ #define HAILO_VDMA_MAX_ONGOING_TRANSFERS (128)
+ #define HAILO_VDMA_MAX_ONGOING_TRANSFERS_MASK (HAILO_VDMA_MAX_ONGOING_TRANSFERS - 1)
+@@ -37,8 +38,8 @@
+ #define FW_ACCESS_APP_CPU_CONTROL_MASK      (1 << FW_ACCESS_CONTROL_INTERRUPT_SHIFT)
+ #define FW_ACCESS_DRIVER_SHUTDOWN_SHIFT     (2)
+ #define FW_ACCESS_DRIVER_SHUTDOWN_MASK      (1 << FW_ACCESS_DRIVER_SHUTDOWN_SHIFT)
+-#define FW_ACCESS_SOC_CONNECT_SHIFT         (3)
+-#define FW_ACCESS_SOC_CONNECT_MASK          (1 << FW_ACCESS_SOC_CONNECT_SHIFT)
++#define FW_ACCESS_SOC_CONTROL_SHIFT         (3)
++#define FW_ACCESS_SOC_CONTROL_MASK          (1 << FW_ACCESS_SOC_CONTROL_SHIFT)
+ 
+ #define INVALID_VDMA_CHANNEL                (0xff)
+ 
+@@ -245,6 +246,12 @@ struct hailo_desc_list_release_params {
+     uintptr_t desc_handle;      // in
+ };
+ 
++struct hailo_write_action_list_params {
++    uint8_t *data;              // in
++    size_t size;                // in
++    uint64_t dma_address;       // out
++};
++
+ /* structure used in ioctl HAILO_DESC_LIST_BIND_VDMA_BUFFER */
+ struct hailo_desc_list_program_params {
+     size_t buffer_handle;       // in
+@@ -508,6 +515,7 @@ struct hailo_vdma_launch_transfer_params
+ 
+ /* structure used in ioctl HAILO_SOC_CONNECT */
+ struct hailo_soc_connect_params {
++    uint16_t port_number;           // in
+     uint8_t input_channel_index;    // out
+     uint8_t output_channel_index;   // out
+     uintptr_t input_desc_handle;    // in
+@@ -522,6 +530,7 @@ struct hailo_soc_close_params {
+ 
+ /* structure used in ioctl HAILO_PCI_EP_ACCEPT */
+ struct hailo_pci_ep_accept_params {
++    uint16_t port_number;           // in
+     uint8_t input_channel_index;    // out
+     uint8_t output_channel_index;   // out
+     uintptr_t input_desc_handle;    // in
+@@ -562,6 +571,7 @@ struct tCompatibleHailoIoctlData
+         struct hailo_soc_close_params SocCloseParams;
+         struct hailo_pci_ep_accept_params AcceptParams;
+         struct hailo_pci_ep_close_params PciEpCloseParams;
++        struct hailo_write_action_list_params WriteActionListParams;
+     } Buffer;
+ };
+ #endif // _MSC_VER
+@@ -632,6 +642,7 @@ enum hailo_nnc_ioctl_code {
+     HAILO_DISABLE_NOTIFICATION_CODE,
+     HAILO_READ_LOG_CODE,
+     HAILO_RESET_NN_CORE_CODE,
++    HAILO_WRITE_ACTION_LIST_CODE,
+ 
+     // Must be last
+     HAILO_NNC_IOCTL_MAX_NR
+@@ -642,6 +653,7 @@ enum hailo_nnc_ioctl_code {
+ #define HAILO_DISABLE_NOTIFICATION      _IO_(HAILO_NNC_IOCTL_MAGIC,    HAILO_DISABLE_NOTIFICATION_CODE)
+ #define HAILO_READ_LOG                  _IOWR_(HAILO_NNC_IOCTL_MAGIC,  HAILO_READ_LOG_CODE,                   struct hailo_read_log_params)
+ #define HAILO_RESET_NN_CORE             _IO_(HAILO_NNC_IOCTL_MAGIC,    HAILO_RESET_NN_CORE_CODE)
++#define HAILO_WRITE_ACTION_LIST         _IOW_(HAILO_NNC_IOCTL_MAGIC,    HAILO_WRITE_ACTION_LIST_CODE,     struct hailo_write_action_list_params)
+ 
+ enum hailo_soc_ioctl_code {
+     HAILO_SOC_IOCTL_CONNECT_CODE,
+--- a/drivers/media/pci/hailo/common/hailo_resource.c
++++ b/drivers/media/pci/hailo/common/hailo_resource.c
+@@ -1,24 +1,31 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include "hailo_resource.h"
+ 
++#include "utils.h"
++
+ #include <linux/io.h>
+ #include <linux/errno.h>
+ #include <linux/types.h>
+ #include <linux/kernel.h>
+ 
++#define ALIGN_TO_32_BIT(addr) ((addr) & (~((uintptr_t)0x3)))
+ 
+ u8 hailo_resource_read8(struct hailo_resource *resource, size_t offset)
+ {
+-    return ioread8((u8*)resource->address + offset);
++    u32 val = ioread32((u8*)ALIGN_TO_32_BIT(resource->address + offset));
++    u64 offset_in_bits = BITS_IN_BYTE * ((resource->address + offset) - ALIGN_TO_32_BIT(resource->address + offset));
++    return (u8)READ_BITS_AT_OFFSET(BYTE_SIZE * BITS_IN_BYTE, offset_in_bits, val);
+ }
+ 
+ u16 hailo_resource_read16(struct hailo_resource *resource, size_t offset)
+ {
+-    return ioread16((u8*)resource->address + offset);
++    u32 val = ioread32((u8*)ALIGN_TO_32_BIT(resource->address + offset));
++    u64 offset_in_bits = BITS_IN_BYTE * ((resource->address + offset) - ALIGN_TO_32_BIT(resource->address + offset));
++    return (u16)READ_BITS_AT_OFFSET(WORD_SIZE * BITS_IN_BYTE, offset_in_bits, val);
+ }
+ 
+ u32 hailo_resource_read32(struct hailo_resource *resource, size_t offset)
+@@ -28,12 +35,18 @@ u32 hailo_resource_read32(struct hailo_r
+ 
+ void hailo_resource_write8(struct hailo_resource *resource, size_t offset, u8 value)
+ {
+-    iowrite8(value, (u8*)resource->address + offset);
++    u32 initial_val = ioread32((u8*)ALIGN_TO_32_BIT(resource->address + offset));
++    u64 offset_in_bits = BITS_IN_BYTE * ((resource->address + offset) - ALIGN_TO_32_BIT(resource->address + offset));
++    iowrite32(WRITE_BITS_AT_OFFSET(BYTE_SIZE * BITS_IN_BYTE, offset_in_bits, initial_val, value),
++        (u8*)ALIGN_TO_32_BIT(resource->address + offset));
+ }
+ 
+ void hailo_resource_write16(struct hailo_resource *resource, size_t offset, u16 value)
+ {
+-    iowrite16(value, (u8*)resource->address + offset);
++    u32 initial_val = ioread32((u8*)ALIGN_TO_32_BIT(resource->address + offset));
++    u64 offset_in_bits = BITS_IN_BYTE * ((resource->address + offset) - ALIGN_TO_32_BIT(resource->address + offset));
++    iowrite32(WRITE_BITS_AT_OFFSET(WORD_SIZE * BITS_IN_BYTE, offset_in_bits, initial_val, value),
++        (u8*)ALIGN_TO_32_BIT(resource->address + offset));
+ }
+ 
+ void hailo_resource_write32(struct hailo_resource *resource, size_t offset, u32 value)
+--- a/drivers/media/pci/hailo/common/hailo_resource.h
++++ b/drivers/media/pci/hailo/common/hailo_resource.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_COMMON_HAILO_RESOURCE_H_
+--- a/drivers/media/pci/hailo/common/pcie_common.c
++++ b/drivers/media/pci/hailo/common/pcie_common.c
+@@ -1,10 +1,11 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include "pcie_common.h"
+ #include "fw_operation.h"
++#include "soc_structs.h"
+ 
+ #include <linux/errno.h>
+ #include <linux/bug.h>
+@@ -35,10 +36,6 @@
+ #define FIRMWARE_LOAD_WAIT_MAX_RETRIES (100)
+ #define FIRMWARE_LOAD_SLEEP_MS         (50)
+ 
+-#define PCIE_APP_CPU_DEBUG_OFFSET (8*1024)
+-#define PCIE_CORE_CPU_DEBUG_OFFSET (PCIE_APP_CPU_DEBUG_OFFSET + DEBUG_BUFFER_TOTAL_SIZE)
+-
+-#define PCIE_D2H_NOTIFICATION_SRAM_OFFSET (0x640 + 0x640)
+ #define PCIE_REQUEST_SIZE_OFFSET (0x640)
+ 
+ #define PCIE_CONFIG_VENDOR_OFFSET (0x0098)
+@@ -59,7 +56,6 @@ struct hailo_fw_addresses {
+     u32 app_fw_code_ram_base;
+     u32 boot_key_cert;
+     u32 boot_cont_cert;
+-    u32 boot_fw_trigger;
+     u32 core_code_ram_base;
+     u32 core_fw_header;
+     u32 atr0_trsl_addr1;
+@@ -69,13 +65,11 @@ struct hailo_fw_addresses {
+ 
+ struct loading_stage {
+     const struct hailo_file_batch *batch;
++    u32 trigger_address;
+ };
+ 
+ struct hailo_board_compatibility {
+     struct hailo_fw_addresses fw_addresses;
+-    const char *fw_filename;
+-    const struct hailo_config_constants board_cfg;
+-    const struct hailo_config_constants fw_cfg;
+     const struct loading_stage stages[MAX_LOADING_STAGES];
+ };
+ 
+@@ -85,28 +79,32 @@ static const struct hailo_file_batch hai
+         .address = 0xA0000,
+         .max_size = 0x8004,
+         .is_mandatory = true,
+-        .has_header = false
++        .has_header = false,
++        .has_core = false
+     },
+     {
+         .filename = "hailo/hailo10h/u-boot.dtb.signed",
+         .address = 0xA8004,
+         .max_size = 0x20000,
+         .is_mandatory = true,
+-        .has_header = false
++        .has_header = false,
++        .has_core = false
+     },
+     {
+         .filename = "hailo/hailo10h/scu_fw.bin",
+         .address = 0x20000,
+         .max_size = 0x40000,
+         .is_mandatory = true,
+-        .has_header = true
++        .has_header = true,
++        .has_core = false
+     },
+     {
+         .filename = NULL,
+         .address = 0x00,
+         .max_size = 0x00,
+         .is_mandatory = false,
+-        .has_header = false
++        .has_header = false,
++        .has_core = false
+     }
+ };
+ 
+@@ -116,36 +114,140 @@ static const struct hailo_file_batch hai
+         .address = 0x85000000,
+         .max_size = 0x1000000,
+         .is_mandatory = true,
+-        .has_header = false
++        .has_header = false,
++        .has_core = false
+     },
+     {
+         .filename = "hailo/hailo10h/u-boot-tfa.itb",
+         .address = 0x86000000,
+         .max_size = 0x1000000,
+         .is_mandatory = true,
+-        .has_header = false
++        .has_header = false,
++        .has_core = false
+     },
+     {
+         .filename = "hailo/hailo10h/fitImage",
+         .address = 0x87000000,
+         .max_size = 0x1000000,
+         .is_mandatory = true,
+-        .has_header = false
++        .has_header = false,
++        .has_core = false
+     },
+     {
+         .filename = "hailo/hailo10h/core-image-minimal-hailo10-m2.ext4.gz",
+         .address = 0x88000000,
+         .max_size = 0x20000000, // Max size 512MB
+         .is_mandatory = true,
+-        .has_header = false
++        .has_header = false,
++        .has_core = false
+     },
+ };
+ 
++// If loading linux from EMMC - only need few files from second batch (u-boot-spl.bin and u-boot-tfa.itb)
++static const struct hailo_file_batch hailo10h_files_stg2_linux_in_emmc[] = {
++    {
++        .filename = "hailo/hailo10h/u-boot-spl.bin",
++        .address = 0x85000000,
++        .max_size = 0x1000000,
++        .is_mandatory = true,
++        .has_header = false,
++        .has_core = false
++    },
++    {
++        .filename = "hailo/hailo10h/u-boot-tfa.itb",
++        .address = 0x86000000,
++        .max_size = 0x1000000,
++        .is_mandatory = true,
++        .has_header = false,
++        .has_core = false
++    },
++    {
++        .filename = NULL,
++        .address = 0x00,
++        .max_size = 0x00,
++        .is_mandatory = false,
++        .has_header = false,
++        .has_core = false
++    },
++};
++
++static const struct hailo_file_batch hailo8_files_stg1[] = {
++    {
++        .filename = "hailo/hailo8_fw.4.19.0.bin",
++        .address = 0x20000,
++        .max_size = 0x50000,
++        .is_mandatory = true,
++        .has_header = true,
++        .has_core = true
++    },
++    {
++        .filename = "hailo/hailo8_board_cfg.bin",
++        .address = 0x60001000,
++        .max_size = PCIE_HAILO8_BOARD_CFG_MAX_SIZE,
++        .is_mandatory = false,
++        .has_header = false,
++        .has_core = false
++    },
++    {
++        .filename = "hailo/hailo8_fw_cfg.bin",
++        .address = 0x60001500,
++        .max_size = PCIE_HAILO8_FW_CFG_MAX_SIZE,
++        .is_mandatory = false,
++        .has_header = false,
++        .has_core = false
++    },
++    {
++        .filename = NULL,
++        .address = 0x00,
++        .max_size = 0x00,
++        .is_mandatory = false,
++        .has_header = false,
++        .has_core = false
++    }
++};
++
++static const struct hailo_file_batch hailo10h_legacy_files_stg1[] = {
++    {
++        .filename = "hailo/hailo15_fw.bin",
++        .address = 0x20000,
++        .max_size = 0x100000,
++        .is_mandatory = true,
++        .has_header = true,
++        .has_core = true
++    },
++    {
++        .filename = NULL,
++        .address = 0x00,
++        .max_size = 0x00,
++        .is_mandatory = false,
++        .has_header = false,
++        .has_core = false
++    }
++};
++
++static const struct hailo_file_batch pluto_files_stg1[] = {
++    {
++        .filename = "hailo/pluto_fw.bin",
++        .address = 0x20000,
++        .max_size = 0x100000,
++        .is_mandatory = true,
++        .has_header = true,
++        .has_core = true
++    },
++    {
++        .filename = NULL,
++        .address = 0x00,
++        .max_size = 0x00,
++        .is_mandatory = false,
++        .has_header = false,
++        .has_core = false
++    }
++};
++
+ static const struct hailo_board_compatibility compat[HAILO_BOARD_TYPE_COUNT] = {
+     [HAILO_BOARD_TYPE_HAILO8] = {
+         .fw_addresses = {
+             .boot_fw_header = 0xE0030,
+-            .boot_fw_trigger = 0xE0980,
+             .boot_key_cert = 0xE0048,
+             .boot_cont_cert = 0xE0390,
+             .app_fw_code_ram_base = 0x60000,
+@@ -155,22 +257,16 @@ static const struct hailo_board_compatib
+             .raise_ready_offset = 0x1684,
+             .boot_status = 0xe0000,
+         },
+-        .fw_filename = "hailo/hailo8_fw.bin",
+-        .board_cfg = {
+-            .filename = "hailo/hailo8_board_cfg.bin",
+-            .address = 0x60001000,
+-            .max_size = PCIE_HAILO8_BOARD_CFG_MAX_SIZE,
+-        },
+-        .fw_cfg = {
+-            .filename = "hailo/hailo8_fw_cfg.bin",
+-            .address = 0x60001500,
+-            .max_size = PCIE_HAILO8_FW_CFG_MAX_SIZE,
++        .stages = {
++            {
++                .batch = hailo8_files_stg1,
++                .trigger_address = 0xE0980
++            },
+         },
+     },
+     [HAILO_BOARD_TYPE_HAILO10H_LEGACY] = {
+         .fw_addresses = {
+             .boot_fw_header = 0x88000,
+-            .boot_fw_trigger = 0x88c98,
+             .boot_key_cert = 0x88018,
+             .boot_cont_cert = 0x886a8,
+             .app_fw_code_ram_base = 0x20000,
+@@ -180,22 +276,16 @@ static const struct hailo_board_compatib
+             .raise_ready_offset = 0x1754,
+             .boot_status = 0x80000,
+         },
+-        .fw_filename = "hailo/hailo15_fw.bin",
+-        .board_cfg = {
+-            .filename = NULL,
+-            .address = 0,
+-            .max_size = 0,
+-        },
+-        .fw_cfg = {
+-            .filename = NULL,
+-            .address = 0,
+-            .max_size = 0,
++        .stages = {
++            {
++                .batch = hailo10h_legacy_files_stg1,
++                .trigger_address = 0x88c98
++            },
+         },
+     },
+     [HAILO_BOARD_TYPE_HAILO10H] = {
+         .fw_addresses = {
+             .boot_fw_header = 0x88000,
+-            .boot_fw_trigger = 0x88c98,
+             .boot_key_cert = 0x88018,
+             .boot_cont_cert = 0x886a8,
+             .app_fw_code_ram_base = 0x20000,
+@@ -205,23 +295,18 @@ static const struct hailo_board_compatib
+             .raise_ready_offset = 0x1754,
+             .boot_status = 0x80000,
+         },
+-        .fw_filename = NULL,
+-        .board_cfg = {
+-            .filename = NULL,
+-            .address = 0,
+-            .max_size = 0,
+-        },
+-        .fw_cfg = {
+-            .filename = NULL,
+-            .address = 0,
+-            .max_size = 0,
+-        },
+         .stages = {
+             {
+                 .batch = hailo10h_files_stg1,
++                .trigger_address = 0x88c98
+             },
+             {
+                 .batch = hailo10h_files_stg2,
++                .trigger_address = 0x84000000
++            },
++            {
++                .batch = hailo10h_files_stg2_linux_in_emmc,
++                .trigger_address = 0x84000000
+             },
+         },
+     },
+@@ -230,7 +315,6 @@ static const struct hailo_board_compatib
+     [HAILO_BOARD_TYPE_PLUTO] = {
+         .fw_addresses = {
+             .boot_fw_header = 0x88000,
+-            .boot_fw_trigger = 0x88c98,
+             .boot_key_cert = 0x88018,
+             .boot_cont_cert = 0x886a8,
+             .app_fw_code_ram_base = 0x20000,
+@@ -241,16 +325,11 @@ static const struct hailo_board_compatib
+             .raise_ready_offset = 0x174c,
+             .boot_status = 0x80000,
+         },
+-        .fw_filename = "hailo/pluto_fw.bin",
+-        .board_cfg = {
+-            .filename = NULL,
+-            .address = 0,
+-            .max_size = 0,
+-        },
+-        .fw_cfg = {
+-            .filename = NULL,
+-            .address = 0,
+-            .max_size = 0,
++        .stages = {
++            {
++                .batch = pluto_files_stg1,
++                .trigger_address = 0x88c98
++            },
+         },
+     }
+ };
+@@ -340,21 +419,6 @@ void hailo_pcie_write_firmware_driver_sh
+     hailo_resource_write32(&resources->fw_access, fw_addresses->raise_ready_offset, fw_access_value);
+ }
+ 
+-int hailo_pcie_read_firmware_notification(struct hailo_pcie_resources *resources,
+-    struct hailo_d2h_notification *notification)
+-{
+-    struct hailo_resource notification_resource;
+-
+-    if (PCIE_D2H_NOTIFICATION_SRAM_OFFSET > resources->fw_access.size) {
+-        return -EINVAL;
+-    }
+-
+-    notification_resource.address = resources->fw_access.address + PCIE_D2H_NOTIFICATION_SRAM_OFFSET,
+-    notification_resource.size = sizeof(struct hailo_d2h_notification);
+-
+-    return hailo_read_firmware_notification(&notification_resource, notification);
+-}
+-
+ int hailo_pcie_configure_atr_table(struct hailo_resource *bridge_config, u64 trsl_addr, u32 atr_index)
+ {
+     size_t offset = 0;
+@@ -388,7 +452,7 @@ static void write_memory_chunk(struct ha
+     u32 ATR_INDEX = 0;
+     BUG_ON(dest_offset + len > (u32)resources->fw_access.size);
+ 
+-    (void)hailo_pcie_configure_atr_table(&resources->config, (u64)dest, ATR_INDEX);
++    (void)hailo_pcie_configure_atr_table(&resources->config, dest, ATR_INDEX);
+     (void)hailo_resource_write_buffer(&resources->fw_access, dest_offset, len, src);
+ }
+ 
+@@ -398,13 +462,13 @@ static void read_memory_chunk(
+     u32 ATR_INDEX = 0;
+     BUG_ON(src_offset + len > (u32)resources->fw_access.size);
+ 
+-    (void)hailo_pcie_configure_atr_table(&resources->config, (u64)src, ATR_INDEX);
++    (void)hailo_pcie_configure_atr_table(&resources->config, src, ATR_INDEX);
+     (void)hailo_resource_read_buffer(&resources->fw_access, src_offset, len, dest);
+ }
+ 
+ // Note: this function modify the device ATR table (that is also used by the firmware for control and vdma).
+ // Use with caution, and restore the original atr if needed.
+-void write_memory(struct hailo_pcie_resources *resources, hailo_ptr_t dest, const void *src, u32 len)
++static void write_memory(struct hailo_pcie_resources *resources, hailo_ptr_t dest, const void *src, u32 len)
+ {
+     struct hailo_atr_config previous_atr = {0};
+     hailo_ptr_t base_address = (dest & ~ATR_TABLE_SIZE_MASK);
+@@ -417,8 +481,8 @@ void write_memory(struct hailo_pcie_reso
+ 
+     if (base_address != dest) {
+         // Data is not aligned, write the first chunk
+-        chunk_len = min(base_address + ATR_TABLE_SIZE - dest, len);
+-        write_memory_chunk(resources, base_address, dest - base_address, src, chunk_len);
++        chunk_len = min((u32)(base_address + ATR_TABLE_SIZE - dest), len);
++        write_memory_chunk(resources, base_address, (u32)(dest - base_address), src, chunk_len);
+         offset += chunk_len;
+     }
+ 
+@@ -447,8 +511,8 @@ static void read_memory(struct hailo_pci
+ 
+     if (base_address != src) {
+         // Data is not aligned, write the first chunk
+-        chunk_len = min(base_address + ATR_TABLE_SIZE - src, len);
+-        read_memory_chunk(resources, base_address, src - base_address, dest, chunk_len);
++        chunk_len = min((u32)(base_address + ATR_TABLE_SIZE - src), len);
++        read_memory_chunk(resources, base_address, (u32)(src - base_address), dest, chunk_len);
+         offset += chunk_len;
+     }
+ 
+@@ -463,12 +527,12 @@ static void read_memory(struct hailo_pci
+ }
+ 
+ static void hailo_write_app_firmware(struct hailo_pcie_resources *resources, firmware_header_t *fw_header,
+-    secure_boot_certificate_t *fw_cert)
++    secure_boot_certificate_header_t *fw_cert)
+ {
+     const struct hailo_fw_addresses *fw_addresses = &(compat[resources->board_type].fw_addresses);
+-    void *fw_code = (void*)((u8*)fw_header + sizeof(firmware_header_t));
+-    void *key_data = &fw_cert->certificates_data[0];
+-    void *content_data = &fw_cert->certificates_data[fw_cert->key_size];
++    u8 *fw_code = ((u8*)fw_header + sizeof(firmware_header_t));
++    u8 *key_data = ((u8*)fw_cert + sizeof(secure_boot_certificate_header_t));
++    u8 *content_data = key_data + fw_cert->key_size;
+ 
+     write_memory(resources, fw_addresses->boot_fw_header, fw_header, sizeof(firmware_header_t));
+ 
+@@ -487,13 +551,11 @@ static void hailo_write_core_firmware(st
+     write_memory(resources, fw_addresses->core_fw_header, fw_header, sizeof(firmware_header_t));
+ }
+ 
+-void hailo_trigger_firmware_boot(struct hailo_pcie_resources *resources)
++void hailo_trigger_firmware_boot(struct hailo_pcie_resources *resources, u32 address)
+ {
+-    const struct hailo_fw_addresses *fw_addresses = &(compat[resources->board_type].fw_addresses);
+     u32 pcie_finished = 1;
+ 
+-    write_memory(resources, fw_addresses->boot_fw_trigger,
+-        (void*)&pcie_finished, sizeof(pcie_finished));
++    write_memory(resources, address, (void*)&pcie_finished, sizeof(pcie_finished));
+ }
+ 
+ u32 hailo_get_boot_status(struct hailo_pcie_resources *resources)
+@@ -501,8 +563,7 @@ u32 hailo_get_boot_status(struct hailo_p
+     u32 boot_status = 0;
+     const struct hailo_fw_addresses *fw_addresses = &(compat[resources->board_type].fw_addresses);
+ 
+-    read_memory(resources, fw_addresses->boot_status,
+-        &boot_status, sizeof(boot_status));
++    read_memory(resources, fw_addresses->boot_status, &boot_status, sizeof(boot_status));
+ 
+     return boot_status;
+ }
+@@ -517,11 +578,11 @@ u32 hailo_get_boot_status(struct hailo_p
+ */
+ static int FW_VALIDATION__validate_fw_headers(uintptr_t firmware_base_address, size_t firmware_size,
+     firmware_header_t **out_app_firmware_header, firmware_header_t **out_core_firmware_header,
+-    secure_boot_certificate_t **out_firmware_cert, enum hailo_board_type board_type)
++    secure_boot_certificate_header_t **out_firmware_cert, enum hailo_board_type board_type)
+ {
+     firmware_header_t *app_firmware_header = NULL;
+     firmware_header_t *core_firmware_header = NULL;
+-    secure_boot_certificate_t *firmware_cert = NULL;
++    secure_boot_certificate_header_t *firmware_cert = NULL;
+     int err = -EINVAL;
+     u32 consumed_firmware_offset = 0;
+ 
+@@ -571,25 +632,25 @@ exit:
+     return err;
+ }
+ 
+-static int write_single_file(struct hailo_pcie_resources *resources, const struct hailo_file_batch *files_batch, struct device *dev)
++static int write_single_file(struct hailo_pcie_resources *resources, const struct hailo_file_batch *file_info, struct device *dev)
+ {
+     const struct firmware *firmware = NULL;
+     firmware_header_t *app_firmware_header = NULL;
+-    secure_boot_certificate_t *firmware_cert = NULL;
++    secure_boot_certificate_header_t *firmware_cert = NULL;
+     firmware_header_t *core_firmware_header = NULL;
+     int err = 0;
+ 
+-    err = request_firmware_direct(&firmware, files_batch->filename, dev);
++    err = request_firmware_direct(&firmware, file_info->filename, dev);
+     if (err < 0) {
+         return err;
+     }
+ 
+-    if (firmware->size > files_batch->max_size) {
++    if (firmware->size > file_info->max_size) {
+         release_firmware(firmware);
+         return -EFBIG;
+     }
+ 
+-    if (files_batch->has_header) {
++    if (file_info->has_header) {
+         err = FW_VALIDATION__validate_fw_headers((uintptr_t)firmware->data, firmware->size,
+             &app_firmware_header, &core_firmware_header, &firmware_cert, resources->board_type);
+         if (err < 0) {
+@@ -598,8 +659,11 @@ static int write_single_file(struct hail
+         }
+ 
+         hailo_write_app_firmware(resources, app_firmware_header, firmware_cert);
++        if (file_info->has_core) {
++            hailo_write_core_firmware(resources, core_firmware_header);
++        }
+     } else {
+-        write_memory(resources, files_batch->address, (void*)firmware->data, firmware->size);
++        write_memory(resources, file_info->address, (void*)firmware->data, firmware->size);
+     }
+ 
+     release_firmware(firmware);
+@@ -632,31 +696,13 @@ int hailo_pcie_write_firmware_batch(stru
+         dev_notice(dev, "File %s written successfully\n", files_batch[file_index].filename);
+     }
+ 
+-    return 0;
+-}
+-
+-int hailo_pcie_write_firmware(struct hailo_pcie_resources *resources, const void *fw_data, size_t fw_size)
+-{
+-    firmware_header_t *app_firmware_header = NULL;
+-    secure_boot_certificate_t *firmware_cert = NULL;
+-    firmware_header_t *core_firmware_header = NULL;
+-
+-    int err = FW_VALIDATION__validate_fw_headers((uintptr_t)fw_data, fw_size,
+-        &app_firmware_header, &core_firmware_header, &firmware_cert, resources->board_type);
+-    if (err < 0) {
+-        return err;
+-    }
+-
+-    hailo_write_app_firmware(resources, app_firmware_header, firmware_cert);
+-    hailo_write_core_firmware(resources, core_firmware_header);
+-
+-    hailo_trigger_firmware_boot(resources);
++    hailo_trigger_firmware_boot(resources, compat[resources->board_type].stages[stage].trigger_address);
+ 
+     return 0;
+ }
+ 
+ // TODO: HRT-14147 - remove this function
+-bool hailo_pcie_is_device_ready_for_boot(struct hailo_pcie_resources *resources)
++static bool hailo_pcie_is_device_ready_for_boot(struct hailo_pcie_resources *resources)
+ {
+     return hailo_get_boot_status(resources) == BOOT_STATUS_UNINITIALIZED;
+ }
+@@ -691,32 +737,6 @@ bool hailo_pcie_wait_for_firmware(struct
+     return false;
+ }
+ 
+-int hailo_pcie_write_config_common(struct hailo_pcie_resources *resources, const void* config_data,
+-    const size_t config_size, const struct hailo_config_constants *config_consts)
+-{
+-    if (config_size > config_consts->max_size) {
+-        return -EINVAL;
+-    }
+-
+-    write_memory(resources, config_consts->address, config_data, (u32)config_size);
+-    return 0;
+-}
+-
+-const struct hailo_config_constants* hailo_pcie_get_board_config_constants(const enum hailo_board_type board_type) {
+-    BUG_ON(board_type >= HAILO_BOARD_TYPE_COUNT || board_type < 0);
+-    return &compat[board_type].board_cfg;
+-}
+-
+-const struct hailo_config_constants* hailo_pcie_get_user_config_constants(const enum hailo_board_type board_type) {
+-    BUG_ON(board_type >= HAILO_BOARD_TYPE_COUNT || board_type < 0);
+-    return &compat[board_type].fw_cfg;
+-}
+-
+-const char* hailo_pcie_get_fw_filename(const enum hailo_board_type board_type) {
+-    BUG_ON(board_type >= HAILO_BOARD_TYPE_COUNT || board_type < 0);
+-    return compat[board_type].fw_filename;
+-}
+-
+ void hailo_pcie_update_channel_interrupts_mask(struct hailo_pcie_resources* resources, u32 channels_bitmap)
+ {
+     size_t i = 0;
+@@ -745,7 +765,7 @@ void hailo_pcie_enable_interrupts(struct
+     hailo_resource_write32(&resources->config, BCS_SOURCE_INTERRUPT_PER_CHANNEL, 0xFFFFFFFF);
+ 
+     mask |= (BCS_ISTATUS_HOST_FW_IRQ_CONTROL_MASK | BCS_ISTATUS_HOST_FW_IRQ_NOTIFICATION |
+-        BCS_ISTATUS_HOST_DRIVER_DOWN | BCS_ISTATUS_SOC_CONNECT_ACCEPTED);
++        BCS_ISTATUS_HOST_DRIVER_DOWN | BCS_ISTATUS_SOC_CONNECT_ACCEPTED | BCS_ISTATUS_SOC_CLOSED_IRQ);
+     hailo_resource_write32(&resources->config, BSC_IMASK_HOST, mask);
+ }
+ 
+@@ -754,45 +774,15 @@ void hailo_pcie_disable_interrupts(struc
+     hailo_resource_write32(&resources->config, BSC_IMASK_HOST, 0);
+ }
+ 
+-long hailo_pcie_read_firmware_log(struct hailo_pcie_resources *resources, struct hailo_read_log_params *params)
+-{
+-    long err = 0;
+-    struct hailo_resource log_resource = {resources->fw_access.address, DEBUG_BUFFER_TOTAL_SIZE};
+-
+-    if (HAILO_CPU_ID_CPU0 == params->cpu_id) {
+-        log_resource.address += PCIE_APP_CPU_DEBUG_OFFSET;
+-    } else if (HAILO_CPU_ID_CPU1 == params->cpu_id) {
+-        log_resource.address += PCIE_CORE_CPU_DEBUG_OFFSET;
+-    } else {
+-        return -EINVAL;
+-    }
+-
+-    if (0 == params->buffer_size) {
+-        params->read_bytes = 0;
+-        return 0;
+-    }
+-
+-    err = hailo_read_firmware_log(&log_resource, params);
+-    if (0 != err) {
+-        return err;
+-    }
+-
+-    return 0;
+-}
+-
+ static int direct_memory_transfer(struct hailo_pcie_resources *resources,
+     struct hailo_memory_transfer_params *params)
+ {
+-    if (params->address > U32_MAX) {
+-        return -EFAULT;
+-    }
+-
+     switch (params->transfer_direction) {
+     case TRANSFER_READ:
+-        read_memory(resources, (u32)params->address, params->buffer, (u32)params->count);
++        read_memory(resources, params->address, params->buffer, (u32)params->count);
+         break;
+     case TRANSFER_WRITE:
+-        write_memory(resources, (u32)params->address, params->buffer, (u32)params->count);
++        write_memory(resources, params->address, params->buffer, (u32)params->count);
+         break;
+     default:
+         return -EINVAL;
+@@ -845,16 +835,18 @@ int hailo_set_device_type(struct hailo_p
+     return 0;
+ }
+ 
+-// On PCIe, just return the address
+-static u64 encode_dma_address(dma_addr_t dma_address, u8 channel_id)
++// On PCIe, just return the start address
++u64 hailo_pcie_encode_desc_dma_address_range(dma_addr_t dma_address_start, dma_addr_t dma_address_end, u32 step, u8 channel_id)
+ {
+     (void)channel_id;
+-    return (u64)dma_address;
++    (void)dma_address_end;
++    (void)step;
++    return (u64)dma_address_start;
+ }
+ 
+ struct hailo_vdma_hw hailo_pcie_vdma_hw = {
+     .hw_ops = {
+-        .encode_desc_dma_address = encode_dma_address
++        .encode_desc_dma_address_range = hailo_pcie_encode_desc_dma_address_range,
+     },
+     .ddr_data_id = HAILO_PCIE_HOST_DMA_DATA_ID,
+     .device_interrupts_bitmask = HAILO_PCIE_DMA_DEVICE_INTERRUPTS_BITMASK,
+@@ -862,11 +854,19 @@ struct hailo_vdma_hw hailo_pcie_vdma_hw
+     .src_channels_bitmask = HAILO_PCIE_DMA_SRC_CHANNELS_BITMASK,
+ };
+ 
+-void hailo_soc_write_soc_connect(struct hailo_pcie_resources *resources)
++void hailo_pcie_soc_write_request(struct hailo_pcie_resources *resources,
++    const struct hailo_pcie_soc_request *request)
+ {
+     const struct hailo_fw_addresses *fw_addresses = &(compat[resources->board_type].fw_addresses);
+-    const u32 soc_connect_value = FW_ACCESS_SOC_CONNECT_MASK;
++    BUILD_BUG_ON_MSG((sizeof(*request) % sizeof(u32)) != 0, "Request must be a multiple of 4 bytes");
+ 
+-    // Write shutdown flag to FW
+-    hailo_resource_write32(&resources->fw_access, fw_addresses->raise_ready_offset, soc_connect_value);
+-}
+\ No newline at end of file
++    hailo_resource_write_buffer(&resources->fw_access, 0, sizeof(*request), (void*)request);
++    hailo_resource_write32(&resources->fw_access, fw_addresses->raise_ready_offset, FW_ACCESS_SOC_CONTROL_MASK);
++}
++
++void hailo_pcie_soc_read_response(struct hailo_pcie_resources *resources,
++    struct hailo_pcie_soc_response *response)
++{
++    BUILD_BUG_ON_MSG((sizeof(*response) % sizeof(u32)) != 0, "Request must be a multiple of 4 bytes");
++    hailo_resource_read_buffer(&resources->fw_access, 0, sizeof(*response), response);
++}
+--- a/drivers/media/pci/hailo/common/pcie_common.h
++++ b/drivers/media/pci/hailo/common/pcie_common.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_COMMON_PCIE_COMMON_H_
+@@ -12,6 +12,7 @@
+ #include "fw_operation.h"
+ #include "utils.h"
+ #include "vdma_common.h"
++#include "soc_structs.h"
+ 
+ #include <linux/types.h>
+ #include <linux/firmware.h>
+@@ -21,6 +22,7 @@
+ #define BCS_ISTATUS_HOST_FW_IRQ_NOTIFICATION (0x02000000)
+ #define BCS_ISTATUS_HOST_DRIVER_DOWN         (0x08000000)
+ #define BCS_ISTATUS_SOC_CONNECT_ACCEPTED     (0x10000000)
++#define BCS_ISTATUS_SOC_CLOSED_IRQ           (0x20000000)
+ #define BCS_ISTATUS_HOST_VDMA_SRC_IRQ_MASK   (0x000000FF)
+ #define BCS_ISTATUS_HOST_VDMA_DEST_IRQ_MASK  (0x0000FF00)
+ 
+@@ -42,7 +44,7 @@
+ #define PCI_DEVICE_ID_HAILO_HAILO15   0x45C4
+ #define PCI_DEVICE_ID_HAILO_PLUTO     0x43a2
+ 
+-typedef u32 hailo_ptr_t;
++typedef u64 hailo_ptr_t;
+ 
+ struct hailo_pcie_resources {
+     struct hailo_resource config;               // BAR0
+@@ -63,7 +65,8 @@ struct hailo_atr_config {
+ enum loading_stages {
+     FIRST_STAGE = 0,
+     SECOND_STAGE = 1,
+-    MAX_LOADING_STAGES = 2
++    SECOND_STAGE_LINUX_IN_EMMC = 2,
++    MAX_LOADING_STAGES = 3
+ };
+ 
+ enum hailo_pcie_interrupt_masks {
+@@ -71,6 +74,7 @@ enum hailo_pcie_interrupt_masks {
+     FW_NOTIFICATION = BCS_ISTATUS_HOST_FW_IRQ_NOTIFICATION,
+     DRIVER_DOWN = BCS_ISTATUS_HOST_DRIVER_DOWN,
+     SOC_CONNECT_ACCEPTED = BCS_ISTATUS_SOC_CONNECT_ACCEPTED,
++    SOC_CLOSED_IRQ = BCS_ISTATUS_SOC_CLOSED_IRQ,
+     VDMA_SRC_IRQ_MASK = BCS_ISTATUS_HOST_VDMA_SRC_IRQ_MASK,
+     VDMA_DEST_IRQ_MASK = BCS_ISTATUS_HOST_VDMA_DEST_IRQ_MASK
+ };
+@@ -80,18 +84,13 @@ struct hailo_pcie_interrupt_source {
+     u32 vdma_channels_bitmap;
+ };
+ 
+-struct hailo_config_constants {
+-    const char *filename;
+-    u32 address;
+-    size_t max_size;
+-};
+-
+ struct hailo_file_batch {
+     const char *filename;
+     u32 address;
+     size_t max_size;
+     bool is_mandatory;
+     bool has_header;
++    bool has_core;
+ };
+ 
+ // TODO: HRT-6144 - Align Windows/Linux to QNX
+@@ -130,27 +129,15 @@ void hailo_pcie_disable_interrupts(struc
+ int hailo_pcie_write_firmware_control(struct hailo_pcie_resources *resources, const struct hailo_fw_control *command);
+ int hailo_pcie_read_firmware_control(struct hailo_pcie_resources *resources, struct hailo_fw_control *command);
+ 
+-int hailo_pcie_write_firmware(struct hailo_pcie_resources *resources, const void *fw_data, size_t fw_size);
+ int hailo_pcie_write_firmware_batch(struct device *dev, struct hailo_pcie_resources *resources, u32 stage);
+ bool hailo_pcie_is_firmware_loaded(struct hailo_pcie_resources *resources);
+ bool hailo_pcie_wait_for_firmware(struct hailo_pcie_resources *resources);
+ 
+-int hailo_pcie_read_firmware_notification(struct hailo_pcie_resources *resources,
+-    struct hailo_d2h_notification *notification);
+-
+-int hailo_pcie_write_config_common(struct hailo_pcie_resources *resources, const void* config_data,
+-    const size_t config_size, const struct hailo_config_constants *config_consts);
+-const struct hailo_config_constants* hailo_pcie_get_board_config_constants(const enum hailo_board_type board_type);
+-const struct hailo_config_constants* hailo_pcie_get_user_config_constants(const enum hailo_board_type board_type);
+-const char* hailo_pcie_get_fw_filename(const enum hailo_board_type board_type);
+-
+-long hailo_pcie_read_firmware_log(struct hailo_pcie_resources *resources, struct hailo_read_log_params *params);
+ int hailo_pcie_memory_transfer(struct hailo_pcie_resources *resources, struct hailo_memory_transfer_params *params);
+ 
+ bool hailo_pcie_is_device_connected(struct hailo_pcie_resources *resources);
+ void hailo_pcie_write_firmware_driver_shutdown(struct hailo_pcie_resources *resources);
+-void write_memory(struct hailo_pcie_resources *resources, hailo_ptr_t dest, const void *src, u32 len);
+-void hailo_trigger_firmware_boot(struct hailo_pcie_resources *resources);
++void hailo_trigger_firmware_boot(struct hailo_pcie_resources *resources, u32 address);
+ 
+ int hailo_set_device_type(struct hailo_pcie_resources *resources);
+ 
+@@ -159,7 +146,12 @@ u32 hailo_get_boot_status(struct hailo_p
+ int hailo_pcie_configure_atr_table(struct hailo_resource *bridge_config, u64 trsl_addr, u32 atr_index);
+ void hailo_pcie_read_atr_table(struct hailo_resource *bridge_config, struct hailo_atr_config *atr, u32 atr_index);
+ 
+-void hailo_soc_write_soc_connect(struct hailo_pcie_resources *resources);
++u64 hailo_pcie_encode_desc_dma_address_range(dma_addr_t dma_address_start, dma_addr_t dma_address_end, u32 step, u8 channel_id);
++
++void hailo_pcie_soc_write_request(struct hailo_pcie_resources *resources,
++    const struct hailo_pcie_soc_request *request);
++void hailo_pcie_soc_read_response(struct hailo_pcie_resources *resources,
++    struct hailo_pcie_soc_response *response);
+ 
+ #ifdef __cplusplus
+ }
+--- /dev/null
++++ b/drivers/media/pci/hailo/common/soc_structs.h
+@@ -0,0 +1,79 @@
++// SPDX-License-Identifier: MIT
++/**
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
++ **/
++/**
++ * Contains definitions for pcie soc to pcie ep communication
++ */
++
++#ifndef __HAILO_COMMON_SOC_STRUCTS__
++#define __HAILO_COMMON_SOC_STRUCTS__
++
++#include <linux/types.h>
++
++#pragma pack(push, 1)
++
++struct hailo_pcie_soc_connect_request {
++    u16 port;
++};
++
++struct hailo_pcie_soc_connect_response {
++    u8 input_channel_index;
++    u8 output_channel_index;
++};
++
++
++struct hailo_pcie_soc_close_request {
++    u32 channels_bitmap;
++};
++
++struct hailo_pcie_soc_close_response {
++    u8 reserved;
++};
++
++enum hailo_pcie_soc_control_code {
++    // Start from big initial value to ensure the right code was used (using 0
++    // as initiale may cause confusion if the code was not set correctly).
++    HAILO_PCIE_SOC_CONTROL_CODE_CONNECT = 0x100,
++    HAILO_PCIE_SOC_CONTROL_CODE_CLOSE,
++    HAILO_PCIE_SOC_CONTROL_CODE_INVALID,
++};
++
++#define HAILO_PCIE_SOC_MAX_REQUEST_SIZE_BYTES  (16)
++#define HAILO_PCIE_SOC_MAX_RESPONSE_SIZE_BYTES (16)
++
++// IRQ to signal the PCIe that the EP was closed/released
++#define PCI_EP_SOC_CLOSED_IRQ       (0x00000020)
++#define PCI_EP_SOC_CONNECT_RESPONSE (0x00000010)
++
++struct hailo_pcie_soc_request {
++    u32 control_code;
++    union {
++        struct hailo_pcie_soc_connect_request connect;
++        struct hailo_pcie_soc_close_request close;
++        u8 pad[HAILO_PCIE_SOC_MAX_REQUEST_SIZE_BYTES];
++    };
++};
++
++struct hailo_pcie_soc_response {
++    u32 control_code;
++    s32 status;
++    union {
++        struct hailo_pcie_soc_connect_response connect;
++        struct hailo_pcie_soc_close_response close;
++        u8 pad[HAILO_PCIE_SOC_MAX_RESPONSE_SIZE_BYTES];
++    };
++};
++
++#pragma pack(pop)
++
++// Compile time validate function. Don't need to call it.
++static inline void __validate_soc_struct_sizes(void)
++{
++    BUILD_BUG_ON_MSG(sizeof(struct hailo_pcie_soc_request) !=
++        sizeof(u32) + HAILO_PCIE_SOC_MAX_REQUEST_SIZE_BYTES, "Invalid request size");
++    BUILD_BUG_ON_MSG(sizeof(struct hailo_pcie_soc_response) !=
++        sizeof(u32) + sizeof(s32) + HAILO_PCIE_SOC_MAX_RESPONSE_SIZE_BYTES, "Invalid response size");
++}
++
++#endif /* __HAILO_COMMON_SOC_STRUCTS__ */
+\ No newline at end of file
+--- a/drivers/media/pci/hailo/common/utils.h
++++ b/drivers/media/pci/hailo/common/utils.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_DRIVER_UTILS_H_
+@@ -8,6 +8,11 @@
+ 
+ #include <linux/bitops.h>
+ 
++#define DWORD_SIZE                  (4)
++#define WORD_SIZE                   (2)
++#define BYTE_SIZE                   (1)
++#define BITS_IN_BYTE                (8)
++
+ #define hailo_clear_bit(bit, pval)  { *(pval) &= ~(1 << bit); }
+ #define hailo_test_bit(pos,var_addr)  ((*var_addr) & (1<<(pos)))
+ 
+@@ -50,6 +55,22 @@ static inline uint8_t ceil_log2(uint32_t
+     return result;
+ }
+ 
++// Gets the nearest power of 2 >= value, for any value <= MAX_POWER_OF_2_VALUE. Otherwise POWER_OF_2_ERROR is returned.
++#define MAX_POWER_OF_2_VALUE (0x80000000)
++#define POWER_OF_2_ERROR ((uint32_t)-1)
++static inline uint32_t get_nearest_powerof_2(uint32_t value)
++{
++    uint32_t power_of_2 = 1;
++    if (value > MAX_POWER_OF_2_VALUE) {
++        return POWER_OF_2_ERROR;
++    }
++
++    while (value > power_of_2) {
++        power_of_2 <<=  1;
++    }
++    return power_of_2;
++}
++
+ #ifndef DIV_ROUND_UP
+ #define DIV_ROUND_UP(n,d) (((n) + (d) - 1) / (d))
+ #endif
+--- a/drivers/media/pci/hailo/common/vdma_common.c
++++ b/drivers/media/pci/hailo/common/vdma_common.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include "vdma_common.h"
+@@ -62,11 +62,6 @@
+ #define VDMA_CHANNEL_NUM_PROCESSED_MASK ((1 << VDMA_CHANNEL_NUM_PROCESSED_WIDTH) - 1)
+ #define VDMA_CHANNEL_NUM_ONGOING_MASK VDMA_CHANNEL_NUM_PROCESSED_MASK
+ 
+-#define DWORD_SIZE                  (4)
+-#define WORD_SIZE                   (2)
+-#define BYTE_SIZE                   (1)
+-#define BITS_IN_BYTE                (8)
+-
+ #define TIMESTAMPS_CIRC_SPACE(timestamp_list) \
+     CIRC_SPACE((timestamp_list).head, (timestamp_list).tail, CHANNEL_IRQ_TIMESTAMPS_SIZE)
+ #define TIMESTAMPS_CIRC_CNT(timestamp_list) \
+@@ -150,7 +145,7 @@ static bool validate_last_desc_status(st
+     return true;
+ }
+ 
+-void hailo_vdma_program_descriptor(struct hailo_vdma_descriptor *descriptor, u64 dma_address, size_t page_size,
++static void hailo_vdma_program_descriptor(struct hailo_vdma_descriptor *descriptor, u64 dma_address, size_t page_size,
+     u8 data_id)
+ {
+     descriptor->PageSize_DescControl = (u32)((page_size << DESCRIPTOR_PAGE_SIZE_SHIFT) +
+@@ -174,33 +169,45 @@ static int program_descriptors_in_chunk(
+     u32 max_desc_index,
+     u8 channel_id)
+ {
+-    const u32 desc_per_chunk = DIV_ROUND_UP(chunk_size, desc_list->desc_page_size);
++    const u16 page_size = desc_list->desc_page_size;
++    const u8 ddr_data_id = vdma_hw->ddr_data_id;
++    const u32 descs_to_program = DIV_ROUND_UP(chunk_size, page_size);
++    const u32 starting_desc_index = desc_index;
++    const u32 residue_size = chunk_size % page_size;
+     struct hailo_vdma_descriptor *dma_desc = NULL;
+-    u16 size_to_program = 0;
+-    u32 index = 0;
+     u64 encoded_addr = 0;
+ 
+-    for (index = 0; index < desc_per_chunk; index++) {
+-        if (desc_index > max_desc_index) {
+-            return -ERANGE;
+-        }
+-
+-        encoded_addr = vdma_hw->hw_ops.encode_desc_dma_address(chunk_addr, channel_id);
+-        if (INVALID_VDMA_ADDRESS == encoded_addr) {
+-            return -EFAULT;
+-        }
++    if (descs_to_program == 0) {
++        // Nothing to program
++        return 0;
++    }
+ 
+-        dma_desc = &desc_list->desc_list[desc_index % desc_list->desc_count];
+-        size_to_program = chunk_size > desc_list->desc_page_size ?
+-            desc_list->desc_page_size : (u16)chunk_size;
+-        hailo_vdma_program_descriptor(dma_desc, encoded_addr, size_to_program, vdma_hw->ddr_data_id);
++    // We iterate through descriptors [desc_index, desc_index + descs_to_program)
++    if (desc_index + descs_to_program > max_desc_index + 1) {
++        return -ERANGE;
++    }
+ 
+-        chunk_addr += size_to_program;
+-        chunk_size -= size_to_program;
+-        desc_index++;
++    encoded_addr = vdma_hw->hw_ops.encode_desc_dma_address_range(chunk_addr, chunk_addr + chunk_size, page_size, channel_id);
++    if (INVALID_VDMA_ADDRESS == encoded_addr) {
++        return -EFAULT;
+     }
+ 
+-    return (int)desc_per_chunk;
++    // Program all descriptors except the last one
++    for (desc_index = starting_desc_index; desc_index < starting_desc_index + descs_to_program - 1; desc_index++) {
++        // 'desc_index & desc_list_len_mask' is used instead of modulo; see hailo_vdma_descriptors_list documentation.
++        hailo_vdma_program_descriptor(
++            &desc_list->desc_list[desc_index & desc_list->desc_count_mask],
++            encoded_addr, page_size, ddr_data_id);
++        encoded_addr += page_size;
++    }
++
++    // Handle the last descriptor outside of the loop
++    // 'desc_index & desc_list_len_mask' is used instead of modulo; see hailo_vdma_descriptors_list documentation.
++    dma_desc = &desc_list->desc_list[desc_index & desc_list->desc_count_mask];
++    hailo_vdma_program_descriptor(dma_desc, encoded_addr,
++        (residue_size == 0) ? page_size : (u16)residue_size, ddr_data_id);
++
++    return (int)descs_to_program;
+ }
+ 
+ static unsigned long get_interrupts_bitmask(struct hailo_vdma_hw *vdma_hw,
+@@ -236,11 +243,11 @@ static int bind_and_program_descriptors_
+ {
+     const u8 channel_id = get_channel_id(channel_index);
+     int desc_programmed = 0;
++    int descs_programmed_in_chunk = 0;
+     u32 max_desc_index = 0;
+     u32 chunk_size = 0;
+     struct scatterlist *sg_entry = NULL;
+     unsigned int i = 0;
+-    int ret = 0;
+     size_t buffer_current_offset = 0;
+     dma_addr_t chunk_start_addr = 0;
+     u32 program_size = buffer->size;
+@@ -272,14 +279,14 @@ static int bind_and_program_descriptors_
+             (u32)(sg_dma_len(sg_entry));
+         chunk_size = min((u32)program_size, chunk_size);
+ 
+-        ret = program_descriptors_in_chunk(vdma_hw, chunk_start_addr, chunk_size, desc_list,
++        descs_programmed_in_chunk  = program_descriptors_in_chunk(vdma_hw, chunk_start_addr, chunk_size, desc_list,
+             starting_desc, max_desc_index, channel_id);
+-        if (ret < 0) {
+-            return ret;
++        if (descs_programmed_in_chunk < 0) {
++            return descs_programmed_in_chunk;
+         }
+ 
+-        desc_programmed += ret;
+-        starting_desc = starting_desc + ret;
++        desc_programmed += descs_programmed_in_chunk;
++        starting_desc = starting_desc + descs_programmed_in_chunk;
+         program_size -= chunk_size;
+         buffer_current_offset += sg_dma_len(sg_entry);
+     }
+@@ -583,21 +590,23 @@ void hailo_vdma_engine_disable_channels(
+     engine->enabled_channels &= ~bitmap;
+ 
+     for_each_vdma_channel(engine, channel, channel_index) {
+-        channel_state_init(&channel->state);
++        if (hailo_test_bit(channel_index, &bitmap)) {
++            channel_state_init(&channel->state);
+ 
+-        while (ONGOING_TRANSFERS_CIRC_CNT(channel->ongoing_transfers) > 0) {
+-            struct hailo_ongoing_transfer transfer;
+-            ongoing_transfer_pop(channel, &transfer);
+-
+-            if (channel->last_desc_list == NULL) {
+-                pr_err("Channel %d has ongoing transfers but no desc list\n", channel->index);
+-                continue;
++            while (ONGOING_TRANSFERS_CIRC_CNT(channel->ongoing_transfers) > 0) {
++                struct hailo_ongoing_transfer transfer;
++                ongoing_transfer_pop(channel, &transfer);
++
++                if (channel->last_desc_list == NULL) {
++                    pr_err("Channel %d has ongoing transfers but no desc list\n", channel->index);
++                    continue;
++                }
++
++                clear_dirty_descs(channel, &transfer);
+             }
+ 
+-            clear_dirty_descs(channel, &transfer);
++            channel->last_desc_list = NULL;
+         }
+-
+-        channel->last_desc_list = NULL;
+     }
+ }
+ 
+--- a/drivers/media/pci/hailo/common/vdma_common.h
++++ b/drivers/media/pci/hailo/common/vdma_common.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: MIT
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_COMMON_VDMA_COMMON_H_
+@@ -30,7 +30,13 @@ struct hailo_vdma_descriptor {
+ 
+ struct hailo_vdma_descriptors_list {
+     struct hailo_vdma_descriptor *desc_list;
+-    u32                           desc_count;  // Must be power of 2 if is_circular is set.
++    // Must be power of 2 if is_circular is set.
++    u32                           desc_count;
++    // The nearest power of 2 to desc_count (including desc_count), minus 1.
++    // * If the list is circular, then 'index & desc_count_mask' can be used instead of modulo.
++    // * Otherwise, we can't wrap around the list anyway. However, for any index < desc_count, 'index & desc_count_mask'
++    //   will return the same value.
++    u32                           desc_count_mask;
+     u16                           desc_page_size;
+     bool                          is_circular;
+ };
+@@ -113,9 +119,10 @@ struct hailo_vdma_engine {
+ };
+ 
+ struct hailo_vdma_hw_ops {
+-    // Accepts some dma_addr_t mapped to the device and encodes it using
+-    // hw specific encode. returns INVALID_VDMA_ADDRESS on failure.
+-    u64 (*encode_desc_dma_address)(dma_addr_t dma_address, u8 channel_id);
++    // Accepts start, end and step of an address range (of type  dma_addr_t).
++    // Returns the encoded base address or INVALID_VDMA_ADDRESS if the range/step is invalid.
++    // All addresses in the range of [returned_addr, returned_addr + step, returned_addr + 2*step, ..., dma_address_end) are valid.
++    u64 (*encode_desc_dma_address_range)(dma_addr_t dma_address_start, dma_addr_t dma_address_end, u32 step, u8 channel_id);
+ };
+ 
+ struct hailo_vdma_hw {
+@@ -136,12 +143,9 @@ struct hailo_vdma_hw {
+     for (index = 0, element = &array[index]; index < size; index++, element = &array[index])
+ 
+ #define for_each_vdma_channel(engine, channel, channel_index) \
+-    _for_each_element_array(engine->channels, MAX_VDMA_CHANNELS_PER_ENGINE,   \
++    _for_each_element_array((engine)->channels, MAX_VDMA_CHANNELS_PER_ENGINE,   \
+         channel, channel_index)
+ 
+-void hailo_vdma_program_descriptor(struct hailo_vdma_descriptor *descriptor, u64 dma_address, size_t page_size,
+-    u8 data_id);
+-
+ /**
+  * Program the given descriptors list to map the given buffer.
+  *
+--- a/drivers/media/pci/hailo/src/fops.c
++++ b/drivers/media/pci/hailo/src/fops.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include <linux/version.h>
+@@ -19,14 +19,14 @@
+ #include <linux/sched/signal.h>
+ #endif
+ 
+-#include "utils.h"
+ #include "fops.h"
+ #include "vdma_common.h"
+ #include "utils/logs.h"
+ #include "vdma/memory.h"
+ #include "vdma/ioctl.h"
+ #include "utils/compact.h"
+-#include "pci_soc_ioctl.h"
++#include "nnc.h"
++#include "soc.h"
+ 
+ 
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION( 4, 13, 0 )
+@@ -48,13 +48,6 @@
+ // On pcie driver there is only one dma engine
+ #define DEFAULT_VDMA_ENGINE_INDEX       (0)
+ 
+-#if !defined(HAILO_EMULATOR)
+-#define DEFAULT_SHUTDOWN_TIMEOUT_MS (5)
+-#else /* !defined(HAILO_EMULATOR) */
+-#define DEFAULT_SHUTDOWN_TIMEOUT_MS (1000)
+-#endif /* !defined(HAILO_EMULATOR) */
+-
+-static long hailo_add_notification_wait(struct hailo_pcie_board *board, struct file *filp);
+ 
+ static struct hailo_file_context *create_file_context(struct hailo_pcie_board *board, struct file *filp)
+ {
+@@ -124,7 +117,7 @@ int hailo_pcie_fops_open(struct inode *i
+ 
+     previous_power_state = pBoard->pDev->current_state;
+     if (PCI_D0 != previous_power_state) {
+-        hailo_info(pBoard, "Waking up board");
++        hailo_info(pBoard, "Waking up board change state from %d to PCI_D0\n", previous_power_state);
+         err = pci_set_power_state(pBoard->pDev, PCI_D0);
+         if (err < 0) {
+             hailo_err(pBoard, "Failed waking up board %d", err);
+@@ -148,7 +141,11 @@ int hailo_pcie_fops_open(struct inode *i
+         interrupts_enabled_by_filp = true;
+     }
+ 
+-    err = hailo_add_notification_wait(pBoard, filp);
++    if (pBoard->pcie_resources.accelerator_type == HAILO_ACCELERATOR_TYPE_NNC) {
++        err = hailo_nnc_file_context_init(pBoard, context);
++    } else {
++        err = hailo_soc_file_context_init(pBoard, context);
++    }
+     if (err < 0) {
+         goto l_release_irq;
+     }
+@@ -166,6 +163,7 @@ l_release_irq:
+ 
+ l_revert_power_state:
+     if (pBoard->pDev->current_state != previous_power_state) {
++        hailo_info(pBoard, "Power changing state from %d to %d\n", previous_power_state, pBoard->pDev->current_state);
+         if (pci_set_power_state(pBoard->pDev, previous_power_state) < 0) {
+             hailo_err(pBoard, "Failed setting power state back to %d\n", (int)previous_power_state);
+         }
+@@ -180,34 +178,6 @@ l_exit:
+     return err;
+ }
+ 
+-int hailo_pcie_driver_down(struct hailo_pcie_board *board)
+-{
+-    long completion_result = 0;
+-    int err = 0;
+-
+-    reinit_completion(&board->driver_down.reset_completed);
+-
+-    hailo_pcie_write_firmware_driver_shutdown(&board->pcie_resources);
+-
+-    // Wait for response
+-    completion_result =
+-        wait_for_completion_timeout(&board->driver_down.reset_completed, msecs_to_jiffies(DEFAULT_SHUTDOWN_TIMEOUT_MS));
+-    if (completion_result <= 0) {
+-        if (0 == completion_result) {
+-            hailo_err(board, "hailo_pcie_driver_down, timeout waiting for shutdown response (timeout_ms=%d)\n", DEFAULT_SHUTDOWN_TIMEOUT_MS);
+-            err = -ETIMEDOUT;
+-        } else {
+-            hailo_info(board, "hailo_pcie_driver_down, wait for completion failed with err=%ld (process was interrupted or killed)\n",
+-                completion_result);
+-            err = completion_result;
+-        }
+-        goto l_exit;
+-    }
+-
+-l_exit:
+-    return err;
+-}
+-
+ int hailo_pcie_fops_release(struct inode *inode, struct file *filp)
+ {
+     struct hailo_pcie_board *board = (struct hailo_pcie_board *)filp->private_data;
+@@ -234,12 +204,10 @@ int hailo_pcie_fops_release(struct inode
+             hailo_err(board, "Invalid file context\n");
+         }
+ 
+-        hailo_pcie_clear_notification_wait_list(board, filp);
+-
+-        if (filp == board->vdma.used_by_filp) {
+-            if (hailo_pcie_driver_down(board)) {
+-                hailo_err(board, "Failed sending FW shutdown event");
+-            }
++        if (board->pcie_resources.accelerator_type == HAILO_ACCELERATOR_TYPE_NNC) {
++            hailo_nnc_file_context_finalize(board, context);
++        } else {
++            hailo_soc_file_context_finalize(board, context);
+         }
+ 
+         hailo_vdma_file_context_finalize(&context->vdma_context, &board->vdma, filp);
+@@ -250,6 +218,7 @@ int hailo_pcie_fops_release(struct inode
+             hailo_disable_interrupts(board);
+ 
+             if (power_mode_enabled()) {
++                hailo_info(board, "Power change state to PCI_D3hot\n");
+                 if (board->pDev && pci_set_power_state(board->pDev, PCI_D3hot) < 0) {
+                     hailo_err(board, "Failed setting power state to D3hot");
+                 }
+@@ -301,44 +270,23 @@ static long hailo_memory_transfer_ioctl(
+     return err;
+ }
+ 
+-static long hailo_read_log_ioctl(struct hailo_pcie_board *pBoard, unsigned long arg)
+-{
+-    long err = 0;
+-    struct hailo_read_log_params params;
+-
+-    if (copy_from_user(&params, (void __user*)arg, sizeof(params))) {
+-        hailo_err(pBoard, "HAILO_READ_LOG, copy_from_user fail\n");
+-        return -ENOMEM;
+-    }
+-
+-    if (0 > (err = hailo_pcie_read_firmware_log(&pBoard->pcie_resources, &params))) {
+-        hailo_err(pBoard, "HAILO_READ_LOG, reading from log failed with error: %ld \n", err);
+-        return err;
+-    }
+-
+-    if (copy_to_user((void*)arg, &params, sizeof(params))) {
+-        return -ENOMEM;
+-    }
+-
+-    return 0;
+-}
+-
+ static void firmware_notification_irq_handler(struct hailo_pcie_board *board)
+ {
+     struct hailo_notification_wait *notif_wait_cursor = NULL;
+     int err = 0;
+     unsigned long irq_saved_flags = 0;
+ 
+-    spin_lock_irqsave(&board->notification_read_spinlock, irq_saved_flags);
+-    err = hailo_pcie_read_firmware_notification(&board->pcie_resources, &board->notification_cache);
+-    spin_unlock_irqrestore(&board->notification_read_spinlock, irq_saved_flags);
++    spin_lock_irqsave(&board->nnc.notification_read_spinlock, irq_saved_flags);
++    err = hailo_pcie_read_firmware_notification(&board->pcie_resources.fw_access, &board->nnc.notification_cache);
++    spin_unlock_irqrestore(&board->nnc.notification_read_spinlock, irq_saved_flags);
+ 
+     if (err < 0) {
+         hailo_err(board, "Failed reading firmware notification");
+     }
+     else {
++        // TODO: HRT-14502 move interrupt handling to nnc
+         rcu_read_lock();
+-        list_for_each_entry_rcu(notif_wait_cursor, &board->notification_wait_list, notification_wait_list)
++        list_for_each_entry_rcu(notif_wait_cursor, &board->nnc.notification_wait_list, notification_wait_list)
+         {
+             complete(&notif_wait_cursor->notification_completion);
+         }
+@@ -374,7 +322,7 @@ irqreturn_t hailo_irqhandler(int irq, vo
+ 
+         // wake fw_control if needed
+         if (irq_source.interrupt_bitmask & FW_CONTROL) {
+-            complete(&board->fw_control.completion);
++            complete(&board->nnc.fw_control.completion);
+         }
+ 
+         // wake driver_down if needed
+@@ -392,7 +340,14 @@ irqreturn_t hailo_irqhandler(int irq, vo
+         }
+ 
+         if (irq_source.interrupt_bitmask & SOC_CONNECT_ACCEPTED) {
+-            complete_all(&board->soc_connect_accepted);
++            complete_all(&board->soc.control_resp_ready);
++        }
++
++        if (irq_source.interrupt_bitmask & SOC_CLOSED_IRQ) {
++            hailo_info(board, "hailo_irqhandler - SOC_CLOSED_IRQ\n");
++            // always use bitmap=0xFFFFFFFF - it is ok to wake all interrupts since each handler will check if the stream was aborted or not. 
++            hailo_vdma_wakeup_interrupts(&board->vdma, &board->vdma.vdma_engines[DEFAULT_VDMA_ENGINE_INDEX],
++                0xFFFFFFFF);
+         }
+ 
+         if (0 != irq_source.vdma_channels_bitmap) {
+@@ -404,170 +359,11 @@ irqreturn_t hailo_irqhandler(int irq, vo
+     return return_value;
+ }
+ 
+-static long hailo_get_notification_wait_thread(struct hailo_pcie_board *pBoard, struct file *filp,
+-    struct hailo_notification_wait **current_waiting_thread)
+-{
+-    struct hailo_notification_wait *cursor = NULL;
+-    // note: safe to access without rcu because the notification_wait_list is closed only on file release
+-    list_for_each_entry(cursor, &pBoard->notification_wait_list, notification_wait_list)
+-    {
+-        if ((current->tgid == cursor->tgid) && (filp == cursor->filp)) {
+-            *current_waiting_thread = cursor;
+-            return 0;
+-        }
+-    }
+-
+-    return -EFAULT;
+-}
+-
+-static long hailo_add_notification_wait(struct hailo_pcie_board *board, struct file *filp)
+-{
+-    struct hailo_notification_wait *new_notification_wait = NULL;
+-    if (!(new_notification_wait = kmalloc(sizeof(*new_notification_wait), GFP_KERNEL))) {
+-        hailo_err(board, "Failed to allocate notification wait structure.\n");
+-        return -ENOMEM;
+-    }
+-    new_notification_wait->tgid = current->tgid;
+-    new_notification_wait->filp = filp;
+-    new_notification_wait->is_disabled = false;
+-    init_completion(&new_notification_wait->notification_completion);
+-    list_add_rcu(&new_notification_wait->notification_wait_list, &board->notification_wait_list);
+-    return 0;
+-}
+-
+-static long hailo_read_notification_ioctl(struct hailo_pcie_board *pBoard, unsigned long arg, struct file *filp,
+-    bool* should_up_board_mutex)
+-{
+-    long err = 0;
+-    struct hailo_notification_wait *current_waiting_thread = NULL;
+-    struct hailo_d2h_notification *notification = &pBoard->notification_to_user;
+-    unsigned long irq_saved_flags;
+-
+-    err = hailo_get_notification_wait_thread(pBoard, filp, &current_waiting_thread);
+-    if (0 != err) {
+-        goto l_exit;
+-    }
+-    up(&pBoard->mutex);
+-
+-    if (0 > (err = wait_for_completion_interruptible(&current_waiting_thread->notification_completion))) {
+-        hailo_info(pBoard,
+-            "HAILO_READ_NOTIFICATION - wait_for_completion_interruptible error. err=%ld. tgid=%d (process was interrupted or killed)\n",
+-            err, current_waiting_thread->tgid);
+-        *should_up_board_mutex = false;
+-        goto l_exit;
+-    }
+-
+-    if (down_interruptible(&pBoard->mutex)) {
+-        hailo_info(pBoard, "HAILO_READ_NOTIFICATION - down_interruptible error (process was interrupted or killed)\n");
+-        *should_up_board_mutex = false;
+-        err = -ERESTARTSYS;
+-        goto l_exit;
+-    }
+-
+-    // Check if was disabled
+-    if (current_waiting_thread->is_disabled) {
+-        hailo_info(pBoard, "HAILO_READ_NOTIFICATION, can't find notification wait for tgid=%d\n", current->tgid);
+-        err = -EINVAL;
+-        goto l_exit;
+-    }
+-
+-    reinit_completion(&current_waiting_thread->notification_completion);
+-    
+-    spin_lock_irqsave(&pBoard->notification_read_spinlock, irq_saved_flags);
+-    notification->buffer_len = pBoard->notification_cache.buffer_len;
+-    memcpy(notification->buffer, pBoard->notification_cache.buffer, notification->buffer_len);
+-    spin_unlock_irqrestore(&pBoard->notification_read_spinlock, irq_saved_flags);
+-
+-    if (copy_to_user((void __user*)arg, notification, sizeof(*notification))) {
+-        hailo_err(pBoard, "HAILO_READ_NOTIFICATION copy_to_user fail\n");
+-        err = -ENOMEM;
+-        goto l_exit;
+-    }
+-
+-l_exit:
+-    return err;
+-}
+-
+-static long hailo_disable_notification(struct hailo_pcie_board *pBoard, struct file *filp)
+-{
+-    struct hailo_notification_wait *cursor = NULL;
+-
+-    hailo_info(pBoard, "HAILO_DISABLE_NOTIFICATION: disable notification");
+-    rcu_read_lock();
+-    list_for_each_entry_rcu(cursor, &pBoard->notification_wait_list, notification_wait_list) {
+-        if ((current->tgid == cursor->tgid) && (filp == cursor->filp)) {
+-            cursor->is_disabled = true;
+-            complete(&cursor->notification_completion);
+-            break;
+-        }
+-    }
+-    rcu_read_unlock();
+-
+-    return 0;
+-}
+-
+-static int hailo_fw_control(struct hailo_pcie_board *pBoard, unsigned long arg, bool* should_up_board_mutex)
+-{
+-    struct hailo_fw_control *command = &pBoard->fw_control.command;
+-    long completion_result = 0;
+-    int err = 0;
+-
+-    up(&pBoard->mutex);
+-    *should_up_board_mutex = false;
+-
+-    if (down_interruptible(&pBoard->fw_control.mutex)) {
+-        hailo_info(pBoard, "hailo_fw_control down_interruptible fail tgid:%d (process was interrupted or killed)\n", current->tgid);
+-        return -ERESTARTSYS;
+-    }
+-
+-    if (copy_from_user(command, (void __user*)arg, sizeof(*command))) {
+-        hailo_err(pBoard, "hailo_fw_control, copy_from_user fail\n");
+-        err = -ENOMEM;
+-        goto l_exit;
+-    }
+-
+-    reinit_completion(&pBoard->fw_control.completion);
+-
+-    err = hailo_pcie_write_firmware_control(&pBoard->pcie_resources, command);
+-    if (err < 0) {
+-        hailo_err(pBoard, "Failed writing fw control to pcie\n");
+-        goto l_exit;
+-    }
+-
+-    // Wait for response
+-    completion_result = wait_for_completion_interruptible_timeout(&pBoard->fw_control.completion, msecs_to_jiffies(command->timeout_ms));
+-    if (completion_result <= 0) {
+-        if (0 == completion_result) {
+-            hailo_err(pBoard, "hailo_fw_control, timeout waiting for control (timeout_ms=%d)\n", command->timeout_ms);
+-            err = -ETIMEDOUT;
+-        } else {
+-            hailo_info(pBoard, "hailo_fw_control, wait for completion failed with err=%ld (process was interrupted or killed)\n", completion_result);
+-            err = -EINTR;
+-        }
+-        goto l_exit;
+-    }
+-
+-    err = hailo_pcie_read_firmware_control(&pBoard->pcie_resources, command);
+-    if (err < 0) {
+-        hailo_err(pBoard, "Failed reading fw control from pcie\n");
+-        goto l_exit;
+-    }
+-
+-    if (copy_to_user((void __user*)arg, command, sizeof(*command))) {
+-        hailo_err(pBoard, "hailo_fw_control, copy_to_user fail\n");
+-        err = -ENOMEM;
+-        goto l_exit;
+-    }
+-
+-l_exit:
+-    up(&pBoard->fw_control.mutex);
+-    return err;
+-}
+-
+ static long hailo_query_device_properties(struct hailo_pcie_board *board, unsigned long arg)
+ {
+     struct hailo_device_properties props = {
+         .desc_max_page_size = board->desc_max_page_size,
++        .board_type = board->pcie_resources.board_type,
+         .allocation_mode = board->allocation_mode,
+         .dma_type = HAILO_DMA_TYPE_PCIE,
+         .dma_engines_count = board->vdma.vdma_engines_count,
+@@ -618,24 +414,6 @@ static long hailo_general_ioctl(struct h
+     }
+ }
+ 
+-static long hailo_nnc_ioctl(struct hailo_pcie_board *board, unsigned int cmd, unsigned long arg,
+-    struct file *filp, bool *should_up_board_mutex)
+-{
+-    switch (cmd) {
+-    case HAILO_FW_CONTROL:
+-        return hailo_fw_control(board, arg, should_up_board_mutex);
+-    case HAILO_READ_NOTIFICATION:
+-        return hailo_read_notification_ioctl(board, arg, filp, should_up_board_mutex);
+-    case HAILO_DISABLE_NOTIFICATION:
+-        return hailo_disable_notification(board, filp);
+-    case HAILO_READ_LOG:
+-        return hailo_read_log_ioctl(board, arg);
+-    default:
+-        hailo_err(board, "Invalid nnc ioctl code 0x%x (nr: %d)\n", cmd, _IOC_NR(cmd));
+-        return -ENOTTY;
+-    }
+-}
+-
+ long hailo_pcie_fops_unlockedioctl(struct file* filp, unsigned int cmd, unsigned long arg)
+ {
+     long err = 0;
+@@ -694,7 +472,7 @@ long hailo_pcie_fops_unlockedioctl(struc
+             hailo_err(board, "Ioctl %d is not supported on this accelerator type\n", _IOC_TYPE(cmd));
+             err = -EINVAL;
+         } else {
+-            err = hailo_soc_ioctl(board, &context->vdma_context, &board->vdma, cmd, arg);
++            err = hailo_soc_ioctl(board, context, &board->vdma, cmd, arg);
+         }
+         break;
+     case HAILO_NNC_IOCTL_MAGIC:
+--- a/drivers/media/pci/hailo/src/fops.h
++++ b/drivers/media/pci/hailo/src/fops.h
+@@ -1,16 +1,17 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_PCI_FOPS_H_
+ #define _HAILO_PCI_FOPS_H_
+ 
++#include "pcie.h"
++
+ int hailo_pcie_fops_open(struct inode* inode, struct file* filp);
+ int hailo_pcie_fops_release(struct inode* inode, struct file* filp);
+ long hailo_pcie_fops_unlockedioctl(struct file* filp, unsigned int cmd, unsigned long arg);
+ int hailo_pcie_fops_mmap(struct file* filp, struct vm_area_struct *vma);
+-int hailo_pcie_driver_down(struct hailo_pcie_board *board);
+ void hailo_pcie_ep_init(struct hailo_pcie_board *board);
+ 
+ #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22)
+--- /dev/null
++++ b/drivers/media/pci/hailo/src/nnc.c
+@@ -0,0 +1,299 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
++ **/
++/**
++ * A Hailo PCIe NNC device is a device contains a NNC (neural network core) and some basic FW.
++ * The device supports sending controls, receiving notification and reading the FW log.
++ */
++
++#include "nnc.h"
++#include "hailo_ioctl_common.h"
++
++#include "utils/logs.h"
++#include "utils/compact.h"
++
++#include <linux/uaccess.h>
++
++#if !defined(HAILO_EMULATOR)
++#define DEFAULT_SHUTDOWN_TIMEOUT_MS (5)
++#else /* !defined(HAILO_EMULATOR) */
++#define DEFAULT_SHUTDOWN_TIMEOUT_MS (1000)
++#endif /* !defined(HAILO_EMULATOR) */
++
++void hailo_nnc_init(struct hailo_pcie_nnc *nnc)
++{
++    sema_init(&nnc->fw_control.mutex, 1);
++    spin_lock_init(&nnc->notification_read_spinlock);
++    init_completion(&nnc->fw_control.completion);
++    INIT_LIST_HEAD(&nnc->notification_wait_list);
++    memset(&nnc->notification_cache, 0, sizeof(nnc->notification_cache));
++}
++
++void hailo_nnc_finalize(struct hailo_pcie_nnc *nnc)
++{
++    struct hailo_notification_wait *cursor = NULL;
++
++    // Lock rcu_read_lock and send notification_completion to wake anyone waiting on the notification_wait_list when removed
++    rcu_read_lock();
++    list_for_each_entry_rcu(cursor, &nnc->notification_wait_list, notification_wait_list) {
++        cursor->is_disabled = true;
++        complete(&cursor->notification_completion);
++    }
++    rcu_read_unlock();
++}
++
++static int hailo_fw_control(struct hailo_pcie_board *board, unsigned long arg, bool* should_up_board_mutex)
++{
++    struct hailo_fw_control *command = &board->nnc.fw_control.command;
++    long completion_result = 0;
++    int err = 0;
++
++    up(&board->mutex);
++    *should_up_board_mutex = false;
++
++    if (down_interruptible(&board->nnc.fw_control.mutex)) {
++        hailo_info(board, "hailo_fw_control down_interruptible fail tgid:%d (process was interrupted or killed)\n", current->tgid);
++        return -ERESTARTSYS;
++    }
++
++    if (copy_from_user(command, (void __user*)arg, sizeof(*command))) {
++        hailo_err(board, "hailo_fw_control, copy_from_user fail\n");
++        err = -ENOMEM;
++        goto l_exit;
++    }
++
++    reinit_completion(&board->nnc.fw_control.completion);
++
++    err = hailo_pcie_write_firmware_control(&board->pcie_resources, command);
++    if (err < 0) {
++        hailo_err(board, "Failed writing fw control to pcie\n");
++        goto l_exit;
++    }
++
++    // Wait for response
++    completion_result = wait_for_completion_interruptible_timeout(&board->nnc.fw_control.completion, msecs_to_jiffies(command->timeout_ms));
++    if (completion_result <= 0) {
++        if (0 == completion_result) {
++            hailo_err(board, "hailo_fw_control, timeout waiting for control (timeout_ms=%d)\n", command->timeout_ms);
++            err = -ETIMEDOUT;
++        } else {
++            hailo_info(board, "hailo_fw_control, wait for completion failed with err=%ld (process was interrupted or killed)\n", completion_result);
++            err = -EINTR;
++        }
++        goto l_exit;
++    }
++
++    err = hailo_pcie_read_firmware_control(&board->pcie_resources, command);
++    if (err < 0) {
++        hailo_err(board, "Failed reading fw control from pcie\n");
++        goto l_exit;
++    }
++
++    if (copy_to_user((void __user*)arg, command, sizeof(*command))) {
++        hailo_err(board, "hailo_fw_control, copy_to_user fail\n");
++        err = -ENOMEM;
++        goto l_exit;
++    }
++
++l_exit:
++    up(&board->nnc.fw_control.mutex);
++    return err;
++}
++
++static long hailo_get_notification_wait_thread(struct hailo_pcie_board *board, struct file *filp,
++    struct hailo_notification_wait **current_waiting_thread)
++{
++    struct hailo_notification_wait *cursor = NULL;
++    // note: safe to access without rcu because the notification_wait_list is closed only on file release
++    list_for_each_entry(cursor, &board->nnc.notification_wait_list, notification_wait_list)
++    {
++        if ((current->tgid == cursor->tgid) && (filp == cursor->filp)) {
++            *current_waiting_thread = cursor;
++            return 0;
++        }
++    }
++
++    return -EFAULT;
++}
++
++static long hailo_read_notification_ioctl(struct hailo_pcie_board *board, unsigned long arg, struct file *filp,
++    bool* should_up_board_mutex)
++{
++    long err = 0;
++    struct hailo_notification_wait *current_waiting_thread = NULL;
++    struct hailo_d2h_notification *notification = &board->nnc.notification_to_user;
++    unsigned long irq_saved_flags;
++
++    err = hailo_get_notification_wait_thread(board, filp, &current_waiting_thread);
++    if (0 != err) {
++        goto l_exit;
++    }
++    up(&board->mutex);
++
++    if (0 > (err = wait_for_completion_interruptible(&current_waiting_thread->notification_completion))) {
++        hailo_info(board,
++            "HAILO_READ_NOTIFICATION - wait_for_completion_interruptible error. err=%ld. tgid=%d (process was interrupted or killed)\n",
++            err, current_waiting_thread->tgid);
++        *should_up_board_mutex = false;
++        goto l_exit;
++    }
++
++    if (down_interruptible(&board->mutex)) {
++        hailo_info(board, "HAILO_READ_NOTIFICATION - down_interruptible error (process was interrupted or killed)\n");
++        *should_up_board_mutex = false;
++        err = -ERESTARTSYS;
++        goto l_exit;
++    }
++
++    // Check if was disabled
++    if (current_waiting_thread->is_disabled) {
++        hailo_info(board, "HAILO_READ_NOTIFICATION, can't find notification wait for tgid=%d\n", current->tgid);
++        err = -EINVAL;
++        goto l_exit;
++    }
++
++    reinit_completion(&current_waiting_thread->notification_completion);
++
++    spin_lock_irqsave(&board->nnc.notification_read_spinlock, irq_saved_flags);
++    notification->buffer_len = board->nnc.notification_cache.buffer_len;
++    memcpy(notification->buffer, board->nnc.notification_cache.buffer, notification->buffer_len);
++    spin_unlock_irqrestore(&board->nnc.notification_read_spinlock, irq_saved_flags);
++
++    if (copy_to_user((void __user*)arg, notification, sizeof(*notification))) {
++        hailo_err(board, "HAILO_READ_NOTIFICATION copy_to_user fail\n");
++        err = -ENOMEM;
++        goto l_exit;
++    }
++
++l_exit:
++    return err;
++}
++
++static long hailo_disable_notification(struct hailo_pcie_board *board, struct file *filp)
++{
++    struct hailo_notification_wait *cursor = NULL;
++
++    hailo_info(board, "HAILO_DISABLE_NOTIFICATION: disable notification");
++    rcu_read_lock();
++    list_for_each_entry_rcu(cursor, &board->nnc.notification_wait_list, notification_wait_list) {
++        if ((current->tgid == cursor->tgid) && (filp == cursor->filp)) {
++            cursor->is_disabled = true;
++            complete(&cursor->notification_completion);
++            break;
++        }
++    }
++    rcu_read_unlock();
++
++    return 0;
++}
++
++static long hailo_read_log_ioctl(struct hailo_pcie_board *board, unsigned long arg)
++{
++    long err = 0;
++    struct hailo_read_log_params params;
++
++    if (copy_from_user(&params, (void __user*)arg, sizeof(params))) {
++        hailo_err(board, "HAILO_READ_LOG, copy_from_user fail\n");
++        return -ENOMEM;
++    }
++
++    if (0 > (err = hailo_pcie_read_firmware_log(&board->pcie_resources.fw_access, &params))) {
++        hailo_err(board, "HAILO_READ_LOG, reading from log failed with error: %ld \n", err);
++        return err;
++    }
++
++    if (copy_to_user((void*)arg, &params, sizeof(params))) {
++        return -ENOMEM;
++    }
++
++    return 0;
++}
++
++long hailo_nnc_ioctl(struct hailo_pcie_board *board, unsigned int cmd, unsigned long arg,
++    struct file *filp, bool *should_up_board_mutex)
++{
++    switch (cmd) {
++    case HAILO_FW_CONTROL:
++        return hailo_fw_control(board, arg, should_up_board_mutex);
++    case HAILO_READ_NOTIFICATION:
++        return hailo_read_notification_ioctl(board, arg, filp, should_up_board_mutex);
++    case HAILO_DISABLE_NOTIFICATION:
++        return hailo_disable_notification(board, filp);
++    case HAILO_READ_LOG:
++        return hailo_read_log_ioctl(board, arg);
++    default:
++        hailo_err(board, "Invalid nnc ioctl code 0x%x (nr: %d)\n", cmd, _IOC_NR(cmd));
++        return -ENOTTY;
++    }
++}
++
++
++static int add_notification_wait(struct hailo_pcie_board *board, struct file *filp)
++{
++    struct hailo_notification_wait *wait = kmalloc(sizeof(*wait), GFP_KERNEL);
++    if (!wait) {
++        hailo_err(board, "Failed to allocate notification wait structure.\n");
++        return -ENOMEM;
++    }
++    wait->tgid = current->tgid;
++    wait->filp = filp;
++    wait->is_disabled = false;
++    init_completion(&wait->notification_completion);
++    list_add_rcu(&wait->notification_wait_list, &board->nnc.notification_wait_list);
++    return 0;
++}
++
++int hailo_nnc_file_context_init(struct hailo_pcie_board *board, struct hailo_file_context *context)
++{
++    return add_notification_wait(board, context->filp);
++}
++
++static void clear_notification_wait_list(struct hailo_pcie_board *board, struct file *filp)
++{
++    struct hailo_notification_wait *cur = NULL, *next = NULL;
++    list_for_each_entry_safe(cur, next, &board->nnc.notification_wait_list, notification_wait_list) {
++        if (cur->filp == filp) {
++            list_del_rcu(&cur->notification_wait_list);
++            synchronize_rcu();
++            kfree(cur);
++        }
++    }
++}
++
++int hailo_nnc_driver_down(struct hailo_pcie_board *board)
++{
++    long completion_result = 0;
++    int err = 0;
++
++    reinit_completion(&board->driver_down.reset_completed);
++
++    hailo_pcie_write_firmware_driver_shutdown(&board->pcie_resources);
++
++    // Wait for response
++    completion_result =
++        wait_for_completion_timeout(&board->driver_down.reset_completed, msecs_to_jiffies(DEFAULT_SHUTDOWN_TIMEOUT_MS));
++    if (completion_result <= 0) {
++        if (0 == completion_result) {
++            hailo_err(board, "hailo_nnc_driver_down, timeout waiting for shutdown response (timeout_ms=%d)\n", DEFAULT_SHUTDOWN_TIMEOUT_MS);
++            err = -ETIMEDOUT;
++        } else {
++            hailo_info(board, "hailo_nnc_driver_down, wait for completion failed with err=%ld (process was interrupted or killed)\n",
++                completion_result);
++            err = completion_result;
++        }
++        goto l_exit;
++    }
++
++l_exit:
++    return err;
++}
++
++void hailo_nnc_file_context_finalize(struct hailo_pcie_board *board, struct hailo_file_context *context)
++{
++    clear_notification_wait_list(board, context->filp);
++
++    if (context->filp == board->vdma.used_by_filp) {
++        hailo_nnc_driver_down(board);
++    }
++}
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/src/nnc.h
+@@ -0,0 +1,22 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_PCI_NNC_H_
++#define _HAILO_PCI_NNC_H_
++
++#include "pcie.h"
++
++void hailo_nnc_init(struct hailo_pcie_nnc *nnc);
++void hailo_nnc_finalize(struct hailo_pcie_nnc *nnc);
++
++long hailo_nnc_ioctl(struct hailo_pcie_board *board, unsigned int cmd, unsigned long arg,
++    struct file *filp, bool *should_up_board_mutex);
++
++int hailo_nnc_file_context_init(struct hailo_pcie_board *board, struct hailo_file_context *context);
++void hailo_nnc_file_context_finalize(struct hailo_pcie_board *board, struct hailo_file_context *context);
++
++int hailo_nnc_driver_down(struct hailo_pcie_board *board);
++
++#endif /* _HAILO_PCI_NNC_H_ */
+\ No newline at end of file
+--- a/drivers/media/pci/hailo/src/pci_soc_ioctl.c
++++ /dev/null
+@@ -1,155 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/**
+- * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+- **/
+-#include "pci_soc_ioctl.h"
+-
+-#include "utils.h"
+-#include "vdma_common.h"
+-#include "utils/logs.h"
+-#include "vdma/memory.h"
+-
+-#define PCI_SOC_VDMA_ENGINE_INDEX           (0)
+-#define PCI_SOC_WAIT_FOR_CONNECT_TIMEOUT_MS (10000)
+-
+-long hailo_soc_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_file_context *context,
+-    struct hailo_vdma_controller *controller, unsigned int cmd, unsigned long arg)
+-{
+-    switch (cmd) {
+-    case HAILO_SOC_CONNECT:
+-        return hailo_soc_connect_ioctl(board, context, controller, arg);
+-    case HAILO_SOC_CLOSE:
+-        return hailo_soc_close_ioctl(board, controller, arg);
+-    default:
+-        hailo_err(board, "Invalid pcie EP ioctl code 0x%x (nr: %d)\n", cmd, _IOC_NR(cmd));
+-        return -ENOTTY;
+-    }
+-}
+-
+-long hailo_soc_connect_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_file_context *context,
+-    struct hailo_vdma_controller *controller, unsigned long arg)
+-{
+-    struct hailo_soc_connect_params params;
+-    struct hailo_vdma_channel *input_channel = NULL;
+-    struct hailo_vdma_channel *output_channel = NULL;
+-    struct hailo_vdma_engine *vdma_engine = NULL;
+-    struct hailo_descriptors_list_buffer *input_descriptors_buffer = NULL;
+-    struct hailo_descriptors_list_buffer *output_descriptors_buffer = NULL;
+-    uint8_t depth = 0;
+-    int err = 0;
+-    long completion_result = 0;
+-
+-    if (copy_from_user(&params, (void *)arg, sizeof(params))) {
+-        hailo_err(board, "copy_from_user fail\n");
+-        return -ENOMEM;
+-    }
+-
+-    // TODO: have pci_ep choose the channel indexes the soc will use - for now use 0 and 16
+-    params.input_channel_index = 0;
+-    params.output_channel_index = 16;
+-
+-    reinit_completion(&board->soc_connect_accepted);
+-    hailo_soc_write_soc_connect(&board->pcie_resources);
+-
+-    // Wait for completion
+-    completion_result = wait_for_completion_interruptible_timeout(&board->soc_connect_accepted,
+-        msecs_to_jiffies(PCI_SOC_WAIT_FOR_CONNECT_TIMEOUT_MS));
+-    if (0 > completion_result) {
+-        if (0 == completion_result) {
+-            hailo_err(board, "Timeout waiting for connect to be accepted (timeout_ms=%d)\n", PCI_SOC_WAIT_FOR_CONNECT_TIMEOUT_MS);
+-            return -ETIMEDOUT;
+-        } else {
+-            hailo_info(board, "soc connect failed with err=%ld (process was interrupted or killed)\n",
+-                completion_result);
+-            return -EINTR;
+-        }
+-    }
+-
+-    vdma_engine = &controller->vdma_engines[PCI_SOC_VDMA_ENGINE_INDEX];
+-    input_channel = &vdma_engine->channels[params.input_channel_index];
+-    output_channel = &vdma_engine->channels[params.output_channel_index];
+-
+-    input_descriptors_buffer = hailo_vdma_find_descriptors_buffer(context, params.input_desc_handle);
+-    output_descriptors_buffer = hailo_vdma_find_descriptors_buffer(context, params.output_desc_handle);
+-    if (NULL == input_descriptors_buffer || NULL == output_descriptors_buffer) {
+-        hailo_dev_err(&board->pDev->dev, "input / output descriptors buffer not found \n");
+-        return -EINVAL;
+-    }
+-
+-    // Make sure channels that we are accepting are not already enabled
+-    if (0 != (vdma_engine->enabled_channels & params.input_channel_index) ||
+-        0 != (vdma_engine->enabled_channels & params.output_channel_index)) {
+-        hailo_dev_err(&board->pDev->dev, "Trying to accept already enabled channels\n");
+-        return -EINVAL;
+-    }
+-
+-    if (!is_powerof2((size_t)input_descriptors_buffer->desc_list.desc_count) ||
+-        !is_powerof2((size_t)output_descriptors_buffer->desc_list.desc_count)) {
+-        hailo_dev_err(&board->pDev->dev, "Invalid desc list size\n");
+-        return -EINVAL;
+-    }
+-
+-    // configure and start input channel
+-    depth = ceil_log2(input_descriptors_buffer->desc_list.desc_count);
+-    // DMA Direction is only to get channel index - so 
+-    err = hailo_vdma_start_channel(input_channel->host_regs, input_descriptors_buffer->dma_address, depth,
+-        board->vdma.hw->ddr_data_id);
+-    if (err < 0) {
+-        hailo_dev_err(&board->pDev->dev, "Error starting vdma input channel index %u\n", params.input_channel_index);
+-        return -EINVAL;
+-    }
+-    
+-    // configure and start output channel
+-    depth = ceil_log2(output_descriptors_buffer->desc_list.desc_count);
+-    // DMA Direction is only to get channel index - so 
+-    err = hailo_vdma_start_channel(output_channel->host_regs, output_descriptors_buffer->dma_address, depth,
+-        board->vdma.hw->ddr_data_id);
+-    if (err < 0) {
+-        hailo_dev_err(&board->pDev->dev, "Error starting vdma output channel index %u\n", params.output_channel_index);
+-        // Close input channel
+-        hailo_vdma_stop_channel(input_channel->host_regs);
+-        return -EINVAL;
+-    }
+-
+-    if (copy_to_user((void *)arg, &params, sizeof(params))) {
+-        hailo_dev_err(&board->pDev->dev, "copy_to_user fail\n");
+-        return -ENOMEM;
+-    }
+-
+-    return 0;
+-}
+-
+-long hailo_soc_close_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_controller *controller, unsigned long arg)
+-{
+-    struct hailo_soc_close_params params;
+-    struct hailo_vdma_channel *input_channel = NULL;
+-    struct hailo_vdma_channel *output_channel = NULL;
+-    struct hailo_vdma_engine *vdma_engine = NULL;
+-
+-    if (copy_from_user(&params, (void *)arg, sizeof(params))) {
+-        hailo_dev_err(&board->pDev->dev, "copy_from_user fail\n");
+-        return -ENOMEM;
+-    }
+-
+-    vdma_engine = &controller->vdma_engines[PCI_SOC_VDMA_ENGINE_INDEX];
+-
+-    if (!hailo_check_channel_index(params.input_channel_index, controller->hw->src_channels_bitmask, true)) {
+-        hailo_dev_err(&board->pDev->dev, "Invalid input channel index %u\n", params.input_channel_index);
+-        return -EINVAL;
+-    }
+-
+-    if (!hailo_check_channel_index(params.output_channel_index, controller->hw->src_channels_bitmask, false)) {
+-        hailo_dev_err(&board->pDev->dev, "Invalid output channel index %u\n", params.output_channel_index);
+-        return -EINVAL;
+-    }
+-
+-    input_channel = &vdma_engine->channels[params.input_channel_index];
+-    output_channel = &vdma_engine->channels[params.output_channel_index];
+-
+-    // Close channels
+-    hailo_vdma_stop_channel(input_channel->host_regs);
+-    hailo_vdma_stop_channel(output_channel->host_regs);
+-
+-    hailo_pcie_write_firmware_driver_shutdown(&board->pcie_resources);
+-    return 0;
+-}
+\ No newline at end of file
+--- a/drivers/media/pci/hailo/src/pcie.c
++++ b/drivers/media/pci/hailo/src/pcie.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include <linux/version.h>
+@@ -22,6 +22,8 @@
+ 
+ #include "hailo_ioctl_common.h"
+ #include "pcie.h"
++#include "nnc.h"
++#include "soc.h"
+ #include "fops.h"
+ #include "sysfs.h"
+ #include "utils/logs.h"
+@@ -40,11 +42,12 @@ enum hailo_allocate_driver_buffer_driver
+     HAILO_FORCE_BUFFER_FROM_DRIVER = 2,
+ };
+ 
+-//Debug flag
++// Debug flag
+ static int force_desc_page_size = 0;
+ static bool g_is_power_mode_enabled = true;
+ static int force_allocation_from_driver = HAILO_NO_FORCE_BUFFER;
+ static bool force_hailo15_legacy_mode = false;
++static bool force_boot_linux_from_eemc = false;
+ 
+ #define DEVICE_NODE_NAME "hailo"
+ static int char_major = 0;
+@@ -206,7 +209,7 @@ static int hailo_pcie_disable_aspm(struc
+     /* Double-check ASPM control.  If not disabled by the above, the
+      * BIOS is preventing that from happening (or CONFIG_PCIEASPM is
+      * not enabled); override by writing PCI config space directly.
+-     */                       
++     */
+     err = pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &pdev_aspmc);
+     if (err < 0) {
+         hailo_err(board, "Couldn't read LNKCTL capability\n");
+@@ -288,101 +291,59 @@ static void hailo_pcie_remove_board(stru
+     up(&g_hailo_add_board_mutex);
+ }
+ 
+-static int hailo_write_config(struct hailo_pcie_resources *resources, struct device *dev,
+-    const struct hailo_config_constants *config_consts)
+-{
+-    const struct firmware *config = NULL;
+-    int err = 0;
+-
+-    if (NULL == config_consts->filename) {
+-        // Config not supported for platform
+-        return 0;
+-    }
+-
+-    err = request_firmware_direct(&config, config_consts->filename, dev);
+-    if (err < 0) {
+-        hailo_dev_info(dev, "Config %s not found\n", config_consts->filename);
+-        return 0;
+-    }
+-
+-    hailo_dev_notice(dev, "Writing config %s\n", config_consts->filename);
+-
+-    err = hailo_pcie_write_config_common(resources, config->data, config->size, config_consts);
+-    if (err < 0) {
+-        if (-EINVAL == err) {
+-            hailo_dev_warn(dev, "Config size %zu is bigger than max %zu\n", config->size, config_consts->max_size);
+-        }
+-        release_firmware(config);
+-        return err;
+-    }
+-
+-    release_firmware(config);
+-    return 0;
+-}
+-
+ static bool wait_for_firmware_completion(struct completion *fw_load_completion)
+ {
+     return (0 != wait_for_completion_timeout(fw_load_completion, msecs_to_jiffies(FIRMWARE_WAIT_TIMEOUT_MS)));
+ }
+ 
+-static int hailo_load_firmware(struct hailo_pcie_resources *resources,
++static int hailo_load_soc_firmware(struct hailo_pcie_resources *resources,
+     struct device *dev, struct completion *fw_load_completion)
+ {
+-    const struct firmware *firmware = NULL;
+-    int err = 0;
+     u32 boot_status = 0;
++    int err = 0;
++    u32 second_stage = force_boot_linux_from_eemc ? SECOND_STAGE_LINUX_IN_EMMC : SECOND_STAGE;
+ 
+     if (hailo_pcie_is_firmware_loaded(resources)) {
+-        hailo_dev_warn(dev, "Firmware was already loaded\n");
++        hailo_dev_warn(dev, "Firmware batch was already loaded\n");
+         return 0;
+     }
+ 
+-    reinit_completion(fw_load_completion);
+-
+-    err = hailo_write_config(resources, dev, hailo_pcie_get_board_config_constants(resources->board_type));
+-    if (err < 0) {
+-        hailo_dev_err(dev, "Failed writing board config");
+-        return err;
+-    }
++    init_completion(fw_load_completion);
+ 
+-    err = hailo_write_config(resources, dev, hailo_pcie_get_user_config_constants(resources->board_type));
++    err = hailo_pcie_write_firmware_batch(dev, resources, FIRST_STAGE);
+     if (err < 0) {
+-        hailo_dev_err(dev, "Failed writing fw config");
++        hailo_dev_err(dev, "Failed writing firmware files. err %d\n", err);
+         return err;
+     }
+ 
+-    // read firmware file
+-    err = request_firmware_direct(&firmware, hailo_pcie_get_fw_filename(resources->board_type), dev);
+-    if (err < 0) {
+-        hailo_dev_warn(dev, "Firmware file not found (/lib/firmware/%s), please upload the firmware manually \n",
+-            hailo_pcie_get_fw_filename(resources->board_type));
+-        return 0;
++    if (!wait_for_firmware_completion(fw_load_completion)) {
++        boot_status = hailo_get_boot_status(resources);
++        hailo_dev_err(dev, "Timeout waiting for firmware file, boot status %u\n", boot_status);
++        return -ETIMEDOUT;
+     }
++    reinit_completion(fw_load_completion);
+ 
+-    err = hailo_pcie_write_firmware(resources, firmware->data, firmware->size);
++    err = hailo_pcie_write_firmware_batch(dev, resources, second_stage);
+     if (err < 0) {
+-        hailo_dev_err(dev, "Failed writing firmware. err %d\n", err);
+-        release_firmware(firmware);
++        hailo_dev_err(dev, "Failed writing firmware files. err %d\n", err);
+         return err;
+     }
+ 
+-    release_firmware(firmware);
+-
+     if (!wait_for_firmware_completion(fw_load_completion)) {
+         boot_status = hailo_get_boot_status(resources);
+         hailo_dev_err(dev, "Timeout waiting for firmware file, boot status %u\n", boot_status);
+         return -ETIMEDOUT;
+     }
+ 
+-    hailo_dev_notice(dev, "Firmware was loaded successfully\n");
++    hailo_dev_notice(dev, "Firmware Batch loaded successfully\n");
++
+     return 0;
+ }
+ 
+-static int hailo_load_firmware_batch(struct hailo_pcie_resources *resources,
++static int hailo_load_nnc_firmware(struct hailo_pcie_resources *resources,
+     struct device *dev, struct completion *fw_load_completion)
+ {
+     u32 boot_status = 0;
+-    u32 pcie_finished = 1;
+     int err = 0;
+ 
+     if (hailo_pcie_is_firmware_loaded(resources)) {
+@@ -398,31 +359,13 @@ static int hailo_load_firmware_batch(str
+         return err;
+     }
+ 
+-    hailo_trigger_firmware_boot(resources);
+-
+     if (!wait_for_firmware_completion(fw_load_completion)) {
+         boot_status = hailo_get_boot_status(resources);
+         hailo_dev_err(dev, "Timeout waiting for firmware file, boot status %u\n", boot_status);
+         return -ETIMEDOUT;
+     }
+-    reinit_completion(fw_load_completion);
+ 
+-    err = hailo_pcie_write_firmware_batch(dev, resources, SECOND_STAGE);
+-    if (err < 0) {
+-        hailo_dev_err(dev, "Failed writing firmware files. err %d\n", err);
+-        return err;
+-    }
+-
+-    // TODO: HRT-13838 - Remove, move address to compat, make write_memory static
+-    write_memory(resources, 0x84000000, (void*)&pcie_finished, sizeof(pcie_finished));
+-
+-    if (!wait_for_firmware_completion(fw_load_completion)) {
+-        boot_status = hailo_get_boot_status(resources);
+-        hailo_dev_err(dev, "Timeout waiting for firmware file, boot status %u\n", boot_status);
+-        return -ETIMEDOUT;
+-    }
+-
+-    hailo_dev_notice(dev, "Firmware Batch loaded successfully\n");
++    hailo_dev_notice(dev, "Firmware loaded successfully\n");
+ 
+     return 0;
+ }
+@@ -439,15 +382,13 @@ static int hailo_activate_board(struct h
+         return err;
+     }
+ 
+-    switch (board->pcie_resources.board_type) {
+-    case HAILO_BOARD_TYPE_HAILO10H:
+-        err = hailo_load_firmware_batch(&board->pcie_resources, &board->pDev->dev,
++    switch (board->pcie_resources.accelerator_type) {
++    case HAILO_ACCELERATOR_TYPE_SOC:
++        err = hailo_load_soc_firmware(&board->pcie_resources, &board->pDev->dev,
+             &board->fw_loaded_completion);
+         break;
+-    case HAILO_BOARD_TYPE_HAILO10H_LEGACY:
+-    case HAILO_BOARD_TYPE_PLUTO:
+-    case HAILO_BOARD_TYPE_HAILO8:
+-        err = hailo_load_firmware(&board->pcie_resources, &board->pDev->dev,
++    case HAILO_ACCELERATOR_TYPE_NNC:
++        err = hailo_load_nnc_firmware(&board->pcie_resources, &board->pDev->dev,
+             &board->fw_loaded_completion);
+         break;
+     default:
+@@ -464,6 +405,7 @@ static int hailo_activate_board(struct h
+ 
+     if (power_mode_enabled()) {
+         // Setting the device to low power state, until the user opens the device
++        hailo_info(board, "Power change state  to PCI_D3hot\n");
+         err = pci_set_power_state(board->pDev, PCI_D3hot);
+         if (err < 0) {
+             hailo_err(board, "Set power state failed %d\n", err);
+@@ -755,21 +697,17 @@ static int hailo_pcie_probe(struct pci_d
+ 
+     pBoard->interrupts_enabled = false;
+     init_completion(&pBoard->fw_loaded_completion);
+-    init_completion(&pBoard->soc_connect_accepted);
+ 
+     sema_init(&pBoard->mutex, 1);
+     atomic_set(&pBoard->ref_count, 0);
+     INIT_LIST_HEAD(&pBoard->open_files_list);
+ 
+-    sema_init(&pBoard->fw_control.mutex, 1);
+-    spin_lock_init(&pBoard->notification_read_spinlock);
+-    init_completion(&pBoard->fw_control.completion);
++    // Init both soc and nnc, since the interrupts are shared.
++    hailo_nnc_init(&pBoard->nnc);
++    hailo_soc_init(&pBoard->soc);
+ 
+     init_completion(&pBoard->driver_down.reset_completed);
+ 
+-    INIT_LIST_HEAD(&pBoard->notification_wait_list);
+-
+-    memset(&pBoard->notification_cache, 0, sizeof(pBoard->notification_cache));
+     memset(&pBoard->memory_transfer_params, 0, sizeof(pBoard->memory_transfer_params));
+ 
+     err = hailo_pcie_vdma_controller_init(&pBoard->vdma, &pBoard->pDev->dev,
+@@ -832,7 +770,6 @@ probe_exit:
+ static void hailo_pcie_remove(struct pci_dev* pDev)
+ {
+     struct hailo_pcie_board* pBoard = (struct hailo_pcie_board*) pci_get_drvdata(pDev);
+-    struct hailo_notification_wait *cursor = NULL;
+ 
+     pci_notice(pDev, "Remove: Releasing board\n");
+ 
+@@ -864,13 +801,7 @@ static void hailo_pcie_remove(struct pci
+ 
+         pci_set_drvdata(pDev, NULL);
+ 
+-        // Lock rcu_read_lock and send notification_completion to wake anyone waiting on the notification_wait_list when removed
+-        rcu_read_lock();
+-        list_for_each_entry_rcu(cursor, &pBoard->notification_wait_list, notification_wait_list) {
+-            cursor->is_disabled = true;
+-            complete(&cursor->notification_completion);
+-        }
+-        rcu_read_unlock();
++        hailo_nnc_finalize(&pBoard->nnc);
+ 
+         up(&pBoard->mutex);
+ 
+@@ -889,6 +820,15 @@ static void hailo_pcie_remove(struct pci
+ 
+ }
+ 
++inline int driver_down(struct hailo_pcie_board *board)
++{
++    if (board->pcie_resources.accelerator_type == HAILO_ACCELERATOR_TYPE_NNC) {
++        return hailo_nnc_driver_down(board);
++    } else {
++        return hailo_soc_driver_down(board);
++    }
++}
++
+ #ifdef CONFIG_PM_SLEEP
+ static int hailo_pcie_suspend(struct device *dev)
+ {
+@@ -899,17 +839,16 @@ static int hailo_pcie_suspend(struct dev
+     // lock board to wait for any pending operations
+     down(&board->mutex);
+ 
+-    // Disable all interrupts. All interrupts from Hailo chip would be masked.
+-    hailo_disable_interrupts(board);
+-
+-    // Close all vDMA channels
+     if (board->vdma.used_by_filp != NULL) {
+-        err = hailo_pcie_driver_down(board);
++        err = driver_down(board);
+         if (err < 0) {
+             dev_notice(dev, "Error while trying to call FW to close vdma channels\n");
+         }
+     }
+ 
++    // Disable all interrupts. All interrupts from Hailo chip would be masked.
++    hailo_disable_interrupts(board);
++
+     // Un validate all activae file contexts so every new action would return error to the user.
+     list_for_each_entry(cur, &board->open_files_list, open_files_list) {
+         cur->is_valid = false;
+@@ -919,8 +858,8 @@ static int hailo_pcie_suspend(struct dev
+     up(&board->mutex);
+ 
+     dev_notice(dev, "PM's suspend\n");
+-    // Continue system suspend
+-    return err;
++    // Success Oriented - Continue system suspend even in case of error (otherwise system will not suspend correctly)
++    return 0;
+ }
+ 
+ static int hailo_pcie_resume(struct device *dev)
+@@ -930,10 +869,10 @@ static int hailo_pcie_resume(struct devi
+ 
+     if ((err = hailo_activate_board(board)) < 0) {
+         dev_err(dev, "Failed activating board %d\n", err);
+-        return err;
+     }
+ 
+     dev_notice(dev, "PM's resume\n");
++    // Success Oriented - Continue system resume even in case of error (otherwise system will not suspend correctly)
+     return 0;
+ }
+ #endif /* CONFIG_PM_SLEEP */
+@@ -954,7 +893,7 @@ static void hailo_pci_reset_prepare(stru
+         down(&board->mutex);
+         if (board->vdma.used_by_filp != NULL) {
+             // Try to close all vDMA channels before reset
+-            err = hailo_pcie_driver_down(board);
++            err = driver_down(board);
+             if (err < 0) {
+                 pci_err(pdev, "Error while trying to call FW to close vdma channels (errno %d)\n", err);
+             }
+@@ -1088,6 +1027,9 @@ MODULE_PARM_DESC(force_desc_page_size, "
+ module_param(force_hailo15_legacy_mode, bool, S_IRUGO);
+ MODULE_PARM_DESC(force_hailo15_legacy_mode, "Forces work with Hailo15 in legacy mode(relevant for emulators)");
+ 
++module_param(force_boot_linux_from_eemc, bool, S_IRUGO);
++MODULE_PARM_DESC(force_boot_linux_from_eemc, "Boot the linux image from eemc (Requires special Image)");
++
+ MODULE_AUTHOR("Hailo Technologies Ltd.");
+ MODULE_DESCRIPTION("Hailo PCIe driver");
+ MODULE_LICENSE("GPL v2");
+--- a/drivers/media/pci/hailo/src/pcie.h
++++ b/drivers/media/pci/hailo/src/pcie.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_PCI_PCIE_H_
+@@ -41,6 +41,19 @@ struct hailo_fw_boot {
+ };
+ 
+ 
++struct hailo_pcie_nnc {
++    struct hailo_fw_control_info fw_control;
++
++    spinlock_t notification_read_spinlock;
++    struct list_head notification_wait_list;
++    struct hailo_d2h_notification notification_cache;
++    struct hailo_d2h_notification notification_to_user;
++};
++
++struct hailo_pcie_soc {
++    struct completion control_resp_ready;
++};
++
+ // Context for each open file handle
+ // TODO: store board and use as actual context
+ struct hailo_file_context {
+@@ -48,6 +61,7 @@ struct hailo_file_context {
+     struct file *filp;
+     struct hailo_vdma_file_context vdma_context;
+     bool is_valid;
++    u32 soc_used_channels_bitmap;
+ };
+ 
+ struct hailo_pcie_board {
+@@ -57,21 +71,17 @@ struct hailo_pcie_board {
+     atomic_t ref_count;
+     struct list_head open_files_list;
+     struct hailo_pcie_resources pcie_resources;
+-    struct hailo_fw_control_info fw_control;
++    struct hailo_pcie_nnc nnc;
++    struct hailo_pcie_soc soc;
+     struct hailo_pcie_driver_down_info driver_down;
+     struct semaphore mutex;
+     struct hailo_vdma_controller vdma;
+-    spinlock_t notification_read_spinlock;
+-    struct list_head notification_wait_list;
+-    struct hailo_d2h_notification notification_cache;
+-    struct hailo_d2h_notification notification_to_user;
++
+     struct hailo_memory_transfer_params memory_transfer_params;
+     u32 desc_max_page_size;
+     enum hailo_allocation_mode allocation_mode;
+     struct completion fw_loaded_completion;
+     bool interrupts_enabled;
+-    // Only needed in accelerator type soc
+-    struct completion soc_connect_accepted;
+ };
+ 
+ bool power_mode_enabled(void);
+--- /dev/null
++++ b/drivers/media/pci/hailo/src/soc.c
+@@ -0,0 +1,244 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
++ **/
++/**
++ * A Hailo PCIe NNC device is a device contains a full SoC over PCIe. The SoC contains NNC (neural network core) and
++ * some application processor (pci_ep).
++ */
++
++#include "soc.h"
++
++#include "vdma_common.h"
++#include "utils/logs.h"
++#include "vdma/memory.h"
++
++#include <linux/uaccess.h>
++
++#define PCI_SOC_VDMA_ENGINE_INDEX           (0)
++#define PCI_SOC_CONTROL_CONNECT_TIMEOUT_MS (1000)
++#define PCI_SOC_INPUT_CHANNEL_BITMASK       (0x000000FF)
++
++void hailo_soc_init(struct hailo_pcie_soc *soc)
++{
++    init_completion(&soc->control_resp_ready);
++}
++
++long hailo_soc_ioctl(struct hailo_pcie_board *board, struct hailo_file_context *context,
++    struct hailo_vdma_controller *controller, unsigned int cmd, unsigned long arg)
++{
++    switch (cmd) {
++    case HAILO_SOC_CONNECT:
++        return hailo_soc_connect_ioctl(board, context, controller, arg);
++    case HAILO_SOC_CLOSE:
++        return hailo_soc_close_ioctl(board, controller, context, arg);
++    default:
++        hailo_err(board, "Invalid pcie EP ioctl code 0x%x (nr: %d)\n", cmd, _IOC_NR(cmd));
++        return -ENOTTY;
++    }
++}
++
++static int soc_control(struct hailo_pcie_board *board,
++    const struct hailo_pcie_soc_request *request,
++    struct hailo_pcie_soc_response *response)
++{
++    int ret = 0;
++    reinit_completion(&board->soc.control_resp_ready);
++
++    hailo_pcie_soc_write_request(&board->pcie_resources, request);
++
++    ret = wait_for_completion_interruptible_timeout(&board->soc.control_resp_ready,
++        msecs_to_jiffies(PCI_SOC_CONTROL_CONNECT_TIMEOUT_MS));
++    if (ret <= 0) {
++        if (0 == ret) {
++            hailo_err(board, "Timeout waiting for soc control (timeout_ms=%d)\n", PCI_SOC_CONTROL_CONNECT_TIMEOUT_MS);
++            return -ETIMEDOUT;
++        } else {
++            hailo_info(board, "soc control failed with err=%d (process was interrupted or killed)\n",
++                ret);
++            return ret;
++        }
++    }
++
++    hailo_pcie_soc_read_response(&board->pcie_resources, response);
++    
++    if (response->status < 0) {
++        hailo_err(board, "soc control failed with status=%d\n", response->status);
++        return response->status;
++    }
++
++    if (response->control_code != request->control_code) {
++        hailo_err(board, "Invalid response control code %d (expected %d)\n",
++            response->control_code, request->control_code);
++        return -EINVAL;
++    }
++
++    return 0;
++}
++
++long hailo_soc_connect_ioctl(struct hailo_pcie_board *board, struct hailo_file_context *context,
++    struct hailo_vdma_controller *controller, unsigned long arg)
++{
++    struct hailo_pcie_soc_request request = {0};
++    struct hailo_pcie_soc_response response = {0};
++    struct hailo_soc_connect_params params;
++    struct hailo_vdma_channel *input_channel = NULL;
++    struct hailo_vdma_channel *output_channel = NULL;
++    struct hailo_vdma_engine *vdma_engine = &controller->vdma_engines[PCI_SOC_VDMA_ENGINE_INDEX];
++    struct hailo_descriptors_list_buffer *input_descriptors_buffer = NULL;
++    struct hailo_descriptors_list_buffer *output_descriptors_buffer = NULL;
++    uint8_t depth = 0;
++    int err = 0;
++
++    if (copy_from_user(&params, (void *)arg, sizeof(params))) {
++        hailo_err(board, "copy_from_user fail\n");
++        return -ENOMEM;
++    }
++
++    request = (struct hailo_pcie_soc_request) {
++        .control_code = HAILO_PCIE_SOC_CONTROL_CODE_CONNECT,
++        .connect = {
++            .port = params.port_number
++        }
++    };
++    err = soc_control(board, &request, &response);
++    if (err < 0) {
++        return err;
++    }
++
++    params.input_channel_index = response.connect.input_channel_index;
++    params.output_channel_index = response.connect.output_channel_index;
++
++    if (!hailo_check_channel_index(params.input_channel_index, controller->hw->src_channels_bitmask, true)) {
++        hailo_dev_err(&board->pDev->dev, "Invalid input channel index %u\n", params.input_channel_index);
++        return -EINVAL;
++    }
++
++    if (!hailo_check_channel_index(params.output_channel_index, controller->hw->src_channels_bitmask, false)) {
++        hailo_dev_err(&board->pDev->dev, "Invalid output channel index %u\n", params.output_channel_index);
++        return -EINVAL;
++    }
++
++    input_channel = &vdma_engine->channels[params.input_channel_index];
++    output_channel = &vdma_engine->channels[params.output_channel_index];
++
++    input_descriptors_buffer = hailo_vdma_find_descriptors_buffer(&context->vdma_context, params.input_desc_handle);
++    output_descriptors_buffer = hailo_vdma_find_descriptors_buffer(&context->vdma_context, params.output_desc_handle);
++    if (NULL == input_descriptors_buffer || NULL == output_descriptors_buffer) {
++        hailo_dev_err(&board->pDev->dev, "input / output descriptors buffer not found \n");
++        return -EINVAL;
++    }
++
++    if (!is_powerof2((size_t)input_descriptors_buffer->desc_list.desc_count) ||
++        !is_powerof2((size_t)output_descriptors_buffer->desc_list.desc_count)) {
++        hailo_dev_err(&board->pDev->dev, "Invalid desc list size\n");
++        return -EINVAL;
++    }
++
++    // configure and start input channel
++    depth = ceil_log2(input_descriptors_buffer->desc_list.desc_count);
++    // DMA Direction is only to get channel index - so 
++    err = hailo_vdma_start_channel(input_channel->host_regs, input_descriptors_buffer->dma_address, depth,
++        board->vdma.hw->ddr_data_id);
++    if (err < 0) {
++        hailo_dev_err(&board->pDev->dev, "Error starting vdma input channel index %u\n", params.input_channel_index);
++        return -EINVAL;
++    }
++
++    // Store the input channels state in bitmap (open)
++    hailo_set_bit(params.input_channel_index, &context->soc_used_channels_bitmap);
++    
++    // configure and start output channel
++    depth = ceil_log2(output_descriptors_buffer->desc_list.desc_count);
++    // DMA Direction is only to get channel index - so 
++    err = hailo_vdma_start_channel(output_channel->host_regs, output_descriptors_buffer->dma_address, depth,
++        board->vdma.hw->ddr_data_id);
++    if (err < 0) {
++        hailo_dev_err(&board->pDev->dev, "Error starting vdma output channel index %u\n", params.output_channel_index);
++        // Close input channel
++        hailo_vdma_stop_channel(input_channel->host_regs);
++        return -EINVAL;
++    }
++
++    // Store the output channels state in bitmap (open)
++    hailo_set_bit(params.output_channel_index, &context->soc_used_channels_bitmap);
++
++    if (copy_to_user((void *)arg, &params, sizeof(params))) {
++        hailo_dev_err(&board->pDev->dev, "copy_to_user fail\n");
++        return -ENOMEM;
++    }
++
++    return 0;
++}
++
++static int close_channels(struct hailo_pcie_board *board, u32 channels_bitmap)
++{
++    struct hailo_pcie_soc_request request = {0};
++    struct hailo_pcie_soc_response response = {0};
++    struct hailo_vdma_engine *engine = &board->vdma.vdma_engines[PCI_SOC_VDMA_ENGINE_INDEX];
++    struct hailo_vdma_channel *channel = NULL;
++    u8 channel_index = 0;
++
++    hailo_info(board, "Closing channels bitmap 0x%x\n", channels_bitmap);
++    for_each_vdma_channel(engine, channel, channel_index) {
++        if (hailo_test_bit(channel_index, &channels_bitmap)) {
++            hailo_vdma_stop_channel(channel->host_regs);
++        }
++    }
++
++    request = (struct hailo_pcie_soc_request) {
++        .control_code = HAILO_PCIE_SOC_CONTROL_CODE_CLOSE,
++        .close = {
++            .channels_bitmap = channels_bitmap
++        }
++    };
++    return soc_control(board, &request, &response);
++}
++
++long hailo_soc_close_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_controller *controller, 
++    struct hailo_file_context *context, unsigned long arg)
++{
++    struct hailo_soc_close_params params;
++    u32 channels_bitmap = 0;
++    int err = 0;
++
++    if (copy_from_user(&params, (void *)arg, sizeof(params))) {
++        hailo_dev_err(&board->pDev->dev, "copy_from_user fail\n");
++        return -ENOMEM;
++    }
++
++    // TOOD: check channels are connected
++
++    channels_bitmap = (1 << params.input_channel_index) | (1 << params.output_channel_index);
++
++    err = close_channels(board, channels_bitmap);
++    if (0 != err) {
++        hailo_dev_err(&board->pDev->dev, "Error closing channels\n");
++        return err;
++    }
++
++    // Store the channel state in bitmap (closed)
++    hailo_clear_bit(params.input_channel_index, &context->soc_used_channels_bitmap);
++    hailo_clear_bit(params.output_channel_index, &context->soc_used_channels_bitmap);
++
++    return err;
++}
++
++int hailo_soc_file_context_init(struct hailo_pcie_board *board, struct hailo_file_context *context)
++{
++    // Nothing to init yet
++    return 0;
++}
++
++void hailo_soc_file_context_finalize(struct hailo_pcie_board *board, struct hailo_file_context *context)
++{
++    // close only channels connected by this (by bitmap)
++    if (context->soc_used_channels_bitmap != 0) {
++        close_channels(board, context->soc_used_channels_bitmap);
++    }
++}
++
++int hailo_soc_driver_down(struct hailo_pcie_board *board)
++{
++    return close_channels(board, 0xFFFFFFFF);
++}
+\ No newline at end of file
+--- a/drivers/media/pci/hailo/src/pci_soc_ioctl.h
++++ /dev/null
+@@ -1,19 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/**
+- * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+- **/
+-
+-#ifndef _HAILO_PCI_SOC_IOCTL_H_
+-#define _HAILO_PCI_SOC_IOCTL_H_
+-
+-#include "vdma/ioctl.h"
+-#include "pcie.h"
+-
+-
+-long hailo_soc_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_file_context *context,
+-    struct hailo_vdma_controller *controller, unsigned int cmd, unsigned long arg);
+-long hailo_soc_connect_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_file_context *context,
+-    struct hailo_vdma_controller *controller, unsigned long arg);
+-long hailo_soc_close_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_controller *controller, unsigned long arg);
+-
+-#endif // _HAILO_PCI_SOC_IOCTL_H_
+\ No newline at end of file
+--- /dev/null
++++ b/drivers/media/pci/hailo/src/soc.h
+@@ -0,0 +1,26 @@
++// SPDX-License-Identifier: GPL-2.0
++/**
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
++ **/
++
++#ifndef _HAILO_PCI_SOC_IOCTL_H_
++#define _HAILO_PCI_SOC_IOCTL_H_
++
++#include "vdma/ioctl.h"
++#include "pcie.h"
++
++
++void hailo_soc_init(struct hailo_pcie_soc *soc);
++
++long hailo_soc_ioctl(struct hailo_pcie_board *board, struct hailo_file_context *context,
++    struct hailo_vdma_controller *controller, unsigned int cmd, unsigned long arg);
++long hailo_soc_connect_ioctl(struct hailo_pcie_board *board, struct hailo_file_context *context,
++    struct hailo_vdma_controller *controller, unsigned long arg);
++long hailo_soc_close_ioctl(struct hailo_pcie_board *board, struct hailo_vdma_controller *controller, struct hailo_file_context *context, unsigned long arg);
++
++int hailo_soc_file_context_init(struct hailo_pcie_board *board, struct hailo_file_context *context);
++void hailo_soc_file_context_finalize(struct hailo_pcie_board *board, struct hailo_file_context *context);
++
++int hailo_soc_driver_down(struct hailo_pcie_board *board);
++
++#endif // _HAILO_PCI_SOC_IOCTL_H_
+\ No newline at end of file
+--- a/drivers/media/pci/hailo/src/sysfs.c
++++ b/drivers/media/pci/hailo/src/sysfs.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include "sysfs.h"
+--- a/drivers/media/pci/hailo/src/sysfs.h
++++ b/drivers/media/pci/hailo/src/sysfs.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_PCI_SYSFS_H_
+--- a/drivers/media/pci/hailo/src/utils.c
++++ /dev/null
+@@ -1,26 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0
+-/**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
+- **/
+-
+-#include <linux/version.h>
+-#include <linux/init.h>
+-#include <linux/module.h>
+-#include <linux/pci.h>
+-
+-#include "pcie.h"
+-#include "utils.h"
+-#include "utils/logs.h"
+-
+-
+-void hailo_pcie_clear_notification_wait_list(struct hailo_pcie_board *pBoard, struct file *filp)
+-{
+-    struct hailo_notification_wait *cur = NULL, *next = NULL;
+-    list_for_each_entry_safe(cur, next, &pBoard->notification_wait_list, notification_wait_list) {
+-        if (cur->filp == filp) {
+-            list_del_rcu(&cur->notification_wait_list);
+-            synchronize_rcu();
+-            kfree(cur);
+-        }
+-    }
+-}
+--- a/drivers/media/pci/hailo/utils/compact.h
++++ b/drivers/media/pci/hailo/utils/compact.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_PCI_COMPACT_H_
+--- a/drivers/media/pci/hailo/utils/fw_common.h
++++ b/drivers/media/pci/hailo/utils/fw_common.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_LINUX_COMMON_H_
+--- a/drivers/media/pci/hailo/utils/integrated_nnc_utils.c
++++ b/drivers/media/pci/hailo/utils/integrated_nnc_utils.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include "integrated_nnc_utils.h"
+@@ -43,11 +43,19 @@ int hailo_ioremap_shmem(struct platform_
+     void __iomem * remap_ptr;
+ 
+     shmem = of_parse_phandle(pdev->dev.of_node, "shmem", index);
++    if (!shmem) {
++        hailo_dev_err(&pdev->dev, "Failed to find shmem node index: %d in device tree\n", index);
++        return -ENODEV;
++    }
++
+     ret = of_address_to_resource(shmem, 0, &res);
+     if (ret) {
+         hailo_dev_err(&pdev->dev, "hailo_ioremap_shmem, failed to get memory (index: %d)\n", index);
++        of_node_put(shmem);
+         return ret;
+     }
++
++    // Decrement the refcount of the node
+     of_node_put(shmem);
+ 
+     remap_ptr = devm_ioremap(&pdev->dev, res.start, resource_size(&res));
+--- a/drivers/media/pci/hailo/utils/integrated_nnc_utils.h
++++ b/drivers/media/pci/hailo/utils/integrated_nnc_utils.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _INTEGRATED_NNC_UTILS_H_
+--- a/drivers/media/pci/hailo/utils/logs.c
++++ b/drivers/media/pci/hailo/utils/logs.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include "logs.h"
+--- a/drivers/media/pci/hailo/utils/logs.h
++++ b/drivers/media/pci/hailo/utils/logs.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _COMMON_LOGS_H_
+--- a/drivers/media/pci/hailo/vdma/ioctl.c
++++ b/drivers/media/pci/hailo/vdma/ioctl.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #include "ioctl.h"
+@@ -12,7 +12,7 @@
+ #include <linux/uaccess.h>
+ 
+ 
+-long hailo_vdma_enable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg)
++long hailo_vdma_enable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg, struct hailo_vdma_file_context *context)
+ {
+     struct hailo_vdma_enable_channels_params input;
+     struct hailo_vdma_engine *engine = NULL;
+@@ -40,12 +40,15 @@ long hailo_vdma_enable_channels_ioctl(st
+         hailo_vdma_update_interrupts_mask(controller, engine_index);
+         hailo_dev_info(controller->dev, "Enabled interrupts for engine %u, channels bitmap 0x%x\n",
+             engine_index, channels_bitmap);
++
++        // Update the context with the enabled channels bitmap
++        context->enabled_channels_bitmap[engine_index] |= channels_bitmap;
+     }
+ 
+     return 0;
+ }
+ 
+-long hailo_vdma_disable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg)
++long hailo_vdma_disable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg, struct hailo_vdma_file_context *context)
+ {
+     struct hailo_vdma_disable_channels_params input;
+     struct hailo_vdma_engine *engine = NULL;
+@@ -77,6 +80,9 @@ long hailo_vdma_disable_channels_ioctl(s
+ 
+         hailo_dev_info(controller->dev, "Disabled channels for engine %u, bitmap 0x%x\n",
+             engine_index, channels_bitmap);
++
++        // Update the context with the disabled channels bitmap
++        context->enabled_channels_bitmap[engine_index] &= ~channels_bitmap;
+     }
+ 
+     // Wake up threads waiting
+@@ -204,7 +210,7 @@ long hailo_vdma_buffer_map_ioctl(struct
+         return -EFAULT;
+     }
+ 
+-    hailo_dev_info(controller->dev, "address %lx tgid %d size: %zu\n",
++    hailo_dev_dbg(controller->dev, "address %lx tgid %d size: %zu\n",
+         buf_info.user_address, current->tgid, buf_info.size);
+ 
+     direction = get_dma_direction(buf_info.data_direction);
+@@ -231,7 +237,7 @@ long hailo_vdma_buffer_map_ioctl(struct
+     }
+ 
+     list_add(&mapped_buffer->mapped_user_buffer_list, &context->mapped_user_buffer_list);
+-    hailo_dev_info(controller->dev, "buffer %lx (handle %zu) is mapped\n",
++    hailo_dev_dbg(controller->dev, "buffer %lx (handle %zu) is mapped\n",
+         buf_info.user_address, buf_info.mapped_handle);
+     return 0;
+ }
+@@ -247,7 +253,7 @@ long hailo_vdma_buffer_unmap_ioctl(struc
+         return -EFAULT;
+     }
+ 
+-    hailo_dev_info(controller->dev, "unmap user buffer handle %zu\n", buffer_unmap_params.mapped_handle);
++    hailo_dev_dbg(controller->dev, "unmap user buffer handle %zu\n", buffer_unmap_params.mapped_handle);
+ 
+     mapped_buffer = hailo_vdma_find_mapped_user_buffer(context, buffer_unmap_params.mapped_handle);
+     if (mapped_buffer == NULL) {
+--- a/drivers/media/pci/hailo/vdma/ioctl.h
++++ b/drivers/media/pci/hailo/vdma/ioctl.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #ifndef _HAILO_VDMA_IOCTL_H_
+@@ -8,8 +8,8 @@
+ 
+ #include "vdma/vdma.h"
+ 
+-long hailo_vdma_enable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg);
+-long hailo_vdma_disable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg);
++long hailo_vdma_enable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg, struct hailo_vdma_file_context *context);
++long hailo_vdma_disable_channels_ioctl(struct hailo_vdma_controller *controller, unsigned long arg, struct hailo_vdma_file_context *context);
+ long hailo_vdma_interrupts_wait_ioctl(struct hailo_vdma_controller *controller, unsigned long arg,
+     struct semaphore *mutex, bool *should_up_board_mutex);
+ 
+--- a/drivers/media/pci/hailo/vdma/memory.c
++++ b/drivers/media/pci/hailo/vdma/memory.c
+@@ -1,11 +1,12 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #define pr_fmt(fmt) "hailo: " fmt
+ 
+ #include "memory.h"
++#include "utils.h"
+ #include "utils/compact.h"
+ 
+ #include <linux/slab.h>
+@@ -316,6 +317,11 @@ int hailo_desc_list_create(struct device
+     size_t buffer_size = 0;
+     const u64 align = VDMA_DESCRIPTOR_LIST_ALIGN; //First addr must be aligned on 64 KB  (from the VDMA registers documentation)
+ 
++    if (MAX_POWER_OF_2_VALUE < descriptors_count) {
++        dev_err(dev, "Invalid descriptors count %u\n", descriptors_count);
++        return -EINVAL;
++    }
++
+     buffer_size = descriptors_count * sizeof(struct hailo_vdma_descriptor);
+     buffer_size = ALIGN(buffer_size, align);
+ 
+@@ -323,7 +329,7 @@ int hailo_desc_list_create(struct device
+         &descriptors->dma_address, GFP_KERNEL | __GFP_ZERO);
+     if (descriptors->kernel_address == NULL) {
+         dev_err(dev, "Failed to allocate descriptors list, desc_count 0x%x, buffer_size 0x%zx, This failure means there is not a sufficient amount of CMA memory "
+-            "(contiguous physical memory), This usually is caused by lack of general system memory. Please check you have sufficent memory.\n",
++            "(contiguous physical memory), This usually is caused by lack of general system memory. Please check you have sufficient memory.\n",
+             descriptors_count, buffer_size);
+         return -ENOMEM;
+     }
+@@ -333,6 +339,8 @@ int hailo_desc_list_create(struct device
+ 
+     descriptors->desc_list.desc_list = descriptors->kernel_address;
+     descriptors->desc_list.desc_count = descriptors_count;
++    // No need to check the return value of get_nearest_powerof_2 because we already checked the input
++    descriptors->desc_list.desc_count_mask = is_circular ? (descriptors_count - 1) : (get_nearest_powerof_2(descriptors_count) - 1);
+     descriptors->desc_list.desc_page_size = desc_page_size;
+     descriptors->desc_list.is_circular = is_circular;
+ 
+--- a/drivers/media/pci/hailo/vdma/memory.h
++++ b/drivers/media/pci/hailo/vdma/memory.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ /**
+  * vDMA memory utility (including allocation and mappings)
+--- a/drivers/media/pci/hailo/vdma/vdma.c
++++ b/drivers/media/pci/hailo/vdma/vdma.c
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ 
+ #define pr_fmt(fmt) "hailo: " fmt
+@@ -105,6 +105,9 @@ void hailo_vdma_file_context_init(struct
+     INIT_LIST_HEAD(&context->descriptors_buffer_list);
+     INIT_LIST_HEAD(&context->vdma_low_memory_buffer_list);
+     INIT_LIST_HEAD(&context->continuous_buffer_list);
++
++    BUILD_BUG_ON_MSG(MAX_VDMA_CHANNELS_PER_ENGINE > sizeof(context->enabled_channels_bitmap[0]) * BITS_IN_BYTE,
++        "Unexpected amount of VDMA channels per engine");
+ }
+ 
+ void hailo_vdma_update_interrupts_mask(struct hailo_vdma_controller *controller,
+@@ -119,21 +122,22 @@ void hailo_vdma_file_context_finalize(st
+ {
+     size_t engine_index = 0;
+     struct hailo_vdma_engine *engine = NULL;
+-    const u32 channels_bitmap = 0xFFFFFFFF; // disable all channel interrupts
+     unsigned long irq_saved_flags = 0;
+     // In case of FLR, the vdma registers will be NULL
+     const bool is_device_up = (NULL != controller->dev);
+ 
+-    if (filp == controller->used_by_filp) {
+-        for_each_vdma_engine(controller, engine, engine_index) {
+-            hailo_vdma_engine_disable_channels(engine, channels_bitmap);
++    for_each_vdma_engine(controller, engine, engine_index) {
++        if (context->enabled_channels_bitmap[engine_index]) {
++            hailo_dev_info(controller->dev, "Disabling channels for engine %zu, channels bitmap 0x%x\n", engine_index, 
++            context->enabled_channels_bitmap[engine_index]);
++            hailo_vdma_engine_disable_channels(engine, context->enabled_channels_bitmap[engine_index]);
+ 
+             if (is_device_up) {
+                 hailo_vdma_update_interrupts_mask(controller, engine_index);
+             }
+ 
+             spin_lock_irqsave(&controller->interrupts_lock, irq_saved_flags);
+-            hailo_vdma_engine_clear_channel_interrupts(engine, channels_bitmap);
++            hailo_vdma_engine_clear_channel_interrupts(engine, context->enabled_channels_bitmap[engine_index]);
+             spin_unlock_irqrestore(&controller->interrupts_lock, irq_saved_flags);
+         }
+     }
+@@ -148,10 +152,21 @@ void hailo_vdma_file_context_finalize(st
+     }
+ }
+ 
++void hailo_vdma_wakeup_interrupts(struct hailo_vdma_controller *controller, struct hailo_vdma_engine *engine, 
++    u32 channels_bitmap)
++{
++    unsigned long irq_saved_flags = 0;
++
++    spin_lock_irqsave(&controller->interrupts_lock, irq_saved_flags);
++    hailo_vdma_engine_set_channel_interrupts(engine, channels_bitmap);
++    spin_unlock_irqrestore(&controller->interrupts_lock, irq_saved_flags);
++
++    wake_up_interruptible_all(&controller->interrupts_wq);
++}
++
+ void hailo_vdma_irq_handler(struct hailo_vdma_controller *controller,
+     size_t engine_index, u32 channels_bitmap)
+ {
+-    unsigned long irq_saved_flags = 0;
+     struct hailo_vdma_engine *engine = NULL;
+ 
+     BUG_ON(engine_index >= controller->vdma_engines_count);
+@@ -159,11 +174,7 @@ void hailo_vdma_irq_handler(struct hailo
+ 
+     hailo_vdma_engine_push_timestamps(engine, channels_bitmap);
+ 
+-    spin_lock_irqsave(&controller->interrupts_lock, irq_saved_flags);
+-    hailo_vdma_engine_set_channel_interrupts(engine, channels_bitmap);
+-    spin_unlock_irqrestore(&controller->interrupts_lock, irq_saved_flags);
+-
+-    wake_up_interruptible_all(&controller->interrupts_wq);
++    hailo_vdma_wakeup_interrupts(controller, engine, channels_bitmap);
+ }
+ 
+ long hailo_vdma_ioctl(struct hailo_vdma_file_context *context, struct hailo_vdma_controller *controller,
+@@ -171,9 +182,9 @@ long hailo_vdma_ioctl(struct hailo_vdma_
+ {
+     switch (cmd) {
+     case HAILO_VDMA_ENABLE_CHANNELS:
+-        return hailo_vdma_enable_channels_ioctl(controller, arg);
++        return hailo_vdma_enable_channels_ioctl(controller, arg, context);
+     case HAILO_VDMA_DISABLE_CHANNELS:
+-        return hailo_vdma_disable_channels_ioctl(controller, arg);
++        return hailo_vdma_disable_channels_ioctl(controller, arg, context);
+     case HAILO_VDMA_INTERRUPTS_WAIT:
+         return hailo_vdma_interrupts_wait_ioctl(controller, arg, mutex, should_up_board_mutex);
+     case HAILO_VDMA_INTERRUPTS_READ_TIMESTAMPS:
+--- a/drivers/media/pci/hailo/vdma/vdma.h
++++ b/drivers/media/pci/hailo/vdma/vdma.h
+@@ -1,6 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /**
+- * Copyright (c) 2019-2022 Hailo Technologies Ltd. All rights reserved.
++ * Copyright (c) 2019-2024 Hailo Technologies Ltd. All rights reserved.
+  **/
+ /**
+  * Hailo vdma engine definitions
+@@ -130,6 +130,7 @@ struct hailo_vdma_file_context {
+     struct list_head descriptors_buffer_list;
+     struct list_head vdma_low_memory_buffer_list;
+     struct list_head continuous_buffer_list;
++    u32 enabled_channels_bitmap[MAX_VDMA_ENGINES];
+ };
+ 
+ 
+@@ -145,6 +146,8 @@ void hailo_vdma_file_context_init(struct
+ void hailo_vdma_file_context_finalize(struct hailo_vdma_file_context *context,
+     struct hailo_vdma_controller *controller, struct file *filp);
+ 
++void hailo_vdma_wakeup_interrupts(struct hailo_vdma_controller *controller, struct hailo_vdma_engine *engine, 
++    u32 channels_bitmap);
+ void hailo_vdma_irq_handler(struct hailo_vdma_controller *controller, size_t engine_index,
+     u32 channels_bitmap);
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1398-dtoverlays-enable-SPI-CS-active-high.patch b/target/linux/bcm27xx/patches-6.6/950-1398-dtoverlays-enable-SPI-CS-active-high.patch
new file mode 100644
index 00000000000000..ecd26a78b8324c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1398-dtoverlays-enable-SPI-CS-active-high.patch
@@ -0,0 +1,108 @@
+From dbf12796d1368286672529d7b03f81066a8c36f3 Mon Sep 17 00:00:00 2001
+From: Iker Pedrosa <ikerpedrosam@gmail.com>
+Date: Mon, 18 Nov 2024 10:55:33 +0100
+Subject: [PATCH] dtoverlays: enable SPI CS active-high
+
+The documentation isn't very clear explaining how to enable SPI CS
+active-high and it takes a long time to understand it. Adding a specific
+overlay as a simple example on how to invert this signal can help
+understand the solution.
+
+Link: https://forums.raspberrypi.com/viewtopic.php?t=378222
+Signed-off-by: Iker Pedrosa <ikerpedrosam@gmail.com>
+---
+ arch/arm/boot/dts/overlays/Makefile           |  1 +
+ arch/arm/boot/dts/overlays/README             |  8 +++
+ .../overlays/spi0-1cs-inverted-overlay.dts    | 59 +++++++++++++++++++
+ 3 files changed, 68 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/spi0-1cs-inverted-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -259,6 +259,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	spi-rtc.dtbo \
+ 	spi0-0cs.dtbo \
+ 	spi0-1cs.dtbo \
++	spi0-1cs-inverted.dtbo \
+ 	spi0-2cs.dtbo \
+ 	spi1-1cs.dtbo \
+ 	spi1-2cs.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -4438,6 +4438,14 @@ Params: cs0_pin                 GPIO pin
+                                 it for other uses.
+ 
+ 
++Name:   spi0-1cs-inverted
++Info:   Only use one CS pin for SPI0 and set to active-high
++Load:   dtoverlay=spi0-1cs-inverted,<param>=<val>
++Params: cs0_pin                 GPIO pin for CS0 (default 8)
++        no_miso                 Don't claim and use the MISO pin (9), freeing
++                                it for other uses.
++
++
+ Name:   spi0-2cs
+ Info:   Change the CS pins for SPI0
+ Load:   dtoverlay=spi0-2cs,<param>=<val>
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/spi0-1cs-inverted-overlay.dts
+@@ -0,0 +1,59 @@
++/dts-v1/;
++/plugin/;
++
++/*
++ * There are some devices that need an inverted Chip Select (CS) to select the
++ * device signal, as an example the AZDelivery 12864 display. That means that
++ * the CS polarity is active-high. To invert the CS signal the DT needs to set
++ * the cs-gpio to GPIO_ACTIVE_HIGH (0) in the controller and set the
++ * spi-cs-high in the peripheral property. On top of that, since this is a
++ * display the DT also needs to specify the write-only property.
++*/
++
++#include <dt-bindings/gpio/gpio.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&spi0_cs_pins>;
++		frag0: __overlay__ {
++			brcm,pins = <8>;
++		};
++	};
++
++	fragment@1 {
++		target = <&spi0>;
++		frag1: __overlay__ {
++			cs-gpios = <&gpio 8 GPIO_ACTIVE_HIGH>;
++			status = "okay";
++		};
++	};
++
++	fragment@2 {
++		target = <&spidev1>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++
++	fragment@3 {
++		target = <&spi0_pins>;
++		__dormant__ {
++			brcm,pins = <10 11>;
++		};
++	};
++
++	fragment@4 {
++		target = <&spidev0>;
++		__overlay__ {
++			spi-cs-high;
++		};
++	};
++
++	__overrides__ {
++		cs0_pin  = <&frag0>,"brcm,pins:0",
++			   <&frag1>,"cs-gpios:4";
++		no_miso = <0>,"=3";
++	};
++};
diff --git a/target/linux/bcm27xx/patches-6.6/950-1399-drm-vc4-hvs-Defer-updating-the-enable_bg_fill-until-.patch b/target/linux/bcm27xx/patches-6.6/950-1399-drm-vc4-hvs-Defer-updating-the-enable_bg_fill-until-.patch
new file mode 100644
index 00000000000000..8f8af00c9fb9ec
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1399-drm-vc4-hvs-Defer-updating-the-enable_bg_fill-until-.patch
@@ -0,0 +1,64 @@
+From 57b528e557890f25e010b6bc7356b5a716c79db2 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 12 Nov 2024 17:58:52 +0000
+Subject: [PATCH] drm/vc4: hvs: Defer updating the enable_bg_fill until vblank
+
+The register to enable/disable background fill was being set
+from atomic flush, however that will be applied immediately and
+can be a while before the vblank. If it was required for the
+current frame but not for the next one, that can result in
+corruption for part of the current frame.
+
+Store the state in vc4_hvs, and update it on vblank.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_drv.h |  2 ++
+ drivers/gpu/drm/vc4/vc4_hvs.c | 18 ++++++++++--------
+ 2 files changed, 12 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_drv.h
++++ b/drivers/gpu/drm/vc4/vc4_drv.h
+@@ -339,6 +339,8 @@ struct vc4_hvs {
+ 		unsigned int enabled: 1;
+ 	} eof_irq[HVS_NUM_CHANNELS];
+ 
++	bool bg_fill[HVS_NUM_CHANNELS];
++
+ 	unsigned long max_core_rate;
+ 
+ 	/* Memory manager for CRTCs to allocate space in the display
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -1470,14 +1470,7 @@ void vc4_hvs_atomic_flush(struct drm_crt
+ 		/* This sets a black background color fill, as is the case
+ 		 * with other DRM drivers.
+ 		 */
+-		if (enable_bg_fill)
+-			HVS_WRITE(SCALER6_DISPX_CTRL1(channel),
+-				  HVS_READ(SCALER6_DISPX_CTRL1(channel)) |
+-				  SCALER6(DISPX_CTRL1_BGENB));
+-		else
+-			HVS_WRITE(SCALER6_DISPX_CTRL1(channel),
+-				  HVS_READ(SCALER6_DISPX_CTRL1(channel)) &
+-				  ~SCALER6(DISPX_CTRL1_BGENB));
++		hvs->bg_fill[channel] = enable_bg_fill;
+ 	} else {
+ 		/* we can actually run with a lower core clock when background
+ 		 * fill is enabled on VC4_GEN_5 so leave it enabled always.
+@@ -1662,6 +1655,15 @@ static irqreturn_t vc6_hvs_eof_irq_handl
+ 		if (hvs->eof_irq[i].desc != irq)
+ 			continue;
+ 
++		if (hvs->bg_fill[i])
++			HVS_WRITE(SCALER6_DISPX_CTRL1(i),
++				  HVS_READ(SCALER6_DISPX_CTRL1(i)) |
++				  SCALER6(DISPX_CTRL1_BGENB));
++		else
++			HVS_WRITE(SCALER6_DISPX_CTRL1(i),
++				  HVS_READ(SCALER6_DISPX_CTRL1(i)) &
++				  ~SCALER6(DISPX_CTRL1_BGENB));
++
+ 		vc4_hvs_schedule_dlist_sweep(hvs, i);
+ 		return IRQ_HANDLED;
+ 	}
diff --git a/target/linux/bcm27xx/patches-6.6/950-1400-misc-rp1-pio-Add-FIFO-related-methods.patch b/target/linux/bcm27xx/patches-6.6/950-1400-misc-rp1-pio-Add-FIFO-related-methods.patch
new file mode 100644
index 00000000000000..da21526c21c217
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1400-misc-rp1-pio-Add-FIFO-related-methods.patch
@@ -0,0 +1,215 @@
+From dd2394360860d15146c96635796a75b05bb32b61 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 19 Nov 2024 09:25:34 +0000
+Subject: [PATCH] misc: rp1-pio: Add FIFO-related methods
+
+Add support for querying the FIFO status and clearing the TX FIFO.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/rp1-fw-pio.h      |  3 ++
+ drivers/misc/rp1-pio.c         | 24 +++++++++
+ include/linux/pio_rp1.h        | 89 ++++++++++++++++++++++++++++++++++
+ include/uapi/misc/rp1_pio_if.h | 13 ++++-
+ 4 files changed, 128 insertions(+), 1 deletion(-)
+
+--- a/drivers/misc/rp1-fw-pio.h
++++ b/drivers/misc/rp1-fw-pio.h
+@@ -47,6 +47,9 @@ enum rp1_pio_ops {
+ 	READ_HW,		// src address, len -> data bytes
+ 	WRITE_HW,		// dst address, data
+ 
++	PIO_SM_FIFO_STATE,	// u16 sm, u8 tx -> u16 level, u8 empty, u8 full
++	PIO_SM_DRAIN_TX,	// u16 sm
++
+ 	PIO_COUNT
+ };
+ 
+--- a/drivers/misc/rp1-pio.c
++++ b/drivers/misc/rp1-pio.c
+@@ -476,6 +476,28 @@ int rp1_pio_sm_set_dmactrl(struct rp1_pi
+ }
+ EXPORT_SYMBOL_GPL(rp1_pio_sm_set_dmactrl);
+ 
++int rp1_pio_sm_fifo_state(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_fifo_state_args *args = param;
++	const int level_offset = offsetof(struct rp1_pio_sm_fifo_state_args, level);
++	int ret;
++
++	ret = rp1_pio_message_resp(client->pio, PIO_SM_FIFO_STATE, args, sizeof(*args),
++				   &args->level, NULL, sizeof(*args) - level_offset);
++	if (ret >= 0)
++		return level_offset + ret;
++	return ret;
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_fifo_state);
++
++int rp1_pio_sm_drain_tx(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_clear_fifos_args *args = param;
++
++	return rp1_pio_message(client->pio, PIO_SM_DRAIN_TX, args, sizeof(*args));
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_drain_tx);
++
+ int rp1_pio_gpio_init(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_gpio_init_args *args = param;
+@@ -848,6 +870,8 @@ struct handler_info {
+ 	HANDLER(SM_PUT, sm_put),
+ 	HANDLER(SM_GET, sm_get),
+ 	HANDLER(SM_SET_DMACTRL, sm_set_dmactrl),
++	HANDLER(SM_FIFO_STATE, sm_fifo_state),
++	HANDLER(SM_DRAIN_TX, sm_drain_tx),
+ 
+ 	HANDLER(GPIO_INIT, gpio_init),
+ 	HANDLER(GPIO_SET_FUNCTION, gpio_set_function),
+--- a/include/linux/pio_rp1.h
++++ b/include/linux/pio_rp1.h
+@@ -200,6 +200,8 @@ int rp1_pio_sm_enable_sync(struct rp1_pi
+ int rp1_pio_sm_put(struct rp1_pio_client *client, void *param);
+ int rp1_pio_sm_get(struct rp1_pio_client *client, void *param);
+ int rp1_pio_sm_set_dmactrl(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_fifo_state(struct rp1_pio_client *client, void *param);
++int rp1_pio_sm_drain_tx(struct rp1_pio_client *client, void *param);
+ int rp1_pio_gpio_init(struct rp1_pio_client *client, void *param);
+ int rp1_pio_gpio_set_function(struct rp1_pio_client *client, void *param);
+ int rp1_pio_gpio_set_pulls(struct rp1_pio_client *client, void *param);
+@@ -551,6 +553,15 @@ static inline int pio_sm_set_dmactrl(str
+ 	return rp1_pio_sm_set_dmactrl(client, &args);
+ };
+ 
++static inline int pio_sm_drain_tx_fifo(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_clear_fifos_args args = { .sm = sm };
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	return rp1_pio_sm_drain_tx(client, &args);
++};
++
+ static inline int pio_sm_put(struct rp1_pio_client *client, uint sm, uint32_t data)
+ {
+ 	struct rp1_pio_sm_put_args args = { .sm = (uint16_t)sm, .blocking = false, .data = data };
+@@ -587,6 +598,84 @@ static inline uint32_t pio_sm_get_blocki
+ 	return args.data;
+ }
+ 
++static inline int pio_sm_is_rx_fifo_empty(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_fifo_state_args args = { .sm = sm, .tx = false };
++	int ret;
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	ret = rp1_pio_sm_fifo_state(client, &args);
++	if (ret == sizeof(args))
++		ret = args.empty;
++	return ret;
++};
++
++static inline int pio_sm_is_rx_fifo_full(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_fifo_state_args args = { .sm = sm, .tx = false };
++	int ret;
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	ret = rp1_pio_sm_fifo_state(client, &args);
++	if (ret == sizeof(args))
++		ret = args.full;
++	return ret;
++};
++
++static inline int pio_sm_rx_fifo_level(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_fifo_state_args args = { .sm = sm, .tx = false };
++	int ret;
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	ret = rp1_pio_sm_fifo_state(client, &args);
++	if (ret == sizeof(args))
++		ret = args.level;
++	return ret;
++};
++
++static inline int pio_sm_is_tx_fifo_empty(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_fifo_state_args args = { .sm = sm, .tx = true };
++	int ret;
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	ret = rp1_pio_sm_fifo_state(client, &args);
++	if (ret == sizeof(args))
++		ret = args.empty;
++	return ret;
++};
++
++static inline int pio_sm_is_tx_fifo_full(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_fifo_state_args args = { .sm = sm, .tx = true };
++	int ret;
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	ret = rp1_pio_sm_fifo_state(client, &args);
++	if (ret == sizeof(args))
++		ret = args.full;
++	return ret;
++};
++
++static inline int pio_sm_tx_fifo_level(struct rp1_pio_client *client, uint sm)
++{
++	struct rp1_pio_sm_fifo_state_args args = { .sm = sm, .tx = true };
++	int ret;
++
++	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
++		return -EINVAL;
++	ret = rp1_pio_sm_fifo_state(client, &args);
++	if (ret == sizeof(args))
++		ret = args.level;
++	return ret;
++};
++
+ static inline void sm_config_set_out_pins(pio_sm_config *c, uint out_base, uint out_count)
+ {
+ 	if (bad_params_if(NULL, out_base >= RP1_PIO_GPIO_COUNT ||
+--- a/include/uapi/misc/rp1_pio_if.h
++++ b/include/uapi/misc/rp1_pio_if.h
+@@ -114,7 +114,7 @@ struct rp1_pio_sm_get_args {
+ 	uint16_t sm;
+ 	uint8_t blocking;
+ 	uint8_t rsvd;
+-	uint32_t data; /* IN/OUT */
++	uint32_t data; /* OUT */
+ };
+ 
+ struct rp1_pio_sm_set_dmactrl_args {
+@@ -124,6 +124,15 @@ struct rp1_pio_sm_set_dmactrl_args {
+ 	uint32_t ctrl;
+ };
+ 
++struct rp1_pio_sm_fifo_state_args {
++	uint16_t sm;
++	uint8_t tx;
++	uint8_t rsvd;
++	uint16_t level; /* OUT */
++	uint8_t empty; /* OUT */
++	uint8_t full; /* OUT */
++};
++
+ struct rp1_gpio_init_args {
+ 	uint16_t gpio;
+ };
+@@ -195,6 +204,8 @@ struct rp1_access_hw_args {
+ #define PIO_IOC_SM_PUT _IOW(PIO_IOC_MAGIC, 41, struct rp1_pio_sm_put_args)
+ #define PIO_IOC_SM_GET _IOWR(PIO_IOC_MAGIC, 42, struct rp1_pio_sm_get_args)
+ #define PIO_IOC_SM_SET_DMACTRL _IOW(PIO_IOC_MAGIC, 43, struct rp1_pio_sm_set_dmactrl_args)
++#define PIO_IOC_SM_FIFO_STATE _IOW(PIO_IOC_MAGIC, 44, struct rp1_pio_sm_fifo_state_args)
++#define PIO_IOC_SM_DRAIN_TX _IOW(PIO_IOC_MAGIC, 45, struct rp1_pio_sm_clear_fifos_args)
+ 
+ #define PIO_IOC_GPIO_INIT _IOW(PIO_IOC_MAGIC, 50, struct rp1_gpio_init_args)
+ #define PIO_IOC_GPIO_SET_FUNCTION _IOW(PIO_IOC_MAGIC, 51, struct rp1_gpio_set_function_args)
diff --git a/target/linux/bcm27xx/patches-6.6/950-1401-overlays-Enable-Raspberry-Touch-2-rotation-with-over.patch b/target/linux/bcm27xx/patches-6.6/950-1401-overlays-Enable-Raspberry-Touch-2-rotation-with-over.patch
new file mode 100644
index 00000000000000..1a709577ebf3f0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1401-overlays-Enable-Raspberry-Touch-2-rotation-with-over.patch
@@ -0,0 +1,31 @@
+From fa6ad4bcad4e8db18493a4af640b4b5c95434e70 Mon Sep 17 00:00:00 2001
+From: Just a nerd <157698061+foonerd@users.noreply.github.com>
+Date: Wed, 20 Nov 2024 14:08:48 +0000
+Subject: [PATCH] overlays: Enable Raspberry Touch 2 rotation with overlay
+
+See: https://github.com/raspberrypi/linux/pull/6480
+Signed-off-by: foonerd <foonerd@github.com>
+---
+ arch/arm/boot/dts/overlays/README                                | 1 +
+ arch/arm/boot/dts/overlays/vc4-kms-dsi-ili9881-7inch-overlay.dts | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -5249,6 +5249,7 @@ Params: sizex                   Touchscr
+         invy                    Touchscreen inverted y axis
+         swapxy                  Touchscreen swapped x y axis
+         disable_touch           Disables the touch screen overlay driver
++        rotation                Display rotation {0,90,180,270} (default 0)
+         dsi0                    Use DSI0 and i2c_csi_dsi0 (rather than
+                                 the default DSI1 and i2c_csi_dsi).
+ 
+--- a/arch/arm/boot/dts/overlays/vc4-kms-dsi-ili9881-7inch-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-ili9881-7inch-overlay.dts
+@@ -118,5 +118,6 @@
+ 		invy = <0>, "+11";
+ 		swapxy = <&gt911>,"touchscreen-swapped-x-y?";
+ 		disable_touch = <&gt911>, "status=disabled";
++		rotation = <&dsi_panel>, "rotation:0";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.6/950-1402-rp1-pio-Add-missing-static-inline-s.patch b/target/linux/bcm27xx/patches-6.6/950-1402-rp1-pio-Add-missing-static-inline-s.patch
new file mode 100644
index 00000000000000..643e83b314ac2d
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1402-rp1-pio-Add-missing-static-inline-s.patch
@@ -0,0 +1,42 @@
+From df8a2f6dc114b2c5c7685a069f717f2b06186b74 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 20 Nov 2024 16:23:06 +0000
+Subject: [PATCH] rp1-pio: Add missing 'static inline's
+
+Avoid some duplicate symbol errors by adding some missing
+'static inline' decorations.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ include/linux/pio_rp1.h | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/include/linux/pio_rp1.h
++++ b/include/linux/pio_rp1.h
+@@ -247,7 +247,7 @@ static inline bool pio_can_add_program_a
+ 	return !rp1_pio_can_add_program(client, &args);
+ }
+ 
+-uint pio_add_program(struct rp1_pio_client *client, const pio_program_t *program)
++static inline uint pio_add_program(struct rp1_pio_client *client, const pio_program_t *program)
+ {
+ 	struct rp1_pio_add_program_args args;
+ 	int offset;
+@@ -367,7 +367,7 @@ static inline int pio_sm_set_config(stru
+ 	return rp1_pio_sm_set_config(client, &args);
+ }
+ 
+-int pio_sm_exec(struct rp1_pio_client *client, uint sm, uint instr)
++static inline int pio_sm_exec(struct rp1_pio_client *client, uint sm, uint instr)
+ {
+ 	struct rp1_pio_sm_exec_args args = { .sm = sm, .instr = instr, .blocking = false };
+ 
+@@ -377,7 +377,7 @@ int pio_sm_exec(struct rp1_pio_client *c
+ 	return rp1_pio_sm_exec(client, &args);
+ }
+ 
+-int pio_sm_exec_wait_blocking(struct rp1_pio_client *client, uint sm, uint instr)
++static inline int pio_sm_exec_wait_blocking(struct rp1_pio_client *client, uint sm, uint instr)
+ {
+ 	struct rp1_pio_sm_exec_args args = { .sm = sm, .instr = instr, .blocking = true };
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1403-misc-rp1-pio-Back-port-some-6.11-build-fixes.patch b/target/linux/bcm27xx/patches-6.6/950-1403-misc-rp1-pio-Back-port-some-6.11-build-fixes.patch
new file mode 100644
index 00000000000000..92bde521d23d74
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1403-misc-rp1-pio-Back-port-some-6.11-build-fixes.patch
@@ -0,0 +1,39 @@
+From d1f0c94e974a5f26d210b1d13a6ef9543bee4984 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 21 Nov 2024 11:11:48 +0000
+Subject: [PATCH] misc: rp1-pio: Back-port some 6.11 build fixes
+
+Porting rp1-pio to rpi-6.11.y uncovered a few missing #includes and a
+difference of const-ness. Although not needed here, back-porting the
+resulting changes makes the driver more "correct" and may prevent a
+future merge conflict.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/rp1-pio.c  | 3 +++
+ include/linux/pio_rp1.h | 2 +-
+ 2 files changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/misc/rp1-pio.c
++++ b/drivers/misc/rp1-pio.c
+@@ -22,6 +22,9 @@
+ #include <linux/init.h>
+ #include <linux/ioctl.h>
+ #include <linux/module.h>
++#include <linux/of.h>
++#include <linux/pio_rp1.h>
++#include <linux/platform_device.h>
+ #include <linux/rp1-firmware.h>
+ #include <linux/semaphore.h>
+ #include <linux/slab.h>
+--- a/include/linux/pio_rp1.h
++++ b/include/linux/pio_rp1.h
+@@ -176,7 +176,7 @@ typedef rp1_pio_sm_config pio_sm_config;
+ typedef struct rp1_pio_client *PIO;
+ 
+ void pio_set_error(struct rp1_pio_client *client, int err);
+-int pio_get_error(struct rp1_pio_client *client);
++int pio_get_error(const struct rp1_pio_client *client);
+ void pio_clear_error(struct rp1_pio_client *client);
+ 
+ int rp1_pio_can_add_program(struct rp1_pio_client *client, void *param);
diff --git a/target/linux/bcm27xx/patches-6.6/950-1404-Adding-Pimidi-kernel-module.patch b/target/linux/bcm27xx/patches-6.6/950-1404-Adding-Pimidi-kernel-module.patch
new file mode 100644
index 00000000000000..fd46f25c202ac6
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1404-Adding-Pimidi-kernel-module.patch
@@ -0,0 +1,1167 @@
+From 8a6f640708627ac8ebf79f88793038933f169198 Mon Sep 17 00:00:00 2001
+From: Giedrius <giedrius@blokas.io>
+Date: Thu, 21 Nov 2024 08:04:02 +0000
+Subject: [PATCH] Adding Pimidi kernel module.
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Giedrius Trainavičius <giedrius@blokas.io>
+---
+ sound/drivers/Kconfig  |   10 +
+ sound/drivers/Makefile |    2 +
+ sound/drivers/pimidi.c | 1113 ++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 1125 insertions(+)
+ create mode 100644 sound/drivers/pimidi.c
+
+--- a/sound/drivers/Kconfig
++++ b/sound/drivers/Kconfig
+@@ -263,4 +263,14 @@ config SND_AC97_POWER_SAVE_DEFAULT
+ 
+ 	  See SND_AC97_POWER_SAVE for more details.
+ 
++config SND_PIMIDI
++	tristate "Pimidi driver"
++	depends on SND_SEQUENCER && CRC8
++	select SND_RAWMIDI
++	help
++	  Say Y here to include support for Blokas Pimidi.
++
++	  To compile this driver as a module, choose M here: the module
++	  will be called snd-pimidi.
++
+ endif	# SND_DRIVERS
+--- a/sound/drivers/Makefile
++++ b/sound/drivers/Makefile
+@@ -9,6 +9,7 @@ snd-aloop-objs := aloop.o
+ snd-mtpav-objs := mtpav.o
+ snd-mts64-objs := mts64.o
+ snd-pcmtest-objs := pcmtest.o
++snd-pimidi-objs := pimidi.o
+ snd-portman2x4-objs := portman2x4.o
+ snd-serial-u16550-objs := serial-u16550.o
+ snd-serial-generic-objs := serial-generic.o
+@@ -23,6 +24,7 @@ obj-$(CONFIG_SND_SERIAL_U16550) += snd-s
+ obj-$(CONFIG_SND_SERIAL_GENERIC) += snd-serial-generic.o
+ obj-$(CONFIG_SND_MTPAV) += snd-mtpav.o
+ obj-$(CONFIG_SND_MTS64) += snd-mts64.o
++obj-$(CONFIG_SND_PIMIDI) += snd-pimidi.o
+ obj-$(CONFIG_SND_PORTMAN2X4) += snd-portman2x4.o
+ 
+ obj-$(CONFIG_SND) += opl3/ opl4/ mpu401/ vx/ pcsp/
+--- /dev/null
++++ b/sound/drivers/pimidi.c
+@@ -0,0 +1,1113 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Pimidi Linux kernel module.
++ * Copyright (C) 2017-2024  Vilniaus Blokas UAB, https://blokas.io/
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * as published by the Free Software Foundation; version 2 of the
++ * License.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++#include <linux/completion.h>
++#include <linux/module.h>
++#include <linux/i2c.h>
++#include <linux/irq.h>
++#include <linux/irqdesc.h>
++#include <linux/bitops.h>
++#include <linux/of_irq.h>
++#include <linux/kfifo.h>
++#include <linux/list.h>
++#include <linux/workqueue.h>
++#include <linux/gpio.h>
++#include <linux/gpio/consumer.h>
++#include <linux/interrupt.h>
++#include <linux/mutex.h>
++#include <linux/refcount.h>
++#include <linux/crc8.h>
++#include <linux/delay.h>
++
++#include <sound/core.h>
++#include <sound/initval.h>
++#include <sound/rawmidi.h>
++#include <sound/asequencer.h>
++#include <sound/info.h>
++
++#define PIMIDI_LOG_IMPL(instance, log_func, msg, ...) log_func("pimidi(%s)[%c]: " msg "\n", \
++	__func__, (instance) ? (instance)->d + '0' : 'G', ## __VA_ARGS__)
++
++#ifdef PIMIDI_DEBUG
++#	define printd(instance, ...) PIMIDI_LOG_IMPL(instance, pr_alert, __VA_ARGS__)
++#	define printd_rl(instance, ...) PIMIDI_LOG_IMPL(instance, pr_alert_ratelimited, __VA_ARGS__)
++#	define printd_g(...) printd((struct pimidi_instance *)NULL, __VA_ARGS__)
++#else
++#	define printd(instance, ...) do {} while (0)
++#	define printd_rl(instance, ...) do {} while (0)
++#	define printd_g(...) do {} while (0)
++#endif
++
++#define printe(instance, ...) PIMIDI_LOG_IMPL(instance, pr_err, __VA_ARGS__)
++#define printe_rl(instance, ...) PIMIDI_LOG_IMPL(instance, pr_err_ratelimited, __VA_ARGS__)
++#define printi(instance, ...) PIMIDI_LOG_IMPL(instance, pr_info, __VA_ARGS__)
++#define printw(instance, ...) PIMIDI_LOG_IMPL(instance, pr_warn, __VA_ARGS__)
++#define printw_rl(instance, ...) PIMIDI_LOG_IMPL(instance, pr_warn_ratelimited, __VA_ARGS__)
++
++#define printe_g(...) printe((struct pimidi_instance *)NULL, __VA_ARGS__)
++#define printi_g(...) printi((struct pimidi_instance *)NULL, __VA_ARGS__)
++
++DECLARE_CRC8_TABLE(pimidi_crc8_table);
++enum { PIMIDI_CRC8_POLYNOMIAL = 0x83 };
++enum { PIMIDI_MAX_DEVICES = 4 };
++enum { PIMIDI_MAX_PACKET_SIZE = 17 };
++enum { PIMIDI_PORTS = 2 };
++
++struct pimidi_shared {
++	// lock protects the shared reset_gpio and devices list.
++	struct mutex            lock;
++	struct gpio_desc        *reset_gpio;
++	struct workqueue_struct *work_queue;
++	struct list_head        devices;
++};
++
++static struct pimidi_shared pimidi_global = {
++	.devices = LIST_HEAD_INIT(pimidi_global.devices),
++};
++
++struct pimidi_version_t {
++	u8 hwrev;
++	u8 major;
++	u8 minor;
++	u8 build;
++};
++
++enum { PIMIDI_IN_FIFO_SIZE = 4096 };
++
++struct pimidi_midi_port {
++	// in_lock protects the input substream.
++	struct mutex                      in_lock;
++	// out_lock protects the output substream.
++	struct mutex                      out_lock;
++	DECLARE_KFIFO(in_fifo, uint8_t, PIMIDI_IN_FIFO_SIZE);
++	unsigned int                      last_output_at;
++	unsigned int                      output_buffer_used_in_millibytes;
++	struct work_struct                in_handler;
++	struct delayed_work               out_handler;
++	unsigned long                     enabled_streams;
++	unsigned int                      tx_cnt;
++	unsigned int                      rx_cnt;
++};
++
++struct pimidi_instance {
++	struct list_head                  list;
++	struct i2c_client                 *i2c_client;
++	struct pimidi_version_t           version;
++	char                              serial[11];
++	char                              d;
++	struct gpio_desc                  *data_ready_gpio;
++
++	struct work_struct                drdy_handler;
++
++	// comm_lock serializes I2C communication.
++	struct mutex                      comm_lock;
++	char                              *rx_buf;
++	size_t                            rx_len;
++	int                               rx_status;
++	struct completion                 *rx_completion;
++
++	struct snd_rawmidi                *rawmidi;
++	struct pimidi_midi_port           midi_port[PIMIDI_PORTS];
++	bool                              stopping;
++};
++
++static struct snd_rawmidi_substream *pimidi_find_substream(struct snd_rawmidi *rawmidi,
++							   int stream,
++							   int number
++	)
++{
++	struct snd_rawmidi_substream *substream;
++
++	list_for_each_entry(substream, &rawmidi->streams[stream].substreams, list) {
++		if (substream->number == number)
++			return substream;
++	}
++	return NULL;
++}
++
++static void pimidi_midi_in_handler(struct pimidi_instance *instance, int port)
++{
++	int i, n, err;
++
++	printd(instance, "(%d)", port);
++
++	struct pimidi_midi_port *midi_port = &instance->midi_port[port];
++
++	if (!test_bit(SNDRV_RAWMIDI_STREAM_INPUT, &midi_port->enabled_streams)) {
++		printd(instance, "Input not enabled for %d", port);
++		return;
++	}
++
++	u8 data[512];
++
++	n = kfifo_out_peek(&midi_port->in_fifo, data, sizeof(data));
++	printd(instance, "Peeked %d MIDI bytes", n);
++
++	mutex_lock(&midi_port->in_lock);
++	struct snd_rawmidi_substream *substream =
++		pimidi_find_substream(instance->rawmidi,
++				      SNDRV_RAWMIDI_STREAM_INPUT,
++				      port);
++
++	err = snd_rawmidi_receive(substream, data, n);
++	if (err > 0)
++		midi_port->rx_cnt += err;
++	mutex_unlock(&midi_port->in_lock);
++
++	for (i = 0; i < err; ++i)
++		kfifo_skip(&midi_port->in_fifo);
++
++	if (n != err)
++		printw_rl(instance,
++			  "Not all MIDI data consumed for port %d: %d / %d", port, err, n);
++
++	if (!kfifo_is_empty(&midi_port->in_fifo) && !instance->stopping)
++		queue_work(pimidi_global.work_queue, &midi_port->in_handler);
++
++	printd(instance, "Done");
++}
++
++static void pimidi_midi_in_handler_0(struct work_struct *work)
++{
++	pimidi_midi_in_handler(container_of(work, struct pimidi_instance, midi_port[0].in_handler),
++			       0);
++}
++
++static void pimidi_midi_in_handler_1(struct work_struct *work)
++{
++	pimidi_midi_in_handler(container_of(work, struct pimidi_instance, midi_port[1].in_handler),
++			       1);
++}
++
++static void pimidi_midi_out_handler(struct pimidi_instance *instance, int port)
++{
++	printd(instance, "(%d)", port);
++	if (!test_bit(SNDRV_RAWMIDI_STREAM_OUTPUT, &instance->midi_port[port].enabled_streams)) {
++		printd(instance, "Output not enabled for %d", port);
++		return;
++	}
++
++	struct pimidi_midi_port *midi_port = &instance->midi_port[port];
++
++	struct snd_rawmidi_substream *substream =
++		pimidi_find_substream(instance->rawmidi, SNDRV_RAWMIDI_STREAM_OUTPUT, port);
++
++	mutex_lock(&midi_port->out_lock);
++
++	enum { MIDI_MILLI_BYTES_PER_JIFFY = 3125000 / HZ };
++	enum { MIDI_MAX_OUTPUT_BUFFER_SIZE_IN_MILLIBYTES =
++		(512 - PIMIDI_MAX_PACKET_SIZE - 1) * 1000 };
++
++	unsigned int now = jiffies;
++	unsigned int millibytes_became_available =
++		(MIDI_MILLI_BYTES_PER_JIFFY) * (now - midi_port->last_output_at);
++
++	midi_port->output_buffer_used_in_millibytes =
++		midi_port->output_buffer_used_in_millibytes <=
++		millibytes_became_available ? 0 : midi_port->output_buffer_used_in_millibytes -
++		millibytes_became_available;
++
++	unsigned int output_buffer_available =
++		(MIDI_MAX_OUTPUT_BUFFER_SIZE_IN_MILLIBYTES
++		- midi_port->output_buffer_used_in_millibytes)
++		/ 1000;
++
++	u8 buffer[PIMIDI_MAX_PACKET_SIZE];
++	int n, batch, err;
++
++	for (batch = 0; batch < 3; ++batch) {
++		if (output_buffer_available == 0)
++			printd(instance, "Buffer full");
++
++		printd(instance, "Buffer available: %u (%u +%u, %u -> %u, dt %u) (%u) @ %u",
++		       output_buffer_available, midi_port->output_buffer_used_in_millibytes,
++		       millibytes_became_available, midi_port->last_output_at, now,
++		       now - midi_port->last_output_at, midi_port->tx_cnt, HZ);
++		midi_port->last_output_at = now;
++
++		n = output_buffer_available
++			? snd_rawmidi_transmit_peek(substream, buffer + 1,
++						    min(output_buffer_available,
++							sizeof(buffer) - 2))
++			: 0;
++		if (n > 0) {
++			printd(instance, "Peeked: %d", n);
++			snd_rawmidi_transmit_ack(substream, n);
++
++			buffer[0] = (port << 4) | n;
++			buffer[n + 1] = ~crc8(pimidi_crc8_table, buffer, n + 1, CRC8_INIT_VALUE);
++
++#ifdef PIMIDI_DEBUG
++			pr_debug("%s[%d]: Sending %d bytes:", __func__, instance->d, n + 2);
++			int i;
++
++			for (i = 0; i < n + 2; ++i)
++				pr_cont(" %02x", buffer[i]);
++
++			pr_cont("\n");
++#endif
++			mutex_lock(&instance->comm_lock);
++			err = i2c_master_send(instance->i2c_client, buffer, n + 2);
++			mutex_unlock(&instance->comm_lock);
++
++			if (err < 0) {
++				printe(instance,
++				       "Error occurred when sending MIDI data over I2C! (%d)",
++				       err);
++				goto cleanup;
++			}
++
++			midi_port->tx_cnt += n;
++			midi_port->output_buffer_used_in_millibytes += n * 1000;
++			output_buffer_available -= n;
++		} else if (n < 0) {
++			err = n;
++			printe(instance, "snd_rawmidi_transmit_peek returned error %d!", err);
++			goto cleanup;
++		} else {
++			break;
++		}
++	}
++
++	printd(instance, "Checking if empty %p", substream);
++	if (!snd_rawmidi_transmit_empty(substream) && !instance->stopping) {
++		unsigned int delay = 1;
++
++		if (output_buffer_available == 0)
++			delay = 125000 / MIDI_MILLI_BYTES_PER_JIFFY;
++		printd(instance, "Queue more work after %u jiffies", delay);
++		mod_delayed_work(pimidi_global.work_queue, &midi_port->out_handler, delay);
++	}
++
++cleanup:
++	mutex_unlock(&midi_port->out_lock);
++	printd(instance, "Done");
++}
++
++static void pimidi_midi_out_handler_0(struct work_struct *work)
++{
++	pimidi_midi_out_handler(container_of(work, struct pimidi_instance,
++					     midi_port[0].out_handler.work), 0);
++}
++
++static void pimidi_midi_out_handler_1(struct work_struct *work)
++{
++	pimidi_midi_out_handler(container_of(work, struct pimidi_instance,
++					     midi_port[1].out_handler.work), 1);
++}
++
++static void pimidi_midi_output_trigger(struct snd_rawmidi_substream *substream, int up)
++{
++	struct pimidi_instance *instance = substream->rmidi->private_data;
++
++	printd(instance, "(%d, %d, %d)", substream->stream, substream->number, up);
++
++	if (up == 0) {
++		clear_bit(substream->stream,
++			  &instance->midi_port[substream->number].enabled_streams);
++	} else {
++		set_bit(substream->stream,
++			&instance->midi_port[substream->number].enabled_streams);
++		if (!delayed_work_pending(&instance->midi_port[substream->number].out_handler)) {
++			printd(instance, "Queueing work");
++			queue_delayed_work(pimidi_global.work_queue,
++					   &instance->midi_port[substream->number].out_handler, 0);
++		}
++	}
++}
++
++static void pimidi_midi_output_drain(struct snd_rawmidi_substream *substream)
++{
++	struct pimidi_instance *instance = substream->rmidi->private_data;
++
++	printd(instance, "(%d, %d)", substream->stream, substream->number);
++
++	printd(instance, "Begin draining!");
++
++	queue_delayed_work(pimidi_global.work_queue,
++			   &instance->midi_port[substream->number].out_handler, 0);
++
++	unsigned long deadline = jiffies + 5 * HZ;
++
++	do {
++		printd(instance, "Before flush");
++		while (delayed_work_pending(&instance->midi_port[substream->number].out_handler))
++			flush_delayed_work(&instance->midi_port[substream->number].out_handler);
++		printd(instance, "Flushed");
++	} while (!snd_rawmidi_transmit_empty(substream) && time_before(jiffies, deadline));
++
++	printd(instance, "Done!");
++}
++
++static int pimidi_midi_output_close(struct snd_rawmidi_substream *substream)
++{
++	struct pimidi_instance *instance = substream->rmidi->private_data;
++	struct pimidi_midi_port *midi_port = &instance->midi_port[substream->number];
++
++	mutex_lock(&midi_port->out_lock);
++	clear_bit(substream->stream, &midi_port->enabled_streams);
++	mutex_unlock(&midi_port->out_lock);
++	return 0;
++}
++
++static int pimidi_midi_input_close(struct snd_rawmidi_substream *substream)
++{
++	struct pimidi_instance *instance = substream->rmidi->private_data;
++	struct pimidi_midi_port *midi_port = &instance->midi_port[substream->number];
++
++	mutex_lock(&midi_port->in_lock);
++	clear_bit(substream->stream, &midi_port->enabled_streams);
++	mutex_unlock(&midi_port->in_lock);
++	return 0;
++}
++
++static void pimidi_midi_input_trigger(struct snd_rawmidi_substream *substream, int up)
++{
++	struct pimidi_instance *instance = substream->rmidi->private_data;
++
++	printd(instance, "(%d, %d, %d)", substream->stream, substream->number, up);
++
++	if (up == 0) {
++		clear_bit(substream->stream,
++			  &instance->midi_port[substream->number].enabled_streams);
++		cancel_work_sync(&instance->midi_port[substream->number].in_handler);
++	} else {
++		set_bit(substream->stream,
++			&instance->midi_port[substream->number].enabled_streams);
++		if (!instance->stopping)
++			queue_work(pimidi_global.work_queue,
++				   &instance->midi_port[substream->number].in_handler);
++	}
++}
++
++static void pimidi_get_port_info(struct snd_rawmidi *rmidi, int number,
++				 struct snd_seq_port_info *seq_port_info)
++{
++	printd_g("%p, %d, %p", rmidi, number, seq_port_info);
++	seq_port_info->type =
++		SNDRV_SEQ_PORT_TYPE_MIDI_GENERIC |
++		SNDRV_SEQ_PORT_TYPE_HARDWARE |
++		SNDRV_SEQ_PORT_TYPE_PORT;
++	strscpy(seq_port_info->name, number == 0 ? "a" : "b",
++		sizeof(seq_port_info->name));
++	seq_port_info->midi_voices = 0;
++}
++
++static const struct snd_rawmidi_global_ops pimidi_midi_ops = {
++	.get_port_info = pimidi_get_port_info,
++};
++
++static int pimidi_midi_open(struct snd_rawmidi_substream *substream)
++{
++	printd_g("(%p) stream=%d number=%d", substream, substream->stream, substream->number);
++	return 0;
++}
++
++static const struct snd_rawmidi_ops pimidi_midi_output_ops = {
++	.open = pimidi_midi_open,
++	.close = pimidi_midi_output_close,
++	.trigger = pimidi_midi_output_trigger,
++	.drain = pimidi_midi_output_drain,
++};
++
++static const struct snd_rawmidi_ops pimidi_midi_input_ops = {
++	.open = pimidi_midi_open,
++	.close = pimidi_midi_input_close,
++	.trigger = pimidi_midi_input_trigger,
++};
++
++static int pimidi_register(struct pimidi_instance *instance)
++{
++	int err = 0;
++
++	mutex_lock(&pimidi_global.lock);
++	printd(instance, "Registering...");
++	if (!pimidi_global.reset_gpio) {
++		printd_g("Getting reset pin.");
++		pimidi_global.reset_gpio = gpiod_get(&instance->i2c_client->dev, "reset",
++						     GPIOD_OUT_LOW);
++		if (IS_ERR(pimidi_global.reset_gpio)) {
++			err = PTR_ERR(pimidi_global.reset_gpio);
++			printe_g("gpiod_get failed: %d", err);
++			pimidi_global.reset_gpio = NULL;
++			mutex_unlock(&pimidi_global.lock);
++			return err;
++		}
++	}
++	list_add_tail(&instance->list, &pimidi_global.devices);
++	mutex_unlock(&pimidi_global.lock);
++	return err;
++}
++
++static void pimidi_unregister(struct pimidi_instance *instance)
++{
++	mutex_lock(&pimidi_global.lock);
++	printd(instance, "Unregistering...");
++	list_del(&instance->list);
++	if (list_empty(&pimidi_global.devices)) {
++		printd_g("Releasing reset pin");
++		gpiod_put(pimidi_global.reset_gpio);
++		pimidi_global.reset_gpio = NULL;
++	}
++	mutex_unlock(&pimidi_global.lock);
++}
++
++static void pimidi_perform_reset(void)
++{
++	mutex_lock(&pimidi_global.lock);
++
++	printd_g("Performing reset.");
++
++	struct list_head *p;
++
++	list_for_each(p, &pimidi_global.devices) {
++		struct pimidi_instance *instance = list_entry(p, struct pimidi_instance, list);
++
++		printd(instance, "Pausing...");
++		instance->stopping = true;
++		disable_irq(instance->i2c_client->irq);
++		cancel_work(&instance->drdy_handler);
++
++		int i;
++
++		for (i = 0; i < PIMIDI_PORTS; ++i) {
++			cancel_work(&instance->midi_port[i].in_handler);
++			cancel_delayed_work(&instance->midi_port[i].out_handler);
++		}
++
++		drain_workqueue(pimidi_global.work_queue);
++	}
++
++	printd_g("Reset = low");
++	gpiod_set_value(pimidi_global.reset_gpio, 1);
++
++	list_for_each(p, &pimidi_global.devices) {
++		struct pimidi_instance *instance = list_entry(p, struct pimidi_instance, list);
++
++		if (gpiod_is_active_low(instance->data_ready_gpio))
++			gpiod_toggle_active_low(instance->data_ready_gpio);
++		gpiod_direction_output(instance->data_ready_gpio, 1);
++		printd(instance, "DRDY high");
++	}
++
++	usleep_range(1000, 5000);
++	printd_g("Reset = high");
++	gpiod_set_value(pimidi_global.reset_gpio, 0);
++	msleep(30);
++
++	int i;
++
++	for (i = 0; i < PIMIDI_MAX_DEVICES; ++i) {
++		usleep_range(1000, 3000);
++		list_for_each(p, &pimidi_global.devices) {
++			struct pimidi_instance *instance = list_entry(p, struct pimidi_instance,
++								      list);
++
++			if (instance->d < i)
++				continue;
++			printd(instance, "DRDY -> %d", !gpiod_get_value(instance->data_ready_gpio));
++			gpiod_set_value(instance->data_ready_gpio,
++					!gpiod_get_value(instance->data_ready_gpio));
++		}
++	}
++	usleep_range(16000, 20000);
++
++	list_for_each(p, &pimidi_global.devices) {
++		struct pimidi_instance *instance = list_entry(p, struct pimidi_instance, list);
++
++		if (!gpiod_is_active_low(instance->data_ready_gpio))
++			gpiod_toggle_active_low(instance->data_ready_gpio);
++
++		printd(instance, "DRDY input");
++		gpiod_direction_input(instance->data_ready_gpio);
++
++		printd(instance, "Resume...");
++		instance->stopping = false;
++		enable_irq(instance->i2c_client->irq);
++	}
++
++	printd_g("Reset done.");
++	usleep_range(16000, 20000);
++
++	mutex_unlock(&pimidi_global.lock);
++}
++
++static int pimidi_read_version(struct pimidi_version_t *version, struct pimidi_instance *instance)
++{
++	memset(version, 0, sizeof(*version));
++
++	const char cmd[4] = { 0xb2, 0x01, 0x01, 0x95 };
++
++	char result[9];
++
++	memset(result, 0, sizeof(result));
++
++	DECLARE_COMPLETION_ONSTACK(done);
++
++	mutex_lock(&instance->comm_lock);
++	int err = i2c_master_send(instance->i2c_client, cmd, sizeof(cmd));
++
++	if (err < 0) {
++		mutex_unlock(&instance->comm_lock);
++		return err;
++	}
++	instance->rx_buf = result;
++	instance->rx_len = sizeof(result);
++	instance->rx_completion = &done;
++	mutex_unlock(&instance->comm_lock);
++
++	printd(instance, "Waiting for drdy");
++	wait_for_completion_io_timeout(&done, msecs_to_jiffies(1000u));
++	printd(instance, "Done waiting");
++
++	if (!completion_done(&done)) {
++		mutex_lock(&instance->comm_lock);
++		instance->rx_buf = NULL;
++		instance->rx_len = 0;
++		instance->rx_status = -ETIMEDOUT;
++		instance->rx_completion = NULL;
++		mutex_unlock(&instance->comm_lock);
++		return -ETIMEDOUT;
++	}
++
++	if (CRC8_GOOD_VALUE(pimidi_crc8_table) != crc8(pimidi_crc8_table, result, sizeof(result),
++						       CRC8_INIT_VALUE))
++		return -EIO;
++
++	const char expected[4] = { 0xb7, 0x81, 0x01, 0x00 };
++
++	if (memcmp(result, expected, sizeof(expected)) != 0)
++		return -EPROTO;
++
++	u32 v = ntohl(*(uint32_t *)(result + 4));
++
++	version->hwrev = v >> 24;
++	version->major = (v & 0x00ff0000) >> 16;
++	version->minor = (v & 0x0000ff00) >> 8;
++	version->build = v & 0x000000ff;
++
++	return 0;
++}
++
++static int pimidi_read_serial(char serial[11], struct pimidi_instance *instance)
++{
++	memset(serial, 0, sizeof(char[11]));
++
++	const char cmd[4] = { 0xb2, 0x03, 0x04, 0x97 };
++
++	char result[PIMIDI_MAX_PACKET_SIZE];
++
++	memset(result, 0, sizeof(result));
++
++	DECLARE_COMPLETION_ONSTACK(done);
++
++	mutex_lock(&instance->comm_lock);
++	int err = i2c_master_send(instance->i2c_client, cmd, sizeof(cmd));
++
++	if (err < 0) {
++		mutex_unlock(&instance->comm_lock);
++		return err;
++	}
++	instance->rx_buf = result;
++	instance->rx_len = sizeof(result);
++	instance->rx_completion = &done;
++	mutex_unlock(&instance->comm_lock);
++
++	printd(instance, "Waiting for drdy");
++	wait_for_completion_io_timeout(&done, msecs_to_jiffies(1000u));
++	printd(instance, "Done waiting");
++
++	if (!completion_done(&done)) {
++		mutex_lock(&instance->comm_lock);
++		instance->rx_buf = NULL;
++		instance->rx_len = 0;
++		instance->rx_status = -ETIMEDOUT;
++		instance->rx_completion = NULL;
++		mutex_unlock(&instance->comm_lock);
++		printe(instance, "Timed out");
++		return -ETIMEDOUT;
++	}
++
++	if (CRC8_GOOD_VALUE(pimidi_crc8_table) != crc8(pimidi_crc8_table, result,
++						       (result[0] & 0x0f) + 2, CRC8_INIT_VALUE))
++		return -EIO;
++
++	const char expected[4] = { 0xbd, 0x83, 0x04, 0x0a };
++
++	if (memcmp(result, expected, sizeof(expected)) != 0) {
++		printe(instance, "Unexpected response: %02x %02x %02x %02x", result[0], result[1],
++		       result[2], result[3]);
++		return -EPROTO;
++	}
++
++	memcpy(serial, result + 4, 10);
++
++	if (strspn(serial, "\xff") == 10)
++		strscpy(serial, "(unset)", 8);
++
++	return 0;
++}
++
++static void pimidi_handle_midi_data(struct pimidi_instance *instance, int port, const uint8_t *data,
++				    unsigned int n)
++{
++	printd(instance, "Handling MIDI data for port %d (%u bytes)", port, n);
++	if (n == 0)
++		return;
++
++	struct pimidi_midi_port *midi_port = &instance->midi_port[port];
++
++	kfifo_in(&midi_port->in_fifo, data, n);
++
++	if (!instance->stopping)
++		queue_work(pimidi_global.work_queue, &midi_port->in_handler);
++
++	printd(instance, "Done");
++}
++
++static void pimidi_drdy_continue(struct pimidi_instance *instance)
++{
++	if (instance->stopping) {
++		printd(instance, "Refusing to queue work / enable IRQ due to stopping.");
++		return;
++	}
++
++	if (gpiod_get_value(instance->data_ready_gpio)) {
++		printd_rl(instance, "Queue work due to DRDY line still low");
++		queue_work(pimidi_global.work_queue, &instance->drdy_handler);
++	} else {
++		printd_rl(instance, "Enabling irq for more data");
++		enable_irq(gpiod_to_irq(instance->data_ready_gpio));
++	}
++}
++
++static void pimidi_drdy_handler(struct work_struct *work)
++{
++	struct pimidi_instance *instance = container_of(work, struct pimidi_instance, drdy_handler);
++
++	printd(instance, "(%p)", work);
++
++	mutex_lock(&instance->comm_lock);
++	if (!instance->rx_completion) {
++		u8 data[PIMIDI_MAX_PACKET_SIZE];
++		int n = i2c_master_recv(instance->i2c_client, data, 3);
++
++		if (n < 0) {
++			printe(instance, "Error reading from device: %d", n);
++			mutex_unlock(&instance->comm_lock);
++			pimidi_drdy_continue(instance);
++			return;
++		}
++
++		if (data[0] == 0xfe) {
++			printe_rl(instance, "Invalid packet 0x%02x 0x%02x 0x%02x", data[0], data[1],
++				  data[2]);
++			mutex_unlock(&instance->comm_lock);
++			pimidi_drdy_continue(instance);
++			return;
++		}
++
++		int len = (data[0] & 0x0f) + 2;
++
++		if (len > n) {
++			printd(instance, "Need %d more bytes", len - n);
++			int err = i2c_master_recv(instance->i2c_client, data + n, len - n);
++
++			if (err < 0) {
++				printe(instance, "Error reading remainder from device: %d", err);
++				mutex_unlock(&instance->comm_lock);
++				pimidi_drdy_continue(instance);
++				return;
++#ifdef PIMIDI_DEBUG
++			} else {
++				pr_debug("Recv_2:");
++				int i;
++
++				for (i = n; i < len; ++i)
++					pr_cont(" %02x", data[i]);
++				pr_cont("\n");
++#endif
++			}
++		}
++
++		if (CRC8_GOOD_VALUE(pimidi_crc8_table) == crc8(pimidi_crc8_table, data, len,
++							       CRC8_INIT_VALUE)) {
++			switch (data[0] & 0xf0) {
++			case 0x00:
++				pimidi_handle_midi_data(instance, 0, data + 1, len - 2);
++				break;
++			case 0x10:
++				pimidi_handle_midi_data(instance, 1, data + 1, len - 2);
++				break;
++			default:
++				printd(instance, "Unhandled command %02x", data[0]);
++				break;
++			}
++		} else {
++			printe(instance, "I2C rx corruption detected.");
++			pr_info("Packet [%d]:", len);
++			int i;
++
++			for (i = 0; i < len; ++i)
++				pr_cont(" %02x", data[i]);
++			pr_cont("\n");
++		}
++
++		mutex_unlock(&instance->comm_lock);
++	} else {
++		printd(instance, "Completing drdy");
++		instance->rx_status = i2c_master_recv(instance->i2c_client, instance->rx_buf, 3);
++		printd(instance, "Recv_1 %02x %02x %02x", instance->rx_buf[0], instance->rx_buf[1],
++		       instance->rx_buf[2]);
++		if (instance->rx_len > 3 && instance->rx_status == 3) {
++			instance->rx_status = i2c_master_recv(instance->i2c_client,
++							      instance->rx_buf + 3,
++							      instance->rx_len - 3);
++			if (instance->rx_status >= 0)
++				instance->rx_status += 3;
++#ifdef PIMIDI_DEBUG
++			pr_debug("Recv_2:");
++			int i;
++
++			for (i = 3; i < instance->rx_len; ++i)
++				pr_cont(" %02x", instance->rx_buf[i]);
++			pr_cont("\n");
++#endif
++		}
++		struct completion *done = instance->rx_completion;
++
++		instance->rx_buf = NULL;
++		instance->rx_len = 0;
++		instance->rx_completion = NULL;
++		complete_all(done);
++		mutex_unlock(&instance->comm_lock);
++	}
++
++	pimidi_drdy_continue(instance);
++}
++
++static irqreturn_t pimidi_drdy_interrupt_handler(int irq, void *dev_id)
++{
++	struct pimidi_instance *instance = (struct pimidi_instance *)dev_id;
++
++	if (instance->stopping) {
++		printd(instance, "DRDY interrupt, but stopping, ignoring...");
++		return IRQ_HANDLED;
++	}
++
++	printd(instance, "DRDY interrupt, masking");
++	disable_irq_nosync(irq);
++
++	printd(instance, "Queue work due to DRDY interrupt");
++	queue_work(pimidi_global.work_queue, &instance->drdy_handler);
++
++	return IRQ_HANDLED;
++}
++
++static void pimidi_proc_stat_show(struct snd_info_entry *entry, struct snd_info_buffer *buffer)
++{
++	const unsigned int *d = entry->private_data;
++
++	snd_iprintf(buffer, "%u\n", *d);
++}
++
++static void pimidi_proc_serial_show(struct snd_info_entry *entry, struct snd_info_buffer *buffer)
++{
++	struct pimidi_instance *instance = entry->private_data;
++
++	snd_iprintf(buffer, "%s\n", instance->serial);
++}
++
++static void pimidi_proc_version_show(struct snd_info_entry *entry, struct snd_info_buffer *buffer)
++{
++	struct pimidi_instance *instance = entry->private_data;
++
++	snd_iprintf(buffer, "%u.%u.%u\n", instance->version.major, instance->version.minor,
++		    instance->version.build);
++}
++
++static void pimidi_proc_hwrev_show(struct snd_info_entry *entry, struct snd_info_buffer *buffer)
++{
++	struct pimidi_instance *instance = entry->private_data;
++
++	snd_iprintf(buffer, "%u\n", instance->version.hwrev);
++}
++
++static int pimidi_i2c_probe(struct i2c_client *client)
++{
++	struct snd_card *card = NULL;
++	int err, d, i;
++
++	d = client->addr - 0x20;
++
++	if (d < 0 || d >= 8) {
++		printe_g("Unexpected device address: %d", client->addr);
++		err = -EINVAL;
++		goto finalize;
++	}
++
++	err = snd_card_new(&client->dev, SNDRV_DEFAULT_IDX1, SNDRV_DEFAULT_STR1, THIS_MODULE,
++			   sizeof(struct pimidi_instance), &card);
++
++	if (err) {
++		printe_g("snd_card_new failed: %d", err);
++		return err;
++	}
++
++	struct pimidi_instance *instance = (struct pimidi_instance *)card->private_data;
++
++	instance->i2c_client = client;
++	instance->d = d;
++
++	struct snd_rawmidi *rawmidi;
++
++	err = snd_rawmidi_new(card, card->shortname, 0, 2, 2, &rawmidi);
++	if (err < 0) {
++		printe(instance, "snd_rawmidi_new failed: %d", err);
++		goto finalize;
++	}
++
++	instance->rawmidi = rawmidi;
++	strscpy(rawmidi->name, "pimidi", sizeof(rawmidi->name));
++
++	rawmidi->info_flags =
++		SNDRV_RAWMIDI_INFO_OUTPUT | SNDRV_RAWMIDI_INFO_INPUT | SNDRV_RAWMIDI_INFO_DUPLEX;
++	rawmidi->private_data = instance;
++	rawmidi->ops = &pimidi_midi_ops;
++
++	snd_rawmidi_set_ops(rawmidi, SNDRV_RAWMIDI_STREAM_OUTPUT, &pimidi_midi_output_ops);
++	snd_rawmidi_set_ops(rawmidi, SNDRV_RAWMIDI_STREAM_INPUT, &pimidi_midi_input_ops);
++
++	instance->data_ready_gpio = devm_gpiod_get(&client->dev, "data-ready", GPIOD_OUT_HIGH);
++	if (IS_ERR(instance->data_ready_gpio)) {
++		err = PTR_ERR(instance->data_ready_gpio);
++		printe(instance, "devm_gpiod_get failed: %d", err);
++		goto finalize;
++	}
++
++	err = pimidi_register(instance);
++	if (err < 0) {
++		printe(instance, "pimidi_register failed: %d", err);
++		goto finalize;
++	}
++
++	pimidi_perform_reset();
++
++	INIT_WORK(&instance->drdy_handler, pimidi_drdy_handler);
++	mutex_init(&instance->comm_lock);
++
++	err = devm_request_irq(&client->dev, client->irq, pimidi_drdy_interrupt_handler,
++			       IRQF_SHARED | IRQF_TRIGGER_LOW, "data_ready_int", instance);
++
++	if (err != 0) {
++		printe(instance, "data_available IRQ request failed! %d", err);
++		goto finalize;
++	}
++
++	err = pimidi_read_version(&instance->version, instance);
++	if (err < 0) {
++		printe(instance, "pimidi_read_version failed: %d", err);
++		goto finalize;
++	}
++
++	err = pimidi_read_serial(instance->serial, instance);
++	if (err < 0) {
++		printe(instance, "pimidi_read_serial failed: %d", err);
++		goto finalize;
++	} else if (instance->serial[0] != 'P' || instance->serial[1] != 'M' ||
++		   strlen(instance->serial) != 10) {
++		printe(instance, "Unexpected serial number: %s", instance->serial);
++		err = -EIO;
++		goto finalize;
++	}
++
++	printi(instance, "pimidi%d hw:%d version %u.%u.%u-%u, serial %s",
++	       d,
++	       card->number,
++	       instance->version.major,
++	       instance->version.minor,
++	       instance->version.build,
++	       instance->version.hwrev,
++	       instance->serial
++	       );
++
++	strscpy(card->driver, "snd-pimidi", sizeof(card->driver));
++	snprintf(card->shortname, sizeof(card->shortname), "pimidi%d", d);
++	snprintf(card->longname, sizeof(card->longname), "pimidi%d %s", d, instance->serial);
++	snprintf(card->id, sizeof(card->id), "pimidi%d", d);
++
++	snprintf(pimidi_find_substream(rawmidi, SNDRV_RAWMIDI_STREAM_OUTPUT, 0)->name,
++		 10u, "pimidi%d-a", d);
++	snprintf(pimidi_find_substream(rawmidi, SNDRV_RAWMIDI_STREAM_INPUT,  0)->name,
++		 10u, "pimidi%d-a", d);
++	snprintf(pimidi_find_substream(rawmidi, SNDRV_RAWMIDI_STREAM_OUTPUT, 1)->name,
++		 10u, "pimidi%d-b", d);
++	snprintf(pimidi_find_substream(rawmidi, SNDRV_RAWMIDI_STREAM_INPUT,  1)->name,
++		 10u, "pimidi%d-b", d);
++
++	err = snd_card_ro_proc_new(card, "a-tx", &instance->midi_port[0].tx_cnt,
++				   pimidi_proc_stat_show);
++	err = snd_card_ro_proc_new(card, "a-rx", &instance->midi_port[0].rx_cnt,
++				   pimidi_proc_stat_show);
++	err = snd_card_ro_proc_new(card, "b-tx", &instance->midi_port[1].tx_cnt,
++				   pimidi_proc_stat_show);
++	err = snd_card_ro_proc_new(card, "b-rx", &instance->midi_port[1].rx_cnt,
++				   pimidi_proc_stat_show);
++	err = snd_card_ro_proc_new(card, "serial", instance, pimidi_proc_serial_show);
++	err = snd_card_ro_proc_new(card, "version", instance, pimidi_proc_version_show);
++	err = snd_card_ro_proc_new(card, "hwrev", instance, pimidi_proc_hwrev_show);
++	if (err < 0) {
++		printe(instance, "snd_card_ro_proc_new failed: %d", err);
++		goto finalize;
++	}
++
++	err = snd_card_register(card);
++	if (err < 0) {
++		printe(instance, "snd_card_register failed: %d", err);
++		goto finalize;
++	}
++
++finalize:
++	if (err) {
++		instance->stopping = true;
++		cancel_work_sync(&instance->drdy_handler);
++		mutex_destroy(&instance->comm_lock);
++		pimidi_unregister(instance);
++		snd_card_free(card);
++		return err;
++	}
++
++	for (i = 0; i < PIMIDI_PORTS; ++i) {
++		struct pimidi_midi_port *port = &instance->midi_port[i];
++
++		mutex_init(&port->in_lock);
++		mutex_init(&port->out_lock);
++		INIT_WORK(&port->in_handler,
++			  i == 0 ? pimidi_midi_in_handler_0 : pimidi_midi_in_handler_1);
++		INIT_DELAYED_WORK(&port->out_handler,
++				  i == 0 ? pimidi_midi_out_handler_0 : pimidi_midi_out_handler_1);
++		INIT_KFIFO(port->in_fifo);
++		port->last_output_at = jiffies;
++	}
++
++	i2c_set_clientdata(client, card);
++	return 0;
++}
++
++static void pimidi_i2c_remove(struct i2c_client *client)
++{
++	printd_g("(%p)", client);
++
++	int i;
++	struct snd_card *card = i2c_get_clientdata(client);
++
++	if (card) {
++		printi_g("Unloading hw:%d %s", card->number, card->longname);
++		struct pimidi_instance *instance = (struct pimidi_instance *)card->private_data;
++
++		instance->stopping = true;
++		i2c_set_clientdata(client, NULL);
++		devm_free_irq(&client->dev, client->irq, instance);
++		cancel_work_sync(&instance->drdy_handler);
++
++		for (i = 0; i < PIMIDI_PORTS; ++i) {
++			cancel_work_sync(&instance->midi_port[i].in_handler);
++			cancel_delayed_work_sync(&instance->midi_port[i].out_handler);
++			mutex_destroy(&instance->midi_port[i].out_lock);
++			mutex_destroy(&instance->midi_port[i].in_lock);
++			kfifo_free(&instance->midi_port[i].in_fifo);
++		}
++
++		mutex_destroy(&instance->comm_lock);
++		pimidi_unregister(instance);
++		snd_card_free(card);
++	}
++}
++
++static const struct i2c_device_id pimidi_i2c_ids[] = {
++	{ "pimidi", 0 },
++	{}
++};
++MODULE_DEVICE_TABLE(i2c, pimidi_i2c_ids);
++
++static const struct of_device_id pimidi_i2c_dt_ids[] = {
++	{ .compatible = "blokaslabs,pimidi", },
++	{}
++};
++MODULE_DEVICE_TABLE(of, pimidi_i2c_dt_ids);
++
++static struct i2c_driver pimidi_i2c_driver = {
++	.driver = {
++		.name = "pimidi",
++		.owner = THIS_MODULE,
++		.of_match_table = of_match_ptr(pimidi_i2c_dt_ids),
++	},
++	.probe = pimidi_i2c_probe,
++	.remove = pimidi_i2c_remove,
++	.id_table = pimidi_i2c_ids,
++};
++
++int pimidi_module_init(void)
++{
++	int err = 0;
++
++	mutex_init(&pimidi_global.lock);
++
++	INIT_LIST_HEAD(&pimidi_global.devices);
++
++	pimidi_global.work_queue = create_singlethread_workqueue("pimidi");
++	if (!pimidi_global.work_queue) {
++		err = -ENOMEM;
++		goto cleanup;
++	}
++
++	err = i2c_add_driver(&pimidi_i2c_driver);
++	if (err < 0)
++		goto cleanup;
++
++	crc8_populate_msb(pimidi_crc8_table, PIMIDI_CRC8_POLYNOMIAL);
++
++	return 0;
++
++cleanup:
++	mutex_destroy(&pimidi_global.lock);
++	return err;
++}
++
++void pimidi_module_exit(void)
++{
++	i2c_del_driver(&pimidi_i2c_driver);
++	mutex_lock(&pimidi_global.lock);
++	if (pimidi_global.reset_gpio) {
++		gpiod_put(pimidi_global.reset_gpio);
++		pimidi_global.reset_gpio = NULL;
++	}
++	mutex_unlock(&pimidi_global.lock);
++
++	destroy_workqueue(pimidi_global.work_queue);
++	pimidi_global.work_queue = NULL;
++
++	mutex_destroy(&pimidi_global.lock);
++}
++
++module_init(pimidi_module_init);
++module_exit(pimidi_module_exit);
++
++MODULE_AUTHOR("Giedrius Trainavi\xc4\x8dius <giedrius@blokas.io>");
++MODULE_DESCRIPTION("MIDI driver for Blokas Pimidi, https://blokas.io/");
++MODULE_LICENSE("GPL");
++
++/* vim: set ts=8 sw=8 noexpandtab: */
diff --git a/target/linux/bcm27xx/patches-6.6/950-1406-Adding-pimidi-overlay.dts.patch b/target/linux/bcm27xx/patches-6.6/950-1406-Adding-pimidi-overlay.dts.patch
new file mode 100644
index 00000000000000..ab46dbdb98cea4
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1406-Adding-pimidi-overlay.dts.patch
@@ -0,0 +1,100 @@
+From 75ab92b077602734458f0a77e19a3599be29b93b Mon Sep 17 00:00:00 2001
+From: Giedrius <giedrius@blokas.io>
+Date: Thu, 21 Nov 2024 08:05:49 +0000
+Subject: [PATCH] Adding pimidi-overlay.dts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Giedrius Trainavičius <giedrius@blokas.io>
+---
+ arch/arm/boot/dts/overlays/Makefile           |  1 +
+ arch/arm/boot/dts/overlays/README             |  8 +++
+ arch/arm/boot/dts/overlays/pimidi-overlay.dts | 54 +++++++++++++++++++
+ 3 files changed, 63 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/pimidi-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -203,6 +203,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	pifi-dac-zero.dtbo \
+ 	pifi-mini-210.dtbo \
+ 	piglow.dtbo \
++	pimidi.dtbo \
+ 	pineboards-hat-ai.dtbo \
+ 	pineboards-hatdrive-poe-plus.dtbo \
+ 	piscreen.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -3701,6 +3701,14 @@ Load:   dtoverlay=piglow
+ Params: <None>
+ 
+ 
++Name:   pimidi
++Info:   Configures the Blokas Labs Pimidi card
++Load:   dtoverlay=pimidi,<param>=<val>
++Params: sel                     The position used for the sel rotary switch.
++                                Each unit in the stack must be set on a unique
++                                position. If param is omitted, sel=0 is assumed.
++
++
+ Name:   pineboards-hat-ai
+ Info:   Pineboards Hat Ai! overlay for the Google Coral Edge TPU
+ Load:   dtoverlay=pineboards-hat-ai
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pimidi-overlay.dts
+@@ -0,0 +1,54 @@
++/*
++ * Pimidi Linux kernel module.
++ * Copyright (C) 2017-2024  Vilniaus Blokas UAB, https://blokas.io/
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public License
++ * as published by the Free Software Foundation; version 2 of the
++ * License.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ */
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c_arm>;
++		__overlay__ {
++			status = "okay";
++			clock-frequency=<1000000>;
++
++			pimidi_ctrl: pimidi_ctrl@20 {
++				compatible = "blokaslabs,pimidi";
++
++				reg = <0x20>;
++				status = "okay";
++
++				interrupt-parent = <&gpio>;
++				interrupts = <23 IRQ_TYPE_LEVEL_LOW>;
++				interrupt-names = "data_ready";
++				interrupt-controller;
++				#interrupt-cells = <2>;
++
++				data-ready-gpios = <&gpio 23 (GPIO_ACTIVE_LOW | GPIO_PULL_UP)>;
++				reset-gpios = <&gpio 22 (GPIO_ACTIVE_LOW | GPIO_PULL_UP)>;
++			};
++		};
++	};
++
++	__overrides__ {
++		sel = <&pimidi_ctrl>,"reg:0{0=0x20,1=0x21,2=0x22,3=0x23}",
++			<&pimidi_ctrl>,"data-ready-gpios:4{0=23,1=5,2=6,3=27}",
++			<&pimidi_ctrl>,"interrupts:0{0=23,1=5,2=6,3=27}";
++	};
++};
diff --git a/target/linux/bcm27xx/patches-6.6/950-0297-staging-vchiq_arm-Add-36-bit-address-support.patch b/target/linux/bcm27xx/patches-6.6/950-1411-staging-vchiq_arm-Add-36-bit-address-support.patch
similarity index 89%
rename from target/linux/bcm27xx/patches-6.6/950-0297-staging-vchiq_arm-Add-36-bit-address-support.patch
rename to target/linux/bcm27xx/patches-6.6/950-1411-staging-vchiq_arm-Add-36-bit-address-support.patch
index 0c1ee62fab2670..db65da69975334 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0297-staging-vchiq_arm-Add-36-bit-address-support.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1411-staging-vchiq_arm-Add-36-bit-address-support.patch
@@ -1,7 +1,7 @@
-From fc5ed9d9bf0411523220bab60304da6d23257a64 Mon Sep 17 00:00:00 2001
+From a1e4b72997dc3ef423b6f510bfead470475750d4 Mon Sep 17 00:00:00 2001
 From: Phil Elwell <phil@raspberrypi.com>
 Date: Thu, 1 Nov 2018 17:31:37 +0000
-Subject: [PATCH 0297/1085] staging: vchiq_arm: Add 36-bit address support
+Subject: [PATCH] staging: vchiq_arm: Add 36-bit address support
 
 Conditional on a new compatible string, change the pagelist encoding
 such that the top 24 bits are the pfn, leaving 8 bits for run length
@@ -36,10 +36,10 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 +	.use_36bit_addrs = true,
 +};
 +
- struct vchiq_2835_state {
- 	int inited;
- 	struct vchiq_arm_state arm_state;
-@@ -147,10 +153,12 @@ static void __iomem *g_regs;
+ struct vchiq_pagelist_info {
+ 	struct pagelist *pagelist;
+ 	size_t pagelist_buffer_size;
+@@ -142,10 +148,12 @@ static void __iomem *g_regs;
   * of 32.
   */
  static unsigned int g_cache_line_size = 32;
@@ -52,7 +52,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  
  static DEFINE_SEMAPHORE(g_free_fragments_mutex, 1);
  
-@@ -180,7 +188,7 @@ static void
+@@ -175,7 +183,7 @@ static void
  cleanup_pagelistinfo(struct vchiq_instance *instance, struct vchiq_pagelist_info *pagelistinfo)
  {
  	if (pagelistinfo->scatterlist_mapped) {
@@ -61,7 +61,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  			     pagelistinfo->num_pages, pagelistinfo->dma_dir);
  	}
  
-@@ -340,7 +348,7 @@ create_pagelist(struct vchiq_instance *i
+@@ -335,7 +343,7 @@ create_pagelist(struct vchiq_instance *i
  		count -= len;
  	}
  
@@ -70,7 +70,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  				 scatterlist,
  				 num_pages,
  				 pagelistinfo->dma_dir);
-@@ -354,22 +362,61 @@ create_pagelist(struct vchiq_instance *i
+@@ -349,22 +357,61 @@ create_pagelist(struct vchiq_instance *i
  
  	/* Combine adjacent blocks for performance */
  	k = 0;
@@ -148,7 +148,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	}
  
  	/* Partial cache lines (fragments) require special measures */
-@@ -413,7 +460,7 @@ free_pagelist(struct vchiq_instance *ins
+@@ -408,7 +455,7 @@ free_pagelist(struct vchiq_instance *ins
  	 * NOTE: dma_unmap_sg must be called before the
  	 * cpu can touch any of the data/pages.
  	 */
@@ -157,7 +157,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  		     pagelistinfo->num_pages, pagelistinfo->dma_dir);
  	pagelistinfo->scatterlist_mapped = 0;
  
-@@ -468,6 +515,7 @@ free_pagelist(struct vchiq_instance *ins
+@@ -463,6 +510,7 @@ free_pagelist(struct vchiq_instance *ins
  static int vchiq_platform_init(struct platform_device *pdev, struct vchiq_state *state)
  {
  	struct device *dev = &pdev->dev;
@@ -165,7 +165,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	struct vchiq_drvdata *drvdata = platform_get_drvdata(pdev);
  	struct rpi_firmware *fw = drvdata->fw;
  	struct vchiq_slot_zero *vchiq_slot_zero;
-@@ -489,6 +537,24 @@ static int vchiq_platform_init(struct pl
+@@ -484,6 +532,24 @@ static int vchiq_platform_init(struct pl
  	g_cache_line_size = drvdata->cache_line_size;
  	g_fragments_size = 2 * g_cache_line_size;
  
@@ -190,7 +190,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	/* Allocate space for the channels in coherent memory */
  	slot_mem_size = PAGE_ALIGN(TOTAL_SLOTS * VCHIQ_SLOT_SIZE);
  	frag_mem_size = PAGE_ALIGN(g_fragments_size * MAX_FRAGMENTS);
-@@ -501,13 +567,14 @@ static int vchiq_platform_init(struct pl
+@@ -496,13 +562,14 @@ static int vchiq_platform_init(struct pl
  	}
  
  	WARN_ON(((unsigned long)slot_mem & (PAGE_SIZE - 1)) != 0);
@@ -206,7 +206,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	vchiq_slot_zero->platform_data[VCHIQ_PLATFORM_FRAGMENTS_COUNT_IDX] =
  		MAX_FRAGMENTS;
  
-@@ -541,7 +608,6 @@ static int vchiq_platform_init(struct pl
+@@ -536,7 +603,6 @@ static int vchiq_platform_init(struct pl
  	}
  
  	/* Send the base address of the slots to VideoCore */
@@ -214,7 +214,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	err = rpi_firmware_property(fw, RPI_FIRMWARE_VCHIQ_INIT,
  				    &channelbase, sizeof(channelbase));
  	if (err) {
-@@ -555,6 +621,8 @@ static int vchiq_platform_init(struct pl
+@@ -550,6 +616,8 @@ static int vchiq_platform_init(struct pl
  		return -ENXIO;
  	}
  
@@ -223,7 +223,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	vchiq_log_info(vchiq_arm_log_level, "vchiq_init - done (slots %pK, phys %pad)",
  		       vchiq_slot_zero, &slot_phys);
  
-@@ -1768,6 +1836,7 @@ void vchiq_platform_conn_state_changed(s
+@@ -1754,6 +1822,7 @@ void vchiq_platform_conn_state_changed(s
  static const struct of_device_id vchiq_of_match[] = {
  	{ .compatible = "brcm,bcm2835-vchiq", .data = &bcm2835_drvdata },
  	{ .compatible = "brcm,bcm2836-vchiq", .data = &bcm2836_drvdata },
@@ -231,7 +231,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
  	{},
  };
  MODULE_DEVICE_TABLE(of, vchiq_of_match);
-@@ -1800,22 +1869,8 @@ vchiq_register_child(struct platform_dev
+@@ -1786,22 +1855,8 @@ vchiq_register_child(struct platform_dev
  
  	child->dev.of_node = np;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0298-staging-vchiq_arm-children-inherit-DMA-config.patch b/target/linux/bcm27xx/patches-6.6/950-1412-staging-vchiq_arm-children-inherit-DMA-config.patch
similarity index 82%
rename from target/linux/bcm27xx/patches-6.6/950-0298-staging-vchiq_arm-children-inherit-DMA-config.patch
rename to target/linux/bcm27xx/patches-6.6/950-1412-staging-vchiq_arm-children-inherit-DMA-config.patch
index b6fb2e9eda2f55..bcacf57c5c86ee 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0298-staging-vchiq_arm-children-inherit-DMA-config.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1412-staging-vchiq_arm-children-inherit-DMA-config.patch
@@ -1,7 +1,7 @@
-From d4712f611e6d60dd9cf09df581f5df6fad6a2207 Mon Sep 17 00:00:00 2001
+From 1129091b2d95273d930acf2926a569b90512a248 Mon Sep 17 00:00:00 2001
 From: Phil Elwell <phil@raspberrypi.com>
 Date: Tue, 21 Jul 2020 17:34:09 +0100
-Subject: [PATCH 0298/1085] staging: vchiq_arm: children inherit DMA config
+Subject: [PATCH] staging: vchiq_arm: children inherit DMA config
 
 Although it is no longer necessary for vchiq's children to have a
 different DMA configuration to the parent, they do still need to
@@ -15,7 +15,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
 +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
-@@ -1869,8 +1869,18 @@ vchiq_register_child(struct platform_dev
+@@ -1855,8 +1855,18 @@ vchiq_register_child(struct platform_dev
  
  	child->dev.of_node = np;
  
diff --git a/target/linux/bcm27xx/patches-6.6/950-0299-staging-vchiq_arm-Usa-a-DMA-pool-for-small-bulks.patch b/target/linux/bcm27xx/patches-6.6/950-1413-staging-vchiq_arm-Usa-a-DMA-pool-for-small-bulks.patch
similarity index 87%
rename from target/linux/bcm27xx/patches-6.6/950-0299-staging-vchiq_arm-Usa-a-DMA-pool-for-small-bulks.patch
rename to target/linux/bcm27xx/patches-6.6/950-1413-staging-vchiq_arm-Usa-a-DMA-pool-for-small-bulks.patch
index bcd9dae853d5ab..7120123ecfe6fb 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0299-staging-vchiq_arm-Usa-a-DMA-pool-for-small-bulks.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1413-staging-vchiq_arm-Usa-a-DMA-pool-for-small-bulks.patch
@@ -1,7 +1,7 @@
-From 9f328c347fc9a5495b8383aa2bae1d3bc242a2ab Mon Sep 17 00:00:00 2001
+From 2d26a598ceceaea8a6837146c741eb742bbd4baa Mon Sep 17 00:00:00 2001
 From: detule <ogjoneski@gmail.com>
 Date: Tue, 2 Oct 2018 04:10:08 -0400
-Subject: [PATCH 0299/1085] staging: vchiq_arm: Usa a DMA pool for small bulks
+Subject: [PATCH] staging: vchiq_arm: Usa a DMA pool for small bulks
 
 During a bulk transfer we request a DMA allocation to hold the
 scatter-gather list.  Most of the time, this allocation is small
@@ -37,7 +37,7 @@ Signed-off-by: Oliver Gjoneski <ogjoneski@gmail.com>
  /* Override the default prefix, which would be vchiq_arm (from the filename) */
  #undef MODULE_PARAM_PREFIX
  #define MODULE_PARAM_PREFIX DEVICE_NAME "."
-@@ -133,6 +136,7 @@ struct vchiq_pagelist_info {
+@@ -128,6 +131,7 @@ struct vchiq_pagelist_info {
  	struct pagelist *pagelist;
  	size_t pagelist_buffer_size;
  	dma_addr_t dma_addr;
@@ -45,7 +45,7 @@ Signed-off-by: Oliver Gjoneski <ogjoneski@gmail.com>
  	enum dma_data_direction dma_dir;
  	unsigned int num_pages;
  	unsigned int pages_need_release;
-@@ -153,6 +157,7 @@ static void __iomem *g_regs;
+@@ -148,6 +152,7 @@ static void __iomem *g_regs;
   * of 32.
   */
  static unsigned int g_cache_line_size = 32;
@@ -53,7 +53,7 @@ Signed-off-by: Oliver Gjoneski <ogjoneski@gmail.com>
  static unsigned int g_use_36bit_addrs = 0;
  static unsigned int g_fragments_size;
  static char *g_fragments_base;
-@@ -195,8 +200,13 @@ cleanup_pagelistinfo(struct vchiq_instan
+@@ -190,8 +195,13 @@ cleanup_pagelistinfo(struct vchiq_instan
  	if (pagelistinfo->pages_need_release)
  		unpin_user_pages(pagelistinfo->pages, pagelistinfo->num_pages);
  
@@ -69,7 +69,7 @@ Signed-off-by: Oliver Gjoneski <ogjoneski@gmail.com>
  }
  
  static inline bool
-@@ -231,6 +241,7 @@ create_pagelist(struct vchiq_instance *i
+@@ -226,6 +236,7 @@ create_pagelist(struct vchiq_instance *i
  	u32 *addrs;
  	unsigned int num_pages, offset, i, k;
  	int actual_pages;
@@ -77,7 +77,7 @@ Signed-off-by: Oliver Gjoneski <ogjoneski@gmail.com>
  	size_t pagelist_size;
  	struct scatterlist *scatterlist, *sg;
  	int dma_buffers;
-@@ -260,8 +271,14 @@ create_pagelist(struct vchiq_instance *i
+@@ -255,8 +266,14 @@ create_pagelist(struct vchiq_instance *i
  	/* Allocate enough storage to hold the page pointers and the page
  	 * list
  	 */
@@ -94,7 +94,7 @@ Signed-off-by: Oliver Gjoneski <ogjoneski@gmail.com>
  
  	vchiq_log_trace(vchiq_arm_log_level, "%s - %pK", __func__, pagelist);
  
-@@ -282,6 +299,7 @@ create_pagelist(struct vchiq_instance *i
+@@ -277,6 +294,7 @@ create_pagelist(struct vchiq_instance *i
  	pagelistinfo->pagelist = pagelist;
  	pagelistinfo->pagelist_buffer_size = pagelist_size;
  	pagelistinfo->dma_addr = dma_addr;
@@ -102,7 +102,7 @@ Signed-off-by: Oliver Gjoneski <ogjoneski@gmail.com>
  	pagelistinfo->dma_dir =  (type == PAGELIST_WRITE) ?
  				  DMA_TO_DEVICE : DMA_FROM_DEVICE;
  	pagelistinfo->num_pages = num_pages;
-@@ -622,6 +640,13 @@ static int vchiq_platform_init(struct pl
+@@ -617,6 +635,13 @@ static int vchiq_platform_init(struct pl
  	}
  
  	g_dma_dev = dma_dev ?: dev;
diff --git a/target/linux/bcm27xx/patches-6.6/950-0365-staging-vchiq_arm-Add-log_level-module-params.patch b/target/linux/bcm27xx/patches-6.6/950-1414-staging-vchiq_arm-Add-log_level-module-params.patch
similarity index 88%
rename from target/linux/bcm27xx/patches-6.6/950-0365-staging-vchiq_arm-Add-log_level-module-params.patch
rename to target/linux/bcm27xx/patches-6.6/950-1414-staging-vchiq_arm-Add-log_level-module-params.patch
index 51815f26193816..d85765bc32827b 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0365-staging-vchiq_arm-Add-log_level-module-params.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1414-staging-vchiq_arm-Add-log_level-module-params.patch
@@ -1,7 +1,7 @@
-From 79f24f7454a416fed9106c75ea9b3be480465dda Mon Sep 17 00:00:00 2001
+From 5b29221e96d1ba60a78d5c804a20fa35a6d0517a Mon Sep 17 00:00:00 2001
 From: Phil Elwell <phil@raspberrypi.com>
 Date: Fri, 29 Apr 2022 09:19:10 +0100
-Subject: [PATCH 0365/1085] staging: vchiq_arm: Add log_level module params
+Subject: [PATCH] staging: vchiq_arm: Add log_level module params
 
 Add module parameters to control the logging levels for the various
 vchiq logging categories.
diff --git a/target/linux/bcm27xx/patches-6.6/950-1415-media-i2c-imx477-Fix-link-frequency-menu.patch b/target/linux/bcm27xx/patches-6.6/950-1415-media-i2c-imx477-Fix-link-frequency-menu.patch
new file mode 100644
index 00000000000000..9b5b0e47d6b808
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1415-media-i2c-imx477-Fix-link-frequency-menu.patch
@@ -0,0 +1,25 @@
+From 8691544f688bd3ae9b6db0845a75ce230fc9e90f Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 21 Nov 2024 15:54:58 +0000
+Subject: [PATCH] media: i2c: imx477: Fix link frequency menu
+
+"media: i2c: imx477: Add options for slightly modifying the link freq"
+created a link frequency menu with 2 items in instead of one.
+Correct this.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/imx477.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/imx477.c
++++ b/drivers/media/i2c/imx477.c
+@@ -2051,7 +2051,7 @@ static int imx477_init_controls(struct i
+ 	/* LINK_FREQ is also read only */
+ 	imx477->link_freq =
+ 		v4l2_ctrl_new_int_menu(ctrl_hdlr, &imx477_ctrl_ops,
+-				       V4L2_CID_LINK_FREQ, 1, 0,
++				       V4L2_CID_LINK_FREQ, 0, 0,
+ 				       &link_freqs[imx477->link_freq_idx]);
+ 	if (imx477->link_freq)
+ 		imx477->link_freq->flags |= V4L2_CTRL_FLAG_READ_ONLY;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1416-misc-rp1-pio-Fix-copy-paste-error-in-pio_rp1.h.patch b/target/linux/bcm27xx/patches-6.6/950-1416-misc-rp1-pio-Fix-copy-paste-error-in-pio_rp1.h.patch
new file mode 100644
index 00000000000000..cf13be0a048160
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1416-misc-rp1-pio-Fix-copy-paste-error-in-pio_rp1.h.patch
@@ -0,0 +1,25 @@
+From 99a0201bb0abc946dc431214b638b2cc6b01dda5 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 25 Nov 2024 16:19:55 +0000
+Subject: [PATCH] misc/rp1-pio: Fix copy/paste error in pio_rp1.h
+
+As per the subject, there was a copy/paste error that caused
+pio_sm_unclaim from a driver to result in a call to
+pio_sm_claim. Fix it.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ include/linux/pio_rp1.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/pio_rp1.h
++++ b/include/linux/pio_rp1.h
+@@ -320,7 +320,7 @@ static inline int pio_sm_unclaim(struct
+ 	if (bad_params_if(client, sm >= NUM_PIO_STATE_MACHINES))
+ 		return -EINVAL;
+ 
+-	return rp1_pio_sm_claim(client, &args);
++	return rp1_pio_sm_unclaim(client, &args);
+ }
+ 
+ static inline int pio_claim_unused_sm(struct rp1_pio_client *client, bool required)
diff --git a/target/linux/bcm27xx/patches-6.6/950-1417-misc-rp1-pio-Fix-parameter-checks-wihout-client.patch b/target/linux/bcm27xx/patches-6.6/950-1417-misc-rp1-pio-Fix-parameter-checks-wihout-client.patch
new file mode 100644
index 00000000000000..e68bd175d8199b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1417-misc-rp1-pio-Fix-parameter-checks-wihout-client.patch
@@ -0,0 +1,25 @@
+From 3687701e8d252864f440f91f1aedf8ffd58d6ee6 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 25 Nov 2024 21:51:13 +0000
+Subject: [PATCH] misc: rp1-pio: Fix parameter checks wihout client
+
+Passing bad parameters to an API call without a pio pointer will cause
+a NULL pointer exception when the persistent error is set. Guard
+against that.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ include/linux/pio_rp1.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/pio_rp1.h
++++ b/include/linux/pio_rp1.h
+@@ -20,7 +20,7 @@
+ #endif
+ 
+ #define bad_params_if(client, test) \
+-	({ bool f = (test); if (f) pio_set_error(client, -EINVAL); \
++	({ bool f = (test); if (f && client) pio_set_error(client, -EINVAL); \
+ 		if (f && PARAM_WARNINGS_ENABLED) WARN_ON((test)); \
+ 		f; })
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1418-drm-vc4-dsi-Handle-the-different-command-FIFO-widths.patch b/target/linux/bcm27xx/patches-6.6/950-1418-drm-vc4-dsi-Handle-the-different-command-FIFO-widths.patch
new file mode 100644
index 00000000000000..5e50af70df4770
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1418-drm-vc4-dsi-Handle-the-different-command-FIFO-widths.patch
@@ -0,0 +1,147 @@
+From 008c93b47b9b965368eb5bbfbef60b816931e0ab Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 20 Nov 2024 13:58:08 +0000
+Subject: [PATCH] drm: vc4: dsi: Handle the different command FIFO widths
+
+DSI0 and DSI1 have different widths for the command FIFO (24bit
+vs 32bit), but the driver was assuming the 32bit width of DSI1
+in all cases.
+DSI0 also wants the data packed as 24bit big endian, so the
+formatting code needs updating.
+
+Handle the difference via the variant structure.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_dsi.c | 64 ++++++++++++++++++++++++-----------
+ 1 file changed, 44 insertions(+), 20 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_dsi.c
++++ b/drivers/gpu/drm/vc4/vc4_dsi.c
+@@ -44,7 +44,6 @@
+ 
+ #define DSI_CMD_FIFO_DEPTH  16
+ #define DSI_PIX_FIFO_DEPTH 256
+-#define DSI_PIX_FIFO_WIDTH   4
+ 
+ #define DSI0_CTRL		0x00
+ 
+@@ -170,11 +169,15 @@
+ #define DSI1_DISP1_CTRL		0x2c
+ /* Format of the data written to TXPKT_PIX_FIFO. */
+ # define DSI_DISP1_PFORMAT_MASK		VC4_MASK(2, 1)
+-# define DSI_DISP1_PFORMAT_SHIFT	1
+-# define DSI_DISP1_PFORMAT_16BIT	0
+-# define DSI_DISP1_PFORMAT_24BIT	1
+-# define DSI_DISP1_PFORMAT_32BIT_LE	2
+-# define DSI_DISP1_PFORMAT_32BIT_BE	3
++# define DSI1_DISP1_PFORMAT_SHIFT	1
++# define DSI0_DISP1_PFORMAT_16BIT	0
++# define DSI0_DISP1_PFORMAT_16BIT_ADJ	1
++# define DSI0_DISP1_PFORMAT_24BIT	2
++# define DSI0_DISP1_PFORMAT_32BIT_LE	3 /* NB Invalid, but required for macros to work */
++# define DSI1_DISP1_PFORMAT_16BIT	0
++# define DSI1_DISP1_PFORMAT_24BIT	1
++# define DSI1_DISP1_PFORMAT_32BIT_LE	2
++# define DSI1_DISP1_PFORMAT_32BIT_BE	3
+ 
+ /* DISP1 is always command mode. */
+ # define DSI_DISP1_ENABLE		BIT(0)
+@@ -553,6 +556,7 @@ struct vc4_dsi_variant {
+ 	unsigned int port;
+ 
+ 	bool broken_axi_workaround;
++	unsigned int cmd_fifo_width;
+ 
+ 	const char *debugfs_name;
+ 	const struct debugfs_reg32 *regs;
+@@ -1151,10 +1155,16 @@ static void vc4_dsi_bridge_pre_enable(st
+ 	/* Set up DISP1 for transferring long command payloads through
+ 	 * the pixfifo.
+ 	 */
+-	DSI_PORT_WRITE(DISP1_CTRL,
+-		       VC4_SET_FIELD(DSI_DISP1_PFORMAT_32BIT_LE,
+-				     DSI_DISP1_PFORMAT) |
+-		       DSI_DISP1_ENABLE);
++	if (dsi->variant->cmd_fifo_width == 4)
++		DSI_PORT_WRITE(DISP1_CTRL,
++			       VC4_SET_FIELD(DSI_PORT_BIT(DISP1_PFORMAT_32BIT_LE),
++					     DSI_DISP1_PFORMAT) |
++			       DSI_DISP1_ENABLE);
++	else
++		DSI_PORT_WRITE(DISP1_CTRL,
++			       VC4_SET_FIELD(DSI_PORT_BIT(DISP1_PFORMAT_24BIT),
++					     DSI_DISP1_PFORMAT) |
++			       DSI_DISP1_ENABLE);
+ 
+ 	/* Bring AFE out of reset. */
+ 	DSI_PORT_WRITE(PHY_AFEC0,
+@@ -1235,9 +1245,9 @@ static ssize_t vc4_dsi_transfer(struct v
+ 			pix_fifo_len = 0;
+ 		} else {
+ 			cmd_fifo_len = (packet.payload_length %
+-					DSI_PIX_FIFO_WIDTH);
++					dsi->variant->cmd_fifo_width);
+ 			pix_fifo_len = ((packet.payload_length - cmd_fifo_len) /
+-					DSI_PIX_FIFO_WIDTH);
++					dsi->variant->cmd_fifo_width);
+ 		}
+ 
+ 		WARN_ON_ONCE(pix_fifo_len >= DSI_PIX_FIFO_DEPTH);
+@@ -1255,14 +1265,25 @@ static ssize_t vc4_dsi_transfer(struct v
+ 
+ 	for (i = 0; i < cmd_fifo_len; i++)
+ 		DSI_PORT_WRITE(TXPKT_CMD_FIFO, packet.payload[i]);
+-	for (i = 0; i < pix_fifo_len; i++) {
+-		const u8 *pix = packet.payload + cmd_fifo_len + i * 4;
++	if (dsi->variant->cmd_fifo_width == 4) {
++		for (i = 0; i < pix_fifo_len; i++) {
++			const u8 *pix = packet.payload + cmd_fifo_len + i * 4;
++
++			DSI_PORT_WRITE(TXPKT_PIX_FIFO,
++				       pix[0] |
++				       pix[1] << 8 |
++				       pix[2] << 16 |
++				       pix[3] << 24);
++		}
++	} else {
++		for (i = 0; i < pix_fifo_len; i++) {
++			const u8 *pix = packet.payload + cmd_fifo_len + i * 3;
+ 
+-		DSI_PORT_WRITE(TXPKT_PIX_FIFO,
+-			       pix[0] |
+-			       pix[1] << 8 |
+-			       pix[2] << 16 |
+-			       pix[3] << 24);
++			DSI_PORT_WRITE(TXPKT_PIX_FIFO,
++				       pix[2] |
++				       pix[1] << 8 |
++				       pix[0] << 16);
++		}
+ 	}
+ 
+ 	if (msg->flags & MIPI_DSI_MSG_USE_LPM)
+@@ -1516,6 +1537,7 @@ static const struct drm_encoder_funcs vc
+ 
+ static const struct vc4_dsi_variant bcm2711_dsi1_variant = {
+ 	.port			= 1,
++	.cmd_fifo_width		= 4,
+ 	.debugfs_name		= "dsi1_regs",
+ 	.regs			= dsi1_regs,
+ 	.nregs			= ARRAY_SIZE(dsi1_regs),
+@@ -1523,6 +1545,7 @@ static const struct vc4_dsi_variant bcm2
+ 
+ static const struct vc4_dsi_variant bcm2835_dsi0_variant = {
+ 	.port			= 0,
++	.cmd_fifo_width		= 3,
+ 	.debugfs_name		= "dsi0_regs",
+ 	.regs			= dsi0_regs,
+ 	.nregs			= ARRAY_SIZE(dsi0_regs),
+@@ -1530,6 +1553,7 @@ static const struct vc4_dsi_variant bcm2
+ 
+ static const struct vc4_dsi_variant bcm2835_dsi1_variant = {
+ 	.port			= 1,
++	.cmd_fifo_width		= 4,
+ 	.broken_axi_workaround	= true,
+ 	.debugfs_name		= "dsi1_regs",
+ 	.regs			= dsi1_regs,
diff --git a/target/linux/bcm27xx/patches-6.6/950-1419-dts-bcm2712-rpi-For-CM5IO-i2c_csi_dsi-needs-to-be-CA.patch b/target/linux/bcm27xx/patches-6.6/950-1419-dts-bcm2712-rpi-For-CM5IO-i2c_csi_dsi-needs-to-be-CA.patch
new file mode 100644
index 00000000000000..0aab1043b597b5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1419-dts-bcm2712-rpi-For-CM5IO-i2c_csi_dsi-needs-to-be-CA.patch
@@ -0,0 +1,30 @@
+From eafaa6015fc0ed676f6115905e7c4145d23f5b7d Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 26 Nov 2024 15:53:24 +0000
+Subject: [PATCH] dts: bcm2712-rpi: For CM5IO, i2c_csi_dsi needs to be
+ CAM/DISP1
+
+Noted setting up a display on CM5IO. Add
+"dtoverlay=vc4-kms-dsi-ili7881-7inch" fails as it tries to
+find the regulator/backlight/touch on i2c_csi_dsi, which pointed
+at i2c_csi_dsi0 by default.
+
+Adding the dsi0 override updated to point at dsi0, and pointed
+the i2c at i2c_csi_dsi0, which all works.
+
+The default with i2c_csi_dsi needs to be consistent in using
+dsi1/csi1 and the corresponding i2c interface (i2c_csi_dsi1).
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5io.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5io.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5io.dtsi
+@@ -11,4 +11,4 @@ i2c_csi_dsi0: &i2c6 { // Note: This is f
+ 	symlink = "i2c-6";
+ };
+ 
+-i2c_csi_dsi: &i2c_csi_dsi0 { }; // The connector that needs no jumper to enable
++i2c_csi_dsi: &i2c_csi_dsi1 { }; // The connector that needs no jumper to enable
diff --git a/target/linux/bcm27xx/patches-6.6/950-1420-dts-bcm2712-rpi-cm5-Remove-inaccessible-USB_OC_N.patch b/target/linux/bcm27xx/patches-6.6/950-1420-dts-bcm2712-rpi-cm5-Remove-inaccessible-USB_OC_N.patch
new file mode 100644
index 00000000000000..e2a01216a3eae9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1420-dts-bcm2712-rpi-cm5-Remove-inaccessible-USB_OC_N.patch
@@ -0,0 +1,25 @@
+From d128c123754e9dd03ad72c16851a1652331d6da1 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 27 Nov 2024 10:24:47 +0000
+Subject: [PATCH] dts: bcm2712-rpi-cm5: Remove inaccessible USB_OC_N
+
+Although VBUS_EN on GPIO42 appears on the CM5's 100-way headers,
+USB_OC_N on GPIO43 does not. Remove the signal name to avoid further
+confusion and disappointment.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
+@@ -718,7 +718,7 @@ spi10_cs_pins: &spi10_cs_gpio1 {};
+ 		"-", // GPIO40
+ 		"-", // GPIO41
+ 		"USB_VBUS_EN", // GPIO42
+-		"USB_OC_N", // GPIO43
++		"-", // GPIO43
+ 		"RP1_STAT_LED", // GPIO44
+ 		"FAN_PWM", // GPIO45
+ 		"-", // GPIO46
diff --git a/target/linux/bcm27xx/patches-6.6/950-1421-overlays-qca7000-replace-URL-with-textual-hint.patch b/target/linux/bcm27xx/patches-6.6/950-1421-overlays-qca7000-replace-URL-with-textual-hint.patch
new file mode 100644
index 00000000000000..8cdb2504a106c5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1421-overlays-qca7000-replace-URL-with-textual-hint.patch
@@ -0,0 +1,33 @@
+From 77389e715039b1feac9c6261727600892cc12fdb Mon Sep 17 00:00:00 2001
+From: Michael Heimpold <michael.heimpold@chargebyte.com>
+Date: Fri, 29 Nov 2024 14:10:04 +0100
+Subject: [PATCH] overlays: qca7000: replace URL with textual hint
+
+The deep link into the website is not that stable, so let's
+replace it with a textual description where to find the
+product information.
+
+Signed-off-by: Michael Heimpold <michael.heimpold@chargebyte.com>
+---
+ arch/arm/boot/dts/overlays/qca7000-overlay.dts       | 2 +-
+ arch/arm/boot/dts/overlays/qca7000-uart0-overlay.dts | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/qca7000-overlay.dts
++++ b/arch/arm/boot/dts/overlays/qca7000-overlay.dts
+@@ -1,5 +1,5 @@
+ // Overlay for the Qualcomm Atheros QCA7000 on PLC Stamp micro EVK
+-// Visit: https://chargebyte.com/products/evaluation-tools/plc-stamp-micro-2-evaluation-board for details
++// Visit: https://chargebyte.com -> Controllers & Modules -> Evaluation Tools -> PLC Stamp Micro 2 Evaluation Board for details
+ 
+ /dts-v1/;
+ /plugin/;
+--- a/arch/arm/boot/dts/overlays/qca7000-uart0-overlay.dts
++++ b/arch/arm/boot/dts/overlays/qca7000-uart0-overlay.dts
+@@ -1,5 +1,5 @@
+ // Overlay for the Qualcomm Atheros QCA7000 on PLC Stamp micro EVK
+-// Visit: https://in-tech-smartcharging.com/products/evaluation-tools/plc-stamp-micro-2-evaluation-board for details
++// Visit: https://chargebyte.com -> Controllers & Modules -> Evaluation Tools -> PLC Stamp Micro 2 Evaluation Board for details
+ 
+ /dts-v1/;
+ /plugin/;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1422-dt-bindings-net-cdns-macb-Add-compatible-for-Raspber.patch b/target/linux/bcm27xx/patches-6.6/950-1422-dt-bindings-net-cdns-macb-Add-compatible-for-Raspber.patch
new file mode 100644
index 00000000000000..1364b4f713cde9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1422-dt-bindings-net-cdns-macb-Add-compatible-for-Raspber.patch
@@ -0,0 +1,24 @@
+From 178f1c2747c3920723242f26ba290785d45bffae Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 11 Nov 2024 16:38:01 +0000
+Subject: [PATCH] dt-bindings: net: cdns,macb: Add compatible for Raspberry Pi
+ RP1
+
+The Raspberry Pi RP1 chip has the Cadence GEM ethernet
+controller, so add a compatible string for it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ Documentation/devicetree/bindings/net/cdns,macb.yaml | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/Documentation/devicetree/bindings/net/cdns,macb.yaml
++++ b/Documentation/devicetree/bindings/net/cdns,macb.yaml
+@@ -54,6 +54,7 @@ properties:
+           - cdns,np4-macb             # NP4 SoC devices
+           - microchip,sama7g5-emac    # Microchip SAMA7G5 ethernet interface
+           - microchip,sama7g5-gem     # Microchip SAMA7G5 gigabit ethernet interface
++          - raspberrypi,rp1-gem       # Raspberry Pi RP1 gigabit ethernet interface
+           - sifive,fu540-c000-gem     # SiFive FU540-C000 SoC
+           - cdns,emac                 # Generic
+           - cdns,gem                  # Generic
diff --git a/target/linux/bcm27xx/patches-6.6/950-1423-net-macb-Add-support-for-Raspberry-Pi-RP1-ethernet-c.patch b/target/linux/bcm27xx/patches-6.6/950-1423-net-macb-Add-support-for-Raspberry-Pi-RP1-ethernet-c.patch
new file mode 100644
index 00000000000000..6a9b7b36bd4075
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1423-net-macb-Add-support-for-Raspberry-Pi-RP1-ethernet-c.patch
@@ -0,0 +1,43 @@
+From f9f0024bd9bf04a58b64bae356be4c04022d23bc Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 11 Nov 2024 16:40:07 +0000
+Subject: [PATCH] net: macb: Add support for Raspberry Pi RP1 ethernet
+ controller
+
+The RP1 chip has the Cadence GEM block, but wants the tx_clock
+to always run at 125MHz, in the same way as sama7g5.
+Add the relevant configuration.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/net/ethernet/cadence/macb_main.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -5023,6 +5023,17 @@ static const struct macb_config versal_c
+ 	.usrio = &macb_default_usrio,
+ };
+ 
++static const struct macb_config raspberrypi_rp1_config = {
++	.caps = MACB_CAPS_GIGABIT_MODE_AVAILABLE | MACB_CAPS_CLK_HW_CHG |
++		MACB_CAPS_JUMBO |
++		MACB_CAPS_GEM_HAS_PTP,
++	.dma_burst_length = 16,
++	.clk_init = macb_clk_init,
++	.init = macb_init,
++	.usrio = &macb_default_usrio,
++	.jumbo_max_len = 10240,
++};
++
+ static const struct of_device_id macb_dt_ids[] = {
+ 	{ .compatible = "cdns,at91sam9260-macb", .data = &at91sam9260_config },
+ 	{ .compatible = "cdns,macb" },
+@@ -5043,6 +5054,7 @@ static const struct of_device_id macb_dt
+ 	{ .compatible = "microchip,mpfs-macb", .data = &mpfs_config },
+ 	{ .compatible = "microchip,sama7g5-gem", .data = &sama7g5_gem_config },
+ 	{ .compatible = "microchip,sama7g5-emac", .data = &sama7g5_emac_config },
++	{ .compatible = "raspberrypi,rp1-gem", .data = &raspberrypi_rp1_config },
+ 	{ .compatible = "xlnx,zynqmp-gem", .data = &zynqmp_config},
+ 	{ .compatible = "xlnx,zynq-gem", .data = &zynq_config },
+ 	{ .compatible = "xlnx,versal-gem", .data = &versal_config},
diff --git a/target/linux/bcm27xx/patches-6.6/950-1424-rp1-clk-Only-set-PLL_SEC_RST-in-rp1_pll_divider_off.patch b/target/linux/bcm27xx/patches-6.6/950-1424-rp1-clk-Only-set-PLL_SEC_RST-in-rp1_pll_divider_off.patch
new file mode 100644
index 00000000000000..91d836f71cabbe
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1424-rp1-clk-Only-set-PLL_SEC_RST-in-rp1_pll_divider_off.patch
@@ -0,0 +1,26 @@
+From 33c225f622d596034a9261316666089a92aa6834 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 25 Nov 2024 12:30:06 +0000
+Subject: [PATCH] rp1: clk: Only set PLL_SEC_RST in rp1_pll_divider_off
+
+Rather than clearing all the bits in rp1_pll_divider_off
+and setting PLL_SEC_RST, retain the status of all the other
+bits.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/clk/clk-rp1.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/clk-rp1.c
++++ b/drivers/clk/clk-rp1.c
+@@ -927,7 +927,8 @@ static void rp1_pll_divider_off(struct c
+ 	const struct rp1_pll_data *data = divider->data;
+ 
+ 	spin_lock(&clockman->regs_lock);
+-	clockman_write(clockman, data->ctrl_reg, PLL_SEC_RST);
++	clockman_write(clockman, data->ctrl_reg,
++		       clockman_read(clockman, data->ctrl_reg) | PLL_SEC_RST);
+ 	spin_unlock(&clockman->regs_lock);
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1425-rp1-clk-Rationalise-the-use-of-the-CLK_IS_CRITICAL-f.patch b/target/linux/bcm27xx/patches-6.6/950-1425-rp1-clk-Rationalise-the-use-of-the-CLK_IS_CRITICAL-f.patch
new file mode 100644
index 00000000000000..3f4850c8990d10
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1425-rp1-clk-Rationalise-the-use-of-the-CLK_IS_CRITICAL-f.patch
@@ -0,0 +1,123 @@
+From eb836a6a299322a8e2b9627cccd23c7a76d068ba Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 8 Nov 2024 17:36:13 +0000
+Subject: [PATCH] rp1: clk: Rationalise the use of the CLK_IS_CRITICAL flag
+
+The clock setup had been copied from clk-bcm2835 which had to cope
+with the firmware having configured clocks, so there were flags
+of CLK_IS_CRITICAL and CLK_IGNORE_UNUSED dotted around.
+
+That isn't the situation with RP1 where only the main PLLs, CLK_SYS,
+and CLK_SLOW_SYS are critical, so update the configuration to match.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/clk/clk-rp1.c | 41 ++++++-----------------------------------
+ 1 file changed, 6 insertions(+), 35 deletions(-)
+
+--- a/drivers/clk/clk-rp1.c
++++ b/drivers/clk/clk-rp1.c
+@@ -1504,8 +1504,6 @@ static const struct clk_ops rp1_varsrc_o
+ 	.round_rate = rp1_varsrc_round_rate,
+ };
+ 
+-static bool rp1_clk_is_claimed(const char *name);
+-
+ static struct clk_hw *rp1_register_pll_core(struct rp1_clockman *clockman,
+ 					    const void *data)
+ {
+@@ -1521,7 +1519,7 @@ static struct clk_hw *rp1_register_pll_c
+ 	init.num_parents = 1;
+ 	init.name = pll_core_data->name;
+ 	init.ops = &rp1_pll_core_ops;
+-	init.flags = pll_core_data->flags | CLK_IGNORE_UNUSED | CLK_IS_CRITICAL;
++	init.flags = pll_core_data->flags | CLK_IS_CRITICAL;
+ 
+ 	pll_core = kzalloc(sizeof(*pll_core), GFP_KERNEL);
+ 	if (!pll_core)
+@@ -1554,7 +1552,7 @@ static struct clk_hw *rp1_register_pll(s
+ 	init.num_parents = 1;
+ 	init.name = pll_data->name;
+ 	init.ops = &rp1_pll_ops;
+-	init.flags = pll_data->flags | CLK_IGNORE_UNUSED | CLK_IS_CRITICAL;
++	init.flags = pll_data->flags | CLK_IGNORE_UNUSED;
+ 
+ 	pll = kzalloc(sizeof(*pll), GFP_KERNEL);
+ 	if (!pll)
+@@ -1635,11 +1633,6 @@ static struct clk_hw *rp1_register_pll_d
+ 	divider->div.hw.init = &init;
+ 	divider->div.table = pll_sec_div_table;
+ 
+-	if (!rp1_clk_is_claimed(divider_data->source_pll))
+-		init.flags |= CLK_IS_CRITICAL;
+-	if (!rp1_clk_is_claimed(divider_data->name))
+-		divider->div.flags |= CLK_IS_CRITICAL;
+-
+ 	divider->clockman = clockman;
+ 	divider->data = divider_data;
+ 
+@@ -1861,6 +1854,8 @@ static const struct rp1_clk_desc clk_des
+ 				.max_freq = 200 * MHz,
+ 				.fc0_src = FC_NUM(0, 4),
+ 				.clk_src_mask = 0x3,
++				/* Always enabled in hardware */
++				.flags = CLK_IS_CRITICAL,
+ 				),
+ 
+ 	[RP1_CLK_SLOW_SYS] = REGISTER_CLK(
+@@ -1875,6 +1870,8 @@ static const struct rp1_clk_desc clk_des
+ 				.max_freq = 50 * MHz,
+ 				.fc0_src = FC_NUM(1, 4),
+ 				.clk_src_mask = 0x1,
++				/* Always enabled in hardware */
++				.flags = CLK_IS_CRITICAL,
+ 				),
+ 
+ 	[RP1_CLK_UART] = REGISTER_CLK(
+@@ -2394,24 +2391,6 @@ static const struct rp1_clk_desc clk_des
+ 	[RP1_CLK_MIPI1_DSI_BYTECLOCK] = REGISTER_VARSRC("clksrc_mipi1_dsi_byteclk"),
+ };
+ 
+-static bool rp1_clk_claimed[ARRAY_SIZE(clk_desc_array)];
+-
+-static bool rp1_clk_is_claimed(const char *name)
+-{
+-	unsigned int i;
+-
+-	for (i = 0; i < ARRAY_SIZE(clk_desc_array); i++) {
+-		if (clk_desc_array[i].data) {
+-			const char *clk_name = *(const char **)(clk_desc_array[i].data);
+-
+-			if (!strcmp(name, clk_name))
+-				return rp1_clk_claimed[i];
+-		}
+-	}
+-
+-	return false;
+-}
+-
+ static int rp1_clk_probe(struct platform_device *pdev)
+ {
+ 	const struct rp1_clk_desc *desc;
+@@ -2422,7 +2401,6 @@ static int rp1_clk_probe(struct platform
+ 	const size_t asize = ARRAY_SIZE(clk_desc_array);
+ 	u32 chip_id, platform;
+ 	unsigned int i;
+-	u32 clk_id;
+ 	int ret;
+ 
+ 	clockman = devm_kzalloc(dev, struct_size(clockman, onecell.hws, asize),
+@@ -2439,13 +2417,6 @@ static int rp1_clk_probe(struct platform
+ 	if (IS_ERR(clockman->regs))
+ 		return PTR_ERR(clockman->regs);
+ 
+-	memset(rp1_clk_claimed, 0, sizeof(rp1_clk_claimed));
+-	for (i = 0;
+-	     !of_property_read_u32_index(pdev->dev.of_node, "claim-clocks",
+-					 i, &clk_id);
+-	     i++)
+-		rp1_clk_claimed[clk_id] = true;
+-
+ 	platform_set_drvdata(pdev, clockman);
+ 
+ 	clockman->onecell.num = asize;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1426-dt-arm64-Fixup-RP1-ethernet-DT-configuration.patch b/target/linux/bcm27xx/patches-6.6/950-1426-dt-arm64-Fixup-RP1-ethernet-DT-configuration.patch
new file mode 100644
index 00000000000000..f213d8def67c51
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1426-dt-arm64-Fixup-RP1-ethernet-DT-configuration.patch
@@ -0,0 +1,50 @@
+From 0b4af929b7125abd3a262577b380c7c81ee9b1c5 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 11 Nov 2024 15:18:14 +0000
+Subject: [PATCH] dt: arm64: Fixup RP1 ethernet DT configuration
+
+Configure RP1's ethernet block to do the correct thing.
+clk_eth is intended to be fixed at 125MHz, so use a new compatible,
+and use assigned-clocks to configure the clock appropriately.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/rp1.dtsi | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/rp1.dtsi
++++ b/arch/arm64/boot/dts/broadcom/rp1.dtsi
+@@ -32,6 +32,7 @@
+ 					  // RP1_PLL_VIDEO_CORE and dividers are now managed by VEC,DPI drivers
+ 					  <&rp1_clocks RP1_PLL_SYS>,
+ 					  <&rp1_clocks RP1_PLL_SYS_SEC>,
++					  <&rp1_clocks RP1_CLK_ETH>,
+ 					  <&rp1_clocks RP1_PLL_AUDIO>,
+ 					  <&rp1_clocks RP1_PLL_AUDIO_SEC>,
+ 					  <&rp1_clocks RP1_CLK_SYS>,
+@@ -46,6 +47,7 @@
+ 					       <1536000000>, // RP1_PLL_AUDIO_CORE
+ 					       <200000000>,  // RP1_PLL_SYS
+ 					       <125000000>,  // RP1_PLL_SYS_SEC
++					       <125000000>,  // RP1_CLK_ETH
+ 					       <61440000>,   // RP1_PLL_AUDIO
+ 					       <192000000>,  // RP1_PLL_AUDIO_SEC
+ 					       <200000000>,  // RP1_CLK_SYS
+@@ -976,12 +978,14 @@
+ 
+ 		rp1_eth: ethernet@100000 {
+ 			reg = <0xc0 0x40100000  0x0 0x4000>;
+-			compatible = "cdns,macb";
++			compatible = "raspberrypi,rp1-gem", "cdns,macb";
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 			interrupts = <RP1_INT_ETH IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&macb_pclk &macb_hclk &rp1_clocks RP1_CLK_ETH_TSU>;
+-			clock-names = "pclk", "hclk", "tsu_clk";
++			clocks = <&macb_pclk &macb_hclk
++				  &rp1_clocks RP1_CLK_ETH_TSU
++				  &rp1_clocks RP1_CLK_ETH>;
++			clock-names = "pclk", "hclk", "tsu_clk", "tx_clk";
+ 			phy-mode = "rgmii-id";
+ 			cdns,aw2w-max-pipe = /bits/ 8 <8>;
+ 			cdns,ar2r-max-pipe = /bits/ 8 <8>;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1427-clk-rp1-Add-RP1_CLK_DMA.patch b/target/linux/bcm27xx/patches-6.6/950-1427-clk-rp1-Add-RP1_CLK_DMA.patch
new file mode 100644
index 00000000000000..b13becd187125b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1427-clk-rp1-Add-RP1_CLK_DMA.patch
@@ -0,0 +1,44 @@
+From d4e41ed9954fa86c4774f98d393aa401c81a68e7 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 13 Nov 2024 13:10:27 +0000
+Subject: [PATCH] clk: rp1: Add RP1_CLK_DMA.
+
+The DMA block has a clock, but wasn't defined in the driver. This
+resulted in the parent being disabled as unused, and then DMA
+stopped working.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/clk/clk-rp1.c | 21 +++++++++++++++++++++
+ 1 file changed, 21 insertions(+)
+
+--- a/drivers/clk/clk-rp1.c
++++ b/drivers/clk/clk-rp1.c
+@@ -1874,6 +1874,27 @@ static const struct rp1_clk_desc clk_des
+ 				.flags = CLK_IS_CRITICAL,
+ 				),
+ 
++	[RP1_CLK_DMA] = REGISTER_CLK(
++				.name = "clk_dma",
++				.parents = {"pll_sys_pri_ph",
++					    "pll_video",
++					    "xosc",
++					    "clksrc_gp0",
++					    "clksrc_gp1",
++					    "clksrc_gp2",
++					    "clksrc_gp3",
++					    "clksrc_gp4",
++					    "clksrc_gp5"},
++				.num_std_parents = 0,
++				.num_aux_parents = 9,
++				.ctrl_reg = CLK_DMA_CTRL,
++				.div_int_reg = CLK_DMA_DIV_INT,
++				.sel_reg = CLK_DMA_SEL,
++				.div_int_max = DIV_INT_8BIT_MAX,
++				.max_freq = 100 * MHz,
++				.fc0_src = FC_NUM(2, 2),
++				),
++
+ 	[RP1_CLK_UART] = REGISTER_CLK(
+ 				.name = "clk_uart",
+ 				.parents = {"pll_sys_pri_ph",
diff --git a/target/linux/bcm27xx/patches-6.6/950-1428-rp1-clk-Remove-CLK_IGNORE_UNUSED-flags.patch b/target/linux/bcm27xx/patches-6.6/950-1428-rp1-clk-Remove-CLK_IGNORE_UNUSED-flags.patch
new file mode 100644
index 00000000000000..662a2485dd151b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1428-rp1-clk-Remove-CLK_IGNORE_UNUSED-flags.patch
@@ -0,0 +1,59 @@
+From 9049e4df2c54b5e620f855f66db3a18c9f2e181f Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Fri, 8 Nov 2024 17:37:08 +0000
+Subject: [PATCH] rp1: clk: Remove CLK_IGNORE_UNUSED flags
+
+There should be no issue in disabling the RP1 clocks as long as
+the kernel knows about all consumers.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/clk/clk-rp1.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/clk/clk-rp1.c
++++ b/drivers/clk/clk-rp1.c
+@@ -1552,7 +1552,7 @@ static struct clk_hw *rp1_register_pll(s
+ 	init.num_parents = 1;
+ 	init.name = pll_data->name;
+ 	init.ops = &rp1_pll_ops;
+-	init.flags = pll_data->flags | CLK_IGNORE_UNUSED;
++	init.flags = pll_data->flags;
+ 
+ 	pll = kzalloc(sizeof(*pll), GFP_KERNEL);
+ 	if (!pll)
+@@ -1586,7 +1586,7 @@ static struct clk_hw *rp1_register_pll_p
+ 	init.num_parents = 1;
+ 	init.name = ph_data->name;
+ 	init.ops = &rp1_pll_ph_ops;
+-	init.flags = ph_data->flags | CLK_IGNORE_UNUSED;
++	init.flags = ph_data->flags;
+ 
+ 	ph = kzalloc(sizeof(*ph), GFP_KERNEL);
+ 	if (!ph)
+@@ -1619,7 +1619,7 @@ static struct clk_hw *rp1_register_pll_d
+ 	init.num_parents = 1;
+ 	init.name = divider_data->name;
+ 	init.ops = &rp1_pll_divider_ops;
+-	init.flags = divider_data->flags | CLK_IGNORE_UNUSED;
++	init.flags = divider_data->flags;
+ 
+ 	divider = devm_kzalloc(clockman->dev, sizeof(*divider), GFP_KERNEL);
+ 	if (!divider)
+@@ -1662,7 +1662,7 @@ static struct clk_hw *rp1_register_clock
+ 	init.num_parents =
+ 		clock_data->num_std_parents + clock_data->num_aux_parents;
+ 	init.name = clock_data->name;
+-	init.flags = clock_data->flags | CLK_IGNORE_UNUSED;
++	init.flags = clock_data->flags;
+ 	init.ops = &rp1_clk_ops;
+ 
+ 	clock = devm_kzalloc(clockman->dev, sizeof(*clock), GFP_KERNEL);
+@@ -1692,7 +1692,6 @@ static struct clk_hw *rp1_register_varsr
+ 	init.parent_names = &ref_clock;
+ 	init.num_parents = 1;
+ 	init.name = name;
+-	init.flags = CLK_IGNORE_UNUSED;
+ 	init.ops = &rp1_varsrc_ops;
+ 
+ 	clock = devm_kzalloc(clockman->dev, sizeof(*clock), GFP_KERNEL);
diff --git a/target/linux/bcm27xx/patches-6.6/950-1429-dt-rp1-Use-clk_sys-for-ethernet-hclk-and-pclk.patch b/target/linux/bcm27xx/patches-6.6/950-1429-dt-rp1-Use-clk_sys-for-ethernet-hclk-and-pclk.patch
new file mode 100644
index 00000000000000..937b1257175c34
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1429-dt-rp1-Use-clk_sys-for-ethernet-hclk-and-pclk.patch
@@ -0,0 +1,45 @@
+From 542d0f7f2e9f90fc0f02f8cb141f7c3fbf46081b Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 11 Nov 2024 17:11:18 +0000
+Subject: [PATCH] dt: rp1: Use clk_sys for ethernet hclk and pclk
+
+hclk and pclk of the MAC are connected to clk_sys, so define
+them as being connected accordingly, rather than having fake
+fixed clocks for them.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/rp1.dtsi | 15 ++-------------
+ 1 file changed, 2 insertions(+), 13 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/rp1.dtsi
++++ b/arch/arm64/boot/dts/broadcom/rp1.dtsi
+@@ -982,7 +982,8 @@
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 			interrupts = <RP1_INT_ETH IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&macb_pclk &macb_hclk
++			clocks = <&rp1_clocks RP1_CLK_SYS
++				  &rp1_clocks RP1_CLK_SYS
+ 				  &rp1_clocks RP1_CLK_ETH_TSU
+ 				  &rp1_clocks RP1_CLK_ETH>;
+ 			clock-names = "pclk", "hclk", "tsu_clk", "tx_clk";
+@@ -1230,18 +1231,6 @@
+ 		clock-output-names = "xosc";
+ 		clock-frequency = <50000000>;
+ 	};
+-	macb_pclk: macb_pclk {
+-		compatible = "fixed-clock";
+-		#clock-cells = <0>;
+-		clock-output-names = "pclk";
+-		clock-frequency = <200000000>;
+-	};
+-	macb_hclk: macb_hclk {
+-		compatible = "fixed-clock";
+-		#clock-cells = <0>;
+-		clock-output-names = "hclk";
+-		clock-frequency = <200000000>;
+-	};
+ 	sdio_src: sdio_src {
+ 		// 400 MHz on FPGA. PLL sys VCO on asic
+ 		compatible = "fixed-clock";
diff --git a/target/linux/bcm27xx/patches-6.6/950-1430-dt-rp1-Link-RP1-DMA-to-the-associated-clock.patch b/target/linux/bcm27xx/patches-6.6/950-1430-dt-rp1-Link-RP1-DMA-to-the-associated-clock.patch
new file mode 100644
index 00000000000000..623fcc6cc362ed
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1430-dt-rp1-Link-RP1-DMA-to-the-associated-clock.patch
@@ -0,0 +1,24 @@
+From efecbda4014b490e042c7fd090942b32316f9345 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 13 Nov 2024 13:11:33 +0000
+Subject: [PATCH] dt: rp1: Link RP1 DMA to the associated clock
+
+This makes the kernel representation of the clock structure
+match reality.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/rp1.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/broadcom/rp1.dtsi
++++ b/arch/arm64/boot/dts/broadcom/rp1.dtsi
+@@ -1081,7 +1081,7 @@
+ 			reg = <0xc0 0x40188000  0x0 0x1000>;
+ 			compatible = "snps,axi-dma-1.01a";
+ 			interrupts = <RP1_INT_DMA IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&sdhci_core &rp1_clocks RP1_CLK_SYS>;
++			clocks = <&rp1_clocks RP1_CLK_DMA &rp1_clocks RP1_CLK_SYS>;
+ 			clock-names = "core-clk", "cfgr-clk";
+ 
+ 			#dma-cells = <1>;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1431-raspberrypi-firmware-Add-the-RPI-firmware-UART-APIs.patch b/target/linux/bcm27xx/patches-6.6/950-1431-raspberrypi-firmware-Add-the-RPI-firmware-UART-APIs.patch
new file mode 100644
index 00000000000000..7e518bff1cc8cf
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1431-raspberrypi-firmware-Add-the-RPI-firmware-UART-APIs.patch
@@ -0,0 +1,23 @@
+From eb035f3ad7da1324d310ef83b42398f47d5bafe7 Mon Sep 17 00:00:00 2001
+From: Tim Gover <tim.gover@raspberrypi.com>
+Date: Fri, 1 Nov 2024 19:42:17 +0000
+Subject: [PATCH] raspberrypi-firmware: Add the RPI firmware UART APIs
+
+Add VideoCore mailbox definitions for the new RPi firmware UART.
+
+Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
+---
+ include/soc/bcm2835/raspberrypi-firmware.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/include/soc/bcm2835/raspberrypi-firmware.h
++++ b/include/soc/bcm2835/raspberrypi-firmware.h
+@@ -98,6 +98,8 @@ enum rpi_firmware_property_tag {
+ 	RPI_FIRMWARE_GET_REBOOT_FLAGS =                       0x00030064,
+ 	RPI_FIRMWARE_SET_REBOOT_FLAGS =                       0x00038064,
+ 	RPI_FIRMWARE_NOTIFY_DISPLAY_DONE =                    0x00030066,
++	RPI_FIRMWARE_GET_SW_UART =                            0x0003008a,
++	RPI_FIRMWARE_SET_SW_UART =                            0x0003808a,
+ 
+ 	/* Dispmanx TAGS */
+ 	RPI_FIRMWARE_FRAMEBUFFER_ALLOCATE =                   0x00040001,
diff --git a/target/linux/bcm27xx/patches-6.6/950-1432-serial-core-Add-the-Raspberry-Pi-firmware-UART-id.patch b/target/linux/bcm27xx/patches-6.6/950-1432-serial-core-Add-the-Raspberry-Pi-firmware-UART-id.patch
new file mode 100644
index 00000000000000..5767f407fe0f6c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1432-serial-core-Add-the-Raspberry-Pi-firmware-UART-id.patch
@@ -0,0 +1,22 @@
+From b8a0e563fd181205565a0edaaebc82b1abf0c5be Mon Sep 17 00:00:00 2001
+From: Tim Gover <tim.gover@raspberrypi.com>
+Date: Fri, 1 Nov 2024 19:43:21 +0000
+Subject: [PATCH] serial: core: Add the Raspberry Pi firmware UART id
+
+Assign a new serial core number for the RPi firmware UART.
+
+Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
+---
+ include/uapi/linux/serial_core.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/include/uapi/linux/serial_core.h
++++ b/include/uapi/linux/serial_core.h
+@@ -245,4 +245,7 @@
+ /* Sunplus UART */
+ #define PORT_SUNPLUS	123
+ 
++/* RPi firmware UART */
++#define PORT_RPI_FW	124
++
+ #endif /* _UAPILINUX_SERIAL_CORE_H */
diff --git a/target/linux/bcm27xx/patches-6.6/950-1433-serial-tty-Add-a-driver-for-the-RPi-firmware-UART.patch b/target/linux/bcm27xx/patches-6.6/950-1433-serial-tty-Add-a-driver-for-the-RPi-firmware-UART.patch
new file mode 100644
index 00000000000000..f26c1bee860b9f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1433-serial-tty-Add-a-driver-for-the-RPi-firmware-UART.patch
@@ -0,0 +1,630 @@
+From 2548d954d78bca44c5cf430f8ea6de7c771312d7 Mon Sep 17 00:00:00 2001
+From: Tim Gover <tim.gover@raspberrypi.com>
+Date: Wed, 28 Aug 2024 09:46:50 +0100
+Subject: [PATCH] serial: tty: Add a driver for the RPi firmware UART
+
+On Raspberry Pi 4 and earlier models the firmware provides
+a low speed (up to 115200 baud) bit-bashed UART on arbitrary
+GPIOs using the second VPU core.
+
+The firmware driver is designed to support 19200 baud. Higher
+rates up to 115200 seem to work but there may be more jitter.
+
+This can be useful for debug or managing additional low
+speed peripherals if the hardware PL011 and 8250 hardware
+UARTs are already used for console / bluetooth.
+
+The firmware driver requires a fixed core clock frequency
+and also requires the VPU PWM audio driver to be disabled
+(dtparam=audio=off)
+
+Runtime configuration is handled via the vc-mailbox APIs
+with the FIFO buffers being allocated in uncached VPU
+addressable memory. The FIFO pointers are stored in spare
+VideoCore multi-core sync registers in order to reduce the number
+of uncached SDRAM accesses thereby reducing jitter.
+
+Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
+---
+ drivers/tty/serial/Kconfig       |  11 +
+ drivers/tty/serial/Makefile      |   1 +
+ drivers/tty/serial/rpi-fw-uart.c | 563 +++++++++++++++++++++++++++++++
+ 3 files changed, 575 insertions(+)
+ create mode 100644 drivers/tty/serial/rpi-fw-uart.c
+
+--- a/drivers/tty/serial/Kconfig
++++ b/drivers/tty/serial/Kconfig
+@@ -1578,6 +1578,17 @@ config SERIAL_NUVOTON_MA35D1_CONSOLE
+ 	  but you can alter that using a kernel command line option such as
+ 	  "console=ttyNVTx".
+ 
++config SERIAL_RPI_FW
++	tristate "Raspberry Pi Firmware software UART support"
++	depends on ARM_AMBA || COMPILE_TEST
++	select SERIAL_CORE
++	help
++	  This selects the Raspberry Pi firmware UART. This is a bit-bashed
++	  implementation running on the Raspbery Pi VPU core.
++	  This is not supported on Raspberry Pi 5 or newer platforms.
++
++	  If unsure, say N.
++
+ endmenu
+ 
+ config SERIAL_MCTRL_GPIO
+--- a/drivers/tty/serial/Makefile
++++ b/drivers/tty/serial/Makefile
+@@ -88,6 +88,7 @@ obj-$(CONFIG_SERIAL_MILBEAUT_USIO) += mi
+ obj-$(CONFIG_SERIAL_SIFIVE)	+= sifive.o
+ obj-$(CONFIG_SERIAL_LITEUART) += liteuart.o
+ obj-$(CONFIG_SERIAL_SUNPLUS)	+= sunplus-uart.o
++obj-$(CONFIG_SERIAL_RPI_FW) += rpi-fw-uart.o
+ 
+ # GPIOLIB helpers for modem control lines
+ obj-$(CONFIG_SERIAL_MCTRL_GPIO)	+= serial_mctrl_gpio.o
+--- /dev/null
++++ b/drivers/tty/serial/rpi-fw-uart.c
+@@ -0,0 +1,563 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2024, Raspberry Pi Ltd.  All rights reserved.
++ */
++
++#include <linux/console.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/gpio/consumer.h>
++#include <linux/platform_device.h>
++#include <linux/serial.h>
++#include <linux/serial_core.h>
++#include <linux/slab.h>
++#include <linux/tty.h>
++#include <linux/tty_flip.h>
++#include <soc/bcm2835/raspberrypi-firmware.h>
++#include <linux/dma-mapping.h>
++
++#define RPI_FW_UART_RX_FIFO_RD	0xb0
++#define RPI_FW_UART_RX_FIFO_WR	0xb4
++#define RPI_FW_UART_TX_FIFO_RD	0xb8
++#define RPI_FW_UART_TX_FIFO_WR	0xbc
++
++#define RPI_FW_UART_FIFO_SIZE		32
++#define RPI_FW_UART_FIFO_SIZE_MASK	(RPI_FW_UART_FIFO_SIZE - 1)
++
++#define RPI_FW_UART_MIN_VERSION	3
++
++struct rpi_fw_uart_params {
++	u32 start;
++	u32 baud;
++	u32 data_bits;
++	u32 stop_bits;
++	u32 gpio_rx;
++	u32 gpio_tx;
++	u32 flags;
++	u32 fifosize;
++	u32 rx_buffer;
++	u32 tx_buffer;
++	u32 version;
++	u32 fifo_reg_base;
++};
++
++struct rpi_fw_uart {
++	struct uart_driver	driver;
++	struct uart_port	port;
++	struct rpi_firmware	*firmware;
++	struct gpio_desc	*rx_gpiod;
++	struct gpio_desc	*tx_gpiod;
++	unsigned int		rx_gpio;
++	unsigned int		tx_gpio;
++	unsigned int		baud;
++	unsigned int		data_bits;
++	unsigned int		stop_bits;
++	unsigned char __iomem	*base;
++	size_t			dma_buffer_size;
++
++	struct hrtimer		trigger_start_rx;
++	ktime_t			rx_poll_delay;
++	void			*rx_buffer;
++	dma_addr_t		rx_buffer_dma_addr;
++	int			rx_stop;
++
++	void			*tx_buffer;
++	dma_addr_t		tx_buffer_dma_addr;
++};
++
++static unsigned int rpi_fw_uart_tx_is_full(struct uart_port *port)
++{
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++	u32 rd, wr;
++
++	rd = readl(rfu->base + RPI_FW_UART_TX_FIFO_RD);
++	wr = readl(rfu->base + RPI_FW_UART_TX_FIFO_WR);
++	return ((wr + 1) & RPI_FW_UART_FIFO_SIZE_MASK) == rd;
++}
++
++static unsigned int rpi_fw_uart_tx_is_empty(struct uart_port *port)
++{
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++	u32 rd, wr;
++
++	if (!rfu->tx_buffer)
++		return 1;
++
++	rd = readl(rfu->base + RPI_FW_UART_TX_FIFO_RD);
++	wr = readl(rfu->base + RPI_FW_UART_TX_FIFO_WR);
++
++	return rd == wr;
++}
++
++unsigned int rpi_fw_uart_rx_is_empty(struct uart_port *port)
++{
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++	u32 rd, wr;
++
++	if (!rfu->rx_buffer)
++		return 1;
++
++	rd = readl(rfu->base + RPI_FW_UART_RX_FIFO_RD);
++	wr = readl(rfu->base + RPI_FW_UART_RX_FIFO_WR);
++
++	return rd == wr;
++}
++
++static unsigned int rpi_fw_uart_tx_empty(struct uart_port *port)
++{
++	return rpi_fw_uart_tx_is_empty(port) ? TIOCSER_TEMT : 0;
++}
++
++static void rpi_fw_uart_set_mctrl(struct uart_port *port, unsigned int mctrl)
++{
++	/*
++	 * No hardware flow control, firmware automatically configures
++	 * TX to output high and RX to input low.
++	 */
++	dev_dbg(port->dev, "%s mctrl %u\n", __func__, mctrl);
++}
++
++static unsigned int rpi_fw_uart_get_mctrl(struct uart_port *port)
++{
++	/* No hardware flow control */
++	return TIOCM_CTS;
++}
++
++static void rpi_fw_uart_stop(struct uart_port *port)
++{
++	struct rpi_fw_uart_params msg = {.start = 0};
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++
++	hrtimer_cancel(&rfu->trigger_start_rx);
++
++	if (rpi_firmware_property(rfu->firmware,
++				RPI_FIRMWARE_SET_SW_UART,
++				&msg, sizeof(msg)))
++		dev_warn(port->dev,
++			 "Failed to shutdown rpi-fw uart. Firmware not configured?");
++}
++
++static void rpi_fw_uart_stop_tx(struct uart_port *port)
++{
++	/* No supported by the current firmware APIs. */
++}
++
++static void rpi_fw_uart_stop_rx(struct uart_port *port)
++{
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++
++	rfu->rx_stop = 1;
++}
++
++static unsigned int rpi_fw_write(struct uart_port *port, const char *s,
++				unsigned int count)
++{
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++	u8 *out = rfu->tx_buffer;
++	unsigned int consumed = 0;
++
++	while (consumed < count && !rpi_fw_uart_tx_is_full(port)) {
++		u32 wp = readl(rfu->base + RPI_FW_UART_TX_FIFO_WR)
++			& RPI_FW_UART_FIFO_SIZE_MASK;
++		out[wp] = s[consumed++];
++		wp = (wp + 1) & RPI_FW_UART_FIFO_SIZE_MASK;
++		writel(wp, rfu->base + RPI_FW_UART_TX_FIFO_WR);
++	}
++	return consumed;
++}
++
++/* Called with port.lock taken */
++static void rpi_fw_uart_start_tx(struct uart_port *port)
++{
++	struct circ_buf *xmit;
++
++	xmit = &port->state->xmit;
++	for (;;) {
++		unsigned int consumed;
++		unsigned long count = CIRC_CNT_TO_END(xmit->head, xmit->tail,
++				UART_XMIT_SIZE);
++		if (!count)
++			break;
++
++		consumed = rpi_fw_write(port, &xmit->buf[xmit->tail], count);
++		uart_xmit_advance(port, consumed);
++	}
++	uart_write_wakeup(port);
++}
++
++/* Called with port.lock taken */
++static void rpi_fw_uart_start_rx(struct uart_port *port)
++{
++	struct tty_port *tty_port = &port->state->port;
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++	int count = 0;
++
++	/*
++	 * RX is polled, read up to a full buffer of data before trying again
++	 * so that this can be interrupted if the firmware is filling the
++	 * buffer too fast
++	 */
++	while (!rpi_fw_uart_rx_is_empty(port) && count < port->fifosize) {
++		const u8 *in = rfu->rx_buffer;
++		u32 rp = readl(rfu->base + RPI_FW_UART_RX_FIFO_RD)
++			& RPI_FW_UART_FIFO_SIZE_MASK;
++
++		tty_insert_flip_char(tty_port, in[rp], TTY_NORMAL);
++		rp = (rp + 1) & RPI_FW_UART_FIFO_SIZE_MASK;
++		writel(rp, rfu->base + RPI_FW_UART_RX_FIFO_RD);
++		count++;
++	}
++	if (count)
++		tty_flip_buffer_push(tty_port);
++}
++
++static enum hrtimer_restart rpi_fw_uart_trigger_rx(struct hrtimer *t)
++{
++	unsigned long flags;
++	struct rpi_fw_uart *rfu = container_of(t, struct rpi_fw_uart,
++					      trigger_start_rx);
++
++	spin_lock_irqsave(&rfu->port.lock, flags);
++	if (rfu->rx_stop) {
++		spin_unlock_irqrestore(&rfu->port.lock, flags);
++		return HRTIMER_NORESTART;
++	}
++
++	rpi_fw_uart_start_rx(&rfu->port);
++	spin_unlock_irqrestore(&rfu->port.lock, flags);
++	hrtimer_forward_now(t, rfu->rx_poll_delay);
++	return HRTIMER_RESTART;
++}
++
++static void rpi_fw_uart_break_ctl(struct uart_port *port, int ctl)
++{
++	dev_dbg(port->dev, "%s ctl %d\n", __func__, ctl);
++}
++
++static int rpi_fw_uart_configure(struct uart_port *port)
++{
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++	struct rpi_fw_uart_params msg;
++	unsigned long flags;
++	int rc;
++
++	rpi_fw_uart_stop(port);
++
++	memset(&msg, 0, sizeof(msg));
++	msg.start = 1;
++	msg.gpio_rx = rfu->rx_gpio;
++	msg.gpio_tx = rfu->tx_gpio;
++	msg.data_bits = rfu->data_bits;
++	msg.stop_bits = rfu->stop_bits;
++	msg.baud = rfu->baud;
++	msg.fifosize = RPI_FW_UART_FIFO_SIZE;
++	msg.rx_buffer = (u32) rfu->rx_buffer_dma_addr;
++	msg.tx_buffer = (u32) rfu->tx_buffer_dma_addr;
++
++	rfu->rx_poll_delay = ms_to_ktime(50);
++
++	/*
++	 * Reconfigures the firmware UART with the new settings. On the first
++	 * call retrieve the addresses of the FIFO buffers. The buffers are
++	 * allocated at startup and are not de-allocated.
++	 * NB rpi_firmware_property can block
++	 */
++	rc = rpi_firmware_property(rfu->firmware,
++				RPI_FIRMWARE_SET_SW_UART,
++				&msg, sizeof(msg));
++	if (rc)
++		goto fail;
++
++	rc = rpi_firmware_property(rfu->firmware,
++			RPI_FIRMWARE_GET_SW_UART,
++			&msg, sizeof(msg));
++	if (rc)
++		goto fail;
++
++	dev_dbg(port->dev, "version %08x, reg addr %x\n", msg.version,
++		msg.fifo_reg_base);
++
++	dev_info(port->dev, "started %d baud %u data %u stop %u rx %u tx %u flags %u fifosize %u\n",
++			msg.start, msg.baud, msg.data_bits, msg.stop_bits,
++			msg.gpio_rx, msg.gpio_tx, msg.flags, msg.fifosize);
++
++	if (msg.fifosize != port->fifosize) {
++		dev_err(port->dev, "Expected fifo size %u actual %u",
++				port->fifosize, msg.fifosize);
++		rc = -EINVAL;
++		goto fail;
++	}
++
++	if (!msg.start) {
++		dev_err(port->dev, "Firmware service not running\n");
++		rc = -EINVAL;
++	}
++
++	spin_lock_irqsave(&rfu->port.lock, flags);
++	rfu->rx_stop = 0;
++	hrtimer_start(&rfu->trigger_start_rx,
++		      rfu->rx_poll_delay, HRTIMER_MODE_REL);
++	spin_unlock_irqrestore(&rfu->port.lock, flags);
++	return 0;
++fail:
++	dev_err(port->dev, "Failed to configure rpi-fw uart. Firmware not configured?");
++	return rc;
++}
++
++static void rpi_fw_uart_free_buffers(struct uart_port *port)
++{
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++
++	if (rfu->rx_buffer)
++		dma_free_coherent(port->dev, rfu->dma_buffer_size,
++				rfu->rx_buffer, GFP_ATOMIC);
++
++	if (rfu->tx_buffer)
++		dma_free_coherent(port->dev, rfu->dma_buffer_size,
++				rfu->tx_buffer, GFP_ATOMIC);
++
++	rfu->rx_buffer = NULL;
++	rfu->tx_buffer = NULL;
++	rfu->rx_buffer_dma_addr = 0;
++	rfu->tx_buffer_dma_addr = 0;
++}
++
++static int rpi_fw_uart_alloc_buffers(struct uart_port *port)
++{
++	struct rpi_fw_uart *rfu = container_of(port, struct rpi_fw_uart, port);
++
++	if (rfu->tx_buffer)
++		return 0;
++
++	rfu->dma_buffer_size = PAGE_ALIGN(RPI_FW_UART_FIFO_SIZE);
++
++	rfu->rx_buffer = dma_alloc_coherent(port->dev, rfu->dma_buffer_size,
++		&rfu->rx_buffer_dma_addr, GFP_ATOMIC);
++
++	if (!rfu->rx_buffer)
++		goto alloc_fail;
++
++	rfu->tx_buffer = dma_alloc_coherent(port->dev, rfu->dma_buffer_size,
++		&rfu->tx_buffer_dma_addr, GFP_ATOMIC);
++
++	if (!rfu->tx_buffer)
++		goto alloc_fail;
++
++	dev_dbg(port->dev, "alloc-buffers %p %x %p %x\n",
++		rfu->rx_buffer, (u32) rfu->rx_buffer_dma_addr,
++		rfu->tx_buffer, (u32) rfu->tx_buffer_dma_addr);
++	return 0;
++
++alloc_fail:
++	dev_err(port->dev, "%s uart buffer allocation failed\n", __func__);
++	rpi_fw_uart_free_buffers(port);
++	return -ENOMEM;
++}
++
++static int rpi_fw_uart_startup(struct uart_port *port)
++{
++	int rc;
++
++	rc = rpi_fw_uart_alloc_buffers(port);
++	if (rc)
++		dev_err(port->dev, "Failed to start\n");
++	return rc;
++}
++
++static void rpi_fw_uart_shutdown(struct uart_port *port)
++{
++	rpi_fw_uart_stop(port);
++	rpi_fw_uart_free_buffers(port);
++}
++
++static void rpi_fw_uart_set_termios(struct uart_port *port,
++				       struct ktermios *new,
++				       const struct ktermios *old)
++{
++	struct rpi_fw_uart *rfu =
++		container_of(port, struct rpi_fw_uart, port);
++	rfu->baud = uart_get_baud_rate(port, new, old, 50, 115200);
++	rfu->stop_bits = (new->c_cflag & CSTOPB) ? 2 : 1;
++
++	rpi_fw_uart_configure(port);
++}
++
++static const struct uart_ops rpi_fw_uart_ops = {
++	.tx_empty = rpi_fw_uart_tx_empty,
++	.set_mctrl = rpi_fw_uart_set_mctrl,
++	.get_mctrl = rpi_fw_uart_get_mctrl,
++	.stop_rx = rpi_fw_uart_stop_rx,
++	.stop_tx = rpi_fw_uart_stop_tx,
++	.start_tx = rpi_fw_uart_start_tx,
++	.break_ctl = rpi_fw_uart_break_ctl,
++	.startup = rpi_fw_uart_startup,
++	.shutdown = rpi_fw_uart_shutdown,
++	.set_termios = rpi_fw_uart_set_termios,
++};
++
++static int rpi_fw_uart_get_gpio_offset(struct device *dev, const char *name)
++{
++	struct of_phandle_args of_args = { 0 };
++	bool is_bcm28xx;
++
++	/* This really shouldn't fail, given that we have a gpiod */
++	if (of_parse_phandle_with_args(dev->of_node, name, "#gpio-cells", 0, &of_args))
++		return dev_err_probe(dev, -EINVAL, "can't find gpio declaration\n");
++
++	is_bcm28xx = of_device_is_compatible(of_args.np, "brcm,bcm2835-gpio") ||
++		     of_device_is_compatible(of_args.np, "brcm,bcm2711-gpio");
++	of_node_put(of_args.np);
++	if (!is_bcm28xx || of_args.args_count != 2)
++		return dev_err_probe(dev, -EINVAL, "not a BCM28xx gpio\n");
++
++	return of_args.args[0];
++}
++
++static int rpi_fw_uart_probe(struct platform_device *pdev)
++{
++	struct device_node *firmware_node;
++	struct device *dev = &pdev->dev;
++	struct rpi_firmware *firmware;
++	struct uart_port *port;
++	struct rpi_fw_uart *rfu;
++	struct rpi_fw_uart_params msg;
++	int version_major;
++	int err;
++
++	dev_dbg(dev, "%s of_node %p\n", __func__, dev->of_node);
++
++	/*
++	 * We can be probed either through the an old-fashioned
++	 * platform device registration or through a DT node that is a
++	 * child of the firmware node. Handle both cases.
++	 */
++	if (dev->of_node)
++		firmware_node = of_parse_phandle(dev->of_node, "firmware", 0);
++	else
++		firmware_node = of_find_compatible_node(NULL, NULL,
++				"raspberrypi,bcm2835-firmware");
++	if (!firmware_node) {
++		dev_err(dev, "Missing firmware node\n");
++		return -ENOENT;
++	}
++
++	firmware = devm_rpi_firmware_get(dev, firmware_node);
++	of_node_put(firmware_node);
++	if (!firmware)
++		return -EPROBE_DEFER;
++
++	rfu = devm_kzalloc(dev, sizeof(*rfu), GFP_KERNEL);
++	if (!rfu)
++		return -ENOMEM;
++
++	rfu->firmware = firmware;
++
++	err = rpi_firmware_property(rfu->firmware, RPI_FIRMWARE_GET_SW_UART,
++			&msg, sizeof(msg));
++	if (err) {
++		dev_err(dev, "VC firmware does not support rpi-fw-uart\n");
++		return err;
++	}
++
++	version_major = msg.version >> 16;
++	if (msg.version < RPI_FW_UART_MIN_VERSION) {
++		dev_err(dev, "rpi-fw-uart fw version %d is too old min version %d\n",
++				version_major, RPI_FW_UART_MIN_VERSION);
++		return -EINVAL;
++	}
++
++	rfu->rx_gpiod = devm_gpiod_get(dev, "rx", GPIOD_IN);
++	if (IS_ERR(rfu->rx_gpiod))
++		return PTR_ERR(rfu->rx_gpiod);
++
++	rfu->tx_gpiod = devm_gpiod_get(dev, "tx", GPIOD_OUT_HIGH);
++	if (IS_ERR(rfu->tx_gpiod))
++		return PTR_ERR(rfu->tx_gpiod);
++
++	rfu->rx_gpio = rpi_fw_uart_get_gpio_offset(dev, "rx-gpios");
++	if (rfu->rx_gpio < 0)
++		return rfu->rx_gpio;
++	rfu->tx_gpio = rpi_fw_uart_get_gpio_offset(dev, "tx-gpios");
++	if (rfu->tx_gpio < 0)
++		return rfu->tx_gpio;
++
++	rfu->base = devm_platform_ioremap_resource(pdev, 0);
++	if (IS_ERR(rfu->base))
++		return PTR_ERR(rfu->base);
++
++	/* setup the driver */
++	rfu->driver.owner = THIS_MODULE;
++	rfu->driver.driver_name = "ttyRFU";
++	rfu->driver.dev_name = "ttyRFU";
++	rfu->driver.nr = 1;
++	rfu->data_bits = 8;
++
++	/* RX is polled */
++	hrtimer_init(&rfu->trigger_start_rx, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
++	rfu->trigger_start_rx.function = rpi_fw_uart_trigger_rx;
++
++	err = uart_register_driver(&rfu->driver);
++	if (err) {
++		dev_err(dev, "failed to register UART driver: %d\n",
++			err);
++		return err;
++	}
++
++	/* setup the port */
++	port = &rfu->port;
++	spin_lock_init(&port->lock);
++	port->dev = &pdev->dev;
++	port->type = PORT_RPI_FW;
++	port->ops = &rpi_fw_uart_ops;
++	port->fifosize = RPI_FW_UART_FIFO_SIZE;
++	port->iotype = UPIO_MEM;
++	port->flags = UPF_BOOT_AUTOCONF;
++	port->private_data = rfu;
++
++	err = uart_add_one_port(&rfu->driver, port);
++	if (err) {
++		dev_err(dev, "failed to add UART port: %d\n", err);
++		goto unregister_uart;
++	}
++	platform_set_drvdata(pdev, rfu);
++
++	dev_info(dev, "version %d.%d gpios tx %u rx %u\n",
++			msg.version >> 16, msg.version & 0xffff,
++			rfu->tx_gpio, rfu->rx_gpio);
++	return 0;
++
++unregister_uart:
++	uart_unregister_driver(&rfu->driver);
++
++	return err;
++}
++
++static int rpi_fw_uart_remove(struct platform_device *pdev)
++{
++	struct rpi_fw_uart *rfu = platform_get_drvdata(pdev);
++
++	uart_remove_one_port(&rfu->driver, &rfu->port);
++	uart_unregister_driver(&rfu->driver);
++
++	return 0;
++}
++
++static const struct of_device_id rpi_fw_match[] = {
++	{ .compatible = "raspberrypi,firmware-uart" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, rpi_fw_match);
++
++static struct platform_driver rpi_fw_driver = {
++	.driver = {
++		.name = "rpi_fw-uart",
++		.of_match_table = rpi_fw_match,
++	},
++	.probe = rpi_fw_uart_probe,
++	.remove = rpi_fw_uart_remove,
++};
++module_platform_driver(rpi_fw_driver);
++
++MODULE_AUTHOR("Tim Gover <tim.gover@rasberrypi.com>");
++MODULE_LICENSE("GPL");
++MODULE_DESCRIPTION("Raspberry Pi Firmware Software UART driver");
diff --git a/target/linux/bcm27xx/patches-6.6/950-1435-dtoverlay-Add-an-overlay-for-the-Raspberry-Pi-firmwa.patch b/target/linux/bcm27xx/patches-6.6/950-1435-dtoverlay-Add-an-overlay-for-the-Raspberry-Pi-firmwa.patch
new file mode 100644
index 00000000000000..0e4b3e37475211
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1435-dtoverlay-Add-an-overlay-for-the-Raspberry-Pi-firmwa.patch
@@ -0,0 +1,95 @@
+From b6b126861062020fb50859c5af71d8846ce43d7c Mon Sep 17 00:00:00 2001
+From: Tim Gover <tim.gover@raspberrypi.com>
+Date: Mon, 4 Nov 2024 13:44:10 +0000
+Subject: [PATCH] dtoverlay: Add an overlay for the Raspberry Pi firmware UART
+
+Add a device-tree overlay to configure the GPIOs for the
+Raspberry Pi firmware UART.
+
+Example config.txt
+dtoverlay=rpi-fw-uart,txd0_pin=20,rxd0_pin=21
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+Signed-off-by: Tim Gover <tim.gover@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/Makefile           |  1 +
+ arch/arm/boot/dts/overlays/README             | 12 ++++++
+ .../boot/dts/overlays/rpi-fw-uart-overlay.dts | 41 +++++++++++++++++++
+ 3 files changed, 54 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/rpi-fw-uart-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -233,6 +233,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	rpi-dacpro.dtbo \
+ 	rpi-digiampplus.dtbo \
+ 	rpi-ft5406.dtbo \
++	rpi-fw-uart.dtbo \
+ 	rpi-poe.dtbo \
+ 	rpi-poe-plus.dtbo \
+ 	rpi-sense.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -4141,6 +4141,18 @@ Params: touchscreen-size-x      Touchscr
+         touchscreen-swapped-x-y Swap X and Y cordinates (default 0);
+ 
+ 
++Name:   rpi-fw-uart
++Info:   Configures the firmware software UART driver.
++        This driver requires exclusive usage of the second VPU core. The
++        following config.txt entries should be set when this driver is used.
++        dtparam=audio=off
++        isp_use_vpu0=1
++Load:   dtoverlay=rpi-fw-uart,<param>[=<val>]
++Params: txd0_pin                GPIO pin for TXD0 (any free - default 20)
++
++        rxd0_pin                GPIO pin for RXD0 (any free - default 21)
++
++
+ Name:   rpi-poe
+ Info:   Raspberry Pi PoE HAT fan
+ Load:   dtoverlay=rpi-poe,<param>[=<val>]
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rpi-fw-uart-overlay.dts
+@@ -0,0 +1,41 @@
++// SPDX-License-Identifier: GPL-2.0
++// Overlay for the Raspberry Pi Firmware UART driver
++/dts-v1/;
++/plugin/;
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			rpi_fw_uart_pins: rpi_fw_uart_pins@4 {
++				brcm,pins = <20 21>;
++				brcm,function = <1 0>; /* output input */
++				brcm,pull = <0 2>; /* none pull-up */
++			};
++		};
++	};
++
++	fragment@1 {
++		target = <&soc>;
++		__overlay__ {
++			rpi_fw_uart: rpi_fw_uart@7e000000 {
++			compatible = "raspberrypi,firmware-uart";
++			reg = <0x7e000000 0x100>; /* VideoCore MS sync regs */
++			firmware = <&firmware>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&rpi_fw_uart_pins>;
++			tx-gpios = <&gpio 20 0>;
++			rx-gpios = <&gpio 21 0>;
++			};
++		};
++	};
++
++	__overrides__ {
++		txd0_pin = <&rpi_fw_uart>,"tx-gpios:4",
++			 <&rpi_fw_uart_pins>, "brcm,pins:0";
++		rxd0_pin = <&rpi_fw_uart>,"rx-gpios:4",
++			 <&rpi_fw_uart_pins>, "brcm,pins:4";
++	};
++};
diff --git a/target/linux/bcm27xx/patches-6.6/950-1436-ARM-dts-Remove-duplicate-tags.patch b/target/linux/bcm27xx/patches-6.6/950-1436-ARM-dts-Remove-duplicate-tags.patch
new file mode 100644
index 00000000000000..7829a4b753dbe4
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1436-ARM-dts-Remove-duplicate-tags.patch
@@ -0,0 +1,142 @@
+From 1993b453dc4a62378e90d91e9e0006a6c085f38a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 18 Sep 2024 10:23:41 +0100
+Subject: [PATCH] ARM: dts: Remove duplicate tags
+
+A dts file should have exactly one /dts-v1/ tag, and overlays should
+also have one /plugin/ tag. Through careless inclusion of other files,
+some Device Trees and overlays end up with duplicated tags - this
+commit removes them.
+
+The change is largely cosmetic, unless using an old version of dtc.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts            | 1 -
+ arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi         | 3 ---
+ arch/arm/boot/dts/overlays/imx290_327-overlay.dtsi        | 2 --
+ arch/arm/boot/dts/overlays/pisound-pi5-overlay.dts        | 3 ---
+ arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts       | 3 ---
+ arch/arm/boot/dts/overlays/vc4-fkms-v3d-pi4-overlay.dts   | 3 ---
+ arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts        | 3 ---
+ arch/arm/boot/dts/overlays/vc4-kms-v3d-pi4-overlay.dts    | 3 ---
+ arch/arm/boot/dts/overlays/w1-gpio-pi5-overlay.dts        | 3 ---
+ arch/arm/boot/dts/overlays/w1-gpio-pullup-pi5-overlay.dts | 3 ---
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5l.dtsi        | 1 -
+ 11 files changed, 28 deletions(-)
+
+--- a/arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts
++++ b/arch/arm/boot/dts/broadcom/bcm2711-rpi-400.dts
+@@ -1,5 +1,4 @@
+ // SPDX-License-Identifier: GPL-2.0
+-/dts-v1/;
+ #include "bcm2711-rpi-4-b.dts"
+ 
+ / {
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+@@ -1,7 +1,4 @@
+ // Definitions for I2C based sensors using the Industrial IO or HWMON interface.
+-/dts-v1/;
+-/plugin/;
+-
+ #include <dt-bindings/gpio/gpio.h>
+ 
+ / {
+--- a/arch/arm/boot/dts/overlays/imx290_327-overlay.dtsi
++++ b/arch/arm/boot/dts/overlays/imx290_327-overlay.dtsi
+@@ -1,8 +1,6 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ // Partial definitions for IMX290 or IMX327 camera module on VC I2C bus
+ // The compatible string should be set in an overlay that then includes this one
+-/dts-v1/;
+-/plugin/;
+ 
+ #include <dt-bindings/gpio/gpio.h>
+ 
+--- a/arch/arm/boot/dts/overlays/pisound-pi5-overlay.dts
++++ b/arch/arm/boot/dts/overlays/pisound-pi5-overlay.dts
+@@ -17,9 +17,6 @@
+  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+  */
+ 
+-/dts-v1/;
+-/plugin/;
+-
+ #include "pisound-overlay.dts"
+ 
+ &pisound_spi {
+--- a/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-overlay.dts
+@@ -2,9 +2,6 @@
+  * vc4-fkms-v3d-overlay.dts
+  */
+ 
+-/dts-v1/;
+-/plugin/;
+-
+ #include "cma-overlay.dts"
+ 
+ / {
+--- a/arch/arm/boot/dts/overlays/vc4-fkms-v3d-pi4-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-fkms-v3d-pi4-overlay.dts
+@@ -2,9 +2,6 @@
+  * vc4-fkms-v3d-overlay.dts
+  */
+ 
+-/dts-v1/;
+-/plugin/;
+-
+ #include "cma-overlay.dts"
+ 
+ &frag0 {
+--- a/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-kms-v3d-overlay.dts
+@@ -2,9 +2,6 @@
+  * vc4-kms-v3d-overlay.dts
+  */
+ 
+-/dts-v1/;
+-/plugin/;
+-
+ #include <dt-bindings/clock/bcm2835.h>
+ 
+ #include "cma-overlay.dts"
+--- a/arch/arm/boot/dts/overlays/vc4-kms-v3d-pi4-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-kms-v3d-pi4-overlay.dts
+@@ -2,9 +2,6 @@
+  * vc4-kms-v3d-pi4-overlay.dts
+  */
+ 
+-/dts-v1/;
+-/plugin/;
+-
+ #include <dt-bindings/clock/bcm2835.h>
+ 
+ #include "cma-overlay.dts"
+--- a/arch/arm/boot/dts/overlays/w1-gpio-pi5-overlay.dts
++++ b/arch/arm/boot/dts/overlays/w1-gpio-pi5-overlay.dts
+@@ -1,6 +1,3 @@
+-/dts-v1/;
+-/plugin/;
+-
+ #include "w1-gpio-overlay.dts"
+ 
+ / {
+--- a/arch/arm/boot/dts/overlays/w1-gpio-pullup-pi5-overlay.dts
++++ b/arch/arm/boot/dts/overlays/w1-gpio-pullup-pi5-overlay.dts
+@@ -1,6 +1,3 @@
+-/dts-v1/;
+-/plugin/;
+-
+ #include "w1-gpio-pullup-overlay.dts"
+ 
+ / {
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5l.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5l.dtsi
+@@ -1,5 +1,4 @@
+ // SPDX-License-Identifier: GPL-2.0
+-/dts-v1/;
+ 
+ #include "bcm2712-rpi-cm5.dtsi"
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1437-Allow-setting-I-C-clock-frequency-via-i2c_arm_baudra.patch b/target/linux/bcm27xx/patches-6.6/950-1437-Allow-setting-I-C-clock-frequency-via-i2c_arm_baudra.patch
new file mode 100644
index 00000000000000..1d14a0bfec6bfb
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1437-Allow-setting-I-C-clock-frequency-via-i2c_arm_baudra.patch
@@ -0,0 +1,25 @@
+From e33702e5e5fe9fef6ec967961e2e5e1c2285ba36 Mon Sep 17 00:00:00 2001
+From: gtrainavicius <gtrainavicius@users.noreply.github.com>
+Date: Wed, 4 Dec 2024 11:18:14 +0200
+Subject: [PATCH] =?UTF-8?q?Allow=20setting=20I=C2=B2C=20clock=20frequency?=
+ =?UTF-8?q?=20via=20i2c=5Farm=5Fbaudrate=20dtparam=20when=20using=20pimidi?=
+ =?UTF-8?q?=20overlay.?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This change removes the forced 1MHz clock frequency, so it can be overridden using `i2c_arm_baudrate`.
+---
+ arch/arm/boot/dts/overlays/pimidi-overlay.dts | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/arm/boot/dts/overlays/pimidi-overlay.dts
++++ b/arch/arm/boot/dts/overlays/pimidi-overlay.dts
+@@ -26,7 +26,6 @@
+ 		target = <&i2c_arm>;
+ 		__overlay__ {
+ 			status = "okay";
+-			clock-frequency=<1000000>;
+ 
+ 			pimidi_ctrl: pimidi_ctrl@20 {
+ 				compatible = "blokaslabs,pimidi";
diff --git a/target/linux/bcm27xx/patches-6.6/950-1438-nvme-pci-Disable-Host-Memory-Buffer-usage.patch b/target/linux/bcm27xx/patches-6.6/950-1438-nvme-pci-Disable-Host-Memory-Buffer-usage.patch
new file mode 100644
index 00000000000000..6662fb4de18abd
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1438-nvme-pci-Disable-Host-Memory-Buffer-usage.patch
@@ -0,0 +1,48 @@
+From fda47c026dee7acd975ee2c0f7a440d4038cfaa3 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 3 Dec 2024 15:57:01 +0000
+Subject: [PATCH] nvme-pci: Disable Host Memory Buffer usage
+
+Some NVME drives seem to request significant amounts of DMA coherent
+memory - enough to exhaust our standard 64MB CMA allocation.
+
+Try disabling the feature to see what effect it has - drives should
+continue to function without it.
+
+Link: https://github.com/raspberrypi/linux/issues/6504
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/nvme/host/pci.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -1970,6 +1970,7 @@ static void nvme_free_host_mem(struct nv
+ 	dev->nr_host_mem_descs = 0;
+ }
+ 
++#if 0
+ static int __nvme_alloc_host_mem(struct nvme_dev *dev, u64 preferred,
+ 		u32 chunk_size)
+ {
+@@ -2038,9 +2039,11 @@ out:
+ 	dev->host_mem_descs = NULL;
+ 	return -ENOMEM;
+ }
++#endif
+ 
+ static int nvme_alloc_host_mem(struct nvme_dev *dev, u64 min, u64 preferred)
+ {
++#if 0
+ 	u64 min_chunk = min_t(u64, preferred, PAGE_SIZE * MAX_ORDER_NR_PAGES);
+ 	u64 hmminds = max_t(u32, dev->ctrl.hmminds * 4096, PAGE_SIZE * 2);
+ 	u64 chunk_size;
+@@ -2053,6 +2056,7 @@ static int nvme_alloc_host_mem(struct nv
+ 			nvme_free_host_mem(dev);
+ 		}
+ 	}
++#endif
+ 
+ 	return -ENOMEM;
+ }
diff --git a/target/linux/bcm27xx/patches-6.6/950-1439-fixup-serial-tty-Add-a-driver-for-the-RPi-firmware-U.patch b/target/linux/bcm27xx/patches-6.6/950-1439-fixup-serial-tty-Add-a-driver-for-the-RPi-firmware-U.patch
new file mode 100644
index 00000000000000..0f18dc4a8d9815
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1439-fixup-serial-tty-Add-a-driver-for-the-RPi-firmware-U.patch
@@ -0,0 +1,23 @@
+From 0313a0961b685973f7833017479a277e3a4c05a4 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 4 Dec 2024 14:40:59 +0000
+Subject: [PATCH] fixup! serial: tty: Add a driver for the RPi firmware UART
+
+Make SERIAL_RPI_FW depend on RASPBERRYPI_FIRMWARE.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/tty/serial/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/Kconfig
++++ b/drivers/tty/serial/Kconfig
+@@ -1580,7 +1580,7 @@ config SERIAL_NUVOTON_MA35D1_CONSOLE
+ 
+ config SERIAL_RPI_FW
+ 	tristate "Raspberry Pi Firmware software UART support"
+-	depends on ARM_AMBA || COMPILE_TEST
++	depends on RASPBERRYPI_FIRMWARE || COMPILE_TEST
+ 	select SERIAL_CORE
+ 	help
+ 	  This selects the Raspberry Pi firmware UART. This is a bit-bashed
diff --git a/target/linux/bcm27xx/patches-6.6/950-1440-serial-rpi-fw-uart-Demote-debug-log-messages.patch b/target/linux/bcm27xx/patches-6.6/950-1440-serial-rpi-fw-uart-Demote-debug-log-messages.patch
new file mode 100644
index 00000000000000..271f743286a4b8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1440-serial-rpi-fw-uart-Demote-debug-log-messages.patch
@@ -0,0 +1,28 @@
+From 0a5be0fe6ba3a981508421131def7eab55d6d75c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 5 Dec 2024 12:08:23 +0000
+Subject: [PATCH] serial: rpi-fw-uart: Demote debug log messages
+
+A dev_info call in rpi_fw_uart_configure causes kernel log output every
+time one opens the UART. Demote it to dev_dbg.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/tty/serial/rpi-fw-uart.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/tty/serial/rpi-fw-uart.c
++++ b/drivers/tty/serial/rpi-fw-uart.c
+@@ -277,9 +277,9 @@ static int rpi_fw_uart_configure(struct
+ 	dev_dbg(port->dev, "version %08x, reg addr %x\n", msg.version,
+ 		msg.fifo_reg_base);
+ 
+-	dev_info(port->dev, "started %d baud %u data %u stop %u rx %u tx %u flags %u fifosize %u\n",
+-			msg.start, msg.baud, msg.data_bits, msg.stop_bits,
+-			msg.gpio_rx, msg.gpio_tx, msg.flags, msg.fifosize);
++	dev_dbg(port->dev, "started %d baud %u data %u stop %u rx %u tx %u flags %u fifosize %u\n",
++		msg.start, msg.baud, msg.data_bits, msg.stop_bits,
++		msg.gpio_rx, msg.gpio_tx, msg.flags, msg.fifosize);
+ 
+ 	if (msg.fifosize != port->fifosize) {
+ 		dev_err(port->dev, "Expected fifo size %u actual %u",
diff --git a/target/linux/bcm27xx/patches-6.6/950-1441-dtoverlays-Add-Arducam-override-for-ov9281.patch b/target/linux/bcm27xx/patches-6.6/950-1441-dtoverlays-Add-Arducam-override-for-ov9281.patch
new file mode 100644
index 00000000000000..354ff961fe098c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1441-dtoverlays-Add-Arducam-override-for-ov9281.patch
@@ -0,0 +1,55 @@
+From 02dee262a9c7295ea514e9db7b9aa4b239922cb3 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 2 Dec 2024 15:41:21 +0000
+Subject: [PATCH] dtoverlays: Add Arducam override for ov9281
+
+The Arducam module is slow starting up, so add an override
+to slow the regulator down.
+https://forums.raspberrypi.com/viewtopic.php?t=380236
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README             |  2 ++
+ arch/arm/boot/dts/overlays/ov9281-overlay.dts | 13 ++++++++++++-
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -3538,6 +3538,8 @@ Params: rotation                Mounting
+                                 configuring the sensor (default on)
+         cam0                    Adopt the default configuration for CAM0 on a
+                                 Compute Module (CSI0, i2c_vc, and cam0_reg).
++        arducam                 Slow down the regulator for slow Arducam
++                                modules.
+ 
+ 
+ Name:   papirus
+--- a/arch/arm/boot/dts/overlays/ov9281-overlay.dts
++++ b/arch/arm/boot/dts/overlays/ov9281-overlay.dts
+@@ -57,6 +57,14 @@
+ 		};
+ 	};
+ 
++	reg_frag: fragment@5 {
++		target = <&cam1_reg>;
++		__dormant__ {
++			startup-delay-us = <20000>;
++			off-on-delay-us = <30000>;
++		};
++	};
++
+ 	__overrides__ {
+ 		rotation = <&cam_node>,"rotation:0";
+ 		orientation = <&cam_node>,"orientation:0";
+@@ -65,7 +73,10 @@
+ 		       <&csi_frag>, "target:0=",<&csi0>,
+ 		       <&clk_frag>, "target:0=",<&cam0_clk>,
+ 		       <&cam_node>, "clocks:0=",<&cam0_clk>,
+-		       <&cam_node>, "avdd-supply:0=",<&cam0_reg>;
++		       <&cam_node>, "avdd-supply:0=",<&cam0_reg>,
++		       <&reg_frag>, "target:0=",<&cam0_reg>;
++		arducam = <0>, "+5";
++
+ 	};
+ };
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1442-drivers-input-touchscreen-Add-support-for-no-irq-to-.patch b/target/linux/bcm27xx/patches-6.6/950-1442-drivers-input-touchscreen-Add-support-for-no-irq-to-.patch
new file mode 100644
index 00000000000000..d13982e9badb36
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1442-drivers-input-touchscreen-Add-support-for-no-irq-to-.patch
@@ -0,0 +1,118 @@
+From 97638920f1a40e2e0cab363d1e03837ff50c5478 Mon Sep 17 00:00:00 2001
+From: eng33 <eng33@waveshare.com>
+Date: Thu, 5 Dec 2024 17:19:23 +0800
+Subject: [PATCH] drivers:input:touchscreen: Add support for no irq to ili210x
+ driver
+
+Signed-off-by: eng33 <eng33@waveshare.com>
+---
+ drivers/input/touchscreen/ili210x.c | 63 ++++++++++++++++++++++++-----
+ 1 file changed, 52 insertions(+), 11 deletions(-)
+
+--- a/drivers/input/touchscreen/ili210x.c
++++ b/drivers/input/touchscreen/ili210x.c
+@@ -67,6 +67,8 @@ struct ili210x {
+ 	u8 version_proto[2];
+ 	u8 ic_mode[2];
+ 	bool stop;
++	struct timer_list poll_timer;
++	struct work_struct poll_work;
+ };
+ 
+ static int ili210x_read_reg(struct i2c_client *client,
+@@ -360,6 +362,34 @@ static irqreturn_t ili210x_irq(int irq,
+ 	return IRQ_HANDLED;
+ }
+ 
++static void ili210x_poll_work(struct work_struct *work)
++{
++	struct ili210x *priv = container_of(work, struct ili210x, poll_work);
++	struct i2c_client *client = priv->client;
++	const struct ili2xxx_chip *chip = priv->chip;
++	u8 touchdata[ILI210X_DATA_SIZE] = { 0 };
++	bool touch;
++	int error;
++
++	error = chip->get_touch_data(client, touchdata);
++	if (error) {
++		dev_err(&client->dev, "Unable to get touch data: %d\n", error);
++		return;
++	}
++
++	touch = ili210x_report_events(priv, touchdata);
++}
++
++static void ili210x_poll_timer_callback(struct timer_list *t)
++{
++	struct ili210x *priv = from_timer(priv, t, poll_timer);
++
++	schedule_work(&priv->poll_work);
++
++	if (!priv->stop)
++		mod_timer(&priv->poll_timer, jiffies + msecs_to_jiffies(ILI2XXX_POLL_PERIOD));
++}
++
+ static int ili251x_firmware_update_resolution(struct device *dev)
+ {
+ 	struct i2c_client *client = to_i2c_client(dev);
+@@ -945,11 +975,6 @@ static int ili210x_i2c_probe(struct i2c_
+ 		return -ENODEV;
+ 	}
+ 
+-	if (client->irq <= 0) {
+-		dev_err(dev, "No IRQ!\n");
+-		return -EINVAL;
+-	}
+-
+ 	reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
+ 	if (IS_ERR(reset_gpio))
+ 		return PTR_ERR(reset_gpio);
+@@ -1001,12 +1026,17 @@ static int ili210x_i2c_probe(struct i2c_
+ 		return error;
+ 	}
+ 
+-	error = devm_request_threaded_irq(dev, client->irq, NULL, ili210x_irq,
+-					  IRQF_ONESHOT, client->name, priv);
+-	if (error) {
+-		dev_err(dev, "Unable to request touchscreen IRQ, err: %d\n",
+-			error);
+-		return error;
++	if (client->irq) {
++		error = devm_request_threaded_irq(dev, client->irq, NULL, ili210x_irq,
++					IRQF_ONESHOT, client->name, priv);
++		if (error) {
++			dev_err(dev, "Unable to request touchscreen IRQ, err: %d\n", error);
++			return error;
++		}
++	} else {
++		timer_setup(&priv->poll_timer, ili210x_poll_timer_callback, 0);
++		mod_timer(&priv->poll_timer, jiffies + msecs_to_jiffies(ILI2XXX_POLL_PERIOD));
++		INIT_WORK(&priv->poll_work, ili210x_poll_work);
+ 	}
+ 
+ 	error = devm_add_action_or_reset(dev, ili210x_stop, priv);
+@@ -1029,6 +1059,16 @@ static int ili210x_i2c_probe(struct i2c_
+ 	return 0;
+ }
+ 
++static void ili210x_i2c_remove(struct i2c_client *client)
++{
++	struct ili210x *tsdata = i2c_get_clientdata(client);
++
++	if (!client->irq) {
++		del_timer(&tsdata->poll_timer);
++		cancel_work_sync(&tsdata->poll_work);
++	}
++}
++
+ static const struct i2c_device_id ili210x_i2c_id[] = {
+ 	{ "ili210x", (long)&ili210x_chip },
+ 	{ "ili2117", (long)&ili211x_chip },
+@@ -1054,6 +1094,7 @@ static struct i2c_driver ili210x_ts_driv
+ 	},
+ 	.id_table = ili210x_i2c_id,
+ 	.probe = ili210x_i2c_probe,
++	.remove   = ili210x_i2c_remove,
+ };
+ 
+ module_i2c_driver(ili210x_ts_driver);
diff --git a/target/linux/bcm27xx/patches-6.6/950-1443-drivers-gpu-drm-panel-Added-waveshare-13.3inch-panel.patch b/target/linux/bcm27xx/patches-6.6/950-1443-drivers-gpu-drm-panel-Added-waveshare-13.3inch-panel.patch
new file mode 100644
index 00000000000000..c6861c6a54c4ca
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1443-drivers-gpu-drm-panel-Added-waveshare-13.3inch-panel.patch
@@ -0,0 +1,309 @@
+From 4a89fda8f73df89e009a6188ef07ab97b1d03c7f Mon Sep 17 00:00:00 2001
+From: eng33 <eng33@waveshare.com>
+Date: Thu, 5 Dec 2024 17:20:22 +0800
+Subject: [PATCH] drivers:gpu:drm:panel: Added waveshare 13.3inch panel(support
+  2/4lane)
+
+Signed-off-by: eng33 <eng33@waveshare.com>
+---
+ drivers/gpu/drm/panel/panel-waveshare-dsi.c | 155 +++++++++++++++++---
+ 1 file changed, 138 insertions(+), 17 deletions(-)
+
+--- a/drivers/gpu/drm/panel/panel-waveshare-dsi.c
++++ b/drivers/gpu/drm/panel/panel-waveshare-dsi.c
+@@ -32,6 +32,12 @@ struct ws_panel {
+ 	enum drm_panel_orientation orientation;
+ };
+ 
++struct ws_panel_data {
++	const struct drm_display_mode *mode;
++	int lanes;
++	unsigned long mode_flags;
++};
++
+ /* 2.8inch 480x640
+  * https://www.waveshare.com/product/raspberry-pi/displays/2.8inch-dsi-lcd.htm
+  */
+@@ -47,6 +53,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 640 + 150 + 50 + 150,
+ };
+ 
++static const struct ws_panel_data ws_panel_2_8_data = {
++	.mode = &ws_panel_2_8_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ /* 3.4inch 800x800 Round
+  * https://www.waveshare.com/product/displays/lcd-oled/3.4inch-dsi-lcd-c.htm
+  */
+@@ -62,6 +74,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 800 + 8 + 4 + 16,
+ };
+ 
++static const struct ws_panel_data ws_panel_3_4_data = {
++	.mode = &ws_panel_3_4_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ /* 4.0inch 480x800
+  * https://www.waveshare.com/product/raspberry-pi/displays/4inch-dsi-lcd.htm
+  */
+@@ -77,6 +95,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 800 + 20 + 100 + 20,
+ };
+ 
++static const struct ws_panel_data ws_panel_4_0_data = {
++	.mode = &ws_panel_4_0_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ /* 7.0inch C 1024x600
+  * https://www.waveshare.com/product/raspberry-pi/displays/lcd-oled/7inch-dsi-lcd-c-with-case-a.htm
+  */
+@@ -92,6 +116,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 600 + 10 + 10 + 10,
+ };
+ 
++static const struct ws_panel_data ws_panel_7_0_c_data = {
++	.mode = &ws_panel_7_0_c_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ /* 7.9inch 400x1280
+  * https://www.waveshare.com/product/raspberry-pi/displays/7.9inch-dsi-lcd.htm
+  */
+@@ -107,6 +137,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 1280 + 20 + 10 + 20,
+ };
+ 
++static const struct ws_panel_data ws_panel_7_9_data = {
++	.mode = &ws_panel_7_9_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ /* 8.0inch or 10.1inch 1280x800
+  * https://www.waveshare.com/product/raspberry-pi/displays/8inch-dsi-lcd-c.htm
+  * https://www.waveshare.com/product/raspberry-pi/displays/10.1inch-dsi-lcd-c.htm
+@@ -123,6 +159,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 800 + 40 + 48 + 40,
+ };
+ 
++static const struct ws_panel_data ws_panel_10_1_data = {
++	.mode = &ws_panel_10_1_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ /* 11.9inch 320x1480
+  * https://www.waveshare.com/product/raspberry-pi/displays/11.9inch-dsi-lcd.htm
+  */
+@@ -138,6 +180,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 1480 + 60 + 60 + 60,
+ };
+ 
++static const struct ws_panel_data ws_panel_11_9_data = {
++	.mode = &ws_panel_11_9_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ static const struct drm_display_mode ws_panel_4_mode = {
+ 	.clock = 50000,
+ 	.hdisplay = 720,
+@@ -150,6 +198,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 720 + 8 + 4 + 16,
+ };
+ 
++static const struct ws_panel_data ws_panel_4_data = {
++	.mode = &ws_panel_4_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ /* 5.0inch 720x1280
+  * https://www.waveshare.com/5inch-dsi-lcd-d.htm
+  */
+@@ -165,6 +219,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 1280 + 20 + 20 + 20,
+ };
+ 
++static const struct ws_panel_data ws_panel_5_0_data = {
++	.mode = &ws_panel_5_0_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ /* 6.25inch 720x1560
+  * https://www.waveshare.com/6.25inch-dsi-lcd.htm
+  */
+@@ -180,6 +240,12 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 1560 + 20 + 20 + 20,
+ };
+ 
++static const struct ws_panel_data ws_panel_6_25_data = {
++	.mode = &ws_panel_6_25_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
+ /* 8.8inch 480x1920
+  * https://www.waveshare.com/8.8inch-dsi-lcd.htm
+  */
+@@ -195,6 +261,48 @@ static const struct drm_display_mode ws_
+ 	.vtotal = 1920 + 20 + 20 + 20,
+ };
+ 
++static const struct ws_panel_data ws_panel_8_8_data = {
++	.mode = &ws_panel_8_8_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO | MIPI_DSI_CLOCK_NON_CONTINUOUS,
++};
++
++static const struct drm_display_mode ws_panel_13_3_4lane_mode = {
++	.clock = 148500,
++	.hdisplay = 1920,
++	.hsync_start = 1920 + 88,
++	.hsync_end = 1920 + 88 + 44,
++	.htotal = 1920 + 88 + 44 + 148,
++	.vdisplay = 1080,
++	.vsync_start = 1080 + 4,
++	.vsync_end = 1080 + 4 + 5,
++	.vtotal = 1080 + 4 + 5 + 36,
++};
++
++static const struct ws_panel_data ws_panel_13_3_4lane_data = {
++	.mode = &ws_panel_13_3_4lane_mode,
++	.lanes = 4,
++	.mode_flags = MIPI_DSI_MODE_VIDEO  | MIPI_DSI_MODE_LPM,
++};
++
++static const struct drm_display_mode ws_panel_13_3_2lane_mode = {
++	.clock = 83333,
++	.hdisplay = 1920,
++	.hsync_start = 1920 + 88,
++	.hsync_end = 1920 + 88 + 44,
++	.htotal = 1920 + 88 + 44 + 148,
++	.vdisplay = 1080,
++	.vsync_start = 1080 + 4,
++	.vsync_end = 1080 + 4 + 5,
++	.vtotal = 1080 + 4 + 5 + 36,
++};
++
++static const struct ws_panel_data ws_panel_13_3_2lane_data = {
++	.mode = &ws_panel_13_3_2lane_mode,
++	.lanes = 2,
++	.mode_flags = MIPI_DSI_MODE_VIDEO  | MIPI_DSI_MODE_LPM,
++};
++
+ static struct ws_panel *panel_to_ts(struct drm_panel *panel)
+ {
+ 	return container_of(panel, struct ws_panel, base);
+@@ -232,7 +340,10 @@ static int ws_panel_enable(struct drm_pa
+ {
+ 	struct ws_panel *ts = panel_to_ts(panel);
+ 
+-	ws_panel_i2c_write(ts, 0xad, 0x01);
++	if (ts->mode == &ws_panel_13_3_2lane_mode)
++		ws_panel_i2c_write(ts, 0xad, 0x02);
++	else
++		ws_panel_i2c_write(ts, 0xad, 0x01);
+ 
+ 	return 0;
+ }
+@@ -328,13 +439,18 @@ static int ws_panel_probe(struct i2c_cli
+ 		.channel = 0,
+ 		.node = NULL,
+ 	};
++	const struct ws_panel_data *_ws_panel_data;
+ 	int ret;
+ 
+ 	ts = devm_kzalloc(dev, sizeof(*ts), GFP_KERNEL);
+ 	if (!ts)
+ 		return -ENOMEM;
+ 
+-	ts->mode = of_device_get_match_data(dev);
++	_ws_panel_data = of_device_get_match_data(dev);
++	if (!_ws_panel_data)
++		return -EINVAL;
++
++	ts->mode = _ws_panel_data->mode;
+ 	if (!ts->mode)
+ 		return -EINVAL;
+ 
+@@ -396,10 +512,9 @@ static int ws_panel_probe(struct i2c_cli
+ 	 */
+ 	drm_panel_add(&ts->base);
+ 
+-	ts->dsi->mode_flags =  MIPI_DSI_MODE_VIDEO_HSE | MIPI_DSI_MODE_VIDEO |
+-			   MIPI_DSI_CLOCK_NON_CONTINUOUS;
++	ts->dsi->mode_flags = _ws_panel_data->mode_flags;
+ 	ts->dsi->format = MIPI_DSI_FMT_RGB888;
+-	ts->dsi->lanes = 2;
++	ts->dsi->lanes = _ws_panel_data->lanes;
+ 
+ 	ret = devm_mipi_dsi_attach(dev, ts->dsi);
+ 
+@@ -432,40 +547,46 @@ static void ws_panel_shutdown(struct i2c
+ static const struct of_device_id ws_panel_of_ids[] = {
+ 	{
+ 		.compatible = "waveshare,2.8inch-panel",
+-		.data = &ws_panel_2_8_mode,
++		.data = &ws_panel_2_8_data,
+ 	}, {
+ 		.compatible = "waveshare,3.4inch-panel",
+-		.data = &ws_panel_3_4_mode,
++		.data = &ws_panel_3_4_data,
+ 	}, {
+ 		.compatible = "waveshare,4.0inch-panel",
+-		.data = &ws_panel_4_0_mode,
++		.data = &ws_panel_4_0_data,
+ 	}, {
+ 		.compatible = "waveshare,7.0inch-c-panel",
+-		.data = &ws_panel_7_0_c_mode,
++		.data = &ws_panel_7_0_c_data,
+ 	}, {
+ 		.compatible = "waveshare,7.9inch-panel",
+-		.data = &ws_panel_7_9_mode,
++		.data = &ws_panel_7_9_data,
+ 	}, {
+ 		.compatible = "waveshare,8.0inch-panel",
+-		.data = &ws_panel_10_1_mode,
++		.data = &ws_panel_10_1_data,
+ 	}, {
+ 		.compatible = "waveshare,10.1inch-panel",
+-		.data = &ws_panel_10_1_mode,
++		.data = &ws_panel_10_1_data,
+ 	}, {
+ 		.compatible = "waveshare,11.9inch-panel",
+-		.data = &ws_panel_11_9_mode,
++		.data = &ws_panel_11_9_data,
+ 	}, {
+ 		.compatible = "waveshare,4inch-panel",
+-		.data = &ws_panel_4_mode,
++		.data = &ws_panel_4_data,
+ 	}, {
+ 		.compatible = "waveshare,5.0inch-panel",
+-		.data = &ws_panel_5_0_mode,
++		.data = &ws_panel_5_0_data,
+ 	}, {
+ 		.compatible = "waveshare,6.25inch-panel",
+-		.data = &ws_panel_6_25_mode,
++		.data = &ws_panel_6_25_data,
+ 	}, {
+ 		.compatible = "waveshare,8.8inch-panel",
+-		.data = &ws_panel_8_8_mode,
++		.data = &ws_panel_8_8_data,
++	}, {
++		.compatible = "waveshare,13.3inch-4lane-panel",
++		.data = &ws_panel_13_3_4lane_data,
++	}, {
++		.compatible = "waveshare,13.3inch-2lane-panel",
++		.data = &ws_panel_13_3_2lane_data,
+ 	}, {
+ 		/* sentinel */
+ 	}
diff --git a/target/linux/bcm27xx/patches-6.6/950-1444-arch-arm-boot-dts-overlays-Added-waveshare-13.3inch-.patch b/target/linux/bcm27xx/patches-6.6/950-1444-arch-arm-boot-dts-overlays-Added-waveshare-13.3inch-.patch
new file mode 100644
index 00000000000000..1d144bf2ca6bb7
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1444-arch-arm-boot-dts-overlays-Added-waveshare-13.3inch-.patch
@@ -0,0 +1,46 @@
+From e442e5c1ab6bff5b5460b4fc949beb72aaf77970 Mon Sep 17 00:00:00 2001
+From: eng33 <eng33@waveshare.com>
+Date: Thu, 5 Dec 2024 18:11:26 +0800
+Subject: [PATCH] arch:arm:boot:dts:overlays: Added waveshare 13.3inch panel
+ support
+
+Signed-off-by: eng33 <eng33@waveshare.com>
+---
+ arch/arm/boot/dts/overlays/README                          | 2 ++
+ .../dts/overlays/vc4-kms-dsi-waveshare-panel-overlay.dts   | 7 +++++++
+ 2 files changed, 9 insertions(+)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -5338,6 +5338,8 @@ Params: 2_8_inch                2.8" 480
+         8_0_inch                8.0" 1280x800
+         10_1_inch               10.1" 1280x800
+         11_9_inch               11.9" 320x1480
++        13_3_inch_4lane         13.3" 1920x1080 4lane
++        13_3_inch_2lane         13.3" 1920x1080 2lane
+         i2c1                    Use i2c-1 with jumper wires from GPIOs 2&3
+         disable_touch           Disable the touch controller
+         rotation                Set the panel orientation property
+--- a/arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-panel-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-panel-overlay.dts
+@@ -51,6 +51,11 @@
+ 				reg = <0x14>;
+ 				compatible = "goodix,gt911";
+ 			};
++
++			touch2: ilitek@41 {
++				compatible = "ilitek,ili251x";
++				reg = <0x41>;
++			};
+ 		};
+ 	};
+ 
+@@ -120,6 +125,8 @@
+ 				   <&touch>, "touchscreen-inverted-x?",
+ 				   <&touch>, "touchscreen-inverted-y?";
+ 		8_8_inch = <&panel>, "compatible=waveshare,8.8inch-panel";
++		13_3_inch_4lane = <&panel>, "compatible=waveshare,13.3inch-4lane-panel";
++		13_3_inch_2lane = <&panel>, "compatible=waveshare,13.3inch-2lane-panel";
+ 		i2c1 = <&i2c_frag>, "target:0=",<&i2c1>,
+ 		       <0>, "-3-4+5";
+ 		disable_touch = <&touch>, "status=disabled";
diff --git a/target/linux/bcm27xx/patches-6.6/950-1445-fixup-cgroup-Use-kernel-command-line-to-disable-memo.patch b/target/linux/bcm27xx/patches-6.6/950-1445-fixup-cgroup-Use-kernel-command-line-to-disable-memo.patch
new file mode 100644
index 00000000000000..b3a73945f648d1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1445-fixup-cgroup-Use-kernel-command-line-to-disable-memo.patch
@@ -0,0 +1,37 @@
+From 166dfc4399643681f2e4277bf7b7407e926861e5 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 9 Dec 2024 14:58:16 +0000
+Subject: [PATCH] fixup! cgroup: Use kernel command line to disable memory
+ cgroup
+
+cgroup features are distinct from cgroup subsystems - handle them
+correctly.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ kernel/cgroup/cgroup.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/kernel/cgroup/cgroup.c
++++ b/kernel/cgroup/cgroup.c
+@@ -6773,11 +6773,19 @@ static int __init cgroup_enable(char *st
+ 			    strcmp(token, ss->legacy_name))
+ 				continue;
+ 
+-			cgroup_feature_disable_mask &= ~(1 << i);
+ 			static_branch_enable(cgroup_subsys_enabled_key[i]);
+ 			pr_info("Enabling %s control group subsystem\n",
+ 				ss->name);
+ 		}
++
++		for (i = 0; i < OPT_FEATURE_COUNT; i++) {
++			if (strcmp(token, cgroup_opt_feature_names[i]))
++				continue;
++			cgroup_feature_disable_mask &= ~(1 << i);
++			pr_info("Enabling %s control group feature\n",
++				cgroup_opt_feature_names[i]);
++			break;
++		}
+ 	}
+ 	return 1;
+ }
diff --git a/target/linux/bcm27xx/patches-6.6/950-1451-Revert-drm-vc4-hvs-Don-t-write-gamma-luts-on-2711.patch b/target/linux/bcm27xx/patches-6.6/950-1451-Revert-drm-vc4-hvs-Don-t-write-gamma-luts-on-2711.patch
new file mode 100644
index 00000000000000..e222ea886a3572
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1451-Revert-drm-vc4-hvs-Don-t-write-gamma-luts-on-2711.patch
@@ -0,0 +1,22 @@
+From 448a2db3990534810b45d3e4202df96ab2dc5815 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Tue, 10 Dec 2024 15:28:28 +0000
+Subject: [PATCH] Revert "drm/vc4: hvs: Don't write gamma luts on 2711"
+
+This reverts commit 40c77e93cfdda320f47fc1a00a76ce466d20e976.
+---
+ drivers/gpu/drm/vc4/vc4_hvs.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/gpu/drm/vc4/vc4_hvs.c
++++ b/drivers/gpu/drm/vc4/vc4_hvs.c
+@@ -521,9 +521,6 @@ static void vc4_hvs_lut_load(struct vc4_
+ 	if (!drm_dev_enter(drm, &idx))
+ 		return;
+ 
+-	if (hvs->vc4->gen == VC4_GEN_5)  
+-		return;
+-
+ 	/* The LUT memory is laid out with each HVS channel in order,
+ 	 * each of which takes 256 writes for R, 256 for G, then 256
+ 	 * for B.
diff --git a/target/linux/bcm27xx/patches-6.6/950-1452-Revert-PCI-Warn-if-no-host-bridge-NUMA-node-info.patch b/target/linux/bcm27xx/patches-6.6/950-1452-Revert-PCI-Warn-if-no-host-bridge-NUMA-node-info.patch
new file mode 100644
index 00000000000000..e8b56706132fe2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1452-Revert-PCI-Warn-if-no-host-bridge-NUMA-node-info.patch
@@ -0,0 +1,29 @@
+From 746662562995125ef7fb2c294300b0bd061b1251 Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Tue, 10 Dec 2024 16:39:31 +0000
+Subject: [PATCH] Revert "PCI: Warn if no host bridge NUMA node info"
+
+This warning doesn't mean anyting on our platform and
+the warning causes confusion.
+
+See: https://forums.raspberrypi.com/viewtopic.php?p=2276125#p2276125
+
+This reverts commit ad5086108b9f0361929aa9a79cf959ab5681d249.
+
+Signed-off-by: Dom Cobley <popcornmix@gmail.com>
+---
+ drivers/pci/probe.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -969,9 +969,6 @@ static int pci_register_host_bridge(stru
+ 	else
+ 		pr_info("PCI host bridge to bus %s\n", name);
+ 
+-	if (nr_node_ids > 1 && pcibus_to_node(bus) == NUMA_NO_NODE)
+-		dev_warn(&bus->dev, "Unknown NUMA node; performance will be reduced\n");
+-
+ 	/* Coalesce contiguous windows */
+ 	resource_list_for_each_entry_safe(window, n, &resources) {
+ 		if (list_is_last(&window->node, &resources))
diff --git a/target/linux/bcm27xx/patches-6.6/950-1454-drm-bridge-panel-Connector-to-allow-interlaced-modes.patch b/target/linux/bcm27xx/patches-6.6/950-1454-drm-bridge-panel-Connector-to-allow-interlaced-modes.patch
new file mode 100644
index 00000000000000..9e4ba2a75acb31
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1454-drm-bridge-panel-Connector-to-allow-interlaced-modes.patch
@@ -0,0 +1,25 @@
+From 7d294fbff4863e53a64685335b30aed9604cae49 Mon Sep 17 00:00:00 2001
+From: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Date: Tue, 19 Nov 2024 16:11:32 +0000
+Subject: [PATCH] drm: bridge: panel: Connector to allow interlaced modes
+
+When initialized from panel_bridge_attach(), connector should
+allow interlaced modes rather than invariably rejecting them,
+so that other components can validate them.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+---
+ drivers/gpu/drm/bridge/panel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/bridge/panel.c
++++ b/drivers/gpu/drm/bridge/panel.c
+@@ -82,6 +82,8 @@ static int panel_bridge_attach(struct dr
+ 		return ret;
+ 	}
+ 
++	connector->interlace_allowed = true;
++
+ 	drm_panel_bridge_set_orientation(connector, bridge);
+ 
+ 	drm_connector_attach_encoder(&panel_bridge->connector,
diff --git a/target/linux/bcm27xx/patches-6.6/950-1455-dts-overlays-vc4-kms-dpi-generic-overlay-Add-interla.patch b/target/linux/bcm27xx/patches-6.6/950-1455-dts-overlays-vc4-kms-dpi-generic-overlay-Add-interla.patch
new file mode 100644
index 00000000000000..1d9792305c0a4a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1455-dts-overlays-vc4-kms-dpi-generic-overlay-Add-interla.patch
@@ -0,0 +1,34 @@
+From 2b0acbe8fd008e09a904b7a3c796a2dc79bf10ea Mon Sep 17 00:00:00 2001
+From: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Date: Tue, 19 Nov 2024 16:17:40 +0000
+Subject: [PATCH] dts: overlays: vc4-kms-dpi-generic-overlay: Add "interlaced"
+ property
+
+Almost no DPI hardware supports it, but it's useful for RP1 video out.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README                          | 1 +
+ arch/arm/boot/dts/overlays/vc4-kms-dpi-generic-overlay.dts | 1 +
+ 2 files changed, 2 insertions(+)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -5099,6 +5099,7 @@ Params: clock-frequency         Display
+         vsync-invert            Vertical sync active low
+         de-invert               Data Enable active low
+         pixclk-invert           Negative edge pixel clock
++        interlaced              Use an interlaced mode (where supported)
+         width-mm                Define the screen width in mm
+         height-mm               Define the screen height in mm
+         rgb565                  Change to RGB565 output on GPIOs 0-19
+--- a/arch/arm/boot/dts/overlays/vc4-kms-dpi-generic-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dpi-generic-overlay.dts
+@@ -59,6 +59,7 @@
+ 		vsync-invert = <&timing>, "vsync-active:0=0";
+ 		de-invert = <&timing>, "de-active:0=0";
+ 		pixclk-invert = <&timing>, "pixelclk-active:0=0";
++		interlaced = <&timing>, "interlaced?";
+ 
+ 		width-mm = <&panel_generic>, "width-mm:0";
+ 		height-mm = <&panel_generic>, "height-mm:0";
diff --git a/target/linux/bcm27xx/patches-6.6/950-1456-drm-rp1-rp1-dpi-Add-interlaced-modes-and-PIO-program.patch b/target/linux/bcm27xx/patches-6.6/950-1456-drm-rp1-rp1-dpi-Add-interlaced-modes-and-PIO-program.patch
new file mode 100644
index 00000000000000..e78ee378a46cae
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1456-drm-rp1-rp1-dpi-Add-interlaced-modes-and-PIO-program.patch
@@ -0,0 +1,762 @@
+From 7735dd0736322cff23aff95490bae1d69937a9bf Mon Sep 17 00:00:00 2001
+From: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Date: Tue, 10 Dec 2024 13:23:09 +0000
+Subject: [PATCH] drm: rp1: rp1-dpi: Add interlaced modes and PIO program to
+ fix VSYNC
+
+Implement interlaced modes by wobbling the base pointer and VFP width
+for every field. This results in correct pixels but incorrect VSYNC.
+
+Now use PIO to generate a fixed-up VSYNC by sampling DE and HSYNC.
+This requires DPI's DE output to be mapped to GPIO1, which we check.
+
+When DE is not exposed, the internal fixup is disabled. VSYNC/GPIO2
+becomes a modified signal, designed to help an external device or
+PIO program synthesize CSYNC or VSYNC.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+---
+ drivers/gpu/drm/rp1/rp1-dpi/Makefile      |   2 +-
+ drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.c     |  34 ++-
+ drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.h     |  18 ++
+ drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_hw.c  | 253 ++++++++++++++++------
+ drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_pio.c | 225 +++++++++++++++++++
+ 5 files changed, 461 insertions(+), 71 deletions(-)
+ create mode 100644 drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_pio.c
+
+--- a/drivers/gpu/drm/rp1/rp1-dpi/Makefile
++++ b/drivers/gpu/drm/rp1/rp1-dpi/Makefile
+@@ -1,5 +1,5 @@
+ # SPDX-License-Identifier: GPL-2.0-only
+ 
+-drm-rp1-dpi-y := rp1_dpi.o rp1_dpi_hw.o rp1_dpi_cfg.o
++drm-rp1-dpi-y := rp1_dpi.o rp1_dpi_hw.o rp1_dpi_cfg.o rp1_dpi_pio.o
+ 
+ obj-$(CONFIG_DRM_RP1_DPI) += drm-rp1-dpi.o
+--- a/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.c
++++ b/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.c
+@@ -80,6 +80,7 @@ static void rp1dpi_pipe_update(struct dr
+ 			if (dpi->dpi_running &&
+ 			    fb->format->format != dpi->cur_fmt) {
+ 				rp1dpi_hw_stop(dpi);
++				rp1dpi_pio_stop(dpi);
+ 				dpi->dpi_running = false;
+ 			}
+ 			if (!dpi->dpi_running) {
+@@ -88,6 +89,7 @@ static void rp1dpi_pipe_update(struct dr
+ 						dpi->bus_fmt,
+ 						dpi->de_inv,
+ 						&pipe->crtc.state->mode);
++				rp1dpi_pio_start(dpi, &pipe->crtc.state->mode);
+ 				dpi->dpi_running = true;
+ 			}
+ 			dpi->cur_fmt = fb->format->format;
+@@ -187,6 +189,7 @@ static void rp1dpi_pipe_disable(struct d
+ 	drm_crtc_vblank_off(&pipe->crtc);
+ 	if (dpi->dpi_running) {
+ 		rp1dpi_hw_stop(dpi);
++		rp1dpi_pio_stop(dpi);
+ 		dpi->dpi_running = false;
+ 	}
+ 	clk_disable_unprepare(dpi->clocks[RP1DPI_CLK_DPI]);
+@@ -236,6 +239,7 @@ static void rp1dpi_stopall(struct drm_de
+ 		if (dpi->dpi_running || rp1dpi_hw_busy(dpi)) {
+ 			rp1dpi_hw_stop(dpi);
+ 			clk_disable_unprepare(dpi->clocks[RP1DPI_CLK_DPI]);
++			rp1dpi_pio_stop(dpi);
+ 			dpi->dpi_running = false;
+ 		}
+ 		rp1dpi_vidout_poweroff(dpi);
+@@ -273,7 +277,7 @@ static int rp1dpi_platform_probe(struct
+ 	struct rp1_dpi *dpi;
+ 	struct drm_bridge *bridge = NULL;
+ 	struct drm_panel *panel;
+-	int i, ret;
++	int i, j, ret;
+ 
+ 	dev_info(dev, __func__);
+ 	ret = drm_of_find_panel_or_bridge(pdev->dev.of_node, 0, 0,
+@@ -295,6 +299,7 @@ static int rp1dpi_platform_probe(struct
+ 		return ret;
+ 	}
+ 	dpi->pdev = pdev;
++	spin_lock_init(&dpi->hw_lock);
+ 
+ 	dpi->bus_fmt = default_bus_fmt;
+ 	ret = of_property_read_u32(dev->of_node, "default_bus_fmt", &dpi->bus_fmt);
+@@ -332,6 +337,33 @@ static int rp1dpi_platform_probe(struct
+ 	if (ret)
+ 		goto done_err;
+ 
++	/* Check if PIO can snoop on or override DPI's GPIO1 */
++	dpi->gpio1_used = false;
++	for (i = 0; !dpi->gpio1_used; i++) {
++		u32 p = 0;
++		const char *str = NULL;
++		struct device_node *np1 = of_parse_phandle(dev->of_node, "pinctrl-0", i);
++
++		if (!np1)
++			break;
++
++		if (!of_property_read_string(np1, "function", &str) && !strcmp(str, "dpi")) {
++			for (j = 0; !dpi->gpio1_used; j++) {
++				if (of_property_read_string_index(np1, "pins", j, &str))
++					break;
++				if (!strcmp(str, "gpio1"))
++					dpi->gpio1_used = true;
++			}
++			for (j = 0; !dpi->gpio1_used; j++) {
++				if (of_property_read_u32_index(np1, "brcm,pins", j, &p))
++					break;
++				if (p == 1)
++					dpi->gpio1_used = true;
++			}
++		}
++		of_node_put(np1);
++	}
++
+ 	/* Now we have all our resources, finish driver initialization */
+ 	dma_set_mask_and_coherent(dev, DMA_BIT_MASK(64));
+ 	init_completion(&dpi->finished);
+--- a/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.h
++++ b/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.h
+@@ -46,6 +46,18 @@ struct rp1_dpi {
+ 	bool de_inv, clk_inv;
+ 	bool dpi_running, pipe_enabled;
+ 	struct completion finished;
++
++	/* Experimental stuff for interlace follows */
++	struct rp1_pio_client *pio;
++	bool gpio1_used;
++	bool pio_stole_gpio2;
++
++	spinlock_t hw_lock; /* the following are used in line-match ISR */
++	dma_addr_t last_dma_addr;
++	u32 last_stride;
++	u32 shorter_front_porch;
++	bool interlaced;
++	bool lower_field_flag;
+ };
+ 
+ /* ---------------------------------------------------------------------- */
+@@ -67,3 +79,9 @@ void rp1dpi_hw_vblank_ctrl(struct rp1_dp
+ 
+ void rp1dpi_vidout_setup(struct rp1_dpi *dpi, bool drive_negedge);
+ void rp1dpi_vidout_poweroff(struct rp1_dpi *dpi);
++
++/* ---------------------------------------------------------------------- */
++/* PIO control -- we need PIO to generate VSync (from DE) when interlaced */
++
++int rp1dpi_pio_start(struct rp1_dpi *dpi, const struct drm_display_mode *mode);
++void rp1dpi_pio_stop(struct rp1_dpi *dpi);
+--- a/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_hw.c
++++ b/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_hw.c
+@@ -202,7 +202,7 @@
+ // Status
+ #define DPI_DMA_STATUS  0x3c
+ 
+-#define BITS(field, val) (((val) << (field ## _SHIFT)) & (field ## _MASK))
++#define BITS(field, val) FIELD_PREP((field ## _MASK), val)
+ 
+ static unsigned int rp1dpi_hw_read(struct rp1_dpi *dpi, unsigned int reg)
+ {
+@@ -231,69 +231,73 @@ struct rp1dpi_ipixfmt {
+ 	u32 rgbsz;  /* Shifts used for scaling; also (BPP/8-1)   */
+ };
+ 
+-#define IMASK_RGB(r, g, b)	(BITS(DPI_DMA_IMASK_R, r)  | \
+-				 BITS(DPI_DMA_IMASK_G, g)  | \
+-				 BITS(DPI_DMA_IMASK_B, b))
+-#define OMASK_RGB(r, g, b)	(BITS(DPI_DMA_OMASK_R, r)  | \
+-				 BITS(DPI_DMA_OMASK_G, g)  | \
+-				 BITS(DPI_DMA_OMASK_B, b))
+-#define ISHIFT_RGB(r, g, b)	(BITS(DPI_DMA_SHIFT_IR, r) | \
+-				 BITS(DPI_DMA_SHIFT_IG, g) | \
+-				 BITS(DPI_DMA_SHIFT_IB, b))
+-#define OSHIFT_RGB(r, g, b)	(BITS(DPI_DMA_SHIFT_OR, r) | \
+-				 BITS(DPI_DMA_SHIFT_OG, g) | \
+-				 BITS(DPI_DMA_SHIFT_OB, b))
++#define IMASK_RGB(r, g, b)  (FIELD_PREP_CONST(DPI_DMA_IMASK_R_MASK, r)  | \
++			     FIELD_PREP_CONST(DPI_DMA_IMASK_G_MASK, g)  | \
++			     FIELD_PREP_CONST(DPI_DMA_IMASK_B_MASK, b))
++#define OMASK_RGB(r, g, b)  (FIELD_PREP_CONST(DPI_DMA_OMASK_R_MASK, r)  | \
++			     FIELD_PREP_CONST(DPI_DMA_OMASK_G_MASK, g)  | \
++			     FIELD_PREP_CONST(DPI_DMA_OMASK_B_MASK, b))
++#define ISHIFT_RGB(r, g, b) (FIELD_PREP_CONST(DPI_DMA_SHIFT_IR_MASK, r) | \
++			     FIELD_PREP_CONST(DPI_DMA_SHIFT_IG_MASK, g) | \
++			     FIELD_PREP_CONST(DPI_DMA_SHIFT_IB_MASK, b))
++#define OSHIFT_RGB(r, g, b) (FIELD_PREP_CONST(DPI_DMA_SHIFT_OR_MASK, r) | \
++			     FIELD_PREP_CONST(DPI_DMA_SHIFT_OG_MASK, g) | \
++			     FIELD_PREP_CONST(DPI_DMA_SHIFT_OB_MASK, b))
+ 
+ static const struct rp1dpi_ipixfmt my_formats[] = {
+ 	{
+ 	  .format = DRM_FORMAT_XRGB8888,
+ 	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
+ 	  .shift  = ISHIFT_RGB(23, 15, 7),
+-	  .rgbsz  = BITS(DPI_DMA_RGBSZ_BPP, 3),
++	  .rgbsz  = FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 3),
+ 	},
+ 	{
+ 	  .format = DRM_FORMAT_XBGR8888,
+ 	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
+ 	  .shift  = ISHIFT_RGB(7, 15, 23),
+-	  .rgbsz  = BITS(DPI_DMA_RGBSZ_BPP, 3),
++	  .rgbsz  = FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 3),
+ 	},
+ 	{
+ 	  .format = DRM_FORMAT_ARGB8888,
+ 	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
+ 	  .shift  = ISHIFT_RGB(23, 15, 7),
+-	  .rgbsz  = BITS(DPI_DMA_RGBSZ_BPP, 3),
++	  .rgbsz  = FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 3),
+ 	},
+ 	{
+ 	  .format = DRM_FORMAT_ABGR8888,
+ 	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
+ 	  .shift  = ISHIFT_RGB(7, 15, 23),
+-	  .rgbsz  = BITS(DPI_DMA_RGBSZ_BPP, 3),
++	  .rgbsz  = FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 3),
+ 	},
+ 	{
+ 	  .format = DRM_FORMAT_RGB888,
+ 	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
+ 	  .shift  = ISHIFT_RGB(23, 15, 7),
+-	  .rgbsz  = BITS(DPI_DMA_RGBSZ_BPP, 2),
++	  .rgbsz  = FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 2),
+ 	},
+ 	{
+ 	  .format = DRM_FORMAT_BGR888,
+ 	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
+ 	  .shift  = ISHIFT_RGB(7, 15, 23),
+-	  .rgbsz  = BITS(DPI_DMA_RGBSZ_BPP, 2),
++	  .rgbsz  = FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 2),
+ 	},
+ 	{
+ 	  .format = DRM_FORMAT_RGB565,
+ 	  .mask	  = IMASK_RGB(0x3e0, 0x3f0, 0x3e0),
+ 	  .shift  = ISHIFT_RGB(15, 10, 4),
+-	  .rgbsz  = BITS(DPI_DMA_RGBSZ_R, 5) | BITS(DPI_DMA_RGBSZ_G, 6) |
+-		    BITS(DPI_DMA_RGBSZ_B, 5) | BITS(DPI_DMA_RGBSZ_BPP, 1),
++	  .rgbsz  = (FIELD_PREP_CONST(DPI_DMA_RGBSZ_R_MASK, 5) |
++		     FIELD_PREP_CONST(DPI_DMA_RGBSZ_G_MASK, 6) |
++		     FIELD_PREP_CONST(DPI_DMA_RGBSZ_B_MASK, 5) |
++		     FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 1)),
+ 	},
+ 	{
+ 	  .format = DRM_FORMAT_BGR565,
+ 	  .mask	  = IMASK_RGB(0x3e0, 0x3f0, 0x3e0),
+ 	  .shift  = ISHIFT_RGB(4, 10, 15),
+-	  .rgbsz  = BITS(DPI_DMA_RGBSZ_R, 5) | BITS(DPI_DMA_RGBSZ_G, 6) |
+-		    BITS(DPI_DMA_RGBSZ_B, 5) | BITS(DPI_DMA_RGBSZ_BPP, 1),
++	  .rgbsz  = (FIELD_PREP_CONST(DPI_DMA_RGBSZ_R_MASK, 5) |
++		     FIELD_PREP_CONST(DPI_DMA_RGBSZ_G_MASK, 6) |
++		     FIELD_PREP_CONST(DPI_DMA_RGBSZ_B_MASK, 5) |
++		     FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 1)),
+ 	}
+ };
+ 
+@@ -354,42 +358,26 @@ void rp1dpi_hw_setup(struct rp1_dpi *dpi
+ 		     u32 in_format, u32 bus_format, bool de_inv,
+ 		    struct drm_display_mode const *mode)
+ {
+-	u32 shift, imask, omask, rgbsz;
++	u32 shift, imask, omask, rgbsz, vctrl;
+ 	int i;
+ 
+-	pr_info("%s: in_fmt=\'%c%c%c%c\' bus_fmt=0x%x mode=%dx%d total=%dx%d %dkHz %cH%cV%cD%cC",
+-		__func__, in_format, in_format >> 8, in_format >> 16, in_format >> 24, bus_format,
+-		mode->hdisplay, mode->vdisplay,
+-		mode->htotal, mode->vtotal,
+-		mode->clock,
+-		(mode->flags & DRM_MODE_FLAG_NHSYNC) ? '-' : '+',
+-		(mode->flags & DRM_MODE_FLAG_NVSYNC) ? '-' : '+',
+-		de_inv ? '-' : '+',
+-		dpi->clk_inv ? '-' : '+');
++	drm_info(&dpi->drm,
++		 "in_fmt=\'%c%c%c%c\' bus_fmt=0x%x mode=%dx%d total=%dx%d%s %dkHz %cH%cV%cD%cC",
++		 in_format, in_format >> 8, in_format >> 16, in_format >> 24, bus_format,
++		 mode->hdisplay, mode->vdisplay,
++		 mode->htotal, mode->vtotal,
++		 (mode->flags & DRM_MODE_FLAG_INTERLACE) ? "i" : "",
++		 mode->clock,
++		 (mode->flags & DRM_MODE_FLAG_NHSYNC) ? '-' : '+',
++		 (mode->flags & DRM_MODE_FLAG_NVSYNC) ? '-' : '+',
++		 de_inv ? '-' : '+',
++		 dpi->clk_inv ? '-' : '+');
+ 
+ 	/*
+ 	 * Configure all DPI/DMA block registers, except base address.
+ 	 * DMA will not actually start until a FB base address is specified
+ 	 * using rp1dpi_hw_update().
+ 	 */
+-	rp1dpi_hw_write(dpi, DPI_DMA_VISIBLE_AREA,
+-			BITS(DPI_DMA_VISIBLE_AREA_ROWSM1, mode->vdisplay - 1) |
+-			BITS(DPI_DMA_VISIBLE_AREA_COLSM1, mode->hdisplay - 1));
+-
+-	rp1dpi_hw_write(dpi, DPI_DMA_SYNC_WIDTH,
+-			BITS(DPI_DMA_SYNC_WIDTH_ROWSM1, mode->vsync_end - mode->vsync_start - 1) |
+-			BITS(DPI_DMA_SYNC_WIDTH_COLSM1, mode->hsync_end - mode->hsync_start - 1));
+-
+-	/* In these registers, "back porch" time includes sync width */
+-	rp1dpi_hw_write(dpi, DPI_DMA_BACK_PORCH,
+-			BITS(DPI_DMA_BACK_PORCH_ROWSM1, mode->vtotal - mode->vsync_start - 1) |
+-			BITS(DPI_DMA_BACK_PORCH_COLSM1, mode->htotal - mode->hsync_start - 1));
+-
+-	rp1dpi_hw_write(dpi, DPI_DMA_FRONT_PORCH,
+-			BITS(DPI_DMA_FRONT_PORCH_ROWSM1, mode->vsync_start - mode->vdisplay - 1) |
+-			BITS(DPI_DMA_FRONT_PORCH_COLSM1, mode->hsync_start - mode->hdisplay - 1));
+-
+-	/* Input to output pixel format conversion */
+ 	for (i = 0; i < ARRAY_SIZE(my_formats); ++i) {
+ 		if (my_formats[i].format == in_format)
+ 			break;
+@@ -417,6 +405,89 @@ void rp1dpi_hw_setup(struct rp1_dpi *dpi
+ 			BITS(DPI_DMA_QOS_LLEV, 0x8) |
+ 			BITS(DPI_DMA_QOS_LQOS, 0x7));
+ 
++	if (!(mode->flags & DRM_MODE_FLAG_INTERLACE)) {
++		rp1dpi_hw_write(dpi, DPI_DMA_VISIBLE_AREA,
++				BITS(DPI_DMA_VISIBLE_AREA_ROWSM1, mode->vdisplay - 1) |
++				BITS(DPI_DMA_VISIBLE_AREA_COLSM1, mode->hdisplay - 1));
++
++		rp1dpi_hw_write(dpi, DPI_DMA_SYNC_WIDTH,
++				BITS(DPI_DMA_SYNC_WIDTH_ROWSM1,
++				     mode->vsync_end - mode->vsync_start - 1) |
++				BITS(DPI_DMA_SYNC_WIDTH_COLSM1,
++				     mode->hsync_end - mode->hsync_start - 1));
++
++		/* In these registers, "back porch" time includes sync width */
++		rp1dpi_hw_write(dpi, DPI_DMA_BACK_PORCH,
++				BITS(DPI_DMA_BACK_PORCH_ROWSM1,
++				     mode->vtotal - mode->vsync_start - 1) |
++				BITS(DPI_DMA_BACK_PORCH_COLSM1,
++				     mode->htotal - mode->hsync_start - 1));
++
++		rp1dpi_hw_write(dpi, DPI_DMA_FRONT_PORCH,
++				BITS(DPI_DMA_FRONT_PORCH_ROWSM1,
++				     mode->vsync_start - mode->vdisplay - 1) |
++				BITS(DPI_DMA_FRONT_PORCH_COLSM1,
++				     mode->hsync_start - mode->hdisplay - 1));
++
++		vctrl = BITS(DPI_DMA_CONTROL_VSYNC_POL, !!(mode->flags & DRM_MODE_FLAG_NVSYNC)) |
++			BITS(DPI_DMA_CONTROL_VBP_EN, (mode->vtotal != mode->vsync_start))       |
++			BITS(DPI_DMA_CONTROL_VFP_EN, (mode->vsync_start != mode->vdisplay))     |
++			BITS(DPI_DMA_CONTROL_VSYNC_EN, (mode->vsync_end != mode->vsync_start));
++
++		dpi->interlaced = false;
++	} else {
++		/*
++		 * Experimental interlace support
++		 *
++		 * RP1 DPI hardware wasn't designed to support interlace, but lets us change
++		 * both the VFP line count and the next DMA address while running. That allows
++		 * pixel data to be correctly timed for interlace, but VSYNC remains wrong.
++		 *
++		 * It is necessary to use external hardware (such as PIO) to regenerate VSYNC
++		 * based on HSYNC, DE (which *must* both be mapped to GPIOs 1, 3 respectively).
++		 * This driver includes a PIO program to do that, when DE is enabled.
++		 *
++		 * An alternative fixup is to synthesize CSYNC from HSYNC and modified-VSYNC.
++		 * We don't implement that here, but to facilitate it, DPI's VSYNC is replaced
++		 * by a "helper signal" that pulses low for 1 or 2 scan-lines, starting 2.0 or
++		 * 2.5 scan-lines respectively before nominal VSYNC start.
++		 */
++		int vact  = mode->vdisplay >> 1; /* visible lines per field. Can't do half-lines */
++		int vtot0 = mode->vtotal >> 1;   /* vtotal should always be odd when interlaced. */
++		int vfp0  = (mode->vsync_start >= mode->vdisplay + 4) ?
++			((mode->vsync_start - mode->vdisplay - 2) >> 1) : 1;
++		int vbp   = max(0, vtot0 - vact - vfp0);
++
++		rp1dpi_hw_write(dpi, DPI_DMA_VISIBLE_AREA,
++				BITS(DPI_DMA_VISIBLE_AREA_ROWSM1, vact - 1) |
++				BITS(DPI_DMA_VISIBLE_AREA_COLSM1, mode->hdisplay - 1));
++
++		rp1dpi_hw_write(dpi, DPI_DMA_SYNC_WIDTH,
++				BITS(DPI_DMA_SYNC_WIDTH_ROWSM1, vtot0 - 2) |
++				BITS(DPI_DMA_SYNC_WIDTH_COLSM1,
++				     mode->hsync_end - mode->hsync_start - 1));
++
++		rp1dpi_hw_write(dpi, DPI_DMA_BACK_PORCH,
++				BITS(DPI_DMA_BACK_PORCH_ROWSM1, vbp - 1) |
++				BITS(DPI_DMA_BACK_PORCH_COLSM1,
++				     mode->htotal - mode->hsync_start - 1));
++
++		dpi->shorter_front_porch =
++			BITS(DPI_DMA_FRONT_PORCH_ROWSM1, vfp0 - 1) |
++			BITS(DPI_DMA_FRONT_PORCH_COLSM1,
++			     mode->hsync_start - mode->hdisplay - 1);
++		rp1dpi_hw_write(dpi, DPI_DMA_FRONT_PORCH, dpi->shorter_front_porch);
++
++		vctrl = BITS(DPI_DMA_CONTROL_VSYNC_POL, 0)      |
++			BITS(DPI_DMA_CONTROL_VBP_EN, (vbp > 0)) |
++			BITS(DPI_DMA_CONTROL_VFP_EN, 1)         |
++			BITS(DPI_DMA_CONTROL_VSYNC_EN, 1);
++
++		dpi->interlaced = true;
++	}
++	dpi->lower_field_flag = false;
++	dpi->last_dma_addr = 0;
++
+ 	rp1dpi_hw_write(dpi, DPI_DMA_IRQ_FLAGS, -1);
+ 	rp1dpi_hw_vblank_ctrl(dpi, 1);
+ 
+@@ -425,49 +496,64 @@ void rp1dpi_hw_setup(struct rp1_dpi *dpi
+ 		pr_warn("%s: Unexpectedly busy at start!", __func__);
+ 
+ 	rp1dpi_hw_write(dpi, DPI_DMA_CONTROL,
++			vctrl                                  |
+ 			BITS(DPI_DMA_CONTROL_ARM,          !i) |
+ 			BITS(DPI_DMA_CONTROL_AUTO_REPEAT,   1) |
+ 			BITS(DPI_DMA_CONTROL_HIGH_WATER,  448) |
+ 			BITS(DPI_DMA_CONTROL_DEN_POL,  de_inv) |
+ 			BITS(DPI_DMA_CONTROL_HSYNC_POL, !!(mode->flags & DRM_MODE_FLAG_NHSYNC)) |
+-			BITS(DPI_DMA_CONTROL_VSYNC_POL, !!(mode->flags & DRM_MODE_FLAG_NVSYNC)) |
+-			BITS(DPI_DMA_CONTROL_COLORM,	   0) |
+-			BITS(DPI_DMA_CONTROL_SHUTDN,	   0) |
+ 			BITS(DPI_DMA_CONTROL_HBP_EN,    (mode->htotal != mode->hsync_end))      |
+ 			BITS(DPI_DMA_CONTROL_HFP_EN,    (mode->hsync_start != mode->hdisplay))  |
+-			BITS(DPI_DMA_CONTROL_VBP_EN,    (mode->vtotal != mode->vsync_end))      |
+-			BITS(DPI_DMA_CONTROL_VFP_EN,    (mode->vsync_start != mode->vdisplay))  |
+-			BITS(DPI_DMA_CONTROL_HSYNC_EN,  (mode->hsync_end != mode->hsync_start)) |
+-			BITS(DPI_DMA_CONTROL_VSYNC_EN,  (mode->vsync_end != mode->vsync_start)));
++			BITS(DPI_DMA_CONTROL_HSYNC_EN,  (mode->hsync_end != mode->hsync_start)));
+ }
+ 
+ void rp1dpi_hw_update(struct rp1_dpi *dpi, dma_addr_t addr, u32 offset, u32 stride)
+ {
+-	u64 a = addr + offset;
++	unsigned long flags;
++
++	spin_lock_irqsave(&dpi->hw_lock, flags);
+ 
+ 	/*
+ 	 * Update STRIDE, DMAH and DMAL only. When called after rp1dpi_hw_setup(),
+ 	 * DMA starts immediately; if already running, the buffer will flip at
+-	 * the next vertical sync event.
++	 * the next vertical sync event. In interlaced mode, we need to adjust
++	 * the address and stride to display only the current field, saving
++	 * the original address (so it can be flipped for subsequent fields).
+ 	 */
++	addr += offset;
++	dpi->last_dma_addr = addr;
++	dpi->last_stride = stride;
++	if (dpi->interlaced) {
++		if (dpi->lower_field_flag)
++			addr += stride;
++		stride *= 2;
++	}
+ 	rp1dpi_hw_write(dpi, DPI_DMA_DMA_STRIDE, stride);
+-	rp1dpi_hw_write(dpi, DPI_DMA_DMA_ADDR_H, a >> 32);
+-	rp1dpi_hw_write(dpi, DPI_DMA_DMA_ADDR_L, a & 0xFFFFFFFFu);
++	rp1dpi_hw_write(dpi, DPI_DMA_DMA_ADDR_H, addr >> 32);
++	rp1dpi_hw_write(dpi, DPI_DMA_DMA_ADDR_L, addr & 0xFFFFFFFFu);
++
++	spin_unlock_irqrestore(&dpi->hw_lock, flags);
+ }
+ 
+ void rp1dpi_hw_stop(struct rp1_dpi *dpi)
+ {
+ 	u32 ctrl;
++	unsigned long flags;
+ 
+ 	/*
+-	 * Stop DMA by turning off the Auto-Repeat flag, and wait up to 100ms for
+-	 * the current and any queued frame to end. "Force drain" flags are not used,
+-	 * as they seem to prevent DMA from re-starting properly; it's safer to wait.
++	 * Stop DMA by turning off Auto-Repeat (and disable S/W field-flip),
++	 * then wait up to 100ms for the current and any queued frame to end.
++	 * (There is a "force drain" flag, but it can leave DPI in a broken
++	 * state which prevents it from restarting; it's safer to wait.)
+ 	 */
++	spin_lock_irqsave(&dpi->hw_lock, flags);
++	dpi->last_dma_addr = 0;
+ 	reinit_completion(&dpi->finished);
+ 	ctrl = rp1dpi_hw_read(dpi, DPI_DMA_CONTROL);
+ 	ctrl &= ~(DPI_DMA_CONTROL_ARM_MASK | DPI_DMA_CONTROL_AUTO_REPEAT_MASK);
+ 	rp1dpi_hw_write(dpi, DPI_DMA_CONTROL, ctrl);
++	spin_unlock_irqrestore(&dpi->hw_lock, flags);
++
+ 	if (!wait_for_completion_timeout(&dpi->finished, HZ / 10))
+ 		drm_err(&dpi->drm, "%s: timed out waiting for idle\n", __func__);
+ 	rp1dpi_hw_write(dpi, DPI_DMA_IRQ_EN, 0);
+@@ -476,10 +562,11 @@ void rp1dpi_hw_stop(struct rp1_dpi *dpi)
+ void rp1dpi_hw_vblank_ctrl(struct rp1_dpi *dpi, int enable)
+ {
+ 	rp1dpi_hw_write(dpi, DPI_DMA_IRQ_EN,
+-			BITS(DPI_DMA_IRQ_EN_AFIFO_EMPTY, 1)      |
+-			BITS(DPI_DMA_IRQ_EN_UNDERFLOW, 1)        |
+-			BITS(DPI_DMA_IRQ_EN_DMA_READY, !!enable) |
+-			BITS(DPI_DMA_IRQ_EN_MATCH_LINE, 4095));
++			BITS(DPI_DMA_IRQ_EN_AFIFO_EMPTY, 1)         |
++			BITS(DPI_DMA_IRQ_EN_UNDERFLOW, 1)           |
++			BITS(DPI_DMA_IRQ_EN_DMA_READY, !!enable)    |
++			BITS(DPI_DMA_IRQ_EN_MATCH, dpi->interlaced) |
++			BITS(DPI_DMA_IRQ_EN_MATCH_LINE, 32));
+ }
+ 
+ irqreturn_t rp1dpi_hw_isr(int irq, void *dev)
+@@ -498,7 +585,35 @@ irqreturn_t rp1dpi_hw_isr(int irq, void
+ 				drm_crtc_handle_vblank(&dpi->pipe.crtc);
+ 			if (u & DPI_DMA_IRQ_FLAGS_AFIFO_EMPTY_MASK)
+ 				complete(&dpi->finished);
++
++			/*
++			 * Added for interlace support: We use this mid-frame interrupt to
++			 * wobble the VFP between fields, re-submitting the next-buffer address
++			 * with an offset to display the opposite field. NB: rp1dpi_hw_update()
++			 * may be called at any time, before or after, so locking is needed.
++			 * H/W Auto-update is no longer needed (unless this IRQ is lost).
++			 */
++			if ((u & DPI_DMA_IRQ_FLAGS_MATCH_MASK) && dpi->interlaced) {
++				unsigned long flags;
++				dma_addr_t a;
++
++				spin_lock_irqsave(&dpi->hw_lock, flags);
++				dpi->lower_field_flag = !dpi->lower_field_flag;
++				rp1dpi_hw_write(dpi, DPI_DMA_FRONT_PORCH,
++						dpi->shorter_front_porch +
++						BITS(DPI_DMA_FRONT_PORCH_ROWSM1,
++						     dpi->lower_field_flag));
++				a = dpi->last_dma_addr;
++				if (a) {
++					if (dpi->lower_field_flag)
++						a += dpi->last_stride;
++					rp1dpi_hw_write(dpi, DPI_DMA_DMA_ADDR_H, a >> 32);
++					rp1dpi_hw_write(dpi, DPI_DMA_DMA_ADDR_L, a & 0xFFFFFFFFu);
++				}
++				spin_unlock_irqrestore(&dpi->hw_lock, flags);
++			}
+ 		}
+ 	}
++
+ 	return u ? IRQ_HANDLED : IRQ_NONE;
+ }
+--- /dev/null
++++ b/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_pio.c
+@@ -0,0 +1,225 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * PIO code for Raspberry Pi RP1 DPI driver
++ *
++ * Copyright (c) 2024 Raspberry Pi Limited.
++ */
++
++/*
++ * Use PIO to fix up VSYNC for interlaced modes.
++ *
++ * For this to work we *require* DPI's pinctrl to enable DE on GPIO1.
++ * PIO can then snoop on HSYNC and DE pins to generate corrected VSYNC.
++ *
++ * Note that corrected VSYNC outputs will not be synchronous to DPICLK,
++ * will lag HSYNC by about 30ns and may suffer up to 5ns of jitter.
++ */
++
++#include <linux/kernel.h>
++#include <linux/errno.h>
++#include <linux/of.h>
++#include <linux/pio_rp1.h>
++#include <linux/pinctrl/consumer.h>
++#include <linux/platform_device.h>
++#include <drm/drm_print.h>
++
++#include "rp1_dpi.h"
++
++/*
++ * Start a PIO SM to generate an interrupt just after HSYNC onset, then another
++ * after a fixed delay (during which we assume HSYNC will have been deasserted).
++ */
++
++static int rp1dpi_pio_start_timer_both(struct rp1_dpi *dpi, u32 flags, u32 tc)
++{
++	static const u16 instructions[2][5] = {
++		{ 0xa022, 0x2083, 0xc001, 0x0043, 0xc001 }, /* posedge */
++		{ 0xa022, 0x2003, 0xc001, 0x0043, 0xc001 }, /* negedge */
++	};
++	const struct pio_program prog = {
++		.instructions = instructions[(flags & DRM_MODE_FLAG_NHSYNC) ? 1 : 0],
++		.length = ARRAY_SIZE(instructions[0]),
++		.origin = -1
++	};
++	int offset, sm;
++
++	sm = pio_claim_unused_sm(dpi->pio, true);
++	if (sm < 0)
++		return -EBUSY;
++
++	offset = pio_add_program(dpi->pio, &prog);
++	if (offset == PIO_ORIGIN_ANY)
++		return -EBUSY;
++
++	pio_sm_config cfg = pio_get_default_sm_config();
++
++	pio_sm_set_enabled(dpi->pio, sm, false);
++	sm_config_set_wrap(&cfg, offset, offset + 4);
++	pio_sm_init(dpi->pio, sm, offset, &cfg);
++
++	pio_sm_put(dpi->pio, sm, tc - 4);
++	pio_sm_exec(dpi->pio, sm, pio_encode_pull(false, false));
++	pio_sm_exec(dpi->pio, sm, pio_encode_out(pio_y, 32));
++	pio_sm_set_enabled(dpi->pio, sm, true);
++
++	return 0;
++}
++
++/*
++ * Snoop on DE, HSYNC to count half-lines in the vertical blanking interval
++ * to determine when the VSYNC pulse should start and finish. Then, at a
++ * suitable moment (which should be an odd number of half-lines since the
++ * last active line), sample DE again to detect field phase.
++ *
++ * This version assumes VFP length is within 2..129 half-lines for any field
++ * (one half-line delay is needed to sample DE; we always wait for the next
++ * half-line boundary to improve VSync start accuracy).
++ */
++
++static int rp1dpi_pio_vsync_ilace(struct rp1_dpi *dpi,
++				  struct drm_display_mode const *mode)
++{
++	static const int wrap_target = 14;
++	static const int wrap = 26;
++	u16 instructions[] = {  /* This is mutable */
++		0xa0e6, //  0: mov    osr, isr    side 0     ; top: rewind parameters
++		0x2081, //  1: wait   1 gpio, 1   side 0     ; main: while (!DE) wait;
++		0x2783, //  2: wait   1 gpio, 3   side 0 [7] ;  do { @HSync
++		0xc041, //  3: irq    clear 1     side 0     ;   flush stale IRQs
++		0x20c1, //  4: wait   1 irq, 1    side 0     ;   @midline
++		0x00c1, //  5: jmp    pin, 1      side 0     ;  } while (DE)
++		0x0007, //  6: jmp    7           side 0     ;  <modify for -DE fixup>
++		0x6027, //  7: out    x, 7        side 0     ;  x = VFPlen - 2
++		0x000a, //  8: jmp    10          side 0     ;  while (x--) {
++		0x20c1, //  9: wait   1 irq, 1    side 0     ;    @halfline
++		0x0049, // 10: jmp    x--, 9      side 0     ;  }
++		0x6021, // 11: out    x, 1        side 0     ;  test for aligned case
++		0x003a, // 12: jmp    !x, 26      side 0     ;  if (!x) goto precise;
++		0x20c1, // 13: wait   1 irq, 1    side 0     ;  @halfline
++		//     .wrap_target                          ; vsjoin:
++		0xb722, // 14: mov    x, y        side 1 [7] ;  VSYNC=1; x = VSyncLen
++		0xd041, // 15: irq    clear 1     side 1     ;  VSYNC=1; flush stale IRQs
++		0x30c1, // 16: wait   1 irq, 1    side 1     ;  VSYNC=1; do { @halfline
++		0x1050, // 17: jmp    x--, 16     side 1     ;  VSYNC=1; } while (x--)
++		0x6028, // 18: out    x, 8        side 0     ;  VSYNC=0; x = VBPLen
++		0x0015, // 19: jmp    21          side 0     ;  while (x--) {
++		0x20c1, // 20: wait   1 irq, 1    side 0     ;    @halfline
++		0x0054, // 21: jmp    x--, 20     side 0     ;  }
++		0x00c0, // 22: jmp    pin, 0      side 0     ;  if (DE) reset phase
++		0x0018, // 23: jmp    24          side 0     ;  <modify for -DE fixup>
++		0x00e1, // 24: jmp    !osre, 1    side 0     ;  if (!phase) goto main
++		0x0000, // 25: jmp    0           side 0     ;  goto top
++		0x2083, // 26: wait   1 gpio, 3   side 0     ; precise: @HSync
++		//     .wrap                                 ;  goto vsjoin
++	};
++	struct pio_program prog = {
++		.instructions = instructions,
++		.length = ARRAY_SIZE(instructions),
++		.origin = -1
++	};
++	pio_sm_config cfg = pio_get_default_sm_config();
++	unsigned int i, offset;
++	u32 tc, vfp, vbp;
++	u32 sysclk = clock_get_hz(clk_sys);
++	int sm = pio_claim_unused_sm(dpi->pio, true);
++
++	if (sm < 0)
++		return -EBUSY;
++
++	/* Compute mid-line time constant and start the timer SM */
++	tc = (mode->htotal * (u64)sysclk) / (u64)(2000u * mode->clock);
++	if (rp1dpi_pio_start_timer_both(dpi, mode->flags, tc) < 0) {
++		pio_sm_unclaim(dpi->pio, sm);
++		return -EBUSY;
++	}
++
++	/* Adapt program code according to DE and Sync polarity; configure program */
++	pio_sm_set_enabled(dpi->pio, sm, false);
++	if (dpi->de_inv) {
++		instructions[1] ^= 0x0080;
++		instructions[5]  = 0x00c7;
++		instructions[6]  = 0x0001;
++		instructions[22] = 0x00d8;
++		instructions[23] = 0x0000;
++	}
++	for (i = 0; i < ARRAY_SIZE(instructions); i++) {
++		if (mode->flags & DRM_MODE_FLAG_NVSYNC)
++			instructions[i] ^= 0x1000;
++		if ((mode->flags & DRM_MODE_FLAG_NHSYNC) && (instructions[i] & 0xe07f) == 0x2003)
++			instructions[i] ^= 0x0080;
++	}
++	offset = pio_add_program(dpi->pio, &prog);
++	if (offset == PIO_ORIGIN_ANY)
++		return -EBUSY;
++
++	/* Configure pins and SM */
++	dpi->pio_stole_gpio2 = true;
++	sm_config_set_wrap(&cfg, offset + wrap_target, offset + wrap);
++	sm_config_set_sideset(&cfg, 1, false, false);
++	sm_config_set_sideset_pins(&cfg, 2);
++	pio_gpio_init(dpi->pio, 2);
++	sm_config_set_jmp_pin(&cfg, 1); /* "DE" is always GPIO1 */
++	pio_sm_init(dpi->pio, sm, offset, &cfg);
++	pio_sm_set_consecutive_pindirs(dpi->pio, sm, 2, 1, true);
++
++	/* Compute vertical times, remembering how we rounded vdisplay, vtotal */
++	vfp = mode->vsync_start - (mode->vdisplay & ~1);
++	vbp = (mode->vtotal | 1) - mode->vsync_end;
++	if (vfp > 128) {
++		vbp += vfp - 128;
++		vfp = 128;
++	} else if (vfp < 3) {
++		vbp = (vbp > 3 - vfp) ? (vbp - 3 + vfp) : 0;
++		vfp = 3;
++	}
++
++	pio_sm_put(dpi->pio, sm,
++		   (vfp - 2) + ((vfp & 1) << 7) + (vbp << 8) +
++		   ((vfp - 3) << 16) + (((~vfp) & 1) << 23) + ((vbp + 1) << 24));
++	pio_sm_put(dpi->pio, sm, mode->vsync_end - mode->vsync_start - 1);
++	pio_sm_exec(dpi->pio, sm, pio_encode_pull(false, false));
++	pio_sm_exec(dpi->pio, sm, pio_encode_out(pio_y, 32));
++	pio_sm_exec(dpi->pio, sm, pio_encode_in(pio_y, 32));
++	pio_sm_exec(dpi->pio, sm, pio_encode_pull(false, false));
++	pio_sm_exec(dpi->pio, sm, pio_encode_out(pio_y, 32));
++	pio_sm_set_enabled(dpi->pio, sm, true);
++
++	return 0;
++}
++
++int rp1dpi_pio_start(struct rp1_dpi *dpi, const struct drm_display_mode *mode)
++{
++	int r;
++
++	if (!(mode->flags & DRM_MODE_FLAG_INTERLACE) || !dpi->gpio1_used)
++		return 0;
++
++	if (dpi->pio)
++		pio_close(dpi->pio);
++
++	dpi->pio = pio_open();
++	if (IS_ERR(dpi->pio)) {
++		drm_err(&dpi->drm, "Could not open PIO\n");
++		dpi->pio = NULL;
++		return -ENODEV;
++	}
++
++	r = rp1dpi_pio_vsync_ilace(dpi, mode);
++	if (r) {
++		drm_err(&dpi->drm, "Failed to initialize PIO\n");
++		rp1dpi_pio_stop(dpi);
++	}
++
++	return r;
++}
++
++void rp1dpi_pio_stop(struct rp1_dpi *dpi)
++{
++	if (dpi->pio) {
++		if (dpi->pio_stole_gpio2)
++			pio_gpio_set_function(dpi->pio, 2, GPIO_FUNC_FSEL1);
++		pio_close(dpi->pio);
++		dpi->pio_stole_gpio2 = false;
++		dpi->pio = NULL;
++	}
++}
diff --git a/target/linux/bcm27xx/patches-6.6/950-1459-ASoC-allo-piano-dac-plus-Fix-volume-limit-locking.patch b/target/linux/bcm27xx/patches-6.6/950-1459-ASoC-allo-piano-dac-plus-Fix-volume-limit-locking.patch
new file mode 100644
index 00000000000000..8e279df6883e58
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1459-ASoC-allo-piano-dac-plus-Fix-volume-limit-locking.patch
@@ -0,0 +1,79 @@
+From ac0cd73932aa1e371ffaf0b974855ed3cd22937f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 11 Dec 2024 13:47:30 +0000
+Subject: [PATCH] ASoC: allo-piano-dac-plus: Fix volume limit locking
+
+Calling snd_soc_limit_volume from within a kcontrol put handler seems
+to cause a deadlock as it attempts to claim a write lock that is already
+held. Call snd_soc_limit_volume from the main initialisation code
+instead, to avoid the recursive locking.
+
+See: https://github.com/raspberrypi/linux/issues/6527
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ sound/soc/bcm/allo-piano-dac-plus.c | 32 +++++++++++++----------------
+ 1 file changed, 14 insertions(+), 18 deletions(-)
+
+--- a/sound/soc/bcm/allo-piano-dac-plus.c
++++ b/sound/soc/bcm/allo-piano-dac-plus.c
+@@ -452,14 +452,6 @@ static int pcm512x_set_reg_sub(struct sn
+ 
+ 	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
+ 
+-	if (digital_gain_0db_limit) {
+-		ret = snd_soc_limit_volume(card, "Subwoofer Playback Volume",
+-					207);
+-		if (ret < 0)
+-			dev_warn(card->dev, "Failed to set volume limit: %d\n",
+-				ret);
+-	}
+-
+ 	// When in Dual Mono, Sub vol control should not set anything.
+ 	if (glb_ptr->dual_mode != 1) { //Not in Dual Mono mode
+ 
+@@ -562,14 +554,6 @@ static int pcm512x_set_reg_master(struct
+ 
+ 	rtd = snd_soc_get_pcm_runtime(card, &card->dai_link[0]);
+ 
+-	if (digital_gain_0db_limit) {
+-		ret = snd_soc_limit_volume(card, "Master Playback Volume",
+-					207);
+-		if (ret < 0)
+-			dev_warn(card->dev, "Failed to set volume limit: %d\n",
+-				ret);
+-	}
+-
+ 	if (glb_ptr->dual_mode == 1) { //in Dual Mono Mode
+ 
+ 		ret = snd_soc_component_write(asoc_rtd_to_codec(rtd, 0)->component,
+@@ -750,6 +734,18 @@ static int snd_allo_piano_dac_init(struc
+ 	if (digital_gain_0db_limit) {
+ 		int ret;
+ 
++		ret = snd_soc_limit_volume(card, "Master Playback Volume",
++					207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set master volume limit: %d\n",
++				ret);
++
++		ret = snd_soc_limit_volume(card, "Subwoofer Playback Volume",
++					207);
++		if (ret < 0)
++			dev_warn(card->dev, "Failed to set subwoofer volume limit: %d\n",
++				ret);
++
+ 		//Set volume limit on both dacs
+ 		for (i = 0; i < ARRAY_SIZE(codec_ctl_pfx); i++) {
+ 			char cname[256];
+@@ -757,8 +753,8 @@ static int snd_allo_piano_dac_init(struc
+ 			sprintf(cname, "%s %s", codec_ctl_pfx[i], codec_ctl_name[0]);
+ 			ret = snd_soc_limit_volume(card, cname, 207);
+ 			if (ret < 0)
+-				dev_warn(card->dev, "Failed to set volume limit: %d\n",
+-					ret);
++				dev_warn(card->dev, "Failed to set %s volume limit: %d\n",
++					 cname, ret);
+ 		}
+ 	}
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1460-drm-vc4-txp-Do-not-allow-24bpp-formats-when-transpos.patch b/target/linux/bcm27xx/patches-6.6/950-1460-drm-vc4-txp-Do-not-allow-24bpp-formats-when-transpos.patch
new file mode 100644
index 00000000000000..93de0f99a49c42
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1460-drm-vc4-txp-Do-not-allow-24bpp-formats-when-transpos.patch
@@ -0,0 +1,30 @@
+From af4ab4fb77dfc697c8ae068b18f27de1ee5d609f Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 11 Dec 2024 16:30:43 +0000
+Subject: [PATCH] drm: vc4: txp: Do not allow 24bpp formats when transposing
+
+The hardware doesn't support transposing to 24bpp (RGB888/BGR888)
+formats. There's no way to advertise this through DRM, so block
+it from atomic_check instead.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/vc4/vc4_txp.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/vc4/vc4_txp.c
++++ b/drivers/gpu/drm/vc4/vc4_txp.c
+@@ -272,6 +272,13 @@ static int vc4_txp_connector_atomic_chec
+ 		return -EINVAL;
+ 	}
+ 
++	if (conn_state->rotation & DRM_MODE_TRANSPOSE &&
++	    (fb->format->format == DRM_FORMAT_RGB888 ||
++	     fb->format->format == DRM_FORMAT_BGR888)) {
++		DRM_DEBUG_KMS("24bpp formats not supported when transposing\n");
++		return -EINVAL;
++	}
++
+ 	for (i = 0; i < ARRAY_SIZE(drm_fmts); i++) {
+ 		if (fb->format->format == drm_fmts[i])
+ 			break;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1461-drm-Validate-connector-rotation-has-one-bit-set-in-t.patch b/target/linux/bcm27xx/patches-6.6/950-1461-drm-Validate-connector-rotation-has-one-bit-set-in-t.patch
new file mode 100644
index 00000000000000..2a6115981a3d8f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1461-drm-Validate-connector-rotation-has-one-bit-set-in-t.patch
@@ -0,0 +1,29 @@
+From 0b216b3988e5b7035cd5ed8a9910eacbb3420ce0 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 12 Dec 2024 11:59:52 +0000
+Subject: [PATCH] drm: Validate connector rotation has one bit set in the
+ rotation property
+
+Copy the same validation logic as from the plane rotation property.
+
+Fixes: 8fec3ff87049 ("drm: Add a rotation parameter to connectors.")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/gpu/drm/drm_atomic_uapi.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/drm_atomic_uapi.c
++++ b/drivers/gpu/drm/drm_atomic_uapi.c
+@@ -812,6 +812,12 @@ static int drm_atomic_connector_set_prop
+ 	} else if (property == connector->privacy_screen_sw_state_property) {
+ 		state->privacy_screen_sw_state = val;
+ 	} else if (property == connector->rotation_property) {
++		if (!is_power_of_2(val & DRM_MODE_ROTATE_MASK)) {
++			drm_dbg_atomic(connector->dev,
++				       "[CONNECTOR:%d:%s] bad rotation bitmask: 0x%llx\n",
++				       connector->base.id, connector->name, val);
++			return -EINVAL;
++		}
+ 		state->rotation = val;
+ 	} else if (connector->funcs->atomic_set_property) {
+ 		return connector->funcs->atomic_set_property(connector,
diff --git a/target/linux/bcm27xx/patches-6.6/950-1462-ASoC-allo-piano-dac-plus-Suppress-517-errors.patch b/target/linux/bcm27xx/patches-6.6/950-1462-ASoC-allo-piano-dac-plus-Suppress-517-errors.patch
new file mode 100644
index 00000000000000..67bce02817ffda
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1462-ASoC-allo-piano-dac-plus-Suppress-517-errors.patch
@@ -0,0 +1,73 @@
+From 61494a7aa2ea887fa1cd1399a8db1317c87f661b Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 12 Dec 2024 13:05:41 +0000
+Subject: [PATCH] ASoC: allo-piano-dac-plus: Suppress -517 errors
+
+Use dev_err_probe to simplify the code and suppress EPROBE_DEFER errors.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ sound/soc/bcm/allo-piano-dac-plus.c | 37 ++++++++---------------------
+ 1 file changed, 10 insertions(+), 27 deletions(-)
+
+--- a/sound/soc/bcm/allo-piano-dac-plus.c
++++ b/sound/soc/bcm/allo-piano-dac-plus.c
+@@ -974,48 +974,31 @@ static int snd_allo_piano_dac_probe(stru
+ 
+ 		allo_piano_2_1_codecs[0].of_node =
+ 			of_parse_phandle(pdev->dev.of_node, "audio-codec", 0);
+-		if (!allo_piano_2_1_codecs[0].of_node) {
+-			dev_err(&pdev->dev,
+-				"Property 'audio-codec' missing or invalid\n");
+-			return -EINVAL;
+-		}
+-
+ 		allo_piano_2_1_codecs[1].of_node =
+ 			of_parse_phandle(pdev->dev.of_node, "audio-codec", 1);
+-		if (!allo_piano_2_1_codecs[1].of_node) {
+-			dev_err(&pdev->dev,
++		if (!allo_piano_2_1_codecs[0].of_node || !allo_piano_2_1_codecs[1].of_node)
++			return dev_err_probe(&pdev->dev, -EINVAL,
+ 				"Property 'audio-codec' missing or invalid\n");
+-			return -EINVAL;
+-		}
+ 
+ 		mute_gpio[0] = devm_gpiod_get_optional(&pdev->dev, "mute1",
+ 							GPIOD_OUT_LOW);
+-		if (IS_ERR(mute_gpio[0])) {
+-			ret = PTR_ERR(mute_gpio[0]);
+-			dev_err(&pdev->dev,
+-				"failed to get mute1 gpio6: %d\n", ret);
+-			return ret;
+-		}
++		if (IS_ERR(mute_gpio[0]))
++			return dev_err_probe(&pdev->dev, PTR_ERR(mute_gpio[0]),
++				"failed to get mute1 gpio\n");
+ 
+ 		mute_gpio[1] = devm_gpiod_get_optional(&pdev->dev, "mute2",
+ 							GPIOD_OUT_LOW);
+-		if (IS_ERR(mute_gpio[1])) {
+-			ret = PTR_ERR(mute_gpio[1]);
+-			dev_err(&pdev->dev,
+-				"failed to get mute2 gpio25: %d\n", ret);
+-			return ret;
+-		}
++		if (IS_ERR(mute_gpio[1]))
++			return dev_err_probe(&pdev->dev, PTR_ERR(mute_gpio[1]),
++				"failed to get mute2 gpio\n");
+ 
+ 		if (mute_gpio[0] && mute_gpio[1])
+ 			snd_allo_piano_dac.set_bias_level =
+ 				snd_allo_piano_set_bias_level;
+ 
+ 		ret = snd_soc_register_card(&snd_allo_piano_dac);
+-		if (ret < 0) {
+-			dev_err(&pdev->dev,
+-				"snd_soc_register_card() failed: %d\n", ret);
+-			return ret;
+-		}
++		if (ret < 0)
++			return dev_err_probe(&pdev->dev, ret, "snd_soc_register_card() failed\n");
+ 
+ 		if ((mute_gpio[0]) && (mute_gpio[1]))
+ 			snd_allo_piano_gpio_mute(&snd_allo_piano_dac);
diff --git a/target/linux/bcm27xx/patches-6.6/950-1463-drm-rp1-rp1-dpi-Fix-optional-dependency-on-RP1_PIO.patch b/target/linux/bcm27xx/patches-6.6/950-1463-drm-rp1-rp1-dpi-Fix-optional-dependency-on-RP1_PIO.patch
new file mode 100644
index 00000000000000..13c735eb4e66f9
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1463-drm-rp1-rp1-dpi-Fix-optional-dependency-on-RP1_PIO.patch
@@ -0,0 +1,98 @@
+From 80533a952218696c0ef1b346bab50dc401e6b74c Mon Sep 17 00:00:00 2001
+From: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Date: Thu, 12 Dec 2024 11:58:12 +0000
+Subject: [PATCH] drm: rp1: rp1-dpi: Fix optional dependency on RP1_PIO
+
+Add optional dependency to Kconfig, and conditionally compile
+PIO-dependent code. Add a mode validation function to reject
+interlaced modes when RP1_PIO is not present.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+---
+ drivers/gpu/drm/rp1/rp1-dpi/Kconfig       |  7 ++++++-
+ drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.c     | 16 ++++++++++++++++
+ drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_pio.c | 18 +++++++++++++++++-
+ 3 files changed, 39 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/rp1/rp1-dpi/Kconfig
++++ b/drivers/gpu/drm/rp1/rp1-dpi/Kconfig
+@@ -7,5 +7,10 @@ config DRM_RP1_DPI
+ 	select DRM_VRAM_HELPER
+ 	select DRM_TTM
+ 	select DRM_TTM_HELPER
++	depends on RP1_PIO || !RP1_PIO
+ 	help
+-	  Choose this option to enable Video Out on RP1
++	  Choose this option to enable DPI output on Raspberry Pi RP1
++
++	  There is an optional dependency on RP1_PIO, as the PIO block
++	  must be used to fix up interlaced sync. Interlaced DPI modes
++	  will be unavailable when RP1_PIO is not selected.
+--- a/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.c
++++ b/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.c
+@@ -217,12 +217,28 @@ static void rp1dpi_pipe_disable_vblank(s
+ 		rp1dpi_hw_vblank_ctrl(dpi, 0);
+ }
+ 
++static enum drm_mode_status rp1dpi_pipe_mode_valid(struct drm_simple_display_pipe *pipe,
++						   const struct drm_display_mode *mode)
++{
++#if !IS_REACHABLE(CONFIG_RP1_PIO)
++	if (mode->flags & DRM_MODE_FLAG_INTERLACE)
++		return MODE_NO_INTERLACE;
++#endif
++	if (mode->clock < 1000) /* 1 MHz */
++		return MODE_CLOCK_LOW;
++	if (mode->clock > 200000) /* 200 MHz */
++		return MODE_CLOCK_HIGH;
++
++	return MODE_OK;
++}
++
+ static const struct drm_simple_display_pipe_funcs rp1dpi_pipe_funcs = {
+ 	.enable	    = rp1dpi_pipe_enable,
+ 	.update	    = rp1dpi_pipe_update,
+ 	.disable    = rp1dpi_pipe_disable,
+ 	.enable_vblank	= rp1dpi_pipe_enable_vblank,
+ 	.disable_vblank = rp1dpi_pipe_disable_vblank,
++	.mode_valid = rp1dpi_pipe_mode_valid,
+ };
+ 
+ static const struct drm_mode_config_funcs rp1dpi_mode_funcs = {
+--- a/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_pio.c
++++ b/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_pio.c
+@@ -18,13 +18,16 @@
+ #include <linux/kernel.h>
+ #include <linux/errno.h>
+ #include <linux/of.h>
+-#include <linux/pio_rp1.h>
+ #include <linux/pinctrl/consumer.h>
+ #include <linux/platform_device.h>
+ #include <drm/drm_print.h>
+ 
+ #include "rp1_dpi.h"
+ 
++#if IS_REACHABLE(CONFIG_RP1_PIO)
++
++#include <linux/pio_rp1.h>
++
+ /*
+  * Start a PIO SM to generate an interrupt just after HSYNC onset, then another
+  * after a fixed delay (during which we assume HSYNC will have been deasserted).
+@@ -223,3 +226,16 @@ void rp1dpi_pio_stop(struct rp1_dpi *dpi
+ 		dpi->pio = NULL;
+ 	}
+ }
++
++#else /* !IS_REACHABLE(CONFIG_RP1_PIO) */
++
++int rp1dpi_pio_start(struct rp1_dpi *dpi, const struct drm_display_mode *mode)
++{
++	return -ENODEV;
++}
++
++void rp1dpi_pio_stop(struct rp1_dpi *dpi)
++{
++}
++
++#endif
diff --git a/target/linux/bcm27xx/patches-6.6/950-1464-serial-sc16is7xx-announce-support-for-SER_RS485_RTS_.patch b/target/linux/bcm27xx/patches-6.6/950-1464-serial-sc16is7xx-announce-support-for-SER_RS485_RTS_.patch
new file mode 100644
index 00000000000000..2f52823afc0f25
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1464-serial-sc16is7xx-announce-support-for-SER_RS485_RTS_.patch
@@ -0,0 +1,42 @@
+From 694247173f2e136196d7cb3a392c84cda65674d2 Mon Sep 17 00:00:00 2001
+From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Date: Mon, 7 Oct 2024 12:27:15 -0400
+Subject: [PATCH] serial: sc16is7xx: announce support for SER_RS485_RTS_ON_SEND
+
+commit 068d35a7be65fa3bca4bba21c269bfe0b39158a6 upstream.
+
+When specifying flag SER_RS485_RTS_ON_SEND in RS485 configuration,
+we get the following warning after commit 4afeced55baa ("serial: core:
+fix sanitizing check for RTS settings"):
+
+    invalid RTS setting, using RTS_AFTER_SEND instead
+
+This results in SER_RS485_RTS_AFTER_SEND being set and the
+driver always write to the register field SC16IS7XX_EFCR_RTS_INVERT_BIT,
+which breaks some hardware using these chips.
+
+The hardware supports both RTS_ON_SEND and RTS_AFTER_SEND modes, so fix
+this by announcing support for RTS_ON_SEND.
+
+Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Suggested-by: Konstantin Pugin <ria.freelander@gmail.com>
+Link: https://lore.kernel.org/lkml/20240422133219.2710061-2-ria.freelander@gmail.com
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Tested-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
+Link: https://lore.kernel.org/r/20241007162716.3122912-1-hugo@hugovil.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/tty/serial/sc16is7xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/tty/serial/sc16is7xx.c
++++ b/drivers/tty/serial/sc16is7xx.c
+@@ -1480,7 +1480,7 @@ static int sc16is7xx_setup_mctrl_ports(s
+ }
+ 
+ static const struct serial_rs485 sc16is7xx_rs485_supported = {
+-	.flags = SER_RS485_ENABLED | SER_RS485_RTS_AFTER_SEND,
++	.flags = SER_RS485_ENABLED | SER_RS485_RTS_ON_SEND | SER_RS485_RTS_AFTER_SEND,
+ 	.delay_rts_before_send = 1,
+ 	.delay_rts_after_send = 1,	/* Not supported but keep returning -EINVAL */
+ };
diff --git a/target/linux/bcm27xx/patches-6.6/950-1467-dtoverlays-Add-override-for-target-path-on-I2C-overl.patch b/target/linux/bcm27xx/patches-6.6/950-1467-dtoverlays-Add-override-for-target-path-on-I2C-overl.patch
new file mode 100644
index 00000000000000..d5f72d1c9226e7
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1467-dtoverlays-Add-override-for-target-path-on-I2C-overl.patch
@@ -0,0 +1,550 @@
+From b75fd2a9385e1358fa82218184e73513f9a5e57f Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 16 Dec 2024 15:11:08 +0000
+Subject: [PATCH] dtoverlays: Add override for target-path on I2C overlays
+
+To allow for attaching any of the standard overlays to a
+bitbashed i2c-gpio bus, allow specifying the target path for
+the overlay.
+
+Suggested by:
+https://forums.raspberrypi.com/viewtopic.php?t=381059
+
+Example:
+dtoverlay=i2c-gpio,i2c_gpio_sda=10,i2c_gpio_scl=11
+dtoverlay=mcp23017,i2c-path=/i2c@0
+dtoverlay=i2c-gpio,i2c_gpio_sda=12,i2c_gpio_scl=13,bus=3
+dtoverlay=mcp23017,i2c-path=/i2c@3
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README             | 59 +++++++++++++++++++
+ .../arm/boot/dts/overlays/ads1115-overlay.dts |  2 +
+ .../boot/dts/overlays/edt-ft5406-overlay.dts  |  3 +
+ arch/arm/boot/dts/overlays/goodix-overlay.dts |  4 +-
+ .../dts/overlays/hd44780-i2c-lcd-overlay.dts  |  4 +-
+ .../arm/boot/dts/overlays/i2c-fan-overlay.dts |  2 +
+ .../arm/boot/dts/overlays/i2c-mux-overlay.dts |  2 +
+ .../dts/overlays/i2c-pwm-pca9685a-overlay.dts |  2 +
+ .../arm/boot/dts/overlays/i2c-rtc-overlay.dts |  2 +
+ .../boot/dts/overlays/i2c-sensor-overlay.dts  |  2 +
+ .../boot/dts/overlays/ilitek251x-overlay.dts  |  4 +-
+ .../boot/dts/overlays/mcp23017-overlay.dts    |  2 +
+ .../arm/boot/dts/overlays/pca953x-overlay.dts | 30 +++++++++-
+ .../arm/boot/dts/overlays/pcf857x-overlay.dts | 30 +++++++++-
+ .../dts/overlays/sc16is750-i2c-overlay.dts    | 30 +++++++++-
+ .../dts/overlays/sc16is752-i2c-overlay.dts    | 30 +++++++++-
+ 16 files changed, 201 insertions(+), 7 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -555,6 +555,7 @@ Params: addr                    I2C bus
+                                 overlay - BCM2711 only)
+         i2c6                    Choose the I2C6 bus (configure with the i2c6
+                                 overlay - BCM2711 only)
++        i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
+         Channel parameters can be set for each enabled channel.
+         A maximum of 4 channels can be enabled (letters a thru d).
+@@ -1238,6 +1239,7 @@ Params: sizex                   Touchscr
+         addr                    Sets the address for the touch controller. Note
+                                 that the device must be configured to use the
+                                 specified address.
++        i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
+ 
+ Name:   enc28j60
+@@ -1439,6 +1441,7 @@ Info:   Enables I2C connected Goodix gt9
+ Load:   dtoverlay=goodix,<param>=<val>
+ Params: interrupt               GPIO used for interrupt (default 4)
+         reset                   GPIO used for reset (default 17)
++        i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
+ 
+ Name:   googlevoicehat-soundcard
+@@ -1730,6 +1733,7 @@ Params: addr                    I2C addr
+         display_height          Height of the display in characters (default 2)
+ 
+         display_width           Width of the display in characters (default 16)
++        i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
+ 
+ Name:   hd44780-lcd
+@@ -2095,6 +2099,8 @@ Params: addr                    Sets the
+         i2c6                    Choose the I2C6 bus (configure with the i2c6
+                                 overlay - BCM2711 only)
+ 
++        i2c-path                Override I2C path to allow for i2c-gpio buses
++
+         minpwm                  PWM setting for the fan when the SoC is below
+                                 mintemp (range 0-255. default 0)
+         maxpwm                  PWM setting for the fan when the SoC is above
+@@ -2165,6 +2171,8 @@ Params: pca9542                 Select t
+         i2c6                    Choose the I2C6 bus (configure with the i2c6
+                                 overlay - BCM2711 only)
+ 
++        i2c-path                Override I2C path to allow for i2c-gpio buses
++
+         disconnect_on_idle      Force the mux to disconnect all child buses
+                                 after every transaction.
+ 
+@@ -2186,6 +2194,7 @@ Params: addr                    I2C addr
+                                 overlay - BCM2711 only)
+         i2c6                    Choose the I2C6 bus (configure with the i2c6
+                                 overlay - BCM2711 only)
++        i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
+ 
+ Name:   i2c-rtc
+@@ -2255,6 +2264,8 @@ Params: abx80x                  Select o
+         i2c6                    Choose the I2C6 bus (configure with the i2c6
+                                 overlay - BCM2711 only)
+ 
++        i2c-path                Override I2C path to allow for i2c-gpio buses
++
+         addr                    Sets the address for the RTC. Note that the
+                                 device must be configured to use the specified
+                                 address.
+@@ -2519,6 +2530,8 @@ Params: addr                    Set the
+         i2c6                    Choose the I2C6 bus (configure with the i2c6
+                                 overlay - BCM2711 only)
+ 
++        i2c-path                Override I2C path to allow for i2c-gpio buses
++
+ 
+ Name:   i2c0
+ Info:   Change i2c0 pin usage. Not all pin combinations are usable on all
+@@ -2661,6 +2674,7 @@ Params: interrupt               GPIO use
+                                 touchscreen (in pixels)
+         sizey                   Touchscreen size y, vertical resolution of
+                                 touchscreen (in pixels)
++        i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
+ 
+ Name:   imx219
+@@ -3138,6 +3152,7 @@ Params: gpiopin                 Gpio pin
+                                 overlay - BCM2711 only)
+         i2c6                    Choose the I2C6 bus (configure with the i2c6
+                                 overlay - BCM2711 only)
++        i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
+ 
+ Name:   mcp23s17
+@@ -3587,6 +3602,17 @@ Params: addr                    I2C addr
+         cat9554                 Select the Onnn CAT9554 (8 bit)
+         pca9654                 Select the Onnn PCA9654 (8 bit)
+         xra1202                 Select the Exar XRA1202 (8 bit)
++        i2c0                    Choose the I2C0 bus on GPIOs 0&1
++        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c3                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++        i2c4                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++        i2c5                    Choose the I2C5 bus (configure with the i2c4
++                                overlay - BCM2711 only)
++        i2c6                    Choose the I2C6 bus (configure with the i2c6
++                                overlay - BCM2711 only)
++        i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
+ 
+ Name:   pcf857x
+@@ -3598,6 +3624,17 @@ Params: addr                    I2C addr
+         pcf8574a                Select the NXP PCF8574A (8 bit)
+         pcf8575                 Select the NXP PCF8575 (16 bit)
+         pca8574                 Select the NXP PCA8574 (8 bit)
++        i2c0                    Choose the I2C0 bus on GPIOs 0&1
++        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c3                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++        i2c4                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++        i2c5                    Choose the I2C5 bus (configure with the i2c4
++                                overlay - BCM2711 only)
++        i2c6                    Choose the I2C6 bus (configure with the i2c6
++                                overlay - BCM2711 only)
++        i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
+ 
+ Name:   pcie-32bit-dma
+@@ -4257,6 +4294,17 @@ Load:   dtoverlay=sc16is750-i2c,<param>=
+ Params: int_pin                 GPIO used for IRQ (default 24)
+         addr                    Address (default 0x48)
+         xtal                    On-board crystal frequency (default 14745600)
++        i2c0                    Choose the I2C0 bus on GPIOs 0&1
++        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c3                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++        i2c4                    Choose the I2C4 bus (configure with the i2c4
++                                overlay - BCM2711 only)
++        i2c5                    Choose the I2C5 bus (configure with the i2c5
++                                overlay - BCM2711 only)
++        i2c6                    Choose the I2C6 bus (configure with the i2c6
++                                overlay - BCM2711 only)
++        i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
+ 
+ Name:   sc16is750-spi0
+@@ -4275,6 +4323,17 @@ Load:   dtoverlay=sc16is752-i2c,<param>=
+ Params: int_pin                 GPIO used for IRQ (default 24)
+         addr                    Address (default 0x48)
+         xtal                    On-board crystal frequency (default 14745600)
++        i2c0                    Choose the I2C0 bus on GPIOs 0&1
++        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c3                    Choose the I2C3 bus (configure with the i2c3
++                                overlay - BCM2711 only)
++        i2c4                    Choose the I2C4 bus (configure with the i2c4
++                                overlay - BCM2711 only)
++        i2c5                    Choose the I2C5 bus (configure with the i2c5
++                                overlay - BCM2711 only)
++        i2c6                    Choose the I2C6 bus (configure with the i2c6
++                                overlay - BCM2711 only)
++        i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
+ 
+ Name:   sc16is752-spi0
+--- a/arch/arm/boot/dts/overlays/ads1115-overlay.dts
++++ b/arch/arm/boot/dts/overlays/ads1115-overlay.dts
+@@ -131,5 +131,7 @@
+ 		       <&frag100>, "target-path=i2c5";
+ 		i2c6 = <&frag100>, "target?=0",
+ 		       <&frag100>, "target-path=i2c6";
++		i2c-path = <&frag100>, "target?=0",
++		       <&frag100>, "target-path";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/edt-ft5406-overlay.dts
++++ b/arch/arm/boot/dts/overlays/edt-ft5406-overlay.dts
+@@ -41,6 +41,9 @@
+ 		i2c6 = <&ts_i2c_frag>, "target?=0",
+ 		       <&ts_i2c_frag>, "target-path=i2c6",
+ 		       <0>,"-0-1";
++		i2c-path = <&ts_i2c_frag>, "target?=0",
++		       <&ts_i2c_frag>, "target-path",
++		       <0>,"-0-1";
+ 		addr = <&ft5406>,"reg:0";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/goodix-overlay.dts
++++ b/arch/arm/boot/dts/overlays/goodix-overlay.dts
+@@ -16,7 +16,7 @@
+ 		};
+ 	};
+ 
+-	fragment@1 {
++	i2c_frag: fragment@1 {
+ 		target = <&i2c1>;
+ 		__overlay__ {
+ 			#address-cells = <1>;
+@@ -42,5 +42,7 @@
+ 			<&gt9271>,"irq-gpios:4";
+ 		reset = <&goodix_pins>,"brcm,pins:4",
+ 			<&gt9271>,"reset-gpios:4";
++		i2c-path = <&i2c_frag>, "target?=0",
++			   <&i2c_frag>, "target-path";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/hd44780-i2c-lcd-overlay.dts
++++ b/arch/arm/boot/dts/overlays/hd44780-i2c-lcd-overlay.dts
+@@ -4,7 +4,7 @@
+ / {
+ 	compatible = "brcm,bcm2835";
+ 
+-	fragment@0 {
++	i2c_frag: fragment@0 {
+ 		target = <&i2c_arm>;
+ 		__overlay__ {
+ 			status = "okay";
+@@ -52,6 +52,8 @@
+ 		display_height = <&lcd_screen>,"display-height-chars:0";
+ 		display_width = <&lcd_screen>,"display-width-chars:0";
+ 		addr = <&pcf857x>,"reg:0";
++		i2c-path = <&i2c_frag>, "target?=0",
++			   <&i2c_frag>, "target-path";
+ 	};
+ 
+ };
+--- a/arch/arm/boot/dts/overlays/i2c-fan-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-fan-overlay.dts
+@@ -93,6 +93,8 @@
+ 		       <&frag100>, "target-path=i2c5";
+ 		i2c6 = <&frag100>, "target?=0",
+ 		       <&frag100>, "target-path=i2c6";
++		i2c-path = <&frag100>, "target?=0",
++			   <&frag100>, "target-path";
+ 		addr =		<&emc2301>,"reg:0";
+ 		minpwm =	<&emc2301>,"emc2305,pwm-min.0";
+ 		maxpwm =	<&emc2301>,"emc2305,pwm-max.0";
+--- a/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
+@@ -175,6 +175,8 @@
+ 		       <&frag100>, "target-path=i2c5";
+ 		i2c6 = <&frag100>, "target?=0",
+ 		       <&frag100>, "target-path=i2c6";
++		i2c-path = <&frag100>, "target?=0",
++			   <&frag100>, "target-path";
+ 		disconnect_on_idle =
+ 			<&pca9542>,"idle-state:0=", <MUX_IDLE_DISCONNECT>,
+ 			<&pca9545>,"idle-state:0=", <MUX_IDLE_DISCONNECT>,
+--- a/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
+@@ -57,5 +57,7 @@
+ 		       <&frag100>, "target-path=i2c5";
+ 		i2c6 = <&frag100>, "target?=0",
+ 		       <&frag100>, "target-path=i2c6";
++		i2c-path = <&frag100>, "target?=0",
++			   <&frag100>, "target-path";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
+@@ -38,5 +38,7 @@
+ 		       <&frag100>, "target-path=i2c5";
+ 		i2c6 = <&frag100>, "target?=0",
+ 		       <&frag100>, "target-path=i2c6";
++		i2c-path = <&frag100>, "target?=0",
++			   <&frag100>, "target-path";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
+@@ -38,5 +38,7 @@
+ 		       <&frag100>, "target-path=i2c5";
+ 		i2c6 = <&frag100>, "target?=0",
+ 		       <&frag100>, "target-path=i2c6";
++		i2c-path = <&frag100>, "target?=0",
++			   <&frag100>, "target-path";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/ilitek251x-overlay.dts
++++ b/arch/arm/boot/dts/overlays/ilitek251x-overlay.dts
+@@ -16,7 +16,7 @@
+ 		};
+ 	};
+ 
+- 	fragment@1 {
++	frag1: fragment@1 {
+ 		target = <&i2c1>;
+ 		__overlay__ {
+ 			#address-cells = <1>;
+@@ -41,5 +41,7 @@
+ 			<&ili251x>,"interrupts:0";
+ 		sizex = <&ili251x>,"touchscreen-size-x:0";
+ 		sizey = <&ili251x>,"touchscreen-size-y:0";
++		i2c-path = <&frag1>, "target?=0",
++			   <&frag1>, "target-path";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
++++ b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
+@@ -98,6 +98,8 @@
+ 		       <&frag100>, "target-path=i2c5";
+ 		i2c6 = <&frag100>, "target?=0",
+ 		       <&frag100>, "target-path=i2c6";
++		i2c-path = <&frag100>, "target?=0",
++		       <&frag100>, "target-path";
+ 	};
+ };
+ 
+--- a/arch/arm/boot/dts/overlays/pca953x-overlay.dts
++++ b/arch/arm/boot/dts/overlays/pca953x-overlay.dts
+@@ -5,7 +5,7 @@
+ /{
+ 	compatible = "brcm,bcm2835";
+ 
+-	fragment@0 {
++	frag0: fragment@0 {
+ 		target = <&i2c_arm>;
+ 		__overlay__ {
+ 			#address-cells = <1>;
+@@ -204,6 +204,20 @@
+ 		};
+ 	};
+ 
++	fragment@100 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@101 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
+ 	__overrides__ {
+ 		addr = <&pca>,"reg:0";
+ 		pca6416 = <0>, "+1";
+@@ -236,5 +250,19 @@
+ 		cat9554 = <0>, "+28";
+ 		pca9654 = <0>, "+29";
+ 		xra1202 = <0>, "+30";
++		i2c0 = <&frag0>, "target:0=",<&i2c0>,
++			      <0>,"+100+101";
++		i2c_csi_dsi = <&frag0>, "target:0=",<&i2c_csi_dsi>,
++			      <0>,"+100+101";
++		i2c3 = <&frag0>, "target?=0",
++		       <&frag0>, "target-path=i2c3";
++		i2c4 = <&frag0>, "target?=0",
++		       <&frag0>, "target-path=i2c4";
++		i2c5 = <&frag0>, "target?=0",
++		       <&frag0>, "target-path=i2c5";
++		i2c6 = <&frag0>, "target?=0",
++		       <&frag0>, "target-path=i2c6";
++		i2c-path = <&frag0>, "target?=0",
++			   <&frag0>, "target-path";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/pcf857x-overlay.dts
++++ b/arch/arm/boot/dts/overlays/pcf857x-overlay.dts
+@@ -6,7 +6,7 @@
+ / {
+ 	compatible = "brcm,bcm2835";
+ 
+-	fragment@0 {
++	frag0: fragment@0 {
+ 		target = <&i2c_arm>;
+ 		__overlay__ {
+ 			#address-cells = <1>;
+@@ -22,11 +22,39 @@
+ 		};
+ 	};
+ 
++	fragment@100 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@101 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
+ 	__overrides__ {
+ 		pcf8574  = <&pcf857x>,"compatible=nxp,pcf8574",  <&pcf857x>,"reg:0=0x20";
+ 		pcf8574a = <&pcf857x>,"compatible=nxp,pcf8574a", <&pcf857x>,"reg:0=0x38";
+ 		pcf8575  = <&pcf857x>,"compatible=nxp,pcf8575",  <&pcf857x>,"reg:0=0x20";
+ 		pca8574  = <&pcf857x>,"compatible=nxp,pca8574", <&pcf857x>,"reg:0=0x20";
+ 		addr = <&pcf857x>,"reg:0";
++		i2c0 = <&frag0>, "target:0=",<&i2c0>,
++			      <0>,"+100+101";
++		i2c_csi_dsi = <&frag0>, "target:0=",<&i2c_csi_dsi>,
++			      <0>,"+100+101";
++		i2c3 = <&frag0>, "target?=0",
++		       <&frag0>, "target-path=i2c3";
++		i2c4 = <&frag0>, "target?=0",
++		       <&frag0>, "target-path=i2c4";
++		i2c5 = <&frag0>, "target?=0",
++		       <&frag0>, "target-path=i2c5";
++		i2c6 = <&frag0>, "target?=0",
++		       <&frag0>, "target-path=i2c6";
++		i2c-path = <&frag0>, "target?=0",
++			   <&frag0>, "target-path";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
++++ b/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
+@@ -4,7 +4,7 @@
+ / {
+ 	compatible = "brcm,bcm2835";
+ 
+-	fragment@0 {
++	frag0: fragment@0 {
+ 		target = <&i2c_arm>;
+ 		__overlay__ {
+ 			#address-cells = <1>;
+@@ -48,10 +48,38 @@
+ 		};
+ 	};
+ 
++	fragment@100 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@101 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
+ 	__overrides__ {
+ 		int_pin = <&sc16is750>,"interrupts:0", <&int_pins>,"brcm,pins:0",
+ 			  <&int_pins>,"reg:0";
+ 		addr = <&sc16is750>,"reg:0", <&sc16is750_clk>,"name";
+ 		xtal = <&sc16is750_clk>,"clock-frequency:0";
++		i2c0 = <&frag0>, "target:0=",<&i2c0>,
++			      <0>,"+100+101";
++		i2c_csi_dsi = <&frag0>, "target:0=",<&i2c_csi_dsi>,
++			      <0>,"+100+101";
++		i2c3 = <&frag0>, "target?=0",
++		       <&frag0>, "target-path=i2c3";
++		i2c4 = <&frag0>, "target?=0",
++		       <&frag0>, "target-path=i2c4";
++		i2c5 = <&frag0>, "target?=0",
++		       <&frag0>, "target-path=i2c5";
++		i2c6 = <&frag0>, "target?=0",
++		       <&frag0>, "target-path=i2c6";
++		i2c-path = <&frag0>, "target?=0",
++			   <&frag0>, "target-path";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
++++ b/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
+@@ -4,7 +4,7 @@
+ / {
+ 	compatible = "brcm,bcm2835";
+ 
+-	fragment@0 {
++	frag0: fragment@0 {
+ 		target = <&i2c_arm>;
+ 		__overlay__ {
+ 			#address-cells = <1>;
+@@ -48,10 +48,38 @@
+ 		};
+ 	};
+ 
++	fragment@100 {
++		target = <&i2c0if>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
++	fragment@101 {
++		target = <&i2c0mux>;
++		__dormant__ {
++			status = "okay";
++		};
++	};
++
+ 	__overrides__ {
+ 		int_pin = <&sc16is752>,"interrupts:0", <&int_pins>,"brcm,pins:0",
+ 			  <&int_pins>,"reg:0";
+ 		addr = <&sc16is752>,"reg:0",<&sc16is752_clk>,"name";
+ 		xtal = <&sc16is752_clk>,"clock-frequency:0";
++		i2c0 = <&frag0>, "target:0=",<&i2c0>,
++			      <0>,"+100+101";
++		i2c_csi_dsi = <&frag0>, "target:0=",<&i2c_csi_dsi>,
++			      <0>,"+100+101";
++		i2c3 = <&frag0>, "target?=0",
++		       <&frag0>, "target-path=i2c3";
++		i2c4 = <&frag0>, "target?=0",
++		       <&frag0>, "target-path=i2c4";
++		i2c5 = <&frag0>, "target?=0",
++		       <&frag0>, "target-path=i2c5";
++		i2c6 = <&frag0>, "target?=0",
++		       <&frag0>, "target-path=i2c6";
++		i2c-path = <&frag0>, "target?=0",
++			   <&frag0>, "target-path";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.6/950-1468-misc-rp1-pio-Support-larger-data-transfers.patch b/target/linux/bcm27xx/patches-6.6/950-1468-misc-rp1-pio-Support-larger-data-transfers.patch
new file mode 100644
index 00000000000000..3183fb580e3fce
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1468-misc-rp1-pio-Support-larger-data-transfers.patch
@@ -0,0 +1,127 @@
+From 4b0ca96738bb937529655a0062d60775f47b0f5e Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 16 Dec 2024 23:01:41 +0000
+Subject: [PATCH] misc: rp1-pio: Support larger data transfers
+
+Add a separate IOCTL for larger transfer with a 32-bit data_bytes
+field.
+
+See: https://github.com/raspberrypi/utils/issues/107
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/rp1-pio.c         | 43 +++++++++++++++++++++++++++++++---
+ include/uapi/misc/rp1_pio_if.h |  8 +++++++
+ 2 files changed, 48 insertions(+), 3 deletions(-)
+
+--- a/drivers/misc/rp1-pio.c
++++ b/drivers/misc/rp1-pio.c
+@@ -824,9 +824,9 @@ static int rp1_pio_sm_rx_user(struct rp1
+ 	return ret;
+ }
+ 
+-static int rp1_pio_sm_xfer_data(struct rp1_pio_client *client, void *param)
++static int rp1_pio_sm_xfer_data32(struct rp1_pio_client *client, void *param)
+ {
+-	struct rp1_pio_sm_xfer_data_args *args = param;
++	struct rp1_pio_sm_xfer_data32_args *args = param;
+ 	struct rp1_pio_device *pio = client->pio;
+ 	struct dma_info *dma;
+ 
+@@ -842,6 +842,19 @@ static int rp1_pio_sm_xfer_data(struct r
+ 		return rp1_pio_sm_rx_user(pio, dma, args->data, args->data_bytes);
+ }
+ 
++static int rp1_pio_sm_xfer_data(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_xfer_data_args *args = param;
++	struct rp1_pio_sm_xfer_data32_args args32;
++
++	args32.sm = args->sm;
++	args32.dir = args->dir;
++	args32.data_bytes = args->data_bytes;
++	args32.data = args->data;
++
++	return rp1_pio_sm_xfer_data32(client, &args32);
++}
++
+ struct handler_info {
+ 	const char *name;
+ 	int (*func)(struct rp1_pio_client *client, void *param);
+@@ -849,6 +862,7 @@ struct handler_info {
+ } ioctl_handlers[] = {
+ 	HANDLER(SM_CONFIG_XFER, sm_config_xfer),
+ 	HANDLER(SM_XFER_DATA, sm_xfer_data),
++	HANDLER(SM_XFER_DATA32, sm_xfer_data32),
+ 
+ 	HANDLER(CAN_ADD_PROGRAM, can_add_program),
+ 	HANDLER(ADD_PROGRAM, add_program),
+@@ -1032,13 +1046,23 @@ struct rp1_pio_sm_xfer_data_args_compat
+ 	compat_uptr_t data;
+ };
+ 
++struct rp1_pio_sm_xfer_data32_args_compat {
++	uint16_t sm;
++	uint16_t dir;
++	uint32_t data_bytes;
++	compat_uptr_t data;
++};
++
+ struct rp1_access_hw_args_compat {
+ 	uint32_t addr;
+ 	uint32_t len;
+ 	compat_uptr_t data;
+ };
+ 
+-#define PIO_IOC_SM_XFER_DATA_COMPAT _IOW(PIO_IOC_MAGIC, 1, struct rp1_pio_sm_xfer_data_args_compat)
++#define PIO_IOC_SM_XFER_DATA_COMPAT \
++	_IOW(PIO_IOC_MAGIC, 1, struct rp1_pio_sm_xfer_data_args_compat)
++#define PIO_IOC_SM_XFER_DATA32_COMPAT \
++	_IOW(PIO_IOC_MAGIC, 2, struct rp1_pio_sm_xfer_data32_args_compat)
+ #define PIO_IOC_READ_HW_COMPAT _IOW(PIO_IOC_MAGIC, 8, struct rp1_access_hw_args_compat)
+ #define PIO_IOC_WRITE_HW_COMPAT _IOW(PIO_IOC_MAGIC, 9, struct rp1_access_hw_args_compat)
+ 
+@@ -1061,6 +1085,19 @@ static long rp1_pio_compat_ioctl(struct
+ 		param.data = compat_ptr(compat_param.data);
+ 		return rp1_pio_sm_xfer_data(client, &param);
+ 	}
++	case PIO_IOC_SM_XFER_DATA32_COMPAT:
++	{
++		struct rp1_pio_sm_xfer_data32_args_compat compat_param;
++		struct rp1_pio_sm_xfer_data32_args param;
++
++		if (copy_from_user(&compat_param, compat_ptr(ioctl_param), sizeof(compat_param)))
++			return -EFAULT;
++		param.sm = compat_param.sm;
++		param.dir = compat_param.dir;
++		param.data_bytes = compat_param.data_bytes;
++		param.data = compat_ptr(compat_param.data);
++		return rp1_pio_sm_xfer_data32(client, &param);
++	}
+ 
+ 	case PIO_IOC_READ_HW_COMPAT:
+ 	case PIO_IOC_WRITE_HW_COMPAT:
+--- a/include/uapi/misc/rp1_pio_if.h
++++ b/include/uapi/misc/rp1_pio_if.h
+@@ -167,6 +167,13 @@ struct rp1_pio_sm_xfer_data_args {
+ 	void *data;
+ };
+ 
++struct rp1_pio_sm_xfer_data32_args {
++	uint16_t sm;
++	uint16_t dir;
++	uint32_t data_bytes;
++	void *data;
++};
++
+ struct rp1_access_hw_args {
+ 	uint32_t addr;
+ 	uint32_t len;
+@@ -177,6 +184,7 @@ struct rp1_access_hw_args {
+ 
+ #define PIO_IOC_SM_CONFIG_XFER _IOW(PIO_IOC_MAGIC, 0, struct rp1_pio_sm_config_xfer_args)
+ #define PIO_IOC_SM_XFER_DATA _IOW(PIO_IOC_MAGIC, 1, struct rp1_pio_sm_xfer_data_args)
++#define PIO_IOC_SM_XFER_DATA32 _IOW(PIO_IOC_MAGIC, 2, struct rp1_pio_sm_xfer_data32_args)
+ 
+ #define PIO_IOC_READ_HW _IOW(PIO_IOC_MAGIC, 8, struct rp1_access_hw_args)
+ #define PIO_IOC_WRITE_HW _IOW(PIO_IOC_MAGIC, 9, struct rp1_access_hw_args)
diff --git a/target/linux/bcm27xx/patches-6.6/950-1469-dtoverlays-Use-continuous-clock-mode-for-ov9281.patch b/target/linux/bcm27xx/patches-6.6/950-1469-dtoverlays-Use-continuous-clock-mode-for-ov9281.patch
new file mode 100644
index 00000000000000..c59e72eb139465
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1469-dtoverlays-Use-continuous-clock-mode-for-ov9281.patch
@@ -0,0 +1,34 @@
+From a4a4d7f9183bae11d81616346038e9efaba2fce1 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 16 Dec 2024 19:15:52 +0000
+Subject: [PATCH] dtoverlays: Use continuous clock mode for ov9281
+
+This increases the maximum frame rate from 247 to 260fps in
+10-bit mode.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/ov9281-overlay.dts | 1 -
+ arch/arm/boot/dts/overlays/ov9281.dtsi        | 1 -
+ 2 files changed, 2 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/ov9281-overlay.dts
++++ b/arch/arm/boot/dts/overlays/ov9281-overlay.dts
+@@ -29,7 +29,6 @@
+ 				csi_ep: endpoint {
+ 					remote-endpoint = <&cam_endpoint>;
+ 					data-lanes = <1 2>;
+-					clock-noncontinuous;
+ 				};
+ 			};
+ 		};
+--- a/arch/arm/boot/dts/overlays/ov9281.dtsi
++++ b/arch/arm/boot/dts/overlays/ov9281.dtsi
+@@ -19,7 +19,6 @@ cam_node: ov9281@60 {
+ 		cam_endpoint: endpoint {
+ 			clock-lanes = <0>;
+ 			data-lanes = <1 2>;
+-			clock-noncontinuous;
+ 			link-frequencies =
+ 				/bits/ 64 <400000000>;
+ 		};
diff --git a/target/linux/bcm27xx/patches-6.6/950-1470-overlays-goodix-Allow-override-i2c-address.patch b/target/linux/bcm27xx/patches-6.6/950-1470-overlays-goodix-Allow-override-i2c-address.patch
new file mode 100644
index 00000000000000..508896b3bda4ff
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1470-overlays-goodix-Allow-override-i2c-address.patch
@@ -0,0 +1,36 @@
+From 62085522016ee2dadbe8668a6a97919770020817 Mon Sep 17 00:00:00 2001
+From: Renjaya Raga Zenta <ragazenta@gmail.com>
+Date: Wed, 18 Dec 2024 16:44:32 +0700
+Subject: [PATCH] overlays: goodix: Allow override i2c address
+
+Some Goodix devices e.g. gt911 use address 0x5d instead of 0x14.
+So, make the address overridable.
+
+Signed-off-by: Renjaya Raga Zenta <ragazenta@gmail.com>
+---
+ arch/arm/boot/dts/overlays/README             | 3 ++-
+ arch/arm/boot/dts/overlays/goodix-overlay.dts | 1 +
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -1439,7 +1439,8 @@ Name:   goodix
+ Info:   Enables I2C connected Goodix gt9271 multiple touch controller using
+         GPIOs 4 and 17 (pins 7 and 11 on GPIO header) for interrupt and reset.
+ Load:   dtoverlay=goodix,<param>=<val>
+-Params: interrupt               GPIO used for interrupt (default 4)
++Params: addr                    I2C address (default 0x14)
++        interrupt               GPIO used for interrupt (default 4)
+         reset                   GPIO used for reset (default 17)
+         i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
+--- a/arch/arm/boot/dts/overlays/goodix-overlay.dts
++++ b/arch/arm/boot/dts/overlays/goodix-overlay.dts
+@@ -37,6 +37,7 @@
+ 	};
+ 
+ 	__overrides__ {
++		addr = <&gt9271>,"reg:0";
+ 		interrupt = <&goodix_pins>,"brcm,pins:0",
+ 			<&gt9271>,"interrupts:0",
+ 			<&gt9271>,"irq-gpios:4";
diff --git a/target/linux/bcm27xx/patches-6.6/950-1471-fixup-misc-Add-RP1-PIO-driver.patch b/target/linux/bcm27xx/patches-6.6/950-1471-fixup-misc-Add-RP1-PIO-driver.patch
new file mode 100644
index 00000000000000..5adc2a69c76ddc
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1471-fixup-misc-Add-RP1-PIO-driver.patch
@@ -0,0 +1,24 @@
+From cd26850713088942ca4f9a248a8bed1f0504a58f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 19 Dec 2024 15:11:40 +0000
+Subject: [PATCH] fixup! misc: Add RP1 PIO driver
+
+Change the Kconfig dependencies so that RP1_PIO depends on FIRMWARE_RP1,
+rather than selecting it.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/misc/Kconfig
++++ b/drivers/misc/Kconfig
+@@ -19,7 +19,7 @@ config BCM2835_SMI
+ 
+ config RP1_PIO
+ 	tristate "Raspberry Pi RP1 PIO driver"
+-	select FIRMWARE_RP1
++	depends on FIRMWARE_RP1 || COMPILE_TEST
+ 	default n
+ 	help
+ 		Driver providing control of the Raspberry Pi PIO block, as found in
diff --git a/target/linux/bcm27xx/patches-6.6/950-1473-misc-rp1-pio-More-logical-probe-sequence.patch b/target/linux/bcm27xx/patches-6.6/950-1473-misc-rp1-pio-More-logical-probe-sequence.patch
new file mode 100644
index 00000000000000..b67b0290105cd1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1473-misc-rp1-pio-More-logical-probe-sequence.patch
@@ -0,0 +1,81 @@
+From 468b525d45a726e4ba704b33c4eba53de47ac684 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 5 Dec 2024 16:03:39 +0000
+Subject: [PATCH] misc: rp1-pio: More logical probe sequence
+
+Sort the probe function initialisation into a more logical order.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/rp1-pio.c | 31 +++++++++++++++----------------
+ 1 file changed, 15 insertions(+), 16 deletions(-)
+
+--- a/drivers/misc/rp1-pio.c
++++ b/drivers/misc/rp1-pio.c
+@@ -1153,6 +1153,10 @@ static int rp1_pio_probe(struct platform
+ 			return -EINVAL;
+ 	}
+ 
++	pdev->id = of_alias_get_id(pdev->dev.of_node, "pio");
++	if (pdev->id < 0)
++		return dev_err_probe(dev, pdev->id, "alias is missing\n");
++
+ 	fw = devm_rp1_firmware_get(dev, dev->of_node);
+ 	if (IS_ERR(fw))
+ 		return PTR_ERR(fw);
+@@ -1185,31 +1189,26 @@ static int rp1_pio_probe(struct platform
+ 		goto out_err;
+ 	}
+ 
+-	cdev_init(&pio->cdev, &rp1_pio_fops);
+-	ret = cdev_add(&pio->cdev, pio->dev_num, 1);
+-	if (ret) {
+-		dev_err(dev, "cdev_add failed (err %d)\n", ret);
+-		goto out_unregister;
+-	}
+-
+ 	pio->dev_class = class_create(DRIVER_NAME);
+ 	if (IS_ERR(pio->dev_class)) {
+ 		ret = PTR_ERR(pio->dev_class);
+ 		dev_err(dev, "class_create failed (err %d)\n", ret);
+-		goto out_cdev_del;
++		goto out_unregister;
+ 	}
+-	pdev->id = of_alias_get_id(pdev->dev.of_node, "pio");
+-	if (pdev->id < 0) {
+-		dev_err(dev, "alias is missing\n");
+-		return -EINVAL;
++
++	cdev_init(&pio->cdev, &rp1_pio_fops);
++	ret = cdev_add(&pio->cdev, pio->dev_num, 1);
++	if (ret) {
++		dev_err(dev, "cdev_add failed (err %d)\n", ret);
+ 		goto out_class_destroy;
+ 	}
++
+ 	sprintf(dev_name, "pio%d", pdev->id);
+ 	cdev = device_create(pio->dev_class, NULL, pio->dev_num, NULL, dev_name);
+ 	if (IS_ERR(cdev)) {
+ 		ret = PTR_ERR(cdev);
+ 		dev_err(dev, "%s: device_create failed (err %d)\n", __func__, ret);
+-		goto out_class_destroy;
++		goto out_cdev_del;
+ 	}
+ 
+ 	g_pio = pio;
+@@ -1217,12 +1216,12 @@ static int rp1_pio_probe(struct platform
+ 	dev_info(dev, "Created instance as %s\n", dev_name);
+ 	return 0;
+ 
+-out_class_destroy:
+-	class_destroy(pio->dev_class);
+-
+ out_cdev_del:
+ 	cdev_del(&pio->cdev);
+ 
++out_class_destroy:
++	class_destroy(pio->dev_class);
++
+ out_unregister:
+ 	unregister_chrdev_region(pio->dev_num, 1);
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1474-misc-rp1-pio-Convert-floats-to-24.8-fixed-point.patch b/target/linux/bcm27xx/patches-6.6/950-1474-misc-rp1-pio-Convert-floats-to-24.8-fixed-point.patch
new file mode 100644
index 00000000000000..d843f1f913a7ca
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1474-misc-rp1-pio-Convert-floats-to-24.8-fixed-point.patch
@@ -0,0 +1,92 @@
+From 5c07ba20630a629399eaa6583457aca93ff74606 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 9 Dec 2024 09:58:29 +0000
+Subject: [PATCH] misc: rp1-pio: Convert floats to 24.8 fixed point
+
+Floating point arithmetic is not supported in the kernel, so use fixed
+point instead.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ include/linux/pio_rp1.h | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+--- a/include/linux/pio_rp1.h
++++ b/include/linux/pio_rp1.h
+@@ -171,6 +171,10 @@ enum gpio_drive_strength {
+ 	GPIO_DRIVE_STRENGTH_12MA = 3
+ };
+ 
++struct fp24_8 {
++	uint32_t val;
++};
++
+ typedef rp1_pio_sm_config pio_sm_config;
+ 
+ typedef struct rp1_pio_client *PIO;
+@@ -218,6 +222,13 @@ void pio_close(PIO pio);
+ int pio_sm_config_xfer(PIO pio, uint sm, uint dir, uint buf_size, uint buf_count);
+ int pio_sm_xfer_data(PIO pio, uint sm, uint dir, uint data_bytes, void *data);
+ 
++static inline struct fp24_8 make_fp24_8(uint mul, uint div)
++{
++	struct fp24_8 res = { .val = ((unsigned long long)mul << 8) / div };
++
++	return res;
++}
++
+ static inline bool pio_can_add_program(struct rp1_pio_client *client,
+ 				       const pio_program_t *program)
+ {
+@@ -396,16 +407,18 @@ static inline int pio_sm_clear_fifos(str
+ 	return rp1_pio_sm_clear_fifos(client, &args);
+ }
+ 
+-static inline bool pio_calculate_clkdiv_from_float(float div, uint16_t *div_int,
++static inline bool pio_calculate_clkdiv_from_fp24_8(struct fp24_8 div, uint16_t *div_int,
+ 						   uint8_t *div_frac)
+ {
+-	if (bad_params_if(NULL, div < 1 || div > 65536))
++	uint inum = (div.val >> 8);
++
++	if (bad_params_if(NULL, inum < 1 || inum > 65536))
+ 		return false;
+-	*div_int = (uint16_t)div;
++	*div_int = (uint16_t)inum;
+ 	if (*div_int == 0)
+ 		*div_frac = 0;
+ 	else
+-		*div_frac = (uint8_t)((div - (float)*div_int) * (1u << 8u));
++		*div_frac = div.val & 0xff;
+ 	return true;
+ }
+ 
+@@ -421,11 +434,11 @@ static inline int pio_sm_set_clkdiv_int_
+ 	return rp1_pio_sm_set_clkdiv(client, &args);
+ }
+ 
+-static inline int pio_sm_set_clkdiv(struct rp1_pio_client *client, uint sm, float div)
++static inline int pio_sm_set_clkdiv(struct rp1_pio_client *client, uint sm, struct fp24_8 div)
+ {
+ 	struct rp1_pio_sm_set_clkdiv_args args = { .sm = sm };
+ 
+-	if (!pio_calculate_clkdiv_from_float(div, &args.div_int, &args.div_frac))
++	if (!pio_calculate_clkdiv_from_fp24_8(div, &args.div_int, &args.div_frac))
+ 		return -EINVAL;
+ 	return rp1_pio_sm_set_clkdiv(client, &args);
+ }
+@@ -745,12 +758,12 @@ static inline void sm_config_set_clkdiv_
+ 		(((uint)div_int) << PROC_PIO_SM0_CLKDIV_INT_LSB);
+ }
+ 
+-static inline void sm_config_set_clkdiv(pio_sm_config *c, float div)
++static inline void sm_config_set_clkdiv(pio_sm_config *c, struct fp24_8 div)
+ {
+ 	uint16_t div_int;
+ 	uint8_t div_frac;
+ 
+-	pio_calculate_clkdiv_from_float(div, &div_int, &div_frac);
++	pio_calculate_clkdiv_from_fp24_8(div, &div_int, &div_frac);
+ 	sm_config_set_clkdiv_int_frac(c, div_int, div_frac);
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1475-misc-rp1-pio-Minor-cosmetic-tweaks.patch b/target/linux/bcm27xx/patches-6.6/950-1475-misc-rp1-pio-Minor-cosmetic-tweaks.patch
new file mode 100644
index 00000000000000..439698d3ef3091
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1475-misc-rp1-pio-Minor-cosmetic-tweaks.patch
@@ -0,0 +1,42 @@
+From 75203c6641cfe47dfb817b095430021b0981ff47 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 10 Dec 2024 12:06:14 +0000
+Subject: [PATCH] misc: rp1-pio: Minor cosmetic tweaks
+
+No functional change.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/rp1-pio.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/misc/rp1-pio.c
++++ b/drivers/misc/rp1-pio.c
+@@ -683,7 +683,7 @@ err_dma_free:
+ }
+ 
+ static int rp1_pio_sm_tx_user(struct rp1_pio_device *pio, struct dma_info *dma,
+-			      const void __user *userbuf, size_t bytes)
++				  const void __user *userbuf, size_t bytes)
+ {
+ 	struct platform_device *pdev = pio->pdev;
+ 	struct dma_async_tx_descriptor *desc;
+@@ -757,7 +757,7 @@ static int rp1_pio_sm_tx_user(struct rp1
+ }
+ 
+ static int rp1_pio_sm_rx_user(struct rp1_pio_device *pio, struct dma_info *dma,
+-			      void __user *userbuf, size_t bytes)
++				  void __user *userbuf, size_t bytes)
+ {
+ 	struct platform_device *pdev = pio->pdev;
+ 	struct dma_async_tx_descriptor *desc;
+@@ -809,8 +809,7 @@ static int rp1_pio_sm_rx_user(struct rp1
+ 		desc->callback = rp1_pio_sm_dma_callback;
+ 		desc->callback_param = dma;
+ 
+-		// Submit the buffer - the callback will kick the semaphore
+-
++		/* Submit the buffer - the callback will kick the semaphore */
+ 		ret = dmaengine_submit(desc);
+ 		if (ret < 0)
+ 			break;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1476-misc-rp1-pio-Add-in-kernel-DMA-support.patch b/target/linux/bcm27xx/patches-6.6/950-1476-misc-rp1-pio-Add-in-kernel-DMA-support.patch
new file mode 100644
index 00000000000000..facfb23c95ce29
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1476-misc-rp1-pio-Add-in-kernel-DMA-support.patch
@@ -0,0 +1,508 @@
+From fddd3e9318dbf01fb763b6880021abc558fce8e6 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 12 Dec 2024 17:09:27 +0000
+Subject: [PATCH] misc: rp1-pio: Add in-kernel DMA support
+
+Add kernel-facing implementations of pio_sm_config_xfer and
+pio_xm_xfer_data.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/rp1-pio.c  | 208 ++++++++++++++++++++++++++++++----------
+ include/linux/pio_rp1.h |  60 ++++++++++--
+ 2 files changed, 210 insertions(+), 58 deletions(-)
+
+--- a/drivers/misc/rp1-pio.c
++++ b/drivers/misc/rp1-pio.c
+@@ -61,9 +61,15 @@
+ #define DMA_BOUNCE_BUFFER_SIZE 0x1000
+ #define DMA_BOUNCE_BUFFER_COUNT 4
+ 
++struct dma_xfer_state {
++	struct dma_info *dma;
++	void (*callback)(void *param);
++	void *callback_param;
++};
++
+ struct dma_buf_info {
+ 	void *buf;
+-	dma_addr_t phys;
++	dma_addr_t dma_addr;
+ 	struct scatterlist sgl;
+ };
+ 
+@@ -572,21 +578,34 @@ static void rp1_pio_sm_dma_callback(void
+ 	up(&dma->buf_sem);
+ }
+ 
++static void rp1_pio_sm_kernel_dma_callback(void *param)
++{
++	struct dma_xfer_state *dxs = param;
++
++	dxs->dma->tail_idx++;
++	up(&dxs->dma->buf_sem);
++
++	dxs->callback(dxs->callback_param);
++
++	kfree(dxs);
++}
++
+ static void rp1_pio_sm_dma_free(struct device *dev, struct dma_info *dma)
+ {
+ 	dmaengine_terminate_all(dma->chan);
+ 	while (dma->buf_count > 0) {
+ 		dma->buf_count--;
+ 		dma_free_coherent(dev, ROUND_UP(dma->buf_size, PAGE_SIZE),
+-				  dma->bufs[dma->buf_count].buf, dma->bufs[dma->buf_count].phys);
++				  dma->bufs[dma->buf_count].buf,
++				  dma->bufs[dma->buf_count].dma_addr);
+ 	}
+ 
+ 	dma_release_channel(dma->chan);
+ }
+ 
+-static int rp1_pio_sm_config_xfer(struct rp1_pio_client *client, void *param)
++static int rp1_pio_sm_config_xfer_internal(struct rp1_pio_client *client, uint sm, uint dir,
++					   uint buf_size, uint buf_count)
+ {
+-	struct rp1_pio_sm_config_xfer_args *args = param;
+ 	struct rp1_pio_sm_set_dmactrl_args set_dmactrl_args;
+ 	struct rp1_pio_device *pio = client->pio;
+ 	struct platform_device *pdev = pio->pdev;
+@@ -596,17 +615,18 @@ static int rp1_pio_sm_config_xfer(struct
+ 	struct dma_info *dma;
+ 	uint32_t dma_mask;
+ 	char chan_name[4];
+-	uint buf_size;
+ 	int ret = 0;
+ 
+-	if (args->sm >= RP1_PIO_SMS_COUNT || args->dir >= RP1_PIO_DIR_COUNT ||
+-	    !args->buf_size || (args->buf_size & 3) ||
+-	    !args->buf_count || args->buf_count > DMA_BOUNCE_BUFFER_COUNT)
++	if (sm >= RP1_PIO_SMS_COUNT || dir >= RP1_PIO_DIR_COUNT)
++		return -EINVAL;
++	if ((buf_count || buf_size) &&
++	    (!buf_size || (buf_size & 3) ||
++	     !buf_count || buf_count > DMA_BOUNCE_BUFFER_COUNT))
+ 		return -EINVAL;
+ 
+-	dma_mask = 1 << (args->sm * 2 + args->dir);
++	dma_mask = 1 << (sm * 2 + dir);
+ 
+-	dma = &pio->dma_configs[args->sm][args->dir];
++	dma = &pio->dma_configs[sm][dir];
+ 
+ 	spin_lock(&pio->lock);
+ 	if (pio->claimed_dmas & dma_mask)
+@@ -615,16 +635,16 @@ static int rp1_pio_sm_config_xfer(struct
+ 	client->claimed_dmas |= dma_mask;
+ 	spin_unlock(&pio->lock);
+ 
+-	dma->buf_size = args->buf_size;
++	dma->buf_size = buf_size;
+ 	/* Round up the allocations */
+-	buf_size = ROUND_UP(args->buf_size, PAGE_SIZE);
++	buf_size = ROUND_UP(buf_size, PAGE_SIZE);
+ 	sema_init(&dma->buf_sem, 0);
+ 
+ 	/* Allocate and configure a DMA channel */
+ 	/* Careful - each SM FIFO has its own DREQ value */
+-	chan_name[0] = (args->dir == RP1_PIO_DIR_TO_SM) ? 't' : 'r';
++	chan_name[0] = (dir == RP1_PIO_DIR_TO_SM) ? 't' : 'r';
+ 	chan_name[1] = 'x';
+-	chan_name[2] = '0' + args->sm;
++	chan_name[2] = '0' + sm;
+ 	chan_name[3] = '\0';
+ 
+ 	dma->chan = dma_request_chan(dev, chan_name);
+@@ -632,37 +652,37 @@ static int rp1_pio_sm_config_xfer(struct
+ 		return PTR_ERR(dma->chan);
+ 
+ 	/* Alloc and map bounce buffers */
+-	for (dma->buf_count = 0; dma->buf_count < args->buf_count; dma->buf_count++) {
++	for (dma->buf_count = 0; dma->buf_count < buf_count; dma->buf_count++) {
+ 		struct dma_buf_info *dbi = &dma->bufs[dma->buf_count];
+ 
+ 		dbi->buf = dma_alloc_coherent(dma->chan->device->dev, buf_size,
+-					      &dbi->phys, GFP_KERNEL);
++					      &dbi->dma_addr, GFP_KERNEL);
+ 		if (!dbi->buf) {
+ 			ret = -ENOMEM;
+ 			goto err_dma_free;
+ 		}
+ 		sg_init_table(&dbi->sgl, 1);
+-		sg_dma_address(&dbi->sgl) = dbi->phys;
++		sg_dma_address(&dbi->sgl) = dbi->dma_addr;
+ 	}
+ 
+ 	fifo_addr = pio->phys_addr;
+-	fifo_addr += args->sm * (RP1_PIO_FIFO_TX1 - RP1_PIO_FIFO_TX0);
+-	fifo_addr += (args->dir == RP1_PIO_DIR_TO_SM) ? RP1_PIO_FIFO_TX0 : RP1_PIO_FIFO_RX0;
++	fifo_addr += sm * (RP1_PIO_FIFO_TX1 - RP1_PIO_FIFO_TX0);
++	fifo_addr += (dir == RP1_PIO_DIR_TO_SM) ? RP1_PIO_FIFO_TX0 : RP1_PIO_FIFO_RX0;
+ 
+ 	config.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ 	config.dst_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;
+ 	config.src_addr = fifo_addr;
+ 	config.dst_addr = fifo_addr;
+-	config.direction = (args->dir == RP1_PIO_DIR_TO_SM) ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM;
++	config.direction = (dir == RP1_PIO_DIR_TO_SM) ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM;
+ 
+ 	ret = dmaengine_slave_config(dma->chan, &config);
+ 	if (ret)
+ 		goto err_dma_free;
+ 
+-	set_dmactrl_args.sm = args->sm;
+-	set_dmactrl_args.is_tx = (args->dir == RP1_PIO_DIR_TO_SM);
++	set_dmactrl_args.sm = sm;
++	set_dmactrl_args.is_tx = (dir == RP1_PIO_DIR_TO_SM);
+ 	set_dmactrl_args.ctrl = RP1_PIO_DMACTRL_DEFAULT;
+-	if (args->dir == RP1_PIO_DIR_FROM_SM)
++	if (dir == RP1_PIO_DIR_FROM_SM)
+ 		set_dmactrl_args.ctrl = (RP1_PIO_DMACTRL_DEFAULT & ~0x1f) | 1;
+ 
+ 	ret = rp1_pio_sm_set_dmactrl(client, &set_dmactrl_args);
+@@ -682,6 +702,14 @@ err_dma_free:
+ 	return ret;
+ }
+ 
++static int rp1_pio_sm_config_xfer_user(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_config_xfer_args *args = param;
++
++	return rp1_pio_sm_config_xfer_internal(client, args->sm, args->dir,
++					       args->buf_size, args->buf_count);
++}
++
+ static int rp1_pio_sm_tx_user(struct rp1_pio_device *pio, struct dma_info *dma,
+ 				  const void __user *userbuf, size_t bytes)
+ {
+@@ -723,7 +751,7 @@ static int rp1_pio_sm_tx_user(struct rp1
+ 					       DMA_PREP_INTERRUPT | DMA_CTRL_ACK |
+ 					       DMA_PREP_FENCE);
+ 		if (!desc) {
+-			dev_err(dev, "DMA preparation failedzn");
++			dev_err(dev, "DMA preparation failed\n");
+ 			ret = -EIO;
+ 			break;
+ 		}
+@@ -779,7 +807,7 @@ static int rp1_pio_sm_rx_user(struct rp1
+ 		if (!bytes || dma->head_idx - dma->tail_idx == dma->buf_count) {
+ 			if (down_timeout(&dma->buf_sem,
+ 				msecs_to_jiffies(1000))) {
+-				dev_err(dev, "DMA wait timed out");
++				dev_err(dev, "DMA wait timed out\n");
+ 				ret = -ETIMEDOUT;
+ 				break;
+ 			}
+@@ -801,7 +829,7 @@ static int rp1_pio_sm_rx_user(struct rp1
+ 					       DMA_PREP_INTERRUPT | DMA_CTRL_ACK |
+ 					       DMA_PREP_FENCE);
+ 		if (!desc) {
+-			dev_err(dev, "DMA preparation failed");
++			dev_err(dev, "DMA preparation failed\n");
+ 			ret = -EIO;
+ 			break;
+ 		}
+@@ -823,7 +851,7 @@ static int rp1_pio_sm_rx_user(struct rp1
+ 	return ret;
+ }
+ 
+-static int rp1_pio_sm_xfer_data32(struct rp1_pio_client *client, void *param)
++static int rp1_pio_sm_xfer_data32_user(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_xfer_data32_args *args = param;
+ 	struct rp1_pio_device *pio = client->pio;
+@@ -841,7 +869,7 @@ static int rp1_pio_sm_xfer_data32(struct
+ 		return rp1_pio_sm_rx_user(pio, dma, args->data, args->data_bytes);
+ }
+ 
+-static int rp1_pio_sm_xfer_data(struct rp1_pio_client *client, void *param)
++static int rp1_pio_sm_xfer_data_user(struct rp1_pio_client *client, void *param)
+ {
+ 	struct rp1_pio_sm_xfer_data_args *args = param;
+ 	struct rp1_pio_sm_xfer_data32_args args32;
+@@ -851,17 +879,97 @@ static int rp1_pio_sm_xfer_data(struct r
+ 	args32.data_bytes = args->data_bytes;
+ 	args32.data = args->data;
+ 
+-	return rp1_pio_sm_xfer_data32(client, &args32);
++	return rp1_pio_sm_xfer_data32_user(client, &args32);
++}
++
++int rp1_pio_sm_config_xfer(struct rp1_pio_client *client, uint sm, uint dir,
++			      uint buf_size, uint buf_count)
++{
++	return rp1_pio_sm_config_xfer_internal(client, sm, dir, buf_size, buf_count);
++}
++EXPORT_SYMBOL_GPL(rp1_pio_sm_config_xfer);
++
++int rp1_pio_sm_xfer_data(struct rp1_pio_client *client, uint sm, uint dir,
++				    uint data_bytes, void *data, dma_addr_t dma_addr,
++				    void (*callback)(void *param), void *param)
++{
++	struct rp1_pio_device *pio = client->pio;
++	struct platform_device *pdev = pio->pdev;
++	struct dma_async_tx_descriptor *desc;
++	struct dma_xfer_state *dxs = NULL;
++	struct device *dev = &pdev->dev;
++	struct dma_buf_info *dbi = NULL;
++	struct scatterlist sg;
++	struct dma_info *dma;
++	int ret = 0;
++
++	if (sm >= RP1_PIO_SMS_COUNT || dir >= RP1_PIO_DIR_COUNT)
++		return -EINVAL;
++
++	dma = &pio->dma_configs[sm][dir];
++
++	if (!dma_addr) {
++		dxs = kmalloc(sizeof(*dxs), GFP_KERNEL);
++		dxs->dma = dma;
++		dxs->callback = callback;
++		dxs->callback_param = param;
++		callback = rp1_pio_sm_kernel_dma_callback;
++		param = dxs;
++
++		if (!dma->buf_count || data_bytes > dma->buf_size)
++			return -EINVAL;
++
++		/* Grab a dma buffer */
++		if (dma->head_idx - dma->tail_idx == dma->buf_count) {
++			if (down_timeout(&dma->buf_sem, msecs_to_jiffies(1000))) {
++				dev_err(dev, "DMA wait timed out\n");
++				return -ETIMEDOUT;
++			}
++		}
++
++		dbi = &dma->bufs[dma->head_idx % dma->buf_count];
++		dma_addr = dbi->dma_addr;
++
++		if (dir == PIO_DIR_TO_SM)
++			memcpy(dbi->buf, data, data_bytes);
++	}
++
++	sg_init_table(&sg, 1);
++	sg_dma_address(&sg) = dma_addr;
++	sg_dma_len(&sg) = data_bytes;
++
++	desc = dmaengine_prep_slave_sg(dma->chan, &sg, 1,
++					   (dir == PIO_DIR_TO_SM) ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM,
++					   DMA_PREP_INTERRUPT | DMA_CTRL_ACK |
++					   DMA_PREP_FENCE);
++	if (!desc) {
++		dev_err(dev, "DMA preparation failed\n");
++		return -EIO;
++	}
++
++	desc->callback = callback;
++	desc->callback_param = param;
++
++	ret = dmaengine_submit(desc);
++	if (ret < 0) {
++		dev_err(dev, "dmaengine_submit failed (%d)\n", ret);
++		return ret;
++	}
++
++	dma_async_issue_pending(dma->chan);
++
++	return 0;
+ }
++EXPORT_SYMBOL_GPL(rp1_pio_sm_xfer_data);
+ 
+ struct handler_info {
+ 	const char *name;
+ 	int (*func)(struct rp1_pio_client *client, void *param);
+ 	int argsize;
+ } ioctl_handlers[] = {
+-	HANDLER(SM_CONFIG_XFER, sm_config_xfer),
+-	HANDLER(SM_XFER_DATA, sm_xfer_data),
+-	HANDLER(SM_XFER_DATA32, sm_xfer_data32),
++	HANDLER(SM_CONFIG_XFER, sm_config_xfer_user),
++	HANDLER(SM_XFER_DATA, sm_xfer_data_user),
++	HANDLER(SM_XFER_DATA32, sm_xfer_data32_user),
+ 
+ 	HANDLER(CAN_ADD_PROGRAM, can_add_program),
+ 	HANDLER(ADD_PROGRAM, add_program),
+@@ -902,7 +1010,7 @@ struct handler_info {
+ 	HANDLER(WRITE_HW, write_hw),
+ };
+ 
+-struct rp1_pio_client *pio_open(void)
++struct rp1_pio_client *rp1_pio_open(void)
+ {
+ 	struct rp1_pio_client *client;
+ 
+@@ -914,9 +1022,9 @@ struct rp1_pio_client *pio_open(void)
+ 
+ 	return client;
+ }
+-EXPORT_SYMBOL_GPL(pio_open);
++EXPORT_SYMBOL_GPL(rp1_pio_open);
+ 
+-void pio_close(struct rp1_pio_client *client)
++void rp1_pio_close(struct rp1_pio_client *client)
+ {
+ 	struct rp1_pio_device *pio = client->pio;
+ 	uint claimed_dmas = client->claimed_dmas;
+@@ -958,31 +1066,31 @@ void pio_close(struct rp1_pio_client *cl
+ 
+ 	kfree(client);
+ }
+-EXPORT_SYMBOL_GPL(pio_close);
++EXPORT_SYMBOL_GPL(rp1_pio_close);
+ 
+-void pio_set_error(struct rp1_pio_client *client, int err)
++void rp1_pio_set_error(struct rp1_pio_client *client, int err)
+ {
+ 	client->error = err;
+ }
+-EXPORT_SYMBOL_GPL(pio_set_error);
++EXPORT_SYMBOL_GPL(rp1_pio_set_error);
+ 
+-int pio_get_error(const struct rp1_pio_client *client)
++int rp1_pio_get_error(const struct rp1_pio_client *client)
+ {
+ 	return client->error;
+ }
+-EXPORT_SYMBOL_GPL(pio_get_error);
++EXPORT_SYMBOL_GPL(rp1_pio_get_error);
+ 
+-void pio_clear_error(struct rp1_pio_client *client)
++void rp1_pio_clear_error(struct rp1_pio_client *client)
+ {
+ 	client->error = 0;
+ }
+-EXPORT_SYMBOL_GPL(pio_clear_error);
++EXPORT_SYMBOL_GPL(rp1_pio_clear_error);
+ 
+-static int rp1_pio_open(struct inode *inode, struct file *filp)
++static int rp1_pio_file_open(struct inode *inode, struct file *filp)
+ {
+ 	struct rp1_pio_client *client;
+ 
+-	client = pio_open();
++	client = rp1_pio_open();
+ 	if (IS_ERR(client))
+ 		return PTR_ERR(client);
+ 
+@@ -991,11 +1099,11 @@ static int rp1_pio_open(struct inode *in
+ 	return 0;
+ }
+ 
+-static int rp1_pio_release(struct inode *inode, struct file *filp)
++static int rp1_pio_file_release(struct inode *inode, struct file *filp)
+ {
+ 	struct rp1_pio_client *client = filp->private_data;
+ 
+-	pio_close(client);
++	rp1_pio_close(client);
+ 
+ 	return 0;
+ }
+@@ -1082,7 +1190,7 @@ static long rp1_pio_compat_ioctl(struct
+ 		param.dir = compat_param.dir;
+ 		param.data_bytes = compat_param.data_bytes;
+ 		param.data = compat_ptr(compat_param.data);
+-		return rp1_pio_sm_xfer_data(client, &param);
++		return rp1_pio_sm_xfer_data_user(client, &param);
+ 	}
+ 	case PIO_IOC_SM_XFER_DATA32_COMPAT:
+ 	{
+@@ -1095,7 +1203,7 @@ static long rp1_pio_compat_ioctl(struct
+ 		param.dir = compat_param.dir;
+ 		param.data_bytes = compat_param.data_bytes;
+ 		param.data = compat_ptr(compat_param.data);
+-		return rp1_pio_sm_xfer_data32(client, &param);
++		return rp1_pio_sm_xfer_data32_user(client, &param);
+ 	}
+ 
+ 	case PIO_IOC_READ_HW_COMPAT:
+@@ -1124,8 +1232,8 @@ static long rp1_pio_compat_ioctl(struct
+ 
+ const struct file_operations rp1_pio_fops = {
+ 	.owner =	THIS_MODULE,
+-	.open =		rp1_pio_open,
+-	.release =	rp1_pio_release,
++	.open =		rp1_pio_file_open,
++	.release =	rp1_pio_file_release,
+ 	.unlocked_ioctl = rp1_pio_ioctl,
+ 	.compat_ioctl = rp1_pio_compat_ioctl,
+ };
+--- a/include/linux/pio_rp1.h
++++ b/include/linux/pio_rp1.h
+@@ -179,9 +179,17 @@ typedef rp1_pio_sm_config pio_sm_config;
+ 
+ typedef struct rp1_pio_client *PIO;
+ 
+-void pio_set_error(struct rp1_pio_client *client, int err);
+-int pio_get_error(const struct rp1_pio_client *client);
+-void pio_clear_error(struct rp1_pio_client *client);
++int rp1_pio_init(void);
++PIO rp1_pio_open(void);
++void rp1_pio_close(struct rp1_pio_client *client);
++void rp1_pio_set_error(struct rp1_pio_client *client, int err);
++int rp1_pio_get_error(const struct rp1_pio_client *client);
++void rp1_pio_clear_error(struct rp1_pio_client *client);
++int rp1_pio_sm_config_xfer(struct rp1_pio_client *client, uint sm, uint dir,
++			   uint buf_size, uint buf_count);
++int rp1_pio_sm_xfer_data(struct rp1_pio_client *client, uint sm, uint dir,
++			 uint data_bytes, void *data, dma_addr_t dma_addr,
++			 void (*callback)(void *param), void *param);
+ 
+ int rp1_pio_can_add_program(struct rp1_pio_client *client, void *param);
+ int rp1_pio_add_program(struct rp1_pio_client *client, void *param);
+@@ -215,12 +223,48 @@ int rp1_pio_gpio_set_oeover(struct rp1_p
+ int rp1_pio_gpio_set_input_enabled(struct rp1_pio_client *client, void *param);
+ int rp1_pio_gpio_set_drive_strength(struct rp1_pio_client *client, void *param);
+ 
+-int pio_init(void);
+-PIO pio_open(void);
+-void pio_close(PIO pio);
++static inline int pio_init(void)
++{
++	return rp1_pio_init();
++}
++
++static inline struct rp1_pio_client *pio_open(void)
++{
++	return rp1_pio_open();
++}
++
++static inline void pio_close(struct rp1_pio_client *client)
++{
++	rp1_pio_close(client);
++}
++
++static inline void pio_set_error(struct rp1_pio_client *client, int err)
++{
++	rp1_pio_set_error(client, err);
++}
+ 
+-int pio_sm_config_xfer(PIO pio, uint sm, uint dir, uint buf_size, uint buf_count);
+-int pio_sm_xfer_data(PIO pio, uint sm, uint dir, uint data_bytes, void *data);
++static inline int pio_get_error(const struct rp1_pio_client *client)
++{
++	return rp1_pio_get_error(client);
++}
++
++static inline void pio_clear_error(struct rp1_pio_client *client)
++{
++	rp1_pio_clear_error(client);
++}
++
++static inline int pio_sm_config_xfer(struct rp1_pio_client *client, uint sm, uint dir,
++				     uint buf_size, uint buf_count)
++{
++	return rp1_pio_sm_config_xfer(client, sm, dir, buf_size, buf_count);
++}
++
++static inline int pio_sm_xfer_data(struct rp1_pio_client *client, uint sm, uint dir,
++				   uint data_bytes, void *data, dma_addr_t dma_addr,
++				   void (*callback)(void *param), void *param)
++{
++	return rp1_pio_sm_xfer_data(client, sm, dir, data_bytes, data, dma_addr, callback, param);
++}
+ 
+ static inline struct fp24_8 make_fp24_8(uint mul, uint div)
+ {
diff --git a/target/linux/bcm27xx/patches-6.6/950-1477-misc-Add-ws2812-pio-rp1-driver.patch b/target/linux/bcm27xx/patches-6.6/950-1477-misc-Add-ws2812-pio-rp1-driver.patch
new file mode 100644
index 00000000000000..b50bdea197e14a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1477-misc-Add-ws2812-pio-rp1-driver.patch
@@ -0,0 +1,568 @@
+From d6d83ad3d9a3a594909a1ad1c82b735ab711cd12 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 3 Dec 2024 16:09:30 +0000
+Subject: [PATCH] misc: Add ws2812-pio-rp1 driver
+
+ws2812-pio-rp1 is a PIO-based driver for WS2812 LEDS. It creates a
+character device in /dev, the default name of which is /dev/leds<n>,
+where <n> is the instance number. The number of LEDS should be set
+in the DT overlay, as should whether it is RGB or RGBW, and the default
+brightness.
+
+Write data to the /dev/* entry in a 4 bytes-per-pixel format in RGBW
+order:
+
+  RR GG BB WW RR GG BB WW ...
+
+The white values are ignored unless the rgbw flag is set for the device.
+
+To change the brightness, write a single byte to offset 0, 255 being
+full brightness and 0 being off.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/Kconfig          |  10 +
+ drivers/misc/Makefile         |   1 +
+ drivers/misc/ws2812-pio-rp1.c | 507 ++++++++++++++++++++++++++++++++++
+ 3 files changed, 518 insertions(+)
+ create mode 100644 drivers/misc/ws2812-pio-rp1.c
+
+--- a/drivers/misc/Kconfig
++++ b/drivers/misc/Kconfig
+@@ -25,6 +25,16 @@ config RP1_PIO
+ 		Driver providing control of the Raspberry Pi PIO block, as found in
+ 		RP1.
+ 
++config WS2812_PIO_RP1
++	tristate "Raspberry Pi PIO-base WS2812 driver"
++	depends on RP1_PIO || COMPILE_TEST
++	default n
++	help
++		Driver for the WS2812 (NeoPixel) LEDs using the RP1 PIO hardware.
++		The driver creates a character device to which rgbw pixels may be
++		written. Single-byte writes to offset 0 set the brightness at
++		runtime.
++
+ config AD525X_DPOT
+ 	tristate "Analog Devices Digital Potentiometers"
+ 	depends on (I2C || SPI) && SYSFS
+--- a/drivers/misc/Makefile
++++ b/drivers/misc/Makefile
+@@ -19,6 +19,7 @@ obj-$(CONFIG_PHANTOM)		+= phantom.o
+ obj-$(CONFIG_QCOM_COINCELL)	+= qcom-coincell.o
+ obj-$(CONFIG_QCOM_FASTRPC)	+= fastrpc.o
+ obj-$(CONFIG_RP1_PIO)		+= rp1-pio.o
++obj-$(CONFIG_WS2812_PIO_RP1)	+= ws2812-pio-rp1.o
+ obj-$(CONFIG_SENSORS_BH1770)	+= bh1770glc.o
+ obj-$(CONFIG_SENSORS_APDS990X)	+= apds990x.o
+ obj-$(CONFIG_ENCLOSURE_SERVICES) += enclosure.o
+--- /dev/null
++++ b/drivers/misc/ws2812-pio-rp1.c
+@@ -0,0 +1,507 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Raspberry Pi PIO-based WS2812 driver
++ *
++ * Copyright (C) 2014-2024 Raspberry Pi Ltd.
++ *
++ * Author: Phil Elwell (phil@raspberrypi.com)
++ *
++ * Based on the ws2812 driver by Gordon Hollingworth <gordon@raspberrypi.com>
++ */
++
++#include <linux/cdev.h>
++#include <linux/delay.h>
++#include <linux/kernel.h>
++#include <linux/module.h>
++#include <linux/fcntl.h>
++#include <linux/file.h>
++#include <linux/fs.h>
++#include <linux/pio_rp1.h>
++#include <linux/platform_device.h>
++#include <linux/of.h>
++#include <linux/gpio/consumer.h>
++
++#define DRIVER_NAME	"ws2812-pio-rp1"
++#define MAX_INSTANCES	4
++
++#define RESET_US	50
++#define PIXEL_BYTES	4
++
++struct ws2812_pio_rp1_state {
++	struct device	*dev;
++	struct gpio_desc *gpiod;
++	struct gpio_desc *power_gpiod;
++	uint		gpio;
++	PIO		pio;
++	uint		sm;
++	uint		offset;
++
++	u8		*buffer;
++	u8		*pixbuf;
++	u32		pixbuf_size;
++	u32		write_end;
++
++	u8		brightness;
++	u32		invert;
++	u32		num_leds;
++	u32		xfer_end_us;
++	bool		is_rgbw;
++	struct delayed_work deferred_work;
++
++	struct completion dma_completion;
++	struct cdev	cdev;
++	dev_t		dev_num;
++	const char	*dev_name;
++};
++
++static			DEFINE_MUTEX(ws2812_pio_mutex);
++static			DEFINE_IDA(ws2812_pio_ida);
++static long		ws2812_pio_ref_count;
++static struct class	*ws2812_pio_class;
++static dev_t		ws2812_pio_dev_num;
++/*
++ * WS2812B gamma correction
++ *	GammaE=255*(res/255).^(1/.45)
++ *	From: http://rgb-123.com/ws2812-color-output/
++ */
++
++static const u8 ws2812_gamma[] = {
++	0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
++	0, 0, 0, 0, 0, 0, 1, 1, 1, 1, 1, 1, 1, 2, 2, 2,
++	2, 2, 2, 3, 3, 3, 3, 3, 4, 4, 4, 4, 5, 5, 5, 5,
++	6, 6, 6, 7, 7, 7, 8, 8, 8, 9, 9, 9, 10, 10, 11, 11,
++	11, 12, 12, 13, 13, 13, 14, 14, 15, 15, 16, 16, 17, 17, 18, 18,
++	19, 19, 20, 21, 21, 22, 22, 23, 23, 24, 25, 25, 26, 27, 27, 28,
++	29, 29, 30, 31, 31, 32, 33, 34, 34, 35, 36, 37, 37, 38, 39, 40,
++	40, 41, 42, 43, 44, 45, 46, 46, 47, 48, 49, 50, 51, 52, 53, 54,
++	55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70,
++	71, 72, 73, 74, 76, 77, 78, 79, 80, 81, 83, 84, 85, 86, 88, 89,
++	90, 91, 93, 94, 95, 96, 98, 99, 100, 102, 103, 104, 106, 107, 109, 110,
++	111, 113, 114, 116, 117, 119, 120, 121, 123, 124, 126, 128, 129, 131, 132, 134,
++	135, 137, 138, 140, 142, 143, 145, 146, 148, 150, 151, 153, 155, 157, 158, 160,
++	162, 163, 165, 167, 169, 170, 172, 174, 176, 178, 179, 181, 183, 185, 187, 189,
++	191, 193, 194, 196, 198, 200, 202, 204, 206, 208, 210, 212, 214, 216, 218, 220,
++	222, 224, 227, 229, 231, 233, 235, 237, 239, 241, 244, 246, 248, 250, 252, 255
++};
++
++// ------ //
++// ws2812 //
++// ------ //
++
++#define ws2812_wrap_target 0
++#define ws2812_wrap 3
++
++#define ws2812_T1 3
++#define ws2812_T2 4
++#define ws2812_T3 3
++
++static const uint16_t ws2812_program_instructions[] = {
++		//     .wrap_target
++	0x6221,	//  0: out    x, 1            side 0 [2]
++	0x1223,	//  1: jmp    !x, 3           side 1 [2]
++	0x1300,	//  2: jmp    0               side 1 [3]
++	0xa342,	//  3: nop                    side 0 [3]
++		//     .wrap
++};
++
++static const struct pio_program ws2812_program = {
++	.instructions = ws2812_program_instructions,
++	.length = 4,
++	.origin = -1,
++};
++
++static inline pio_sm_config ws2812_program_get_default_config(uint offset)
++{
++	pio_sm_config c = pio_get_default_sm_config();
++
++	sm_config_set_wrap(&c, offset + ws2812_wrap_target, offset + ws2812_wrap);
++	sm_config_set_sideset(&c, 1, false, false);
++	return c;
++}
++
++static inline void ws2812_program_init(PIO pio, uint sm, uint offset, uint pin, uint freq,
++				       bool rgbw)
++{
++	int cycles_per_bit = ws2812_T1 + ws2812_T2 + ws2812_T3;
++	struct fp24_8 div;
++	pio_sm_config c;
++
++	pio_gpio_init(pio, pin);
++	pio_sm_set_consecutive_pindirs(pio, sm, pin, 1, true);
++	c = ws2812_program_get_default_config(offset);
++	sm_config_set_sideset_pins(&c, pin);
++	sm_config_set_out_shift(&c, false, true, rgbw ? 32 : 24);
++	sm_config_set_fifo_join(&c, PIO_FIFO_JOIN_TX);
++	div = make_fp24_8(clock_get_hz(clk_sys), freq * cycles_per_bit);
++	sm_config_set_clkdiv(&c, div);
++	pio_sm_init(pio, sm, offset, &c);
++	pio_sm_set_enabled(pio, sm, true);
++}
++
++static uint8_t ws2812_apply_gamma(uint8_t brightness, uint8_t val)
++{
++	int bright;
++
++	if (!val)
++		return 0;
++	bright = (val * brightness) / 255;
++	return ws2812_gamma[bright];
++}
++
++static inline uint8_t *rgbw_u32(const struct ws2812_pio_rp1_state *state,
++			       uint8_t r, uint8_t g, uint8_t b, uint8_t w, uint8_t *p)
++{
++	p[0] = ws2812_apply_gamma(state->brightness, w);
++	p[1] = ws2812_apply_gamma(state->brightness, b);
++	p[2] = ws2812_apply_gamma(state->brightness, r);
++	p[3] = ws2812_apply_gamma(state->brightness, g);
++	return p + 4;
++}
++
++static void ws2812_dma_complete(void *param)
++{
++	struct ws2812_pio_rp1_state *state = param;
++
++	complete(&state->dma_completion);
++}
++
++static void ws2812_update_leds(struct ws2812_pio_rp1_state *state, uint length)
++{
++	init_completion(&state->dma_completion);
++	if (!pio_sm_xfer_data(state->pio, state->sm, PIO_DIR_TO_SM, length, state->buffer, 0,
++			      (void (*)(void *))ws2812_dma_complete, state)) {
++		wait_for_completion(&state->dma_completion);
++		usleep_range(RESET_US, RESET_US + 100);
++	}
++}
++
++static void ws2812_clear_leds(struct ws2812_pio_rp1_state *state)
++{
++	uint8_t *p_buffer;
++	uint length;
++	int i;
++
++	p_buffer = state->buffer;
++	for (i = 0; i < state->num_leds; i++)
++		p_buffer = rgbw_u32(state, 0, 0, 0, 0, p_buffer);
++
++	length = (void *)p_buffer - (void *)state->buffer;
++
++	ws2812_update_leds(state, length);
++}
++
++/*
++ * Function to write the RGB buffer to the WS2812 leds, the input buffer
++ * contains a sequence of up to num_leds RGB32 integers, these are then
++ * gamma-corrected before being sent to the PIO state machine.
++ */
++
++static ssize_t ws2812_pio_rp1_write(struct file *filp, const char __user *buf, size_t count,
++				    loff_t *ppos)
++{
++	struct ws2812_pio_rp1_state *state;
++	uint32_t pixbuf_size;
++	unsigned long delay;
++	loff_t pos = *ppos;
++	int err = 0;
++
++	state = (struct ws2812_pio_rp1_state *)filp->private_data;
++	pixbuf_size = state->pixbuf_size;
++
++	if (pos > pixbuf_size)
++		return -EFBIG;
++
++	if (count > pixbuf_size) {
++		err = -EFBIG;
++		count = pixbuf_size;
++	}
++
++	if (pos + count > pixbuf_size) {
++		if (!err)
++			err = -ENOSPC;
++
++		count = pixbuf_size - pos;
++	}
++
++	if (!pos && count == 1) {
++		if (copy_from_user(&state->brightness, buf, 1))
++			return -EFAULT;
++	} else {
++		if (copy_from_user(state->pixbuf + pos, buf, count))
++			return -EFAULT;
++		pos += count;
++		state->write_end = (u32)pos;
++	}
++
++	*ppos = pos;
++
++	delay = (state->write_end == pixbuf_size) ? 0 : HZ / 20;
++	schedule_delayed_work(&state->deferred_work, delay);
++
++	return err ? err : count;
++}
++
++static void ws2812_pio_rp1_deferred_work(struct work_struct *work)
++{
++	struct ws2812_pio_rp1_state *state =
++		container_of(work, struct ws2812_pio_rp1_state, deferred_work.work);
++	uint8_t *p_buffer;
++	uint32_t *p_rgb;
++	int blank_bytes;
++	uint length;
++	int i;
++
++	blank_bytes = state->pixbuf_size - state->write_end;
++	if (blank_bytes > 0)
++		memset(state->pixbuf + state->write_end, 0, blank_bytes);
++
++	p_rgb = (uint32_t *)state->pixbuf;
++	p_buffer = state->buffer;
++
++	for (i = 0; i < state->num_leds; i++) {
++		uint32_t rgbw_pix = *(p_rgb++);
++
++		p_buffer = rgbw_u32(state,
++				    (uint8_t)(rgbw_pix >> 0),
++				    (uint8_t)(rgbw_pix >> 8),
++				    (uint8_t)(rgbw_pix >> 16),
++				    (uint8_t)(rgbw_pix >> 24),
++				    p_buffer);
++	}
++
++	length = (void *)p_buffer - (void *)state->buffer;
++
++	ws2812_update_leds(state, length);
++}
++
++static int ws2812_pio_rp1_open(struct inode *inode, struct file *file)
++{
++	struct ws2812_pio_rp1_state *state;
++
++	state  = container_of(inode->i_cdev, struct ws2812_pio_rp1_state, cdev);
++	file->private_data = state;
++
++	return 0;
++}
++
++const struct file_operations ws2812_pio_rp1_fops = {
++	.owner = THIS_MODULE,
++	.write = ws2812_pio_rp1_write,
++	.open = ws2812_pio_rp1_open,
++};
++
++/*
++ * Probe function
++ */
++static int ws2812_pio_rp1_probe(struct platform_device *pdev)
++{
++	struct device_node *np = pdev->dev.of_node;
++	struct of_phandle_args of_args = { 0 };
++	struct ws2812_pio_rp1_state *state;
++	struct device *dev = &pdev->dev;
++	struct device *char_dev;
++	const char *dev_name;
++	uint32_t brightness;
++	bool is_rp1;
++	int minor;
++	int ret;
++
++	state = devm_kzalloc(dev, sizeof(*state), GFP_KERNEL);
++	if (IS_ERR(state))
++		return PTR_ERR(state);
++
++	state->dev = dev;
++
++	platform_set_drvdata(pdev, state);
++
++	ret = of_property_read_u32(np, "rpi,num-leds", &state->num_leds);
++	if (ret)
++		return dev_err_probe(dev, ret, "Could not get num-leds\n");
++
++	brightness = 255;
++	of_property_read_u32(np, "rpi,brightness", &brightness);
++	state->brightness = min(brightness, 255);
++
++	state->pixbuf_size = state->num_leds * PIXEL_BYTES;
++
++	state->is_rgbw = of_property_read_bool(np, "rpi,rgbw");
++	state->gpiod = devm_gpiod_get(dev, "leds", GPIOD_ASIS);
++	if (IS_ERR(state->gpiod))
++		return dev_err_probe(dev, PTR_ERR(state->gpiod),
++				     "Could not get a gpio\n");
++
++	/* This must be an RP1 GPIO in the first bank, and retrieve the offset. */
++	/* Unfortunately I think this has to be done by parsing the gpios property */
++
++	/* This really shouldn't fail, given that we have a gpiod */
++	if (of_parse_phandle_with_args(np, "leds-gpios", "#gpio-cells", 0, &of_args))
++		return dev_err_probe(dev, -EINVAL,
++				     "Can't find gpio declaration\n");
++
++	is_rp1 = of_device_is_compatible(of_args.np, "raspberrypi,rp1-gpio");
++	of_node_put(of_args.np);
++	if (!is_rp1 || of_args.args_count != 2)
++		return dev_err_probe(dev, -EINVAL,
++				     "Not an RP1 gpio\n");
++
++	state->gpio = of_args.args[0];
++
++	state->pixbuf = devm_kmalloc(dev, state->pixbuf_size, GFP_KERNEL);
++	if (state->pixbuf == NULL)
++		return -ENOMEM;
++
++	state->buffer = devm_kmalloc(dev, state->num_leds * PIXEL_BYTES, GFP_KERNEL);
++	if (state->buffer == NULL)
++		return -ENOMEM;
++
++	ret = of_property_read_string(np, "dev-name", &dev_name);
++	if (ret) {
++		pr_err("Failed to read 'dev-name' property\n");
++		return ret;
++	}
++
++	state->pio = pio_open();
++	if (IS_ERR(state->pio))
++		return dev_err_probe(dev, PTR_ERR(state->pio),
++				     "Could not open PIO\n");
++
++	state->sm = pio_claim_unused_sm(state->pio, false);
++	if ((int)state->sm < 0) {
++		dev_err(dev, "No free PIO SM\n");
++		ret = -EBUSY;
++		goto fail_pio;
++	}
++
++	state->offset = pio_add_program(state->pio, &ws2812_program);
++	if (state->offset == PIO_ORIGIN_ANY) {
++		dev_err(dev, "Not enough PIO program space\n");
++		ret = -EBUSY;
++		goto fail_pio;
++	}
++
++	pio_sm_config_xfer(state->pio, state->sm, PIO_DIR_TO_SM, state->num_leds * sizeof(int), 1);
++
++	pio_sm_clear_fifos(state->pio, state->sm);
++	pio_sm_set_clkdiv(state->pio, state->sm, make_fp24_8(1, 1));
++	ws2812_program_init(state->pio, state->sm, state->offset, state->gpio, 800000,
++			    state->is_rgbw);
++
++	mutex_lock(&ws2812_pio_mutex);
++
++	if (!ws2812_pio_ref_count) {
++		ret = alloc_chrdev_region(&ws2812_pio_dev_num, 0, MAX_INSTANCES, DRIVER_NAME);
++		if (ret < 0) {
++			dev_err(dev, "alloc_chrdev_region failed (rc=%d)\n", ret);
++			goto fail_mutex;
++		}
++
++		ws2812_pio_class = class_create(DRIVER_NAME);
++		if (IS_ERR(ws2812_pio_class)) {
++			pr_err("Unable to create class " DRIVER_NAME "\n");
++			ret = PTR_ERR(ws2812_pio_class);
++			goto fail_chrdev;
++		}
++	}
++
++	ws2812_pio_ref_count++;
++
++	minor = ida_alloc_range(&ws2812_pio_ida, 0, MAX_INSTANCES - 1, GFP_KERNEL);
++	if (minor < 0) {
++		pr_err("No free instances\n");
++		ret = minor;
++		goto fail_class;
++
++	}
++
++	mutex_unlock(&ws2812_pio_mutex);
++
++	state->dev_num = MKDEV(MAJOR(ws2812_pio_dev_num), minor);
++	state->dev_name = devm_kasprintf(dev, GFP_KERNEL, dev_name, minor);
++
++	char_dev = device_create(ws2812_pio_class, NULL, state->dev_num, NULL, state->dev_name);
++
++	if (IS_ERR(char_dev)) {
++		pr_err("Unable to create device %s\n", state->dev_name);
++		ret = PTR_ERR(char_dev);
++		goto fail_ida;
++	}
++
++	state->cdev.owner = THIS_MODULE;
++	cdev_init(&state->cdev, &ws2812_pio_rp1_fops);
++
++	ret = cdev_add(&state->cdev, state->dev_num, 1);
++	if (ret) {
++		pr_err("cdev_add failed\n");
++		goto fail_device;
++	}
++
++	INIT_DELAYED_WORK(&state->deferred_work, ws2812_pio_rp1_deferred_work);
++
++	ws2812_clear_leds(state);
++
++	dev_info(&pdev->dev, "Instantiated %d LEDs on GPIO %d as /dev/%s\n",
++		 state->num_leds, state->gpio, state->dev_name);
++
++	return 0;
++
++fail_device:
++	device_destroy(ws2812_pio_class, state->dev_num);
++fail_ida:
++	mutex_lock(&ws2812_pio_mutex);
++	ida_free(&ws2812_pio_ida, minor);
++fail_class:
++	ws2812_pio_ref_count--;
++	if (ws2812_pio_ref_count)
++		goto fail_mutex;
++	class_destroy(ws2812_pio_class);
++fail_chrdev:
++	unregister_chrdev_region(ws2812_pio_dev_num, MAX_INSTANCES);
++fail_mutex:
++	mutex_unlock(&ws2812_pio_mutex);
++fail_pio:
++	pio_close(state->pio);
++
++	return ret;
++}
++
++static void ws2812_pio_rp1_remove(struct platform_device *pdev)
++{
++	struct ws2812_pio_rp1_state *state = platform_get_drvdata(pdev);
++
++	cancel_delayed_work(&state->deferred_work);
++	platform_set_drvdata(pdev, NULL);
++
++	cdev_del(&state->cdev);
++	device_destroy(ws2812_pio_class, state->dev_num);
++
++	mutex_lock(&ws2812_pio_mutex);
++	ida_free(&ws2812_pio_ida, MINOR(state->dev_num));
++	ws2812_pio_ref_count--;
++	if (!ws2812_pio_ref_count) {
++		class_destroy(ws2812_pio_class);
++		unregister_chrdev_region(ws2812_pio_dev_num, MAX_INSTANCES);
++	}
++	mutex_unlock(&ws2812_pio_mutex);
++
++	pio_close(state->pio);
++}
++
++static const struct of_device_id ws2812_pio_rp1_match[] = {
++	{ .compatible = "raspberrypi,ws2812-pio-rp1" },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, ws2812_pio_rp1_match);
++
++static struct platform_driver ws2812_pio_rp1_driver = {
++	.driver = {
++		.name = "ws2812-pio-rp1",
++		.of_match_table = ws2812_pio_rp1_match,
++	},
++	.probe = ws2812_pio_rp1_probe,
++	.remove_new  = ws2812_pio_rp1_remove,
++};
++module_platform_driver(ws2812_pio_rp1_driver);
++
++MODULE_DESCRIPTION("WS2812 PIO RP1 driver");
++MODULE_AUTHOR("Phil Elwell");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/bcm27xx/patches-6.6/950-1478-overlays-Add-ws2812-pio-overlay.patch b/target/linux/bcm27xx/patches-6.6/950-1478-overlays-Add-ws2812-pio-overlay.patch
new file mode 100644
index 00000000000000..ab98fa139f9a9e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1478-overlays-Add-ws2812-pio-overlay.patch
@@ -0,0 +1,107 @@
+From 4a8f2b39157825fefc505fe4b94f3a9ce101e170 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 12 Dec 2024 23:23:39 +0000
+Subject: [PATCH] overlays: Add ws2812-pio overlay
+
+Add an overlay to enable a WS2812 LED driver on a given GPIO.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/Makefile           |  3 +-
+ arch/arm/boot/dts/overlays/README             | 22 +++++++++
+ .../boot/dts/overlays/ws2812-pio-overlay.dts  | 46 +++++++++++++++++++
+ 3 files changed, 70 insertions(+), 1 deletion(-)
+ create mode 100644 arch/arm/boot/dts/overlays/ws2812-pio-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -342,7 +342,8 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	waveshare-can-fd-hat-mode-a.dtbo \
+ 	waveshare-can-fd-hat-mode-b.dtbo \
+ 	wittypi.dtbo \
+-	wm8960-soundcard.dtbo
++	wm8960-soundcard.dtbo \
++	ws2812-pio.dtbo
+ 
+ targets += dtbs dtbs_install
+ targets += $(dtbo-y)
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -5599,6 +5599,28 @@ Params: alsaname                Changes
+         compatible              Changes the codec compatibility
+ 
+ 
++Name:   ws2812-pio
++Info:   Configures a GPIO pin to drive a string of WS2812 LEDS using pio. It
++        can be enabled on any RP1 GPIO in bank 0 (0-27). Up to 4 are supported,
++        assuming nothing else is using PIO. Pi 5 only.
++Load:   dtoverlay=ws2812-pio,<param>=<val>
++Params: brightness              Set the initial brightness for the LEDs. The
++                                brightness can be changed at runtime by writing
++                                a single byte to offset 0 of the device. Note
++                                that brightness is a multiplier for the pixel
++                                values, and only white pixels can reach the
++                                maximum visible brightness. (range 0-255,
++                                default 255)
++        dev_name                The name for the /dev/ device entry. Note that
++                                if the name includes '%d' it will be replaced
++                                by the instance number. (default 'leds%d')
++        gpio                    Output GPIO (0-27, default 4)
++        num_leds                Number of LEDs (default 60)
++        rgbw                    'rgbw=on' (or 'rgbw') indicates that each pixel
++                                includes a white LED as well as the usual red,
++                                green and blue. (default 'off')
++
++
+ Troubleshooting
+ ===============
+ 
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/ws2812-pio-overlay.dts
+@@ -0,0 +1,46 @@
++// SPDX-License-Identifier: GPL-2.0
++// Device tree overlay for RP1 PIO WS2812 driver.
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2712";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			ws2812_pio_pins: ws2812_pio_pins@4 {
++				brcm,pins = <4>; /* gpio 4 */
++				function = "pio";
++				bias-disable;
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			ws2812_pio: ws2812_pio@4 {
++				compatible = "raspberrypi,ws2812-pio-rp1";
++				pinctrl-names = "default";
++				pinctrl-0 = <&ws2812_pio_pins>;
++				dev-name = "leds%d";
++				leds-gpios = <&gpio 4 0>;
++				rpi,num-leds = <60>;
++				rpi,brightness = <255>;
++			};
++		};
++	};
++
++	__overrides__ {
++		brightness = <&ws2812_pio>, "rpi,brightness:0";
++		dev_name = <&ws2812_pio>, "dev-name";
++		gpio = <&ws2812_pio>,"leds-gpios:4",
++		       <&ws2812_pio_pins>,"brcm,pins:0",
++		       /* modify reg values to allow multiple instantiation */
++		       <&ws2812_pio>,"reg:0",
++		       <&ws2812_pio_pins>,"reg:0";
++		num_leds = <&ws2812_pio>, "rpi,num-leds:0";
++		rgbw = <&ws2812_pio>, "rpi,rgbw?";
++	};
++};
diff --git a/target/linux/bcm27xx/patches-6.6/950-1480-overlays-Add-and-document-i2c_csi_dsi0-parameters.patch b/target/linux/bcm27xx/patches-6.6/950-1480-overlays-Add-and-document-i2c_csi_dsi0-parameters.patch
new file mode 100644
index 00000000000000..ab0f051136fb2c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1480-overlays-Add-and-document-i2c_csi_dsi0-parameters.patch
@@ -0,0 +1,342 @@
+From 489570796a5789f849683fc3fb034c55cb13e4c6 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 19 Dec 2024 17:13:17 +0000
+Subject: [PATCH] overlays: Add and document i2c_csi_dsi0 parameters
+
+Add "i2c_csi_dsi0" parameters to overlays that already have an
+"i2c_csi_dsi" parameter.
+
+The I2C bus and GPIO mapping of i2c_csi_dsi and i2c_csi_dsi0 varies
+between platforms. Document the associations against the dtparams
+"i2c_csi_dsi" and "i2c_csi_dsi0" - run "dtparam -h i2c_csi_dsi"
+and "dtparam -h i2c_csi_dsi0" to read it.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README             | 103 ++++++++++++++++--
+ .../arm/boot/dts/overlays/ads1115-overlay.dts |   2 +
+ .../arm/boot/dts/overlays/i2c-fan-overlay.dts |   2 +
+ .../arm/boot/dts/overlays/i2c-mux-overlay.dts |   2 +
+ .../dts/overlays/i2c-pwm-pca9685a-overlay.dts |   2 +
+ .../arm/boot/dts/overlays/i2c-rtc-overlay.dts |   2 +
+ .../boot/dts/overlays/i2c-sensor-overlay.dts  |   2 +
+ .../boot/dts/overlays/mcp23017-overlay.dts    |   2 +
+ .../arm/boot/dts/overlays/pca953x-overlay.dts |   2 +
+ .../arm/boot/dts/overlays/pcf857x-overlay.dts |   2 +
+ .../dts/overlays/sc16is750-i2c-overlay.dts    |   2 +
+ .../dts/overlays/sc16is752-i2c-overlay.dts    |   2 +
+ 12 files changed, 113 insertions(+), 12 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -301,10 +301,31 @@ Params:
+         i2c_baudrate            An alias for i2c_arm_baudrate
+ 
+         i2c_csi_dsi             Set to "on" to enable the i2c_csi_dsi interface
++                                The I2C bus and GPIOs are platform specific:
++                                  B rev 1:
++                                    i2c-1 on 2 & 3
++                                  B rev 2, B+, CM, Zero, Zero W, 2B, CM2, CM3,
++                                  CM4S:
++                                    i2c-0 on 28 & 29
++                                  3B, 3B+, Zero 2W, 4B, 400, CM4:
++                                    i2c-0 on 44 & 45
++                                  5, 500:
++                                    i2c-11/i2c-4 on 40 & 41
++                                  CM5 on CM5IO:
++                                    i2c-0 on 0 & 1
++                                  CM5 on CM4IO:
++                                    i2c-10/i2c-6 on 38 & 39
+ 
+         i2c_csi_dsi0            Set to "on" to enable the i2c_csi_dsi0 interface
++                                The I2C bus and GPIOs are platform specific:
++                                  B rev 1 & 2, B+, CM, Zero, Zero W, 2B, CM2,
++                                  CM3, CM4S, 3B, 3B+, Zero 2W, 4B, 400, CM4,
++                                  CM5 on CM4IO:
++                                    i2c-0 on 0 & 1
++                                  5, 500, CM5 on CM5IO:
++                                    i2c-10/i2c-6 on 38 & 39
+ 
+-        i2c_csi_dsi1            Set to "on" to enable the i2c_csi_dsi1 interface
++        i2c_csi_dsi1            A Pi 5 family-specific alias for i2c_csi_dsi.
+ 
+         i2c_vc                  Set to "on" to enable the i2c interface
+                                 usually reserved for the VideoCore processor
+@@ -546,7 +567,12 @@ Params: addr                    I2C bus
+                                 Amplifier for this channel. (Default 1 sets the
+                                 full scale of the channel to 4.096 Volts)
+         i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c_csi_dsi             Choose the I2C bus connected to the main
++                                camera/display connector.
++                                See "dtparam -h i2c_csi_dsi" for details.
++        i2c_csi_dsi0            Choose the I2C bus connected to the second
++                                camera/display connector, if present.
++                                See "dtparam -h i2c_csi_dsi0" for details.
+         i2c3                    Choose the I2C3 bus (configure with the i2c3
+                                 overlay - BCM2711 only)
+         i2c4                    Choose the I2C4 bus (configure with the i2c4
+@@ -2086,7 +2112,13 @@ Params: addr                    Sets the
+ 
+         i2c0                    Choose the I2C0 bus on GPIOs 0&1
+ 
+-        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c_csi_dsi             Choose the I2C bus connected to the main
++                                camera/display connector.
++                                See "dtparam -h i2c_csi_dsi" for details.
++
++        i2c_csi_dsi0            Choose the I2C bus connected to the second
++                                camera/display connector, if present.
++                                See "dtparam -h i2c_csi_dsi0" for details.
+ 
+         i2c3                    Choose the I2C3 bus (configure with the i2c3
+                                 overlay - BCM2711 only)
+@@ -2158,7 +2190,13 @@ Params: pca9542                 Select t
+ 
+         i2c0                    Choose the I2C0 bus on GPIOs 0&1
+ 
+-        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c_csi_dsi             Choose the I2C bus connected to the main
++                                camera/display connector.
++                                See "dtparam -h i2c_csi_dsi" for details.
++
++        i2c_csi_dsi0            Choose the I2C bus connected to the second
++                                camera/display connector, if present.
++                                See "dtparam -h i2c_csi_dsi0" for details.
+ 
+         i2c3                    Choose the I2C3 bus (configure with the i2c3
+                                 overlay - BCM2711 only)
+@@ -2186,7 +2224,12 @@ Info:   Adds support for an NXP PCA9685A
+ Load:   dtoverlay=i2c-pwm-pca9685a,<param>=<val>
+ Params: addr                    I2C address of PCA9685A (default 0x40)
+         i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c_csi_dsi             Choose the I2C bus connected to the main
++                                camera/display connector.
++                                See "dtparam -h i2c_csi_dsi" for details.
++        i2c_csi_dsi0            Choose the I2C bus connected to the second
++                                camera/display connector, if present.
++                                See "dtparam -h i2c_csi_dsi0" for details.
+         i2c3                    Choose the I2C3 bus (configure with the i2c3
+                                 overlay - BCM2711 only)
+         i2c4                    Choose the I2C3 bus (configure with the i2c3
+@@ -2251,7 +2294,13 @@ Params: abx80x                  Select o
+ 
+         i2c0                    Choose the I2C0 bus on GPIOs 0&1
+ 
+-        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c_csi_dsi             Choose the I2C bus connected to the main
++                                camera/display connector.
++                                See "dtparam -h i2c_csi_dsi" for details.
++
++        i2c_csi_dsi0            Choose the I2C bus connected to the second
++                                camera/display connector, if present.
++                                See "dtparam -h i2c_csi_dsi0" for details.
+ 
+         i2c3                    Choose the I2C3 bus (configure with the i2c3
+                                 overlay - BCM2711 only)
+@@ -2517,7 +2566,12 @@ Params: addr                    Set the
+ 
+         i2c0                    Choose the I2C0 bus on GPIOs 0&1
+ 
+-        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c_csi_dsi             Choose the I2C bus connected to the main
++                                camera/display connector.
++                                See "dtparam -h i2c_csi_dsi" for details.
++        i2c_csi_dsi0            Choose the I2C bus connected to the second
++                                camera/display connector, if present.
++                                See "dtparam -h i2c_csi_dsi0" for details.
+ 
+         i2c3                    Choose the I2C3 bus (configure with the i2c3
+                                 overlay - BCM2711 only)
+@@ -3144,7 +3198,12 @@ Params: gpiopin                 Gpio pin
+         mcp23008                Configure an MCP23008 instead.
+         noints                  Disable the interrupt GPIO line.
+         i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c_csi_dsi             Choose the I2C bus connected to the main
++                                camera/display connector.
++                                See "dtparam -h i2c_csi_dsi" for details.
++        i2c_csi_dsi0            Choose the I2C bus connected to the second
++                                camera/display connector, if present.
++                                See "dtparam -h i2c_csi_dsi0" for details.
+         i2c3                    Choose the I2C3 bus (configure with the i2c3
+                                 overlay - BCM2711 only)
+         i2c4                    Choose the I2C4 bus (configure with the i2c4
+@@ -3604,7 +3663,12 @@ Params: addr                    I2C addr
+         pca9654                 Select the Onnn PCA9654 (8 bit)
+         xra1202                 Select the Exar XRA1202 (8 bit)
+         i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c_csi_dsi             Choose the I2C bus connected to the main
++                                camera/display connector.
++                                See "dtparam -h i2c_csi_dsi" for details.
++        i2c_csi_dsi0            Choose the I2C bus connected to the second
++                                camera/display connector, if present.
++                                See "dtparam -h i2c_csi_dsi0" for details.
+         i2c3                    Choose the I2C3 bus (configure with the i2c3
+                                 overlay - BCM2711 only)
+         i2c4                    Choose the I2C3 bus (configure with the i2c3
+@@ -3626,7 +3690,12 @@ Params: addr                    I2C addr
+         pcf8575                 Select the NXP PCF8575 (16 bit)
+         pca8574                 Select the NXP PCA8574 (8 bit)
+         i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c_csi_dsi             Choose the I2C bus connected to the main
++                                camera/display connector.
++                                See "dtparam -h i2c_csi_dsi" for details.
++        i2c_csi_dsi0            Choose the I2C bus connected to the second
++                                camera/display connector, if present.
++                                See "dtparam -h i2c_csi_dsi0" for details.
+         i2c3                    Choose the I2C3 bus (configure with the i2c3
+                                 overlay - BCM2711 only)
+         i2c4                    Choose the I2C3 bus (configure with the i2c3
+@@ -4296,7 +4365,12 @@ Params: int_pin                 GPIO use
+         addr                    Address (default 0x48)
+         xtal                    On-board crystal frequency (default 14745600)
+         i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c_csi_dsi             Choose the I2C bus connected to the main
++                                camera/display connector.
++                                See "dtparam -h i2c_csi_dsi" for details.
++        i2c_csi_dsi0            Choose the I2C bus connected to the second
++                                camera/display connector, if present.
++                                See "dtparam -h i2c_csi_dsi0" for details.
+         i2c3                    Choose the I2C3 bus (configure with the i2c3
+                                 overlay - BCM2711 only)
+         i2c4                    Choose the I2C4 bus (configure with the i2c4
+@@ -4325,7 +4399,12 @@ Params: int_pin                 GPIO use
+         addr                    Address (default 0x48)
+         xtal                    On-board crystal frequency (default 14745600)
+         i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-        i2c_csi_dsi             Choose the I2C0 bus on GPIOs 44&45
++        i2c_csi_dsi             Choose the I2C bus connected to the main
++                                camera/display connector.
++                                See "dtparam -h i2c_csi_dsi" for details.
++        i2c_csi_dsi0            Choose the I2C bus connected to the second
++                                camera/display connector, if present.
++                                See "dtparam -h i2c_csi_dsi0" for details.
+         i2c3                    Choose the I2C3 bus (configure with the i2c3
+                                 overlay - BCM2711 only)
+         i2c4                    Choose the I2C4 bus (configure with the i2c4
+--- a/arch/arm/boot/dts/overlays/ads1115-overlay.dts
++++ b/arch/arm/boot/dts/overlays/ads1115-overlay.dts
+@@ -123,6 +123,8 @@
+ 		i2c0 = <&frag100>, "target:0=",<&i2c0>;
+ 		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+ 			      <0>,"+101+102";
++		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
++			      <0>,"+101+102";
+ 		i2c3 = <&frag100>, "target?=0",
+ 		       <&frag100>, "target-path=i2c3";
+ 		i2c4 = <&frag100>, "target?=0",
+--- a/arch/arm/boot/dts/overlays/i2c-fan-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-fan-overlay.dts
+@@ -85,6 +85,8 @@
+ 		i2c0 =		<&frag100>,"target:0=",<&i2c0>;
+ 		i2c_csi_dsi =	<&frag100>,"target:0=",<&i2c_csi_dsi>,
+ 				<0>,"+101+102";
++		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
++			      <0>,"+101+102";
+ 		i2c3 = <&frag100>, "target?=0",
+ 		       <&frag100>, "target-path=i2c3";
+ 		i2c4 = <&frag100>, "target?=0",
+--- a/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
+@@ -167,6 +167,8 @@
+ 			      <0>,"+101+102";
+ 		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+ 			      <0>,"+101+102";
++		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
++			      <0>,"+101+102";
+ 		i2c3 = <&frag100>, "target?=0",
+ 		       <&frag100>, "target-path=i2c3";
+ 		i2c4 = <&frag100>, "target?=0",
+--- a/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
+@@ -49,6 +49,8 @@
+ 			      <0>,"+101+102";
+ 		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+ 			      <0>,"+101+102";
++		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
++			      <0>,"+101+102";
+ 		i2c3 = <&frag100>, "target?=0",
+ 		       <&frag100>, "target-path=i2c3";
+ 		i2c4 = <&frag100>, "target?=0",
+--- a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
+@@ -30,6 +30,8 @@
+ 		i2c0 = <&frag100>, "target:0=",<&i2c0>;
+ 		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+ 			      <0>,"+101+102";
++		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
++			      <0>,"+101+102";
+ 		i2c3 = <&frag100>, "target?=0",
+ 		       <&frag100>, "target-path=i2c3";
+ 		i2c4 = <&frag100>, "target?=0",
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
+@@ -30,6 +30,8 @@
+ 		i2c0 = <&frag100>, "target:0=",<&i2c0>;
+ 		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+ 			      <0>,"+101+102";
++		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
++			      <0>,"+101+102";
+ 		i2c3 = <&frag100>, "target?=0",
+ 		       <&frag100>, "target-path=i2c3";
+ 		i2c4 = <&frag100>, "target?=0",
+--- a/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
++++ b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
+@@ -90,6 +90,8 @@
+ 		i2c0 = <&frag100>, "target:0=",<&i2c0>;
+ 		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+ 			      <0>,"+101+102";
++		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
++			      <0>,"+101+102";
+ 		i2c3 = <&frag100>, "target?=0",
+ 		       <&frag100>, "target-path=i2c3";
+ 		i2c4 = <&frag100>, "target?=0",
+--- a/arch/arm/boot/dts/overlays/pca953x-overlay.dts
++++ b/arch/arm/boot/dts/overlays/pca953x-overlay.dts
+@@ -254,6 +254,8 @@
+ 			      <0>,"+100+101";
+ 		i2c_csi_dsi = <&frag0>, "target:0=",<&i2c_csi_dsi>,
+ 			      <0>,"+100+101";
++		i2c_csi_dsi0 = <&frag0>, "target:0=",<&i2c_csi_dsi0>,
++			      <0>,"+100+101";
+ 		i2c3 = <&frag0>, "target?=0",
+ 		       <&frag0>, "target-path=i2c3";
+ 		i2c4 = <&frag0>, "target?=0",
+--- a/arch/arm/boot/dts/overlays/pcf857x-overlay.dts
++++ b/arch/arm/boot/dts/overlays/pcf857x-overlay.dts
+@@ -46,6 +46,8 @@
+ 			      <0>,"+100+101";
+ 		i2c_csi_dsi = <&frag0>, "target:0=",<&i2c_csi_dsi>,
+ 			      <0>,"+100+101";
++		i2c_csi_dsi0 = <&frag0>, "target:0=",<&i2c_csi_dsi0>,
++			      <0>,"+100+101";
+ 		i2c3 = <&frag0>, "target?=0",
+ 		       <&frag0>, "target-path=i2c3";
+ 		i2c4 = <&frag0>, "target?=0",
+--- a/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
++++ b/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
+@@ -71,6 +71,8 @@
+ 			      <0>,"+100+101";
+ 		i2c_csi_dsi = <&frag0>, "target:0=",<&i2c_csi_dsi>,
+ 			      <0>,"+100+101";
++		i2c_csi_dsi0 = <&frag0>, "target:0=",<&i2c_csi_dsi0>,
++			      <0>,"+100+101";
+ 		i2c3 = <&frag0>, "target?=0",
+ 		       <&frag0>, "target-path=i2c3";
+ 		i2c4 = <&frag0>, "target?=0",
+--- a/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
++++ b/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
+@@ -71,6 +71,8 @@
+ 			      <0>,"+100+101";
+ 		i2c_csi_dsi = <&frag0>, "target:0=",<&i2c_csi_dsi>,
+ 			      <0>,"+100+101";
++		i2c_csi_dsi0 = <&frag0>, "target:0=",<&i2c_csi_dsi0>,
++			      <0>,"+100+101";
+ 		i2c3 = <&frag0>, "target?=0",
+ 		       <&frag0>, "target-path=i2c3";
+ 		i2c4 = <&frag0>, "target?=0",
diff --git a/target/linux/bcm27xx/patches-6.6/950-1481-dts-Add-noanthogs-parameter-to-CM4-and-CM5.patch b/target/linux/bcm27xx/patches-6.6/950-1481-dts-Add-noanthogs-parameter-to-CM4-and-CM5.patch
new file mode 100644
index 00000000000000..483031057c5079
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1481-dts-Add-noanthogs-parameter-to-CM4-and-CM5.patch
@@ -0,0 +1,56 @@
+From 147ddfdaf626fe5484596235bba8bdc6dcfde501 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 20 Dec 2024 15:08:52 +0000
+Subject: [PATCH] dts: Add noanthogs parameter to CM4 and CM5
+
+By default, the antenna selection on CM4 and CM5 is fixed at boot time,
+with the dtparams ant1, ant2 and noant selecting which should be
+enabled. Add a new dtparam - noanthogs - which leaves the GPIOs free
+to be controlled at runtime by the OS.
+
+N.B. Using this parameter without suitable OS support will leave both
+antennae disabled, resulting in attenuated WiFi and Bluetooth signals.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/broadcom/bcm2711-rpi-cm4.dts    | 2 ++
+ arch/arm/boot/dts/overlays/README                 | 6 ++++++
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi | 2 ++
+ 3 files changed, 10 insertions(+)
+
+--- a/arch/arm/boot/dts/broadcom/bcm2711-rpi-cm4.dts
++++ b/arch/arm/boot/dts/broadcom/bcm2711-rpi-cm4.dts
+@@ -493,6 +493,8 @@ i2c_csi_dsi0: &i2c0 {
+ 			<&ant1>, "output-low?=on",
+ 			<&ant2>, "output-high?=off",
+ 			<&ant2>, "output-low?=on";
++		noanthogs = <&ant1>,"status=disabled",
++			<&ant2>, "status=disabled";
+ 
+ 		pcie_tperst_clk_ms = <&pcie0>,"brcm,tperst-clk-ms:0";
+ 	};
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -153,6 +153,12 @@ Params:
+ 
+         noant                   Disable both antennas. CM4/5 only.
+ 
++        noanthogs               Disable the GPIO hogs on the antenna controls
++                                so they can be controlled at runtime. Note that
++                                using this parameter without suitable OS
++                                support will result in attenuated WiFi and
++                                Bluetooth signals. CM4/5 only.
++
+         audio                   Set to "on" to enable the onboard ALSA audio
+                                 interface (default "off")
+ 
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
+@@ -750,5 +750,7 @@ spi10_cs_pins: &spi10_cs_gpio1 {};
+ 			<&ant1>, "output-low?=on",
+ 			<&ant2>, "output-high?=off",
+ 			<&ant2>, "output-low?=on";
++		noanthogs = <&ant1>,"status=disabled",
++			<&ant2>, "status=disabled";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.6/950-1484-Add-and-update-files-for-pwm-gpio-fan-overlay.patch b/target/linux/bcm27xx/patches-6.6/950-1484-Add-and-update-files-for-pwm-gpio-fan-overlay.patch
new file mode 100644
index 00000000000000..521b3407303e3a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1484-Add-and-update-files-for-pwm-gpio-fan-overlay.patch
@@ -0,0 +1,246 @@
+From 5fa4b1ff4db7635da04b1b8bf33b42a941064718 Mon Sep 17 00:00:00 2001
+From: Kai-Uwe Herbing <155751635+herbingk@users.noreply.github.com>
+Date: Tue, 31 Dec 2024 19:44:31 +0100
+Subject: [PATCH] Add and update files for pwm-gpio-fan overlay
+
+Add and update files for pwm-gpio-fan overlay
+Signed-off-by: Kai-Uwe Herbing <155751635+herbingk@users.noreply.github.com>
+---
+ arch/arm/boot/dts/overlays/Makefile           |   1 +
+ arch/arm/boot/dts/overlays/README             |  40 +++++
+ .../dts/overlays/pwm-gpio-fan-overlay.dts     | 170 ++++++++++++++++++
+ 3 files changed, 211 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/pwm-gpio-fan-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -219,6 +219,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	pwm.dtbo \
+ 	pwm-2chan.dtbo \
+ 	pwm-gpio.dtbo \
++	pwm-gpio-fan.dtbo \
+ 	pwm-ir-tx.dtbo \
+ 	pwm-pio.dtbo \
+ 	pwm1.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -4036,6 +4036,46 @@ Load:   dtoverlay=pwm-gpio,<param>=<val>
+ Params: gpio                    Output pin (default 4)
+ 
+ 
++Name:   pwm-gpio-fan
++Info:   Configure a GPIO connected PWM cooling fan controlled by the
++        software-based GPIO PWM kernel module
++Load:   dtoverlay=pwm-gpio-fan,<param>=<val>
++Params: fan_gpio                BCM number of the pin driving the fan,
++                                default 18 (GPIO 18)
++        fan_temp0               CPU temperature at which fan is started with
++                                low speed in millicelsius,
++                                default 55000 (55 °C)
++        fan_temp1               CPU temperature at which fan is switched
++                                to medium speed in millicelsius,
++                                default 60000 (60 °C)
++        fan_temp2               CPU temperature at which fan is switched
++                                to high speed in millicelsius,
++                                default 67500 (67.5 °C)
++        fan_temp3               CPU temperature at which fan is switched
++                                to max speed in millicelsius,
++                                default 75000 (75 °C)
++        fan_temp0_hyst          Temperature hysteris at which fan is stopped
++                                in millicelsius,default 5000 (resulting
++                                in 50 °C)
++        fan_temp1_hyst          Temperature hysteris at which fan is switched
++                                back to low speed in millicelsius,
++                                default 5000 (resulting in 55 °C)
++        fan_temp2_hyst          Temperature hysteris at which fan is switched
++                                back to medium speed in millicelsius,
++                                default 5000 (resulting in 62.5 °C)
++        fan_temp3_hyst          Temperature hysteris at which fan is switched
++                                back to high speed in millicelsius,
++                                default 5000 (resulting in 70 °C)
++        fan_temp0_speed         Fan speed for low cooling state in range
++                                0 to 255, default 114 (45% PWM duty cycle)
++        fan_temp1_speed         Fan speed for medium cooling state in range
++                                0 to 255, default 152 (60% PWM duty cycle)
++        fan_temp2_speed         Fan speed for high cooling state in range
++                                0 to 255, default 204 (80% PWM duty cycle)
++        fan_temp3_speed         Fan speed for max cooling state in range
++                                0 to 255, default 255 (100% PWM duty cycle)
++
++
+ Name:   pwm-ir-tx
+ Info:   Use GPIO pin as pwm-assisted infrared transmitter output.
+         This is an alternative to "gpio-ir-tx". pwm-ir-tx makes use
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/pwm-gpio-fan-overlay.dts
+@@ -0,0 +1,170 @@
++/*
++ * Overlay for a GPIO connected PWM cooling fan controlled by software GPIO PWM
++ *
++ * Optional parameters:
++ *  - "fan_gpio"	BCM number of the pin driving the fan, default 18 (GPIO18)
++ *
++ *  - "fan_temp0"	CPU temperature at which fan is started with low speed in millicelsius,
++ *			default 55000 (55 °C)
++ *  - "fan_temp1"	CPU temperature at which fan is switched to medium speed in millicelsius,
++ *			default 60000  (60 °C)
++ *  - "fan_temp2"	CPU temperature at which fan is switched to high speed in millicelsius,
++ *			default 67500  (67.5 °C)
++ *  - "fan_temp3"	CPU temperature at which fan is switched to max speed in millicelsius,
++ *			default 75000  (75 °C)
++ *  - "fan_temp0_hyst"	Temperature hysteris at which fan is stopped in millicelsius,
++ *			default 5000 (resulting in 50 °C)
++ *  - "fan_temp1_hyst"	Temperature hysteris at which fan is switched back to low speed
++ *			in millicelsius, default 5000 (resulting in 55 °C)
++ *  - "fan_temp2_hyst"	Temperature hysteris at which fan is switched back to medium speed
++ *			in millicelsius, default 5000 (resulting in 62.5 °C)
++ *  - "fan_temp3_hyst"	Temperature hysteris at which fan is switched back to high speed
++ *			in millicelsius, default 5000 (resulting in 70 °C)
++ *  - "fan_temp0_speed"	Fan speed for low cooling state in range 0 to 255,
++ *			default 114 (45% PWM duty cycle)
++ *  - "fan_temp1_speed"	Fan speed for medium cooling state in range 0 to 255,
++ *			default 152 (60% PWM duty cycle)
++ *  - "fan_temp2_speed"	Fan speed for high cooling state in range 0 to 255,
++ *			default 204 (80% PWM duty cycle)
++ *  - "fan_temp3_speed"	Fan speed for max cooling state in range 0 to 255,
++ *			default 255 (100% PWM duty cycle)
++ *
++ * N.B.
++ *  - Uses the software GPIO PWM kernel module instead of the Pis hardware PWMs (PWM0/PWM1).
++ *    This will allow for an undisturbed concurrent usage of the Pis analogue audio output.
++ *
++ * Requires:
++ *  - A PWM controlled cooling fan connected to the GPIO, such as an
++ *    Argon mini-fan, HighPi Pro Fan or Waveshare FAN-4020-PWM-5V
++ *  - Raspberry Pi OS Bookworm with kernel 6.6.62 or above
++ *
++ * Build:
++ *  - sudo dtc -I dts -O dtb -o /boot/firmware/overlays/pwm-gpiofan.dtbo pwm-gpiofan-overlay.dts
++ *
++ * Activate:
++ *  - sudo nano /boot/firmware/config.txt add "dtoverlay=pwm-gpiofan"
++ *
++ */
++/dts-v1/;
++/plugin/;
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&gpio>;
++		__overlay__ {
++			pwm_gpio_pins: pwm_gpio_pins {
++				brcm,pins = <18>; /* gpio-pin = 18 */
++				brcm,function = <1>; /* gpio function = output */
++				brcm,pull = <0>; /* gpio pull up/down = off */
++			};
++		};
++	};
++
++	fragment@1 {
++		target-path = "/";
++		__overlay__ {
++			pwm_gpio: pwm_gpio {
++				compatible="pwm-gpio";
++				#pwm-cells = <2>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&pwm_gpio_pins>;
++				gpios = <&gpio 18 0>; /* gpio-pin = 18 */
++			};
++		};
++	};
++
++	fragment@2 {
++		target-path = "/";
++		__overlay__ {
++			fan0: pwm-fan {
++				compatible = "pwm-fan";
++				#cooling-cells = <2>;
++				/* in ns = 20ms = 50 Hz */
++				pwms = <&pwm_gpio 0 20000000 0>;
++
++				cooling-min-state = <0>;
++				cooling-max-state = <4>;
++				/* PWM duty cycle values in a range from 0 to 255 */
++				/* which correspond to thermal cooling states 0 to 4 */
++				cooling-levels = <0 114 152 204 255>;
++			};
++		};
++	};
++
++	fragment@3 {
++		target = <&cpu_thermal>;
++		__overlay__ {
++			/* in ms = poll every 2s */
++			polling-delay = <2000>;
++		};
++	};
++
++	fragment@4 {
++		target = <&thermal_trips>;
++		__overlay__ {
++			/* below temperatures in millicelsius */
++			trip0: trip0 {
++				temperature = <55000>; /* 55 °C */
++				hysteresis = <5000>;   /*  5 °C */
++				type = "active";
++			};
++			trip1: trip1 {
++				temperature = <60000>; /* 60 °C */
++				hysteresis = <5000>;   /*  5 °C */
++				type = "active";
++			};
++			trip2: trip2 {
++				temperature = <67500>; /* 67.5 °C */
++				hysteresis = <5000>;   /*  5 °C */
++				type = "active";
++			};
++			trip3: trip3 {
++				temperature = <75000>; /* 75 °C */
++				hysteresis = <5000>;   /*  5 °C */
++				type = "active";
++			};
++		};
++	};
++
++	fragment@5 {
++		target = <&cooling_maps>;
++		__overlay__ {
++			map0 {
++				cooling-device = <&fan0 0 1>;
++				trip = <&trip0>;
++			};
++			map1 {
++				cooling-device = <&fan0 1 2>;
++				trip = <&trip1>;
++			};
++			map2 {
++				cooling-device = <&fan0 2 3>;
++				trip = <&trip2>;
++			};
++			map3 {
++				cooling-device = <&fan0 3 4>;
++				trip = <&trip3>;
++			};
++		};
++	};
++
++	__overrides__ {
++		fan_gpio =		<&pwm_gpio>,"gpios:4",
++					<&pwm_gpio_pins>,"brcm,pins:0";
++		fan_temp0 =		<&trip0>,"temperature:0";
++		fan_temp0_hyst =	<&trip0>,"hysteresis:0";
++		fan_temp0_speed =	<&fan0>,"cooling-levels:4";
++		fan_temp1 =		<&trip1>,"temperature:0";
++		fan_temp1_hyst =	<&trip1>,"hysteresis:0";
++		fan_temp1_speed =	<&fan0>,"cooling-levels:8";
++		fan_temp2 =		<&trip2>,"temperature:0";
++		fan_temp2_hyst =	<&trip2>,"hysteresis:0";
++		fan_temp2_speed =	<&fan0>,"cooling-levels:12";
++		fan_temp3 =		<&trip3>,"temperature:0";
++		fan_temp3_hyst =	<&trip3>,"hysteresis:0";
++		fan_temp3_speed =	<&fan0>,"cooling-levels:16";
++	};
++
++};
diff --git a/target/linux/bcm27xx/patches-6.6/950-1486-media-i2c-imx290-Limit-analogue-gain-according-to-mo.patch b/target/linux/bcm27xx/patches-6.6/950-1486-media-i2c-imx290-Limit-analogue-gain-according-to-mo.patch
new file mode 100644
index 00000000000000..818f95f7c3b5dc
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1486-media-i2c-imx290-Limit-analogue-gain-according-to-mo.patch
@@ -0,0 +1,71 @@
+From b3dd7e8947cddec41864e8d3ce5f5d8b81033d6a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 20 Nov 2024 19:17:03 +0000
+Subject: [PATCH] media: i2c: imx290: Limit analogue gain according to module
+
+Commit ec75fd952b0b5cdab7b606cdacba237c57c1fdda upstream.
+
+The imx327 only supports up to 29.4dB of analogue gain, vs
+the imx290 going up to 30dB. Both are in 0.3dB steps.
+
+As we now have model specific config, fix this mismatch,
+and delete the comment referencing it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -178,6 +178,7 @@ struct imx290_model_info {
+ 	enum imx290_colour_variant colour_variant;
+ 	const struct cci_reg_sequence *init_regs;
+ 	size_t init_regs_num;
++	unsigned int max_analog_gain;
+ 	const char *name;
+ };
+ 
+@@ -879,14 +880,10 @@ static int imx290_ctrl_init(struct imx29
+ 	 * up to 72.0dB (240) add further digital gain. Limit the range to
+ 	 * analog gain only, support for digital gain can be added separately
+ 	 * if needed.
+-	 *
+-	 * The IMX327 and IMX462 are largely compatible with the IMX290, but
+-	 * have an analog gain range of 0.0dB to 29.4dB and 42dB of digital
+-	 * gain. When support for those sensors gets added to the driver, the
+-	 * gain control should be adjusted accordingly.
+ 	 */
+ 	v4l2_ctrl_new_std(&imx290->ctrls, &imx290_ctrl_ops,
+-			  V4L2_CID_ANALOGUE_GAIN, 0, 100, 1, 0);
++			  V4L2_CID_ANALOGUE_GAIN, 0,
++			  imx290->model->max_analog_gain, 1, 0);
+ 
+ 	/*
+ 	 * Correct range will be determined through imx290_ctrl_update setting
+@@ -1437,18 +1434,21 @@ static const struct imx290_model_info im
+ 		.colour_variant = IMX290_VARIANT_COLOUR,
+ 		.init_regs = imx290_global_init_settings_290,
+ 		.init_regs_num = ARRAY_SIZE(imx290_global_init_settings_290),
++		.max_analog_gain = 100,
+ 		.name = "imx290",
+ 	},
+ 	[IMX290_MODEL_IMX290LLR] = {
+ 		.colour_variant = IMX290_VARIANT_MONO,
+ 		.init_regs = imx290_global_init_settings_290,
+ 		.init_regs_num = ARRAY_SIZE(imx290_global_init_settings_290),
++		.max_analog_gain = 100,
+ 		.name = "imx290",
+ 	},
+ 	[IMX290_MODEL_IMX327LQR] = {
+ 		.colour_variant = IMX290_VARIANT_COLOUR,
+ 		.init_regs = imx290_global_init_settings_327,
+ 		.init_regs_num = ARRAY_SIZE(imx290_global_init_settings_327),
++		.max_analog_gain = 98,
+ 		.name = "imx327",
+ 	},
+ };
diff --git a/target/linux/bcm27xx/patches-6.6/950-1488-media-dt-bindings-sony-imx290-Add-IMX462-to-the-IMX2.patch b/target/linux/bcm27xx/patches-6.6/950-1488-media-dt-bindings-sony-imx290-Add-IMX462-to-the-IMX2.patch
new file mode 100644
index 00000000000000..7cf477c3c8e8e5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1488-media-dt-bindings-sony-imx290-Add-IMX462-to-the-IMX2.patch
@@ -0,0 +1,31 @@
+From f4f17c3fe223b3d8ad65f5420abbcd69ef901186 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 20 Nov 2024 19:17:05 +0000
+Subject: [PATCH] media: dt-bindings: sony,imx290: Add IMX462 to the IMX290
+ binding
+
+Commit e4faac99d5bb4b6c80f2495c40fcd71a67c40b27 upstream.
+
+IMX462 is the successor to IMX290, which is supportable by
+the existing IMX290 driver via a new compatible string.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Acked-by: Conor Dooley <conor.dooley@microchip.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+---
+ Documentation/devicetree/bindings/media/i2c/sony,imx290.yaml | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/Documentation/devicetree/bindings/media/i2c/sony,imx290.yaml
++++ b/Documentation/devicetree/bindings/media/i2c/sony,imx290.yaml
+@@ -30,6 +30,8 @@ properties:
+           - sony,imx290lqr # Colour
+           - sony,imx290llr # Monochrome
+           - sony,imx327lqr # Colour
++          - sony,imx462lqr # Colour
++          - sony,imx462llr # Monochrome
+       - const: sony,imx290
+         deprecated: true
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1489-media-i2c-imx290-Add-configuration-for-IMX462.patch b/target/linux/bcm27xx/patches-6.6/950-1489-media-i2c-imx290-Add-configuration-for-IMX462.patch
new file mode 100644
index 00000000000000..027f4571d81392
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1489-media-i2c-imx290-Add-configuration-for-IMX462.patch
@@ -0,0 +1,116 @@
+From 23037697914a6d1220768a752c6358d35ca03737 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 20 Nov 2024 19:17:06 +0000
+Subject: [PATCH] media: i2c: imx290: Add configuration for IMX462
+
+Commit c699b6c7c857baba1375a1ed090bf71f695e2971 upstream.
+
+IMX462 is the successor to IMX290, and wants very minor
+changes to the register setup.
+
+Add the relevant configuration to support it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+---
+ drivers/media/i2c/imx290.c | 66 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 66 insertions(+)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -172,6 +172,8 @@ enum imx290_model {
+ 	IMX290_MODEL_IMX290LQR,
+ 	IMX290_MODEL_IMX290LLR,
+ 	IMX290_MODEL_IMX327LQR,
++	IMX290_MODEL_IMX462LQR,
++	IMX290_MODEL_IMX462LLR,
+ };
+ 
+ struct imx290_model_info {
+@@ -318,6 +320,50 @@ static const struct cci_reg_sequence imx
+ 	{ CCI_REG8(0x33b3), 0x04 },
+ };
+ 
++static const struct cci_reg_sequence imx290_global_init_settings_462[] = {
++	{ CCI_REG8(0x300f), 0x00 },
++	{ CCI_REG8(0x3010), 0x21 },
++	{ CCI_REG8(0x3011), 0x02 },
++	{ CCI_REG8(0x3016), 0x09 },
++	{ CCI_REG8(0x3070), 0x02 },
++	{ CCI_REG8(0x3071), 0x11 },
++	{ CCI_REG8(0x309b), 0x10 },
++	{ CCI_REG8(0x309c), 0x22 },
++	{ CCI_REG8(0x30a2), 0x02 },
++	{ CCI_REG8(0x30a6), 0x20 },
++	{ CCI_REG8(0x30a8), 0x20 },
++	{ CCI_REG8(0x30aa), 0x20 },
++	{ CCI_REG8(0x30ac), 0x20 },
++	{ CCI_REG8(0x30b0), 0x43 },
++	{ CCI_REG8(0x3119), 0x9e },
++	{ CCI_REG8(0x311c), 0x1e },
++	{ CCI_REG8(0x311e), 0x08 },
++	{ CCI_REG8(0x3128), 0x05 },
++	{ CCI_REG8(0x313d), 0x83 },
++	{ CCI_REG8(0x3150), 0x03 },
++	{ CCI_REG8(0x317e), 0x00 },
++	{ CCI_REG8(0x32b8), 0x50 },
++	{ CCI_REG8(0x32b9), 0x10 },
++	{ CCI_REG8(0x32ba), 0x00 },
++	{ CCI_REG8(0x32bb), 0x04 },
++	{ CCI_REG8(0x32c8), 0x50 },
++	{ CCI_REG8(0x32c9), 0x10 },
++	{ CCI_REG8(0x32ca), 0x00 },
++	{ CCI_REG8(0x32cb), 0x04 },
++	{ CCI_REG8(0x332c), 0xd3 },
++	{ CCI_REG8(0x332d), 0x10 },
++	{ CCI_REG8(0x332e), 0x0d },
++	{ CCI_REG8(0x3358), 0x06 },
++	{ CCI_REG8(0x3359), 0xe1 },
++	{ CCI_REG8(0x335a), 0x11 },
++	{ CCI_REG8(0x3360), 0x1e },
++	{ CCI_REG8(0x3361), 0x61 },
++	{ CCI_REG8(0x3362), 0x10 },
++	{ CCI_REG8(0x33b0), 0x50 },
++	{ CCI_REG8(0x33b2), 0x1a },
++	{ CCI_REG8(0x33b3), 0x04 },
++};
++
+ #define IMX290_NUM_CLK_REGS	2
+ static const struct cci_reg_sequence xclk_regs[][IMX290_NUM_CLK_REGS] = {
+ 	[IMX290_CLK_37_125] = {
+@@ -1451,6 +1497,20 @@ static const struct imx290_model_info im
+ 		.max_analog_gain = 98,
+ 		.name = "imx327",
+ 	},
++	[IMX290_MODEL_IMX462LQR] = {
++		.colour_variant = IMX290_VARIANT_COLOUR,
++		.init_regs = imx290_global_init_settings_462,
++		.init_regs_num = ARRAY_SIZE(imx290_global_init_settings_462),
++		.max_analog_gain = 98,
++		.name = "imx462",
++	},
++	[IMX290_MODEL_IMX462LLR] = {
++		.colour_variant = IMX290_VARIANT_MONO,
++		.init_regs = imx290_global_init_settings_462,
++		.init_regs_num = ARRAY_SIZE(imx290_global_init_settings_462),
++		.max_analog_gain = 98,
++		.name = "imx462",
++	},
+ };
+ 
+ static int imx290_parse_dt(struct imx290 *imx290)
+@@ -1646,6 +1706,12 @@ static const struct of_device_id imx290_
+ 	}, {
+ 		.compatible = "sony,imx327lqr",
+ 		.data = &imx290_models[IMX290_MODEL_IMX327LQR],
++	}, {
++		.compatible = "sony,imx462lqr",
++		.data = &imx290_models[IMX290_MODEL_IMX462LQR],
++	}, {
++		.compatible = "sony,imx462llr",
++		.data = &imx290_models[IMX290_MODEL_IMX462LLR],
+ 	},
+ 	{ /* sentinel */ },
+ };
diff --git a/target/linux/bcm27xx/patches-6.6/950-1490-media-imx290-Add-module-parameter-to-allow-selection.patch b/target/linux/bcm27xx/patches-6.6/950-1490-media-imx290-Add-module-parameter-to-allow-selection.patch
new file mode 100644
index 00000000000000..219cfce67bee3c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1490-media-imx290-Add-module-parameter-to-allow-selection.patch
@@ -0,0 +1,60 @@
+From c633c2e93e460925120e0817c14bbfc444a70226 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 15 May 2024 12:43:15 +0100
+Subject: [PATCH] media: imx290: Add module parameter to allow selection of HCG
+ mode
+
+The sensor has Low Conversion Gain (HCG) and High Conversion Gain (HCG)
+modes, with the supposedly the HCG mode having better noise performance
+at high gains.
+
+As this parameter changes the gain range of the sensor, it isn't
+possible to make this an automatic property, and there is no
+suitable V4L2 control to set it, so just add it as a module parameter.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/imx290.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/imx290.c
++++ b/drivers/media/i2c/imx290.c
+@@ -13,6 +13,7 @@
+ #include <linux/gpio/consumer.h>
+ #include <linux/i2c.h>
+ #include <linux/module.h>
++#include <linux/moduleparam.h>
+ #include <linux/of.h>
+ #include <linux/pm_runtime.h>
+ #include <linux/regmap.h>
+@@ -41,6 +42,9 @@
+ #define IMX290_WINMODE_720P				(1 << 4)
+ #define IMX290_WINMODE_CROP				(4 << 4)
+ #define IMX290_FR_FDG_SEL				CCI_REG8(0x3009)
++#define IMX290_FDG_HCG					BIT(4)
++#define IMX290_FRSEL_60FPS				BIT(0)
++#define IMX290_FDG_LCG					0
+ #define IMX290_BLKLEVEL					CCI_REG16_LE(0x300a)
+ #define IMX290_GAIN					CCI_REG8(0x3014)
+ #define IMX290_VMAX					CCI_REG24_LE(0x3018)
+@@ -162,6 +166,10 @@
+ 
+ #define IMX290_NUM_SUPPLIES				3
+ 
++static bool hcg_mode;
++module_param(hcg_mode, bool, 0664);
++MODULE_PARM_DESC(hcg_mode, "Enable HCG mode");
++
+ enum imx290_colour_variant {
+ 	IMX290_VARIANT_COLOUR,
+ 	IMX290_VARIANT_MONO,
+@@ -697,7 +705,8 @@ static int imx290_set_data_lanes(struct
+ 		  &ret);
+ 	cci_write(imx290->regmap, IMX290_CSI_LANE_MODE, imx290->nlanes - 1,
+ 		  &ret);
+-	cci_write(imx290->regmap, IMX290_FR_FDG_SEL, 0x01, &ret);
++	cci_write(imx290->regmap, IMX290_FR_FDG_SEL, IMX290_FRSEL_60FPS |
++		  (hcg_mode ? IMX290_FDG_HCG : IMX290_FDG_LCG), &ret);
+ 
+ 	return ret;
+ }
diff --git a/target/linux/bcm27xx/patches-6.6/950-1491-dtoverlays-Switch-imx462-overlay-to-use-the-new-comp.patch b/target/linux/bcm27xx/patches-6.6/950-1491-dtoverlays-Switch-imx462-overlay-to-use-the-new-comp.patch
new file mode 100644
index 00000000000000..8e894791c238de
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1491-dtoverlays-Switch-imx462-overlay-to-use-the-new-comp.patch
@@ -0,0 +1,47 @@
+From eec7048c4e3aec1aadc21fcffcf6be9f5385f72a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 12 Nov 2024 14:15:30 +0000
+Subject: [PATCH] dtoverlays: Switch imx462 overlay to use the new compatible
+
+Now that imx462 has a separate compatible string, make use of it.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/imx462-overlay.dts | 10 +++-------
+ 1 file changed, 3 insertions(+), 7 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/imx462-overlay.dts
++++ b/arch/arm/boot/dts/overlays/imx462-overlay.dts
+@@ -1,9 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ // Definitions for IMX462 camera module on VC I2C bus
+ 
+-// IMX462 is the successor to IMX290. The drivers currently don't support
+-// any additional feature of IMX462, so use the IMX290 compatible strings
+-// for now.
++// IMX462 is the successor to IMX290.
+ 
+ /dts-v1/;
+ /plugin/;
+@@ -17,19 +15,17 @@
+ 	// Fragment numbers deliberately high to avoid conflicts with the
+ 	// included imx290_327 overlay file.
+ 
+-	//IMX462 is not defined in the bindings, so use IMX290 for now.
+-
+ 	fragment@101 {
+ 		target = <&cam_node>;
+ 		__overlay__ {
+-			compatible = "sony,imx290lqr";
++			compatible = "sony,imx462lqr";
+ 		};
+ 	};
+ 
+ 	fragment@102 {
+ 		target = <&cam_node>;
+ 		__dormant__ {
+-			compatible = "sony,imx290llr";
++			compatible = "sony,imx462llr";
+ 		};
+ 	};
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1492-media-i2c-imx415-Add-more-clock-configurations.patch b/target/linux/bcm27xx/patches-6.6/950-1492-media-i2c-imx415-Add-more-clock-configurations.patch
new file mode 100644
index 00000000000000..0b04bf0c2b206a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1492-media-i2c-imx415-Add-more-clock-configurations.patch
@@ -0,0 +1,327 @@
+From 0a0814f830829b1a377273ddb09c156c84e1a8ca Mon Sep 17 00:00:00 2001
+From: Alexander Stein <alexander.stein@ew.tq-group.com>
+Date: Wed, 17 Jan 2024 08:39:36 +0100
+Subject: [PATCH] media: i2c: imx415: Add more clock configurations
+
+Commit b814b5b2ec2d327b79e415c1baa5eecdf9aa786b upstream.
+
+Complete the list from "INCK Setting" section in IMX415-AAQR-C
+(Rev. E19504, 2019/05/21). For consistency suffix all lane rate values by
+UL, which is needed for 2376000000 anyway.
+
+Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
+Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+---
+ drivers/media/i2c/imx415.c | 265 ++++++++++++++++++++++++++++++++++++-
+ 1 file changed, 260 insertions(+), 5 deletions(-)
+
+--- a/drivers/media/i2c/imx415.c
++++ b/drivers/media/i2c/imx415.c
+@@ -124,7 +124,7 @@ struct imx415_clk_params {
+ /* INCK Settings - includes all lane rate and INCK dependent registers */
+ static const struct imx415_clk_params imx415_clk_params[] = {
+ 	{
+-		.lane_rate = 594000000,
++		.lane_rate = 594000000UL,
+ 		.inck = 27000000,
+ 		.regs[0] = { IMX415_BCWAIT_TIME, 0x05D },
+ 		.regs[1] = { IMX415_CPWAIT_TIME, 0x042 },
+@@ -139,7 +139,37 @@ static const struct imx415_clk_params im
+ 		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x06C0 },
+ 	},
+ 	{
+-		.lane_rate = 720000000,
++		.lane_rate = 594000000UL,
++		.inck = 37125000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x07F },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x05B },
++		.regs[2] = { IMX415_SYS_MODE, 0x7 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x24 },
++		.regs[5] = { IMX415_INCKSEL3, 0x080 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x24 },
++		.regs[8] = { IMX415_INCKSEL6, 0x0 },
++		.regs[9] = { IMX415_INCKSEL7, 0x1 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x0984 },
++	},
++	{
++		.lane_rate = 594000000UL,
++		.inck = 74250000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x0FF },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x0B6 },
++		.regs[2] = { IMX415_SYS_MODE, 0x7 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x28 },
++		.regs[5] = { IMX415_INCKSEL3, 0x080 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x28 },
++		.regs[8] = { IMX415_INCKSEL6, 0x0 },
++		.regs[9] = { IMX415_INCKSEL7, 0x1 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x1290 },
++	},
++	{
++		.lane_rate = 720000000UL,
+ 		.inck = 24000000,
+ 		.regs[0] = { IMX415_BCWAIT_TIME, 0x054 },
+ 		.regs[1] = { IMX415_CPWAIT_TIME, 0x03B },
+@@ -154,7 +184,22 @@ static const struct imx415_clk_params im
+ 		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x0600 },
+ 	},
+ 	{
+-		.lane_rate = 891000000,
++		.lane_rate = 720000000UL,
++		.inck = 72000000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x0F8 },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x0B0 },
++		.regs[2] = { IMX415_SYS_MODE, 0x9 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x28 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0A0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x28 },
++		.regs[8] = { IMX415_INCKSEL6, 0x0 },
++		.regs[9] = { IMX415_INCKSEL7, 0x1 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x1200 },
++	},
++	{
++		.lane_rate = 891000000UL,
+ 		.inck = 27000000,
+ 		.regs[0] = { IMX415_BCWAIT_TIME, 0x05D },
+ 		.regs[1] = { IMX415_CPWAIT_TIME, 0x042 },
+@@ -169,7 +214,37 @@ static const struct imx415_clk_params im
+ 		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x06C0 },
+ 	},
+ 	{
+-		.lane_rate = 1440000000,
++		.lane_rate = 891000000UL,
++		.inck = 37125000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x07F },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x05B },
++		.regs[2] = { IMX415_SYS_MODE, 0x5 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x24 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0C0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x24 },
++		.regs[8] = { IMX415_INCKSEL6, 0x0 },
++		.regs[9] = { IMX415_INCKSEL7, 0x1 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x0948 },
++	},
++	{
++		.lane_rate = 891000000UL,
++		.inck = 74250000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x0FF },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x0B6 },
++		.regs[2] = { IMX415_SYS_MODE, 0x5 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x28 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0C0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x28 },
++		.regs[8] = { IMX415_INCKSEL6, 0x0 },
++		.regs[9] = { IMX415_INCKSEL7, 0x1 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x1290 },
++	},
++	{
++		.lane_rate = 1440000000UL,
+ 		.inck = 24000000,
+ 		.regs[0] = { IMX415_BCWAIT_TIME, 0x054 },
+ 		.regs[1] = { IMX415_CPWAIT_TIME, 0x03B },
+@@ -184,7 +259,22 @@ static const struct imx415_clk_params im
+ 		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x0600 },
+ 	},
+ 	{
+-		.lane_rate = 1485000000,
++		.lane_rate = 1440000000UL,
++		.inck = 72000000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x0F8 },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x0B0 },
++		.regs[2] = { IMX415_SYS_MODE, 0x8 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x28 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0A0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x28 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x1200 },
++	},
++	{
++		.lane_rate = 1485000000UL,
+ 		.inck = 27000000,
+ 		.regs[0] = { IMX415_BCWAIT_TIME, 0x05D },
+ 		.regs[1] = { IMX415_CPWAIT_TIME, 0x042 },
+@@ -198,6 +288,171 @@ static const struct imx415_clk_params im
+ 		.regs[9] = { IMX415_INCKSEL7, 0x0 },
+ 		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x06C0 },
+ 	},
++	{
++		.lane_rate = 1485000000UL,
++		.inck = 37125000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x07F },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x05B },
++		.regs[2] = { IMX415_SYS_MODE, 0x8 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x24 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0A0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x24 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x0948 },
++	},
++	{
++		.lane_rate = 1485000000UL,
++		.inck = 74250000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x0FF },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x0B6 },
++		.regs[2] = { IMX415_SYS_MODE, 0x8 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x28 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0A0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x28 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x1290 },
++	},
++	{
++		.lane_rate = 1782000000UL,
++		.inck = 27000000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x05D },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x042 },
++		.regs[2] = { IMX415_SYS_MODE, 0x4 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x23 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0C6 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E7 },
++		.regs[7] = { IMX415_INCKSEL5, 0x23 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x06C0 },
++	},
++	{
++		.lane_rate = 1782000000UL,
++		.inck = 37125000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x07F },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x05B },
++		.regs[2] = { IMX415_SYS_MODE, 0x4 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x24 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0C0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x24 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x0948 },
++	},
++	{
++		.lane_rate = 1782000000UL,
++		.inck = 74250000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x0FF },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x0B6 },
++		.regs[2] = { IMX415_SYS_MODE, 0x4 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x28 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0C0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x28 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x1290 },
++	},
++	{
++		.lane_rate = 2079000000UL,
++		.inck = 27000000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x05D },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x042 },
++		.regs[2] = { IMX415_SYS_MODE, 0x2 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x23 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0E7 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E7 },
++		.regs[7] = { IMX415_INCKSEL5, 0x23 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x06C0 },
++	},
++	{
++		.lane_rate = 2079000000UL,
++		.inck = 37125000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x07F },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x05B },
++		.regs[2] = { IMX415_SYS_MODE, 0x2 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x24 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0E0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x24 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x0948 },
++	},
++	{
++		.lane_rate = 2079000000UL,
++		.inck = 74250000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x0FF },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x0B6 },
++		.regs[2] = { IMX415_SYS_MODE, 0x2 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x28 },
++		.regs[5] = { IMX415_INCKSEL3, 0x0E0 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x28 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x1290 },
++	},
++	{
++		.lane_rate = 2376000000UL,
++		.inck = 27000000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x05D },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x042 },
++		.regs[2] = { IMX415_SYS_MODE, 0x0 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x23 },
++		.regs[5] = { IMX415_INCKSEL3, 0x108 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E7 },
++		.regs[7] = { IMX415_INCKSEL5, 0x23 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x06C0 },
++	},
++	{
++		.lane_rate = 2376000000UL,
++		.inck = 37125000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x07F },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x05B },
++		.regs[2] = { IMX415_SYS_MODE, 0x0 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x24 },
++		.regs[5] = { IMX415_INCKSEL3, 0x100 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x24 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x0948 },
++	},
++	{
++		.lane_rate = 2376000000UL,
++		.inck = 74250000,
++		.regs[0] = { IMX415_BCWAIT_TIME, 0x0FF },
++		.regs[1] = { IMX415_CPWAIT_TIME, 0x0B6 },
++		.regs[2] = { IMX415_SYS_MODE, 0x0 },
++		.regs[3] = { IMX415_INCKSEL1, 0x00 },
++		.regs[4] = { IMX415_INCKSEL2, 0x28 },
++		.regs[5] = { IMX415_INCKSEL3, 0x100 },
++		.regs[6] = { IMX415_INCKSEL4, 0x0E0 },
++		.regs[7] = { IMX415_INCKSEL5, 0x28 },
++		.regs[8] = { IMX415_INCKSEL6, 0x1 },
++		.regs[9] = { IMX415_INCKSEL7, 0x0 },
++		.regs[10] = { IMX415_TXCLKESC_FREQ, 0x1290 },
++	},
+ };
+ 
+ /* all-pixel 2-lane 720 Mbps 15.74 Hz mode */
diff --git a/target/linux/bcm27xx/patches-6.6/950-1494-dtoverlays-Add-overlay-for-Sony-IMX415-image-sensor.patch b/target/linux/bcm27xx/patches-6.6/950-1494-dtoverlays-Add-overlay-for-Sony-IMX415-image-sensor.patch
new file mode 100644
index 00000000000000..139cd58284082e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1494-dtoverlays-Add-overlay-for-Sony-IMX415-image-sensor.patch
@@ -0,0 +1,214 @@
+From 384e58f63a3a328f7f656052b6357f3408aac6c3 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 31 Dec 2024 20:33:46 +0000
+Subject: [PATCH] dtoverlays: Add overlay for Sony IMX415 image sensor
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/Makefile           |   1 +
+ arch/arm/boot/dts/overlays/README             |  31 +++++
+ arch/arm/boot/dts/overlays/imx415-overlay.dts | 116 ++++++++++++++++++
+ arch/arm/boot/dts/overlays/imx415.dtsi        |  27 ++++
+ 4 files changed, 175 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/imx415-overlay.dts
+ create mode 100644 arch/arm/boot/dts/overlays/imx415.dtsi
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -135,6 +135,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	imx296.dtbo \
+ 	imx327.dtbo \
+ 	imx378.dtbo \
++	imx415.dtbo \
+ 	imx462.dtbo \
+ 	imx477.dtbo \
+ 	imx500.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -2859,6 +2859,37 @@ Params: rotation                Mounting
+                                 450000000 (default), 453000000, 456000000.
+ 
+ 
++Name:   imx415
++Info:   Sony IMX415 camera module.
++        Uses Unicam 1, which is the standard camera connector on most Pi
++        variants. By default this uses 4 CSI2 data lanes, so requires a
++        Compute Module or Pi5.
++Load:   dtoverlay=imx415,<param>
++Params: addr                    Set I2C address of sensor. Valid values are
++                                0x10, 0x1a, 0x36 and 0x37. Default is 0x37.
++        4lane                   Enable 4 CSI2 data lanes.
++        clock-frequency         Sets the clock frequency to match that used on
++                                the board.
++                                Valid values are 24, 27, 37.125, 72, or
++                                74.25MHz.
++                                The default is 24MHz.
++                                Note that the link frequencies permitted vary
++                                based on the oscillator used.
++        link-frequency          Confgures the link frequency to be used. Note
++                                that the permitted values vary based on
++                                clock-frequency and number of lanes.
++                                The default is 360MHz for 720Mbit/s.
++        orientation             Sensor orientation (0 = front, 1 = rear,
++                                2 = external, default external)
++        rotation                Mounting rotation of the camera sensor (0 or
++                                180, default 0)
++        media-controller        Configure use of Media Controller API for
++                                configuring the sensor (default on)
++        cam0                    Adopt the default configuration for CAM0 on a
++                                Compute Module (CSI0, i2c_vc, and cam0_reg).
++        vcm                     Enable ad5398 VCM associated with the sensor.
++
++
+ Name:   imx462
+ Info:   Sony IMX462 camera module.
+         Uses Unicam 1, which is the standard camera connector on most Pi
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx415-overlay.dts
+@@ -0,0 +1,116 @@
++// SPDX-License-Identifier: GPL-2.0-only
++// Definitions for IMX415 camera module on VC I2C bus
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++
++/{
++	compatible = "brcm,bcm2835";
++
++	fragment@0 {
++		target = <&i2c0if>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	clk_frag: fragment@1 {
++		target = <&cam1_clk>;
++		cam_clk: __overlay__ {
++			status = "okay";
++			clock-frequency = <24000000>;
++		};
++	};
++
++	fragment@2 {
++		target = <&i2c0mux>;
++		__overlay__ {
++			status = "okay";
++		};
++	};
++
++	reg_frag: fragment@3 {
++		target = <&cam1_reg>;
++		cam_reg: __overlay__ {
++			startup-delay-us = <100000>;
++		};
++	};
++
++	i2c_frag: fragment@100 {
++		target = <&i2c_csi_dsi>;
++		__overlay__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			#include "imx415.dtsi"
++
++			vcm: ad5398@c {
++				compatible = "adi,ad5398";
++				reg = <0x0c>;
++				status = "disabled";
++				VANA-supply = <&cam1_reg>;
++			};
++		};
++	};
++
++	csi_frag: fragment@101 {
++		target = <&csi1>;
++		csi: __overlay__ {
++			status = "okay";
++			brcm,media-controller;
++
++			port {
++				csi_ep: endpoint {
++					remote-endpoint = <&cam_endpoint>;
++					clock-lanes = <0>;
++					data-lanes = <1 2>;
++					clock-noncontinuous;
++				};
++			};
++		};
++	};
++
++	fragment@201 {
++		target = <&cam_endpoint>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++		};
++	};
++
++	fragment@202 {
++		target = <&csi_ep>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++		};
++	};
++
++
++	__overrides__ {
++		addr = <&cam_node>, "reg:0";
++		rotation = <&cam_node>,"rotation:0";
++		orientation = <&cam_node>,"orientation:0";
++		media-controller = <&csi>,"brcm,media-controller?";
++		cam0 = <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
++		       <&csi_frag>, "target:0=",<&csi0>,
++		       <&reg_frag>, "target:0=",<&cam0_reg>,
++		       <&clk_frag>, "target:0=",<&cam0_clk>,
++		       <&cam_node>, "clocks:0=",<&cam0_clk>,
++		       <&cam_node>, "avdd-supply:0=",<&cam0_reg>,
++		       <&vcm>, "VANA-supply:0=", <&cam0_reg>;
++		vcm = <&vcm>, "status=okay",
++		      <&cam_node>,"lens-focus:0=", <&vcm>;
++		clock-frequency = <&cam_clk>, "clock-frequency:0";
++		link-frequency = <&cam_endpoint>,"link-frequencies#0";
++		4lane = <0>, "+201+202";
++	};
++};
++
++&cam_node {
++	status = "okay";
++};
++
++&cam_endpoint {
++	remote-endpoint = <&csi_ep>;
++};
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/imx415.dtsi
+@@ -0,0 +1,27 @@
++// Fragment that configures an imx415
++
++cam_node: imx415@37 {
++	compatible = "sony,imx415";
++	reg = <0x37>;
++	status = "disabled";
++
++	clocks = <&cam1_clk>;
++	clock-names = "inck";
++
++	avdd-supply = <&cam1_reg>;	/* 2.8v */
++	dvdd-supply = <&cam_dummy_reg>;	/* 1.8v */
++	ovdd-supply = <&cam_dummy_reg>;	/* 1.2v */
++
++	rotation = <180>;
++	orientation = <2>;
++
++	port {
++		cam_endpoint: endpoint {
++			clock-lanes = <0>;
++			data-lanes = <1 2>;
++			//clock-noncontinuous;
++			link-frequencies =
++				/bits/ 64 <360000000>;
++		};
++	};
++};
diff --git a/target/linux/bcm27xx/patches-6.6/950-1495-media-i2c-imx415-Add-read-write-control-of-VBLANK.patch b/target/linux/bcm27xx/patches-6.6/950-1495-media-i2c-imx415-Add-read-write-control-of-VBLANK.patch
new file mode 100644
index 00000000000000..aee483b9794701
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1495-media-i2c-imx415-Add-read-write-control-of-VBLANK.patch
@@ -0,0 +1,146 @@
+From 4e8d73ce89c6dd6fdcb8dd7df8310762707c5b1a Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 1 Jan 2025 14:18:25 +0000
+Subject: [PATCH] media: i2c: imx415: Add read/write control of VBLANK
+
+This also requires that the ranges for the exposure control
+are updated.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/imx415.c | 52 +++++++++++++++++++++++++-------------
+ 1 file changed, 34 insertions(+), 18 deletions(-)
+
+--- a/drivers/media/i2c/imx415.c
++++ b/drivers/media/i2c/imx415.c
+@@ -25,6 +25,7 @@
+ #define IMX415_PIXEL_ARRAY_WIDTH  3864
+ #define IMX415_PIXEL_ARRAY_HEIGHT 2192
+ #define IMX415_PIXEL_ARRAY_VBLANK 58
++#define IMX415_EXPOSURE_OFFSET	  8
+ 
+ #define IMX415_NUM_CLK_PARAM_REGS 11
+ 
+@@ -56,6 +57,7 @@
+ #define IMX415_OUTSEL		  IMX415_REG_8BIT(0x30C0)
+ #define IMX415_DRV		  IMX415_REG_8BIT(0x30C1)
+ #define IMX415_VMAX		  IMX415_REG_24BIT(0x3024)
++#define IMX415_VMAX_MAX		  0xfffff
+ #define IMX415_HMAX		  IMX415_REG_16BIT(0x3028)
+ #define IMX415_SHR0		  IMX415_REG_24BIT(0x3050)
+ #define IMX415_GAIN_PCG_0	  IMX415_REG_16BIT(0x3090)
+@@ -457,7 +459,6 @@ static const struct imx415_clk_params im
+ 
+ /* all-pixel 2-lane 720 Mbps 15.74 Hz mode */
+ static const struct imx415_reg imx415_mode_2_720[] = {
+-	{ IMX415_VMAX, 0x08CA },
+ 	{ IMX415_HMAX, 0x07F0 },
+ 	{ IMX415_LANEMODE, IMX415_LANEMODE_2 },
+ 	{ IMX415_TCLKPOST, 0x006F },
+@@ -473,7 +474,6 @@ static const struct imx415_reg imx415_mo
+ 
+ /* all-pixel 2-lane 1440 Mbps 30.01 Hz mode */
+ static const struct imx415_reg imx415_mode_2_1440[] = {
+-	{ IMX415_VMAX, 0x08CA },
+ 	{ IMX415_HMAX, 0x042A },
+ 	{ IMX415_LANEMODE, IMX415_LANEMODE_2 },
+ 	{ IMX415_TCLKPOST, 0x009F },
+@@ -489,7 +489,6 @@ static const struct imx415_reg imx415_mo
+ 
+ /* all-pixel 4-lane 891 Mbps 30 Hz mode */
+ static const struct imx415_reg imx415_mode_4_891[] = {
+-	{ IMX415_VMAX, 0x08CA },
+ 	{ IMX415_HMAX, 0x044C },
+ 	{ IMX415_LANEMODE, IMX415_LANEMODE_4 },
+ 	{ IMX415_TCLKPOST, 0x007F },
+@@ -617,6 +616,7 @@ struct imx415 {
+ 	struct v4l2_ctrl *vblank;
+ 	struct v4l2_ctrl *hflip;
+ 	struct v4l2_ctrl *vflip;
++	struct v4l2_ctrl *exposure;
+ 
+ 	unsigned int cur_mode;
+ 	unsigned int num_data_lanes;
+@@ -795,16 +795,37 @@ static int imx415_s_ctrl(struct v4l2_ctr
+ 					     ctrls);
+ 	const struct v4l2_mbus_framefmt *format;
+ 	struct v4l2_subdev_state *state;
++	u32 exposure_max;
+ 	unsigned int vmax;
+ 	unsigned int flip;
+-
+-	if (!sensor->streaming)
+-		return 0;
++	int ret;
+ 
+ 	state = v4l2_subdev_get_locked_active_state(&sensor->subdev);
+ 	format = v4l2_subdev_get_pad_format(&sensor->subdev, state, 0);
+ 
++	if (ctrl->id == V4L2_CID_VBLANK) {
++		exposure_max = format->height + ctrl->val -
++			       IMX415_EXPOSURE_OFFSET;
++		__v4l2_ctrl_modify_range(sensor->exposure,
++					 sensor->exposure->minimum,
++					 exposure_max, sensor->exposure->step,
++					 sensor->exposure->default_value);
++	}
++
++	if (!sensor->streaming)
++		return 0;
++
+ 	switch (ctrl->id) {
++	case V4L2_CID_VBLANK:
++		ret = imx415_write(sensor, IMX415_VMAX,
++				   format->height + ctrl->val);
++		if (ret)
++			return ret;
++		/*
++		 * Deliberately fall through as exposure is set based on VMAX
++		 * which has just changed.
++		 */
++		fallthrough;
+ 	case V4L2_CID_EXPOSURE:
+ 		/* clamp the exposure value to VMAX. */
+ 		vmax = format->height + sensor->vblank->cur.val;
+@@ -840,7 +861,8 @@ static int imx415_ctrls_init(struct imx4
+ 	u64 pixel_rate = supported_modes[sensor->cur_mode].pixel_rate;
+ 	u64 lane_rate = supported_modes[sensor->cur_mode].lane_rate;
+ 	u32 exposure_max = IMX415_PIXEL_ARRAY_HEIGHT +
+-			   IMX415_PIXEL_ARRAY_VBLANK - 8;
++			   IMX415_PIXEL_ARRAY_VBLANK -
++			   IMX415_EXPOSURE_OFFSET;
+ 	u32 hblank;
+ 	unsigned int i;
+ 	int ret;
+@@ -869,8 +891,9 @@ static int imx415_ctrls_init(struct imx4
+ 	if (ctrl)
+ 		ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+ 
+-	v4l2_ctrl_new_std(&sensor->ctrls, &imx415_ctrl_ops, V4L2_CID_EXPOSURE,
+-			  4, exposure_max, 1, exposure_max);
++	sensor->exposure = v4l2_ctrl_new_std(&sensor->ctrls, &imx415_ctrl_ops,
++					     V4L2_CID_EXPOSURE, 4,
++					     exposure_max, 1, exposure_max);
+ 
+ 	v4l2_ctrl_new_std(&sensor->ctrls, &imx415_ctrl_ops,
+ 			  V4L2_CID_ANALOGUE_GAIN, IMX415_AGAIN_MIN,
+@@ -887,16 +910,9 @@ static int imx415_ctrls_init(struct imx4
+ 	sensor->vblank = v4l2_ctrl_new_std(&sensor->ctrls, &imx415_ctrl_ops,
+ 					   V4L2_CID_VBLANK,
+ 					   IMX415_PIXEL_ARRAY_VBLANK,
+-					   IMX415_PIXEL_ARRAY_VBLANK, 1,
+-					   IMX415_PIXEL_ARRAY_VBLANK);
+-	if (sensor->vblank)
+-		sensor->vblank->flags |= V4L2_CTRL_FLAG_READ_ONLY;
+-
+-	/*
+-	 * The pixel rate used here is a virtual value and can be used for
+-	 * calculating the frame rate together with hblank. It may not
+-	 * necessarily be the physically correct pixel clock.
+-	 */
++					   IMX415_VMAX_MAX - IMX415_PIXEL_ARRAY_HEIGHT,
++					   1, IMX415_PIXEL_ARRAY_VBLANK);
++
+ 	v4l2_ctrl_new_std(&sensor->ctrls, NULL, V4L2_CID_PIXEL_RATE, pixel_rate,
+ 			  pixel_rate, 1, pixel_rate);
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1496-media-i2c-imx415-Make-HBLANK-controllable-and-in-con.patch b/target/linux/bcm27xx/patches-6.6/950-1496-media-i2c-imx415-Make-HBLANK-controllable-and-in-con.patch
new file mode 100644
index 00000000000000..7ad9e11953b78c
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1496-media-i2c-imx415-Make-HBLANK-controllable-and-in-con.patch
@@ -0,0 +1,231 @@
+From 6722e1358768671c1e5761aa092efb4ae62b2c46 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Wed, 1 Jan 2025 17:01:34 +0000
+Subject: [PATCH] media: i2c: imx415: Make HBLANK controllable and in
+ consistent units
+
+The control of HMAX documented in the datasheet is consistent
+with being in terms of a scaled INCK, being always 72MHz or
+74.25MHz. It is NOT link frequency dependent, but the minimum
+value for HMAX is dictated by the link frequency.
+
+If PIXEL_RATE is defined as being 12 times the 72 or 74.25MHz,
+and all values are scaled down again when writing HMAX, then
+the numbers all work out regardless of INCK or link frequency.
+Retain an hmax_min (set to the same value as the previous fixed
+hmax register value) to set as the default value to avoid changing
+the behaviour for existing users.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/imx415.c | 86 +++++++++++++++++---------------------
+ 1 file changed, 38 insertions(+), 48 deletions(-)
+
+--- a/drivers/media/i2c/imx415.c
++++ b/drivers/media/i2c/imx415.c
+@@ -27,6 +27,9 @@
+ #define IMX415_PIXEL_ARRAY_VBLANK 58
+ #define IMX415_EXPOSURE_OFFSET	  8
+ 
++#define IMX415_PIXEL_RATE_74_25MHZ	891000000
++#define IMX415_PIXEL_RATE_72MHZ		864000000
++
+ #define IMX415_NUM_CLK_PARAM_REGS 11
+ 
+ #define IMX415_REG_8BIT(n)	  ((1 << 16) | (n))
+@@ -59,6 +62,8 @@
+ #define IMX415_VMAX		  IMX415_REG_24BIT(0x3024)
+ #define IMX415_VMAX_MAX		  0xfffff
+ #define IMX415_HMAX		  IMX415_REG_16BIT(0x3028)
++#define IMX415_HMAX_MAX		  0xffff
++#define IMX415_HMAX_MULTIPLIER	  12
+ #define IMX415_SHR0		  IMX415_REG_24BIT(0x3050)
+ #define IMX415_GAIN_PCG_0	  IMX415_REG_16BIT(0x3090)
+ #define IMX415_AGAIN_MIN	  0
+@@ -459,7 +464,6 @@ static const struct imx415_clk_params im
+ 
+ /* all-pixel 2-lane 720 Mbps 15.74 Hz mode */
+ static const struct imx415_reg imx415_mode_2_720[] = {
+-	{ IMX415_HMAX, 0x07F0 },
+ 	{ IMX415_LANEMODE, IMX415_LANEMODE_2 },
+ 	{ IMX415_TCLKPOST, 0x006F },
+ 	{ IMX415_TCLKPREPARE, 0x002F },
+@@ -474,7 +478,6 @@ static const struct imx415_reg imx415_mo
+ 
+ /* all-pixel 2-lane 1440 Mbps 30.01 Hz mode */
+ static const struct imx415_reg imx415_mode_2_1440[] = {
+-	{ IMX415_HMAX, 0x042A },
+ 	{ IMX415_LANEMODE, IMX415_LANEMODE_2 },
+ 	{ IMX415_TCLKPOST, 0x009F },
+ 	{ IMX415_TCLKPREPARE, 0x0057 },
+@@ -489,7 +492,6 @@ static const struct imx415_reg imx415_mo
+ 
+ /* all-pixel 4-lane 891 Mbps 30 Hz mode */
+ static const struct imx415_reg imx415_mode_4_891[] = {
+-	{ IMX415_HMAX, 0x044C },
+ 	{ IMX415_LANEMODE, IMX415_LANEMODE_4 },
+ 	{ IMX415_TCLKPOST, 0x007F },
+ 	{ IMX415_TCLKPREPARE, 0x0037 },
+@@ -507,39 +509,10 @@ struct imx415_mode_reg_list {
+ 	const struct imx415_reg *regs;
+ };
+ 
+-/*
+- * Mode : number of lanes, lane rate and frame rate dependent settings
+- *
+- * pixel_rate and hmax_pix are needed to calculate hblank for the v4l2 ctrl
+- * interface. These values can not be found in the data sheet and should be
+- * treated as virtual values. Use following table when adding new modes.
+- *
+- * lane_rate  lanes    fps     hmax_pix   pixel_rate
+- *
+- *     594      2     10.000     4400       99000000
+- *     891      2     15.000     4400      148500000
+- *     720      2     15.748     4064      144000000
+- *    1782      2     30.000     4400      297000000
+- *    2079      2     30.000     4400      297000000
+- *    1440      2     30.019     4510      304615385
+- *
+- *     594      4     20.000     5500      247500000
+- *     594      4     25.000     4400      247500000
+- *     720      4     25.000     4400      247500000
+- *     720      4     30.019     4510      304615385
+- *     891      4     30.000     4400      297000000
+- *    1440      4     30.019     4510      304615385
+- *    1440      4     60.038     4510      609230769
+- *    1485      4     60.000     4400      594000000
+- *    1782      4     60.000     4400      594000000
+- *    2079      4     60.000     4400      594000000
+- *    2376      4     90.164     4392      891000000
+- */
+ struct imx415_mode {
+ 	u64 lane_rate;
+ 	u32 lanes;
+-	u32 hmax_pix;
+-	u64 pixel_rate;
++	u32 hmax_min;
+ 	struct imx415_mode_reg_list reg_list;
+ };
+ 
+@@ -548,8 +521,7 @@ static const struct imx415_mode supporte
+ 	{
+ 		.lane_rate = 720000000,
+ 		.lanes = 2,
+-		.hmax_pix = 4064,
+-		.pixel_rate = 144000000,
++		.hmax_min = 2032,
+ 		.reg_list = {
+ 			.num_of_regs = ARRAY_SIZE(imx415_mode_2_720),
+ 			.regs = imx415_mode_2_720,
+@@ -558,8 +530,7 @@ static const struct imx415_mode supporte
+ 	{
+ 		.lane_rate = 1440000000,
+ 		.lanes = 2,
+-		.hmax_pix = 4510,
+-		.pixel_rate = 304615385,
++		.hmax_min = 1066,
+ 		.reg_list = {
+ 			.num_of_regs = ARRAY_SIZE(imx415_mode_2_1440),
+ 			.regs = imx415_mode_2_1440,
+@@ -568,8 +539,7 @@ static const struct imx415_mode supporte
+ 	{
+ 		.lane_rate = 891000000,
+ 		.lanes = 4,
+-		.hmax_pix = 4400,
+-		.pixel_rate = 297000000,
++		.hmax_min = 1100,
+ 		.reg_list = {
+ 			.num_of_regs = ARRAY_SIZE(imx415_mode_4_891),
+ 			.regs = imx415_mode_4_891,
+@@ -601,6 +571,7 @@ static const char *const imx415_test_pat
+ struct imx415 {
+ 	struct device *dev;
+ 	struct clk *clk;
++	unsigned long pixel_rate;
+ 	struct regulator_bulk_data supplies[ARRAY_SIZE(imx415_supply_names)];
+ 	struct gpio_desc *reset;
+ 	struct regmap *regmap;
+@@ -614,6 +585,7 @@ struct imx415 {
+ 
+ 	struct v4l2_ctrl_handler ctrls;
+ 	struct v4l2_ctrl *vblank;
++	struct v4l2_ctrl *hblank;
+ 	struct v4l2_ctrl *hflip;
+ 	struct v4l2_ctrl *vflip;
+ 	struct v4l2_ctrl *exposure;
+@@ -845,6 +817,11 @@ static int imx415_s_ctrl(struct v4l2_ctr
+ 	case V4L2_CID_TEST_PATTERN:
+ 		return imx415_set_testpattern(sensor, ctrl->val);
+ 
++	case V4L2_CID_HBLANK:
++		return imx415_write(sensor, IMX415_HMAX,
++				    (format->width + ctrl->val) /
++						IMX415_HMAX_MULTIPLIER);
++
+ 	default:
+ 		return -EINVAL;
+ 	}
+@@ -858,12 +835,11 @@ static int imx415_ctrls_init(struct imx4
+ {
+ 	struct v4l2_fwnode_device_properties props;
+ 	struct v4l2_ctrl *ctrl;
+-	u64 pixel_rate = supported_modes[sensor->cur_mode].pixel_rate;
+ 	u64 lane_rate = supported_modes[sensor->cur_mode].lane_rate;
+ 	u32 exposure_max = IMX415_PIXEL_ARRAY_HEIGHT +
+ 			   IMX415_PIXEL_ARRAY_VBLANK -
+ 			   IMX415_EXPOSURE_OFFSET;
+-	u32 hblank;
++	u32 hblank_min, hblank_max;
+ 	unsigned int i;
+ 	int ret;
+ 
+@@ -900,12 +876,14 @@ static int imx415_ctrls_init(struct imx4
+ 			  IMX415_AGAIN_MAX, IMX415_AGAIN_STEP,
+ 			  IMX415_AGAIN_MIN);
+ 
+-	hblank = supported_modes[sensor->cur_mode].hmax_pix -
+-		 IMX415_PIXEL_ARRAY_WIDTH;
++	hblank_min = (supported_modes[sensor->cur_mode].hmax_min *
++		      IMX415_HMAX_MULTIPLIER) - IMX415_PIXEL_ARRAY_WIDTH;
++	hblank_max = (IMX415_HMAX_MAX * IMX415_HMAX_MULTIPLIER) -
++		     IMX415_PIXEL_ARRAY_WIDTH;
+ 	ctrl = v4l2_ctrl_new_std(&sensor->ctrls, &imx415_ctrl_ops,
+-				 V4L2_CID_HBLANK, hblank, hblank, 1, hblank);
+-	if (ctrl)
+-		ctrl->flags |= V4L2_CTRL_FLAG_READ_ONLY;
++				 V4L2_CID_HBLANK, hblank_min,
++				 hblank_max, IMX415_HMAX_MULTIPLIER,
++				 hblank_min);
+ 
+ 	sensor->vblank = v4l2_ctrl_new_std(&sensor->ctrls, &imx415_ctrl_ops,
+ 					   V4L2_CID_VBLANK,
+@@ -913,8 +891,9 @@ static int imx415_ctrls_init(struct imx4
+ 					   IMX415_VMAX_MAX - IMX415_PIXEL_ARRAY_HEIGHT,
+ 					   1, IMX415_PIXEL_ARRAY_VBLANK);
+ 
+-	v4l2_ctrl_new_std(&sensor->ctrls, NULL, V4L2_CID_PIXEL_RATE, pixel_rate,
+-			  pixel_rate, 1, pixel_rate);
++	v4l2_ctrl_new_std(&sensor->ctrls, NULL, V4L2_CID_PIXEL_RATE,
++			  sensor->pixel_rate, sensor->pixel_rate, 1,
++			  sensor->pixel_rate);
+ 
+ 	sensor->hflip = v4l2_ctrl_new_std(&sensor->ctrls, &imx415_ctrl_ops,
+ 					  V4L2_CID_HFLIP, 0, 1, 1, 0);
+@@ -1410,6 +1389,17 @@ static int imx415_parse_hw_config(struct
+ 				    "no valid sensor mode defined\n");
+ 		goto done_endpoint_free;
+ 	}
++	switch (inck) {
++	case 27000000:
++	case 37125000:
++	case 74250000:
++		sensor->pixel_rate = IMX415_PIXEL_RATE_74_25MHZ;
++		break;
++	case 24000000:
++	case 72000000:
++		sensor->pixel_rate = IMX415_PIXEL_RATE_72MHZ;
++		break;
++	}
+ 
+ 	lane_rate = supported_modes[sensor->cur_mode].lane_rate;
+ 	for (i = 0; i < ARRAY_SIZE(imx415_clk_params); ++i) {
diff --git a/target/linux/bcm27xx/patches-6.6/950-1497-media-i2c-imx415-Link-frequencies-are-not-exclusive-.patch b/target/linux/bcm27xx/patches-6.6/950-1497-media-i2c-imx415-Link-frequencies-are-not-exclusive-.patch
new file mode 100644
index 00000000000000..d0375058c3fe23
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1497-media-i2c-imx415-Link-frequencies-are-not-exclusive-.patch
@@ -0,0 +1,136 @@
+From 0292614f8cd061f71f975dae7d74fe5324545321 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 2 Jan 2025 12:43:01 +0000
+Subject: [PATCH] media: i2c: imx415: Link frequencies are not exclusive to num
+ lanes
+
+The link frequencies are equally valid in 2 or 4 lane modes, but
+they change the hmax_min value for the mode as the MIPI block
+has to have sufficient time to send the pixel data for each line.
+
+Remove the association with number of lanes, and add hmax_min
+configuration for both lane options.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/imx415.c | 49 +++++++++++++++++---------------------
+ 1 file changed, 22 insertions(+), 27 deletions(-)
+
+--- a/drivers/media/i2c/imx415.c
++++ b/drivers/media/i2c/imx415.c
+@@ -462,9 +462,8 @@ static const struct imx415_clk_params im
+ 	},
+ };
+ 
+-/* all-pixel 2-lane 720 Mbps 15.74 Hz mode */
+-static const struct imx415_reg imx415_mode_2_720[] = {
+-	{ IMX415_LANEMODE, IMX415_LANEMODE_2 },
++/* 720 Mbps CSI configuration */
++static const struct imx415_reg imx415_linkrate_720mbps[] = {
+ 	{ IMX415_TCLKPOST, 0x006F },
+ 	{ IMX415_TCLKPREPARE, 0x002F },
+ 	{ IMX415_TCLKTRAIL, 0x002F },
+@@ -476,9 +475,8 @@ static const struct imx415_reg imx415_mo
+ 	{ IMX415_TLPX, 0x0027 },
+ };
+ 
+-/* all-pixel 2-lane 1440 Mbps 30.01 Hz mode */
+-static const struct imx415_reg imx415_mode_2_1440[] = {
+-	{ IMX415_LANEMODE, IMX415_LANEMODE_2 },
++/* 1440 Mbps CSI configuration */
++static const struct imx415_reg imx415_linkrate_1440mbps[] = {
+ 	{ IMX415_TCLKPOST, 0x009F },
+ 	{ IMX415_TCLKPREPARE, 0x0057 },
+ 	{ IMX415_TCLKTRAIL, 0x0057 },
+@@ -490,9 +488,8 @@ static const struct imx415_reg imx415_mo
+ 	{ IMX415_TLPX, 0x004F },
+ };
+ 
+-/* all-pixel 4-lane 891 Mbps 30 Hz mode */
+-static const struct imx415_reg imx415_mode_4_891[] = {
+-	{ IMX415_LANEMODE, IMX415_LANEMODE_4 },
++/* 891 Mbps */
++static const struct imx415_reg imx415_linkrate_891mbps[] = {
+ 	{ IMX415_TCLKPOST, 0x007F },
+ 	{ IMX415_TCLKPREPARE, 0x0037 },
+ 	{ IMX415_TCLKTRAIL, 0x0037 },
+@@ -511,8 +508,7 @@ struct imx415_mode_reg_list {
+ 
+ struct imx415_mode {
+ 	u64 lane_rate;
+-	u32 lanes;
+-	u32 hmax_min;
++	u32 hmax_min[2];
+ 	struct imx415_mode_reg_list reg_list;
+ };
+ 
+@@ -520,29 +516,26 @@ struct imx415_mode {
+ static const struct imx415_mode supported_modes[] = {
+ 	{
+ 		.lane_rate = 720000000,
+-		.lanes = 2,
+-		.hmax_min = 2032,
++		.hmax_min = { 2032, 1066 },
+ 		.reg_list = {
+-			.num_of_regs = ARRAY_SIZE(imx415_mode_2_720),
+-			.regs = imx415_mode_2_720,
++			.num_of_regs = ARRAY_SIZE(imx415_linkrate_720mbps),
++			.regs = imx415_linkrate_720mbps,
+ 		},
+ 	},
+ 	{
+ 		.lane_rate = 1440000000,
+-		.lanes = 2,
+-		.hmax_min = 1066,
++		.hmax_min = { 1066, 533 },
+ 		.reg_list = {
+-			.num_of_regs = ARRAY_SIZE(imx415_mode_2_1440),
+-			.regs = imx415_mode_2_1440,
++			.num_of_regs = ARRAY_SIZE(imx415_linkrate_1440mbps),
++			.regs = imx415_linkrate_1440mbps,
+ 		},
+ 	},
+ 	{
+ 		.lane_rate = 891000000,
+-		.lanes = 4,
+-		.hmax_min = 1100,
++		.hmax_min = { 1100, 550 },
+ 		.reg_list = {
+-			.num_of_regs = ARRAY_SIZE(imx415_mode_4_891),
+-			.regs = imx415_mode_4_891,
++			.num_of_regs = ARRAY_SIZE(imx415_linkrate_891mbps),
++			.regs = imx415_linkrate_891mbps,
+ 		},
+ 	},
+ };
+@@ -876,7 +869,7 @@ static int imx415_ctrls_init(struct imx4
+ 			  IMX415_AGAIN_MAX, IMX415_AGAIN_STEP,
+ 			  IMX415_AGAIN_MIN);
+ 
+-	hblank_min = (supported_modes[sensor->cur_mode].hmax_min *
++	hblank_min = (supported_modes[sensor->cur_mode].hmax_min[sensor->num_data_lanes == 2 ? 0 : 1] *
+ 		      IMX415_HMAX_MULTIPLIER) - IMX415_PIXEL_ARRAY_WIDTH;
+ 	hblank_max = (IMX415_HMAX_MAX * IMX415_HMAX_MULTIPLIER) -
+ 		     IMX415_PIXEL_ARRAY_WIDTH;
+@@ -944,7 +937,11 @@ static int imx415_set_mode(struct imx415
+ 			return ret;
+ 	}
+ 
+-	return 0;
++	ret = imx415_write(sensor, IMX415_LANEMODE,
++			   sensor->num_data_lanes == 2 ? IMX415_LANEMODE_2 :
++							 IMX415_LANEMODE_4);
++
++	return ret;
+ }
+ 
+ static int imx415_setup(struct imx415 *sensor, struct v4l2_subdev_state *state)
+@@ -1373,8 +1370,6 @@ static int imx415_parse_hw_config(struct
+ 		}
+ 
+ 		for (j = 0; j < ARRAY_SIZE(supported_modes); ++j) {
+-			if (sensor->num_data_lanes != supported_modes[j].lanes)
+-				continue;
+ 			if (bus_cfg.link_frequencies[i] * 2 !=
+ 			    supported_modes[j].lane_rate)
+ 				continue;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1499-dts-bcm2712-PL011-UARTs-are-actually-r1p5.patch b/target/linux/bcm27xx/patches-6.6/950-1499-dts-bcm2712-PL011-UARTs-are-actually-r1p5.patch
new file mode 100644
index 00000000000000..520d1d64252072
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1499-dts-bcm2712-PL011-UARTs-are-actually-r1p5.patch
@@ -0,0 +1,43 @@
+From 602be52637ecca0b247cf832c8a4ec345844d325 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 Jan 2025 12:09:48 +0000
+Subject: [PATCH] dts: bcm2712: PL011 UARTs are actually r1p5
+
+The ARM PL011 UART instances in BCM2712 are r1p5 spec, which means they
+have 32-entry FIFOs. The correct periphid value for this is 0x00341011.
+Thanks to N Buchwitz for pointing this out.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
+@@ -190,7 +190,7 @@
+ 			clocks = <&clk_uart>,
+ 				 <&clk_vpu>;
+ 			clock-names = "uartclk", "apb_pclk";
+-			arm,primecell-periphid = <0x00241011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			status = "disabled";
+ 		};
+ 
+@@ -201,7 +201,7 @@
+ 			clocks = <&clk_uart>,
+ 				 <&clk_vpu>;
+ 			clock-names = "uartclk", "apb_pclk";
+-			arm,primecell-periphid = <0x00241011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			status = "disabled";
+ 		};
+ 
+@@ -212,7 +212,7 @@
+ 			clocks = <&clk_uart>,
+ 				 <&clk_vpu>;
+ 			clock-names = "uartclk", "apb_pclk";
+-			arm,primecell-periphid = <0x00241011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			status = "disabled";
+ 		};
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1500-dts-rp1-PL011-UARTs-are-actually-r1p5.patch b/target/linux/bcm27xx/patches-6.6/950-1500-dts-rp1-PL011-UARTs-are-actually-r1p5.patch
new file mode 100644
index 00000000000000..9363036ccb9c4b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1500-dts-rp1-PL011-UARTs-are-actually-r1p5.patch
@@ -0,0 +1,70 @@
+From 7a4972f36a63eba4d862115265a7bf77ac1e4129 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 7 Jan 2025 12:11:10 +0000
+Subject: [PATCH] dts: rp1: PL011 UARTs are actually r1p5
+
+The ARM PL011 UART instances in RP1 are r1p5 spec, which means they
+have 32-entry FIFOs. The correct periphid value for this is 0x00341011.
+Thanks to N Buchwitz for pointing this out.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/rp1.dtsi | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/rp1.dtsi
++++ b/arch/arm64/boot/dts/broadcom/rp1.dtsi
+@@ -69,7 +69,7 @@
+ 			       <&rp1_dma RP1_DMA_UART0_RX>;
+ 			dma-names = "tx", "rx";
+ 			pinctrl-names = "default";
+-			arm,primecell-periphid = <0x00541011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			uart-has-rtscts;
+ 			cts-event-workaround;
+ 			skip-init;
+@@ -86,7 +86,7 @@
+ 			//        <&rp1_dma RP1_DMA_UART1_RX>;
+ 			// dma-names = "tx", "rx";
+ 			pinctrl-names = "default";
+-			arm,primecell-periphid = <0x00541011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			uart-has-rtscts;
+ 			cts-event-workaround;
+ 			skip-init;
+@@ -103,7 +103,7 @@
+ 			//        <&rp1_dma RP1_DMA_UART2_RX>;
+ 			// dma-names = "tx", "rx";
+ 			pinctrl-names = "default";
+-			arm,primecell-periphid = <0x00541011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			uart-has-rtscts;
+ 			cts-event-workaround;
+ 			skip-init;
+@@ -120,7 +120,7 @@
+ 			//        <&rp1_dma RP1_DMA_UART3_RX>;
+ 			// dma-names = "tx", "rx";
+ 			pinctrl-names = "default";
+-			arm,primecell-periphid = <0x00541011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			uart-has-rtscts;
+ 			cts-event-workaround;
+ 			skip-init;
+@@ -137,7 +137,7 @@
+ 			//        <&rp1_dma RP1_DMA_UART4_RX>;
+ 			// dma-names = "tx", "rx";
+ 			pinctrl-names = "default";
+-			arm,primecell-periphid = <0x00541011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			uart-has-rtscts;
+ 			cts-event-workaround;
+ 			skip-init;
+@@ -154,7 +154,7 @@
+ 			//        <&rp1_dma RP1_DMA_UART5_RX>;
+ 			// dma-names = "tx", "rx";
+ 			pinctrl-names = "default";
+-			arm,primecell-periphid = <0x00541011>;
++			arm,primecell-periphid = <0x00341011>;
+ 			uart-has-rtscts;
+ 			cts-event-workaround;
+ 			skip-init;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1501-ASoC-pcm512x-Demote-No-SCLK-to-debug-level.patch b/target/linux/bcm27xx/patches-6.6/950-1501-ASoC-pcm512x-Demote-No-SCLK-to-debug-level.patch
new file mode 100644
index 00000000000000..02857ce6db344a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1501-ASoC-pcm512x-Demote-No-SCLK-to-debug-level.patch
@@ -0,0 +1,25 @@
+From 4f7341263ebd6ab2ae805c8f27191d24abc05a62 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 8 Jan 2025 15:48:35 +0000
+Subject: [PATCH] ASoC: pcm512x: Demote "No SCLK" to debug level
+
+Designing a PCM512X-based soundcard with no external SCLK is a valid
+choice supported by the driver. Don't alarm users with messages that
+say "No SCLK, using BCLK: -2" - reclassify them as debug information.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ sound/soc/codecs/pcm512x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/sound/soc/codecs/pcm512x.c
++++ b/sound/soc/codecs/pcm512x.c
+@@ -630,7 +630,7 @@ static int pcm512x_dai_startup_slave(str
+ 	struct regmap *regmap = pcm512x->regmap;
+ 
+ 	if (IS_ERR(pcm512x->sclk)) {
+-		dev_info(dev, "No SCLK, using BCLK: %ld\n",
++		dev_dbg(dev, "No SCLK, using BCLK: %ld\n",
+ 			 PTR_ERR(pcm512x->sclk));
+ 
+ 		/* Disable reporting of missing SCLK as an error */
diff --git a/target/linux/bcm27xx/patches-6.6/950-1502-ASoC-allo-piano-dac-plus-Fix-volume-limiting.patch b/target/linux/bcm27xx/patches-6.6/950-1502-ASoC-allo-piano-dac-plus-Fix-volume-limiting.patch
new file mode 100644
index 00000000000000..f08083463fb8f2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1502-ASoC-allo-piano-dac-plus-Fix-volume-limiting.patch
@@ -0,0 +1,58 @@
+From 4111f4ede92b1f5bf869f87c66fc39151999c42f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 8 Jan 2025 15:46:30 +0000
+Subject: [PATCH] ASoC: allo-piano-dac-plus: Fix volume limiting
+
+Controls which only exist when snd_soc_register_card returns can't be
+modified before then. Move the setting of volume limits to just before
+the end of the probe function.
+
+Link: https://github.com/raspberrypi/linux/issues/6527
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ sound/soc/bcm/allo-piano-dac-plus.c | 26 ++++++++++++++------------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+--- a/sound/soc/bcm/allo-piano-dac-plus.c
++++ b/sound/soc/bcm/allo-piano-dac-plus.c
+@@ -734,18 +734,6 @@ static int snd_allo_piano_dac_init(struc
+ 	if (digital_gain_0db_limit) {
+ 		int ret;
+ 
+-		ret = snd_soc_limit_volume(card, "Master Playback Volume",
+-					207);
+-		if (ret < 0)
+-			dev_warn(card->dev, "Failed to set master volume limit: %d\n",
+-				ret);
+-
+-		ret = snd_soc_limit_volume(card, "Subwoofer Playback Volume",
+-					207);
+-		if (ret < 0)
+-			dev_warn(card->dev, "Failed to set subwoofer volume limit: %d\n",
+-				ret);
+-
+ 		//Set volume limit on both dacs
+ 		for (i = 0; i < ARRAY_SIZE(codec_ctl_pfx); i++) {
+ 			char cname[256];
+@@ -1000,6 +988,20 @@ static int snd_allo_piano_dac_probe(stru
+ 		if (ret < 0)
+ 			return dev_err_probe(&pdev->dev, ret, "snd_soc_register_card() failed\n");
+ 
++		if (digital_gain_0db_limit) {
++			ret = snd_soc_limit_volume(card, "Master Playback Volume",
++						207);
++			if (ret < 0)
++				dev_warn(card->dev, "Failed to set master volume limit: %d\n",
++					ret);
++
++			ret = snd_soc_limit_volume(card, "Subwoofer Playback Volume",
++						207);
++			if (ret < 0)
++				dev_warn(card->dev, "Failed to set subwoofer volume limit: %d\n",
++					ret);
++		}
++
+ 		if ((mute_gpio[0]) && (mute_gpio[1]))
+ 			snd_allo_piano_gpio_mute(&snd_allo_piano_dac);
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1503-ASoC-allo-piano-dac-plus-Remove-pointless-code.patch b/target/linux/bcm27xx/patches-6.6/950-1503-ASoC-allo-piano-dac-plus-Remove-pointless-code.patch
new file mode 100644
index 00000000000000..bb5c21d4291696
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1503-ASoC-allo-piano-dac-plus-Remove-pointless-code.patch
@@ -0,0 +1,53 @@
+From 62c33972e3eb724d80179fb71b05e923920f0b0d Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Wed, 8 Jan 2025 16:05:02 +0000
+Subject: [PATCH] ASoC: allo-piano-dac-plus: Remove pointless code
+
+The codec control Digital Playback Volume is one of the controls deleted
+by the allo-piano-dac-plus driver. It is effectively replaced by the
+soundcard controls Master Playback Volume and Subwoofer Playback Volume.
+
+Delete the code that sets the volume limit on those codec controls - the
+limits on the soundcard volume controls are sufficient.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ sound/soc/bcm/allo-piano-dac-plus.c | 20 +-------------------
+ 1 file changed, 1 insertion(+), 19 deletions(-)
+
+--- a/sound/soc/bcm/allo-piano-dac-plus.c
++++ b/sound/soc/bcm/allo-piano-dac-plus.c
+@@ -731,21 +731,6 @@ static int snd_allo_piano_dac_init(struc
+ 
+ 	mutex_init(&glb_ptr->lock);
+ 
+-	if (digital_gain_0db_limit) {
+-		int ret;
+-
+-		//Set volume limit on both dacs
+-		for (i = 0; i < ARRAY_SIZE(codec_ctl_pfx); i++) {
+-			char cname[256];
+-
+-			sprintf(cname, "%s %s", codec_ctl_pfx[i], codec_ctl_name[0]);
+-			ret = snd_soc_limit_volume(card, cname, 207);
+-			if (ret < 0)
+-				dev_warn(card->dev, "Failed to set %s volume limit: %d\n",
+-					 cname, ret);
+-		}
+-	}
+-
+ 	// Remove codec controls
+ 	for (i = 0; i < ARRAY_SIZE(codec_ctl_pfx); i++) {
+ 		for (j = 0; j < ARRAY_SIZE(codec_ctl_name); j++) {
+@@ -753,10 +738,7 @@ static int snd_allo_piano_dac_init(struc
+ 
+ 			sprintf(cname, "%s %s", codec_ctl_pfx[i], codec_ctl_name[j]);
+ 			kctl = snd_soc_card_get_kcontrol(card, cname);
+-			if (!kctl) {
+-				dev_err(rtd->card->dev, "Control %s not found\n",
+-				       cname);
+-			} else {
++			if (kctl) {
+ 				kctl->vd[0].access =
+ 					SNDRV_CTL_ELEM_ACCESS_READWRITE;
+ 				snd_ctl_remove(card->snd_card, kctl);
diff --git a/target/linux/bcm27xx/patches-6.6/950-1505-DT-bcm2712-override-supports-cqe-to-a-cell.patch b/target/linux/bcm27xx/patches-6.6/950-1505-DT-bcm2712-override-supports-cqe-to-a-cell.patch
new file mode 100644
index 00000000000000..c95c1d432ea2f8
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1505-DT-bcm2712-override-supports-cqe-to-a-cell.patch
@@ -0,0 +1,90 @@
+From 301420a8cc44ee457670e015adc3a08cfc4531a9 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 8 Jan 2025 14:58:37 +0000
+Subject: [PATCH] DT: bcm2712: override supports-cqe to a cell
+
+We want to be able to control the interop surface exposed by Command
+Queueing across bcm2712 products to a more restrictive default, with
+selectable disable and permissive behaviour.
+
+Changing the bool to a cell lets it relay a tristate value.
+
+Also add the override parameter to CM5 as CM5-lite may interface with
+arbitrary eMMC or SD cards.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README                 | 11 ++++++++---
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts  |  4 ++--
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi |  3 ++-
+ arch/arm64/boot/dts/broadcom/bcm2712.dtsi         |  2 +-
+ 4 files changed, 13 insertions(+), 7 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -405,9 +405,14 @@ Params:
+                                 non-lite SKU of CM4).
+                                 (default "on")
+ 
+-        sd_cqe                  Set to "off" to disable Command Queueing if you
+-                                have an incompatible Class A2 SD card
+-                                (Pi 5 only, default "on")
++        sd_cqe                  Modify Command Queuing behaviour on the main SD
++                                interface. Legal values are:
++                                0: disable CQ
++                                1: allow CQ for known-good SD A2 cards, and all
++                                   eMMC cards
++                                2: allow CQ for all SD A2 cards that aren't
++                                   known-bad, and all eMMC cards.
++                                (2712 only, default "1")
+ 
+         sd_overclock            Clock (in MHz) to use when the MMC framework
+                                 requests 50MHz
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-5-b.dts
+@@ -365,7 +365,7 @@ dpi_16bit_gpio2:        &rp1_dpi_16bit_g
+ 	sd-uhs-sdr50;
+ 	sd-uhs-ddr50;
+ 	sd-uhs-sdr104;
+-	supports-cqe;
++	supports-cqe = <1>;
+ 	cd-gpios = <&gio_aon 5 GPIO_ACTIVE_LOW>;
+ 	//no-1-8-v;
+ 	status = "okay";
+@@ -745,6 +745,6 @@ spi10_cs_pins: &spi10_cs_gpio1 {};
+ 
+ / {
+ 	__overrides__ {
+-		sd_cqe = <&sdio1>, "supports-cqe?";
++		sd_cqe = <&sdio1>, "supports-cqe:0";
+ 	};
+ };
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
+@@ -339,7 +339,7 @@ dpi_16bit_gpio2:        &rp1_dpi_16bit_g
+ 	mmc-hs400-1_8v;
+ 	mmc-hs400-enhanced-strobe;
+ 	broken-cd;
+-	supports-cqe;
++	supports-cqe = <1>;
+ 	status = "okay";
+ };
+ 
+@@ -752,5 +752,6 @@ spi10_cs_pins: &spi10_cs_gpio1 {};
+ 			<&ant2>, "output-low?=on";
+ 		noanthogs = <&ant1>,"status=disabled",
+ 			<&ant2>, "status=disabled";
++		sd_cqe = <&sdio1>, "supports-cqe:0";
+ 	};
+ };
+--- a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
+@@ -1210,7 +1210,7 @@
+ 			clocks = <&clk_emmc2>;
+ 			sdhci-caps-mask = <0x0000C000 0x0>;
+ 			sdhci-caps = <0x0 0x0>;
+-			supports-cqe;
++			supports-cqe = <1>;
+ 			mmc-ddr-3_3v;
+ 			status = "disabled";
+ 		};
diff --git a/target/linux/bcm27xx/patches-6.6/950-1506-mmc-sd-filter-card-CQ-support-based-on-an-allow-list.patch b/target/linux/bcm27xx/patches-6.6/950-1506-mmc-sd-filter-card-CQ-support-based-on-an-allow-list.patch
new file mode 100644
index 00000000000000..612f31e239ac73
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1506-mmc-sd-filter-card-CQ-support-based-on-an-allow-list.patch
@@ -0,0 +1,57 @@
+From d70a60eb03ae4fc687b91b5f6c4684000be21c5f Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 8 Jan 2025 15:09:53 +0000
+Subject: [PATCH] mmc: sd: filter card CQ support based on an allow-list
+
+We have found that many SD cards in the field, even of the same make and
+model, have latent bugs in their CQ implementation. Some product lines
+have fewer bugs with newer manufacture dates, but this is not a
+guarantee that a particular card is at a particular firmware revision
+level.
+
+Many of these bugs lead to card hangs or data corruption. Add a quirk to
+mark a card as having a tested, working CQ implementation and ignore the
+capability if absent.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/card.h  | 5 +++++
+ drivers/mmc/core/sd.c    | 4 ++++
+ include/linux/mmc/card.h | 1 +
+ 3 files changed, 10 insertions(+)
+
+--- a/drivers/mmc/core/card.h
++++ b/drivers/mmc/core/card.h
+@@ -298,4 +298,9 @@ static inline int mmc_card_no_uhs_ddr50_
+ 	return c->quirks & MMC_QUIRK_NO_UHS_DDR50_TUNING;
+ }
+ 
++static inline int mmc_card_working_sd_cq(const struct mmc_card *c)
++{
++	return c->quirks & MMC_QUIRK_WORKING_SD_CQ;
++}
++
+ #endif
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -1522,6 +1522,10 @@ cont:
+ 			goto free_card;
+ 	}
+ 
++	/* Disallow command queueing on unvetted cards */
++	if (!mmc_card_working_sd_cq(card))
++		card->ext_csd.cmdq_support = false;
++
+ 	/* Enable command queueing if supported */
+ 	if (card->ext_csd.cmdq_support && host->caps2 & MMC_CAP2_CQE) {
+ 		/*
+--- a/include/linux/mmc/card.h
++++ b/include/linux/mmc/card.h
+@@ -298,6 +298,7 @@ struct mmc_card {
+ #define MMC_QUIRK_BROKEN_CACHE_FLUSH	(1<<16)	/* Don't flush cache until the write has occurred */
+ #define MMC_QUIRK_BROKEN_SD_POWEROFF_NOTIFY	(1<<17) /* Disable broken SD poweroff notify support */
+ #define MMC_QUIRK_NO_UHS_DDR50_TUNING	(1<<18) /* Disable DDR50 tuning */
++#define MMC_QUIRK_WORKING_SD_CQ	(1<<30)		/* SD card has known-good CQ implementation */
+ #define MMC_QUIRK_ERASE_BROKEN	(1<<31)		/* Skip erase */
+ 
+ 	bool			written_flag;	/* Indicates eMMC has been written since power on */
diff --git a/target/linux/bcm27xx/patches-6.6/950-1507-mmc-set-MMC_QUIRK_KNOWN_WORKING_SD_CQ-on-Raspberry-P.patch b/target/linux/bcm27xx/patches-6.6/950-1507-mmc-set-MMC_QUIRK_KNOWN_WORKING_SD_CQ-on-Raspberry-P.patch
new file mode 100644
index 00000000000000..3002cc5be60783
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1507-mmc-set-MMC_QUIRK_KNOWN_WORKING_SD_CQ-on-Raspberry-P.patch
@@ -0,0 +1,41 @@
+From eb4d8ffb2b007963662be7eca88baf0e5c358bd6 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 8 Jan 2025 15:18:33 +0000
+Subject: [PATCH] mmc: set MMC_QUIRK_KNOWN_WORKING_SD_CQ on Raspberry Pi class
+ A2 cards
+
+These cards have a known-good CQ implementation and are based on a
+Longsys product. Add the MANFID for Longsys SD, and the particular CID
+details for the Pi card.
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/card.h   | 1 +
+ drivers/mmc/core/quirks.h | 6 ++++++
+ 2 files changed, 7 insertions(+)
+
+--- a/drivers/mmc/core/card.h
++++ b/drivers/mmc/core/card.h
+@@ -91,6 +91,7 @@ struct mmc_fixup {
+ #define CID_MANFID_KINGSTON     0x70
+ #define CID_MANFID_HYNIX	0x90
+ #define CID_MANFID_KINGSTON_SD	0x9F
++#define CID_MANFID_LONGSYS_SD	0xAD
+ #define CID_MANFID_NUMONYX	0xFE
+ 
+ #define END_FIXUP { NULL }
+--- a/drivers/mmc/core/quirks.h
++++ b/drivers/mmc/core/quirks.h
+@@ -90,6 +90,12 @@ static const struct mmc_fixup __maybe_un
+ 		   0, -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
+ 		   MMC_QUIRK_BROKEN_SD_CACHE, EXT_CSD_REV_ANY),
+ 
++	/* SD A2 allow-list - only trust CQ on these cards */
++	/* Raspberry Pi A2 cards */
++	_FIXUP_EXT(CID_NAME_ANY, CID_MANFID_LONGSYS_SD, 0x4c53, CID_YEAR_ANY, CID_MONTH_ANY,
++		   cid_rev(1, 0, 0, 0), -1ull, SDIO_ANY_ID, SDIO_ANY_ID, add_quirk_sd,
++		   MMC_QUIRK_WORKING_SD_CQ, EXT_CSD_REV_ANY),
++
+ 	END_FIXUP
+ };
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1508-mmc-use-downstream-DT-property-to-modify-CQE-and-or-.patch b/target/linux/bcm27xx/patches-6.6/950-1508-mmc-use-downstream-DT-property-to-modify-CQE-and-or-.patch
new file mode 100644
index 00000000000000..cd29a177545bc2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1508-mmc-use-downstream-DT-property-to-modify-CQE-and-or-.patch
@@ -0,0 +1,94 @@
+From e72f42ebc9a236c023f8027a37c9351d58e28b05 Mon Sep 17 00:00:00 2001
+From: Jonathan Bell <jonathan@raspberrypi.com>
+Date: Wed, 8 Jan 2025 16:02:27 +0000
+Subject: [PATCH] mmc: use downstream DT property to modify CQE and/or SD CQ
+ behaviour
+
+Implement a tristate-style option for "supports-cqe". If the property is
+absent or zero, disable CQ completely. For 1, enable CQ unconditionally
+for eMMC cards, and known-good SD cards. For 2, enable for eMMC cards,
+and all SD cards that are not known-bad.
+
+The sdhci-brcmstb driver needs to know about the tristate as its probe
+sequence would otherwise override a disable in mmc_of_parse().
+
+Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+---
+ drivers/mmc/core/host.c          | 11 ++++++++++-
+ drivers/mmc/core/sd.c            |  4 ++--
+ drivers/mmc/host/sdhci-brcmstb.c |  6 ++++--
+ include/linux/mmc/host.h         |  1 +
+ 4 files changed, 17 insertions(+), 5 deletions(-)
+
+--- a/drivers/mmc/core/host.c
++++ b/drivers/mmc/core/host.c
+@@ -275,7 +275,7 @@ EXPORT_SYMBOL(mmc_of_parse_clk_phase);
+ int mmc_of_parse(struct mmc_host *host)
+ {
+ 	struct device *dev = host->parent;
+-	u32 bus_width, drv_type, cd_debounce_delay_ms;
++	u32 bus_width, drv_type, cd_debounce_delay_ms, cq_allow;
+ 	int ret;
+ 
+ 	if (!dev || !dev_fwnode(dev))
+@@ -410,6 +410,15 @@ int mmc_of_parse(struct mmc_host *host)
+ 		host->caps2 &= ~(MMC_CAP2_HS400_1_8V | MMC_CAP2_HS400_1_2V |
+ 				 MMC_CAP2_HS400_ES);
+ 
++	cq_allow = 0;
++	/*
++	 * Downstream property - if a u32 and 2 instead of a bool,
++	 * trust most A2 SD cards claiming CQ support.
++	 */
++	device_property_read_u32(dev, "supports-cqe", &cq_allow);
++	if (cq_allow == 2)
++		host->caps2 |= MMC_CAP2_SD_CQE_PERMISSIVE;
++
+ 	/* Must be after "non-removable" check */
+ 	if (device_property_read_u32(dev, "fixed-emmc-driver-type", &drv_type) == 0) {
+ 		if (host->caps & MMC_CAP_NONREMOVABLE)
+--- a/drivers/mmc/core/sd.c
++++ b/drivers/mmc/core/sd.c
+@@ -1522,8 +1522,8 @@ cont:
+ 			goto free_card;
+ 	}
+ 
+-	/* Disallow command queueing on unvetted cards */
+-	if (!mmc_card_working_sd_cq(card))
++	/* Disallow command queueing on unvetted cards unless overridden */
++	if (!(host->caps2 & MMC_CAP2_SD_CQE_PERMISSIVE) && !mmc_card_working_sd_cq(card))
+ 		card->ext_csd.cmdq_support = false;
+ 
+ 	/* Enable command queueing if supported */
+--- a/drivers/mmc/host/sdhci-brcmstb.c
++++ b/drivers/mmc/host/sdhci-brcmstb.c
+@@ -511,7 +511,7 @@ static int sdhci_brcmstb_probe(struct pl
+ 	struct sdhci_pltfm_host *pltfm_host;
+ 	const struct of_device_id *match;
+ 	struct sdhci_brcmstb_priv *priv;
+-	u32 actual_clock_mhz;
++	u32 actual_clock_mhz, cqe;
+ 	struct sdhci_host *host;
+ 	struct resource *iomem;
+ 	bool no_pinctrl = false;
+@@ -540,7 +540,9 @@ static int sdhci_brcmstb_probe(struct pl
+ 	pltfm_host->clk = clk;
+ 
+ 	priv = sdhci_pltfm_priv(pltfm_host);
+-	if (device_property_read_bool(&pdev->dev, "supports-cqe")) {
++	cqe = 0;
++	device_property_read_u32(&pdev->dev, "supports-cqe", &cqe);
++	if (cqe > 0) {
+ 		priv->flags |= BRCMSTB_PRIV_FLAGS_HAS_CQE;
+ 		match_priv->ops->irq = sdhci_brcmstb_cqhci_irq;
+ 	}
+--- a/include/linux/mmc/host.h
++++ b/include/linux/mmc/host.h
+@@ -427,6 +427,7 @@ struct mmc_host {
+ #define MMC_CAP2_CRYPTO		0
+ #endif
+ #define MMC_CAP2_ALT_GPT_TEGRA	(1 << 28)	/* Host with eMMC that has GPT entry at a non-standard location */
++#define MMC_CAP2_SD_CQE_PERMISSIVE	(1 << 31)	/* Ignore allow-list for CQ capable SD card detection */
+ 
+ 	int			fixed_drv_type;	/* fixed driver type for non-removable media */
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1509-misc-rp1-pio-Handle-probe-errors.patch b/target/linux/bcm27xx/patches-6.6/950-1509-misc-rp1-pio-Handle-probe-errors.patch
new file mode 100644
index 00000000000000..0aca41f744dbc4
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1509-misc-rp1-pio-Handle-probe-errors.patch
@@ -0,0 +1,38 @@
+From e56aa0bd2b552daa4349a7eb2e6b0dec81d3e5cc Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 9 Jan 2025 16:40:25 +0000
+Subject: [PATCH] misc: rp1-pio: Handle probe errors
+
+Ensure that rp1_pio_open fails if the device failed to probe.
+
+Link: https://github.com/raspberrypi/linux/issues/6593
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/rp1-pio.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/misc/rp1-pio.c
++++ b/drivers/misc/rp1-pio.c
+@@ -1014,6 +1014,9 @@ struct rp1_pio_client *rp1_pio_open(void
+ {
+ 	struct rp1_pio_client *client;
+ 
++	if (!g_pio)
++		return ERR_PTR(-ENOENT);
++
+ 	client = kzalloc(sizeof(*client), GFP_KERNEL);
+ 	if (!client)
+ 		return ERR_PTR(-ENOMEM);
+@@ -1265,9 +1268,8 @@ static int rp1_pio_probe(struct platform
+ 		return dev_err_probe(dev, pdev->id, "alias is missing\n");
+ 
+ 	fw = devm_rp1_firmware_get(dev, dev->of_node);
+-	if (IS_ERR(fw))
+-		return PTR_ERR(fw);
+-
++	if (IS_ERR_OR_NULL(fw))
++		return dev_err_probe(dev, -ENOENT, "failed to contact RP1 firmware\n");
+ 	ret = rp1_firmware_get_feature(fw, FOURCC_PIO, &op_base, &op_count);
+ 	if (ret < 0)
+ 		return ret;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1510-firmware-rp1-Simplify-rp1_firmware_get.patch b/target/linux/bcm27xx/patches-6.6/950-1510-firmware-rp1-Simplify-rp1_firmware_get.patch
new file mode 100644
index 00000000000000..71a64da9591473
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1510-firmware-rp1-Simplify-rp1_firmware_get.patch
@@ -0,0 +1,84 @@
+From dafde0ac8b6d4b21578a677c8afad8714af47aaf Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 9 Jan 2025 16:33:37 +0000
+Subject: [PATCH] firmware: rp1: Simplify rp1_firmware_get
+
+Simplify the implementation of rp1_firmware_get, requiring its clients
+to have a valid 'firmware' property. Also make it return NULL on error.
+
+Link: https://github.com/raspberrypi/linux/issues/6593
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/firmware/rp1.c | 36 +++++++++++++++---------------------
+ 1 file changed, 15 insertions(+), 21 deletions(-)
+
+--- a/drivers/firmware/rp1.c
++++ b/drivers/firmware/rp1.c
+@@ -159,42 +159,36 @@ struct rp1_firmware *rp1_firmware_get(st
+ 	struct device_node *fwnode;
+ 	struct rp1_firmware *fw;
+ 
+-	if (client) {
+-		fwnode = of_parse_phandle(client, "firmware", 0);
+-		if (!fwnode)
+-			fwnode = of_get_parent(client);
+-		if (fwnode && !of_device_is_compatible(fwnode, match)) {
+-			of_node_put(fwnode);
+-			fwnode = NULL;
+-		}
+-	}
+-
+-	if (!fwnode)
+-		fwnode = of_find_matching_node(NULL, rp1_firmware_of_match);
+-
++	if (!client)
++		return NULL;
++	fwnode = of_parse_phandle(client, "firmware", 0);
+ 	if (!fwnode)
+-		return ERR_PTR(-ENOENT);
++		return NULL;
++	if (!of_device_is_compatible(fwnode, match)) {
++		of_node_put(fwnode);
++		return NULL;
++	}
+ 
+ 	pdev = of_find_device_by_node(fwnode);
+ 	of_node_put(fwnode);
+ 
+ 	if (!pdev)
+-		return ERR_PTR(-EPROBE_DEFER);
++		goto err_exit;
+ 
+ 	fw = platform_get_drvdata(pdev);
+ 	if (!fw)
+-		goto err_defer;
++		goto err_exit;
+ 
+ 	if (!kref_get_unless_zero(&fw->consumers))
+-		goto err_defer;
++		goto err_exit;
+ 
+ 	put_device(&pdev->dev);
+ 
+ 	return fw;
+ 
+-err_defer:
++err_exit:
+ 	put_device(&pdev->dev);
+-	return ERR_PTR(-EPROBE_DEFER);
++	return NULL;
+ }
+ EXPORT_SYMBOL_GPL(rp1_firmware_get);
+ 
+@@ -210,8 +204,8 @@ struct rp1_firmware *devm_rp1_firmware_g
+ 	int ret;
+ 
+ 	fw = rp1_firmware_get(client);
+-	if (IS_ERR(fw))
+-		return fw;
++	if (!fw)
++		return NULL;
+ 
+ 	ret = devm_add_action_or_reset(dev, devm_rp1_firmware_put, fw);
+ 	if (ret)
diff --git a/target/linux/bcm27xx/patches-6.6/950-1512-dts-bcm2711-Don-t-mark-timer-regs-unconfigured.patch b/target/linux/bcm27xx/patches-6.6/950-1512-dts-bcm2711-Don-t-mark-timer-regs-unconfigured.patch
new file mode 100644
index 00000000000000..168dd19f16e4c2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1512-dts-bcm2711-Don-t-mark-timer-regs-unconfigured.patch
@@ -0,0 +1,33 @@
+From d06cb3534b6553a1f76bef2ddaf833e23dc12a4c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 10 Jan 2025 15:45:11 +0000
+Subject: [PATCH] dts: bcm2711: Don't mark timer regs unconfigured
+
+The DT property arm,cpu-registers-not-fw-configured tells the kernel
+that the ARM architectural timer has not been configured by the
+firmware. This prevents the use of a vDSO - a faster alternative to a
+syscall for some common kernel operations.
+
+However, on Pi 4 the firmware does configure the timer, so this property
+is unnecessary. Delete it.
+
+Also remove it from the bcm2712.dtsi where it should never have been,
+since it is only relevant to 32-bit ARM kernels.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/broadcom/bcm2711.dtsi   | 2 --
+ arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 2 --
+ 2 files changed, 4 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
+@@ -741,8 +741,6 @@
+ 					  IRQ_TYPE_LEVEL_LOW)>,
+ 			     <GIC_PPI 10 (GIC_CPU_MASK_SIMPLE(4) |
+ 					  IRQ_TYPE_LEVEL_LOW)>;
+-		/* This only applies to the ARMv7 stub */
+-		arm,cpu-registers-not-fw-configured;
+ 	};
+ 
+ 	cpus: cpus {
diff --git a/target/linux/bcm27xx/patches-6.6/950-1513-mmc-bcm2835-sdhost-Observe-SWIOTLB-memory-limit.patch b/target/linux/bcm27xx/patches-6.6/950-1513-mmc-bcm2835-sdhost-Observe-SWIOTLB-memory-limit.patch
new file mode 100644
index 00000000000000..08a58f2ed5ea12
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1513-mmc-bcm2835-sdhost-Observe-SWIOTLB-memory-limit.patch
@@ -0,0 +1,29 @@
+From dfff38316c1284c30c68d02cc424bad0562cf253 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Fri, 10 Jan 2025 16:33:13 +0000
+Subject: [PATCH] mmc: bcm2835-sdhost Observe SWIOTLB memory limit
+
+Make sure the sdhost driver doesn't use requests bigger than SWIOTLB
+can handle.
+
+Copied from [1].
+
+Link: https://github.com/raspberrypi/linux/issues/6589
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+[1] d4dd9bccf485 ("mmc: bcm2835: Take SWIOTLB memory size limitation
+into account")
+---
+ drivers/mmc/host/bcm2835-sdhost.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mmc/host/bcm2835-sdhost.c
++++ b/drivers/mmc/host/bcm2835-sdhost.c
+@@ -1971,7 +1971,7 @@ int bcm2835_sdhost_add_host(struct platf
+ 	}
+ 
+ 	mmc->max_segs = 128;
+-	mmc->max_req_size = 524288;
++	mmc->max_req_size = min_t(size_t, 524288, dma_max_mapping_size(&pdev->dev));
+ 	mmc->max_seg_size = mmc->max_req_size;
+ 	mmc->max_blk_size = 512;
+ 	mmc->max_blk_count =  65535;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1514-drivers-media-pisp_be-Add-support-for-YUV422-planar-.patch b/target/linux/bcm27xx/patches-6.6/950-1514-drivers-media-pisp_be-Add-support-for-YUV422-planar-.patch
new file mode 100644
index 00000000000000..554c9307c11135
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1514-drivers-media-pisp_be-Add-support-for-YUV422-planar-.patch
@@ -0,0 +1,31 @@
+From a73ecafc5532e31b184220149cc2863f625700bf Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Wed, 15 Jan 2025 09:46:25 +0000
+Subject: [PATCH] drivers: media: pisp_be: Add support for YUV422 planar format
+
+List V4L2_PIX_FMT_YUV422P as supported by the PiSP backend hardware.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../platform/raspberrypi/pisp_be/pisp_be_formats.h     | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/media/platform/raspberrypi/pisp_be/pisp_be_formats.h
++++ b/drivers/media/platform/raspberrypi/pisp_be/pisp_be_formats.h
+@@ -129,6 +129,16 @@ static const struct pisp_be_format suppo
+ 		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
+ 		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
+ 	},
++	{
++		.fourcc		    = V4L2_PIX_FMT_YUV422P,
++		/* 128 alignment to ensure U/V planes are 64 byte aligned. */
++		.align		    = 128,
++		.bit_depth	    = 8,
++		.plane_factor	    = { P3(1), P3(0.5), P3(0.5) },
++		.num_planes	    = 1,
++		.colorspace_mask    = V4L2_COLORSPACE_MASK_ALL_SRGB,
++		.colorspace_default = V4L2_COLORSPACE_SMPTE170M,
++	},
+ 	/* Multiplane YUV formats */
+ 	{
+ 		.fourcc		    = V4L2_PIX_FMT_YUV420M,
diff --git a/target/linux/bcm27xx/patches-6.6/950-1515-drivers-media-pisp_be-Remove-unused-fields-in-struct.patch b/target/linux/bcm27xx/patches-6.6/950-1515-drivers-media-pisp_be-Remove-unused-fields-in-struct.patch
new file mode 100644
index 00000000000000..51b8f7e7e739eb
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1515-drivers-media-pisp_be-Remove-unused-fields-in-struct.patch
@@ -0,0 +1,82 @@
+From a452251cc286f2799969f047698c76fe3d7862b9 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 16 Jan 2025 10:13:57 +0000
+Subject: [PATCH] drivers: media: pisp_be: Remove unused fields in struct
+ pisp_be_config
+
+These fields should not be set by either the user or the kernel driver
+so remove them. Replace them with padding bytes to maintain backward
+compatibility with existing userland applications.
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../linux/media/raspberrypi/pisp_be_config.h  | 42 ++-----------------
+ 1 file changed, 4 insertions(+), 38 deletions(-)
+
+--- a/include/uapi/linux/media/raspberrypi/pisp_be_config.h
++++ b/include/uapi/linux/media/raspberrypi/pisp_be_config.h
+@@ -716,13 +716,6 @@ struct pisp_be_hog_buffer_config {
+ /**
+  * struct pisp_be_config - RaspberryPi PiSP Back End Processing configuration
+  *
+- * @input_buffer:		Input buffer addresses
+- * @tdn_input_buffer:		TDN input buffer addresses
+- * @stitch_input_buffer:	Stitch input buffer addresses
+- * @tdn_output_buffer:		TDN output buffer addresses
+- * @stitch_output_buffer:	Stitch output buffer addresses
+- * @output_buffer:		Output buffers addresses
+- * @hog_buffer:			HOG buffer addresses
+  * @global:			Global PiSP configuration
+  * @input_format:		Input image format
+  * @decompress:			Decompress configuration
+@@ -761,28 +754,10 @@ struct pisp_be_hog_buffer_config {
+  * @output_format:		Output format configuration
+  * @hog:			HOG configuration
+  * @axi:			AXI bus configuration
+- * @lsc_extra:			LSC extra info
+- * @cac_extra:			CAC extra info
+- * @downscale_extra:		Downscaler extra info
+- * @resample_extra:		Resample extra info
+- * @crop:			Crop configuration
+- * @hog_format:			HOG format info
+- * @dirty_flags_bayer:		Bayer enable dirty flags
+- *				(:c:type:`pisp_be_bayer_enable`)
+- * @dirty_flags_rgb:		RGB enable dirty flags
+- *				(:c:type:`pisp_be_rgb_enable`)
+- * @dirty_flags_extra:		Extra dirty flags
+  */
+ struct pisp_be_config {
+-	/* I/O configuration: */
+-	struct pisp_be_input_buffer_config input_buffer;
+-	struct pisp_be_tdn_input_buffer_config tdn_input_buffer;
+-	struct pisp_be_stitch_input_buffer_config stitch_input_buffer;
+-	struct pisp_be_tdn_output_buffer_config tdn_output_buffer;
+-	struct pisp_be_stitch_output_buffer_config stitch_output_buffer;
+-	struct pisp_be_output_buffer_config
+-				output_buffer[PISP_BACK_END_NUM_OUTPUTS];
+-	struct pisp_be_hog_buffer_config hog_buffer;
++	/* For backward compatibility */
++	uint8_t pad0[112];
+ 	/* Processing configuration: */
+ 	struct pisp_be_global_config global;
+ 	struct pisp_image_format_config input_format;
+@@ -823,17 +798,8 @@ struct pisp_be_config {
+ 				output_format[PISP_BACK_END_NUM_OUTPUTS];
+ 	struct pisp_be_hog_config hog;
+ 	struct pisp_be_axi_config axi;
+-	/* Non-register fields: */
+-	struct pisp_be_lsc_extra lsc_extra;
+-	struct pisp_be_cac_extra cac_extra;
+-	struct pisp_be_downscale_extra
+-				downscale_extra[PISP_BACK_END_NUM_OUTPUTS];
+-	struct pisp_be_resample_extra resample_extra[PISP_BACK_END_NUM_OUTPUTS];
+-	struct pisp_be_crop_config crop;
+-	struct pisp_image_format_config hog_format;
+-	__u32 dirty_flags_bayer; /* these use pisp_be_bayer_enable */
+-	__u32 dirty_flags_rgb; /* use pisp_be_rgb_enable */
+-	__u32 dirty_flags_extra; /* these use pisp_be_dirty_t */
++	/* For backward compatibility */
++	uint8_t pad1[84];
+ } __attribute__((packed));
+ 
+ /**
diff --git a/target/linux/bcm27xx/patches-6.6/950-1516-media-imx219-Adjust-PLL-settings-based-on-the-number.patch b/target/linux/bcm27xx/patches-6.6/950-1516-media-imx219-Adjust-PLL-settings-based-on-the-number.patch
new file mode 100644
index 00000000000000..227ada434c89a0
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1516-media-imx219-Adjust-PLL-settings-based-on-the-number.patch
@@ -0,0 +1,163 @@
+From 5b958efc20d381ee103103df5df0c88dc02ada18 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Thu, 16 Jan 2025 11:08:25 +0000
+Subject: [PATCH] media: imx219: Adjust PLL settings based on the number of
+ MIPI lanes
+
+Commit ceddfd4493b3 ("media: i2c: imx219: Support four-lane operation")
+added support for device tree to allow configuration of the sensor to
+use 4 lanes with a link frequency of 363MHz, and amended the advertised
+pixel rate to 280.8MPix/s.
+
+However it didn't change any of the PLL settings, so actually it would
+have been running effectively overclocked in the MIPI block, and with
+the frame rate and exposure calculations being wrong.
+
+The pixel rate and link frequency advertised were taken from the "Clock
+Setting Example" section of the datasheet. However those are based on an
+external clock of 12MHz, and are unachievable with a clock of 24MHz (it
+seems PREPLLCLK_VT_DIV and PREPLLCK_OP_DIV can ONLY be set via the
+automatic configuration doumented in "9-1-2 EXCK_FREQ setting depend on
+INCK frequency).
+
+Dropping all support for the 363MHz link frequency would cause problems
+for existing users, so allow it from device tree, but log a warning that
+the requested value is not being truly applied.
+
+Fixes: ceddfd4493b3 ("media: i2c: imx219: Support four-lane operation")
+Co-developed-by: Peyton Howe <peyton.howe@bellsouth.net>
+Signed-off-by: Peyton Howe <peyton.howe@bellsouth.net>
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/imx219.c | 83 +++++++++++++++++++++++++++++---------
+ 1 file changed, 64 insertions(+), 19 deletions(-)
+
+--- a/drivers/media/i2c/imx219.c
++++ b/drivers/media/i2c/imx219.c
+@@ -148,10 +148,11 @@
+ 
+ /* Pixel rate is fixed for all the modes */
+ #define IMX219_PIXEL_RATE		182400000
+-#define IMX219_PIXEL_RATE_4LANE		280800000
++#define IMX219_PIXEL_RATE_4LANE		281600000
+ 
+ #define IMX219_DEFAULT_LINK_FREQ	456000000
+-#define IMX219_DEFAULT_LINK_FREQ_4LANE	363000000
++#define IMX219_DEFAULT_LINK_FREQ_4LANE_UNSUPPORTED	363000000
++#define IMX219_DEFAULT_LINK_FREQ_4LANE	364000000
+ 
+ /* IMX219 native and active pixel array size. */
+ #define IMX219_NATIVE_WIDTH		3296U
+@@ -224,15 +225,6 @@ static const struct cci_reg_sequence imx
+ 	{ CCI_REG8(0x30eb), 0x05 },
+ 	{ CCI_REG8(0x30eb), 0x09 },
+ 
+-	/* PLL Clock Table */
+-	{ IMX219_REG_VTPXCK_DIV, 5 },
+-	{ IMX219_REG_VTSYCK_DIV, 1 },
+-	{ IMX219_REG_PREPLLCK_VT_DIV, 3 },	/* 0x03 = AUTO set */
+-	{ IMX219_REG_PREPLLCK_OP_DIV, 3 },	/* 0x03 = AUTO set */
+-	{ IMX219_REG_PLL_VT_MPY, 57 },
+-	{ IMX219_REG_OPSYCK_DIV, 1 },
+-	{ IMX219_REG_PLL_OP_MPY, 114 },
+-
+ 	/* Undocumented registers */
+ 	{ CCI_REG8(0x455e), 0x00 },
+ 	{ CCI_REG8(0x471e), 0x4b },
+@@ -316,6 +308,34 @@ static const struct cci_reg_sequence raw
+ 	{ IMX219_REG_OPPXCK_DIV, 10 },
+ };
+ 
++static const struct cci_reg_sequence imx219_2lane_regs[] = {
++	/* PLL Clock Table */
++	{ IMX219_REG_VTPXCK_DIV, 5 },
++	{ IMX219_REG_VTSYCK_DIV, 1 },
++	{ IMX219_REG_PREPLLCK_VT_DIV, 3 },	/* 0x03 = AUTO set */
++	{ IMX219_REG_PREPLLCK_OP_DIV, 3 },	/* 0x03 = AUTO set */
++	{ IMX219_REG_PLL_VT_MPY, 57 },
++	{ IMX219_REG_OPSYCK_DIV, 1 },
++	{ IMX219_REG_PLL_OP_MPY, 114 },
++
++	/* 2-Lane CSI Mode */
++	{ IMX219_REG_CSI_LANE_MODE, IMX219_CSI_2_LANE_MODE },
++};
++
++static const struct cci_reg_sequence imx219_4lane_regs[] = {
++	/* PLL Clock Table */
++	{ IMX219_REG_VTPXCK_DIV, 5 },
++	{ IMX219_REG_VTSYCK_DIV, 1 },
++	{ IMX219_REG_PREPLLCK_VT_DIV, 3 },	/* 0x03 = AUTO set */
++	{ IMX219_REG_PREPLLCK_OP_DIV, 3 },	/* 0x03 = AUTO set */
++	{ IMX219_REG_PLL_VT_MPY, 88 },
++	{ IMX219_REG_OPSYCK_DIV, 1 },
++	{ IMX219_REG_PLL_OP_MPY, 91 },
++
++	/* 4-Lane CSI Mode */
++	{ IMX219_REG_CSI_LANE_MODE, IMX219_CSI_4_LANE_MODE },
++};
++
+ static const s64 imx219_link_freq_menu[] = {
+ 	IMX219_DEFAULT_LINK_FREQ,
+ };
+@@ -941,9 +961,11 @@ static int imx219_get_selection(struct v
+ 
+ static int imx219_configure_lanes(struct imx219 *imx219)
+ {
+-	return cci_write(imx219->regmap, IMX219_REG_CSI_LANE_MODE,
+-			 imx219->lanes == 2 ? IMX219_CSI_2_LANE_MODE :
+-			 IMX219_CSI_4_LANE_MODE, NULL);
++	/* Write the appropriate PLL settings for the number of MIPI lanes */
++	return cci_multi_reg_write(imx219->regmap,
++				  imx219->lanes == 2 ? imx219_2lane_regs : imx219_4lane_regs,
++				  imx219->lanes == 2 ? ARRAY_SIZE(imx219_2lane_regs) :
++				  ARRAY_SIZE(imx219_4lane_regs), NULL);
+ };
+ 
+ static int imx219_start_streaming(struct imx219 *imx219,
+@@ -1334,6 +1356,7 @@ static int imx219_check_hwcfg(struct dev
+ 		.bus_type = V4L2_MBUS_CSI2_DPHY
+ 	};
+ 	int ret = -EINVAL;
++	bool link_frequency_valid = false;
+ 
+ 	endpoint = fwnode_graph_get_next_endpoint(dev_fwnode(dev), NULL);
+ 	if (!endpoint) {
+@@ -1360,11 +1383,33 @@ static int imx219_check_hwcfg(struct dev
+ 		goto error_out;
+ 	}
+ 
+-	if (ep_cfg.nr_of_link_frequencies != 1 ||
+-	   (ep_cfg.link_frequencies[0] != ((imx219->lanes == 2) ?
+-	    IMX219_DEFAULT_LINK_FREQ : IMX219_DEFAULT_LINK_FREQ_4LANE))) {
+-		dev_err(dev, "Link frequency not supported: %lld\n",
+-			ep_cfg.link_frequencies[0]);
++	if (ep_cfg.nr_of_link_frequencies == 1) {
++		switch (imx219->lanes) {
++		case 2:
++			if (ep_cfg.link_frequencies[0] ==
++						IMX219_DEFAULT_LINK_FREQ)
++				link_frequency_valid = true;
++			break;
++		case 4:
++			if (ep_cfg.link_frequencies[0] ==
++						IMX219_DEFAULT_LINK_FREQ_4LANE)
++				link_frequency_valid = true;
++			else if (ep_cfg.link_frequencies[0] ==
++				   IMX219_DEFAULT_LINK_FREQ_4LANE_UNSUPPORTED) {
++				dev_warn(dev, "Link frequency of %d not supported, but has been incorrectly advertised previously\n",
++					 IMX219_DEFAULT_LINK_FREQ_4LANE_UNSUPPORTED);
++				dev_warn(dev, "Using link frequency of %d\n",
++					 IMX219_DEFAULT_LINK_FREQ_4LANE);
++				link_frequency_valid = true;
++			}
++			break;
++		}
++	}
++
++	if (!link_frequency_valid) {
++		dev_err_probe(dev, -EINVAL,
++			      "Link frequency not supported: %lld\n",
++			      ep_cfg.link_frequencies[0]);
+ 		goto error_out;
+ 	}
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1517-IMX219-Add-4-lane-option-to-the-device-tree-overlay.patch b/target/linux/bcm27xx/patches-6.6/950-1517-IMX219-Add-4-lane-option-to-the-device-tree-overlay.patch
new file mode 100644
index 00000000000000..2872f18425330b
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1517-IMX219-Add-4-lane-option-to-the-device-tree-overlay.patch
@@ -0,0 +1,55 @@
+From e3297f3fbffdaec8076c00167261f504bb2c64b6 Mon Sep 17 00:00:00 2001
+From: Peyton Howe <peyton.howe@bellsouth.net>
+Date: Sat, 4 Jan 2025 15:15:33 -0500
+Subject: [PATCH] IMX219: Add 4-lane option to the device tree overlay
+
+Signed-off-by: Peyton Howe <peyton.howe@bellsouth.net>
+---
+ arch/arm/boot/dts/overlays/README             |  2 ++
+ arch/arm/boot/dts/overlays/imx219-overlay.dts | 17 +++++++++++++++++
+ 2 files changed, 19 insertions(+)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -2757,6 +2757,8 @@ Params: rotation                Mounting
+         cam0                    Adopt the default configuration for CAM0 on a
+                                 Compute Module (CSI0, i2c_vc, and cam0_reg).
+         vcm                     Configure a VCM focus drive on the sensor.
++        4lane                   Enable 4 CSI2 lanes. This requires a Compute
++                                Module (1, 3, 4, or 5) or Pi 5.
+ 
+ 
+ Name:   imx258
+--- a/arch/arm/boot/dts/overlays/imx219-overlay.dts
++++ b/arch/arm/boot/dts/overlays/imx219-overlay.dts
+@@ -65,6 +65,22 @@
+ 		};
+ 	};
+ 
++	fragment@201 {
++		target = <&csi_ep>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++		};
++	};
++
++	fragment@202 {
++		target = <&cam_endpoint>;
++		__dormant__ {
++			data-lanes = <1 2 3 4>;
++			link-frequencies =
++					/bits/ 64 <363000000>;
++		};
++	};
++
+ 	__overrides__ {
+ 		rotation = <&cam_node>,"rotation:0";
+ 		orientation = <&cam_node>,"orientation:0";
+@@ -77,6 +93,7 @@
+ 		       <&vcm>, "VANA-supply:0=", <&cam0_reg>;
+ 		vcm = <&vcm>, "status=okay",
+ 		      <&cam_node>,"lens-focus:0=", <&vcm>;
++		4lane = <0>, "+201+202";
+ 	};
+ };
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1518-dtoverlays-waveshare-panel-Disable-new-touch-control.patch b/target/linux/bcm27xx/patches-6.6/950-1518-dtoverlays-waveshare-panel-Disable-new-touch-control.patch
new file mode 100644
index 00000000000000..61534982dd13f3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1518-dtoverlays-waveshare-panel-Disable-new-touch-control.patch
@@ -0,0 +1,40 @@
+From 11381ac246576bc84dfc28f6cdd8030305c605aa Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 20 Jan 2025 11:53:04 +0000
+Subject: [PATCH] dtoverlays: waveshare-panel: Disable new touch controller by
+ default
+
+Commit e442e5c1ab6b ("arch:arm:boot:dts:overlays: Added waveshare 13.3inch
+panel support") added an extra touch controller for the new panels.
+On systems with old panels, it ends up spamming the kernel log as that
+touch controller isn't there to respond.
+
+Fixes: e442e5c1ab6b ("arch:arm:boot:dts:overlays: Added waveshare 13.3inch panel support")
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ .../dts/overlays/vc4-kms-dsi-waveshare-panel-overlay.dts   | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-panel-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-panel-overlay.dts
+@@ -55,6 +55,7 @@
+ 			touch2: ilitek@41 {
+ 				compatible = "ilitek,ili251x";
+ 				reg = <0x41>;
++				status = "disabled";
+ 			};
+ 		};
+ 	};
+@@ -125,8 +126,10 @@
+ 				   <&touch>, "touchscreen-inverted-x?",
+ 				   <&touch>, "touchscreen-inverted-y?";
+ 		8_8_inch = <&panel>, "compatible=waveshare,8.8inch-panel";
+-		13_3_inch_4lane = <&panel>, "compatible=waveshare,13.3inch-4lane-panel";
+-		13_3_inch_2lane = <&panel>, "compatible=waveshare,13.3inch-2lane-panel";
++		13_3_inch_4lane = <&panel>, "compatible=waveshare,13.3inch-4lane-panel",
++				  <&touch2>, "status=okay";
++		13_3_inch_2lane = <&panel>, "compatible=waveshare,13.3inch-2lane-panel",
++				  <&touch2>, "status=okay";
+ 		i2c1 = <&i2c_frag>, "target:0=",<&i2c1>,
+ 		       <0>, "-3-4+5";
+ 		disable_touch = <&touch>, "status=disabled";
diff --git a/target/linux/bcm27xx/patches-6.6/950-1519-drm-rp1-rp1-dpi-Add-rgb_order-property-to-match-VC4-.patch b/target/linux/bcm27xx/patches-6.6/950-1519-drm-rp1-rp1-dpi-Add-rgb_order-property-to-match-VC4-.patch
new file mode 100644
index 00000000000000..4892c271ffc933
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1519-drm-rp1-rp1-dpi-Add-rgb_order-property-to-match-VC4-.patch
@@ -0,0 +1,325 @@
+From ba9883e3b667e4f1fbeacc4346f6e9179a3a5479 Mon Sep 17 00:00:00 2001
+From: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+Date: Mon, 20 Jan 2025 11:20:48 +0000
+Subject: [PATCH] drm: rp1: rp1-dpi: Add "rgb_order" property (to match VC4
+ DPI)
+
+As on VC4, the OF property overrides the order implied by media
+bus format. Only 4 of the 6 possible orders are supported. New
+add-on hardware designs should not rely on this "legacy" feature.
+
+Signed-off-by: Nick Hollinghurst <nick.hollinghurst@raspberrypi.com>
+---
+ drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.c    |  15 ++
+ drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.h    |   8 +
+ drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_hw.c | 191 ++++++++++++++---------
+ 3 files changed, 143 insertions(+), 71 deletions(-)
+
+--- a/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.c
++++ b/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.c
+@@ -292,6 +292,7 @@ static int rp1dpi_platform_probe(struct
+ 	struct device *dev = &pdev->dev;
+ 	struct rp1_dpi *dpi;
+ 	struct drm_bridge *bridge = NULL;
++	const char *rgb_order = NULL;
+ 	struct drm_panel *panel;
+ 	int i, j, ret;
+ 
+@@ -353,6 +354,20 @@ static int rp1dpi_platform_probe(struct
+ 	if (ret)
+ 		goto done_err;
+ 
++	dpi->rgb_order_override = RP1DPI_ORDER_UNCHANGED;
++	if (!of_property_read_string(dev->of_node, "rgb_order", &rgb_order)) {
++		if (!strcmp(rgb_order, "rgb"))
++			dpi->rgb_order_override = RP1DPI_ORDER_RGB;
++		else if (!strcmp(rgb_order, "bgr"))
++			dpi->rgb_order_override = RP1DPI_ORDER_BGR;
++		else if (!strcmp(rgb_order, "grb"))
++			dpi->rgb_order_override = RP1DPI_ORDER_GRB;
++		else if (!strcmp(rgb_order, "brg"))
++			dpi->rgb_order_override = RP1DPI_ORDER_BRG;
++		else
++			DRM_ERROR("Invalid dpi order %s - ignored\n", rgb_order);
++	}
++
+ 	/* Check if PIO can snoop on or override DPI's GPIO1 */
+ 	dpi->gpio1_used = false;
+ 	for (i = 0; !dpi->gpio1_used; i++) {
+--- a/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.h
++++ b/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi.h
+@@ -25,6 +25,13 @@
+ #define RP1DPI_CLK_PLLCORE  2
+ #define RP1DPI_NUM_CLOCKS   3
+ 
++/* Codes (in LE byte order) used for S/W permutation */
++#define RP1DPI_ORDER_UNCHANGED 0
++#define RP1DPI_ORDER_RGB       0x020100
++#define RP1DPI_ORDER_BGR       0x000102
++#define RP1DPI_ORDER_GRB       0x020001
++#define RP1DPI_ORDER_BRG       0x010002
++
+ /* ---------------------------------------------------------------------- */
+ 
+ struct rp1_dpi {
+@@ -45,6 +52,7 @@ struct rp1_dpi {
+ 	u32 bus_fmt;
+ 	bool de_inv, clk_inv;
+ 	bool dpi_running, pipe_enabled;
++	unsigned int rgb_order_override;
+ 	struct completion finished;
+ 
+ 	/* Experimental stuff for interlace follows */
+--- a/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_hw.c
++++ b/drivers/gpu/drm/rp1/rp1-dpi/rp1_dpi_hw.c
+@@ -223,12 +223,90 @@ int rp1dpi_hw_busy(struct rp1_dpi *dpi)
+ 	return (rp1dpi_hw_read(dpi, DPI_DMA_STATUS) & 0xF8F) ? 1 : 0;
+ }
+ 
+-/* Table of supported input (in-memory/DMA) pixel formats. */
++/*
++ * Table of supported input (in-memory/DMA) pixel formats.
++ *
++ * RP1 DPI describes RGB components in terms of their MS bit position, a 10-bit
++ * left-aligned bit-mask, and an optional right-shift-and-OR used for scaling.
++ * To make it easier to permute R, G and B components, we re-pack these fields
++ * into 32-bit code-words, which don't themselves correspond to any register.
++ */
++
++#define RGB_CODE(scale, shift, mask) (((scale) << 24) | ((shift) << 16) | (mask))
++#define RGB_SCALE(c) ((c) >> 24)
++#define RGB_SHIFT(c) (((c) >> 16) & 31)
++#define RGB_MASK(c) ((c) & 0x3ff)
++
+ struct rp1dpi_ipixfmt {
+-	u32 format; /* DRM format code                           */
+-	u32 mask;   /* RGB masks (10 bits each, left justified)  */
+-	u32 shift;  /* RGB MSB positions in the memory word      */
+-	u32 rgbsz;  /* Shifts used for scaling; also (BPP/8-1)   */
++	u32 format;       /* DRM format code                          */
++	u32 rgb_code[3];  /* (width&7), MS bit position, 10-bit mask  */
++	u32 bpp;          /* Bytes per pixel minus one                */
++};
++
++static const struct rp1dpi_ipixfmt my_formats[] = {
++	{
++		.format = DRM_FORMAT_XRGB8888,
++		.rgb_code = {
++			RGB_CODE(0, 23, 0x3fc),
++			RGB_CODE(0, 15, 0x3fc),
++			RGB_CODE(0, 7, 0x3fc),
++		},
++		.bpp = 3,
++	},
++	{
++		.format = DRM_FORMAT_XBGR8888,
++		.rgb_code = {
++			RGB_CODE(0, 7, 0x3fc),
++			RGB_CODE(0, 15, 0x3fc),
++			RGB_CODE(0, 23, 0x3fc),
++		},
++		.bpp = 3,
++	},
++	{
++		.format = DRM_FORMAT_ARGB8888,
++		.rgb_code = {
++			RGB_CODE(0, 23, 0x3fc),
++			RGB_CODE(0, 15, 0x3fc),
++			RGB_CODE(0, 7, 0x3fc),
++		},
++		.bpp = 3,
++	},
++	{
++		.format = DRM_FORMAT_ABGR8888,
++		.rgb_code = {
++			RGB_CODE(0, 7, 0x3fc),
++			RGB_CODE(0, 15, 0x3fc),
++			RGB_CODE(0, 23, 0x3fc),
++		},
++		.bpp = 3,
++	},
++	{
++		.format = DRM_FORMAT_RGB888,
++		.rgb_code = {
++			RGB_CODE(0, 23, 0x3fc),
++			RGB_CODE(0, 15, 0x3fc),
++			RGB_CODE(0, 7, 0x3fc),
++		},
++		.bpp = 2,
++	},
++	{
++		.format = DRM_FORMAT_BGR888,
++		.rgb_code = {
++			RGB_CODE(0, 7, 0x3fc),
++			RGB_CODE(0, 15, 0x3fc),
++			RGB_CODE(0, 23, 0x3fc),
++		},
++		.bpp = 2,
++	},
++	{
++		.format = DRM_FORMAT_RGB565,
++		.rgb_code = {
++			RGB_CODE(5, 15, 0x3e0),
++			RGB_CODE(6, 10, 0x3f0),
++			RGB_CODE(5, 4, 0x3e0),
++		},
++		.bpp = 1,
++	},
+ };
+ 
+ #define IMASK_RGB(r, g, b)  (FIELD_PREP_CONST(DPI_DMA_IMASK_R_MASK, r)  | \
+@@ -244,63 +322,13 @@ struct rp1dpi_ipixfmt {
+ 			     FIELD_PREP_CONST(DPI_DMA_SHIFT_OG_MASK, g) | \
+ 			     FIELD_PREP_CONST(DPI_DMA_SHIFT_OB_MASK, b))
+ 
+-static const struct rp1dpi_ipixfmt my_formats[] = {
+-	{
+-	  .format = DRM_FORMAT_XRGB8888,
+-	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
+-	  .shift  = ISHIFT_RGB(23, 15, 7),
+-	  .rgbsz  = FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 3),
+-	},
+-	{
+-	  .format = DRM_FORMAT_XBGR8888,
+-	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
+-	  .shift  = ISHIFT_RGB(7, 15, 23),
+-	  .rgbsz  = FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 3),
+-	},
+-	{
+-	  .format = DRM_FORMAT_ARGB8888,
+-	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
+-	  .shift  = ISHIFT_RGB(23, 15, 7),
+-	  .rgbsz  = FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 3),
+-	},
+-	{
+-	  .format = DRM_FORMAT_ABGR8888,
+-	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
+-	  .shift  = ISHIFT_RGB(7, 15, 23),
+-	  .rgbsz  = FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 3),
+-	},
+-	{
+-	  .format = DRM_FORMAT_RGB888,
+-	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
+-	  .shift  = ISHIFT_RGB(23, 15, 7),
+-	  .rgbsz  = FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 2),
+-	},
+-	{
+-	  .format = DRM_FORMAT_BGR888,
+-	  .mask	  = IMASK_RGB(0x3fc, 0x3fc, 0x3fc),
+-	  .shift  = ISHIFT_RGB(7, 15, 23),
+-	  .rgbsz  = FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 2),
+-	},
+-	{
+-	  .format = DRM_FORMAT_RGB565,
+-	  .mask	  = IMASK_RGB(0x3e0, 0x3f0, 0x3e0),
+-	  .shift  = ISHIFT_RGB(15, 10, 4),
+-	  .rgbsz  = (FIELD_PREP_CONST(DPI_DMA_RGBSZ_R_MASK, 5) |
+-		     FIELD_PREP_CONST(DPI_DMA_RGBSZ_G_MASK, 6) |
+-		     FIELD_PREP_CONST(DPI_DMA_RGBSZ_B_MASK, 5) |
+-		     FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 1)),
+-	},
+-	{
+-	  .format = DRM_FORMAT_BGR565,
+-	  .mask	  = IMASK_RGB(0x3e0, 0x3f0, 0x3e0),
+-	  .shift  = ISHIFT_RGB(4, 10, 15),
+-	  .rgbsz  = (FIELD_PREP_CONST(DPI_DMA_RGBSZ_R_MASK, 5) |
+-		     FIELD_PREP_CONST(DPI_DMA_RGBSZ_G_MASK, 6) |
+-		     FIELD_PREP_CONST(DPI_DMA_RGBSZ_B_MASK, 5) |
+-		     FIELD_PREP_CONST(DPI_DMA_RGBSZ_BPP_MASK, 1)),
+-	}
+-};
+-
++/*
++ * Function to update *shift with output positions, and return output RGB masks.
++ * By the time we get here, RGB order has been normalized to RGB (R most significant).
++ * Note that an internal bus is 30 bits wide: bits [21:20], [11:10], [1:0] are dropped.
++ * This makes the packed RGB5656 and RGB666 formats problematic, as colour components
++ * need to straddle the gaps; we mitigate this by hijacking input masks and scaling.
++ */
+ static u32 set_output_format(u32 bus_format, u32 *shift, u32 *imask, u32 *rgbsz)
+ {
+ 	switch (bus_format) {
+@@ -308,6 +336,7 @@ static u32 set_output_format(u32 bus_for
+ 		if (*shift == ISHIFT_RGB(15, 10, 4)) {
+ 			/* When framebuffer is RGB565, we can output RGB565 */
+ 			*shift = ISHIFT_RGB(15, 7, 0) | OSHIFT_RGB(19, 9, 0);
++			*imask = IMASK_RGB(0x3fc, 0x3fc, 0);
+ 			*rgbsz &= DPI_DMA_RGBSZ_BPP_MASK;
+ 			return OMASK_RGB(0x3fc, 0x3fc, 0);
+ 		}
+@@ -322,7 +351,7 @@ static u32 set_output_format(u32 bus_for
+ 	case MEDIA_BUS_FMT_BGR666_1X18:
+ 		/* due to a HW limitation, bit-depth is effectively RGB444 */
+ 		*shift |= OSHIFT_RGB(23, 15, 7);
+-		*imask &= IMASK_RGB(0x3c0, 0x3c0, 0x3c0);
++		*imask = IMASK_RGB(0x3c0, 0x3c0, 0x3c0);
+ 		*rgbsz = BITS(DPI_DMA_RGBSZ_R, 2) | (*rgbsz & DPI_DMA_RGBSZ_BPP_MASK);
+ 		return OMASK_RGB(0x330, 0x3c0, 0x3c0);
+ 
+@@ -359,7 +388,8 @@ void rp1dpi_hw_setup(struct rp1_dpi *dpi
+ 		    struct drm_display_mode const *mode)
+ {
+ 	u32 shift, imask, omask, rgbsz, vctrl;
+-	int i;
++	u32 rgb_code[3];
++	int order, i;
+ 
+ 	drm_info(&dpi->drm,
+ 		 "in_fmt=\'%c%c%c%c\' bus_fmt=0x%x mode=%dx%d total=%dx%d%s %dkHz %cH%cV%cD%cC",
+@@ -373,26 +403,45 @@ void rp1dpi_hw_setup(struct rp1_dpi *dpi
+ 		 de_inv ? '-' : '+',
+ 		 dpi->clk_inv ? '-' : '+');
+ 
+-	/*
+-	 * Configure all DPI/DMA block registers, except base address.
+-	 * DMA will not actually start until a FB base address is specified
+-	 * using rp1dpi_hw_update().
+-	 */
++	/* Look up the input (in-memory) pixel format */
+ 	for (i = 0; i < ARRAY_SIZE(my_formats); ++i) {
+ 		if (my_formats[i].format == in_format)
+ 			break;
+ 	}
+ 	if (i >= ARRAY_SIZE(my_formats)) {
+ 		pr_err("%s: bad input format\n", __func__);
+-		i = 4;
++		i = ARRAY_SIZE(my_formats) - 1;
+ 	}
+-	if (BUS_FMT_IS_BGR(bus_format))
+-		i ^= 1;
+-	shift = my_formats[i].shift;
+-	imask = my_formats[i].mask;
+-	rgbsz = my_formats[i].rgbsz;
++
++	/*
++	 * Although these RGB orderings refer to the output (DPI bus) format,
++	 * here we permute the *input* components. After this point, "Red"
++	 * will be most significant (highest numbered GPIOs), regardless
++	 * of rgb_order or bus_format. This simplifies later workarounds.
++	 */
++	order = dpi->rgb_order_override;
++	if (order == RP1DPI_ORDER_UNCHANGED)
++		order = BUS_FMT_IS_BGR(bus_format) ? RP1DPI_ORDER_BGR : RP1DPI_ORDER_RGB;
++	rgb_code[0] = my_formats[i].rgb_code[order & 3];
++	rgb_code[1] = my_formats[i].rgb_code[(order >> 8) & 3];
++	rgb_code[2] = my_formats[i].rgb_code[(order >> 16) & 3];
++	rgbsz = FIELD_PREP(DPI_DMA_RGBSZ_BPP_MASK, my_formats[i].bpp) |
++		FIELD_PREP(DPI_DMA_RGBSZ_R_MASK, RGB_SCALE(rgb_code[0])) |
++		FIELD_PREP(DPI_DMA_RGBSZ_G_MASK, RGB_SCALE(rgb_code[1])) |
++		FIELD_PREP(DPI_DMA_RGBSZ_B_MASK, RGB_SCALE(rgb_code[2]));
++	shift = FIELD_PREP(DPI_DMA_SHIFT_IR_MASK, RGB_SHIFT(rgb_code[0])) |
++		FIELD_PREP(DPI_DMA_SHIFT_IG_MASK, RGB_SHIFT(rgb_code[1])) |
++		FIELD_PREP(DPI_DMA_SHIFT_IB_MASK, RGB_SHIFT(rgb_code[2]));
++	imask = FIELD_PREP(DPI_DMA_IMASK_R_MASK, RGB_MASK(rgb_code[0])) |
++		FIELD_PREP(DPI_DMA_IMASK_G_MASK, RGB_MASK(rgb_code[1])) |
++		FIELD_PREP(DPI_DMA_IMASK_B_MASK, RGB_MASK(rgb_code[2]));
+ 	omask = set_output_format(bus_format, &shift, &imask, &rgbsz);
+ 
++	/*
++	 * Configure all DPI/DMA block registers, except base address.
++	 * DMA will not actually start until a FB base address is specified
++	 * using rp1dpi_hw_update().
++	 */
+ 	rp1dpi_hw_write(dpi, DPI_DMA_IMASK, imask);
+ 	rp1dpi_hw_write(dpi, DPI_DMA_OMASK, omask);
+ 	rp1dpi_hw_write(dpi, DPI_DMA_SHIFT, shift);
diff --git a/target/linux/bcm27xx/patches-6.6/950-1522-add-ina238-to-i2c-sensors.patch b/target/linux/bcm27xx/patches-6.6/950-1522-add-ina238-to-i2c-sensors.patch
new file mode 100644
index 00000000000000..cc0f31d08babb6
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1522-add-ina238-to-i2c-sensors.patch
@@ -0,0 +1,102 @@
+From 94de19285cc9bd781394bf1aa4fb8d401aac5195 Mon Sep 17 00:00:00 2001
+From: James Sarrett <jsarrett@gmail.com>
+Date: Sun, 26 Jan 2025 11:29:31 -0800
+Subject: [PATCH] add ina238 to i2c-sensors
+
+This patch adds the ina238 device tree parameters to the i2c-sensors
+overlay.  The ina238 driver needs 2 configuration parameters, shut_resistor
+and ti,shunt-gain in addition to it's address, so they are added as well.
+---
+ arch/arm/boot/dts/overlays/README             | 13 ++++++++++
+ .../boot/dts/overlays/i2c-sensor-common.dtsi  | 26 ++++++++++++++++++-
+ 2 files changed, 38 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -2486,11 +2486,20 @@ Params: addr                    Set the
+         ds1621                  Select the Dallas Semiconductors DS1621 temp
+                                 sensor. Valid addresses 0x48-0x4f, default 0x48
+ 
++        gain                    Gain used for measuring shunt resistor current.
++                                Valid values 1 or 4, default 1. (ina238 only,
++                                disabled by default)
++
+         hdc100x                 Select the Texas Instruments HDC100x temp sensor
+                                 Valid addresses 0x40-0x43, default 0x40
+ 
+         htu21                   Select the HTU21 temperature and humidity sensor
+ 
++        ina238                  Select the TI INA238 power monitor. Valid
++                                addresses 0x40-0x4F, default 0x40.
++                                Uses parameters shunt-resistor and
++                                ti,shunt-gain for configuration
++
+         int_pin                 Set the GPIO to use for interrupts (max30102,
+                                 mpu6050 and mpu9250 only)
+ 
+@@ -2549,6 +2558,10 @@ Params: addr                    Set the
+         reset_pin               GPIO to be used to reset the device (bno055
+                                 only, disabled by default)
+ 
++        shunt_resistor          Value of shunt resistor used for current
++                                measurement in uOhms.  (ina238 only, disabled
++                                by default)
++
+         sht3x                   Select the Sensirion SHT3x temperature and
+                                 humidity sensors. Valid addresses 0x44-0x45,
+                                 default 0x44
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+@@ -526,6 +526,27 @@
+ 		};
+ 	};
+ 
++	fragment@35 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			ina238: ina238@48 {
++				compatible = "ti,ina238";
++				#address-cells = <1>;
++				#size-cells = <0>;
++				reg = <0x40>;
++				/* uOhms, uint32_t */
++				shunt-resistor = <1000>;
++				/* 1 or 4, (±40.96 mV or ±163.84 mV) */
++				ti,shunt-gain = <1>;
++				status = "okay";
++			};
++		};
++	};
++
+ 	fragment@99 {
+ 		target = <&gpio>;
+ 		__dormant__ {
+@@ -573,6 +594,7 @@
+ 		bno055 = <0>,"+31";
+ 		sht4x = <0>,"+32";
+ 		adt7410 = <0>,"+34";
++		ina238 = <0>,"+35";
+ 
+ 		addr =	<&bme280>,"reg:0", <&bmp280>,"reg:0", <&tmp102>,"reg:0",
+ 			<&lm75>,"reg:0", <&hdc100x>,"reg:0", <&sht3x>,"reg:0",
+@@ -582,7 +604,7 @@
+ 			<&ms5837>,"reg:0", <&ms8607>,"reg:0",
+ 			<&mpu6050>,"reg:0", <&mpu9250>,"reg:0",
+ 			<&bno055>,"reg:0", <&sht4x>,"reg:0",
+-			<&bmp380>,"reg:0", <&adt7410>,"reg:0";
++			<&bmp380>,"reg:0", <&adt7410>,"reg:0", <&ina238>,"reg:0";
+ 		int_pin = <&int_pins>, "brcm,pins:0",
+ 			<&int_pins>, "reg:0",
+ 			<&max30102>, "interrupts:0",
+@@ -590,5 +612,7 @@
+ 			<&mpu9250>, "interrupts:0";
+ 		no_timeout = <&jc42>, "smbus-timeout-disable?";
+ 		reset_pin = <&bno055>,"reset-gpios:4", <0>,"+30";
++		shunt_resistor = <&ina238>,"shunt-resistor:0";
++		gain = <&ina238>,"ti,shunt-gain:0";
+ 	};
+ };
diff --git a/target/linux/bcm27xx/patches-6.6/950-1524-add-shtc3-to-i2c-sensors.patch b/target/linux/bcm27xx/patches-6.6/950-1524-add-shtc3-to-i2c-sensors.patch
new file mode 100644
index 00000000000000..575d52241eeff6
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1524-add-shtc3-to-i2c-sensors.patch
@@ -0,0 +1,57 @@
+From aabe16b3cdc6172618803ed7a6002d1099d306e5 Mon Sep 17 00:00:00 2001
+From: James Sarrett <jsarrett@gmail.com>
+Date: Sun, 26 Jan 2025 22:07:02 -0800
+Subject: [PATCH] add shtc3 to i2c-sensors
+
+This patch adds the shtc3 device tree parameters to the i2c-sensors
+overlay.  The shtc3 driver needs no other configuration parameters, as the
+i2c address is permanently baked in to the silicon.
+---
+ arch/arm/boot/dts/overlays/README                |  3 +++
+ .../arm/boot/dts/overlays/i2c-sensor-common.dtsi | 16 ++++++++++++++++
+ 2 files changed, 19 insertions(+)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -2570,6 +2570,9 @@ Params: addr                    Set the
+                                 humidity sensors. Valid addresses 0x44-0x45,
+                                 default 0x44
+ 
++        shtc3                   Select the Sensirion SHTC3 temperature and
++                                humidity sensors.
++
+         si7020                  Select the Silicon Labs Si7013/20/21 humidity/
+                                 temperature sensor
+ 
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-common.dtsi
+@@ -547,6 +547,21 @@
+ 		};
+ 	};
+ 
++	fragment@36 {
++		target = <&i2cbus>;
++		__dormant__ {
++			#address-cells = <1>;
++			#size-cells = <0>;
++			status = "okay";
++
++			shtc3: shtc3@70 {
++				compatible = "sensirion,shtc3";
++				reg = <0x70>;
++				status = "okay";
++			};
++		};
++	};
++
+ 	fragment@99 {
+ 		target = <&gpio>;
+ 		__dormant__ {
+@@ -595,6 +610,7 @@
+ 		sht4x = <0>,"+32";
+ 		adt7410 = <0>,"+34";
+ 		ina238 = <0>,"+35";
++		shtc3 = <0>,"+36";
+ 
+ 		addr =	<&bme280>,"reg:0", <&bmp280>,"reg:0", <&tmp102>,"reg:0",
+ 			<&lm75>,"reg:0", <&hdc100x>,"reg:0", <&sht3x>,"reg:0",
diff --git a/target/linux/bcm27xx/patches-6.6/950-1525-drivers-media-pci-Update-Hailo-accelerator-device-dr.patch b/target/linux/bcm27xx/patches-6.6/950-1525-drivers-media-pci-Update-Hailo-accelerator-device-dr.patch
new file mode 100644
index 00000000000000..72d73089e3cf68
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1525-drivers-media-pci-Update-Hailo-accelerator-device-dr.patch
@@ -0,0 +1,2137 @@
+From a18d9ced4965462cb7b3b4252ada440395105308 Mon Sep 17 00:00:00 2001
+From: Naushir Patuck <naush@raspberrypi.com>
+Date: Thu, 23 Jan 2025 14:14:47 +0000
+Subject: [PATCH] drivers: media: pci: Update Hailo accelerator device driver
+ to v4.20
+
+Sourced from https://github.com/hailo-ai/hailort-drivers
+
+Signed-off-by: Naushir Patuck <naush@raspberrypi.com>
+---
+ .../media/pci/hailo/common/fw_validation.c    |   4 +-
+ .../media/pci/hailo/common/fw_validation.h    |  14 +-
+ .../pci/hailo/common/hailo_ioctl_common.h     |  10 +-
+ drivers/media/pci/hailo/common/pcie_common.c  | 175 +++--
+ drivers/media/pci/hailo/common/pcie_common.h  |  69 +-
+ drivers/media/pci/hailo/common/vdma_common.c  |  70 +-
+ drivers/media/pci/hailo/common/vdma_common.h  |  27 +-
+ drivers/media/pci/hailo/src/fops.c            |  90 ++-
+ drivers/media/pci/hailo/src/nnc.c             |   4 +-
+ drivers/media/pci/hailo/src/pcie.c            | 630 ++++++++++++++++--
+ drivers/media/pci/hailo/src/pcie.h            |  39 +-
+ drivers/media/pci/hailo/src/soc.c             |  18 +-
+ drivers/media/pci/hailo/utils/compact.h       |   8 +
+ drivers/media/pci/hailo/vdma/memory.c         |  86 ++-
+ drivers/media/pci/hailo/vdma/memory.h         |   2 +
+ 15 files changed, 997 insertions(+), 249 deletions(-)
+
+--- a/drivers/media/pci/hailo/common/fw_validation.c
++++ b/drivers/media/pci/hailo/common/fw_validation.c
+@@ -41,8 +41,8 @@ int FW_VALIDATION__validate_fw_header(ui
+     case HAILO_BOARD_TYPE_HAILO10H:
+         expected_firmware_magic = FIRMWARE_HEADER_MAGIC_HAILO15;
+         break;
+-    case HAILO_BOARD_TYPE_PLUTO:
+-        expected_firmware_magic = FIRMWARE_HEADER_MAGIC_PLUTO;
++    case HAILO_BOARD_TYPE_HAILO15L:
++        expected_firmware_magic = FIRMWARE_HEADER_MAGIC_HAILO15L;
+         break;
+     default:
+         err = -EINVAL;
+--- a/drivers/media/pci/hailo/common/fw_validation.h
++++ b/drivers/media/pci/hailo/common/fw_validation.h
+@@ -9,15 +9,9 @@
+ #include "hailo_ioctl_common.h"
+ #include <linux/types.h>
+ 
+-#define FIRMWARE_HEADER_MAGIC_HAILO8 (0x1DD89DE0)
+-#define FIRMWARE_HEADER_MAGIC_HAILO15 (0xE905DAAB)
+-#define FIRMWARE_HEADER_MAGIC_PLUTO (0xF94739AB)
+-
+-#ifndef HAILO_EMULATOR
+-#define FIRMWARE_WAIT_TIMEOUT_MS (5000)
+-#else /* ifndef HAILO_EMULATOR */
+-#define FIRMWARE_WAIT_TIMEOUT_MS (500000)
+-#endif /* ifndef HAILO_EMULATOR */
++#define FIRMWARE_HEADER_MAGIC_HAILO8    (0x1DD89DE0)
++#define FIRMWARE_HEADER_MAGIC_HAILO15   (0xE905DAAB)
++#define FIRMWARE_HEADER_MAGIC_HAILO15L  (0xF94739AB)
+ 
+ typedef enum {
+     FIRMWARE_HEADER_VERSION_INITIAL = 0,
+@@ -61,4 +55,4 @@ int FW_VALIDATION__validate_fw_header(ui
+ int FW_VALIDATION__validate_cert_header(uintptr_t firmware_base_address,
+     size_t firmware_size, u32 *outer_consumed_firmware_offset, secure_boot_certificate_header_t **out_firmware_cert);
+ 
+-#endif
+\ No newline at end of file
++#endif
+--- a/drivers/media/pci/hailo/common/hailo_ioctl_common.h
++++ b/drivers/media/pci/hailo/common/hailo_ioctl_common.h
+@@ -7,7 +7,7 @@
+ #define _HAILO_IOCTL_COMMON_H_
+ 
+ #define HAILO_DRV_VER_MAJOR 4
+-#define HAILO_DRV_VER_MINOR 19
++#define HAILO_DRV_VER_MINOR 20
+ #define HAILO_DRV_VER_REVISION 0
+ 
+ #define _STRINGIFY_EXPANDED( x ) #x
+@@ -22,6 +22,7 @@
+ #define MAX_VDMA_ENGINES                        (3)
+ #define SIZE_OF_VDMA_DESCRIPTOR                 (16)
+ #define VDMA_DEST_CHANNELS_START                (16)
++#define MAX_SG_DESCS_COUNT                      (64 * 1024u)
+ 
+ #define HAILO_VDMA_MAX_ONGOING_TRANSFERS (128)
+ #define HAILO_VDMA_MAX_ONGOING_TRANSFERS_MASK (HAILO_VDMA_MAX_ONGOING_TRANSFERS - 1)
+@@ -38,6 +39,10 @@
+ #define FW_ACCESS_APP_CPU_CONTROL_MASK      (1 << FW_ACCESS_CONTROL_INTERRUPT_SHIFT)
+ #define FW_ACCESS_DRIVER_SHUTDOWN_SHIFT     (2)
+ #define FW_ACCESS_DRIVER_SHUTDOWN_MASK      (1 << FW_ACCESS_DRIVER_SHUTDOWN_SHIFT)
++// HRT-15790 TODO: separate nnc interrupts and soc interrupts
++#define FW_ACCESS_SOFT_RESET_SHIFT          (3)
++#define FW_ACCESS_SOFT_RESET_MASK           (1 << FW_ACCESS_SOFT_RESET_SHIFT)
++
+ #define FW_ACCESS_SOC_CONTROL_SHIFT         (3)
+ #define FW_ACCESS_SOC_CONTROL_MASK          (1 << FW_ACCESS_SOC_CONTROL_SHIFT)
+ 
+@@ -184,7 +189,6 @@ enum hailo_dma_data_direction {
+ };
+ 
+ // Enum that states what type of buffer we are working with in the driver
+-// TODO: HRT-13580 - Add specific type for user allocated and for driver allocated
+ enum hailo_dma_buffer_type {
+     HAILO_DMA_USER_PTR_BUFFER = 0,
+     HAILO_DMA_DMABUF_BUFFER = 1,
+@@ -399,7 +403,7 @@ struct hailo_d2h_notification {
+ enum hailo_board_type {
+     HAILO_BOARD_TYPE_HAILO8 = 0,
+     HAILO_BOARD_TYPE_HAILO15,
+-    HAILO_BOARD_TYPE_PLUTO,
++    HAILO_BOARD_TYPE_HAILO15L,
+     HAILO_BOARD_TYPE_HAILO10H,
+     HAILO_BOARD_TYPE_HAILO10H_LEGACY,
+     HAILO_BOARD_TYPE_COUNT,
+--- a/drivers/media/pci/hailo/common/pcie_common.c
++++ b/drivers/media/pci/hailo/common/pcie_common.c
+@@ -30,6 +30,8 @@
+ 
+ #define ATR0_PCIE_BRIDGE_OFFSET (0x700)
+ 
++#define ATR_PCIE_BRIDGE_OFFSET(atr_index)    (ATR0_PCIE_BRIDGE_OFFSET + (atr_index * 0x20))
++
+ #define MAXIMUM_APP_FIRMWARE_CODE_SIZE (0x40000)
+ #define MAXIMUM_CORE_FIRMWARE_CODE_SIZE (0x20000)
+ 
+@@ -40,17 +42,21 @@
+ 
+ #define PCIE_CONFIG_VENDOR_OFFSET (0x0098)
+ 
+-#define HAILO_PCIE_HOST_DMA_DATA_ID (0)
+ #define HAILO_PCIE_DMA_DEVICE_INTERRUPTS_BITMASK    (1 << 4)
+ #define HAILO_PCIE_DMA_HOST_INTERRUPTS_BITMASK      (1 << 5)
+ #define HAILO_PCIE_DMA_SRC_CHANNELS_BITMASK         (0x0000FFFF)
+ 
+ #define HAILO_PCIE_MAX_ATR_TABLE_INDEX (3)
+ 
+-#define MAX_FILES_PER_STAGE (4)
+-
+ #define BOOT_STATUS_UNINITIALIZED (0x1)
+ 
++#define PCIE_CONTROL_SECTION_ADDRESS_H8 (0x60000000)
++#define PCIE_BLOCK_ADDRESS_ATR1    (0x200000)
++
++#define PCIE_CONFIG_PCIE_CFG_QM_ROUTING_MODE_SET(reg_offset)                            \
++			(reg_offset) = (((reg_offset) & ~0x00000004L) | ((uint32_t)(1) << 2))
++
++
+ struct hailo_fw_addresses {
+     u32 boot_fw_header;
+     u32 app_fw_code_ram_base;
+@@ -58,19 +64,14 @@ struct hailo_fw_addresses {
+     u32 boot_cont_cert;
+     u32 core_code_ram_base;
+     u32 core_fw_header;
+-    u32 atr0_trsl_addr1;
+     u32 raise_ready_offset;
+     u32 boot_status;
+-};
+-
+-struct loading_stage {
+-    const struct hailo_file_batch *batch;
+-    u32 trigger_address;
++    u32 pcie_cfg_regs;
+ };
+ 
+ struct hailo_board_compatibility {
+     struct hailo_fw_addresses fw_addresses;
+-    const struct loading_stage stages[MAX_LOADING_STAGES];
++    const struct hailo_pcie_loading_stage stages[MAX_LOADING_STAGES];
+ };
+ 
+ static const struct hailo_file_batch hailo10h_files_stg1[] = {
+@@ -134,13 +135,18 @@ static const struct hailo_file_batch hai
+         .has_core = false
+     },
+     {
+-        .filename = "hailo/hailo10h/core-image-minimal-hailo10-m2.ext4.gz",
++        .filename = "hailo/hailo10h/image-fs",
++#ifndef HAILO_EMULATOR
+         .address = 0x88000000,
++#else
++        // TODO : HRT-15692 - merge two cases
++        .address = 0x89000000,
++#endif /* ifndef HAILO_EMULATOR */
+         .max_size = 0x20000000, // Max size 512MB
+         .is_mandatory = true,
+         .has_header = false,
+         .has_core = false
+-    },
++    }
+ };
+ 
+ // If loading linux from EMMC - only need few files from second batch (u-boot-spl.bin and u-boot-tfa.itb)
+@@ -173,7 +179,7 @@ static const struct hailo_file_batch hai
+ 
+ static const struct hailo_file_batch hailo8_files_stg1[] = {
+     {
+-        .filename = "hailo/hailo8_fw.4.19.0.bin",
++        .filename = "hailo/hailo8_fw.bin",
+         .address = 0x20000,
+         .max_size = 0x50000,
+         .is_mandatory = true,
+@@ -225,9 +231,10 @@ static const struct hailo_file_batch hai
+     }
+ };
+ 
+-static const struct hailo_file_batch pluto_files_stg1[] = {
++// TODO HRT-15014 - Fix names for hailo15l legacy accelerator
++static const struct hailo_file_batch hailo15l_files_stg1[] = {
+     {
+-        .filename = "hailo/pluto_fw.bin",
++        .filename = "hailo/hailo15l_fw.bin",
+         .address = 0x20000,
+         .max_size = 0x100000,
+         .is_mandatory = true,
+@@ -253,14 +260,15 @@ static const struct hailo_board_compatib
+             .app_fw_code_ram_base = 0x60000,
+             .core_code_ram_base = 0xC0000,
+             .core_fw_header = 0xA0000,
+-            .atr0_trsl_addr1 = 0x60000000,
+             .raise_ready_offset = 0x1684,
+             .boot_status = 0xe0000,
+         },
+         .stages = {
+             {
+                 .batch = hailo8_files_stg1,
+-                .trigger_address = 0xE0980
++                .trigger_address = 0xE0980,
++                .timeout = FIRMWARE_WAIT_TIMEOUT_MS,
++                .amount_of_files_in_stage = 3
+             },
+         },
+     },
+@@ -272,14 +280,15 @@ static const struct hailo_board_compatib
+             .app_fw_code_ram_base = 0x20000,
+             .core_code_ram_base = 0x60000,
+             .core_fw_header = 0xC0000,
+-            .atr0_trsl_addr1 = 0x000BE000,
+             .raise_ready_offset = 0x1754,
+             .boot_status = 0x80000,
+         },
+         .stages = {
+             {
+                 .batch = hailo10h_legacy_files_stg1,
+-                .trigger_address = 0x88c98
++                .trigger_address = 0x88c98,
++                .timeout = FIRMWARE_WAIT_TIMEOUT_MS,
++                .amount_of_files_in_stage = 1
+             },
+         },
+     },
+@@ -291,28 +300,34 @@ static const struct hailo_board_compatib
+             .app_fw_code_ram_base = 0x20000,
+             .core_code_ram_base = 0,
+             .core_fw_header = 0,
+-            .atr0_trsl_addr1 = 0x000BE000,
+             .raise_ready_offset = 0x1754,
+             .boot_status = 0x80000,
++            .pcie_cfg_regs = 0x002009dc,
+         },
+         .stages = {
+             {
+                 .batch = hailo10h_files_stg1,
+-                .trigger_address = 0x88c98
++                .trigger_address = 0x88c98,
++                .timeout = FIRMWARE_WAIT_TIMEOUT_MS,
++                .amount_of_files_in_stage = 3
+             },
+             {
+                 .batch = hailo10h_files_stg2,
+-                .trigger_address = 0x84000000
++                .trigger_address = 0x84000000,
++                .timeout = PCI_EP_WAIT_TIMEOUT_MS,
++                .amount_of_files_in_stage = 4
+             },
+             {
+                 .batch = hailo10h_files_stg2_linux_in_emmc,
+-                .trigger_address = 0x84000000
++                .trigger_address = 0x84000000,
++                .timeout = FIRMWARE_WAIT_TIMEOUT_MS,
++                .amount_of_files_in_stage = 2
+             },
+         },
+     },
+     // HRT-11344 : none of these matter except raise_ready_offset seeing as we load fw seperately - not through driver
+     // After implementing bootloader put correct values here
+-    [HAILO_BOARD_TYPE_PLUTO] = {
++    [HAILO_BOARD_TYPE_HAILO15L] = {
+         .fw_addresses = {
+             .boot_fw_header = 0x88000,
+             .boot_key_cert = 0x88018,
+@@ -320,44 +335,54 @@ static const struct hailo_board_compatib
+             .app_fw_code_ram_base = 0x20000,
+             .core_code_ram_base = 0x60000,
+             .core_fw_header = 0xC0000,
+-            .atr0_trsl_addr1 = 0x000BE000,
+             // NOTE: After they update hw consts - check register fw_access_interrupt_w1s of pcie_config
+             .raise_ready_offset = 0x174c,
+             .boot_status = 0x80000,
+         },
+         .stages = {
+             {
+-                .batch = pluto_files_stg1,
+-                .trigger_address = 0x88c98
++                .batch = hailo15l_files_stg1,
++                .trigger_address = 0x88c98,
++                .timeout = FIRMWARE_WAIT_TIMEOUT_MS,
++                .amount_of_files_in_stage = 1
+             },
+         },
+     }
+ };
+ 
++const struct hailo_pcie_loading_stage *hailo_pcie_get_loading_stage_info(enum hailo_board_type board_type,
++    enum loading_stages stage)
++{
++    return &compat[board_type].stages[stage];
++}
++
++static u32 read_and_clear_reg(struct hailo_resource *resource, u32 offset)
++{
++    u32 value = hailo_resource_read32(resource, offset);
++    if (value != 0) {
++        hailo_resource_write32(resource, offset, value);
++    }
++    return value;
++}
+ 
+ bool hailo_pcie_read_interrupt(struct hailo_pcie_resources *resources, struct hailo_pcie_interrupt_source *source)
+ {
+-    u32 channel_data_source = 0;
+-    u32 channel_data_dest = 0;
++    u32 istatus_host = 0;
+     memset(source, 0, sizeof(*source));
+ 
+-    source->interrupt_bitmask = hailo_resource_read32(&resources->config, BCS_ISTATUS_HOST);
+-    if (0 == source->interrupt_bitmask) {
++    istatus_host = read_and_clear_reg(&resources->config, BCS_ISTATUS_HOST);
++    if (0 == istatus_host) {
+         return false;
+     }
+ 
+-    // clear signal
+-    hailo_resource_write32(&resources->config, BCS_ISTATUS_HOST, source->interrupt_bitmask);
++    source->sw_interrupts = (istatus_host >> BCS_ISTATUS_HOST_SW_IRQ_SHIFT);
+ 
+-    if (source->interrupt_bitmask & BCS_ISTATUS_HOST_VDMA_SRC_IRQ_MASK) {
+-        channel_data_source = hailo_resource_read32(&resources->config, BCS_SOURCE_INTERRUPT_PER_CHANNEL);
+-        hailo_resource_write32(&resources->config, BCS_SOURCE_INTERRUPT_PER_CHANNEL, channel_data_source);
+-    }
+-    if (source->interrupt_bitmask & BCS_ISTATUS_HOST_VDMA_DEST_IRQ_MASK) {
+-        channel_data_dest = hailo_resource_read32(&resources->config, BCS_DESTINATION_INTERRUPT_PER_CHANNEL);
+-        hailo_resource_write32(&resources->config, BCS_DESTINATION_INTERRUPT_PER_CHANNEL, channel_data_dest);
++    if (istatus_host & BCS_ISTATUS_HOST_VDMA_SRC_IRQ_MASK) {
++        source->vdma_channels_bitmap |= read_and_clear_reg(&resources->config, BCS_SOURCE_INTERRUPT_PER_CHANNEL);
++    }
++    if (istatus_host & BCS_ISTATUS_HOST_VDMA_DEST_IRQ_MASK) {
++        source->vdma_channels_bitmap |= read_and_clear_reg(&resources->config, BCS_DESTINATION_INTERRUPT_PER_CHANNEL);
+     }
+-    source->vdma_channels_bitmap = channel_data_source | channel_data_dest;
+ 
+     return true;
+ }
+@@ -419,6 +444,15 @@ void hailo_pcie_write_firmware_driver_sh
+     hailo_resource_write32(&resources->fw_access, fw_addresses->raise_ready_offset, fw_access_value);
+ }
+ 
++void hailo_pcie_write_firmware_soft_reset(struct hailo_pcie_resources *resources)
++{
++    const struct hailo_fw_addresses *fw_addresses = &(compat[resources->board_type].fw_addresses);
++    const u32 fw_access_value = FW_ACCESS_SOFT_RESET_MASK;
++
++    // Write shutdown flag to FW
++    hailo_resource_write32(&resources->fw_access, fw_addresses->raise_ready_offset, fw_access_value);
++}
++
+ int hailo_pcie_configure_atr_table(struct hailo_resource *bridge_config, u64 trsl_addr, u32 atr_index)
+ {
+     size_t offset = 0;
+@@ -431,7 +465,7 @@ int hailo_pcie_configure_atr_table(struc
+     };
+ 
+     BUG_ON(HAILO_PCIE_MAX_ATR_TABLE_INDEX < atr_index);
+-    offset = ATR0_PCIE_BRIDGE_OFFSET + (atr_index * 0x20);
++    offset = ATR_PCIE_BRIDGE_OFFSET(atr_index);
+ 
+     return hailo_resource_write_buffer(bridge_config, offset, sizeof(atr), (void*)&atr);
+ }
+@@ -441,7 +475,7 @@ void hailo_pcie_read_atr_table(struct ha
+     size_t offset = 0;
+ 
+     BUG_ON(HAILO_PCIE_MAX_ATR_TABLE_INDEX < atr_index);
+-    offset = ATR0_PCIE_BRIDGE_OFFSET + (atr_index * 0x20);
++    offset = ATR_PCIE_BRIDGE_OFFSET(atr_index);
+     
+     hailo_resource_read_buffer(bridge_config, offset, sizeof(*atr), (void*)atr);
+ }
+@@ -510,7 +544,7 @@ static void read_memory(struct hailo_pci
+     hailo_pcie_read_atr_table(&resources->config, &previous_atr, ATR_INDEX);
+ 
+     if (base_address != src) {
+-        // Data is not aligned, write the first chunk
++        // Data is not aligned, read the first chunk
+         chunk_len = min((u32)(base_address + ATR_TABLE_SIZE - src), len);
+         read_memory_chunk(resources, base_address, (u32)(src - base_address), dest, chunk_len);
+         offset += chunk_len;
+@@ -526,6 +560,18 @@ static void read_memory(struct hailo_pci
+         (((u64)(previous_atr.atr_trsl_addr_2) << 32) | previous_atr.atr_trsl_addr_1), ATR_INDEX);
+ }
+ 
++// Note: This function use for enabling the vDMA transaction host<->device by read modify write of the EP registers in the SOC - for fast boot over vDMA.
++void hailo_pcie_configure_ep_registers_for_dma_transaction(struct hailo_pcie_resources *resources)
++{
++    u32 reg_routing_mercury = 0;
++    
++    BUG_ON(compat[resources->board_type].fw_addresses.pcie_cfg_regs == 0);
++    
++    read_memory(resources, compat[resources->board_type].fw_addresses.pcie_cfg_regs, &reg_routing_mercury, sizeof(reg_routing_mercury));
++    PCIE_CONFIG_PCIE_CFG_QM_ROUTING_MODE_SET(reg_routing_mercury);
++    write_memory(resources, compat[resources->board_type].fw_addresses.pcie_cfg_regs, &reg_routing_mercury, sizeof(reg_routing_mercury));
++}
++
+ static void hailo_write_app_firmware(struct hailo_pcie_resources *resources, firmware_header_t *fw_header,
+     secure_boot_certificate_header_t *fw_cert)
+ {
+@@ -551,11 +597,11 @@ static void hailo_write_core_firmware(st
+     write_memory(resources, fw_addresses->core_fw_header, fw_header, sizeof(firmware_header_t));
+ }
+ 
+-void hailo_trigger_firmware_boot(struct hailo_pcie_resources *resources, u32 address)
++void hailo_trigger_firmware_boot(struct hailo_pcie_resources *resources, u32 stage)
+ {
+     u32 pcie_finished = 1;
+ 
+-    write_memory(resources, address, (void*)&pcie_finished, sizeof(pcie_finished));
++    write_memory(resources, compat[resources->board_type].stages[stage].trigger_address, (void*)&pcie_finished, sizeof(pcie_finished));
+ }
+ 
+ u32 hailo_get_boot_status(struct hailo_pcie_resources *resources)
+@@ -673,16 +719,14 @@ static int write_single_file(struct hail
+ 
+ int hailo_pcie_write_firmware_batch(struct device *dev, struct hailo_pcie_resources *resources, u32 stage)
+ {
+-    const struct hailo_file_batch *files_batch = compat[resources->board_type].stages[stage].batch;
++    const struct hailo_pcie_loading_stage *stage_info = hailo_pcie_get_loading_stage_info(resources->board_type, stage);
++    const struct hailo_file_batch *files_batch = stage_info->batch;
++    const u8 amount_of_files = stage_info->amount_of_files_in_stage;  
+     int file_index = 0;
+     int err = 0;
+ 
+-    for (file_index = 0; file_index < MAX_FILES_PER_STAGE; file_index++)
++    for (file_index = 0; file_index < amount_of_files; file_index++)
+     {
+-        if (NULL == files_batch[file_index].filename) {
+-            break;
+-        }
+-
+         dev_notice(dev, "Writing file %s\n", files_batch[file_index].filename);
+ 
+         err = write_single_file(resources, &files_batch[file_index], dev);
+@@ -696,31 +740,29 @@ int hailo_pcie_write_firmware_batch(stru
+         dev_notice(dev, "File %s written successfully\n", files_batch[file_index].filename);
+     }
+ 
+-    hailo_trigger_firmware_boot(resources, compat[resources->board_type].stages[stage].trigger_address);
++    hailo_trigger_firmware_boot(resources, stage);
+ 
+     return 0;
+ }
+ 
+-// TODO: HRT-14147 - remove this function
+-static bool hailo_pcie_is_device_ready_for_boot(struct hailo_pcie_resources *resources)
+-{
+-    return hailo_get_boot_status(resources) == BOOT_STATUS_UNINITIALIZED;
+-}
+-
+ bool hailo_pcie_is_firmware_loaded(struct hailo_pcie_resources *resources)
+ {
+     u32 offset;
+     u32 atr_value;
+ 
+-    // TODO: HRT-14147
+-    if (HAILO_BOARD_TYPE_HAILO10H == resources->board_type) {
+-        return !hailo_pcie_is_device_ready_for_boot(resources);
++    if (HAILO_BOARD_TYPE_HAILO8 == resources->board_type) {
++        offset = ATR_PCIE_BRIDGE_OFFSET(0) + offsetof(struct hailo_atr_config, atr_trsl_addr_1);
++        atr_value = hailo_resource_read32(&resources->config, offset);
++
++        return (PCIE_CONTROL_SECTION_ADDRESS_H8 == atr_value);
+     }
++    else {
++        offset = ATR_PCIE_BRIDGE_OFFSET(1) + offsetof(struct hailo_atr_config, atr_trsl_addr_1);
++        atr_value = hailo_resource_read32(&resources->config, offset);
+ 
+-    offset = ATR0_PCIE_BRIDGE_OFFSET + offsetof(struct hailo_atr_config, atr_trsl_addr_1);
+-    atr_value = hailo_resource_read32(&resources->config, offset);
++        return (PCIE_BLOCK_ADDRESS_ATR1 == atr_value);
++    }
+ 
+-    return atr_value == compat[resources->board_type].fw_addresses.atr0_trsl_addr1;
+ }
+ 
+ bool hailo_pcie_wait_for_firmware(struct hailo_pcie_resources *resources)
+@@ -764,8 +806,7 @@ void hailo_pcie_enable_interrupts(struct
+     hailo_resource_write32(&resources->config, BCS_DESTINATION_INTERRUPT_PER_CHANNEL, 0xFFFFFFFF);
+     hailo_resource_write32(&resources->config, BCS_SOURCE_INTERRUPT_PER_CHANNEL, 0xFFFFFFFF);
+ 
+-    mask |= (BCS_ISTATUS_HOST_FW_IRQ_CONTROL_MASK | BCS_ISTATUS_HOST_FW_IRQ_NOTIFICATION |
+-        BCS_ISTATUS_HOST_DRIVER_DOWN | BCS_ISTATUS_SOC_CONNECT_ACCEPTED | BCS_ISTATUS_SOC_CLOSED_IRQ);
++    mask |= BCS_ISTATUS_HOST_SW_IRQ_MASK;
+     hailo_resource_write32(&resources->config, BSC_IMASK_HOST, mask);
+ }
+ 
+@@ -822,7 +863,7 @@ int hailo_set_device_type(struct hailo_p
+     switch(resources->board_type) {
+     case HAILO_BOARD_TYPE_HAILO8:
+     case HAILO_BOARD_TYPE_HAILO10H_LEGACY:
+-    case HAILO_BOARD_TYPE_PLUTO:
++    case HAILO_BOARD_TYPE_HAILO15L:
+         resources->accelerator_type = HAILO_ACCELERATOR_TYPE_NNC;
+         break;
+     case HAILO_BOARD_TYPE_HAILO10H:
+--- a/drivers/media/pci/hailo/common/pcie_common.h
++++ b/drivers/media/pci/hailo/common/pcie_common.h
+@@ -18,11 +18,8 @@
+ #include <linux/firmware.h>
+ 
+ 
+-#define BCS_ISTATUS_HOST_FW_IRQ_CONTROL_MASK (0x04000000)
+-#define BCS_ISTATUS_HOST_FW_IRQ_NOTIFICATION (0x02000000)
+-#define BCS_ISTATUS_HOST_DRIVER_DOWN         (0x08000000)
+-#define BCS_ISTATUS_SOC_CONNECT_ACCEPTED     (0x10000000)
+-#define BCS_ISTATUS_SOC_CLOSED_IRQ           (0x20000000)
++#define BCS_ISTATUS_HOST_SW_IRQ_MASK         (0xFF000000)
++#define BCS_ISTATUS_HOST_SW_IRQ_SHIFT        (24)
+ #define BCS_ISTATUS_HOST_VDMA_SRC_IRQ_MASK   (0x000000FF)
+ #define BCS_ISTATUS_HOST_VDMA_DEST_IRQ_MASK  (0x0000FF00)
+ 
+@@ -36,13 +33,19 @@
+ #define HAILO_PCIE_FW_ACCESS_BAR    (4)
+ 
+ #define HAILO_PCIE_DMA_ENGINES_COUNT (1)
++#define PCI_VDMA_ENGINE_INDEX        (0)
++
++#define MAX_FILES_PER_STAGE (4)
++
++#define HAILO_PCIE_HOST_DMA_DATA_ID    (0)
++#define HAILO_PCI_EP_HOST_DMA_DATA_ID  (6)
+ 
+ #define DRIVER_NAME		"hailo"
+ 
+ #define PCI_VENDOR_ID_HAILO           0x1e60
+ #define PCI_DEVICE_ID_HAILO_HAILO8    0x2864
+-#define PCI_DEVICE_ID_HAILO_HAILO15   0x45C4
+-#define PCI_DEVICE_ID_HAILO_PLUTO     0x43a2
++#define PCI_DEVICE_ID_HAILO_HAILO10H  0x45C4
++#define PCI_DEVICE_ID_HAILO_HAILO15L  0x43a2
+ 
+ typedef u64 hailo_ptr_t;
+ 
+@@ -69,18 +72,24 @@ enum loading_stages {
+     MAX_LOADING_STAGES = 3
+ };
+ 
+-enum hailo_pcie_interrupt_masks {
+-    FW_CONTROL = BCS_ISTATUS_HOST_FW_IRQ_CONTROL_MASK,
+-    FW_NOTIFICATION = BCS_ISTATUS_HOST_FW_IRQ_NOTIFICATION,
+-    DRIVER_DOWN = BCS_ISTATUS_HOST_DRIVER_DOWN,
+-    SOC_CONNECT_ACCEPTED = BCS_ISTATUS_SOC_CONNECT_ACCEPTED,
+-    SOC_CLOSED_IRQ = BCS_ISTATUS_SOC_CLOSED_IRQ,
+-    VDMA_SRC_IRQ_MASK = BCS_ISTATUS_HOST_VDMA_SRC_IRQ_MASK,
+-    VDMA_DEST_IRQ_MASK = BCS_ISTATUS_HOST_VDMA_DEST_IRQ_MASK
++enum hailo_pcie_nnc_sw_interrupt_masks {
++    HAILO_PCIE_NNC_FW_NOTIFICATION_IRQ  = 0x2,
++    HAILO_PCIE_NNC_FW_CONTROL_IRQ       = 0x4,
++    HAILO_PCIE_NNC_DRIVER_DOWN_IRQ      = 0x8,
++};
++
++enum hailo_pcie_soc_sw_interrupt_masks {
++    HAILO_PCIE_SOC_CONTROL_IRQ          = 0x10,
++    HAILO_PCIE_SOC_CLOSE_IRQ            = 0x20,
++};
++
++enum hailo_pcie_boot_interrupt_masks {
++    HAILO_PCIE_BOOT_SOFT_RESET_IRQ      = 0x1,
++    HAILO_PCIE_BOOT_IRQ                 = 0x2,
+ };
+ 
+ struct hailo_pcie_interrupt_source {
+-    u32 interrupt_bitmask;
++    u32 sw_interrupts;
+     u32 vdma_channels_bitmap;
+ };
+ 
+@@ -93,6 +102,13 @@ struct hailo_file_batch {
+     bool has_core;
+ };
+ 
++struct hailo_pcie_loading_stage {
++    const struct hailo_file_batch *batch;
++    u32 trigger_address;
++    u32 timeout;
++    u8 amount_of_files_in_stage;
++};
++
+ // TODO: HRT-6144 - Align Windows/Linux to QNX
+ #ifdef __QNX__
+ enum hailo_bar_index {
+@@ -117,8 +133,23 @@ enum hailo_bar_index {
+ extern "C" {
+ #endif
+ 
++
++#ifndef HAILO_EMULATOR
++#define TIME_UNTIL_REACH_BOOTLOADER (10)
++#define PCI_EP_WAIT_TIMEOUT_MS   (40000)
++#define FIRMWARE_WAIT_TIMEOUT_MS (5000)
++#else /* ifndef HAILO_EMULATOR */
++// PCI EP timeout is defined to 50000000 because on Emulator the boot time + linux init time can be very long (4+ hours)
++#define TIME_UNTIL_REACH_BOOTLOADER (10000)
++#define PCI_EP_WAIT_TIMEOUT_MS   (50000000)
++#define FIRMWARE_WAIT_TIMEOUT_MS (5000000)
++#endif /* ifndef HAILO_EMULATOR */
++
+ extern struct hailo_vdma_hw hailo_pcie_vdma_hw;
+ 
++const struct hailo_pcie_loading_stage* hailo_pcie_get_loading_stage_info(enum hailo_board_type board_type,
++    enum loading_stages stage);
++
+ // Reads the interrupt source from BARs, return false if there is no interrupt.
+ // note - this function clears the interrupt signals.
+ bool hailo_pcie_read_interrupt(struct hailo_pcie_resources *resources, struct hailo_pcie_interrupt_source *source);
+@@ -137,7 +168,9 @@ int hailo_pcie_memory_transfer(struct ha
+ 
+ bool hailo_pcie_is_device_connected(struct hailo_pcie_resources *resources);
+ void hailo_pcie_write_firmware_driver_shutdown(struct hailo_pcie_resources *resources);
+-void hailo_trigger_firmware_boot(struct hailo_pcie_resources *resources, u32 address);
++void hailo_pcie_write_firmware_soft_reset(struct hailo_pcie_resources *resources);
++void hailo_pcie_configure_ep_registers_for_dma_transaction(struct hailo_pcie_resources *resources);
++void hailo_trigger_firmware_boot(struct hailo_pcie_resources *resources, u32 stage);
+ 
+ int hailo_set_device_type(struct hailo_pcie_resources *resources);
+ 
+@@ -157,4 +190,4 @@ void hailo_pcie_soc_read_response(struct
+ }
+ #endif
+ 
+-#endif /* _HAILO_COMMON_PCIE_COMMON_H_ */
+\ No newline at end of file
++#endif /* _HAILO_COMMON_PCIE_COMMON_H_ */
+--- a/drivers/media/pci/hailo/common/vdma_common.c
++++ b/drivers/media/pci/hailo/common/vdma_common.c
+@@ -15,16 +15,6 @@
+ #include <linux/kconfig.h>
+ #include <linux/printk.h>
+ 
+-
+-#define CHANNEL_BASE_OFFSET(channel_index) ((channel_index) << 5)
+-
+-#define CHANNEL_CONTROL_OFFSET      (0x0)
+-#define CHANNEL_DEPTH_ID_OFFSET     (0x1)
+-#define CHANNEL_NUM_AVAIL_OFFSET    (0x2)
+-#define CHANNEL_NUM_PROC_OFFSET     (0x4)
+-#define CHANNEL_ERROR_OFFSET        (0x8)
+-#define CHANNEL_DEST_REGS_OFFSET    (0x10)
+-
+ #define VDMA_CHANNEL_CONTROL_START (0x1)
+ #define VDMA_CHANNEL_CONTROL_ABORT (0b00)
+ #define VDMA_CHANNEL_CONTROL_ABORT_PAUSE (0b10)
+@@ -160,17 +150,17 @@ static u8 get_channel_id(u8 channel_inde
+     return (channel_index < MAX_VDMA_CHANNELS_PER_ENGINE) ? (channel_index & 0xF) : INVALID_VDMA_CHANNEL;
+ }
+ 
+-static int program_descriptors_in_chunk(
++int hailo_vdma_program_descriptors_in_chunk(
+     struct hailo_vdma_hw *vdma_hw,
+     dma_addr_t chunk_addr,
+     unsigned int chunk_size,
+     struct hailo_vdma_descriptors_list *desc_list,
+     u32 desc_index,
+     u32 max_desc_index,
+-    u8 channel_id)
++    u8 channel_index,
++    u8 data_id)
+ {
+     const u16 page_size = desc_list->desc_page_size;
+-    const u8 ddr_data_id = vdma_hw->ddr_data_id;
+     const u32 descs_to_program = DIV_ROUND_UP(chunk_size, page_size);
+     const u32 starting_desc_index = desc_index;
+     const u32 residue_size = chunk_size % page_size;
+@@ -187,7 +177,7 @@ static int program_descriptors_in_chunk(
+         return -ERANGE;
+     }
+ 
+-    encoded_addr = vdma_hw->hw_ops.encode_desc_dma_address_range(chunk_addr, chunk_addr + chunk_size, page_size, channel_id);
++    encoded_addr = vdma_hw->hw_ops.encode_desc_dma_address_range(chunk_addr, chunk_addr + chunk_size, page_size, get_channel_id(channel_index));
+     if (INVALID_VDMA_ADDRESS == encoded_addr) {
+         return -EFAULT;
+     }
+@@ -197,7 +187,7 @@ static int program_descriptors_in_chunk(
+         // 'desc_index & desc_list_len_mask' is used instead of modulo; see hailo_vdma_descriptors_list documentation.
+         hailo_vdma_program_descriptor(
+             &desc_list->desc_list[desc_index & desc_list->desc_count_mask],
+-            encoded_addr, page_size, ddr_data_id);
++            encoded_addr, page_size, data_id);
+         encoded_addr += page_size;
+     }
+ 
+@@ -205,7 +195,7 @@ static int program_descriptors_in_chunk(
+     // 'desc_index & desc_list_len_mask' is used instead of modulo; see hailo_vdma_descriptors_list documentation.
+     dma_desc = &desc_list->desc_list[desc_index & desc_list->desc_count_mask];
+     hailo_vdma_program_descriptor(dma_desc, encoded_addr,
+-        (residue_size == 0) ? page_size : (u16)residue_size, ddr_data_id);
++        (residue_size == 0) ? page_size : (u16)residue_size, data_id);
+ 
+     return (int)descs_to_program;
+ }
+@@ -241,7 +231,6 @@ static int bind_and_program_descriptors_
+     enum hailo_vdma_interrupts_domain last_desc_interrupts,
+     bool is_debug)
+ {
+-    const u8 channel_id = get_channel_id(channel_index);
+     int desc_programmed = 0;
+     int descs_programmed_in_chunk = 0;
+     u32 max_desc_index = 0;
+@@ -279,8 +268,8 @@ static int bind_and_program_descriptors_
+             (u32)(sg_dma_len(sg_entry));
+         chunk_size = min((u32)program_size, chunk_size);
+ 
+-        descs_programmed_in_chunk  = program_descriptors_in_chunk(vdma_hw, chunk_start_addr, chunk_size, desc_list,
+-            starting_desc, max_desc_index, channel_id);
++        descs_programmed_in_chunk  = hailo_vdma_program_descriptors_in_chunk(vdma_hw, chunk_start_addr, chunk_size, desc_list,
++            starting_desc, max_desc_index, channel_index, vdma_hw->ddr_data_id);
+         if (descs_programmed_in_chunk < 0) {
+             return descs_programmed_in_chunk;
+         }
+@@ -363,16 +352,16 @@ static int validate_channel_state(struct
+     return 0;
+ }
+ 
+-static void set_num_avail(u8 __iomem *host_regs, u16 num_avail)
++void hailo_vdma_set_num_avail(u8 __iomem *regs, u16 num_avail)
+ {
+-    u32 host_regs_val = ioread32(host_regs);
+-    iowrite32(WRITE_BITS_AT_OFFSET(WORD_SIZE * BITS_IN_BYTE, CHANNEL_NUM_AVAIL_OFFSET * BITS_IN_BYTE, host_regs_val, num_avail),
+-        host_regs);
++    u32 regs_val = ioread32(regs);
++    iowrite32(WRITE_BITS_AT_OFFSET(WORD_SIZE * BITS_IN_BYTE, CHANNEL_NUM_AVAIL_OFFSET * BITS_IN_BYTE, regs_val, num_avail),
++        regs);
+ }
+ 
+-static u16 get_num_proc(u8 __iomem *host_regs)
++u16 hailo_vdma_get_num_proc(u8 __iomem *regs)
+ {
+-    return READ_BITS_AT_OFFSET(WORD_SIZE * BITS_IN_BYTE, 0, ioread32(host_regs + CHANNEL_NUM_PROC_OFFSET));
++    return READ_BITS_AT_OFFSET(WORD_SIZE * BITS_IN_BYTE, 0, ioread32(regs + CHANNEL_NUM_PROC_OFFSET));
+ }
+ 
+ int hailo_vdma_launch_transfer(
+@@ -455,7 +444,7 @@ int hailo_vdma_launch_transfer(
+ 
+     new_num_avail = (u16)((last_desc + 1) % desc_list->desc_count);
+     channel->state.num_avail = new_num_avail;
+-    set_num_avail(channel->host_regs, new_num_avail);
++    hailo_vdma_set_num_avail(channel->host_regs, new_num_avail);
+ 
+     return (int)total_descs;
+ }
+@@ -463,7 +452,7 @@ int hailo_vdma_launch_transfer(
+ static void hailo_vdma_push_timestamp(struct hailo_vdma_channel *channel)
+ {
+     struct hailo_channel_interrupt_timestamp_list *timestamp_list = &channel->timestamp_list;
+-    const u16 num_proc = get_num_proc(channel->host_regs);
++    const u16 num_proc = hailo_vdma_get_num_proc(channel->host_regs);
+     if (TIMESTAMPS_CIRC_SPACE(*timestamp_list) != 0) {
+         timestamp_list->timestamps[timestamp_list->head].timestamp_ns = ktime_get_ns();
+         timestamp_list->timestamps[timestamp_list->head].desc_num_processed = num_proc;
+@@ -725,7 +714,7 @@ int hailo_vdma_engine_fill_irq_data(stru
+         // the actual hw_num_processed is a number between 1 and desc_count.
+         // Therefore the value can be desc_count, in this case we change it to
+         // zero.
+-        hw_num_proc = get_num_proc(channel->host_regs) & channel->state.desc_count_mask;
++        hw_num_proc = hailo_vdma_get_num_proc(channel->host_regs) & channel->state.desc_count_mask;
+ 
+         while (ONGOING_TRANSFERS_CIRC_CNT(channel->ongoing_transfers) > 0) {
+             struct hailo_ongoing_transfer *cur_transfer =
+@@ -780,12 +769,13 @@ static void hailo_vdma_channel_abort(u8
+         VDMA_CHANNEL_CONTROL_ABORT), host_regs);
+ }
+ 
+-int hailo_vdma_start_channel(u8 __iomem *host_regs, uint64_t desc_dma_address, uint8_t desc_depth,
++int hailo_vdma_start_channel(u8 __iomem *regs, uint64_t desc_dma_address, uint32_t desc_count,
+     uint8_t data_id)
+ {
+     u16 dma_address_l = 0;
+     u32 dma_address_h = 0;
+     u32 desc_depth_data_id = 0;
++    u8 desc_depth = ceil_log2(desc_count);
+ 
+     if (((desc_dma_address & 0xFFFF) != 0) || 
+          (desc_depth > DESCRIPTOR_LIST_MAX_DEPTH)) {
+@@ -798,22 +788,22 @@ int hailo_vdma_start_channel(u8 __iomem
+     }
+ 
+     // Stop old channel state
+-    hailo_vdma_stop_channel(host_regs);
++    hailo_vdma_stop_channel(regs);
+ 
+     // Configure address, depth and id
+     dma_address_l = (uint16_t)((desc_dma_address >> 16) & 0xFFFF);
+     iowrite32(WRITE_BITS_AT_OFFSET(WORD_SIZE * BITS_IN_BYTE, (VDMA_CHANNEL__ADDRESS_L_OFFSET -
+-        VDMA_CHANNEL__ALIGNED_ADDRESS_L_OFFSET) * BITS_IN_BYTE, ioread32(host_regs +
+-        VDMA_CHANNEL__ALIGNED_ADDRESS_L_OFFSET), dma_address_l), host_regs + VDMA_CHANNEL__ALIGNED_ADDRESS_L_OFFSET);
++        VDMA_CHANNEL__ALIGNED_ADDRESS_L_OFFSET) * BITS_IN_BYTE, ioread32(regs +
++        VDMA_CHANNEL__ALIGNED_ADDRESS_L_OFFSET), dma_address_l), regs + VDMA_CHANNEL__ALIGNED_ADDRESS_L_OFFSET);
+ 
+     dma_address_h = (uint32_t)(desc_dma_address >> 32);
+-    iowrite32(dma_address_h, host_regs + VDMA_CHANNEL__ADDRESS_H_OFFSET);
++    iowrite32(dma_address_h, regs + VDMA_CHANNEL__ADDRESS_H_OFFSET);
+ 
+     desc_depth_data_id = (uint32_t)(desc_depth << VDMA_CHANNEL_DESC_DEPTH_SHIFT) | 
+         (data_id << VDMA_CHANNEL_DATA_ID_SHIFT);
+-    iowrite32(desc_depth_data_id, host_regs);
++    iowrite32(desc_depth_data_id, regs);
+ 
+-    start_vdma_control_register(host_regs);
++    start_vdma_control_register(regs);
+ 
+     return 0;
+ }
+@@ -853,10 +843,10 @@ static int hailo_vdma_wait_until_channel
+     return -ETIMEDOUT;
+ }
+ 
+-void hailo_vdma_stop_channel(u8 __iomem *host_regs)
++void hailo_vdma_stop_channel(u8 __iomem *regs)
+ {
+     int err = 0;
+-    u8 host_side_channel_regs = READ_BITS_AT_OFFSET(BYTE_SIZE * BITS_IN_BYTE, CHANNEL_CONTROL_OFFSET * BITS_IN_BYTE, ioread32(host_regs));
++    u8 host_side_channel_regs = READ_BITS_AT_OFFSET(BYTE_SIZE * BITS_IN_BYTE, CHANNEL_CONTROL_OFFSET * BITS_IN_BYTE, ioread32(regs));
+ 
+     if ((host_side_channel_regs & VDMA_CHANNEL_CONTROL_START_ABORT_PAUSE_RESUME_BITMASK) == VDMA_CHANNEL_CONTROL_ABORT_PAUSE) {
+         // The channel is aborted (we set the channel to VDMA_CHANNEL_CONTROL_ABORT_PAUSE at the end of this function)
+@@ -866,17 +856,17 @@ void hailo_vdma_stop_channel(u8 __iomem
+     // Pause the channel
+     // The channel is paused to allow for "all transfers from fetched descriptors..." to be "...completed"
+     // (from PLDA PCIe refernce manual, "9.2.5 Starting a Channel and Transferring Data")
+-    hailo_vdma_channel_pause(host_regs);
++    hailo_vdma_channel_pause(regs);
+ 
+     // Even if channel is stuck and not idle, force abort and return error in the end
+-    err = hailo_vdma_wait_until_channel_idle(host_regs);
++    err = hailo_vdma_wait_until_channel_idle(regs);
+     // Success oriented - if error occured print error but still abort channel
+     if (err < 0) {
+         pr_err("Timeout occured while waiting for channel to become idle\n");
+     }
+ 
+     // Abort the channel (even of hailo_vdma_wait_until_channel_idle function fails)
+-    hailo_vdma_channel_abort(host_regs);
++    hailo_vdma_channel_abort(regs);
+ }
+ 
+ bool hailo_check_channel_index(u8 channel_index, u32 src_channels_bitmask, bool is_input_channel)
+--- a/drivers/media/pci/hailo/common/vdma_common.h
++++ b/drivers/media/pci/hailo/common/vdma_common.h
+@@ -16,6 +16,15 @@
+ #define VDMA_DESCRIPTOR_LIST_ALIGN  (1 << 16)
+ #define INVALID_VDMA_ADDRESS        (0)
+ 
++#define CHANNEL_BASE_OFFSET(channel_index) ((channel_index) << 5)
++
++#define CHANNEL_CONTROL_OFFSET      (0x0)
++#define CHANNEL_DEPTH_ID_OFFSET     (0x1)
++#define CHANNEL_NUM_AVAIL_OFFSET    (0x2)
++#define CHANNEL_NUM_PROC_OFFSET     (0x4)
++#define CHANNEL_ERROR_OFFSET        (0x8)
++#define CHANNEL_DEST_REGS_OFFSET    (0x10)
++
+ #ifdef __cplusplus
+ extern "C"
+ {
+@@ -172,6 +181,20 @@ int hailo_vdma_program_descriptors_list(
+     enum hailo_vdma_interrupts_domain last_desc_interrupts,
+     bool is_debug);
+ 
++int hailo_vdma_program_descriptors_in_chunk(
++    struct hailo_vdma_hw *vdma_hw,
++    dma_addr_t chunk_addr,
++    unsigned int chunk_size,
++    struct hailo_vdma_descriptors_list *desc_list,
++    u32 desc_index,
++    u32 max_desc_index,
++    u8 channel_index,
++    u8 data_id);
++
++void hailo_vdma_set_num_avail(u8 __iomem *regs, u16 num_avail);
++
++u16 hailo_vdma_get_num_proc(u8 __iomem *regs);
++
+ /**
+  * Launch a transfer on some vdma channel. Includes:
+  *      1. Binding the transfer buffers to the descriptors list.
+@@ -249,9 +272,9 @@ int hailo_vdma_engine_fill_irq_data(stru
+     struct hailo_vdma_engine *engine, u32 irq_channels_bitmap,
+     transfer_done_cb_t transfer_done, void *transfer_done_opaque);
+ 
+-int hailo_vdma_start_channel(u8 __iomem *host_regs, uint64_t desc_dma_address, uint8_t desc_depth, uint8_t data_id);
++int hailo_vdma_start_channel(u8 __iomem *regs, uint64_t desc_dma_address, uint32_t desc_count, uint8_t data_id);
+ 
+-void hailo_vdma_stop_channel(u8 __iomem *host_regs);
++void hailo_vdma_stop_channel(u8 __iomem *regs);
+ 
+ bool hailo_check_channel_index(u8 channel_index, u32 src_channels_bitmask, bool is_input_channel);
+ 
+--- a/drivers/media/pci/hailo/src/fops.c
++++ b/drivers/media/pci/hailo/src/fops.c
+@@ -294,6 +294,54 @@ static void firmware_notification_irq_ha
+     }
+ }
+ 
++static void boot_irq_handler(struct hailo_pcie_board *board, struct hailo_pcie_interrupt_source *irq_source)
++{
++    if (irq_source->sw_interrupts & HAILO_PCIE_BOOT_SOFT_RESET_IRQ) {
++        hailo_dbg(board, "soft reset trigger IRQ\n");
++        complete(&board->soft_reset.reset_completed);
++    }
++    if (irq_source->sw_interrupts & HAILO_PCIE_BOOT_IRQ) {
++        hailo_dbg(board, "boot trigger IRQ\n");
++        complete_all(&board->fw_boot.fw_loaded_completion);
++    } else {
++        board->fw_boot.boot_used_channel_bitmap &= ~irq_source->vdma_channels_bitmap;
++        hailo_dbg(board, "boot vDMA data IRQ - channel_bitmap = 0x%x\n", irq_source->vdma_channels_bitmap);
++        if (0 == board->fw_boot.boot_used_channel_bitmap) {
++            complete_all(&board->fw_boot.vdma_boot_completion);
++            hailo_dbg(board, "boot vDMA data trigger IRQ\n");
++        }
++    }
++}
++
++static void nnc_irq_handler(struct hailo_pcie_board *board, struct hailo_pcie_interrupt_source *irq_source)
++{
++    if (irq_source->sw_interrupts & HAILO_PCIE_NNC_FW_CONTROL_IRQ) {
++        complete(&board->nnc.fw_control.completion);
++    }
++
++    if (irq_source->sw_interrupts & HAILO_PCIE_NNC_DRIVER_DOWN_IRQ) {
++        complete(&board->driver_down.reset_completed);
++    }
++
++    if (irq_source->sw_interrupts & HAILO_PCIE_NNC_FW_NOTIFICATION_IRQ) {
++        firmware_notification_irq_handler(board);
++    }
++}
++
++static void soc_irq_handler(struct hailo_pcie_board *board, struct hailo_pcie_interrupt_source *irq_source)
++{
++    if (irq_source->sw_interrupts & HAILO_PCIE_SOC_CONTROL_IRQ) {
++        complete_all(&board->soc.control_resp_ready);
++    }
++
++    if (irq_source->sw_interrupts & HAILO_PCIE_SOC_CLOSE_IRQ) {
++        hailo_info(board, "soc_irq_handler - HAILO_PCIE_SOC_CLOSE_IRQ\n");
++        // always use bitmap=0xFFFFFFFF - it is ok to wake all interrupts since each handler will check if the stream was aborted or not. 
++        hailo_vdma_wakeup_interrupts(&board->vdma, &board->vdma.vdma_engines[DEFAULT_VDMA_ENGINE_INDEX],
++            0xFFFFFFFF);
++    }
++}
++
+ #if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,22)
+ irqreturn_t hailo_irqhandler(int irq, void *dev_id, struct pt_regs *regs)
+ #else
+@@ -320,39 +368,21 @@ irqreturn_t hailo_irqhandler(int irq, vo
+ 
+         return_value = IRQ_HANDLED;
+ 
+-        // wake fw_control if needed
+-        if (irq_source.interrupt_bitmask & FW_CONTROL) {
+-            complete(&board->nnc.fw_control.completion);
+-        }
+-
+-        // wake driver_down if needed
+-        if (irq_source.interrupt_bitmask & DRIVER_DOWN) {
+-            complete(&board->driver_down.reset_completed);
+-        }
+-
+-        if (irq_source.interrupt_bitmask & FW_NOTIFICATION) {
+-            if (!completion_done(&board->fw_loaded_completion)) {
+-                // Complete firmware loaded completion
+-                complete_all(&board->fw_loaded_completion);
++        if (board->fw_boot.is_in_boot) {
++            boot_irq_handler(board, &irq_source);
++        } else {
++            if (HAILO_ACCELERATOR_TYPE_NNC == board->pcie_resources.accelerator_type) {
++                nnc_irq_handler(board, &irq_source);
++            } else if (HAILO_ACCELERATOR_TYPE_SOC == board->pcie_resources.accelerator_type) {
++                soc_irq_handler(board, &irq_source);
+             } else {
+-                firmware_notification_irq_handler(board);
++                hailo_err(board, "Invalid accelerator type %d\n", board->pcie_resources.accelerator_type);
+             }
+-        }
+-
+-        if (irq_source.interrupt_bitmask & SOC_CONNECT_ACCEPTED) {
+-            complete_all(&board->soc.control_resp_ready);
+-        }
+ 
+-        if (irq_source.interrupt_bitmask & SOC_CLOSED_IRQ) {
+-            hailo_info(board, "hailo_irqhandler - SOC_CLOSED_IRQ\n");
+-            // always use bitmap=0xFFFFFFFF - it is ok to wake all interrupts since each handler will check if the stream was aborted or not. 
+-            hailo_vdma_wakeup_interrupts(&board->vdma, &board->vdma.vdma_engines[DEFAULT_VDMA_ENGINE_INDEX],
+-                0xFFFFFFFF);
+-        }
+-
+-        if (0 != irq_source.vdma_channels_bitmap) {
+-            hailo_vdma_irq_handler(&board->vdma, DEFAULT_VDMA_ENGINE_INDEX,
+-                irq_source.vdma_channels_bitmap);
++            if (0 != irq_source.vdma_channels_bitmap) {
++                hailo_vdma_irq_handler(&board->vdma, DEFAULT_VDMA_ENGINE_INDEX,
++                    irq_source.vdma_channels_bitmap);
++            }
+         }
+     }
+ 
+--- a/drivers/media/pci/hailo/src/nnc.c
++++ b/drivers/media/pci/hailo/src/nnc.c
+@@ -148,8 +148,8 @@ static long hailo_read_notification_ioct
+ 
+     // Check if was disabled
+     if (current_waiting_thread->is_disabled) {
+-        hailo_info(board, "HAILO_READ_NOTIFICATION, can't find notification wait for tgid=%d\n", current->tgid);
+-        err = -EINVAL;
++        hailo_info(board, "HAILO_READ_NOTIFICATION - notification disabled for tgid=%d\n", current->tgid);
++        err = -ECANCELED;
+         goto l_exit;
+     }
+ 
+--- a/drivers/media/pci/hailo/src/pcie.c
++++ b/drivers/media/pci/hailo/src/pcie.c
+@@ -13,6 +13,7 @@
+ #include <linux/pagemap.h>
+ #include <linux/firmware.h>
+ #include <linux/kthread.h>
++#include <linux/delay.h>
+ 
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 16, 0)
+ #include <linux/dma-direct.h>
+@@ -29,6 +30,7 @@
+ #include "utils/logs.h"
+ #include "utils/compact.h"
+ #include "vdma/vdma.h"
++#include "vdma/memory.h"
+ 
+ #if LINUX_VERSION_CODE < KERNEL_VERSION( 5, 4, 0 )
+ #include <linux/pci-aspm.h>
+@@ -46,8 +48,9 @@ enum hailo_allocate_driver_buffer_driver
+ static int force_desc_page_size = 0;
+ static bool g_is_power_mode_enabled = true;
+ static int force_allocation_from_driver = HAILO_NO_FORCE_BUFFER;
+-static bool force_hailo15_legacy_mode = false;
++static bool force_hailo10h_legacy_mode = false;
+ static bool force_boot_linux_from_eemc = false;
++static bool support_soft_reset = true;
+ 
+ #define DEVICE_NODE_NAME "hailo"
+ static int char_major = 0;
+@@ -291,12 +294,468 @@ static void hailo_pcie_remove_board(stru
+     up(&g_hailo_add_board_mutex);
+ }
+ 
+-static bool wait_for_firmware_completion(struct completion *fw_load_completion)
++/**
++ * Wait until the relevant completion is done.
++ *
++ * @param completion - pointer to the completion struct to wait for.
++ * @param msecs - the amount of time to wait in milliseconds.
++ * @return false if timed out, true if completed.
++ */
++static bool wait_for_firmware_completion(struct completion *completion, unsigned int msecs)
++{
++    return (0 != wait_for_completion_timeout(completion, msecs_to_jiffies(msecs)));
++}
++
++/**
++ * Program one FW file descriptors to the vDMA engine.
++ *
++ * @param dev - pointer to the device struct we are working on.
++ * @param boot_dma_state - pointer to the boot dma state struct which includes all of the boot resources.
++ * @param file_address - the address of the file in the device memory.
++ * @param transfer_buffer - the buffer to program to the vDMA engine.
++ * @param channel_index - the index of the channel to program.
++ * @param filename - the name of the file to program.
++ * @param raise_int_on_completion - true if this is the last descriptors chunk in the specific channel in the boot flow, false otherwise. If true - will enable
++ * an IRQ for the relevant channel when the transfer is finished.
++ * @return the amount of descriptors programmed on success, negative error code on failure.
++ */
++static int pcie_vdma_program_one_file_descriptors(struct device *dev, struct hailo_pcie_boot_dma_channel_state *boot_channel_state,
++    u32 file_address, struct hailo_vdma_mapped_transfer_buffer transfer_buffer, u8 channel_index, const char *filename, bool raise_int_on_completion)
++{
++    int device_desc = 0, host_desc = 0;
++    enum hailo_vdma_interrupts_domain interrupts_domain = raise_int_on_completion ? HAILO_VDMA_INTERRUPTS_DOMAIN_HOST :
++        HAILO_VDMA_INTERRUPTS_DOMAIN_NONE;
++
++    hailo_dev_dbg(dev, "channel_index = %d, file_name = %s, file_address = 0x%x, transfer_buffer.offset = 0x%x,\
++        size_to_program = 0x%x, starting_desc/desc_index = 0x%x\n", channel_index, filename, file_address,
++        transfer_buffer.offset, transfer_buffer.size, boot_channel_state->desc_program_num);
++
++    // program descriptors
++    device_desc = hailo_vdma_program_descriptors_in_chunk(&hailo_pcie_vdma_hw, file_address, transfer_buffer.size,
++        &boot_channel_state->device_descriptors_buffer.desc_list, boot_channel_state->desc_program_num,
++        (boot_channel_state->device_descriptors_buffer.desc_list.desc_count - 1), channel_index, HAILO_PCI_EP_HOST_DMA_DATA_ID);
++    if (device_desc < 0) {
++        hailo_dev_err(dev, "Failed to program device descriptors, error = %u\n", device_desc);
++        return device_desc;
++    }
++
++    host_desc = hailo_vdma_program_descriptors_list(&hailo_pcie_vdma_hw, &boot_channel_state->host_descriptors_buffer.desc_list,
++        boot_channel_state->desc_program_num, &transfer_buffer, true, channel_index, interrupts_domain, false);
++    if (host_desc < 0) {
++        hailo_dev_err(dev, "Failed to program host descriptors, error = %u\n", host_desc);
++        return host_desc;
++    }
++    
++    // checks that same amount of decsriptors were programmed on device side and host side
++    if (host_desc != device_desc) {
++        hailo_dev_err(dev, "Host and device descriptors should be the same\n");
++        return -EINVAL;
++    }
++
++    return host_desc;
++}
++
++/**
++ * Program one FW file to the vDMA engine.
++ *
++ * @param board - pointer to the board struct we are working on.
++ * @param boot_dma_state - pointer to the boot dma state struct which includes all of the boot resources.
++ * @param file_address - the address of the file in the device memory.
++ * @param filename - the name of the file to program.
++ * @param raise_int_on_completion - true if this is the last file in the boot flow, false otherwise. uses to enable an IRQ for the
++ * relevant channel when the transfer is finished.
++ * @return 0 on success, negative error code on failure. at the end of the function the firmware is released.
++ */
++static int pcie_vdma_program_one_file(struct hailo_pcie_board *board, struct hailo_pcie_boot_dma_state *boot_dma_state, u32 file_address,
++    const char *filename, bool raise_int_on_completion)
++{
++    const struct firmware *firmware = NULL;
++    struct hailo_vdma_mapped_transfer_buffer transfer_buffer = {0};
++    int desc_programmed = 0;
++    int err = 0;
++    size_t bytes_copied = 0, remaining_size = 0, data_offset = 0, desc_num_left = 0, current_desc_to_program = 0;
++
++    hailo_notice(board, "Programing file %s for dma transfer\n", filename);
++
++    // load firmware directly without usermode helper for the relevant file
++    err = request_firmware_direct(&firmware, filename, board->vdma.dev);
++    if (err < 0) {
++        hailo_err(board, "Failed to allocate memory for file %s\n", filename);
++        return err;
++    }
++
++    // set the remaining size as the whole file size to begin with
++    remaining_size = firmware->size;
++
++    while (remaining_size > 0) {
++        struct hailo_pcie_boot_dma_channel_state *channel = &boot_dma_state->channels[boot_dma_state->curr_channel_index];
++        bool is_last_desc_chunk_of_curr_channel = false;
++        bool rais_interrupt_on_last_chunk = false;
++        
++        hailo_dbg(board, "desc_program_num = 0x%x, desc_page_size = 0x%x, on channel = %d\n",
++            channel->desc_program_num, HAILO_PCI_OVER_VDMA_PAGE_SIZE, boot_dma_state->curr_channel_index);
++
++        // increment the channel index if the current channel is full
++        if ((MAX_SG_DESCS_COUNT - 1) == channel->desc_program_num) {
++            boot_dma_state->curr_channel_index++;
++            channel = &boot_dma_state->channels[boot_dma_state->curr_channel_index];
++            board->fw_boot.boot_used_channel_bitmap |= (1 << boot_dma_state->curr_channel_index);
++        }
++
++        // calculate the number of descriptors left to program and the number of bytes left to program
++        desc_num_left = (MAX_SG_DESCS_COUNT - 1) - channel->desc_program_num;
++
++        // prepare the transfer buffer to make sure all the fields are initialized
++        transfer_buffer.sg_table = &channel->sg_table; 
++        transfer_buffer.size = min(remaining_size, (desc_num_left * HAILO_PCI_OVER_VDMA_PAGE_SIZE));
++        // no need to check for overflow since the variables are constant and always desc_program_num <= max u16 (65536)
++        // & the buffer max size is 256 Mb << 4G (max u32)
++        transfer_buffer.offset = (channel->desc_program_num * HAILO_PCI_OVER_VDMA_PAGE_SIZE);
++
++        // check if this is the last descriptor chunk to program in the whole boot flow
++        current_desc_to_program = (transfer_buffer.size / HAILO_PCI_OVER_VDMA_PAGE_SIZE);
++        is_last_desc_chunk_of_curr_channel = ((MAX_SG_DESCS_COUNT - 1) ==
++            (current_desc_to_program + channel->desc_program_num));
++        rais_interrupt_on_last_chunk = (is_last_desc_chunk_of_curr_channel || (raise_int_on_completion &&
++            (remaining_size == transfer_buffer.size)));
++
++        // try to copy the file to the buffer, if failed, release the firmware and return
++        bytes_copied = sg_pcopy_from_buffer(transfer_buffer.sg_table->sgl, transfer_buffer.sg_table->orig_nents,
++            &firmware->data[data_offset], transfer_buffer.size, transfer_buffer.offset);
++        if (transfer_buffer.size != bytes_copied) {
++            hailo_err(board, "There is not enough memory allocated to copy file %s\n", filename);
++            release_firmware(firmware);
++            return -EFBIG;
++        }
++
++        // program the descriptors
++        desc_programmed = pcie_vdma_program_one_file_descriptors(&board->pDev->dev, channel, (file_address + data_offset),
++            transfer_buffer, boot_dma_state->curr_channel_index, filename, rais_interrupt_on_last_chunk);
++        if (desc_programmed < 0) {
++            hailo_err(board, "Failed to program descriptors for file %s, on cahnnel = %d\n", filename,
++                boot_dma_state->curr_channel_index);
++            release_firmware(firmware);
++            return desc_programmed;
++        }
++
++        // Update remaining size, data_offset and desc_program_num for the next iteration
++        remaining_size -= transfer_buffer.size;
++        data_offset += transfer_buffer.size;
++        channel->desc_program_num += desc_programmed;
++    }
++    
++    hailo_notice(board, "File %s programed successfully\n", filename);
++
++    release_firmware(firmware);
++
++    return desc_programmed;
++}
++
++/**
++ * Program the entire batch of firmware files to the vDMA engine.
++ *
++ * @param board - pointer to the board struct we are working on.
++ * @param boot_dma_state - pointer to the boot dma state struct which includes all of the boot resources.
++ * @param resources - pointer to the hailo_pcie_resources struct.
++ * @param stage - the stage to program.
++ * @return 0 on success, negative error code on failure.
++ */
++static long pcie_vdma_program_entire_batch(struct hailo_pcie_board *board, struct hailo_pcie_boot_dma_state *boot_dma_state,
++    struct hailo_pcie_resources *resources, u32 stage)
++{
++    long err = 0;
++    int file_index = 0;
++    const struct hailo_pcie_loading_stage *stage_info = hailo_pcie_get_loading_stage_info(resources->board_type, stage);
++    const struct hailo_file_batch *files_batch = stage_info->batch;
++    const u8 amount_of_files = stage_info->amount_of_files_in_stage;
++    const char *filename = NULL;
++    u32 file_address = 0;
++
++    for (file_index = 0; file_index < amount_of_files; file_index++)
++    {
++        filename = files_batch[file_index].filename;
++        file_address = files_batch[file_index].address;
++        
++        if (NULL == filename) {
++            hailo_err(board, "The amount of files wasn't specified for stage %d\n", stage);
++            break;
++        }
++
++        err = pcie_vdma_program_one_file(board, boot_dma_state, file_address, filename,
++            (file_index == (amount_of_files - 1)));
++        if (err < 0) {
++            hailo_err(board, "Failed to program file %s\n", filename);
++            return err;
++        }
++    }
++
++    return 0;
++}
++
++/**
++ * Release noncontinuous memory (virtual continuous memory). (sg table and kernel_addrs)
++ *
++ * @param dev - pointer to the device struct we are working on.
++ * @param sg_table - the sg table to release.
++ * @param kernel_addrs - the kernel address to release.
++ */
++static void pcie_vdma_release_noncontinuous_memory(struct device *dev, struct sg_table *sg_table, void *kernel_addrs)
++{
++    dma_unmap_sg(dev, sg_table->sgl, sg_table->orig_nents, DMA_TO_DEVICE);
++    sg_free_table(sg_table);
++    vfree(kernel_addrs);
++}
++
++/**
++ * Allocate noncontinuous memory (virtual continuous memory).
++ *
++ * @param dev - pointer to the device struct we are working on.
++ * @param buffer_size - the size of the buffer to allocate.
++ * @param kernel_addrs - pointer to the allocated buffer.
++ * @param sg_table - pointer to the sg table struct.
++ * @return 0 on success, negative error code on failure. on failure all resurces are released. (pages array, sg table, kernel_addrs)
++ */
++static long pcie_vdma_allocate_noncontinuous_memory(struct device *dev, u64 buffer_size, void **kernel_addrs, struct sg_table *sg_table)
++{
++    struct page **pages = NULL;
++    size_t npages = 0;
++    struct scatterlist *sgl = NULL;
++    long err = 0;
++    size_t i = 0;
++
++    // allocate noncontinuous memory for the kernel address (virtual continuous memory)
++    *kernel_addrs = vmalloc(buffer_size);
++    if (NULL == *kernel_addrs) {
++        hailo_dev_err(dev, "Failed to allocate memory for kernel_addrs\n");
++        err = -ENOMEM;
++        goto exit;
++    }
++
++    // map the memory to pages
++    npages = DIV_ROUND_UP(buffer_size, PAGE_SIZE);
++
++    // allocate memory for a virtually contiguous array for the pages
++    pages = kvmalloc_array(npages, sizeof(*pages), GFP_KERNEL);
++    if (!pages) {
++        err = -ENOMEM;
++        hailo_dev_err(dev, "Failed to allocate memory for pages\n");
++        goto release_user_addrs;
++    }
++
++    // walk a vmap address to the struct page it maps
++    for (i = 0; i < npages; i++) {
++        pages[i] = vmalloc_to_page(*kernel_addrs + (i * PAGE_SIZE));
++        if (!pages[i]) {
++            err = -ENOMEM;
++            hailo_dev_err(dev, "Failed to get page from vmap address\n");
++            goto release_array;
++        }
++    }
++
++    // allocate and initialize the sg table from a list of pages
++    sgl = sg_alloc_table_from_pages_segment_compat(sg_table, pages, npages, 0, buffer_size, SGL_MAX_SEGMENT_SIZE, NULL,
++        0, GFP_KERNEL);
++    if (IS_ERR(sgl)) {
++        err = PTR_ERR(sgl);
++        hailo_dev_err(dev, "sg table alloc failed (err %ld)..\n", err);
++        goto release_array;
++    }
++
++    // map the sg list
++    sg_table->nents = dma_map_sg(dev, sg_table->sgl, sg_table->orig_nents, DMA_TO_DEVICE);
++    if (0 == sg_table->nents) {
++        hailo_dev_err(dev, "failed to map sg list for user buffer\n");
++        err = -ENXIO;
++        goto release_sg_table;
++    }
++
++    // clean exit - just release the pages array & return err = 0
++    err = 0;
++    kfree(pages);
++    goto exit;
++
++release_sg_table:
++    dma_unmap_sg(dev, sg_table->sgl, sg_table->orig_nents, DMA_TO_DEVICE);
++release_array:
++    kfree(pages);
++release_user_addrs:
++    vfree(*kernel_addrs);
++exit:
++    return err;
++}
++
++/**
++ * Release all boot resources.
++ *
++ * @param board - pointer to the board struct we are working on.
++ * @param engine - pointer to the vdma engine struct.
++ * @param boot_dma_state - pointer to the boot dma state struct which includes all of the boot resources.
++ */
++static void pcie_vdme_release_boot_resources(struct hailo_pcie_board *board, struct hailo_vdma_engine *engine,
++    struct hailo_pcie_boot_dma_state *boot_dma_state)
++{
++    u8 channel_index = 0;
++
++    // release all the resources
++    for (channel_index = 0; channel_index < HAILO_PCI_OVER_VDMA_NUM_CHANNELS; channel_index++) {
++        struct hailo_pcie_boot_dma_channel_state *channel = &boot_dma_state->channels[channel_index];
++        // release descriptor lists
++        if (channel->host_descriptors_buffer.kernel_address != NULL) {
++            hailo_desc_list_release(&board->pDev->dev, &channel->host_descriptors_buffer);
++        }
++        if (channel->device_descriptors_buffer.kernel_address != NULL) {
++            hailo_desc_list_release(&board->pDev->dev, &channel->device_descriptors_buffer);
++        }
++
++        // stops all boot vDMA channels
++        hailo_vdma_stop_channel(engine->channels[channel_index].host_regs);
++        hailo_vdma_stop_channel(engine->channels[channel_index].device_regs);
++
++        // release noncontinuous memory (virtual continuous memory)
++        if (channel->kernel_addrs != NULL) {
++            pcie_vdma_release_noncontinuous_memory(&board->pDev->dev, &channel->sg_table, channel->kernel_addrs);
++        }
++    }
++}
++
++/**
++ * Allocate boot resources for vDMA transfer.
++ *
++ * @param desc_page_size - the size of the descriptor page.
++ * @param board - pointer to the board struct we are working on.
++ * @param boot_dma_state - pointer to the boot dma state struct which includes all of the boot resources.
++ * @param engine - pointer to the vDMA engine struct.
++ * @return 0 on success, negative error code on failure. in case of failure descriptor lists are released,
++ *  boot vDMA channels are stopped and memory is released. 
++ */
++static long pcie_vdme_allocate_boot_resources(u32 desc_page_size, struct hailo_pcie_board *board,
++    struct hailo_pcie_boot_dma_state *boot_dma_state, struct hailo_vdma_engine *engine)
++{
++    long err = 0;
++    uintptr_t device_handle = 0, host_handle = 0;
++    u8 channel_index = 0;
++    
++    for (channel_index = 0; channel_index < HAILO_PCI_OVER_VDMA_NUM_CHANNELS; channel_index++) {    
++        struct hailo_pcie_boot_dma_channel_state *channel = &boot_dma_state->channels[channel_index];
++
++        // create 2 descriptors list - 1 for the host & 1 for the device for each channel
++        err = hailo_desc_list_create(&board->pDev->dev, MAX_SG_DESCS_COUNT, desc_page_size, host_handle, false, 
++            &channel->host_descriptors_buffer);
++        if (err < 0) {
++            hailo_err(board, "failed to allocate host descriptors list buffer\n");
++            goto release_all_resources;
++        }
++
++        err = hailo_desc_list_create(&board->pDev->dev, MAX_SG_DESCS_COUNT, desc_page_size, device_handle, false,
++            &channel->device_descriptors_buffer);
++        if (err < 0) {
++            hailo_err(board, "failed to allocate device descriptors list buffer\n");
++            goto release_all_resources;
++        }
++
++        // start vDMA channels - both sides with DDR at the host side (AKA ID 0)
++        err = hailo_vdma_start_channel(engine->channels[channel_index].host_regs,
++            channel->host_descriptors_buffer.dma_address,
++            channel->host_descriptors_buffer.desc_list.desc_count, board->vdma.hw->ddr_data_id);
++        if (err < 0) {
++            hailo_err(board, "Error starting host vdma channel\n");
++            goto release_all_resources;
++        }
++
++        err = hailo_vdma_start_channel(engine->channels[channel_index].device_regs,
++            channel->device_descriptors_buffer.dma_address,
++            channel->device_descriptors_buffer.desc_list.desc_count, board->vdma.hw->ddr_data_id);
++        if (err < 0) {
++            hailo_err(board, "Error starting device vdma channel\n");
++            goto release_all_resources;
++        }
++
++        // initialize the buffer size per channel
++        channel->buffer_size = (MAX_SG_DESCS_COUNT * desc_page_size);
++
++        // allocate noncontinuous memory (virtual continuous memory)
++        err = pcie_vdma_allocate_noncontinuous_memory(&board->pDev->dev, channel->buffer_size, &channel->kernel_addrs,
++            &channel->sg_table);
++        if (err < 0) {
++            hailo_err(board, "Failed to allocate noncontinuous memory\n");
++            goto release_all_resources;
++        }
++    }
++
++    return 0;
++
++release_all_resources:
++    pcie_vdme_release_boot_resources(board, engine, boot_dma_state);
++    return err;
++}
++
++/**
++ * Write FW boot files over vDMA using multiple channels for timing optimizations.
++ * 
++ * The function is divided into the following steps:
++ * 1) Allocate resources for the boot process.
++ * 2) Programs descriptors to point to the memory and start the vDMA.
++ * 3) Waits until the vDMA is done and triggers the device to start the boot process.
++ * 4) Releases all the resources.
++ *
++ * @param board - pointer to the board struct.
++ * @param stage - the stage of the boot process.
++ * @param desc_page_size - the size of the descriptor page.
++ * @return 0 on success, negative error code on failure. in any case all resurces are released.
++ */
++static long pcie_write_firmware_batch_over_dma(struct hailo_pcie_board *board, u32 stage, u32 desc_page_size)
+ {
+-    return (0 != wait_for_completion_timeout(fw_load_completion, msecs_to_jiffies(FIRMWARE_WAIT_TIMEOUT_MS)));
++    long err = 0;
++    struct hailo_vdma_engine *engine = &board->vdma.vdma_engines[PCI_VDMA_ENGINE_INDEX];
++    u8 channel_index = 0;
++
++    err = pcie_vdme_allocate_boot_resources(desc_page_size, board, &board->fw_boot.boot_dma_state, engine);
++    if (err < 0) {
++        hailo_err(board, "Failed to create descriptors and start channels\n");
++        return err;
++    }
++
++    // initialize the completion for the vDMA boot data completion
++    reinit_completion(&board->fw_boot.vdma_boot_completion);
++
++    err = pcie_vdma_program_entire_batch(board, &board->fw_boot.boot_dma_state, &board->pcie_resources, stage);
++    if (err < 0) {
++        hailo_err(board, "Failed to program entire batch\n");
++        goto release_all;
++    }
++
++    // sync the sg tables for the device before statirng the vDMA
++    for (channel_index = 0; channel_index < HAILO_PCI_OVER_VDMA_NUM_CHANNELS; channel_index++) {
++        dma_sync_sgtable_for_device(&board->pDev->dev, &board->fw_boot.boot_dma_state.channels[channel_index].sg_table,
++        DMA_TO_DEVICE);
++    }
++
++    // start the vDMA transfer on all channels
++    for (channel_index = 0; channel_index < HAILO_PCI_OVER_VDMA_NUM_CHANNELS; channel_index++) {
++        struct hailo_pcie_boot_dma_channel_state *channel = &board->fw_boot.boot_dma_state.channels[channel_index];
++        if (channel->desc_program_num != 0) {
++            hailo_vdma_set_num_avail(engine->channels[channel_index].host_regs, channel->desc_program_num);
++            hailo_vdma_set_num_avail(engine->channels[channel_index].device_regs, channel->desc_program_num);
++            hailo_dbg(board, "Set num avail to %u, on channel %u\n", channel->desc_program_num, channel_index);
++        }
++    }
++
++    if (!wait_for_firmware_completion(&board->fw_boot.vdma_boot_completion, hailo_pcie_get_loading_stage_info(board->pcie_resources.board_type, SECOND_STAGE)->timeout)) {
++        hailo_err(board, "Timeout waiting for vDMA boot data completion\n");
++        err = -ETIMEDOUT;
++        goto release_all;
++    }
++
++    hailo_notice(board, "vDMA transfer completed, triggering boot\n");
++    reinit_completion(&board->fw_boot.fw_loaded_completion);
++    hailo_trigger_firmware_boot(&board->pcie_resources, stage);
++
++release_all:
++    pcie_vdme_release_boot_resources(board, engine, &board->fw_boot.boot_dma_state);
++    return err;
+ }
+ 
+-static int hailo_load_soc_firmware(struct hailo_pcie_resources *resources,
++static int load_soc_firmware(struct hailo_pcie_board *board, struct hailo_pcie_resources *resources,
+     struct device *dev, struct completion *fw_load_completion)
+ {
+     u32 boot_status = 0;
+@@ -304,104 +763,165 @@ static int hailo_load_soc_firmware(struc
+     u32 second_stage = force_boot_linux_from_eemc ? SECOND_STAGE_LINUX_IN_EMMC : SECOND_STAGE;
+ 
+     if (hailo_pcie_is_firmware_loaded(resources)) {
+-        hailo_dev_warn(dev, "Firmware batch was already loaded\n");
++        hailo_dev_warn(dev, "SOC Firmware batch was already loaded\n");
+         return 0;
+     }
+ 
++    // configure the EP registers for the DMA transaction
++    hailo_pcie_configure_ep_registers_for_dma_transaction(resources);
++
+     init_completion(fw_load_completion);
++    init_completion(&board->fw_boot.vdma_boot_completion);
+ 
+     err = hailo_pcie_write_firmware_batch(dev, resources, FIRST_STAGE);
+     if (err < 0) {
+-        hailo_dev_err(dev, "Failed writing firmware files. err %d\n", err);
++        hailo_dev_err(dev, "Failed writing SOC FIRST_STAGE firmware files. err %d\n", err);
+         return err;
+     }
+ 
+-    if (!wait_for_firmware_completion(fw_load_completion)) {
++    if (!wait_for_firmware_completion(fw_load_completion, hailo_pcie_get_loading_stage_info(resources->board_type, FIRST_STAGE)->timeout)) {
+         boot_status = hailo_get_boot_status(resources);
+-        hailo_dev_err(dev, "Timeout waiting for firmware file, boot status %u\n", boot_status);
++        hailo_dev_err(dev, "Timeout waiting for SOC FIRST_STAGE firmware file, boot status %u\n", boot_status);
+         return -ETIMEDOUT;
+     }
+-    reinit_completion(fw_load_completion);
+ 
+-    err = hailo_pcie_write_firmware_batch(dev, resources, second_stage);
++    reinit_completion(fw_load_completion);
++    
++    err = (int)pcie_write_firmware_batch_over_dma(board, second_stage, HAILO_PCI_OVER_VDMA_PAGE_SIZE);
+     if (err < 0) {
+-        hailo_dev_err(dev, "Failed writing firmware files. err %d\n", err);
++        hailo_dev_err(dev, "Failed writing SOC SECOND_STAGE firmware files over vDMA. err %d\n", err);
+         return err;
+     }
+ 
+-    if (!wait_for_firmware_completion(fw_load_completion)) {
++    if (!wait_for_firmware_completion(fw_load_completion, hailo_pcie_get_loading_stage_info(resources->board_type, SECOND_STAGE)->timeout)) {
+         boot_status = hailo_get_boot_status(resources);
+-        hailo_dev_err(dev, "Timeout waiting for firmware file, boot status %u\n", boot_status);
++        hailo_dev_err(dev, "Timeout waiting for SOC SECOND_STAGE firmware file, boot status %u\n", boot_status);
+         return -ETIMEDOUT;
+     }
+ 
+-    hailo_dev_notice(dev, "Firmware Batch loaded successfully\n");
++    reinit_completion(fw_load_completion);
++    reinit_completion(&board->fw_boot.vdma_boot_completion);
++
++    hailo_dev_notice(dev, "SOC Firmware Batch loaded successfully\n");
+ 
+     return 0;
+ }
+-
+-static int hailo_load_nnc_firmware(struct hailo_pcie_resources *resources,
+-    struct device *dev, struct completion *fw_load_completion)
++static int load_nnc_firmware(struct hailo_pcie_board *board)
+ {
+     u32 boot_status = 0;
+     int err = 0;
++    struct device *dev = &board->pDev->dev;
+ 
+-    if (hailo_pcie_is_firmware_loaded(resources)) {
+-        hailo_dev_warn(dev, "Firmware batch was already loaded\n");
+-        return 0;
++    if (hailo_pcie_is_firmware_loaded(&board->pcie_resources)) {
++        if (support_soft_reset) {
++            err = hailo_pcie_soft_reset(&board->pcie_resources, &board->soft_reset.reset_completed); // send control, wait for done
++            if (err < 0) {
++                hailo_dev_err(dev, "Failed hailo pcie soft reset. err %d\n", err);
++                return 0;
++            }
++            hailo_dev_notice(dev, "Soft reset done\n");
++        } else {
++            hailo_dev_warn(dev, "NNC Firmware batch was already loaded\n");
++            return 0;
++        }
+     }
+ 
+-    init_completion(fw_load_completion);
++    init_completion(&board->fw_boot.fw_loaded_completion);
+ 
+-    err = hailo_pcie_write_firmware_batch(dev, resources, FIRST_STAGE);
++    err = hailo_pcie_write_firmware_batch(dev, &board->pcie_resources, FIRST_STAGE);
+     if (err < 0) {
+-        hailo_dev_err(dev, "Failed writing firmware files. err %d\n", err);
++        hailo_dev_err(dev, "Failed writing NNC firmware files. err %d\n", err);
+         return err;
+     }
+ 
+-    if (!wait_for_firmware_completion(fw_load_completion)) {
+-        boot_status = hailo_get_boot_status(resources);
+-        hailo_dev_err(dev, "Timeout waiting for firmware file, boot status %u\n", boot_status);
++    if (!wait_for_firmware_completion(&board->fw_boot.fw_loaded_completion, hailo_pcie_get_loading_stage_info(board->pcie_resources.board_type, FIRST_STAGE)->timeout)) {
++        boot_status = hailo_get_boot_status(&board->pcie_resources);
++        hailo_dev_err(dev, "Timeout waiting for NNC firmware file, boot status %u\n", boot_status);
+         return -ETIMEDOUT;
+     }
+ 
+-    hailo_dev_notice(dev, "Firmware loaded successfully\n");
++    hailo_dev_notice(dev, "NNC Firmware loaded successfully\n");
+ 
+     return 0;
+ }
+ 
+-static int hailo_activate_board(struct hailo_pcie_board *board)
++int hailo_pcie_soft_reset(struct hailo_pcie_resources *resources, struct completion *reset_completed)
+ {
++    bool completion_result = false;
+     int err = 0;
+ 
+-    (void)hailo_pcie_disable_aspm(board, PCIE_LINK_STATE_L0S, false);
++    hailo_pcie_write_firmware_soft_reset(resources);
+ 
+-    err = hailo_enable_interrupts(board);
+-    if (err < 0) {
+-        hailo_err(board, "Failed Enabling interrupts %d\n", err);
++    reinit_completion(reset_completed);
++
++    // Wait for response
++    completion_result =
++        wait_for_firmware_completion(reset_completed, msecs_to_jiffies(FIRMWARE_WAIT_TIMEOUT_MS));
++    if (completion_result == false) {
++        pr_warn("hailo reset firmware, timeout waiting for shutdown response (timeout_ms=%d)\n", FIRMWARE_WAIT_TIMEOUT_MS);
++        err = -ETIMEDOUT;
+         return err;
+     }
+ 
++    msleep(TIME_UNTIL_REACH_BOOTLOADER);
++    pr_notice("hailo_driver_down finished\n");
++
++    return err;
++}
++
++static int load_firmware(struct hailo_pcie_board *board)
++{
+     switch (board->pcie_resources.accelerator_type) {
+     case HAILO_ACCELERATOR_TYPE_SOC:
+-        err = hailo_load_soc_firmware(&board->pcie_resources, &board->pDev->dev,
+-            &board->fw_loaded_completion);
+-        break;
++        return load_soc_firmware(board, &board->pcie_resources, &board->pDev->dev, &board->fw_boot.fw_loaded_completion);
+     case HAILO_ACCELERATOR_TYPE_NNC:
+-        err = hailo_load_nnc_firmware(&board->pcie_resources, &board->pDev->dev,
+-            &board->fw_loaded_completion);
+-        break;
++        return load_nnc_firmware(board);
+     default:
+-        hailo_err(board, "Invalid board type");
+-        err = -EINVAL;
++        hailo_err(board, "Invalid board type %d\n", board->pcie_resources.accelerator_type);
++        return -EINVAL;
+     }
++}
++
++static int enable_boot_interrupts(struct hailo_pcie_board *board)
++{
++    int err = hailo_enable_interrupts(board);
+     if (err < 0) {
+-        hailo_err(board, "Firmware load failed\n");
+-        hailo_disable_interrupts(board);
++        hailo_err(board, "Failed enabling interrupts %d\n", err);
+         return err;
+     }
+ 
++    board->fw_boot.is_in_boot = true;
++    return 0;
++}
++
++static void disable_boot_interrupts(struct hailo_pcie_board *board)
++{
++    board->fw_boot.is_in_boot = false;
+     hailo_disable_interrupts(board);
++}
++
++static int hailo_activate_board(struct hailo_pcie_board *board)
++{
++    int err = 0;
++    ktime_t start_time = 0, end_time = 0;
++
++    (void)hailo_pcie_disable_aspm(board, PCIE_LINK_STATE_L0S, false);
++
++    err = enable_boot_interrupts(board);
++    if (err < 0) {
++        return err;
++    }
++
++    start_time = ktime_get();
++    err = load_firmware(board);
++    end_time = ktime_get();
++    hailo_notice(board, "FW loaded, took %lld ms\n", ktime_to_ms(ktime_sub(end_time, start_time)));
++    disable_boot_interrupts(board);
++
++    if (err < 0) {
++        hailo_err(board, "Firmware load failed\n");
++        return err;
++    }
+ 
+     if (power_mode_enabled()) {
+         // Setting the device to low power state, until the user opens the device
+@@ -520,12 +1040,9 @@ static int pcie_resources_init(struct pc
+     }
+ 
+ 
+-    // There is no HAILO15 as mercury through pcie unless it's legacy mode (H15 as accelerator) or HAILO-10H
+-    if (HAILO_BOARD_TYPE_HAILO15 == board_type){
+-        if (true == force_hailo15_legacy_mode) {
++    if (HAILO_BOARD_TYPE_HAILO10H == board_type){
++        if (true == force_hailo10h_legacy_mode) {
+             board_type = HAILO_BOARD_TYPE_HAILO10H_LEGACY;
+-        } else {
+-            board_type = HAILO_BOARD_TYPE_HAILO10H;
+         }
+     }
+ 
+@@ -696,7 +1213,8 @@ static int hailo_pcie_probe(struct pci_d
+     }
+ 
+     pBoard->interrupts_enabled = false;
+-    init_completion(&pBoard->fw_loaded_completion);
++    pBoard->fw_boot.is_in_boot = false;
++    init_completion(&pBoard->fw_boot.fw_loaded_completion);
+ 
+     sema_init(&pBoard->mutex, 1);
+     atomic_set(&pBoard->ref_count, 0);
+@@ -707,6 +1225,7 @@ static int hailo_pcie_probe(struct pci_d
+     hailo_soc_init(&pBoard->soc);
+ 
+     init_completion(&pBoard->driver_down.reset_completed);
++    init_completion(&pBoard->soft_reset.reset_completed);
+ 
+     memset(&pBoard->memory_transfer_params, 0, sizeof(pBoard->memory_transfer_params));
+ 
+@@ -724,6 +1243,10 @@ static int hailo_pcie_probe(struct pci_d
+         goto probe_release_pcie_resources;
+     }
+ 
++    // Initialize the boot channel bitmap to 1 since channel 0 is always used for boot 
++    // (we will always use at least 1 channel which is LSB in the bitmap)
++    pBoard->fw_boot.boot_used_channel_bitmap = (1 << 0);
++    memset(&pBoard->fw_boot.boot_dma_state, 0, sizeof(pBoard->fw_boot.boot_dma_state));
+     err = hailo_activate_board(pBoard);
+     if (err < 0) {
+         hailo_err(pBoard, "Failed activating board %d\n", err);
+@@ -927,8 +1450,8 @@ static const struct pci_error_handlers h
+ static struct pci_device_id hailo_pcie_id_table[] =
+ {
+     {PCI_DEVICE_DATA(HAILO, HAILO8, HAILO_BOARD_TYPE_HAILO8)},
+-    {PCI_DEVICE_DATA(HAILO, HAILO15, HAILO_BOARD_TYPE_HAILO15)},
+-    {PCI_DEVICE_DATA(HAILO, PLUTO, HAILO_BOARD_TYPE_PLUTO)},
++    {PCI_DEVICE_DATA(HAILO, HAILO10H, HAILO_BOARD_TYPE_HAILO10H)},
++    {PCI_DEVICE_DATA(HAILO, HAILO15L, HAILO_BOARD_TYPE_HAILO15L)},
+     {0,0,0,0,0,0,0 },
+ };
+ 
+@@ -1024,12 +1547,15 @@ MODULE_PARM_DESC(force_allocation_from_d
+ module_param(force_desc_page_size, int, S_IRUGO);
+ MODULE_PARM_DESC(force_desc_page_size, "Determines the maximum DMA descriptor page size (must be a power of 2)");
+ 
+-module_param(force_hailo15_legacy_mode, bool, S_IRUGO);
+-MODULE_PARM_DESC(force_hailo15_legacy_mode, "Forces work with Hailo15 in legacy mode(relevant for emulators)");
++module_param(force_hailo10h_legacy_mode, bool, S_IRUGO);
++MODULE_PARM_DESC(force_hailo10h_legacy_mode, "Forces work with Hailo10h in legacy mode(relevant for emulators)");
+ 
+ module_param(force_boot_linux_from_eemc, bool, S_IRUGO);
+ MODULE_PARM_DESC(force_boot_linux_from_eemc, "Boot the linux image from eemc (Requires special Image)");
+ 
++module_param(support_soft_reset, bool, S_IRUGO);
++MODULE_PARM_DESC(support_soft_reset, "enables driver reload to reload a new firmware as well");
++
+ MODULE_AUTHOR("Hailo Technologies Ltd.");
+ MODULE_DESCRIPTION("Hailo PCIe driver");
+ MODULE_LICENSE("GPL v2");
+--- a/drivers/media/pci/hailo/src/pcie.h
++++ b/drivers/media/pci/hailo/src/pcie.h
+@@ -19,6 +19,9 @@
+ 
+ #include <linux/ioctl.h>
+ 
++#define HAILO_PCI_OVER_VDMA_NUM_CHANNELS                (8)
++#define HAILO_PCI_OVER_VDMA_PAGE_SIZE                   (512)
++
+ struct hailo_fw_control_info {
+     // protects that only one fw control will be send at a time
+     struct semaphore    mutex;
+@@ -33,6 +36,11 @@ struct hailo_pcie_driver_down_info {
+     struct completion   reset_completed;
+ };
+ 
++struct hailo_pcie_soft_reset {
++    // called from the interrupt handler to notify that FW completed reset
++    struct completion   reset_completed;
++};
++
+ struct hailo_fw_boot {
+     // the filp that enabled interrupts for fw boot. the interrupt is enabled if this is not null
+     struct file *filp;
+@@ -64,6 +72,32 @@ struct hailo_file_context {
+     u32 soc_used_channels_bitmap;
+ };
+ 
++struct hailo_pcie_boot_dma_channel_state {
++    struct hailo_descriptors_list_buffer host_descriptors_buffer;
++    struct hailo_descriptors_list_buffer device_descriptors_buffer;
++    struct sg_table sg_table;
++    u64 buffer_size;
++    void *kernel_addrs;
++    u32 desc_program_num;
++};
++
++struct hailo_pcie_boot_dma_state {
++    struct hailo_pcie_boot_dma_channel_state channels[HAILO_PCI_OVER_VDMA_NUM_CHANNELS];
++    u8 curr_channel_index;
++};
++
++struct hailo_pcie_fw_boot {
++    struct hailo_pcie_boot_dma_state boot_dma_state;
++    // is_in_boot is set to true when the board is in boot mode
++    bool is_in_boot;
++    // boot_used_channel_bitmap is a bitmap of the channels that are used for boot
++    u16 boot_used_channel_bitmap;
++    // fw_loaded_completion is used to notify that the FW was loaded - SOC & NNC
++    struct completion fw_loaded_completion;
++    // vdma_boot_completion is used to notify that the vDMA boot data was transferred completely on all used channels for boot
++    struct completion vdma_boot_completion;
++};
++
+ struct hailo_pcie_board {
+     struct list_head board_list;
+     struct pci_dev *pDev;
+@@ -74,13 +108,15 @@ struct hailo_pcie_board {
+     struct hailo_pcie_nnc nnc;
+     struct hailo_pcie_soc soc;
+     struct hailo_pcie_driver_down_info driver_down;
++    struct hailo_pcie_soft_reset soft_reset;
+     struct semaphore mutex;
+     struct hailo_vdma_controller vdma;
+ 
++    struct hailo_pcie_fw_boot fw_boot;
++    
+     struct hailo_memory_transfer_params memory_transfer_params;
+     u32 desc_max_page_size;
+     enum hailo_allocation_mode allocation_mode;
+-    struct completion fw_loaded_completion;
+     bool interrupts_enabled;
+ };
+ 
+@@ -89,6 +125,7 @@ bool power_mode_enabled(void);
+ struct hailo_pcie_board* hailo_pcie_get_board_index(u32 index);
+ void hailo_disable_interrupts(struct hailo_pcie_board *board);
+ int hailo_enable_interrupts(struct hailo_pcie_board *board);
++int  hailo_pcie_soft_reset(struct hailo_pcie_resources *resources, struct completion *reset_completed);
+ 
+ #endif /* _HAILO_PCI_PCIE_H_ */
+ 
+--- a/drivers/media/pci/hailo/src/soc.c
++++ b/drivers/media/pci/hailo/src/soc.c
+@@ -12,12 +12,15 @@
+ #include "vdma_common.h"
+ #include "utils/logs.h"
+ #include "vdma/memory.h"
++#include "pcie_common.h"
+ 
+ #include <linux/uaccess.h>
+ 
+-#define PCI_SOC_VDMA_ENGINE_INDEX           (0)
++#ifndef HAILO_EMULATOR
+ #define PCI_SOC_CONTROL_CONNECT_TIMEOUT_MS (1000)
+-#define PCI_SOC_INPUT_CHANNEL_BITMASK       (0x000000FF)
++#else
++#define PCI_SOC_CONTROL_CONNECT_TIMEOUT_MS (1000000)
++#endif /* ifndef HAILO_EMULATOR */
+ 
+ void hailo_soc_init(struct hailo_pcie_soc *soc)
+ {
+@@ -84,10 +87,9 @@ long hailo_soc_connect_ioctl(struct hail
+     struct hailo_soc_connect_params params;
+     struct hailo_vdma_channel *input_channel = NULL;
+     struct hailo_vdma_channel *output_channel = NULL;
+-    struct hailo_vdma_engine *vdma_engine = &controller->vdma_engines[PCI_SOC_VDMA_ENGINE_INDEX];
++    struct hailo_vdma_engine *vdma_engine = &controller->vdma_engines[PCI_VDMA_ENGINE_INDEX];
+     struct hailo_descriptors_list_buffer *input_descriptors_buffer = NULL;
+     struct hailo_descriptors_list_buffer *output_descriptors_buffer = NULL;
+-    uint8_t depth = 0;
+     int err = 0;
+ 
+     if (copy_from_user(&params, (void *)arg, sizeof(params))) {
+@@ -136,9 +138,8 @@ long hailo_soc_connect_ioctl(struct hail
+     }
+ 
+     // configure and start input channel
+-    depth = ceil_log2(input_descriptors_buffer->desc_list.desc_count);
+     // DMA Direction is only to get channel index - so 
+-    err = hailo_vdma_start_channel(input_channel->host_regs, input_descriptors_buffer->dma_address, depth,
++    err = hailo_vdma_start_channel(input_channel->host_regs, input_descriptors_buffer->dma_address, input_descriptors_buffer->desc_list.desc_count,
+         board->vdma.hw->ddr_data_id);
+     if (err < 0) {
+         hailo_dev_err(&board->pDev->dev, "Error starting vdma input channel index %u\n", params.input_channel_index);
+@@ -149,9 +150,8 @@ long hailo_soc_connect_ioctl(struct hail
+     hailo_set_bit(params.input_channel_index, &context->soc_used_channels_bitmap);
+     
+     // configure and start output channel
+-    depth = ceil_log2(output_descriptors_buffer->desc_list.desc_count);
+     // DMA Direction is only to get channel index - so 
+-    err = hailo_vdma_start_channel(output_channel->host_regs, output_descriptors_buffer->dma_address, depth,
++    err = hailo_vdma_start_channel(output_channel->host_regs, output_descriptors_buffer->dma_address, output_descriptors_buffer->desc_list.desc_count,
+         board->vdma.hw->ddr_data_id);
+     if (err < 0) {
+         hailo_dev_err(&board->pDev->dev, "Error starting vdma output channel index %u\n", params.output_channel_index);
+@@ -175,7 +175,7 @@ static int close_channels(struct hailo_p
+ {
+     struct hailo_pcie_soc_request request = {0};
+     struct hailo_pcie_soc_response response = {0};
+-    struct hailo_vdma_engine *engine = &board->vdma.vdma_engines[PCI_SOC_VDMA_ENGINE_INDEX];
++    struct hailo_vdma_engine *engine = &board->vdma.vdma_engines[PCI_VDMA_ENGINE_INDEX];
+     struct hailo_vdma_channel *channel = NULL;
+     u8 channel_index = 0;
+ 
+--- a/drivers/media/pci/hailo/utils/compact.h
++++ b/drivers/media/pci/hailo/utils/compact.h
+@@ -48,6 +48,14 @@ static inline long get_user_pages_compac
+ }
+ #endif
+ 
++#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 8, 0)
++static inline void dma_sync_sgtable_for_device(struct device *dev,
++    struct sg_table *sgt, enum dma_data_direction dir)
++{
++	dma_sync_sg_for_device(dev, sgt->sgl, sgt->orig_nents, dir);
++}
++#endif
++
+ #ifndef _LINUX_MMAP_LOCK_H
+ static inline void mmap_read_lock(struct mm_struct *mm)
+ {
+--- a/drivers/media/pci/hailo/vdma/memory.c
++++ b/drivers/media/pci/hailo/vdma/memory.c
+@@ -14,10 +14,10 @@
+ #include <linux/sched.h>
+ #include <linux/module.h>
+ 
+-
+-#define SGL_MAX_SEGMENT_SIZE 	(0x10000)
+ // See linux/mm.h
+ #define MMIO_AND_NO_PAGES_VMA_MASK (VM_IO | VM_PFNMAP)
++// The linux kernel names the dmabuf's vma vm_file field "dmabuf"
++#define VMA_VM_FILE_DMABUF_NAME    ("dmabuf")
+ 
+ static int map_mmio_address(uintptr_t user_address, u32 size, struct vm_area_struct *vma,
+     struct sg_table *sgt);
+@@ -27,10 +27,16 @@ static void clear_sg_table(struct sg_tab
+ 
+ #if LINUX_VERSION_CODE >= KERNEL_VERSION( 3, 3, 0 )
+ 
+-#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 16, 0)
++#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 13, 0)
++#define DMA_NS_NAME DMA_BUF
++#else
++#define DMA_NS_NAME "DMA_BUF"
++#endif // LINUX_VERSION_CODE < KERNEL_VERSION(6, 13, 0)
++
++#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0)
+ // Import DMA_BUF namespace for needed kernels
+-MODULE_IMPORT_NS(DMA_BUF);
+-#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(5, 16, 0) */
++MODULE_IMPORT_NS(DMA_NS_NAME);
++#endif /* LINUX_VERSION_CODE >= KERNEL_VERSION(5, 15, 0) */
+ 
+ static int hailo_map_dmabuf(struct device *dev, int dmabuf_fd, enum dma_data_direction direction, struct sg_table *sgt,
+     struct hailo_dmabuf_info *dmabuf_info)
+@@ -103,6 +109,39 @@ static void hailo_unmap_dmabuf(struct ha
+ 
+ #endif /* LINUX_VERSION_CODE >= KERNEL_VERSION( 3, 3, 0 ) */
+ 
++// Function that checks if the vma is backed by a mapped dmabuf
++static bool is_dmabuf_vma(struct vm_area_struct *vma)
++{
++    return (vma && vma->vm_file && (0 == strcmp(vma->vm_file->f_path.dentry->d_name.name, VMA_VM_FILE_DMABUF_NAME)));
++}
++
++static int create_fd_from_vma(struct device *dev, struct vm_area_struct *vma) {
++    struct file *file = NULL;
++    int fd = 0;
++
++    if (!vma || !vma->vm_file) {
++        dev_err(dev, "Invalid VMA or no associated file.\n");
++        return -EINVAL;
++    }
++
++    file = vma->vm_file;
++
++    // This functions increments the ref count of the file
++    get_file(file);
++
++    // 0 for default flags
++    fd = get_unused_fd_flags(0);
++    if (fd < 0) {
++        dev_err(dev, "Failed to get unused file descriptor.\n");
++        fput(file);
++        return fd;
++    }
++
++    // Install the file into the file descriptor table
++    fd_install(fd, file);
++    return fd;
++}
++
+ struct hailo_vdma_buffer *hailo_vdma_buffer_map(struct device *dev,
+     uintptr_t user_address, size_t size, enum dma_data_direction direction,
+     enum hailo_dma_buffer_type buffer_type, struct hailo_vdma_low_memory_buffer *low_mem_driver_allocated_buffer)
+@@ -112,7 +151,8 @@ struct hailo_vdma_buffer *hailo_vdma_buf
+     struct sg_table sgt = {0};
+     struct vm_area_struct *vma = NULL;
+     bool is_mmio = false;
+-    struct hailo_dmabuf_info dmabuf_info = {0}; 
++    struct hailo_dmabuf_info dmabuf_info = {0};
++    bool created_dmabuf_fd_from_vma = false;
+ 
+     mapped_buffer = kzalloc(sizeof(*mapped_buffer), GFP_KERNEL);
+     if (NULL == mapped_buffer) {
+@@ -121,12 +161,27 @@ struct hailo_vdma_buffer *hailo_vdma_buf
+         goto cleanup;
+     }
+ 
+-    if (IS_ENABLED(HAILO_SUPPORT_MMIO_DMA_MAPPING) && (HAILO_DMA_DMABUF_BUFFER != buffer_type)) {
++    if (HAILO_DMA_DMABUF_BUFFER != buffer_type) {
+         vma = find_vma(current->mm, user_address);
+-        if (NULL == vma) {
+-            dev_err(dev, "no vma for virt_addr/size = 0x%08lx/0x%08zx\n", user_address, size);
+-            ret = -EFAULT;
+-            goto cleanup;
++        if (IS_ENABLED(HAILO_SUPPORT_MMIO_DMA_MAPPING)) {
++            if (NULL == vma) {
++                dev_err(dev, "no vma for virt_addr/size = 0x%08lx/0x%08zx\n", user_address, size);
++                ret = -EFAULT;
++                goto cleanup;
++            }
++        }
++
++        if (is_dmabuf_vma(vma)) {
++            dev_dbg(dev, "Given vma is backed by dmabuf - creating fd and mapping as dmabuf\n");
++            buffer_type = HAILO_DMA_DMABUF_BUFFER;
++            ret = create_fd_from_vma(dev, vma);
++            if (ret < 0) {
++                dev_err(dev, "Failed creating fd from vma in given dmabuf\n");
++                goto cleanup;
++            }
++            // Override user address with fd to the dmabuf - like normal dmabuf flow
++            user_address = ret;
++            created_dmabuf_fd_from_vma = true;
+         }
+     }
+ 
+@@ -157,6 +212,11 @@ struct hailo_vdma_buffer *hailo_vdma_buf
+             dev_err(dev, "Failed mapping dmabuf\n");
+             goto cleanup;
+         }
++        // If created dmabuf fd from vma need to decrement refcount and release fd
++        if (created_dmabuf_fd_from_vma) {
++            fput(vma->vm_file);
++            put_unused_fd(user_address);
++        }
+     } else {
+         // user_address is a standard 'struct page' backed memory address
+         ret = prepare_sg_table(&sgt, user_address, size, low_mem_driver_allocated_buffer);
+@@ -331,7 +391,7 @@ int hailo_desc_list_create(struct device
+         dev_err(dev, "Failed to allocate descriptors list, desc_count 0x%x, buffer_size 0x%zx, This failure means there is not a sufficient amount of CMA memory "
+             "(contiguous physical memory), This usually is caused by lack of general system memory. Please check you have sufficient memory.\n",
+             descriptors_count, buffer_size);
+-        return -ENOMEM;
++        return -ENOBUFS;
+     }
+ 
+     descriptors->buffer_size = buffer_size;
+@@ -467,7 +527,7 @@ int hailo_vdma_continuous_buffer_alloc(s
+     if (NULL == kernel_address) {
+         dev_warn(dev, "Failed to allocate continuous buffer, size 0x%zx. This failure means there is not a sufficient amount of CMA memory "
+             "(contiguous physical memory), This usually is caused by lack of general system memory. Please check you have sufficent memory.\n", size);
+-        return -ENOMEM;
++        return -ENOBUFS;
+     }
+ 
+     continuous_buffer->kernel_address = kernel_address;
+--- a/drivers/media/pci/hailo/vdma/memory.h
++++ b/drivers/media/pci/hailo/vdma/memory.h
+@@ -11,6 +11,8 @@
+ 
+ #include "vdma/vdma.h"
+ 
++#define SGL_MAX_SEGMENT_SIZE 	(0x10000)
++
+ struct hailo_vdma_buffer *hailo_vdma_buffer_map(struct device *dev, uintptr_t user_address, size_t size,
+     enum dma_data_direction direction, enum hailo_dma_buffer_type buffer_type,
+     struct hailo_vdma_low_memory_buffer *low_mem_driver_allocated_buffer);
diff --git a/target/linux/bcm27xx/patches-6.6/950-1526-overlays-Regularisation-and-improvements.patch b/target/linux/bcm27xx/patches-6.6/950-1526-overlays-Regularisation-and-improvements.patch
new file mode 100644
index 00000000000000..c763b1d27a59b2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1526-overlays-Regularisation-and-improvements.patch
@@ -0,0 +1,139 @@
+From fa71765fd3c98fa170407e72e052004913da6874 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 27 Jan 2025 14:17:46 +0000
+Subject: [PATCH] overlays: Regularisation and improvements
+
+A few small improvements, with a view to making the updated overlays
+behave the same before and after the big conversion.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/ads1115-overlay.dts       | 3 ++-
+ arch/arm/boot/dts/overlays/i2c-fan-overlay.dts       | 4 ++--
+ arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts       | 3 ++-
+ arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts    | 3 ++-
+ arch/arm/boot/dts/overlays/mcp23017-overlay.dts      | 3 ++-
+ arch/arm/boot/dts/overlays/pca953x-overlay.dts       | 2 --
+ arch/arm/boot/dts/overlays/pcf857x-overlay.dts       | 2 +-
+ arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts | 2 +-
+ arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts | 2 +-
+ 9 files changed, 13 insertions(+), 11 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/ads1115-overlay.dts
++++ b/arch/arm/boot/dts/overlays/ads1115-overlay.dts
+@@ -120,7 +120,8 @@
+ 		chd_cfg =         <&channel_d>,"reg:0";
+ 		chd_gain =        <&channel_d>,"ti,gain:0";
+ 		chd_datarate =    <&channel_d>,"ti,datarate:0";
+-		i2c0 = <&frag100>, "target:0=",<&i2c0>;
++		i2c0 = <&frag100>, "target:0=",<&i2c0>,
++			      <0>,"+101+102";
+ 		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+ 			      <0>,"+101+102";
+ 		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
+--- a/arch/arm/boot/dts/overlays/i2c-fan-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-fan-overlay.dts
+@@ -17,7 +17,6 @@
+ 			emc2301: emc2301@2f {
+ 				compatible = "microchip,emc2301";
+ 				reg = <0x2f>;
+-				status = "okay";
+ 				#cooling-cells = <0x02>;
+ 			};
+ 		};
+@@ -82,7 +81,8 @@
+ 	};
+ 
+ 	__overrides__ {
+-		i2c0 =		<&frag100>,"target:0=",<&i2c0>;
++		i2c0 =		<&frag100>,"target:0=",<&i2c0>,
++				<0>,"+101+102";
+ 		i2c_csi_dsi =	<&frag100>,"target:0=",<&i2c_csi_dsi>,
+ 				<0>,"+101+102";
+ 		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
+--- a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
+@@ -27,7 +27,8 @@
+ 	};
+ 
+ 	__overrides__ {
+-		i2c0 = <&frag100>, "target:0=",<&i2c0>;
++		i2c0 = <&frag100>, "target:0=",<&i2c0>,
++			      <0>,"+101+102";
+ 		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+ 			      <0>,"+101+102";
+ 		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
+@@ -27,7 +27,8 @@
+ 	};
+ 
+ 	__overrides__ {
+-		i2c0 = <&frag100>, "target:0=",<&i2c0>;
++		i2c0 = <&frag100>, "target:0=",<&i2c0>,
++			      <0>,"+101+102";
+ 		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+ 			      <0>,"+101+102";
+ 		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
+--- a/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
++++ b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
+@@ -87,7 +87,8 @@
+ 		addr = <&mcp23017>,"reg:0", <&mcp23017_pins>,"reg:0";
+ 		mcp23008 = <0>,"=2";
+ 		noints = <0>,"!1!3";
+-		i2c0 = <&frag100>, "target:0=",<&i2c0>;
++		i2c0 = <&frag100>, "target:0=",<&i2c0>,
++			      <0>,"+101+102";
+ 		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+ 			      <0>,"+101+102";
+ 		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
+--- a/arch/arm/boot/dts/overlays/pca953x-overlay.dts
++++ b/arch/arm/boot/dts/overlays/pca953x-overlay.dts
+@@ -17,8 +17,6 @@
+ 				reg = <0x20>;
+ 				gpio-controller;
+ 				#gpio-cells = <2>;
+-
+-				status = "okay";
+ 			};
+ 		};
+ 	};
+--- a/arch/arm/boot/dts/overlays/pcf857x-overlay.dts
++++ b/arch/arm/boot/dts/overlays/pcf857x-overlay.dts
+@@ -11,13 +11,13 @@
+ 		__overlay__ {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
++			status = "okay";
+ 
+ 			pcf857x: pcf857x@0 {
+ 				compatible = "";
+ 				reg = <0x00>;
+ 				gpio-controller;
+ 				#gpio-cells = <2>;
+-				status = "okay";
+ 			};
+ 		};
+ 	};
+--- a/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
++++ b/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
+@@ -27,7 +27,7 @@
+ 	};
+ 
+ 	fragment@1 {
+-		target-path = "/";
++		target = <&clocks>;
+ 		__overlay__ {
+ 			sc16is750_clk: sc16is750_i2c_clk@48 {
+ 				compatible = "fixed-clock";
+--- a/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
++++ b/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
+@@ -27,7 +27,7 @@
+ 	};
+ 
+ 	fragment@1 {
+-		target-path = "/";
++		target = <&clocks>;
+ 		__overlay__ {
+ 			sc16is752_clk: sc16is752_i2c_clk@48 {
+ 				compatible = "fixed-clock";
diff --git a/target/linux/bcm27xx/patches-6.6/950-1527-overlays-Factor-out-the-common-i2c-bus-selection.patch b/target/linux/bcm27xx/patches-6.6/950-1527-overlays-Factor-out-the-common-i2c-bus-selection.patch
new file mode 100644
index 00000000000000..504e46376ad04f
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1527-overlays-Factor-out-the-common-i2c-bus-selection.patch
@@ -0,0 +1,1630 @@
+From a320d39840745502d420f56b3d49b3723a12058f Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Sun, 26 Jan 2025 22:08:16 +0000
+Subject: [PATCH] overlays: Factor out the common i2c bus selection
+
+Create an i2c-buses.dtsi to hold all of the common I2C bus selection
+logic, and refactor existing overlays to use it. This patch should
+have no functional change overall except to increase the range of
+options for some overlays.
+
+There is a slightly ugly mechanism for overriding the default bus, where
+the mux nodes may or may not need to be enabled.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README             | 264 ++++-------------
+ .../arm/boot/dts/overlays/ads1115-overlay.dts |  39 +--
+ .../boot/dts/overlays/edt-ft5406-overlay.dts  |  39 +--
+ arch/arm/boot/dts/overlays/edt-ft5406.dtsi    |   5 +-
+ arch/arm/boot/dts/overlays/i2c-buses.dtsi     |  67 +++++
+ .../arm/boot/dts/overlays/i2c-fan-overlay.dts |  45 +--
+ .../arm/boot/dts/overlays/i2c-mux-overlay.dts |  42 +--
+ .../dts/overlays/i2c-pwm-pca9685a-overlay.dts |  41 +--
+ .../arm/boot/dts/overlays/i2c-rtc-overlay.dts |  43 +--
+ .../boot/dts/overlays/i2c-sensor-overlay.dts  |  43 +--
+ .../boot/dts/overlays/mcp23017-overlay.dts    |  47 +--
+ .../arm/boot/dts/overlays/pca953x-overlay.dts | 277 +++---------------
+ .../arm/boot/dts/overlays/pcf857x-overlay.dts |  38 +--
+ .../dts/overlays/sc16is750-i2c-overlay.dts    |  37 +--
+ .../dts/overlays/sc16is752-i2c-overlay.dts    |  37 +--
+ .../overlays/seeed-can-fd-hat-v2-overlay.dts  |   9 +-
+ .../overlays/vc4-kms-dsi-7inch-overlay.dts    |  17 +-
+ .../vc4-kms-dsi-waveshare-800x480-overlay.dts |  15 +-
+ 18 files changed, 202 insertions(+), 903 deletions(-)
+ create mode 100644 arch/arm/boot/dts/overlays/i2c-buses.dtsi
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -568,6 +568,8 @@ Load:   dtoverlay=ads1115,<param>[=<val>
+ Params: addr                    I2C bus address of device. Set based on how the
+                                 addr pin is wired. (default=0x48 assumes addr
+                                 is pulled to GND)
++        i2c-bus                 Supports all the standard I2C bus selection
++                                parameters - see "dtoverlay -h i2c-bus"
+         cha_enable              Enable virtual channel a.
+         cha_cfg                 Set the configuration for virtual channel a.
+                                 (default=4 configures this channel for the
+@@ -577,22 +579,6 @@ Params: addr                    I2C bus
+         cha_gain                Set the gain of the Programmable Gain
+                                 Amplifier for this channel. (Default 1 sets the
+                                 full scale of the channel to 4.096 Volts)
+-        i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-        i2c_csi_dsi             Choose the I2C bus connected to the main
+-                                camera/display connector.
+-                                See "dtparam -h i2c_csi_dsi" for details.
+-        i2c_csi_dsi0            Choose the I2C bus connected to the second
+-                                camera/display connector, if present.
+-                                See "dtparam -h i2c_csi_dsi0" for details.
+-        i2c3                    Choose the I2C3 bus (configure with the i2c3
+-                                overlay - BCM2711 only)
+-        i2c4                    Choose the I2C4 bus (configure with the i2c4
+-                                overlay - BCM2711 only)
+-        i2c5                    Choose the I2C5 bus (configure with the i2c5
+-                                overlay - BCM2711 only)
+-        i2c6                    Choose the I2C6 bus (configure with the i2c6
+-                                overlay - BCM2711 only)
+-        i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
+         Channel parameters can be set for each enabled channel.
+         A maximum of 4 channels can be enabled (letters a thru d).
+@@ -1263,20 +1249,11 @@ Params: sizex                   Touchscr
+         invx                    Touchscreen inverted x axis
+         invy                    Touchscreen inverted y axis
+         swapxy                  Touchscreen swapped x y axis
+-        i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-        i2c1                    Choose the I2C1 bus on GPIOs 2&3
+-        i2c3                    Choose the I2C3 bus (configure with the i2c3
+-                                overlay - BCM2711 only)
+-        i2c4                    Choose the I2C4 bus (configure with the i2c4
+-                                overlay - BCM2711 only)
+-        i2c5                    Choose the I2C5 bus (configure with the i2c5
+-                                overlay - BCM2711 only)
+-        i2c6                    Choose the I2C6 bus (configure with the i2c6
+-                                overlay - BCM2711 only)
+         addr                    Sets the address for the touch controller. Note
+                                 that the device must be configured to use the
+                                 specified address.
+-        i2c-path                Override I2C path to allow for i2c-gpio buses
++        i2c-bus                 Supports all the standard I2C bus selection
++                                parameters - see "dtoverlay -h i2c-bus"
+ 
+ 
+ Name:   enc28j60
+@@ -2114,37 +2091,41 @@ Load:   dtoverlay=i2c-bcm2708
+ Params: <None>
+ 
+ 
+-Name:   i2c-fan
+-Info:   Adds support for a number of I2C fan controllers
+-Load:   dtoverlay=i2c-fan,<param>=<val>
+-Params: addr                    Sets the address for the fan controller. Note
+-                                that the device must be configured to use the
+-                                specified address.
+-
+-        i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-
+-        i2c_csi_dsi             Choose the I2C bus connected to the main
+-                                camera/display connector.
+-                                See "dtparam -h i2c_csi_dsi" for details.
+-
+-        i2c_csi_dsi0            Choose the I2C bus connected to the second
+-                                camera/display connector, if present.
+-                                See "dtparam -h i2c_csi_dsi0" for details.
+-
++Name:   i2c-bus
++Info:   This is not a real overlay. Many overlays support the use of a variety
++        of I2C buses, and this is where the relevant parameters are documented.
++Load:   <Documentation>
++Params: i2c0                    Choose the I2C0 bus on GPIOs 0&1
++        i2c1                    Choose the I2C1 bus on GPIOs 2&3
++        i2c2                    Choose the I2C2 bus (configure with the i2c2
++                                overlay - BCM2711 only)
+         i2c3                    Choose the I2C3 bus (configure with the i2c3
+                                 overlay - BCM2711 only)
+-
+         i2c4                    Choose the I2C4 bus (configure with the i2c4
+                                 overlay - BCM2711 only)
+-
+         i2c5                    Choose the I2C5 bus (configure with the i2c5
+                                 overlay - BCM2711 only)
+-
+         i2c6                    Choose the I2C6 bus (configure with the i2c6
+                                 overlay - BCM2711 only)
+-
++        i2c_csi_dsi             Choose the I2C bus connected to the main
++                                camera/display connector.
++                                See "dtparam -h i2c_csi_dsi" for details.
++        i2c_csi_dsi0            Choose the I2C bus connected to the second
++                                camera/display connector, if present.
++                                See "dtparam -h i2c_csi_dsi0" for details.
+         i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
++
++Name:   i2c-fan
++Info:   Adds support for a number of I2C fan controllers
++Load:   dtoverlay=i2c-fan,<param>=<val>
++Params: addr                    Sets the address for the fan controller. Note
++                                that the device must be configured to use the
++                                specified address.
++
++        i2c-bus                 Supports all the standard I2C bus selection
++                                parameters - see "dtoverlay -h i2c-bus"
++
+         minpwm                  PWM setting for the fan when the SoC is below
+                                 mintemp (range 0-255. default 0)
+         maxpwm                  PWM setting for the fan when the SoC is above
+@@ -2196,33 +2177,12 @@ Params: pca9542                 Select t
+ 
+         addr                    Change I2C address of the device (default 0x70)
+ 
++        i2c-bus                 Supports all the standard I2C bus selection
++                                parameters - see "dtoverlay -h i2c-bus"
++
+         base                    Set an explicit base value for the channel bus
+                                 numbers
+ 
+-        i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-
+-        i2c_csi_dsi             Choose the I2C bus connected to the main
+-                                camera/display connector.
+-                                See "dtparam -h i2c_csi_dsi" for details.
+-
+-        i2c_csi_dsi0            Choose the I2C bus connected to the second
+-                                camera/display connector, if present.
+-                                See "dtparam -h i2c_csi_dsi0" for details.
+-
+-        i2c3                    Choose the I2C3 bus (configure with the i2c3
+-                                overlay - BCM2711 only)
+-
+-        i2c4                    Choose the I2C3 bus (configure with the i2c3
+-                                overlay - BCM2711 only)
+-
+-        i2c5                    Choose the I2C5 bus (configure with the i2c4
+-                                overlay - BCM2711 only)
+-
+-        i2c6                    Choose the I2C6 bus (configure with the i2c6
+-                                overlay - BCM2711 only)
+-
+-        i2c-path                Override I2C path to allow for i2c-gpio buses
+-
+         disconnect_on_idle      Force the mux to disconnect all child buses
+                                 after every transaction.
+ 
+@@ -2234,22 +2194,8 @@ Name:   i2c-pwm-pca9685a
+ Info:   Adds support for an NXP PCA9685A I2C PWM controller on i2c_arm
+ Load:   dtoverlay=i2c-pwm-pca9685a,<param>=<val>
+ Params: addr                    I2C address of PCA9685A (default 0x40)
+-        i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-        i2c_csi_dsi             Choose the I2C bus connected to the main
+-                                camera/display connector.
+-                                See "dtparam -h i2c_csi_dsi" for details.
+-        i2c_csi_dsi0            Choose the I2C bus connected to the second
+-                                camera/display connector, if present.
+-                                See "dtparam -h i2c_csi_dsi0" for details.
+-        i2c3                    Choose the I2C3 bus (configure with the i2c3
+-                                overlay - BCM2711 only)
+-        i2c4                    Choose the I2C3 bus (configure with the i2c3
+-                                overlay - BCM2711 only)
+-        i2c5                    Choose the I2C5 bus (configure with the i2c4
+-                                overlay - BCM2711 only)
+-        i2c6                    Choose the I2C6 bus (configure with the i2c6
+-                                overlay - BCM2711 only)
+-        i2c-path                Override I2C path to allow for i2c-gpio buses
++        i2c-bus                 Supports all the standard I2C bus selection
++                                parameters - see "dtoverlay -h i2c-bus"
+ 
+ 
+ Name:   i2c-rtc
+@@ -2303,29 +2249,8 @@ Params: abx80x                  Select o
+ 
+         s35390a                 Select the ABLIC S35390A device
+ 
+-        i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-
+-        i2c_csi_dsi             Choose the I2C bus connected to the main
+-                                camera/display connector.
+-                                See "dtparam -h i2c_csi_dsi" for details.
+-
+-        i2c_csi_dsi0            Choose the I2C bus connected to the second
+-                                camera/display connector, if present.
+-                                See "dtparam -h i2c_csi_dsi0" for details.
+-
+-        i2c3                    Choose the I2C3 bus (configure with the i2c3
+-                                overlay - BCM2711 only)
+-
+-        i2c4                    Choose the I2C3 bus (configure with the i2c3
+-                                overlay - BCM2711 only)
+-
+-        i2c5                    Choose the I2C5 bus (configure with the i2c4
+-                                overlay - BCM2711 only)
+-
+-        i2c6                    Choose the I2C6 bus (configure with the i2c6
+-                                overlay - BCM2711 only)
+-
+-        i2c-path                Override I2C path to allow for i2c-gpio buses
++        i2c-bus                 Supports all the standard I2C bus selection
++                                parameters - see "dtoverlay -h i2c-bus"
+ 
+         addr                    Sets the address for the RTC. Note that the
+                                 device must be configured to use the specified
+@@ -2451,6 +2376,9 @@ Params: addr                    Set the
+                                 JC42, LM75, MCP980x, MPU6050, MPU9250, MS5637,
+                                 MS5803, MS5805, MS5837, MS8607, SHT3x or TMP102
+ 
++        i2c-bus                 Supports all the standard I2C bus selection
++                                parameters - see "dtoverlay -h i2c-bus"
++
+         adt7410                 Select the Analog Devices ADT7410 and ADT7420
+                                 temperature sensors
+                                 Valid address 0x48-0x4b, default 0x48
+@@ -2591,29 +2519,6 @@ Params: addr                    Set the
+         veml6070                Select the Vishay VEML6070 ultraviolet light
+                                 sensor
+ 
+-        i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-
+-        i2c_csi_dsi             Choose the I2C bus connected to the main
+-                                camera/display connector.
+-                                See "dtparam -h i2c_csi_dsi" for details.
+-        i2c_csi_dsi0            Choose the I2C bus connected to the second
+-                                camera/display connector, if present.
+-                                See "dtparam -h i2c_csi_dsi0" for details.
+-
+-        i2c3                    Choose the I2C3 bus (configure with the i2c3
+-                                overlay - BCM2711 only)
+-
+-        i2c4                    Choose the I2C3 bus (configure with the i2c3
+-                                overlay - BCM2711 only)
+-
+-        i2c5                    Choose the I2C5 bus (configure with the i2c4
+-                                overlay - BCM2711 only)
+-
+-        i2c6                    Choose the I2C6 bus (configure with the i2c6
+-                                overlay - BCM2711 only)
+-
+-        i2c-path                Override I2C path to allow for i2c-gpio buses
+-
+ 
+ Name:   i2c0
+ Info:   Change i2c0 pin usage. Not all pin combinations are usable on all
+@@ -3255,24 +3160,11 @@ Params: gpiopin                 Gpio pin
+ 
+         addr                    I2C address of the MCP23017 (default: 0x20)
+ 
++        i2c-bus                 Supports all the standard I2C bus selection
++                                parameters - see "dtoverlay -h i2c-bus"
++
+         mcp23008                Configure an MCP23008 instead.
+         noints                  Disable the interrupt GPIO line.
+-        i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-        i2c_csi_dsi             Choose the I2C bus connected to the main
+-                                camera/display connector.
+-                                See "dtparam -h i2c_csi_dsi" for details.
+-        i2c_csi_dsi0            Choose the I2C bus connected to the second
+-                                camera/display connector, if present.
+-                                See "dtparam -h i2c_csi_dsi0" for details.
+-        i2c3                    Choose the I2C3 bus (configure with the i2c3
+-                                overlay - BCM2711 only)
+-        i2c4                    Choose the I2C4 bus (configure with the i2c4
+-                                overlay - BCM2711 only)
+-        i2c5                    Choose the I2C5 bus (configure with the i2c5
+-                                overlay - BCM2711 only)
+-        i2c6                    Choose the I2C6 bus (configure with the i2c6
+-                                overlay - BCM2711 only)
+-        i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
+ 
+ Name:   mcp23s17
+@@ -3692,6 +3584,8 @@ Name:   pca953x
+ Info:   TI PCA953x family of I2C GPIO expanders. Default is for NXP PCA9534.
+ Load:   dtoverlay=pca953x,<param>=<val>
+ Params: addr                    I2C address of expander. Default 0x20.
++        i2c-bus                 Supports all the standard I2C bus selection
++                                parameters - see "dtoverlay -h i2c-bus"
+         pca6416                 Select the NXP PCA6416 (16 bit)
+         pca9505                 Select the NXP PCA9505 (40 bit)
+         pca9535                 Select the NXP PCA9535 (16 bit)
+@@ -3722,22 +3616,6 @@ Params: addr                    I2C addr
+         cat9554                 Select the Onnn CAT9554 (8 bit)
+         pca9654                 Select the Onnn PCA9654 (8 bit)
+         xra1202                 Select the Exar XRA1202 (8 bit)
+-        i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-        i2c_csi_dsi             Choose the I2C bus connected to the main
+-                                camera/display connector.
+-                                See "dtparam -h i2c_csi_dsi" for details.
+-        i2c_csi_dsi0            Choose the I2C bus connected to the second
+-                                camera/display connector, if present.
+-                                See "dtparam -h i2c_csi_dsi0" for details.
+-        i2c3                    Choose the I2C3 bus (configure with the i2c3
+-                                overlay - BCM2711 only)
+-        i2c4                    Choose the I2C3 bus (configure with the i2c3
+-                                overlay - BCM2711 only)
+-        i2c5                    Choose the I2C5 bus (configure with the i2c4
+-                                overlay - BCM2711 only)
+-        i2c6                    Choose the I2C6 bus (configure with the i2c6
+-                                overlay - BCM2711 only)
+-        i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
+ 
+ Name:   pcf857x
+@@ -3745,26 +3623,12 @@ Info:   NXP PCF857x family of I2C GPIO e
+ Load:   dtoverlay=pcf857x,<param>=<val>
+ Params: addr                    I2C address of expander. Default
+                                 depends on model selected.
++        i2c-bus                 Supports all the standard I2C bus selection
++                                parameters - see "dtoverlay -h i2c-bus"
+         pcf8574                 Select the NXP PCF8574 (8 bit)
+         pcf8574a                Select the NXP PCF8574A (8 bit)
+         pcf8575                 Select the NXP PCF8575 (16 bit)
+         pca8574                 Select the NXP PCA8574 (8 bit)
+-        i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-        i2c_csi_dsi             Choose the I2C bus connected to the main
+-                                camera/display connector.
+-                                See "dtparam -h i2c_csi_dsi" for details.
+-        i2c_csi_dsi0            Choose the I2C bus connected to the second
+-                                camera/display connector, if present.
+-                                See "dtparam -h i2c_csi_dsi0" for details.
+-        i2c3                    Choose the I2C3 bus (configure with the i2c3
+-                                overlay - BCM2711 only)
+-        i2c4                    Choose the I2C3 bus (configure with the i2c3
+-                                overlay - BCM2711 only)
+-        i2c5                    Choose the I2C5 bus (configure with the i2c4
+-                                overlay - BCM2711 only)
+-        i2c6                    Choose the I2C6 bus (configure with the i2c6
+-                                overlay - BCM2711 only)
+-        i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
+ 
+ Name:   pcie-32bit-dma
+@@ -4463,23 +4327,9 @@ Info:   Overlay for the NXP SC16IS750 UA
+ Load:   dtoverlay=sc16is750-i2c,<param>=<val>
+ Params: int_pin                 GPIO used for IRQ (default 24)
+         addr                    Address (default 0x48)
++        i2c-bus                 Supports all the standard I2C bus selection
++                                parameters - see "dtoverlay -h i2c-bus"
+         xtal                    On-board crystal frequency (default 14745600)
+-        i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-        i2c_csi_dsi             Choose the I2C bus connected to the main
+-                                camera/display connector.
+-                                See "dtparam -h i2c_csi_dsi" for details.
+-        i2c_csi_dsi0            Choose the I2C bus connected to the second
+-                                camera/display connector, if present.
+-                                See "dtparam -h i2c_csi_dsi0" for details.
+-        i2c3                    Choose the I2C3 bus (configure with the i2c3
+-                                overlay - BCM2711 only)
+-        i2c4                    Choose the I2C4 bus (configure with the i2c4
+-                                overlay - BCM2711 only)
+-        i2c5                    Choose the I2C5 bus (configure with the i2c5
+-                                overlay - BCM2711 only)
+-        i2c6                    Choose the I2C6 bus (configure with the i2c6
+-                                overlay - BCM2711 only)
+-        i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
+ 
+ Name:   sc16is750-spi0
+@@ -4497,23 +4347,9 @@ Info:   Overlay for the NXP SC16IS752 du
+ Load:   dtoverlay=sc16is752-i2c,<param>=<val>
+ Params: int_pin                 GPIO used for IRQ (default 24)
+         addr                    Address (default 0x48)
++        i2c-bus                 Supports all the standard I2C bus selection
++                                parameters - see "dtoverlay -h i2c-bus"
+         xtal                    On-board crystal frequency (default 14745600)
+-        i2c0                    Choose the I2C0 bus on GPIOs 0&1
+-        i2c_csi_dsi             Choose the I2C bus connected to the main
+-                                camera/display connector.
+-                                See "dtparam -h i2c_csi_dsi" for details.
+-        i2c_csi_dsi0            Choose the I2C bus connected to the second
+-                                camera/display connector, if present.
+-                                See "dtparam -h i2c_csi_dsi0" for details.
+-        i2c3                    Choose the I2C3 bus (configure with the i2c3
+-                                overlay - BCM2711 only)
+-        i2c4                    Choose the I2C4 bus (configure with the i2c4
+-                                overlay - BCM2711 only)
+-        i2c5                    Choose the I2C5 bus (configure with the i2c5
+-                                overlay - BCM2711 only)
+-        i2c6                    Choose the I2C6 bus (configure with the i2c6
+-                                overlay - BCM2711 only)
+-        i2c-path                Override I2C path to allow for i2c-gpio buses
+ 
+ 
+ Name:   sc16is752-spi0
+--- a/arch/arm/boot/dts/overlays/ads1115-overlay.dts
++++ b/arch/arm/boot/dts/overlays/ads1115-overlay.dts
+@@ -5,6 +5,8 @@
+ /dts-v1/;
+ /plugin/;
+ 
++#include "i2c-buses.dtsi"
++
+ / {
+ 	compatible = "brcm,bcm2835";
+ 
+@@ -81,27 +83,6 @@
+ 		};
+ 	};
+ 
+-	frag100: fragment@100 {
+-		target = <&i2c1>;
+-		i2cbus: __overlay__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@101 {
+-		target = <&i2c0if>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@102 {
+-		target = <&i2c0mux>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+ 	__overrides__ {
+ 		addr =            <&ads1115>,"reg:0";
+ 		cha_enable =      <0>,"=0";
+@@ -120,21 +101,5 @@
+ 		chd_cfg =         <&channel_d>,"reg:0";
+ 		chd_gain =        <&channel_d>,"ti,gain:0";
+ 		chd_datarate =    <&channel_d>,"ti,datarate:0";
+-		i2c0 = <&frag100>, "target:0=",<&i2c0>,
+-			      <0>,"+101+102";
+-		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+-			      <0>,"+101+102";
+-		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
+-			      <0>,"+101+102";
+-		i2c3 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c3";
+-		i2c4 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c4";
+-		i2c5 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c5";
+-		i2c6 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c6";
+-		i2c-path = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/edt-ft5406-overlay.dts
++++ b/arch/arm/boot/dts/overlays/edt-ft5406-overlay.dts
+@@ -7,43 +7,16 @@
+ /dts-v1/;
+ /plugin/;
+ 
++#define ENABLE_I2C0_MUX
++#include "i2c-buses.dtsi"
+ #include "edt-ft5406.dtsi"
+ 
+-/ {
+-	fragment@0 {
+-		target = <&i2c0if>;
+-		__overlay__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@1 {
+-		target = <&i2c0mux>;
+-		__overlay__ {
+-			status = "okay";
+-		};
+-	};
++&busfrag {
++	target = <&i2c_csi_dsi>;
++};
+ 
++/ {
+ 	__overrides__ {
+-		i2c0 = <&ts_i2c_frag>,"target:0=",<&i2c0>;
+-		i2c1 = <&ts_i2c_frag>, "target?=0",
+-		       <&ts_i2c_frag>, "target-path=i2c1",
+-		       <0>,"-0-1";
+-		i2c3 = <&ts_i2c_frag>, "target?=0",
+-		       <&ts_i2c_frag>, "target-path=i2c3",
+-		       <0>,"-0-1";
+-		i2c4 = <&ts_i2c_frag>, "target?=0",
+-		       <&ts_i2c_frag>, "target-path=i2c4",
+-		       <0>,"-0-1";
+-		i2c5 = <&ts_i2c_frag>, "target?=0",
+-		       <&ts_i2c_frag>, "target-path=i2c5",
+-		       <0>,"-0-1";
+-		i2c6 = <&ts_i2c_frag>, "target?=0",
+-		       <&ts_i2c_frag>, "target-path=i2c6",
+-		       <0>,"-0-1";
+-		i2c-path = <&ts_i2c_frag>, "target?=0",
+-		       <&ts_i2c_frag>, "target-path",
+-		       <0>,"-0-1";
+ 		addr = <&ft5406>,"reg:0";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/edt-ft5406.dtsi
++++ b/arch/arm/boot/dts/overlays/edt-ft5406.dtsi
+@@ -22,12 +22,11 @@
+ 		};
+ 	};
+ 
+-	ts_i2c_frag: fragment@12 {
+-		target = <&i2c_csi_dsi>;
++	fragment@12 {
++		target = <&i2cbus>;
+ 		__overlay__ {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			status = "okay";
+ 
+ 			ft5406: ts@38 {
+ 				compatible = "edt,edt-ft5506";
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/i2c-buses.dtsi
+@@ -0,0 +1,67 @@
++// Common i2c buses, and dtparams to select them
++
++/ {
++	compatible = "brcm,bcm2835";
++
++	busfrag: fragment@100 {
++		target = <&i2c_arm>;
++		i2cbus: __overlay__ {
++			status = "okay";
++		};
++	};
++
++	fragment@101 {
++		target = <&i2c0if>;
++#ifdef ENABLE_I2C0_MUX
++		__overlay__ {
++#else
++		__dormant__ {
++#endif
++			status = "okay";
++		};
++	};
++
++	fragment@102 {
++		target = <&i2c0mux>;
++#ifdef ENABLE_I2C0_MUX
++		__overlay__ {
++#else
++		__dormant__ {
++#endif
++			status = "okay";
++		};
++	};
++
++	__overrides__ {
++		i2c0 = <&busfrag>,"target:0=",<&i2c0>,
++			      <&busfrag>, "target-path?=0",
++			      <0>,"+101+102";
++		i2c_csi_dsi = <&busfrag>,"target:0=",<&i2c_csi_dsi>,
++			      <&busfrag>, "target-path?=0",
++			      <0>,"+101+102";
++		i2c_csi_dsi0 = <&busfrag>, "target:0=",<&i2c_csi_dsi0>,
++			       <&busfrag>, "target-path?=0",
++			       <0>,"+101+102";
++		i2c1 = <&busfrag>,"target:0=",<&i2c1>,
++		       <&busfrag>, "target-path?=0",
++		       <0>,"-101-102";
++		i2c2 = <&busfrag>, "target?=0",
++		       <&busfrag>, "target-path=i2c2",
++		       <0>,"-101-102";
++		i2c3 = <&busfrag>, "target?=0",
++		       <&busfrag>, "target-path=i2c3",
++		       <0>,"-101-102";
++		i2c4 = <&busfrag>, "target?=0",
++		       <&busfrag>, "target-path=i2c4",
++		       <0>,"-101-102";
++		i2c5 = <&busfrag>, "target?=0",
++		       <&busfrag>, "target-path=i2c5",
++		       <0>,"-101-102";
++		i2c6 = <&busfrag>, "target?=0",
++		       <&busfrag>, "target-path=i2c6",
++		       <0>,"-101-102";
++		i2c-path = <&busfrag>, "target?=0",
++			   <&busfrag>, "target-path",
++			   <0>,"-101-102";
++	};
++};
+--- a/arch/arm/boot/dts/overlays/i2c-fan-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-fan-overlay.dts
+@@ -4,6 +4,8 @@
+ 
+ #include <dt-bindings/thermal/thermal.h>
+ 
++#include "i2c-buses.dtsi"
++
+ / {
+ 	compatible = "brcm,bcm2835";
+ 
+@@ -22,35 +24,14 @@
+ 		};
+ 	};
+ 
+-	frag100: fragment@100 {
+-		target = <&i2c_arm>;
+-		i2cbus: __overlay__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@101 {
+-		target = <&i2c0if>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@102 {
+-		target = <&i2c0mux>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@103 {
++	fragment@1 {
+ 		target = <&cpu_thermal>;
+ 		__overlay__ {
+ 			polling-delay = <2000>; /* milliseconds */
+ 		};
+ 	};
+ 
+-	fragment@104 {
++	fragment@2 {
+ 		target = <&thermal_trips>;
+ 		__overlay__ {
+ 			fanmid0: fanmid0 {
+@@ -66,7 +47,7 @@
+ 		};
+ 	};
+ 
+-	fragment@105 {
++	fragment@3 {
+ 		target = <&cooling_maps>;
+ 		__overlay__ {
+ 			map0: map0 {
+@@ -81,22 +62,6 @@
+ 	};
+ 
+ 	__overrides__ {
+-		i2c0 =		<&frag100>,"target:0=",<&i2c0>,
+-				<0>,"+101+102";
+-		i2c_csi_dsi =	<&frag100>,"target:0=",<&i2c_csi_dsi>,
+-				<0>,"+101+102";
+-		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
+-			      <0>,"+101+102";
+-		i2c3 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c3";
+-		i2c4 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c4";
+-		i2c5 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c5";
+-		i2c6 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c6";
+-		i2c-path = <&frag100>, "target?=0",
+-			   <&frag100>, "target-path";
+ 		addr =		<&emc2301>,"reg:0";
+ 		minpwm =	<&emc2301>,"emc2305,pwm-min.0";
+ 		maxpwm =	<&emc2301>,"emc2305,pwm-max.0";
+--- a/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-mux-overlay.dts
+@@ -5,6 +5,8 @@
+ 
+ #include <dt-bindings/mux/mux.h>
+ 
++#include "i2c-buses.dtsi"
++
+ /{
+ 	compatible = "brcm,bcm2835";
+ 
+@@ -13,7 +15,6 @@
+ 		__dormant__ {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			status = "okay";
+ 
+ 			pca9542: mux@70 {
+ 				compatible = "nxp,pca9542";
+@@ -40,7 +41,6 @@
+ 		__dormant__ {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			status = "okay";
+ 
+ 			pca9545: mux@70 {
+ 				compatible = "nxp,pca9545";
+@@ -77,7 +77,6 @@
+ 		__dormant__ {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			status = "okay";
+ 
+ 			pca9548: mux@70 {
+ 				compatible = "nxp,pca9548";
+@@ -129,27 +128,6 @@
+ 		};
+ 	};
+ 
+-	frag100: fragment@100 {
+-		target = <&i2c_arm>;
+-		i2cbus: __overlay__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@101 {
+-		target = <&i2c0if>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@102 {
+-		target = <&i2c0mux>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+ 	__overrides__ {
+ 		pca9542 = <0>, "+0";
+ 		pca9545 = <0>, "+1";
+@@ -163,22 +141,6 @@
+ 			<&pca9545>,"base-nr:0",
+ 			<&pca9548>,"base-nr:0";
+ 
+-		i2c0 = <&frag100>, "target:0=",<&i2c0>,
+-			      <0>,"+101+102";
+-		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+-			      <0>,"+101+102";
+-		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
+-			      <0>,"+101+102";
+-		i2c3 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c3";
+-		i2c4 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c4";
+-		i2c5 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c5";
+-		i2c6 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c6";
+-		i2c-path = <&frag100>, "target?=0",
+-			   <&frag100>, "target-path";
+ 		disconnect_on_idle =
+ 			<&pca9542>,"idle-state:0=", <MUX_IDLE_DISCONNECT>,
+ 			<&pca9545>,"idle-state:0=", <MUX_IDLE_DISCONNECT>,
+--- a/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-pwm-pca9685a-overlay.dts
+@@ -2,6 +2,8 @@
+ /dts-v1/;
+ /plugin/;
+ 
++#include "i2c-buses.dtsi"
++
+ /{
+ 	compatible = "brcm,bcm2835";
+ 
+@@ -10,7 +12,6 @@
+ 		__overlay__ {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			status = "okay";
+ 
+ 			pca: pca@40 {
+ 				compatible = "nxp,pca9685-pwm";
+@@ -21,45 +22,7 @@
+ 		};
+ 	};
+ 
+-
+-	frag100: fragment@100 {
+-		target = <&i2c_arm>;
+-		i2cbus: __overlay__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@101 {
+-		target = <&i2c0if>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@102 {
+-		target = <&i2c0mux>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+ 	__overrides__ {
+ 		addr = <&pca>,"reg:0";
+-		i2c0 = <&frag100>, "target:0=",<&i2c0>,
+-			      <0>,"+101+102";
+-		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+-			      <0>,"+101+102";
+-		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
+-			      <0>,"+101+102";
+-		i2c3 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c3";
+-		i2c4 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c4";
+-		i2c5 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c5";
+-		i2c6 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c6";
+-		i2c-path = <&frag100>, "target?=0",
+-			   <&frag100>, "target-path";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-rtc-overlay.dts
+@@ -3,45 +3,4 @@
+ /plugin/;
+ 
+ #include "i2c-rtc-common.dtsi"
+-
+-/ {
+-	frag100: fragment@100 {
+-		target = <&i2c_arm>;
+-		i2cbus: __overlay__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@101 {
+-		target = <&i2c0if>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@102 {
+-		target = <&i2c0mux>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	__overrides__ {
+-		i2c0 = <&frag100>, "target:0=",<&i2c0>,
+-			      <0>,"+101+102";
+-		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+-			      <0>,"+101+102";
+-		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
+-			      <0>,"+101+102";
+-		i2c3 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c3";
+-		i2c4 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c4";
+-		i2c5 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c5";
+-		i2c6 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c6";
+-		i2c-path = <&frag100>, "target?=0",
+-			   <&frag100>, "target-path";
+-	};
+-};
++#include "i2c-buses.dtsi"
+--- a/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
++++ b/arch/arm/boot/dts/overlays/i2c-sensor-overlay.dts
+@@ -3,45 +3,4 @@
+ /plugin/;
+ 
+ #include "i2c-sensor-common.dtsi"
+-
+-/ {
+-	frag100: fragment@100 {
+-		target = <&i2c_arm>;
+-		i2cbus: __overlay__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@101 {
+-		target = <&i2c0if>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@102 {
+-		target = <&i2c0mux>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	__overrides__ {
+-		i2c0 = <&frag100>, "target:0=",<&i2c0>,
+-			      <0>,"+101+102";
+-		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+-			      <0>,"+101+102";
+-		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
+-			      <0>,"+101+102";
+-		i2c3 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c3";
+-		i2c4 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c4";
+-		i2c5 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c5";
+-		i2c6 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c6";
+-		i2c-path = <&frag100>, "target?=0",
+-			   <&frag100>, "target-path";
+-	};
+-};
++#include "i2c-buses.dtsi"
+--- a/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
++++ b/arch/arm/boot/dts/overlays/mcp23017-overlay.dts
+@@ -3,16 +3,11 @@
+ /dts-v1/;
+ /plugin/;
+ 
++#include "i2c-buses.dtsi"
++
+ / {
+ 	compatible = "brcm,bcm2835";
+ 
+-	fragment@0 {
+-		target = <&i2cbus>;
+-		__overlay__ {
+-			status = "okay";
+-		};
+-	};
+-
+ 	fragment@1 {
+ 		target = <&gpio>;
+ 		__overlay__ {
+@@ -60,49 +55,11 @@
+ 		};
+ 	};
+ 
+-	frag100: fragment@100 {
+-		target = <&i2c1>;
+-		i2cbus: __overlay__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@101 { 
+-		target = <&i2c0if>; 
+-		__dormant__ { 
+-			status = "okay"; 
+-		}; 
+-	};
+-
+-	fragment@102 { 
+-		target = <&i2c0mux>; 
+-		__dormant__ { 
+-			status = "okay"; 
+-		}; 
+-	};
+-
+ 	__overrides__ {
+ 		gpiopin = <&mcp23017_pins>,"brcm,pins:0",
+ 				<&mcp23017_irq>,"interrupts:0";
+ 		addr = <&mcp23017>,"reg:0", <&mcp23017_pins>,"reg:0";
+ 		mcp23008 = <0>,"=2";
+ 		noints = <0>,"!1!3";
+-		i2c0 = <&frag100>, "target:0=",<&i2c0>,
+-			      <0>,"+101+102";
+-		i2c_csi_dsi = <&frag100>, "target:0=",<&i2c_csi_dsi>,
+-			      <0>,"+101+102";
+-		i2c_csi_dsi0 = <&frag100>, "target:0=",<&i2c_csi_dsi0>,
+-			      <0>,"+101+102";
+-		i2c3 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c3";
+-		i2c4 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c4";
+-		i2c5 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c5";
+-		i2c6 = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path=i2c6";
+-		i2c-path = <&frag100>, "target?=0",
+-		       <&frag100>, "target-path";
+ 	};
+ };
+-
+--- a/arch/arm/boot/dts/overlays/pca953x-overlay.dts
++++ b/arch/arm/boot/dts/overlays/pca953x-overlay.dts
+@@ -2,11 +2,13 @@
+ /dts-v1/;
+ /plugin/;
+ 
++#include "i2c-buses.dtsi"
++
+ /{
+ 	compatible = "brcm,bcm2835";
+ 
+-	frag0: fragment@0 {
+-		target = <&i2c_arm>;
++	fragment@0 {
++		target = <&i2cbus>;
+ 		__overlay__ {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+@@ -21,248 +23,37 @@
+ 		};
+ 	};
+ 
+-	fragment@1 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "nxp,pca6416";
+-		};
+-	};
+-	fragment@2 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "nxp,pca9505";
+-		};
+-	};
+-	fragment@3 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "nxp,pca9535";
+-		};
+-	};
+-	fragment@4 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "nxp,pca9536";
+-		};
+-	};
+-	fragment@5 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "nxp,pca9537";
+-		};
+-	};
+-	fragment@6 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "nxp,pca9538";
+-		};
+-	};
+-	fragment@7 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "nxp,pca9539";
+-		};
+-	};
+-	fragment@8 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "nxp,pca9554";
+-		};
+-	};
+-	fragment@9 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "nxp,pca9555";
+-		};
+-	};
+-	fragment@10 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "nxp,pca9556";
+-		};
+-	};
+-	fragment@11 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "nxp,pca9557";
+-		};
+-	};
+-	fragment@12 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "nxp,pca9574";
+-		};
+-	};
+-	fragment@13 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "nxp,pca9575";
+-		};
+-	};
+-	fragment@14 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "nxp,pca9698";
+-		};
+-	};
+-	fragment@15 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "nxp,pcal6416";
+-		};
+-	};
+-	fragment@16 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "nxp,pcal6524";
+-		};
+-	};
+-	fragment@17 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "nxp,pcal9555a";
+-		};
+-	};
+-	fragment@18 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "maxim,max7310";
+-		};
+-	};
+-	fragment@19 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "maxim,max7312";
+-		};
+-	};
+-	fragment@20 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "maxim,max7313";
+-		};
+-	};
+-	fragment@21 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "maxim,max7315";
+-		};
+-	};
+-	fragment@22 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "ti,pca6107";
+-		};
+-	};
+-	fragment@23 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "ti,tca6408";
+-		};
+-	};
+-	fragment@24 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "ti,tca6416";
+-		};
+-	};
+-	fragment@25 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "ti,tca6424";
+-		};
+-	};
+-	fragment@26 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "ti,tca9539";
+-		};
+-	};
+-	fragment@27 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "ti,tca9554";
+-		};
+-	};
+-	fragment@28 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "onnn,cat9554";
+-		};
+-	};
+-	fragment@29 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "onnn,pca9654";
+-		};
+-	};
+-	fragment@30 {
+-		target = <&pca>;
+-		__dormant__ {
+-			compatible = "exar,xra1202";
+-		};
+-	};
+-
+-	fragment@100 {
+-		target = <&i2c0if>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@101 {
+-		target = <&i2c0mux>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+ 	__overrides__ {
+ 		addr = <&pca>,"reg:0";
+-		pca6416 = <0>, "+1";
+-		pca9505 = <0>, "+2";
+-		pca9535 = <0>, "+3";
+-		pca9536 = <0>, "+4";
+-		pca9537 = <0>, "+5";
+-		pca9538 = <0>, "+6";
+-		pca9539 = <0>, "+7";
+-		pca9554 = <0>, "+8";
+-		pca9555 = <0>, "+9";
+-		pca9556 = <0>, "+10";
+-		pca9557 = <0>, "+11";
+-		pca9574 = <0>, "+12";
+-		pca9575 = <0>, "+13";
+-		pca9698 = <0>, "+14";
+-		pcal6416 = <0>, "+15";
+-		pcal6524 = <0>, "+16";
+-		pcal9555a = <0>, "+17";
+-		max7310 = <0>, "+18";
+-		max7312 = <0>, "+19";
+-		max7313 = <0>, "+20";
+-		max7315 = <0>, "+21";
+-		pca6107 = <0>, "+22";
+-		tca6408 = <0>, "+23";
+-		tca6416 = <0>, "+24";
+-		tca6424 = <0>, "+25";
+-		tca9539 = <0>, "+26";
+-		tca9554 = <0>, "+27";
+-		cat9554 = <0>, "+28";
+-		pca9654 = <0>, "+29";
+-		xra1202 = <0>, "+30";
+-		i2c0 = <&frag0>, "target:0=",<&i2c0>,
+-			      <0>,"+100+101";
+-		i2c_csi_dsi = <&frag0>, "target:0=",<&i2c_csi_dsi>,
+-			      <0>,"+100+101";
+-		i2c_csi_dsi0 = <&frag0>, "target:0=",<&i2c_csi_dsi0>,
+-			      <0>,"+100+101";
+-		i2c3 = <&frag0>, "target?=0",
+-		       <&frag0>, "target-path=i2c3";
+-		i2c4 = <&frag0>, "target?=0",
+-		       <&frag0>, "target-path=i2c4";
+-		i2c5 = <&frag0>, "target?=0",
+-		       <&frag0>, "target-path=i2c5";
+-		i2c6 = <&frag0>, "target?=0",
+-		       <&frag0>, "target-path=i2c6";
+-		i2c-path = <&frag0>, "target?=0",
+-			   <&frag0>, "target-path";
++		pca6416 = <&pca>,"compatible=nxp,pca6416";
++		pca9505 = <&pca>,"compatible=nxp,pca9505";
++		pca9535 = <&pca>,"compatible=nxp,pca9535";
++		pca9536 = <&pca>,"compatible=nxp,pca9536";
++		pca9537 = <&pca>,"compatible=nxp,pca9537";
++		pca9538 = <&pca>,"compatible=nxp,pca9538";
++		pca9539 = <&pca>,"compatible=nxp,pca9539";
++		pca9554 = <&pca>,"compatible=nxp,pca9554";
++		pca9555 = <&pca>,"compatible=nxp,pca9555";
++		pca9556 = <&pca>,"compatible=nxp,pca9556";
++		pca9557 = <&pca>,"compatible=nxp,pca9557";
++		pca9574 = <&pca>,"compatible=nxp,pca9574";
++		pca9575 = <&pca>,"compatible=nxp,pca9575";
++		pca9698 = <&pca>,"compatible=nxp,pca9698";
++		pcal6416 = <&pca>,"compatible=nxp,pcal6416";
++		pcal6524 = <&pca>,"compatible=nxp,pcal6524";
++		pcal9555a = <&pca>,"compatible=nxp,pcal9555a";
++		max7310 = <&pca>,"compatible=maxim,max7310";
++		max7312 = <&pca>,"compatible=maxim,max7312";
++		max7313 = <&pca>,"compatible=maxim,max7313";
++		max7315 = <&pca>,"compatible=maxim,max7315";
++		pca6107 = <&pca>,"compatible=ti,pca6107";
++		tca6408 = <&pca>,"compatible=ti,tca6408";
++		tca6416 = <&pca>,"compatible=ti,tca6416";
++		tca6424 = <&pca>,"compatible=ti,tca6424";
++		tca9539 = <&pca>,"compatible=ti,tca9539";
++		tca9554 = <&pca>,"compatible=ti,tca9554";
++		cat9554 = <&pca>,"compatible=onnn,cat9554";
++		pca9654 = <&pca>,"compatible=onnn,pca9654";
++		xra1202 = <&pca>,"compatible=exar,xra1202";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/pcf857x-overlay.dts
++++ b/arch/arm/boot/dts/overlays/pcf857x-overlay.dts
+@@ -3,11 +3,13 @@
+ /dts-v1/;
+ /plugin/;
+ 
++#include "i2c-buses.dtsi"
++
+ / {
+ 	compatible = "brcm,bcm2835";
+ 
+-	frag0: fragment@0 {
+-		target = <&i2c_arm>;
++	fragment@0 {
++		target = <&i2cbus>;
+ 		__overlay__ {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+@@ -22,41 +24,11 @@
+ 		};
+ 	};
+ 
+-	fragment@100 {
+-		target = <&i2c0if>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@101 {
+-		target = <&i2c0mux>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+ 	__overrides__ {
+ 		pcf8574  = <&pcf857x>,"compatible=nxp,pcf8574",  <&pcf857x>,"reg:0=0x20";
+ 		pcf8574a = <&pcf857x>,"compatible=nxp,pcf8574a", <&pcf857x>,"reg:0=0x38";
+ 		pcf8575  = <&pcf857x>,"compatible=nxp,pcf8575",  <&pcf857x>,"reg:0=0x20";
+-		pca8574  = <&pcf857x>,"compatible=nxp,pca8574", <&pcf857x>,"reg:0=0x20";
++		pca8574  = <&pcf857x>,"compatible=nxp,pca8574",  <&pcf857x>,"reg:0=0x20";
+ 		addr = <&pcf857x>,"reg:0";
+-		i2c0 = <&frag0>, "target:0=",<&i2c0>,
+-			      <0>,"+100+101";
+-		i2c_csi_dsi = <&frag0>, "target:0=",<&i2c_csi_dsi>,
+-			      <0>,"+100+101";
+-		i2c_csi_dsi0 = <&frag0>, "target:0=",<&i2c_csi_dsi0>,
+-			      <0>,"+100+101";
+-		i2c3 = <&frag0>, "target?=0",
+-		       <&frag0>, "target-path=i2c3";
+-		i2c4 = <&frag0>, "target?=0",
+-		       <&frag0>, "target-path=i2c4";
+-		i2c5 = <&frag0>, "target?=0",
+-		       <&frag0>, "target-path=i2c5";
+-		i2c6 = <&frag0>, "target?=0",
+-		       <&frag0>, "target-path=i2c6";
+-		i2c-path = <&frag0>, "target?=0",
+-			   <&frag0>, "target-path";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
++++ b/arch/arm/boot/dts/overlays/sc16is750-i2c-overlay.dts
+@@ -1,15 +1,16 @@
+ /dts-v1/;
+ /plugin/;
+ 
++#include "i2c-buses.dtsi"
++
+ / {
+ 	compatible = "brcm,bcm2835";
+ 
+-	frag0: fragment@0 {
+-		target = <&i2c_arm>;
++	fragment@0 {
++		target = <&i2cbus>;
+ 		__overlay__ {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			status = "okay";
+ 
+ 			sc16is750: sc16is750@48 {
+ 				compatible = "nxp,sc16is750";
+@@ -48,40 +49,10 @@
+ 		};
+ 	};
+ 
+-	fragment@100 {
+-		target = <&i2c0if>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@101 {
+-		target = <&i2c0mux>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+ 	__overrides__ {
+ 		int_pin = <&sc16is750>,"interrupts:0", <&int_pins>,"brcm,pins:0",
+ 			  <&int_pins>,"reg:0";
+ 		addr = <&sc16is750>,"reg:0", <&sc16is750_clk>,"name";
+ 		xtal = <&sc16is750_clk>,"clock-frequency:0";
+-		i2c0 = <&frag0>, "target:0=",<&i2c0>,
+-			      <0>,"+100+101";
+-		i2c_csi_dsi = <&frag0>, "target:0=",<&i2c_csi_dsi>,
+-			      <0>,"+100+101";
+-		i2c_csi_dsi0 = <&frag0>, "target:0=",<&i2c_csi_dsi0>,
+-			      <0>,"+100+101";
+-		i2c3 = <&frag0>, "target?=0",
+-		       <&frag0>, "target-path=i2c3";
+-		i2c4 = <&frag0>, "target?=0",
+-		       <&frag0>, "target-path=i2c4";
+-		i2c5 = <&frag0>, "target?=0",
+-		       <&frag0>, "target-path=i2c5";
+-		i2c6 = <&frag0>, "target?=0",
+-		       <&frag0>, "target-path=i2c6";
+-		i2c-path = <&frag0>, "target?=0",
+-			   <&frag0>, "target-path";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
++++ b/arch/arm/boot/dts/overlays/sc16is752-i2c-overlay.dts
+@@ -1,15 +1,16 @@
+ /dts-v1/;
+ /plugin/;
+ 
++#include "i2c-buses.dtsi"
++
+ / {
+ 	compatible = "brcm,bcm2835";
+ 
+-	frag0: fragment@0 {
+-		target = <&i2c_arm>;
++	fragment@0 {
++		target = <&i2cbus>;
+ 		__overlay__ {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+-			status = "okay";
+ 
+ 			sc16is752: sc16is752@48 {
+ 				compatible = "nxp,sc16is752";
+@@ -48,40 +49,10 @@
+ 		};
+ 	};
+ 
+-	fragment@100 {
+-		target = <&i2c0if>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+-	fragment@101 {
+-		target = <&i2c0mux>;
+-		__dormant__ {
+-			status = "okay";
+-		};
+-	};
+-
+ 	__overrides__ {
+ 		int_pin = <&sc16is752>,"interrupts:0", <&int_pins>,"brcm,pins:0",
+ 			  <&int_pins>,"reg:0";
+ 		addr = <&sc16is752>,"reg:0",<&sc16is752_clk>,"name";
+ 		xtal = <&sc16is752_clk>,"clock-frequency:0";
+-		i2c0 = <&frag0>, "target:0=",<&i2c0>,
+-			      <0>,"+100+101";
+-		i2c_csi_dsi = <&frag0>, "target:0=",<&i2c_csi_dsi>,
+-			      <0>,"+100+101";
+-		i2c_csi_dsi0 = <&frag0>, "target:0=",<&i2c_csi_dsi0>,
+-			      <0>,"+100+101";
+-		i2c3 = <&frag0>, "target?=0",
+-		       <&frag0>, "target-path=i2c3";
+-		i2c4 = <&frag0>, "target?=0",
+-		       <&frag0>, "target-path=i2c4";
+-		i2c5 = <&frag0>, "target?=0",
+-		       <&frag0>, "target-path=i2c5";
+-		i2c6 = <&frag0>, "target?=0",
+-		       <&frag0>, "target-path=i2c6";
+-		i2c-path = <&frag0>, "target?=0",
+-			   <&frag0>, "target-path";
+ 	};
+ };
+--- a/arch/arm/boot/dts/overlays/seeed-can-fd-hat-v2-overlay.dts
++++ b/arch/arm/boot/dts/overlays/seeed-can-fd-hat-v2-overlay.dts
+@@ -98,8 +98,9 @@
+ 		};
+ 	};
+ 	fragment@8 {
+-		target = <&i2cbus>;
++		target = <&i2c_arm>;
+ 		__overlay__ {
++			status = "okay";
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 			pcf85063@51 {
+@@ -108,10 +109,4 @@
+ 			};
+ 		};
+ 	};
+-	fragment@9 {
+-		target = <&i2c_arm>;
+-		i2cbus: __overlay__ {
+-			status = "okay";
+-		};
+-	};
+ };
+--- a/arch/arm/boot/dts/overlays/vc4-kms-dsi-7inch-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-7inch-overlay.dts
+@@ -1,4 +1,4 @@
+-/*
++ /*
+  * Device Tree overlay for RaspberryPi 7" Touchscreen panel
+  *
+  */
+@@ -8,6 +8,11 @@
+ 
+ #include "edt-ft5406.dtsi"
+ 
++&ft5406 {
++	vcc-supply = <&reg_display>;
++	reset-gpio = <&reg_display 1 1>;
++};
++
+ / {
+ 	/* No compatible as it will have come from edt-ft5406.dtsi */
+ 
+@@ -77,7 +82,7 @@
+ 
+ 	i2c_frag: fragment@2 {
+ 		target = <&i2c_csi_dsi>;
+-		__overlay__ {
++		i2cbus: __overlay__ {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 			status = "okay";
+@@ -104,18 +109,10 @@
+ 			status = "okay";
+ 		};
+ 	};
+-	fragment@5 {
+-		target = <&ft5406>;
+-		__overlay__ {
+-			vcc-supply = <&reg_display>;
+-			reset-gpio = <&reg_display 1 1>;
+-		};
+-	};
+ 
+ 	__overrides__ {
+ 		dsi0 = <&dsi_frag>, "target:0=",<&dsi0>,
+ 		       <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
+-		       <&ts_i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
+ 		       <&panel_disp>, "reg:0=0",
+ 		       <&reg_bridge>, "reg:0=0",
+ 		       <&reg_bridge>, "regulator-name=bridge_reg_0";
+--- a/arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-800x480-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dsi-waveshare-800x480-overlay.dts
+@@ -9,6 +9,11 @@
+ 
+ #include "edt-ft5406.dtsi"
+ 
++&ft5406 {
++	vcc-supply = <&reg_display>;
++	reset-gpio = <&reg_display 1 1>;
++};
++
+ / {
+ 	/* No compatible as it will have come from edt-ft5406.dtsi */
+ 
+@@ -73,7 +78,7 @@
+ 
+ 	i2c_frag: fragment@2 {
+ 		target = <&i2c_csi_dsi>;
+-		__overlay__ {
++		i2cbus: __overlay__ {
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 			status = "okay";
+@@ -100,18 +105,10 @@
+ 			status = "okay";
+ 		};
+ 	};
+-	fragment@5 {
+-		target = <&ft5406>;
+-		__overlay__ {
+-			vcc-supply = <&reg_display>;
+-			reset-gpio = <&reg_display 1 1>;
+-		};
+-	};
+ 
+ 	__overrides__ {
+ 		dsi0 = <&dsi_frag>, "target:0=",<&dsi0>,
+ 		       <&i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
+-		       <&ts_i2c_frag>, "target:0=",<&i2c_csi_dsi0>,
+ 		       <&reg_bridge>, "reg:0=0",
+ 		       <&reg_bridge>, "regulator-name=bridge_reg_0";
+ 		disable_touch = <&ft5406>, "status=disabled";
diff --git a/target/linux/bcm27xx/patches-6.6/950-1529-misc-rp1-pio-SM_CONFIG_XFER32-larger-DMA-bufs.patch b/target/linux/bcm27xx/patches-6.6/950-1529-misc-rp1-pio-SM_CONFIG_XFER32-larger-DMA-bufs.patch
new file mode 100644
index 00000000000000..a084ec698b03dd
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1529-misc-rp1-pio-SM_CONFIG_XFER32-larger-DMA-bufs.patch
@@ -0,0 +1,63 @@
+From 8a08b4ad6dbd48a826b3052e52a4fdc88c3ac36e Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Thu, 30 Jan 2025 15:26:39 +0000
+Subject: [PATCH] misc: rp1-pio: SM_CONFIG_XFER32 = larger DMA bufs
+
+Add an ioctl type - SM_CONFIG_XFER32 - that takes uints for the buf_size
+and buf_count values.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/rp1-pio.c         | 9 +++++++++
+ include/uapi/misc/rp1_pio_if.h | 8 ++++++++
+ 2 files changed, 17 insertions(+)
+
+--- a/drivers/misc/rp1-pio.c
++++ b/drivers/misc/rp1-pio.c
+@@ -710,6 +710,14 @@ static int rp1_pio_sm_config_xfer_user(s
+ 					       args->buf_size, args->buf_count);
+ }
+ 
++static int rp1_pio_sm_config_xfer32_user(struct rp1_pio_client *client, void *param)
++{
++	struct rp1_pio_sm_config_xfer32_args *args = param;
++
++	return rp1_pio_sm_config_xfer_internal(client, args->sm, args->dir,
++					       args->buf_size, args->buf_count);
++}
++
+ static int rp1_pio_sm_tx_user(struct rp1_pio_device *pio, struct dma_info *dma,
+ 				  const void __user *userbuf, size_t bytes)
+ {
+@@ -970,6 +978,7 @@ struct handler_info {
+ 	HANDLER(SM_CONFIG_XFER, sm_config_xfer_user),
+ 	HANDLER(SM_XFER_DATA, sm_xfer_data_user),
+ 	HANDLER(SM_XFER_DATA32, sm_xfer_data32_user),
++	HANDLER(SM_CONFIG_XFER32, sm_config_xfer32_user),
+ 
+ 	HANDLER(CAN_ADD_PROGRAM, can_add_program),
+ 	HANDLER(ADD_PROGRAM, add_program),
+--- a/include/uapi/misc/rp1_pio_if.h
++++ b/include/uapi/misc/rp1_pio_if.h
+@@ -160,6 +160,13 @@ struct rp1_pio_sm_config_xfer_args {
+ 	uint16_t buf_count;
+ };
+ 
++struct rp1_pio_sm_config_xfer32_args {
++	uint16_t sm;
++	uint16_t dir;
++	uint32_t buf_size;
++	uint32_t buf_count;
++};
++
+ struct rp1_pio_sm_xfer_data_args {
+ 	uint16_t sm;
+ 	uint16_t dir;
+@@ -185,6 +192,7 @@ struct rp1_access_hw_args {
+ #define PIO_IOC_SM_CONFIG_XFER _IOW(PIO_IOC_MAGIC, 0, struct rp1_pio_sm_config_xfer_args)
+ #define PIO_IOC_SM_XFER_DATA _IOW(PIO_IOC_MAGIC, 1, struct rp1_pio_sm_xfer_data_args)
+ #define PIO_IOC_SM_XFER_DATA32 _IOW(PIO_IOC_MAGIC, 2, struct rp1_pio_sm_xfer_data32_args)
++#define PIO_IOC_SM_CONFIG_XFER32 _IOW(PIO_IOC_MAGIC, 3, struct rp1_pio_sm_config_xfer32_args)
+ 
+ #define PIO_IOC_READ_HW _IOW(PIO_IOC_MAGIC, 8, struct rp1_access_hw_args)
+ #define PIO_IOC_WRITE_HW _IOW(PIO_IOC_MAGIC, 9, struct rp1_access_hw_args)
diff --git a/target/linux/bcm27xx/patches-6.6/950-1530-spi-dw-Wait-for-idle-after-TX.patch b/target/linux/bcm27xx/patches-6.6/950-1530-spi-dw-Wait-for-idle-after-TX.patch
new file mode 100644
index 00000000000000..fa32b711960def
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1530-spi-dw-Wait-for-idle-after-TX.patch
@@ -0,0 +1,29 @@
+From 54a442deb925c37346abbbcc566234757925910c Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 3 Feb 2025 17:50:20 +0000
+Subject: [PATCH] spi: dw: Wait for idle after TX
+
+If this is a DMA transfer, and if there is no simultaneous RX transfer,
+wait for the interface to go idle before reporting that TX is done.
+
+Link: https://forums.raspberrypi.com/viewtopic.php?t=383027
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spi-dw-dma.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/spi/spi-dw-dma.c
++++ b/drivers/spi/spi-dw-dma.c
+@@ -304,6 +304,11 @@ static int dw_spi_dma_wait_tx_done(struc
+ 		return -EIO;
+ 	}
+ 
++	if (!xfer->rx_buf) {
++		while (dw_readl(dws, DW_SPI_SR) & DW_SPI_SR_BUSY)
++			cpu_relax();
++	}
++
+ 	return 0;
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1531-misc-rp1-pio-Error-out-on-incompatible-firmware.patch b/target/linux/bcm27xx/patches-6.6/950-1531-misc-rp1-pio-Error-out-on-incompatible-firmware.patch
new file mode 100644
index 00000000000000..2fa70f38a1d594
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1531-misc-rp1-pio-Error-out-on-incompatible-firmware.patch
@@ -0,0 +1,42 @@
+From e0a21a407b78477aa530800255d53405950cb1fb Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 3 Feb 2025 14:44:08 +0000
+Subject: [PATCH] misc: rp1-pio: Error out on incompatible firmware
+
+If the RP1 firmware has reported an error then return that from the PIO
+probe function, otherwise defer the probing.
+
+Link: https://github.com/raspberrypi/linux/issues/6642
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/rp1-pio.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/misc/rp1-pio.c
++++ b/drivers/misc/rp1-pio.c
+@@ -1277,8 +1277,10 @@ static int rp1_pio_probe(struct platform
+ 		return dev_err_probe(dev, pdev->id, "alias is missing\n");
+ 
+ 	fw = devm_rp1_firmware_get(dev, dev->of_node);
+-	if (IS_ERR_OR_NULL(fw))
+-		return dev_err_probe(dev, -ENOENT, "failed to contact RP1 firmware\n");
++	if (!fw)
++		return dev_err_probe(dev, -EPROBE_DEFER, "failed to find RP1 firmware driver\n");
++	if (IS_ERR(fw))
++		return dev_err_probe(dev, PTR_ERR(fw), "failed to contact RP1 firmware\n");
+ 	ret = rp1_firmware_get_feature(fw, FOURCC_PIO, &op_base, &op_count);
+ 	if (ret < 0)
+ 		return ret;
+@@ -1355,6 +1357,11 @@ static void rp1_pio_remove(struct platfo
+ 
+ 	if (g_pio == pio)
+ 		g_pio = NULL;
++
++	device_destroy(pio->dev_class, pio->dev_num);
++	cdev_del(&pio->cdev);
++	class_destroy(pio->dev_class);
++	unregister_chrdev_region(pio->dev_num, 1);
+ }
+ 
+ static const struct of_device_id rp1_pio_ids[] = {
diff --git a/target/linux/bcm27xx/patches-6.6/950-1532-firmware-rp1-Linger-on-firmware-failure.patch b/target/linux/bcm27xx/patches-6.6/950-1532-firmware-rp1-Linger-on-firmware-failure.patch
new file mode 100644
index 00000000000000..cf0bbc8c49c731
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1532-firmware-rp1-Linger-on-firmware-failure.patch
@@ -0,0 +1,103 @@
+From 3f60adc5ce8238996ec43d2b76a6e38e46f8271b Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Mon, 3 Feb 2025 14:51:52 +0000
+Subject: [PATCH] firmware: rp1: Linger on firmware failure
+
+To avoid pointless retries, let the probe function succeed if the
+firmware interface is configured correctly but the firmware is
+incompatible. The value of the private drvdata field holds the outcome.
+
+Link: https://github.com/raspberrypi/linux/issues/6642
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/firmware/rp1.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+--- a/drivers/firmware/rp1.c
++++ b/drivers/firmware/rp1.c
+@@ -114,7 +114,8 @@ static void rp1_firmware_delete(struct k
+ 
+ void rp1_firmware_put(struct rp1_firmware *fw)
+ {
+-	kref_put(&fw->consumers, rp1_firmware_delete);
++	if (!IS_ERR_OR_NULL(fw))
++		kref_put(&fw->consumers, rp1_firmware_delete);
+ }
+ EXPORT_SYMBOL_GPL(rp1_firmware_put);
+ 
+@@ -157,7 +158,7 @@ struct rp1_firmware *rp1_firmware_get(st
+ 	const char *match = rp1_firmware_of_match[0].compatible;
+ 	struct platform_device *pdev;
+ 	struct device_node *fwnode;
+-	struct rp1_firmware *fw;
++	struct rp1_firmware *fw = NULL;
+ 
+ 	if (!client)
+ 		return NULL;
+@@ -166,17 +167,17 @@ struct rp1_firmware *rp1_firmware_get(st
+ 		return NULL;
+ 	if (!of_device_is_compatible(fwnode, match)) {
+ 		of_node_put(fwnode);
+-		return NULL;
++		return ERR_PTR(-ENXIO);
+ 	}
+ 
+ 	pdev = of_find_device_by_node(fwnode);
+ 	of_node_put(fwnode);
+ 
+ 	if (!pdev)
+-		goto err_exit;
++		return ERR_PTR(-ENXIO);
+ 
+ 	fw = platform_get_drvdata(pdev);
+-	if (!fw)
++	if (IS_ERR_OR_NULL(fw))
+ 		goto err_exit;
+ 
+ 	if (!kref_get_unless_zero(&fw->consumers))
+@@ -188,7 +189,7 @@ struct rp1_firmware *rp1_firmware_get(st
+ 
+ err_exit:
+ 	put_device(&pdev->dev);
+-	return NULL;
++	return fw;
+ }
+ EXPORT_SYMBOL_GPL(rp1_firmware_get);
+ 
+@@ -204,8 +205,8 @@ struct rp1_firmware *devm_rp1_firmware_g
+ 	int ret;
+ 
+ 	fw = rp1_firmware_get(client);
+-	if (!fw)
+-		return NULL;
++	if (IS_ERR_OR_NULL(fw))
++		return fw;
+ 
+ 	ret = devm_add_action_or_reset(dev, devm_rp1_firmware_put, fw);
+ 	if (ret)
+@@ -270,19 +271,18 @@ static int rp1_firmware_probe(struct pla
+ 	init_completion(&fw->c);
+ 	kref_init(&fw->consumers);
+ 
+-	platform_set_drvdata(pdev, fw);
+-
+ 	ret = rp1_firmware_message(fw, GET_FIRMWARE_VERSION,
+ 				   NULL, 0, &version, sizeof(version));
+ 	if (ret == sizeof(version)) {
+ 		dev_info(dev, "RP1 Firmware version %08x%08x%08x%08x%08x\n",
+ 			 version[0], version[1], version[2], version[3], version[4]);
+-		ret = 0;
+-	} else if (ret >= 0) {
+-		ret = -EIO;
++		platform_set_drvdata(pdev, fw);
++	} else {
++		rp1_firmware_put(fw);
++		platform_set_drvdata(pdev, ERR_PTR(-ENOENT));
+ 	}
+ 
+-	return ret;
++	return 0;
+ }
+ 
+ static int rp1_firmware_remove(struct platform_device *pdev)
diff --git a/target/linux/bcm27xx/patches-6.6/950-1533-mailbox-rp1-Don-t-claim-channels-in-of_xlate.patch b/target/linux/bcm27xx/patches-6.6/950-1533-mailbox-rp1-Don-t-claim-channels-in-of_xlate.patch
new file mode 100644
index 00000000000000..5d6014d68f2f09
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1533-mailbox-rp1-Don-t-claim-channels-in-of_xlate.patch
@@ -0,0 +1,30 @@
+From 4d577c42b47dfffda80da995fafd5b16fdb242e2 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 4 Feb 2025 13:18:45 +0000
+Subject: [PATCH] mailbox: rp1: Don't claim channels in of_xlate
+
+The of_xlate method saves the calculated event mask in the con_priv
+field. It also rejects subsequent attempt to use that channel because
+the mask is non-zero, which causes a repeated instantiation of a client
+driver to fail.
+
+The of_xlate method is not meant to be a point of resource acquisition.
+Leave the con_priv initialisation, but drop the test that it was
+previously zero.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/mailbox/rp1-mailbox.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/mailbox/rp1-mailbox.c
++++ b/drivers/mailbox/rp1-mailbox.c
+@@ -133,8 +133,6 @@ static struct mbox_chan *rp1_mbox_xlate(
+ 		return ERR_PTR(-EINVAL);
+ 
+ 	chan = &mbox->chans[doorbell];
+-	if (chan->con_priv)
+-		return ERR_PTR(-EBUSY);
+ 
+ 	chan->con_priv = (void *)(uintptr_t)(1 << doorbell);
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1534-fixup-spi-dw-Wait-for-idle-after-TX.patch b/target/linux/bcm27xx/patches-6.6/950-1534-fixup-spi-dw-Wait-for-idle-after-TX.patch
new file mode 100644
index 00000000000000..9ac62a3407d59a
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1534-fixup-spi-dw-Wait-for-idle-after-TX.patch
@@ -0,0 +1,25 @@
+From fab0093d88452972f05f4b13e91e31d00b55421a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 4 Feb 2025 15:25:30 +0000
+Subject: [PATCH] fixup! spi: dw: Wait for idle after TX
+
+Relax a bit harder - transmission of the last bits may take a while.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/spi/spi-dw-dma.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-dw-dma.c
++++ b/drivers/spi/spi-dw-dma.c
+@@ -305,8 +305,9 @@ static int dw_spi_dma_wait_tx_done(struc
+ 	}
+ 
+ 	if (!xfer->rx_buf) {
++		delay.value = dws->n_bytes * BITS_PER_BYTE;
+ 		while (dw_readl(dws, DW_SPI_SR) & DW_SPI_SR_BUSY)
+-			cpu_relax();
++			spi_delay_exec(&delay, xfer);
+ 	}
+ 
+ 	return 0;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1535-dtoverlays-adds-support-for-Hifiberry-ADC8x-to-the-D.patch b/target/linux/bcm27xx/patches-6.6/950-1535-dtoverlays-adds-support-for-Hifiberry-ADC8x-to-the-D.patch
new file mode 100644
index 00000000000000..a742b30a345cfb
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1535-dtoverlays-adds-support-for-Hifiberry-ADC8x-to-the-D.patch
@@ -0,0 +1,76 @@
+From 2cdd83392ba025cc88072c0153d443fc59919960 Mon Sep 17 00:00:00 2001
+From: j-schambacher <joerg@hifiberry.com>
+Date: Mon, 10 Feb 2025 14:58:34 +0100
+Subject: [PATCH] dtoverlays: adds support for Hifiberry ADC8x to the DAC8x
+
+Allows the usage of ADC8x stacked on top of the DAC8x.
+Activates all I2S pins and uses now the dummy-dai instead
+of the formerly used pcm5102 to allow the use of a
+capture device, too. The simple card driver will
+probe for the ADC8x and may activate the 8 channel
+capture. Uses GPIO5 for detection.
+
+Signed-off-by: j-schambacher <joerg@hifiberry.com>
+---
+ arch/arm/boot/dts/overlays/README                  |  3 +++
+ .../boot/dts/overlays/hifiberry-dac8x-overlay.dts  | 14 ++++++++++----
+ 2 files changed, 13 insertions(+), 4 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -1879,6 +1879,9 @@ Params: <None>
+ 
+ Name:   hifiberry-dac8x
+ Info:   Configures the HifiBerry DAC8X audio cards (only on Pi5)
++        This driver also detects a stacked ADC8x and activates the
++        capture capabilities.
++        Note: for standalone use of the ADC8x activate the ADC8x module.
+ Load:   dtoverlay=hifiberry-dac8x
+ Params: <None>
+ 
+--- a/arch/arm/boot/dts/overlays/hifiberry-dac8x-overlay.dts
++++ b/arch/arm/boot/dts/overlays/hifiberry-dac8x-overlay.dts
+@@ -1,7 +1,10 @@
++// SPDX-License-Identifier: GPL-2.0
+ // Definitions for HiFiBerry DAC8x
+ /dts-v1/;
+ /plugin/;
+ 
++#include <dt-bindings/gpio/gpio.h>
++
+ / {
+ 	compatible = "brcm,bcm2712";
+ 
+@@ -10,8 +13,10 @@
+ 		__overlay__ {
+ 			rp1_i2s0_dac8x: rp1_i2s0_dac8x {
+ 				function = "i2s0";
+-				pins = "gpio18", "gpio19", "gpio21",
+-				       "gpio23", "gpio25", "gpio27";
++				pins = "gpio18", "gpio19", "gpio20",
++				       "gpio21", "gpio22", "gpio23",
++				       "gpio24", "gpio25", "gpio26",
++				       "gpio27";
+ 				bias-disable;
+ 				status = "okay";
+ 			};
+@@ -30,9 +35,9 @@
+ 	fragment@2 {
+ 		target-path = "/";
+ 		__overlay__ {
+-			pcm5102a-codec {
++			dummy-codec {
+ 				#sound-dai-cells = <0>;
+-				compatible = "ti,pcm5102a";
++				compatible = "snd-soc-dummy";
+ 				status = "okay";
+ 			};
+ 		};
+@@ -43,6 +48,7 @@
+ 		__overlay__ {
+ 			compatible = "hifiberry,hifiberry-dac8x";
+ 			i2s-controller = <&i2s_clk_producer>;
++			hasadc-gpio = <&gpio 5 GPIO_ACTIVE_LOW>;
+ 			status = "okay";
+ 		};
+ 	};
diff --git a/target/linux/bcm27xx/patches-6.6/950-1536-ASoC-adds-ADC8x-support-to-the-Hifiberry-DAC8x.patch b/target/linux/bcm27xx/patches-6.6/950-1536-ASoC-adds-ADC8x-support-to-the-Hifiberry-DAC8x.patch
new file mode 100644
index 00000000000000..fec52cc60f1d05
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1536-ASoC-adds-ADC8x-support-to-the-Hifiberry-DAC8x.patch
@@ -0,0 +1,75 @@
+From d664f45f77423b03e5a435e480822075c03331bd Mon Sep 17 00:00:00 2001
+From: j-schambacher <joerg@hifiberry.com>
+Date: Mon, 10 Feb 2025 15:08:48 +0100
+Subject: [PATCH] ASoC: adds ADC8x support to the Hifiberry DAC8x
+
+The driver probes for the ADC8x which can be stacked on top
+of the DAC8x. It enables a symmetric 8 channel capture using
+the dummy-dai.
+
+Signed-off-by: j-schambacher <joerg@hifiberry.com>
+---
+ sound/soc/bcm/rpi-simple-soundcard.c | 38 +++++++++++++++++++++++++---
+ 1 file changed, 34 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/bcm/rpi-simple-soundcard.c
++++ b/sound/soc/bcm/rpi-simple-soundcard.c
+@@ -354,16 +354,46 @@ static struct snd_rpi_simple_drvdata drv
+ 	.dai       = snd_hifiberry_dac_dai,
+ };
+ 
++SND_SOC_DAILINK_DEFS(hifiberry_dac8x,
++	DAILINK_COMP_ARRAY(COMP_EMPTY()),
++	DAILINK_COMP_ARRAY(COMP_CODEC("snd-soc-dummy", "snd-soc-dummy-dai")),
++	DAILINK_COMP_ARRAY(COMP_EMPTY()));
++
+ static int hifiberry_dac8x_init(struct snd_soc_pcm_runtime *rtd)
+ {
+ 	struct snd_soc_dai *codec_dai = asoc_rtd_to_codec(rtd, 0);
++	struct snd_soc_card *card = rtd->card;
++	struct gpio_desc *gpio_desc;
++	bool has_adc;
+ 
+-	/* override the defaults to reflect 4 x PCM5102A on the card
+-	 * and limit the sample rate to 192ksps
+-	 */
++	/* Configure the codec for 8 channel playback */
+ 	codec_dai->driver->playback.channels_max = 8;
+ 	codec_dai->driver->playback.rates = SNDRV_PCM_RATE_8000_192000;
+ 
++	/* Activate capture based on ADC8x detection */
++	gpio_desc = devm_gpiod_get(card->dev, "hasadc", GPIOD_IN);
++	if (IS_ERR(gpio_desc)) {
++		dev_err(card->dev, "Failed to get GPIO: %ld\n", PTR_ERR(gpio_desc));
++		return PTR_ERR(gpio_desc);
++	}
++
++	has_adc = gpiod_get_value(gpio_desc);
++
++	if (has_adc) {
++		struct snd_soc_dai_link *dai = rtd->dai_link;
++
++		dev_info(card->dev, "ADC8x detected: capture enabled\n");
++		codec_dai->driver->symmetric_rate = 1;
++		codec_dai->driver->symmetric_channels = 1;
++		codec_dai->driver->symmetric_sample_bits = 1;
++		codec_dai->driver->capture.rates = SNDRV_PCM_RATE_8000_192000;
++		dai->name = "HiFiBerry DAC8xADC8x";
++		dai->stream_name = "HiFiBerry DAC8xADC8x HiFi";
++	} else {
++		dev_info(card->dev, "no ADC8x detected\n");
++		rtd->dai_link->playback_only = 1;  // Disable capture
++	}
++
+ 	return 0;
+ }
+ 
+@@ -375,7 +405,7 @@ static struct snd_soc_dai_link snd_hifib
+ 					SND_SOC_DAIFMT_NB_NF |
+ 					SND_SOC_DAIFMT_CBS_CFS,
+ 		.init           = hifiberry_dac8x_init,
+-		SND_SOC_DAILINK_REG(hifiberry_dac),
++		SND_SOC_DAILINK_REG(hifiberry_dac8x),
+ 	},
+ };
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-0519-usb-dwc3-Set-DMA-and-coherent-masks-early.patch b/target/linux/bcm27xx/patches-6.6/950-1539-Reapply-usb-dwc3-Set-DMA-and-coherent-masks-early.patch
similarity index 77%
rename from target/linux/bcm27xx/patches-6.6/950-0519-usb-dwc3-Set-DMA-and-coherent-masks-early.patch
rename to target/linux/bcm27xx/patches-6.6/950-1539-Reapply-usb-dwc3-Set-DMA-and-coherent-masks-early.patch
index 7d3a139a776107..327819f289f09e 100644
--- a/target/linux/bcm27xx/patches-6.6/950-0519-usb-dwc3-Set-DMA-and-coherent-masks-early.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1539-Reapply-usb-dwc3-Set-DMA-and-coherent-masks-early.patch
@@ -1,50 +1,9 @@
-From fa846f5991de6c37db1f40e26a39f52c130f2bc7 Mon Sep 17 00:00:00 2001
-From: Jonathan Bell <jonathan@raspberrypi.com>
-Date: Mon, 13 Sep 2021 11:14:32 +0100
-Subject: [PATCH 0519/1085] usb: dwc3: Set DMA and coherent masks early
+From 1b1e75ae7d69816609a95ff2fb92729a2ff04d8e Mon Sep 17 00:00:00 2001
+From: Dom Cobley <popcornmix@gmail.com>
+Date: Mon, 10 Feb 2025 13:26:33 +0000
+Subject: [PATCH] Reapply "usb: dwc3: Set DMA and coherent masks early"
 
-dwc3 allocates scratch and event buffers in the top-level driver. Hack the
-probe function to set the DMA mask before trying to allocate these.
-
-I think the event buffers are only used in device mode, but the scratch
-buffers may be used if core hibernation is enabled.
-
-usb: dwc3: add support for new DT quirks
-
-Apply the optional axi-pipe-limit and dis-in-autoretry-quirk properties
-during driver probe.
-
-Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
-
-phy: phy-brcm-usb: Add 2712 support
-
-usb: dwc3: if the host controller instance number is present in DT, use it
-
-If two instances of a dwc3 host controller are specified in devicetree,
-then the probe order may be arbitrary which results in the device names
-swapping on a per-boot basis.
-
-If a "usb" alias with the instance number is specified, then use
-that to construct the device name instead of autogenerating one.
-
-Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
-
-rp1 dwc3 changes
-
-drivers: usb: dwc3: allow setting GTXTHRCFG on dwc_usb3.0 hardware
-
-Equivalent register fields exist in the SuperSpeed Host version of the
-hardware, so allow the use of TX thresholds if specified in devicetree.
-
-Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
-
-drivers: usb: dwc3: remove downstream quirk dis-in-autoretry
-
-Upstream have unilaterally disabled the feature.
-
-Partially reverts 6e9142a26ee0fdc3a5adc49ed6cedc0b16ec2ed1 (downstream)
-
-Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
+This reverts commit 09dfdf6129532e19b2cfd4992d1d09e7119ccd48.
 ---
  drivers/phy/broadcom/Kconfig                  |  2 +-
  .../phy/broadcom/phy-brcm-usb-init-synopsys.c | 59 +++++++++++++++++++
@@ -68,7 +27,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	select SOC_BRCMSTB if ARCH_BRCMSTB
 --- a/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c
 +++ b/drivers/phy/broadcom/phy-brcm-usb-init-synopsys.c
-@@ -335,6 +335,36 @@ static void usb_init_common_7216(struct
+@@ -341,6 +341,36 @@ static void usb_init_common_7216(struct
  	usb_init_common(params);
  }
  
@@ -105,7 +64,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  static void usb_init_xhci(struct brcm_usb_init_params *params)
  {
  	pr_debug("%s\n", __func__);
-@@ -380,6 +410,18 @@ static void usb_uninit_common_7211b0(str
+@@ -386,6 +416,18 @@ static void usb_uninit_common_7211b0(str
  
  }
  
@@ -124,7 +83,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  static void usb_uninit_xhci(struct brcm_usb_init_params *params)
  {
  
-@@ -434,6 +476,16 @@ static const struct brcm_usb_init_ops bc
+@@ -440,6 +482,16 @@ static const struct brcm_usb_init_ops bc
  	.set_dual_select = usb_set_dual_select,
  };
  
@@ -141,7 +100,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  void brcm_usb_dvr_init_7216(struct brcm_usb_init_params *params)
  {
  
-@@ -451,3 +503,10 @@ void brcm_usb_dvr_init_7211b0(struct brc
+@@ -457,3 +509,10 @@ void brcm_usb_dvr_init_7211b0(struct brc
  	params->family_name = "7211";
  	params->ops = &bcm7211b0_ops;
  }
@@ -212,7 +171,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	},
 --- a/drivers/usb/dwc3/core.c
 +++ b/drivers/usb/dwc3/core.c
-@@ -1208,6 +1208,24 @@ static void dwc3_config_threshold(struct
+@@ -1223,6 +1223,24 @@ static void dwc3_config_threshold(struct
  	}
  }
  
@@ -237,7 +196,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  /**
   * dwc3_core_init - Low-level initialization of DWC3 Core
   * @dwc: Pointer to our controller context structure
-@@ -1273,6 +1291,8 @@ static int dwc3_core_init(struct dwc3 *d
+@@ -1288,6 +1306,8 @@ static int dwc3_core_init(struct dwc3 *d
  
  	dwc3_set_incr_burst_type(dwc);
  
@@ -246,7 +205,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	ret = dwc3_phy_power_on(dwc);
  	if (ret)
  		goto err_exit_phy;
-@@ -1362,6 +1382,24 @@ static int dwc3_core_init(struct dwc3 *d
+@@ -1386,6 +1406,24 @@ static int dwc3_core_init(struct dwc3 *d
  
  	dwc3_config_threshold(dwc);
  
@@ -271,15 +230,15 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	return 0;
  
  err_power_off_phy:
-@@ -1505,6 +1543,7 @@ static void dwc3_get_properties(struct d
+@@ -1529,6 +1567,7 @@ static void dwc3_get_properties(struct d
  	u8			tx_thr_num_pkt_prd = 0;
  	u8			tx_max_burst_prd = 0;
  	u8			tx_fifo_resize_max_num;
 +	u8			axi_pipe_limit;
- 	const char		*usb_psy_name;
- 	int			ret;
  
-@@ -1527,6 +1566,9 @@ static void dwc3_get_properties(struct d
+ 	/* default to highest possible threshold */
+ 	lpm_nyet_threshold = 0xf;
+@@ -1549,6 +1588,9 @@ static void dwc3_get_properties(struct d
  	 */
  	tx_fifo_resize_max_num = 6;
  
@@ -289,7 +248,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	dwc->maximum_speed = usb_get_maximum_speed(dev);
  	dwc->max_ssp_rate = usb_get_maximum_ssp_rate(dev);
  	dwc->dr_mode = usb_get_dr_mode(dev);
-@@ -1648,6 +1690,9 @@ static void dwc3_get_properties(struct d
+@@ -1669,6 +1711,9 @@ static void dwc3_get_properties(struct d
  	dwc->dis_split_quirk = device_property_read_bool(dev,
  				"snps,dis-split-quirk");
  
@@ -299,18 +258,18 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  	dwc->lpm_nyet_threshold = lpm_nyet_threshold;
  	dwc->tx_de_emphasis = tx_de_emphasis;
  
-@@ -1665,6 +1710,8 @@ static void dwc3_get_properties(struct d
+@@ -1686,6 +1731,8 @@ static void dwc3_get_properties(struct d
  	dwc->tx_thr_num_pkt_prd = tx_thr_num_pkt_prd;
  	dwc->tx_max_burst_prd = tx_max_burst_prd;
  
 +	dwc->axi_pipe_limit = axi_pipe_limit;
 +
- 	dwc->imod_interval = 0;
- 
  	dwc->tx_fifo_resize_max_num = tx_fifo_resize_max_num;
-@@ -1940,6 +1987,12 @@ static int dwc3_probe(struct platform_de
+ }
  
- 	dwc3_get_properties(dwc);
+@@ -1978,6 +2025,12 @@ static int dwc3_probe(struct platform_de
+ 	if (IS_ERR(dwc->usb_psy))
+ 		return dev_err_probe(dev, PTR_ERR(dwc->usb_psy), "couldn't get usb power supply\n");
  
 +	if (!dwc->sysdev_is_parent) {
 +		ret = dma_set_mask_and_coherent(dwc->sysdev, DMA_BIT_MASK(64));
@@ -333,7 +292,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
  /* Global Debug LSP MUX Select */
  #define DWC3_GDBGLSPMUX_ENDBC		BIT(15)	/* Host only */
  #define DWC3_GDBGLSPMUX_HOSTSELECT(n)	((n) & 0x3fff)
-@@ -1061,6 +1064,7 @@ struct dwc3_scratchpad_array {
+@@ -1070,6 +1073,7 @@ struct dwc3_scratchpad_array {
   * @tx_max_burst_prd: max periodic ESS transmit burst size
   * @tx_fifo_resize_max_num: max number of fifos allocated during txfifo resize
   * @clear_stall_protocol: endpoint number that requires a delayed status phase
@@ -341,7 +300,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
   * @hsphy_interface: "utmi" or "ulpi"
   * @connected: true when we're connected to a host, false otherwise
   * @softconnect: true when gadget connect is called, false when disconnect runs
-@@ -1296,6 +1300,7 @@ struct dwc3 {
+@@ -1311,6 +1315,7 @@ struct dwc3 {
  	u8			tx_max_burst_prd;
  	u8			tx_fifo_resize_max_num;
  	u8			clear_stall_protocol;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1541-overlays-Add-OpenHydroponics-RootMaster-overlay.patch b/target/linux/bcm27xx/patches-6.6/950-1541-overlays-Add-OpenHydroponics-RootMaster-overlay.patch
new file mode 100644
index 00000000000000..f16d0bdd29a270
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1541-overlays-Add-OpenHydroponics-RootMaster-overlay.patch
@@ -0,0 +1,119 @@
+From 081eebdeccfd12e0aaba4b64c9f87b608777913b Mon Sep 17 00:00:00 2001
+From: Micke Prag <micke.prag@gmail.com>
+Date: Thu, 13 Feb 2025 22:08:43 +0100
+Subject: [PATCH] overlays: Add OpenHydroponics RootMaster overlay
+
+Signed-off-by: Micke Prag <micke.prag@gmail.com>
+---
+ arch/arm/boot/dts/overlays/Makefile           |  1 +
+ arch/arm/boot/dts/overlays/README             |  7 ++
+ .../boot/dts/overlays/rootmaster-overlay.dts  | 77 +++++++++++++++++++
+ 3 files changed, 85 insertions(+)
+ create mode 100644 arch/arm/boot/dts/overlays/rootmaster-overlay.dts
+
+--- a/arch/arm/boot/dts/overlays/Makefile
++++ b/arch/arm/boot/dts/overlays/Makefile
+@@ -228,6 +228,7 @@ dtbo-$(CONFIG_ARCH_BCM2835) += \
+ 	qca7000-uart0.dtbo \
+ 	ramoops.dtbo \
+ 	ramoops-pi4.dtbo \
++	rootmaster.dtbo \
+ 	rotary-encoder.dtbo \
+ 	rpi-backlight.dtbo \
+ 	rpi-codeczero.dtbo \
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -4084,6 +4084,13 @@ Params: base-addr               Where to
+         console-size            Size of non-panic dmesg captures (default 0)
+ 
+ 
++Name:   rootmaster
++Info:   Overlay for OpenHydroponics RootMaster board.
++        https://openhydroponics.com/hw/rootmaster
++Load:   dtoverlay=rootmaster
++Params: <None>
++
++
+ Name:   rotary-encoder
+ Info:   Overlay for GPIO connected rotary encoder.
+ Load:   dtoverlay=rotary-encoder,<param>=<val>
+--- /dev/null
++++ b/arch/arm/boot/dts/overlays/rootmaster-overlay.dts
+@@ -0,0 +1,77 @@
++// redo: ovmerge -c mcp251xfd-overlay.dts,spi0-0,interrupt=25 w1-gpio-overlay.dts,gpiopin=4
++
++/dts-v1/;
++/plugin/;
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/interrupt-controller/irq.h>
++#include <dt-bindings/pinctrl/bcm2835.h>
++
++/ {
++	compatible = "brcm,bcm2835";
++	fragment@0 {
++		target = <&spidev0>;
++		__overlay__ {
++			status = "disabled";
++		};
++	};
++	fragment@1 {
++		target = <&gpio>;
++		__overlay__ {
++			mcp251xfd_pins: mcp251xfd_spi0_0_pins {
++				brcm,pins = <25>;
++				brcm,function = <BCM2835_FSEL_GPIO_IN>;
++			};
++		};
++	};
++	fragment@2 {
++		target-path = "/clocks";
++		__overlay__ {
++			clk_mcp251xfd_osc: mcp251xfd-spi0-0-osc {
++				#clock-cells = <0>;
++				compatible = "fixed-clock";
++				clock-frequency = <40000000>;
++			};
++		};
++	};
++	fragment@3 {
++		target = <&spi0>;
++		__overlay__ {
++			status = "okay";
++			#address-cells = <1>;
++			#size-cells = <0>;
++			mcp251xfd@0 {
++				compatible = "microchip,mcp251xfd";
++				reg = <0>;
++				pinctrl-names = "default";
++				pinctrl-0 = <&mcp251xfd_pins>;
++				spi-max-frequency = <20000000>;
++				interrupt-parent = <&gpio>;
++				interrupts = <25 IRQ_TYPE_LEVEL_LOW>;
++				clocks = <&clk_mcp251xfd_osc>;
++			};
++		};
++	};
++	fragment@4 {
++		target-path = "/";
++		__overlay__ {
++			onewire@4 {
++				compatible = "w1-gpio";
++				pinctrl-names = "default";
++				pinctrl-0 = <&w1_pins>;
++				gpios = <&gpio 4 0>;
++				status = "okay";
++			};
++		};
++	};
++	fragment@5 {
++		target = <&gpio>;
++		__overlay__ {
++			w1_pins: w1_pins@4 {
++				brcm,pins = <4>;
++				brcm,function = <0>;
++				brcm,pull = <0>;
++			};
++		};
++	};
++};
diff --git a/target/linux/bcm27xx/patches-6.6/950-1542-media-i2c-arducam-pivariety-Fix-mutex-init-and-NULL-.patch b/target/linux/bcm27xx/patches-6.6/950-1542-media-i2c-arducam-pivariety-Fix-mutex-init-and-NULL-.patch
new file mode 100644
index 00000000000000..784ae522f18ff5
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1542-media-i2c-arducam-pivariety-Fix-mutex-init-and-NULL-.patch
@@ -0,0 +1,37 @@
+From 011cbf22d7583687ae18690185169e5da0be000a Mon Sep 17 00:00:00 2001
+From: Yuriy Pasichnyk <yurijpasichnyk11@gmail.com>
+Date: Tue, 18 Feb 2025 16:20:31 +0200
+Subject: [PATCH] media: i2c: arducam-pivariety: Fix mutex init and NULL
+ pointer
+
+The mutex used in arducam-pivariety was not properly initialized,
+which could lead to undefined behavior. This also caused a NULL
+pointer dereference under certain conditions.
+
+This patch ensures the mutex is correctly initialized during probe
+and prevents NULL pointer dereferences.
+
+Signed-off-by: Yuriy Pasichnyk <yurijpasichnyk11@gmail.com>
+---
+ drivers/media/i2c/arducam-pivariety.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/media/i2c/arducam-pivariety.c
++++ b/drivers/media/i2c/arducam-pivariety.c
+@@ -1208,6 +1208,8 @@ static int pivariety_enum_controls(struc
+ 	if (ret)
+ 		return ret;
+ 
++	mutex_init(&pivariety->mutex);
++
+ 	index = 0;
+ 	while (1) {
+ 		ret = pivariety_write(pivariety, CTRL_INDEX_REG, index);
+@@ -1295,6 +1297,7 @@ static int pivariety_enum_controls(struc
+ 	v4l2_ctrl_handler_setup(ctrl_hdlr);
+ 	return 0;
+ err:
++	mutex_destroy(&pivariety->mutex);
+ 	return -ENODEV;
+ }
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1543-misc-rp1-pio-Demote-fw-probe-error-to-warning.patch b/target/linux/bcm27xx/patches-6.6/950-1543-misc-rp1-pio-Demote-fw-probe-error-to-warning.patch
new file mode 100644
index 00000000000000..af9c9f9e529204
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1543-misc-rp1-pio-Demote-fw-probe-error-to-warning.patch
@@ -0,0 +1,32 @@
+From af9965a855a8c6c7140bbcccfa89eec7e90a993d Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 25 Feb 2025 12:16:33 +0000
+Subject: [PATCH] misc: rp1-pio: Demote fw probe error to warning
+
+Support for the RP1 firmware mailbox API is rolling out to Pi 5 EEPROM
+images. For most users, the fact that the PIO is not available is no
+cause for alarm. Change the message to a warning, so that it does not
+appear with "quiet" in cmdline.txt.
+
+Link: https://github.com/raspberrypi/linux/issues/6642
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ drivers/misc/rp1-pio.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/misc/rp1-pio.c
++++ b/drivers/misc/rp1-pio.c
+@@ -1279,8 +1279,10 @@ static int rp1_pio_probe(struct platform
+ 	fw = devm_rp1_firmware_get(dev, dev->of_node);
+ 	if (!fw)
+ 		return dev_err_probe(dev, -EPROBE_DEFER, "failed to find RP1 firmware driver\n");
+-	if (IS_ERR(fw))
+-		return dev_err_probe(dev, PTR_ERR(fw), "failed to contact RP1 firmware\n");
++	if (IS_ERR(fw)) {
++		dev_warn(dev, "failed to contact RP1 firmware\n");
++		return PTR_ERR(fw);
++	}
+ 	ret = rp1_firmware_get_feature(fw, FOURCC_PIO, &op_base, &op_count);
+ 	if (ret < 0)
+ 		return ret;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1544-dts-Add-hogs-for-RP1-GPIO-46-48-on-CM5.patch b/target/linux/bcm27xx/patches-6.6/950-1544-dts-Add-hogs-for-RP1-GPIO-46-48-on-CM5.patch
new file mode 100644
index 00000000000000..98eaf56ee69ce3
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1544-dts-Add-hogs-for-RP1-GPIO-46-48-on-CM5.patch
@@ -0,0 +1,38 @@
+From a4e7897eef1ad4628572a6abfd30291209a0bf43 Mon Sep 17 00:00:00 2001
+From: Richard Oliver <richard.oliver@raspberrypi.com>
+Date: Tue, 25 Feb 2025 15:06:23 +0000
+Subject: [PATCH] dts: Add hogs for RP1 GPIO 46/48 on CM5
+
+On Pi5 5, GPIOs 46/48 are made available on the 'CAM/DISP 1' connector as
+'CD1_IO0_MICCLK'/'CD1_IO1_MICDAT1'. These GPIOs are not connected on
+CM5.
+
+Add hogs for GPIO 46/48 on CM5 to prevent camera drivers from
+inadvertently using them when connected to 'CAM/DISP 1'
+
+Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-cm5.dtsi
+@@ -734,6 +734,18 @@ spi10_cs_pins: &spi10_cs_gpio1 {};
+ 		function = "vbus1";
+ 		pins = "gpio42", "gpio43";
+ 	};
++
++	micclk1_hog {
++		gpio-hog;
++		gpios = <46 GPIO_ACTIVE_HIGH>;
++		output-high;
++	};
++
++	micdat1_hog {
++		gpio-hog;
++		gpios = <48 GPIO_ACTIVE_HIGH>;
++		output-high;
++	};
+ };
+ 
+ / {
diff --git a/target/linux/bcm27xx/patches-6.6/950-1545-spi-rp2040-gpio-bridge-fix-gpiod-error-handling.patch b/target/linux/bcm27xx/patches-6.6/950-1545-spi-rp2040-gpio-bridge-fix-gpiod-error-handling.patch
new file mode 100644
index 00000000000000..31e35a3bf2d876
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1545-spi-rp2040-gpio-bridge-fix-gpiod-error-handling.patch
@@ -0,0 +1,25 @@
+From f8f3e202fb083906fbc98ef6ea445e424779c076 Mon Sep 17 00:00:00 2001
+From: Richard Oliver <richard.oliver@raspberrypi.com>
+Date: Tue, 25 Feb 2025 15:22:46 +0000
+Subject: [PATCH] spi: rp2040-gpio-bridge: fix gpiod error handling
+
+In some circumstances, devm_gpiod_get_array_optional() can return
+PTR_ERR rather than NULL to indicate failure. Handle these cases.
+
+Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
+---
+ drivers/spi/spi-rp2040-gpio-bridge.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-rp2040-gpio-bridge.c
++++ b/drivers/spi/spi-rp2040-gpio-bridge.c
+@@ -956,7 +956,8 @@ static void rp2040_gbdg_parse_dt(struct
+ 
+ 	rp2040_gbdg->fast_xfer_gpios =
+ 		devm_gpiod_get_array_optional(dev, "fast_xfer", GPIOD_ASIS);
+-	if (!rp2040_gbdg->fast_xfer_gpios) {
++	if (IS_ERR_OR_NULL(rp2040_gbdg->fast_xfer_gpios)) {
++		rp2040_gbdg->fast_xfer_gpios = NULL;
+ 		dev_info(dev, "Could not acquire fast_xfer-gpios\n");
+ 		goto node_put;
+ 	}
diff --git a/target/linux/bcm27xx/patches-6.6/950-1546-spi-rp2040-gpio-bridge-probe-Cfg-fast_xfer-clk.patch b/target/linux/bcm27xx/patches-6.6/950-1546-spi-rp2040-gpio-bridge-probe-Cfg-fast_xfer-clk.patch
new file mode 100644
index 00000000000000..04b9ea60254e61
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1546-spi-rp2040-gpio-bridge-probe-Cfg-fast_xfer-clk.patch
@@ -0,0 +1,37 @@
+From 2e071057fded90e789c0101498e45a1778be93fe Mon Sep 17 00:00:00 2001
+From: Richard Oliver <richard.oliver@raspberrypi.com>
+Date: Tue, 25 Feb 2025 15:27:59 +0000
+Subject: [PATCH] spi: rp2040-gpio-bridge: probe: Cfg fast_xfer clk
+
+Fast transfer mode requires that the first bit of data is clocked with a
+rising edge. This can cause extra bits of data to be clocked on hardware
+where the clock signal uses a pull-up. This change ensures that clk is
+driven low before fast data transfer mode is entered.
+
+Signed-off-by: Richard Oliver <richard.oliver@raspberrypi.com>
+---
+ drivers/spi/spi-rp2040-gpio-bridge.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/spi/spi-rp2040-gpio-bridge.c
++++ b/drivers/spi/spi-rp2040-gpio-bridge.c
+@@ -617,7 +617,6 @@ static int rp2040_gbdg_fast_xfer(struct
+ 				 &clock_mux);
+ 
+ 	gpiod_direction_output(priv_data->fast_xfer_gpios->desc[0], 1);
+-	gpiod_direction_output(priv_data->fast_xfer_gpios->desc[1], 0);
+ 
+ 	rp2040_gbdg_rp1_calc_offsets(priv_data->fast_xfer_data_index,
+ 				     &data_bank, &data_offset);
+@@ -989,6 +988,11 @@ static void rp2040_gbdg_parse_dt(struct
+ 		goto node_put;
+ 	}
+ 
++	/*
++	 * fast_xfer mode requires first data bit to be clocked on a rising
++	 * edge. Configure as output-low here before fast_xfer mode is entered.
++	 */
++	gpiod_direction_output(rp2040_gbdg->fast_xfer_gpios->desc[1], 0);
+ node_put:
+ 	if (of_args[0].np)
+ 		of_node_put(of_args[0].np);
diff --git a/target/linux/bcm27xx/patches-6.6/950-1547-fix-clang-compilation-error.patch b/target/linux/bcm27xx/patches-6.6/950-1547-fix-clang-compilation-error.patch
new file mode 100644
index 00000000000000..13fa24beaf55f4
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1547-fix-clang-compilation-error.patch
@@ -0,0 +1,30 @@
+From 1337c39626c14ca5e61b4cddbc097d87212a0b13 Mon Sep 17 00:00:00 2001
+From: KubaTaba1uga <luna7337anul@proton.me>
+Date: Mon, 3 Mar 2025 17:25:29 +0100
+Subject: [PATCH] fix clang compilation error
+
+---
+ drivers/dma-buf/heaps/system_heap.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/dma-buf/heaps/system_heap.c
++++ b/drivers/dma-buf/heaps/system_heap.c
+@@ -50,11 +50,16 @@ static gfp_t order_flags[] = {HIGH_ORDER
+  * to match with the sizes often found in IOMMUs. Using order 4 pages instead
+  * of order 0 pages can significantly improve the performance of many IOMMUs
+  * by reducing TLB pressure and time spent updating page tables.
++ *
++ * Note: `module_max_order` must be set explicitly instead of using
++ * `orders[0]` to avoid Clang's "initializer element is not a
++ * compile-time constant" error.
+  */
+-static const unsigned int orders[] = {8, 4, 0};
++#define MAX_ORDERS_VALUE 8
++static const unsigned int orders[] = {MAX_ORDERS_VALUE, 4, 0};
+ #define NUM_ORDERS ARRAY_SIZE(orders)
+ 
+-static unsigned int module_max_order = orders[0];
++static unsigned int module_max_order = MAX_ORDERS_VALUE;
+ 
+ module_param_named(max_order, module_max_order, uint, 0400);
+ MODULE_PARM_DESC(max_order, "Maximum allocation order override.");
diff --git a/target/linux/bcm27xx/patches-6.6/950-1548-delete-the-comment.patch b/target/linux/bcm27xx/patches-6.6/950-1548-delete-the-comment.patch
new file mode 100644
index 00000000000000..0918f8cded173e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1548-delete-the-comment.patch
@@ -0,0 +1,22 @@
+From f1076a9d7a269d72b6707283560d0d38203cb07a Mon Sep 17 00:00:00 2001
+From: KubaTaba1uga <luna7337anul@proton.me>
+Date: Tue, 4 Mar 2025 09:50:30 +0100
+Subject: [PATCH] delete the comment
+
+---
+ drivers/dma-buf/heaps/system_heap.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/dma-buf/heaps/system_heap.c
++++ b/drivers/dma-buf/heaps/system_heap.c
+@@ -50,10 +50,6 @@ static gfp_t order_flags[] = {HIGH_ORDER
+  * to match with the sizes often found in IOMMUs. Using order 4 pages instead
+  * of order 0 pages can significantly improve the performance of many IOMMUs
+  * by reducing TLB pressure and time spent updating page tables.
+- *
+- * Note: `module_max_order` must be set explicitly instead of using
+- * `orders[0]` to avoid Clang's "initializer element is not a
+- * compile-time constant" error.
+  */
+ #define MAX_ORDERS_VALUE 8
+ static const unsigned int orders[] = {MAX_ORDERS_VALUE, 4, 0};
diff --git a/target/linux/bcm27xx/patches-6.6/950-1549-dtoverlays-ov9281-Add-continuous-clock-option-as-an-.patch b/target/linux/bcm27xx/patches-6.6/950-1549-dtoverlays-ov9281-Add-continuous-clock-option-as-an-.patch
new file mode 100644
index 00000000000000..a2b7df78d9c913
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1549-dtoverlays-ov9281-Add-continuous-clock-option-as-an-.patch
@@ -0,0 +1,66 @@
+From ac56a225e0889e60e912ecd3a51333a5aee901fc Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Tue, 4 Mar 2025 15:28:53 +0000
+Subject: [PATCH] dtoverlays: ov9281: Add continuous clock option as an
+ override
+
+The previous change to make ov9281 always run in continuous clock
+mode causes problems on Pi3 for reasons that aren't fully
+understood. Pi4 is quite happy with it.
+
+Change the default back to being non-continuous clock, and add
+an override to select continuous clock mode and its slightly
+greater max frame rate.
+
+https://forums.raspberrypi.com/viewtopic.php?p=2300215
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/README             |  3 +++
+ arch/arm/boot/dts/overlays/ov9281-overlay.dts | 16 +++++++++++++++-
+ 2 files changed, 18 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/overlays/README
++++ b/arch/arm/boot/dts/overlays/README
+@@ -3570,6 +3570,9 @@ Params: rotation                Mounting
+                                 Compute Module (CSI0, i2c_vc, and cam0_reg).
+         arducam                 Slow down the regulator for slow Arducam
+                                 modules.
++        clk-continuous          Switch to continuous mode on the CSI clock lane,
++                                which increases the maximum frame rate slightly.
++                                Appears not to work on Pi3.
+ 
+ 
+ Name:   papirus
+--- a/arch/arm/boot/dts/overlays/ov9281-overlay.dts
++++ b/arch/arm/boot/dts/overlays/ov9281-overlay.dts
+@@ -64,6 +64,20 @@
+ 		};
+ 	};
+ 
++	fragment@6 {
++		target = <&csi_ep>;
++		__overlay__ {
++			clock-noncontinuous;
++		};
++	};
++
++	fragment@7 {
++		target = <&cam_endpoint>;
++		__overlay__ {
++			clock-noncontinuous;
++		};
++	};
++
+ 	__overrides__ {
+ 		rotation = <&cam_node>,"rotation:0";
+ 		orientation = <&cam_node>,"orientation:0";
+@@ -75,7 +89,7 @@
+ 		       <&cam_node>, "avdd-supply:0=",<&cam0_reg>,
+ 		       <&reg_frag>, "target:0=",<&cam0_reg>;
+ 		arducam = <0>, "+5";
+-
++		clk-continuous = <0>, "-6-7";
+ 	};
+ };
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1552-drm-v3d-Set-job-pointer-to-NULL-when-the-job-s-fence.patch b/target/linux/bcm27xx/patches-6.6/950-1552-drm-v3d-Set-job-pointer-to-NULL-when-the-job-s-fence.patch
new file mode 100644
index 00000000000000..3bf33ffc757b84
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1552-drm-v3d-Set-job-pointer-to-NULL-when-the-job-s-fence.patch
@@ -0,0 +1,84 @@
+From 131564261399a36a5cf2ac2731ed1ceffba93d10 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ma=C3=ADra=20Canal?= <mcanal@igalia.com>
+Date: Sat, 22 Feb 2025 14:56:46 -0300
+Subject: [PATCH] drm/v3d: Set job pointer to NULL when the job's fence has an
+ error
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Similar to commit e4b5ccd392b9 ("drm/v3d: Ensure job pointer is set to
+NULL after job completion"), ensure the job pointer is set to `NULL` when
+a job's fence has an error. Failing to do so can trigger kernel warnings
+in specific scenarios, such as:
+
+1. v3d_csd_job_run() assigns `v3d->csd_job = job`
+2. CSD job exceeds hang limit, causing a timeout → v3d_gpu_reset_for_timeout()
+3. GPU reset
+4. drm_sched_resubmit_jobs() sets the job's fence to `-ECANCELED`.
+5. v3d_csd_job_run() detects the fence error and returns NULL, not
+   submitting the job to the GPU
+6. User-space runs `modprobe -r v3d`
+7. v3d_gem_destroy()
+
+v3d_gem_destroy() triggers a warning indicating that the CSD job never
+ended, as we didn't set `v3d->csd_job` to NULL after the timeout. The same
+can also happen to BIN, RENDER, and TFU jobs.
+
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+---
+ drivers/gpu/drm/v3d/v3d_sched.c | 18 ++++++++++++++----
+ 1 file changed, 14 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/v3d/v3d_sched.c
++++ b/drivers/gpu/drm/v3d/v3d_sched.c
+@@ -189,8 +189,12 @@ static struct dma_fence *v3d_bin_job_run
+ 	struct dma_fence *fence;
+ 	unsigned long irqflags;
+ 
+-	if (unlikely(job->base.base.s_fence->finished.error))
++	if (unlikely(job->base.base.s_fence->finished.error)) {
++		spin_lock_irqsave(&v3d->job_lock, irqflags);
++		v3d->bin_job = NULL;
++		spin_unlock_irqrestore(&v3d->job_lock, irqflags);
+ 		return NULL;
++	}
+ 
+ 	/* Lock required around bin_job update vs
+ 	 * v3d_overflow_mem_work().
+@@ -244,8 +248,10 @@ static struct dma_fence *v3d_render_job_
+ 	struct drm_device *dev = &v3d->drm;
+ 	struct dma_fence *fence;
+ 
+-	if (unlikely(job->base.base.s_fence->finished.error))
++	if (unlikely(job->base.base.s_fence->finished.error)) {
++		v3d->render_job = NULL;
+ 		return NULL;
++	}
+ 
+ 	v3d->render_job = job;
+ 
+@@ -292,8 +298,10 @@ v3d_tfu_job_run(struct drm_sched_job *sc
+ 	struct drm_device *dev = &v3d->drm;
+ 	struct dma_fence *fence;
+ 
+-	if (unlikely(job->base.base.s_fence->finished.error))
++	if (unlikely(job->base.base.s_fence->finished.error)) {
++		v3d->tfu_job = NULL;
+ 		return NULL;
++	}
+ 
+ 	v3d->tfu_job = job;
+ 
+@@ -337,8 +345,10 @@ v3d_csd_job_run(struct drm_sched_job *sc
+ 	struct dma_fence *fence;
+ 	int i, csd_cfg0_reg, csd_cfg_reg_count;
+ 
+-	if (unlikely(job->base.base.s_fence->finished.error))
++	if (unlikely(job->base.base.s_fence->finished.error)) {
++		v3d->csd_job = NULL;
+ 		return NULL;
++	}
+ 
+ 	v3d->csd_job = job;
+ 
diff --git a/target/linux/bcm27xx/patches-6.6/950-1553-drm-v3d-Associate-a-V3D-tech-revision-to-all-support.patch b/target/linux/bcm27xx/patches-6.6/950-1553-drm-v3d-Associate-a-V3D-tech-revision-to-all-support.patch
new file mode 100644
index 00000000000000..0b3f80704b19a1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1553-drm-v3d-Associate-a-V3D-tech-revision-to-all-support.patch
@@ -0,0 +1,447 @@
+From 97988373018e7fa7ff33b7774f88d30e48f71509 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ma=C3=ADra=20Canal?= <mcanal@igalia.com>
+Date: Tue, 25 Feb 2025 20:44:59 -0300
+Subject: [PATCH] drm/v3d: Associate a V3D tech revision to all supported
+ devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The V3D driver currently determines the GPU tech version (33, 41...)
+by reading a register. This approach has worked so far since this
+information wasn’t needed before powering on the GPU.
+
+V3D 7.1 introduces new registers that must be written to power on the
+GPU, requiring us to know the V3D version beforehand. To address this,
+associate each supported SoC with the corresponding VideoCore GPU version
+as part of the device data.
+
+To prevent possible mistakes, add an assertion to verify that the version
+specified in the device data matches the one reported by the hardware.
+If there is a mismatch, the kernel will trigger a warning.
+
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+---
+ drivers/gpu/drm/v3d/v3d_debugfs.c | 128 +++++++++++++++---------------
+ drivers/gpu/drm/v3d/v3d_drv.c     |  22 +++--
+ drivers/gpu/drm/v3d/v3d_drv.h     |  11 ++-
+ drivers/gpu/drm/v3d/v3d_gem.c     |  12 +--
+ drivers/gpu/drm/v3d/v3d_irq.c     |  10 +--
+ drivers/gpu/drm/v3d/v3d_sched.c   |  12 +--
+ 6 files changed, 106 insertions(+), 89 deletions(-)
+
+--- a/drivers/gpu/drm/v3d/v3d_debugfs.c
++++ b/drivers/gpu/drm/v3d/v3d_debugfs.c
+@@ -22,74 +22,74 @@ struct v3d_reg_def {
+ };
+ 
+ static const struct v3d_reg_def v3d_hub_reg_defs[] = {
+-	REGDEF(33, 42, V3D_HUB_AXICFG),
+-	REGDEF(33, 71, V3D_HUB_UIFCFG),
+-	REGDEF(33, 71, V3D_HUB_IDENT0),
+-	REGDEF(33, 71, V3D_HUB_IDENT1),
+-	REGDEF(33, 71, V3D_HUB_IDENT2),
+-	REGDEF(33, 71, V3D_HUB_IDENT3),
+-	REGDEF(33, 71, V3D_HUB_INT_STS),
+-	REGDEF(33, 71, V3D_HUB_INT_MSK_STS),
+-
+-	REGDEF(33, 71, V3D_MMU_CTL),
+-	REGDEF(33, 71, V3D_MMU_VIO_ADDR),
+-	REGDEF(33, 71, V3D_MMU_VIO_ID),
+-	REGDEF(33, 71, V3D_MMU_DEBUG_INFO),
+-
+-	REGDEF(71, 71, V3D_V7_GMP_STATUS),
+-	REGDEF(71, 71, V3D_V7_GMP_CFG),
+-	REGDEF(71, 71, V3D_V7_GMP_VIO_ADDR),
++	REGDEF(V3D_GEN_33, V3D_GEN_42, V3D_HUB_AXICFG),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_HUB_UIFCFG),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_HUB_IDENT0),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_HUB_IDENT1),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_HUB_IDENT2),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_HUB_IDENT3),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_HUB_INT_STS),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_HUB_INT_MSK_STS),
++
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_MMU_CTL),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_MMU_VIO_ADDR),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_MMU_VIO_ID),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_MMU_DEBUG_INFO),
++
++	REGDEF(V3D_GEN_71, V3D_GEN_71, V3D_V7_GMP_STATUS),
++	REGDEF(V3D_GEN_71, V3D_GEN_71, V3D_V7_GMP_CFG),
++	REGDEF(V3D_GEN_71, V3D_GEN_71, V3D_V7_GMP_VIO_ADDR),
+ };
+ 
+ static const struct v3d_reg_def v3d_gca_reg_defs[] = {
+-	REGDEF(33, 33, V3D_GCA_SAFE_SHUTDOWN),
+-	REGDEF(33, 33, V3D_GCA_SAFE_SHUTDOWN_ACK),
++	REGDEF(V3D_GEN_33, V3D_GEN_33, V3D_GCA_SAFE_SHUTDOWN),
++	REGDEF(V3D_GEN_33, V3D_GEN_33, V3D_GCA_SAFE_SHUTDOWN_ACK),
+ };
+ 
+ static const struct v3d_reg_def v3d_core_reg_defs[] = {
+-	REGDEF(33, 71, V3D_CTL_IDENT0),
+-	REGDEF(33, 71, V3D_CTL_IDENT1),
+-	REGDEF(33, 71, V3D_CTL_IDENT2),
+-	REGDEF(33, 71, V3D_CTL_MISCCFG),
+-	REGDEF(33, 71, V3D_CTL_INT_STS),
+-	REGDEF(33, 71, V3D_CTL_INT_MSK_STS),
+-	REGDEF(33, 71, V3D_CLE_CT0CS),
+-	REGDEF(33, 71, V3D_CLE_CT0CA),
+-	REGDEF(33, 71, V3D_CLE_CT0EA),
+-	REGDEF(33, 71, V3D_CLE_CT1CS),
+-	REGDEF(33, 71, V3D_CLE_CT1CA),
+-	REGDEF(33, 71, V3D_CLE_CT1EA),
+-
+-	REGDEF(33, 71, V3D_PTB_BPCA),
+-	REGDEF(33, 71, V3D_PTB_BPCS),
+-
+-	REGDEF(33, 41, V3D_GMP_STATUS),
+-	REGDEF(33, 41, V3D_GMP_CFG),
+-	REGDEF(33, 41, V3D_GMP_VIO_ADDR),
+-
+-	REGDEF(33, 71, V3D_ERR_FDBGO),
+-	REGDEF(33, 71, V3D_ERR_FDBGB),
+-	REGDEF(33, 71, V3D_ERR_FDBGS),
+-	REGDEF(33, 71, V3D_ERR_STAT),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_CTL_IDENT0),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_CTL_IDENT1),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_CTL_IDENT2),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_CTL_MISCCFG),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_CTL_INT_STS),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_CTL_INT_MSK_STS),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_CLE_CT0CS),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_CLE_CT0CA),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_CLE_CT0EA),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_CLE_CT1CS),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_CLE_CT1CA),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_CLE_CT1EA),
++
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_PTB_BPCA),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_PTB_BPCS),
++
++	REGDEF(V3D_GEN_33, V3D_GEN_41, V3D_GMP_STATUS),
++	REGDEF(V3D_GEN_33, V3D_GEN_41, V3D_GMP_CFG),
++	REGDEF(V3D_GEN_33, V3D_GEN_41, V3D_GMP_VIO_ADDR),
++
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_ERR_FDBGO),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_ERR_FDBGB),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_ERR_FDBGS),
++	REGDEF(V3D_GEN_33, V3D_GEN_71, V3D_ERR_STAT),
+ };
+ 
+ static const struct v3d_reg_def v3d_csd_reg_defs[] = {
+-	REGDEF(41, 71, V3D_CSD_STATUS),
+-	REGDEF(41, 41, V3D_CSD_CURRENT_CFG0),
+-	REGDEF(41, 41, V3D_CSD_CURRENT_CFG1),
+-	REGDEF(41, 41, V3D_CSD_CURRENT_CFG2),
+-	REGDEF(41, 41, V3D_CSD_CURRENT_CFG3),
+-	REGDEF(41, 41, V3D_CSD_CURRENT_CFG4),
+-	REGDEF(41, 41, V3D_CSD_CURRENT_CFG5),
+-	REGDEF(41, 41, V3D_CSD_CURRENT_CFG6),
+-	REGDEF(71, 71, V3D_V7_CSD_CURRENT_CFG0),
+-	REGDEF(71, 71, V3D_V7_CSD_CURRENT_CFG1),
+-	REGDEF(71, 71, V3D_V7_CSD_CURRENT_CFG2),
+-	REGDEF(71, 71, V3D_V7_CSD_CURRENT_CFG3),
+-	REGDEF(71, 71, V3D_V7_CSD_CURRENT_CFG4),
+-	REGDEF(71, 71, V3D_V7_CSD_CURRENT_CFG5),
+-	REGDEF(71, 71, V3D_V7_CSD_CURRENT_CFG6),
+-	REGDEF(71, 71, V3D_V7_CSD_CURRENT_CFG7),
++	REGDEF(V3D_GEN_41, V3D_GEN_71, V3D_CSD_STATUS),
++	REGDEF(V3D_GEN_41, V3D_GEN_41, V3D_CSD_CURRENT_CFG0),
++	REGDEF(V3D_GEN_41, V3D_GEN_41, V3D_CSD_CURRENT_CFG1),
++	REGDEF(V3D_GEN_41, V3D_GEN_41, V3D_CSD_CURRENT_CFG2),
++	REGDEF(V3D_GEN_41, V3D_GEN_41, V3D_CSD_CURRENT_CFG3),
++	REGDEF(V3D_GEN_41, V3D_GEN_41, V3D_CSD_CURRENT_CFG4),
++	REGDEF(V3D_GEN_41, V3D_GEN_41, V3D_CSD_CURRENT_CFG5),
++	REGDEF(V3D_GEN_41, V3D_GEN_41, V3D_CSD_CURRENT_CFG6),
++	REGDEF(V3D_GEN_71, V3D_GEN_71, V3D_V7_CSD_CURRENT_CFG0),
++	REGDEF(V3D_GEN_71, V3D_GEN_71, V3D_V7_CSD_CURRENT_CFG1),
++	REGDEF(V3D_GEN_71, V3D_GEN_71, V3D_V7_CSD_CURRENT_CFG2),
++	REGDEF(V3D_GEN_71, V3D_GEN_71, V3D_V7_CSD_CURRENT_CFG3),
++	REGDEF(V3D_GEN_71, V3D_GEN_71, V3D_V7_CSD_CURRENT_CFG4),
++	REGDEF(V3D_GEN_71, V3D_GEN_71, V3D_V7_CSD_CURRENT_CFG5),
++	REGDEF(V3D_GEN_71, V3D_GEN_71, V3D_V7_CSD_CURRENT_CFG6),
++	REGDEF(V3D_GEN_71, V3D_GEN_71, V3D_V7_CSD_CURRENT_CFG7),
+ };
+ 
+ static int v3d_v3d_debugfs_regs(struct seq_file *m, void *unused)
+@@ -165,7 +165,7 @@ static int v3d_v3d_debugfs_ident(struct
+ 		   str_yes_no(ident2 & V3D_HUB_IDENT2_WITH_MMU));
+ 	seq_printf(m, "TFU:        %s\n",
+ 		   str_yes_no(ident1 & V3D_HUB_IDENT1_WITH_TFU));
+-	if (v3d->ver <= 42) {
++	if (v3d->ver <= V3D_GEN_42) {
+ 		seq_printf(m, "TSY:        %s\n",
+ 			   str_yes_no(ident1 & V3D_HUB_IDENT1_WITH_TSY));
+ 	}
+@@ -197,11 +197,11 @@ static int v3d_v3d_debugfs_ident(struct
+ 		seq_printf(m, "  QPUs:         %d\n", nslc * qups);
+ 		seq_printf(m, "  Semaphores:   %d\n",
+ 			   V3D_GET_FIELD(ident1, V3D_IDENT1_NSEM));
+-		if (v3d->ver <= 42) {
++		if (v3d->ver <= V3D_GEN_42) {
+ 			seq_printf(m, "  BCG int:      %d\n",
+ 				   (ident2 & V3D_IDENT2_BCG_INT) != 0);
+ 		}
+-		if (v3d->ver < 40) {
++		if (v3d->ver < V3D_GEN_41) {
+ 			seq_printf(m, "  Override TMU: %d\n",
+ 				   (misccfg & V3D_MISCCFG_OVRTMUOUT) != 0);
+ 		}
+@@ -311,8 +311,8 @@ static int v3d_measure_clock(struct seq_
+ 	int core = 0;
+ 	int measure_ms = 1000;
+ 
+-	if (v3d->ver >= 40) {
+-		int cycle_count_reg = v3d->ver < 71 ?
++	if (v3d->ver >= V3D_GEN_41) {
++		int cycle_count_reg = v3d->ver < V3D_GEN_71 ?
+ 			V3D_PCTR_CYCLE_COUNT : V3D_V7_PCTR_CYCLE_COUNT;
+ 		V3D_CORE_WRITE(core, V3D_V4_PCTR_0_SRC_0_3,
+ 			       V3D_SET_FIELD(cycle_count_reg,
+--- a/drivers/gpu/drm/v3d/v3d_drv.c
++++ b/drivers/gpu/drm/v3d/v3d_drv.c
+@@ -17,6 +17,7 @@
+ #include <linux/dma-mapping.h>
+ #include <linux/io.h>
+ #include <linux/module.h>
++#include <linux/of.h>
+ #include <linux/of_platform.h>
+ #include <linux/platform_device.h>
+ #include <linux/reset.h>
+@@ -88,7 +89,7 @@ static int v3d_get_param_ioctl(struct dr
+ 		args->value = 1;
+ 		return 0;
+ 	case DRM_V3D_PARAM_SUPPORTS_PERFMON:
+-		args->value = (v3d->ver >= 40);
++		args->value = (v3d->ver >= V3D_GEN_41);
+ 		return 0;
+ 	case DRM_V3D_PARAM_SUPPORTS_MULTISYNC_EXT:
+ 		args->value = 1;
+@@ -189,10 +190,10 @@ static const struct drm_driver v3d_drm_d
+ };
+ 
+ static const struct of_device_id v3d_of_match[] = {
+-	{ .compatible = "brcm,2712-v3d" },
+-	{ .compatible = "brcm,2711-v3d" },
+-	{ .compatible = "brcm,7268-v3d" },
+-	{ .compatible = "brcm,7278-v3d" },
++	{ .compatible = "brcm,2711-v3d", .data = (void *)V3D_GEN_42 },
++	{ .compatible = "brcm,2712-v3d", .data = (void *)V3D_GEN_71 },
++	{ .compatible = "brcm,7268-v3d", .data = (void *)V3D_GEN_33 },
++	{ .compatible = "brcm,7278-v3d", .data = (void *)V3D_GEN_41 },
+ 	{},
+ };
+ MODULE_DEVICE_TABLE(of, v3d_of_match);
+@@ -211,6 +212,7 @@ static int v3d_platform_drm_probe(struct
+ 	struct device_node *node;
+ 	struct drm_device *drm;
+ 	struct v3d_dev *v3d;
++	enum v3d_gen gen;
+ 	int ret;
+ 	u32 mmu_debug;
+ 	u32 ident1;
+@@ -224,6 +226,9 @@ static int v3d_platform_drm_probe(struct
+ 
+ 	platform_set_drvdata(pdev, drm);
+ 
++	gen = (enum v3d_gen)of_device_get_match_data(dev);
++	v3d->ver = gen;
++
+ 	ret = map_regs(v3d, &v3d->hub_regs, "hub");
+ 	if (ret)
+ 		return ret;
+@@ -253,6 +258,11 @@ static int v3d_platform_drm_probe(struct
+ 	ident1 = V3D_READ(V3D_HUB_IDENT1);
+ 	v3d->ver = (V3D_GET_FIELD(ident1, V3D_HUB_IDENT1_TVER) * 10 +
+ 		    V3D_GET_FIELD(ident1, V3D_HUB_IDENT1_REV));
++	/* Make sure that the V3D tech version retrieved from the HW is equal
++	 * to the one advertised by the device tree.
++	 */
++	WARN_ON(v3d->ver != gen);
++
+ 	v3d->cores = V3D_GET_FIELD(ident1, V3D_HUB_IDENT1_NCORES);
+ 	WARN_ON(v3d->cores > 1); /* multicore not yet implemented */
+ 
+@@ -300,7 +310,7 @@ static int v3d_platform_drm_probe(struct
+ 	v3d->clk_down_rate =
+ 		(clk_get_rate(clk_get_parent(v3d->clk)) / (1 << 4)) + 10000;
+ 
+-	if (v3d->ver < 41) {
++	if (v3d->ver < V3D_GEN_41) {
+ 		ret = map_regs(v3d, &v3d->gca_regs, "gca");
+ 		if (ret)
+ 			goto clk_disable;
+--- a/drivers/gpu/drm/v3d/v3d_drv.h
++++ b/drivers/gpu/drm/v3d/v3d_drv.h
+@@ -121,13 +121,20 @@ enum v3d_irq {
+ 	V3D_MAX_IRQS,
+ };
+ 
++enum v3d_gen {
++	V3D_GEN_33 = 33,
++	V3D_GEN_41 = 41,
++	V3D_GEN_42 = 42,
++	V3D_GEN_71 = 71,
++};
++
+ struct v3d_dev {
+ 	struct drm_device drm;
+ 
+ 	/* Short representation (e.g. 33, 41) of the V3D tech version
+ 	 * and revision.
+ 	 */
+-	int ver;
++	enum v3d_gen ver;
+ 	bool single_irq_line;
+ 
+ 	int irq[V3D_MAX_IRQS];
+@@ -221,7 +228,7 @@ to_v3d_dev(struct drm_device *dev)
+ static inline bool
+ v3d_has_csd(struct v3d_dev *v3d)
+ {
+-	return v3d->ver >= 41;
++	return v3d->ver >= V3D_GEN_41;
+ }
+ 
+ #define v3d_to_pdev(v3d) to_platform_device((v3d)->drm.dev)
+--- a/drivers/gpu/drm/v3d/v3d_gem.c
++++ b/drivers/gpu/drm/v3d/v3d_gem.c
+@@ -69,7 +69,7 @@ v3d_init_core(struct v3d_dev *v3d, int c
+ 	 * type.  If you want the default behavior, you can still put
+ 	 * "2" in the indirect texture state's output_type field.
+ 	 */
+-	if (v3d->ver < 40)
++	if (v3d->ver < V3D_GEN_41)
+ 		V3D_CORE_WRITE(core, V3D_CTL_MISCCFG, V3D_MISCCFG_OVRTMUOUT);
+ 
+ 	/* Whenever we flush the L2T cache, we always want to flush
+@@ -89,7 +89,7 @@ v3d_init_hw_state(struct v3d_dev *v3d)
+ static void
+ v3d_idle_axi(struct v3d_dev *v3d, int core)
+ {
+-	if (v3d->ver >= 71)
++	if (v3d->ver >= V3D_GEN_71)
+ 		return;
+ 
+ 	V3D_CORE_WRITE(core, V3D_GMP_CFG, V3D_GMP_CFG_STOP_REQ);
+@@ -105,7 +105,7 @@ v3d_idle_axi(struct v3d_dev *v3d, int co
+ static void
+ v3d_idle_gca(struct v3d_dev *v3d)
+ {
+-	if (v3d->ver >= 41)
++	if (v3d->ver >= V3D_GEN_41)
+ 		return;
+ 
+ 	V3D_GCA_WRITE(V3D_GCA_SAFE_SHUTDOWN, V3D_GCA_SAFE_SHUTDOWN_EN);
+@@ -181,13 +181,13 @@ v3d_reset(struct v3d_dev *v3d)
+ static void
+ v3d_flush_l3(struct v3d_dev *v3d)
+ {
+-	if (v3d->ver < 41) {
++	if (v3d->ver < V3D_GEN_41) {
+ 		u32 gca_ctrl = V3D_GCA_READ(V3D_GCA_CACHE_CTRL);
+ 
+ 		V3D_GCA_WRITE(V3D_GCA_CACHE_CTRL,
+ 			      gca_ctrl | V3D_GCA_CACHE_CTRL_FLUSH);
+ 
+-		if (v3d->ver < 33) {
++		if (v3d->ver < V3D_GEN_33) {
+ 			V3D_GCA_WRITE(V3D_GCA_CACHE_CTRL,
+ 				      gca_ctrl & ~V3D_GCA_CACHE_CTRL_FLUSH);
+ 		}
+@@ -200,7 +200,7 @@ v3d_flush_l3(struct v3d_dev *v3d)
+ static void
+ v3d_invalidate_l2c(struct v3d_dev *v3d, int core)
+ {
+-	if (v3d->ver > 32)
++	if (v3d->ver >= V3D_GEN_33)
+ 		return;
+ 
+ 	V3D_CORE_WRITE(core, V3D_CTL_L2CACTL,
+--- a/drivers/gpu/drm/v3d/v3d_irq.c
++++ b/drivers/gpu/drm/v3d/v3d_irq.c
+@@ -125,8 +125,8 @@ v3d_irq(int irq, void *arg)
+ 		status = IRQ_HANDLED;
+ 	}
+ 
+-	if ((v3d->ver < 71 && (intsts & V3D_INT_CSDDONE)) ||
+-	    (v3d->ver >= 71 && (intsts & V3D_V7_INT_CSDDONE))) {
++	if ((v3d->ver < V3D_GEN_71 && (intsts & V3D_INT_CSDDONE)) ||
++	    (v3d->ver >= V3D_GEN_71 && (intsts & V3D_V7_INT_CSDDONE))) {
+ 		struct v3d_fence *fence =
+ 			to_v3d_fence(v3d->csd_job->base.irq_fence);
+ 		v3d->gpu_queue_stats[V3D_CSD].last_exec_end = local_clock();
+@@ -142,7 +142,7 @@ v3d_irq(int irq, void *arg)
+ 	/* We shouldn't be triggering these if we have GMP in
+ 	 * always-allowed mode.
+ 	 */
+-	if (v3d->ver < 71 && (intsts & V3D_INT_GMPV))
++	if (v3d->ver < V3D_GEN_71 && (intsts & V3D_INT_GMPV))
+ 		dev_err(v3d->drm.dev, "GMP violation\n");
+ 
+ 	/* V3D 4.2 wires the hub and core IRQs together, so if we &
+@@ -200,7 +200,7 @@ v3d_hub_irq(int irq, void *arg)
+ 
+ 		V3D_WRITE(V3D_MMU_CTL, V3D_READ(V3D_MMU_CTL));
+ 
+-		if (v3d->ver >= 41) {
++		if (v3d->ver >= V3D_GEN_41) {
+ 			axi_id = axi_id >> 5;
+ 			if (axi_id < ARRAY_SIZE(v3d41_axi_ids))
+ 				client = v3d41_axi_ids[axi_id];
+@@ -219,7 +219,7 @@ v3d_hub_irq(int irq, void *arg)
+ 		status = IRQ_HANDLED;
+ 	}
+ 
+-	if (v3d->ver >= 71 && intsts & V3D_V7_HUB_INT_GMPV) {
++	if (v3d->ver >= V3D_GEN_71 && intsts & V3D_V7_HUB_INT_GMPV) {
+ 		dev_err(v3d->drm.dev, "GMP Violation\n");
+ 		status = IRQ_HANDLED;
+ 	}
+--- a/drivers/gpu/drm/v3d/v3d_sched.c
++++ b/drivers/gpu/drm/v3d/v3d_sched.c
+@@ -288,7 +288,7 @@ static struct dma_fence *v3d_render_job_
+ 	return fence;
+ }
+ 
+-#define V3D_TFU_REG(name) ((v3d->ver < 71) ? V3D_TFU_ ## name : V3D_V7_TFU_ ## name)
++#define V3D_TFU_REG(name) ((v3d->ver < V3D_GEN_71) ? V3D_TFU_ ## name : V3D_V7_TFU_ ## name)
+ 
+ static struct dma_fence *
+ v3d_tfu_job_run(struct drm_sched_job *sched_job)
+@@ -321,11 +321,11 @@ v3d_tfu_job_run(struct drm_sched_job *sc
+ 	V3D_WRITE(V3D_TFU_REG(ICA), job->args.ica);
+ 	V3D_WRITE(V3D_TFU_REG(IUA), job->args.iua);
+ 	V3D_WRITE(V3D_TFU_REG(IOA), job->args.ioa);
+-	if (v3d->ver >= 71)
++	if (v3d->ver >= V3D_GEN_71)
+ 		V3D_WRITE(V3D_V7_TFU_IOC, job->args.v71.ioc);
+ 	V3D_WRITE(V3D_TFU_REG(IOS), job->args.ios);
+ 	V3D_WRITE(V3D_TFU_REG(COEF0), job->args.coef[0]);
+-	if (v3d->ver >= 71 || (job->args.coef[0] & V3D_TFU_COEF0_USECOEF)) {
++	if (v3d->ver >= V3D_GEN_71 || (job->args.coef[0] & V3D_TFU_COEF0_USECOEF)) {
+ 		V3D_WRITE(V3D_TFU_REG(COEF1), job->args.coef[1]);
+ 		V3D_WRITE(V3D_TFU_REG(COEF2), job->args.coef[2]);
+ 		V3D_WRITE(V3D_TFU_REG(COEF3), job->args.coef[3]);
+@@ -367,8 +367,8 @@ v3d_csd_job_run(struct drm_sched_job *sc
+ 	v3d_sched_stats_add_job(&v3d->gpu_queue_stats[V3D_CSD], sched_job);
+ 	v3d_switch_perfmon(v3d, &job->base);
+ 
+-	csd_cfg0_reg = v3d->ver < 71 ? V3D_CSD_QUEUED_CFG0 : V3D_V7_CSD_QUEUED_CFG0;
+-	csd_cfg_reg_count = v3d->ver < 71 ? 6 : 7;
++	csd_cfg0_reg = v3d->ver < V3D_GEN_71 ? V3D_CSD_QUEUED_CFG0 : V3D_V7_CSD_QUEUED_CFG0;
++	csd_cfg_reg_count = v3d->ver < V3D_GEN_71 ? 6 : 7;
+ 	for (i = 1; i <= csd_cfg_reg_count; i++)
+ 		V3D_CORE_WRITE(0, csd_cfg0_reg + 4 * i, job->args.cfg[i]);
+ 	/* CFG0 write kicks off the job. */
+@@ -487,7 +487,7 @@ v3d_csd_job_timedout(struct drm_sched_jo
+ {
+ 	struct v3d_csd_job *job = to_csd_job(sched_job);
+ 	struct v3d_dev *v3d = job->base.v3d;
+-	u32 batches = V3D_CORE_READ(0, (v3d->ver < 71 ? V3D_CSD_CURRENT_CFG4 :
++	u32 batches = V3D_CORE_READ(0, (v3d->ver < V3D_GEN_71 ? V3D_CSD_CURRENT_CFG4 :
+ 							V3D_V7_CSD_CURRENT_CFG4));
+ 
+ 	/* If we've made progress, skip reset, add the job to the pending
diff --git a/target/linux/bcm27xx/patches-6.6/950-1554-dt-bindings-gpu-v3d-Add-SMS-to-the-registers-list.patch b/target/linux/bcm27xx/patches-6.6/950-1554-dt-bindings-gpu-v3d-Add-SMS-to-the-registers-list.patch
new file mode 100644
index 00000000000000..fb03d82e3f5ea2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1554-dt-bindings-gpu-v3d-Add-SMS-to-the-registers-list.patch
@@ -0,0 +1,43 @@
+From 08e99bc475ad907f3087e4f14c2ddb6560514da1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ma=C3=ADra=20Canal?= <mcanal@igalia.com>
+Date: Sat, 22 Feb 2025 15:26:39 -0300
+Subject: [PATCH] dt-bindings: gpu: v3d: Add SMS to the registers' list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+V3D 7.1 exposes a new register block, called V3D_SMS. As BCM2712 has a
+V3D 7.1 core, add a new register item to the list. Similar to the GCA
+and bridge register, SMS is optional and should only be added for V3D
+7.1 variants.
+
+Cc: Krzysztof Kozlowski <krzk+dt@kernel.org>
+Cc: Conor Dooley <conor+dt@kernel.org>
+Cc: Nicolas Saenz Julienne <nsaenz@kernel.org>
+Cc: devicetree@vger.kernel.org
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+---
+ Documentation/devicetree/bindings/gpu/brcm,bcm-v3d.yaml | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/Documentation/devicetree/bindings/gpu/brcm,bcm-v3d.yaml
++++ b/Documentation/devicetree/bindings/gpu/brcm,bcm-v3d.yaml
+@@ -27,14 +27,16 @@ properties:
+       - description: core0 register (required)
+       - description: GCA cache controller register (if GCA controller present)
+       - description: bridge register (if no external reset controller)
++      - description: SMS register (if SMS controller present)
+     minItems: 2
+ 
+   reg-names:
+     items:
+       - const: hub
+       - const: core0
+-      - enum: [ bridge, gca ]
+-      - enum: [ bridge, gca ]
++      - enum: [ bridge, gca, sms ]
++      - enum: [ bridge, gca, sms ]
++      - enum: [ bridge, gca, sms ]
+     minItems: 2
+ 
+   interrupts:
diff --git a/target/linux/bcm27xx/patches-6.6/950-1555-drm-v3d-Use-V3D_SMS-registers-for-power-on-off-and-r.patch b/target/linux/bcm27xx/patches-6.6/950-1555-drm-v3d-Use-V3D_SMS-registers-for-power-on-off-and-r.patch
new file mode 100644
index 00000000000000..b405938cefca07
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1555-drm-v3d-Use-V3D_SMS-registers-for-power-on-off-and-r.patch
@@ -0,0 +1,198 @@
+From 85e1a7592aa192d760159f9bc6e83d56fdf433f3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ma=C3=ADra=20Canal?= <mcanal@igalia.com>
+Date: Sat, 22 Feb 2025 15:49:49 -0300
+Subject: [PATCH] drm/v3d: Use V3D_SMS registers for power on/off and reset on
+ V3D 7.x
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+In addition to the standard reset controller, V3D 7.x requires configuring
+the V3D_SMS registers for proper power on/off and reset. Add the new
+registers to `v3d_regs.h` and ensure they are properly configured during
+device probing, removal, and reset.
+
+This change fixes GPU reset issues on the Raspberry Pi 5 (BCM2712).
+Without exposing these registers, a GPU reset causes the GPU to hang,
+stopping any further job execution and freezing the desktop GUI. The same
+issue occurs when unloading and loading the v3d driver.
+
+Link: https://github.com/raspberrypi/linux/issues/6660
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+---
+ drivers/gpu/drm/v3d/v3d_drv.c  | 40 ++++++++++++++++++++++++++++++++++
+ drivers/gpu/drm/v3d/v3d_drv.h  | 11 ++++++++++
+ drivers/gpu/drm/v3d/v3d_gem.c  | 17 +++++++++++++++
+ drivers/gpu/drm/v3d/v3d_regs.h | 26 ++++++++++++++++++++++
+ 4 files changed, 94 insertions(+)
+
+--- a/drivers/gpu/drm/v3d/v3d_drv.c
++++ b/drivers/gpu/drm/v3d/v3d_drv.c
+@@ -198,6 +198,36 @@ static const struct of_device_id v3d_of_
+ };
+ MODULE_DEVICE_TABLE(of, v3d_of_match);
+ 
++static void
++v3d_idle_sms(struct v3d_dev *v3d)
++{
++	if (v3d->ver < V3D_GEN_71)
++		return;
++
++	V3D_SMS_WRITE(V3D_SMS_TEE_CS, V3D_SMS_CLEAR_POWER_OFF);
++
++	if (wait_for((V3D_GET_FIELD(V3D_SMS_READ(V3D_SMS_TEE_CS),
++				    V3D_SMS_STATE) == V3D_SMS_IDLE), 100)) {
++		DRM_ERROR("Failed to power up SMS\n");
++	}
++
++	v3d_reset_sms(v3d);
++}
++
++static void
++v3d_power_off_sms(struct v3d_dev *v3d)
++{
++	if (v3d->ver < V3D_GEN_71)
++		return;
++
++	V3D_SMS_WRITE(V3D_SMS_TEE_CS, V3D_SMS_POWER_OFF);
++
++	if (wait_for((V3D_GET_FIELD(V3D_SMS_READ(V3D_SMS_TEE_CS),
++				    V3D_SMS_STATE) == V3D_SMS_POWER_OFF_STATE), 100)) {
++		DRM_ERROR("Failed to power off SMS\n");
++	}
++}
++
+ static int
+ map_regs(struct v3d_dev *v3d, void __iomem **regs, const char *name)
+ {
+@@ -237,6 +267,12 @@ static int v3d_platform_drm_probe(struct
+ 	if (ret)
+ 		return ret;
+ 
++	if (v3d->ver >= V3D_GEN_71) {
++		ret = map_regs(v3d, &v3d->sms_regs, "sms");
++		if (ret)
++			return ret;
++	}
++
+ 	v3d->clk = devm_clk_get_optional(dev, NULL);
+ 	if (IS_ERR(v3d->clk))
+ 		return dev_err_probe(dev, PTR_ERR(v3d->clk), "Failed to get V3D clock\n");
+@@ -247,6 +283,8 @@ static int v3d_platform_drm_probe(struct
+ 		return ret;
+ 	}
+ 
++	v3d_idle_sms(v3d);
++
+ 	mmu_debug = V3D_READ(V3D_MMU_DEBUG_INFO);
+ 	mask = DMA_BIT_MASK(30 + V3D_GET_FIELD(mmu_debug, V3D_MMU_PA_WIDTH));
+ 	ret = dma_set_mask_and_coherent(dev, mask);
+@@ -364,6 +402,8 @@ static void v3d_platform_drm_remove(stru
+ 	dma_free_wc(v3d->drm.dev, 4096, v3d->mmu_scratch,
+ 		    v3d->mmu_scratch_paddr);
+ 
++	v3d_power_off_sms(v3d);
++
+ 	clk_disable_unprepare(v3d->clk);
+ }
+ 
+--- a/drivers/gpu/drm/v3d/v3d_drv.h
++++ b/drivers/gpu/drm/v3d/v3d_drv.h
+@@ -143,6 +143,7 @@ struct v3d_dev {
+ 	void __iomem *core_regs[3];
+ 	void __iomem *bridge_regs;
+ 	void __iomem *gca_regs;
++	void __iomem *sms_regs;
+ 	struct clk *clk;
+ 	struct delayed_work clk_down_work;
+ 	unsigned long clk_up_rate, clk_down_rate;
+@@ -285,6 +286,15 @@ to_v3d_fence(struct dma_fence *fence)
+ #define V3D_GCA_READ(offset) readl(v3d->gca_regs + offset)
+ #define V3D_GCA_WRITE(offset, val) writel(val, v3d->gca_regs + offset)
+ 
++#define V3D_SMS_IDLE				0x0
++#define V3D_SMS_ISOLATING_FOR_RESET		0xa
++#define V3D_SMS_RESETTING			0xb
++#define V3D_SMS_ISOLATING_FOR_POWER_OFF	0xc
++#define V3D_SMS_POWER_OFF_STATE		0xd
++
++#define V3D_SMS_READ(offset) readl(v3d->sms_regs + (offset))
++#define V3D_SMS_WRITE(offset, val) writel(val, v3d->sms_regs + (offset))
++
+ #define V3D_CORE_READ(core, offset) readl(v3d->core_regs[core] + offset)
+ #define V3D_CORE_WRITE(core, offset, val) writel(val, v3d->core_regs[core] + offset)
+ 
+@@ -463,6 +473,7 @@ int v3d_wait_bo_ioctl(struct drm_device
+ 		      struct drm_file *file_priv);
+ void v3d_job_cleanup(struct v3d_job *job);
+ void v3d_job_put(struct v3d_job *job);
++void v3d_reset_sms(struct v3d_dev *v3d);
+ void v3d_reset(struct v3d_dev *v3d);
+ void v3d_invalidate_caches(struct v3d_dev *v3d);
+ void v3d_clean_caches(struct v3d_dev *v3d);
+--- a/drivers/gpu/drm/v3d/v3d_gem.c
++++ b/drivers/gpu/drm/v3d/v3d_gem.c
+@@ -152,6 +152,22 @@ v3d_reset_v3d(struct v3d_dev *v3d)
+ }
+ 
+ void
++v3d_reset_sms(struct v3d_dev *v3d)
++{
++	if (v3d->ver < V3D_GEN_71)
++		return;
++
++	V3D_SMS_WRITE(V3D_SMS_REE_CS, V3D_SET_FIELD(0x4, V3D_SMS_STATE));
++
++	if (wait_for(!(V3D_GET_FIELD(V3D_SMS_READ(V3D_SMS_REE_CS),
++				     V3D_SMS_STATE) == V3D_SMS_ISOLATING_FOR_RESET) &&
++		     !(V3D_GET_FIELD(V3D_SMS_READ(V3D_SMS_REE_CS),
++				     V3D_SMS_STATE) == V3D_SMS_RESETTING), 100)) {
++		DRM_ERROR("Failed to wait for SMS reset\n");
++	}
++}
++
++void
+ v3d_reset(struct v3d_dev *v3d)
+ {
+ 	struct drm_device *dev = &v3d->drm;
+@@ -168,6 +184,7 @@ v3d_reset(struct v3d_dev *v3d)
+ 	v3d_irq_disable(v3d);
+ 
+ 	v3d_idle_gca(v3d);
++	v3d_reset_sms(v3d);
+ 	v3d_reset_v3d(v3d);
+ 
+ 	v3d_mmu_set_page_table(v3d);
+--- a/drivers/gpu/drm/v3d/v3d_regs.h
++++ b/drivers/gpu/drm/v3d/v3d_regs.h
+@@ -543,4 +543,30 @@
+ # define V3D_ERR_VPAERGS                               BIT(1)
+ # define V3D_ERR_VPAEABB                               BIT(0)
+ 
++#define V3D_SMS_REE_CS                                 0x00000
++#define V3D_SMS_TEE_CS                                 0x00400
++# define V3D_SMS_INTERRUPT                             BIT(31)
++# define V3D_SMS_POWER_OFF                             BIT(30)
++# define V3D_SMS_CLEAR_POWER_OFF                       BIT(29)
++# define V3D_SMS_LOCK                                  BIT(28)
++# define V3D_SMS_CLEAR_LOCK                            BIT(27)
++# define V3D_SMS_SVP_MODE_EXIT                         BIT(26)
++# define V3D_SMS_CLEAR_SVP_MODE_EXIT                   BIT(25)
++# define V3D_SMS_SVP_MODE_ENTER                        BIT(24)
++# define V3D_SMS_CLEAR_SVP_MODE_ENTER                  BIT(23)
++# define V3D_SMS_THEIR_MODE_EXIT                       BIT(22)
++# define V3D_SMS_THEIR_MODE_ENTER                      BIT(21)
++# define V3D_SMS_OUR_MODE_EXIT                         BIT(20)
++# define V3D_SMS_CLEAR_OUR_MODE_EXIT                   BIT(19)
++# define V3D_SMS_SEQ_PC_MASK                           V3D_MASK(16, 10)
++# define V3D_SMS_SEQ_PC_SHIFT                          10
++# define V3D_SMS_HUBCORE_STATUS_MASK                   V3D_MASK(9, 8)
++# define V3D_SMS_HUBCORE_STATUS_SHIFT                  8
++# define V3D_SMS_NEW_MODE_MASK                         V3D_MASK(7, 6)
++# define V3D_SMS_NEW_MODE_SHIFT                        6
++# define V3D_SMS_OLD_MODE_MASK                         V3D_MASK(5, 4)
++# define V3D_SMS_OLD_MODE_SHIFT                        4
++# define V3D_SMS_STATE_MASK                            V3D_MASK(3, 0)
++# define V3D_SMS_STATE_SHIFT                           0
++
+ #endif /* V3D_REGS_H */
diff --git a/target/linux/bcm27xx/patches-6.6/950-1556-dts-bcm2712-Add-V3D_SMS-register.patch b/target/linux/bcm27xx/patches-6.6/950-1556-dts-bcm2712-Add-V3D_SMS-register.patch
new file mode 100644
index 00000000000000..2d43d1c858da9e
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1556-dts-bcm2712-Add-V3D_SMS-register.patch
@@ -0,0 +1,27 @@
+From 3c21211667e35029054b0dfebdf292e4e7d5754b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ma=C3=ADra=20Canal?= <mcanal@igalia.com>
+Date: Thu, 27 Feb 2025 21:00:42 -0300
+Subject: [PATCH] dts: bcm2712: Add V3D_SMS register
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: Maíra Canal <mcanal@igalia.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
++++ b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
+@@ -1222,8 +1222,9 @@
+ 		v3d: v3d@2000000 {
+ 			compatible = "brcm,2712-v3d";
+ 			reg = <0x10 0x02000000  0x0 0x4000>,
+-			      <0x10 0x02008000  0x0 0x6000>;
+-			reg-names = "hub", "core0";
++			      <0x10 0x02008000  0x0 0x6000>,
++			      <0x10 0x02030800  0x0 0x0700>;
++			reg-names = "hub", "core0", "sms";
+ 
+ 			power-domains = <&pm BCM2835_POWER_DOMAIN_GRAFX_V3D>;
+ 			resets = <&pm BCM2835_RESET_V3D>;
diff --git a/target/linux/bcm27xx/patches-6.6/950-1557-dts-Remove-the-power-key-debounce-on-Pi-500.patch b/target/linux/bcm27xx/patches-6.6/950-1557-dts-Remove-the-power-key-debounce-on-Pi-500.patch
new file mode 100644
index 00000000000000..faccc79c2ca1a2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1557-dts-Remove-the-power-key-debounce-on-Pi-500.patch
@@ -0,0 +1,21 @@
+From 08d4e8f52256bd422d8a1f876411603f627d0a82 Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 11 Mar 2025 08:58:52 +0000
+Subject: [PATCH] dts: Remove the power key debounce on Pi 500
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm64/boot/dts/broadcom/bcm2712-rpi-500.dts | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/broadcom/bcm2712-rpi-500.dts
++++ b/arch/arm64/boot/dts/broadcom/bcm2712-rpi-500.dts
+@@ -7,7 +7,7 @@
+ };
+ 
+ &pwr_key {
+-	debounce-interval = <400>;
++	debounce-interval = <0>;
+ };
+ 
+ &gio {
diff --git a/target/linux/bcm27xx/patches-6.6/950-1558-media-i2c-imx477-Add-further-link-frequency-options.patch b/target/linux/bcm27xx/patches-6.6/950-1558-media-i2c-imx477-Add-further-link-frequency-options.patch
new file mode 100644
index 00000000000000..8ed80cd201fda1
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1558-media-i2c-imx477-Add-further-link-frequency-options.patch
@@ -0,0 +1,77 @@
+From 0553897d77e849a86e836ddf1e0c0dbbd8e64f83 Mon Sep 17 00:00:00 2001
+From: Dave Stevenson <dave.stevenson@raspberrypi.com>
+Date: Mon, 20 Jan 2025 10:40:09 +0000
+Subject: [PATCH] media: i2c: imx477: Add further link frequency options
+
+https://github.com/raspberrypi/linux/issues/6004 reports further
+issues with GPS interference.
+
+Untested, but adds further link frequency options.
+
+Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
+---
+ drivers/media/i2c/imx477.c | 33 +++++++++++++++++++++++++++++++++
+ 1 file changed, 33 insertions(+)
+
+--- a/drivers/media/i2c/imx477.c
++++ b/drivers/media/i2c/imx477.c
+@@ -169,12 +169,18 @@ enum {
+ 	IMX477_LINK_FREQ_450MHZ,
+ 	IMX477_LINK_FREQ_453MHZ,
+ 	IMX477_LINK_FREQ_456MHZ,
++	IMX477_LINK_FREQ_459MHZ,
++	IMX477_LINK_FREQ_462MHZ,
++	IMX477_LINK_FREQ_498MHZ,
+ };
+ 
+ static const s64 link_freqs[] = {
+ 	[IMX477_LINK_FREQ_450MHZ] = 450000000,
+ 	[IMX477_LINK_FREQ_453MHZ] = 453000000,
+ 	[IMX477_LINK_FREQ_456MHZ] = 456000000,
++	[IMX477_LINK_FREQ_459MHZ] = 459000000,
++	[IMX477_LINK_FREQ_462MHZ] = 462000000,
++	[IMX477_LINK_FREQ_498MHZ] = 498000000,
+ };
+ 
+ /* 450MHz is the nominal "default" link frequency */
+@@ -193,6 +199,21 @@ static const struct imx477_reg link_456M
+ 	{0x030F, 0x98},
+ };
+ 
++static const struct imx477_reg link_459Mhz_regs[] = {
++	{0x030E, 0x00},
++	{0x030F, 0x99},
++};
++
++static const struct imx477_reg link_462Mhz_regs[] = {
++	{0x030E, 0x00},
++	{0x030F, 0x9a},
++};
++
++static const struct imx477_reg link_498Mhz_regs[] = {
++	{0x030E, 0x00},
++	{0x030F, 0xa6},
++};
++
+ static const struct imx477_reg_list link_freq_regs[] = {
+ 	[IMX477_LINK_FREQ_450MHZ] = {
+ 		.regs = link_450Mhz_regs,
+@@ -206,6 +227,18 @@ static const struct imx477_reg_list link
+ 		.regs = link_456Mhz_regs,
+ 		.num_of_regs = ARRAY_SIZE(link_456Mhz_regs)
+ 	},
++	[IMX477_LINK_FREQ_459MHZ] = {
++		.regs = link_459Mhz_regs,
++		.num_of_regs = ARRAY_SIZE(link_459Mhz_regs)
++	},
++	[IMX477_LINK_FREQ_462MHZ] = {
++		.regs = link_462Mhz_regs,
++		.num_of_regs = ARRAY_SIZE(link_462Mhz_regs)
++	},
++	[IMX477_LINK_FREQ_498MHZ] = {
++		.regs = link_498Mhz_regs,
++		.num_of_regs = ARRAY_SIZE(link_498Mhz_regs)
++	},
+ };
+ 
+ static const struct imx477_reg mode_common_regs[] = {
diff --git a/target/linux/bcm27xx/patches-6.6/950-1559-overlays-Fix-some-unusable-fragments.patch b/target/linux/bcm27xx/patches-6.6/950-1559-overlays-Fix-some-unusable-fragments.patch
new file mode 100644
index 00000000000000..bebe05555239c2
--- /dev/null
+++ b/target/linux/bcm27xx/patches-6.6/950-1559-overlays-Fix-some-unusable-fragments.patch
@@ -0,0 +1,82 @@
+From 9da8d6df2051478f0ba16d73c65995955c19cb3a Mon Sep 17 00:00:00 2001
+From: Phil Elwell <phil@raspberrypi.com>
+Date: Tue, 18 Mar 2025 13:09:11 +0000
+Subject: [PATCH] overlays: Fix some unusable fragments
+
+A forthcoming overlaycheck update looks for dormant fragments with no
+parameters to enable them. The test discovered some real errors, which
+this patch fixes, and one case where some fragments aren't yet being
+used, which this comments out until they are.
+
+Signed-off-by: Phil Elwell <phil@raspberrypi.com>
+---
+ arch/arm/boot/dts/overlays/rpi-poe-overlay.dts           | 2 +-
+ arch/arm/boot/dts/overlays/rpi-poe-plus-overlay.dts      | 2 +-
+ arch/arm/boot/dts/overlays/sx150x-overlay.dts            | 2 +-
+ arch/arm/boot/dts/overlays/vc4-kms-dpi-panel-overlay.dts | 4 ++++
+ 4 files changed, 7 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
++++ b/arch/arm/boot/dts/overlays/rpi-poe-overlay.dts
+@@ -145,7 +145,7 @@
+ 		poe_fan_temp2_hyst =	<&trip2>,"hysteresis:0";
+ 		poe_fan_temp3 =		<&trip3>,"temperature:0";
+ 		poe_fan_temp3_hyst =	<&trip3>,"hysteresis:0";
+-		i2c =			<0>, "+5+6",
++		i2c =			<0>, "+7+8",
+ 					<&fwpwm>,"status=disabled",
+ 					<&i2c_bus>,"status=okay",
+ 					<&poe_mfd>,"status=okay",
+--- a/arch/arm/boot/dts/overlays/rpi-poe-plus-overlay.dts
++++ b/arch/arm/boot/dts/overlays/rpi-poe-plus-overlay.dts
+@@ -28,7 +28,7 @@
+ 	};
+ 
+ 	__overrides__ {
+-		i2c =	<0>, "+5+6",
++		i2c =	<0>, "+7+8",
+ 			<&fwpwm>,"status=disabled",
+ 			<&rpi_poe_power_supply>,"status=disabled",
+ 			<&i2c_bus>,"status=okay",
+--- a/arch/arm/boot/dts/overlays/sx150x-overlay.dts
++++ b/arch/arm/boot/dts/overlays/sx150x-overlay.dts
+@@ -1681,7 +1681,7 @@
+ 		sx1507-1-3E-int-gpio = <0>,"+67+99",  <&sx150x_1_3E_pins>,"brcm,pins:0", <&sx1507_1_3E>,"interrupts:0";
+ 		sx1507-0-3F-int-gpio = <0>,"+68+100", <&sx150x_0_3F_pins>,"brcm,pins:0", <&sx1507_0_3F>,"interrupts:0";
+ 		sx1507-1-3F-int-gpio = <0>,"+69+101", <&sx150x_1_3F_pins>,"brcm,pins:0", <&sx1507_1_3F>,"interrupts:0";
+-		sx1507-0-70-int-gpio = <0>,"+60+102", <&sx150x_0_70_pins>,"brcm,pins:0", <&sx1507_0_70>,"interrupts:0";
++		sx1507-0-70-int-gpio = <0>,"+70+102", <&sx150x_0_70_pins>,"brcm,pins:0", <&sx1507_0_70>,"interrupts:0";
+ 		sx1507-1-70-int-gpio = <0>,"+71+103", <&sx150x_1_70_pins>,"brcm,pins:0", <&sx1507_1_70>,"interrupts:0";
+ 		sx1507-0-71-int-gpio = <0>,"+72+104", <&sx150x_0_71_pins>,"brcm,pins:0", <&sx1507_0_71>,"interrupts:0";
+ 		sx1507-1-71-int-gpio = <0>,"+73+105", <&sx150x_1_71_pins>,"brcm,pins:0", <&sx1507_1_71>,"interrupts:0";
+--- a/arch/arm/boot/dts/overlays/vc4-kms-dpi-panel-overlay.dts
++++ b/arch/arm/boot/dts/overlays/vc4-kms-dpi-panel-overlay.dts
+@@ -42,24 +42,28 @@
+ 			pinctrl-0 = <&dpi_18bit_gpio0>;
+ 		};
+ 	};
++#if 0
+ 	fragment@92 {
+ 		target = <&dpi>;
+ 		__dormant__  {
+ 			pinctrl-0 = <&dpi_gpio0>;
+ 		};
+ 	};
++#endif
+ 	fragment@93 {
+ 		target = <&dpi>;
+ 		__dormant__  {
+ 			pinctrl-0 = <&dpi_16bit_cpadhi_gpio0>;
+ 		};
+ 	};
++#if 0
+ 	fragment@94 {
+ 		target = <&dpi>;
+ 		__dormant__  {
+ 			pinctrl-0 = <&dpi_16bit_gpio0>;
+ 		};
+ 	};
++#endif
+ 
+ 	__overrides__ {
+ 		at056tn53v1 = <0>, "+0+90";
diff --git a/target/linux/bcm27xx/patches-6.6/950-1267-dts-rp1-Disable-DMA-usage-for-UART0.patch b/target/linux/bcm27xx/patches-6.6/950-1560-dts-rp1-Don-t-use-DMA-with-UARTs.patch
similarity index 54%
rename from target/linux/bcm27xx/patches-6.6/950-1267-dts-rp1-Disable-DMA-usage-for-UART0.patch
rename to target/linux/bcm27xx/patches-6.6/950-1560-dts-rp1-Don-t-use-DMA-with-UARTs.patch
index c809c4f10b60f6..df19f4cac6cf19 100644
--- a/target/linux/bcm27xx/patches-6.6/950-1267-dts-rp1-Disable-DMA-usage-for-UART0.patch
+++ b/target/linux/bcm27xx/patches-6.6/950-1560-dts-rp1-Don-t-use-DMA-with-UARTs.patch
@@ -1,16 +1,15 @@
-From cc63d552b9aab92fb581dfb08267d5af697f477b Mon Sep 17 00:00:00 2001
+From bba53a117a4a5c29da892962332ff1605990e17a Mon Sep 17 00:00:00 2001
 From: Phil Elwell <phil@raspberrypi.com>
-Date: Wed, 18 Sep 2024 16:45:24 +0100
-Subject: [PATCH 1267/1350] dts: rp1: Disable DMA usage for UART0
+Date: Wed, 26 Mar 2025 11:28:28 +0000
+Subject: [PATCH] dts: rp1: Don't use DMA with UARTs
 
-Some recent DMA changes have led to data loss in UART0 on Pi 5. It also
-seems that even prior to these changes there was a problem with aborted
-transfers.
+DMA has been enabled on RP1's UART0, but with mixed success. Transmits
+seem to work, but the DMA interface is not well suited to receiving
+arbitrary amounts of data. In particular, the PL011 driver is slow to
+pass on the received data, batching it into large blocks.
 
-As this is the only RP1 UART configured for DMA, it is better to remove
-the DMA usage until it is shown to be reliable.
-
-Link: https://github.com/raspberrypi/linux/issues/6365
+On balance, it's better to just disable the DMA support. As with the
+other UARTs, the required runes are left in the DTS as comments.
 
 Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 ---
@@ -19,7 +18,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 
 --- a/arch/arm64/boot/dts/broadcom/rp1.dtsi
 +++ b/arch/arm64/boot/dts/broadcom/rp1.dtsi
-@@ -55,9 +55,9 @@
+@@ -65,9 +65,9 @@
  			interrupts = <RP1_INT_UART0 IRQ_TYPE_LEVEL_HIGH>;
  			clocks = <&rp1_clocks RP1_CLK_UART &rp1_clocks RP1_PLL_SYS_PRI_PH>;
  			clock-names = "uartclk", "apb_pclk";
@@ -30,5 +29,5 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
 +			//        <&rp1_dma RP1_DMA_UART0_RX>;
 +			// dma-names = "tx", "rx";
  			pinctrl-names = "default";
- 			arm,primecell-periphid = <0x00541011>;
+ 			arm,primecell-periphid = <0x00341011>;
  			uart-has-rtscts;
diff --git a/target/linux/bcm47xx/config-6.6 b/target/linux/bcm47xx/config-6.6
index 3b795941f37c65..ec549f6e331d86 100644
--- a/target/linux/bcm47xx/config-6.6
+++ b/target/linux/bcm47xx/config-6.6
@@ -27,8 +27,6 @@ CONFIG_BCMA_PFLASH=y
 CONFIG_BCMA_SFLASH=y
 # CONFIG_BGMAC_BCMA is not set
 CONFIG_BLK_MQ_PCI=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CMDLINE="noinitrd console=ttyS0,115200"
@@ -66,7 +64,6 @@ CONFIG_FS_IOMAP=y
 CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_CLOCKEVENTS=y
diff --git a/target/linux/bcm47xx/patches-6.6/701-bgmac-reduce-max-frame-size-to-support-just-MTU-1500.patch b/target/linux/bcm47xx/patches-6.6/701-bgmac-reduce-max-frame-size-to-support-just-MTU-1500.patch
deleted file mode 100644
index 3a2f4b06ed6d8c..00000000000000
--- a/target/linux/bcm47xx/patches-6.6/701-bgmac-reduce-max-frame-size-to-support-just-MTU-1500.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Fri, 10 Jun 2022 13:10:47 +0200
-Subject: [PATCH] bgmac: reduce max frame size to support just MTU 1500
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-bgmac allocates new replacement buffer before handling each received
-frame. Allocating & DMA-preparing 9724 B each time consumes a lot of CPU
-time. Ideally bgmac should just respect currently set MTU but it isn't
-the case right now. For now just revert back to the old limited frame
-size.
-
-This change bumps NAT masquarade speed by ~95%.
-
-Ref: 8c7da63978f1 ("bgmac: configure MTU and add support for frames beyond 8192 byte size")
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
----
- drivers/net/ethernet/broadcom/bgmac.h | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
---- a/drivers/net/ethernet/broadcom/bgmac.h
-+++ b/drivers/net/ethernet/broadcom/bgmac.h
-@@ -328,8 +328,7 @@
- #define BGMAC_RX_FRAME_OFFSET			30		/* There are 2 unused bytes between header and real data */
- #define BGMAC_RX_BUF_OFFSET			(NET_SKB_PAD + NET_IP_ALIGN - \
- 						 BGMAC_RX_FRAME_OFFSET)
--/* Jumbo frame size with FCS */
--#define BGMAC_RX_MAX_FRAME_SIZE			9724
-+#define BGMAC_RX_MAX_FRAME_SIZE			1536
- #define BGMAC_RX_BUF_SIZE			(BGMAC_RX_FRAME_OFFSET + BGMAC_RX_MAX_FRAME_SIZE)
- #define BGMAC_RX_ALLOC_SIZE			(SKB_DATA_ALIGN(BGMAC_RX_BUF_SIZE + BGMAC_RX_BUF_OFFSET) + \
- 						 SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
diff --git a/target/linux/bcm47xx/patches-6.6/791-tg3-no-pci-sleep.patch b/target/linux/bcm47xx/patches-6.6/791-tg3-no-pci-sleep.patch
index 76e979ad58286e..07778737014e68 100644
--- a/target/linux/bcm47xx/patches-6.6/791-tg3-no-pci-sleep.patch
+++ b/target/linux/bcm47xx/patches-6.6/791-tg3-no-pci-sleep.patch
@@ -5,7 +5,7 @@ when a switch driver is in use.
 
 --- a/drivers/net/ethernet/broadcom/tg3.c
 +++ b/drivers/net/ethernet/broadcom/tg3.c
-@@ -4269,7 +4269,8 @@ static int tg3_power_down_prepare(struct
+@@ -4270,7 +4270,8 @@ static int tg3_power_down_prepare(struct
  static void tg3_power_down(struct tg3 *tp)
  {
  	pci_wake_from_d3(tp->pdev, tg3_flag(tp, WOL_ENABLE));
diff --git a/target/linux/bcm47xx/patches-6.6/831-old_gpio_wdt.patch b/target/linux/bcm47xx/patches-6.6/831-old_gpio_wdt.patch
index 6c76cbeee7fb65..f7ab33802c698f 100644
--- a/target/linux/bcm47xx/patches-6.6/831-old_gpio_wdt.patch
+++ b/target/linux/bcm47xx/patches-6.6/831-old_gpio_wdt.patch
@@ -32,7 +32,7 @@ Signed-off-by: Mathias Adam <m.adam--openwrt@adamis.de>
  obj-$(CONFIG_TXX9_WDT) += txx9wdt.o
 --- /dev/null
 +++ b/drivers/watchdog/old_gpio_wdt.c
-@@ -0,0 +1,301 @@
+@@ -0,0 +1,300 @@
 +/*
 + *      Driver for GPIO-controlled Hardware Watchdogs.
 + *
@@ -294,7 +294,6 @@ Signed-off-by: Mathias Adam <m.adam--openwrt@adamis.de>
 +	.probe = gpio_wdt_probe,
 +	.remove = gpio_wdt_remove,
 +	.driver.name = "gpio-wdt",
-+	.driver.owner = THIS_MODULE,
 +};
 +
 +static int __init gpio_wdt_init(void)
diff --git a/target/linux/bcm4908/config-6.6 b/target/linux/bcm4908/config-6.6
index 0c604a1860f925..02eb2f2ce6bcdd 100644
--- a/target/linux/bcm4908/config-6.6
+++ b/target/linux/bcm4908/config-6.6
@@ -49,8 +49,6 @@ CONFIG_BLK_PM=y
 CONFIG_BUILTIN_RETURN_ADDRESS_STRIPS_PAC=y
 CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLK_BCM_63XX=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CMDLINE="earlycon=bcm63xx_uart,0xff800640 console=ttyS0,115200"
@@ -94,7 +92,6 @@ CONFIG_FUNCTION_ALIGNMENT_4B=y
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS=y
 CONFIG_GENERIC_ALLOCATOR=y
diff --git a/target/linux/bcm53xx/config-6.6 b/target/linux/bcm53xx/config-6.6
index 34dcf86e7b8280..9e3211801c8971 100644
--- a/target/linux/bcm53xx/config-6.6
+++ b/target/linux/bcm53xx/config-6.6
@@ -73,8 +73,6 @@ CONFIG_BOUNCE=y
 CONFIG_BROADCOM_PHY=y
 CONFIG_CACHE_L2X0=y
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_ARM_GLOBAL_TIMER_SCHED_CLOCK=y
 CONFIG_CLKSRC_MMIO=y
 # CONFIG_CLK_BCM_NS2 is not set
@@ -140,7 +138,6 @@ CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
 # CONFIG_FW_LOADER_USER_HELPER_FALLBACK is not set
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
diff --git a/target/linux/bcm53xx/patches-6.6/180-usb-xhci-add-support-for-performing-fake-doorbell.patch b/target/linux/bcm53xx/patches-6.6/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
index efcda986796d27..378d1467ed62ca 100644
--- a/target/linux/bcm53xx/patches-6.6/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
+++ b/target/linux/bcm53xx/patches-6.6/180-usb-xhci-add-support-for-performing-fake-doorbell.patch
@@ -35,7 +35,7 @@ it on BCM4708 family.
  /* called during probe() after chip reset completes */
 --- a/drivers/usb/host/xhci.c
 +++ b/drivers/usb/host/xhci.c
-@@ -161,6 +161,49 @@ int xhci_start(struct xhci_hcd *xhci)
+@@ -163,6 +163,49 @@ int xhci_start(struct xhci_hcd *xhci)
  	return ret;
  }
  
@@ -73,7 +73,7 @@ it on BCM4708 family.
 +	}
 +
 +	/* Free virt device */
-+	xhci_free_virt_device(xhci, slot_id);
++	xhci_disable_and_free_slot(xhci, slot_id);
 +
 +	/* We're done if controller is already running */
 +	if (readl(&xhci->op_regs->command) & CMD_RUN)
@@ -85,7 +85,7 @@ it on BCM4708 family.
  /*
   * Reset a halted HC.
   *
-@@ -480,6 +523,15 @@ static int xhci_run_finished(struct xhci
+@@ -500,6 +543,15 @@ static int xhci_run_finished(struct xhci
  		return -ENODEV;
  	}
  
@@ -103,11 +103,11 @@ it on BCM4708 family.
  	if (xhci->quirks & XHCI_NEC_HOST)
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1916,6 +1916,7 @@ struct xhci_hcd {
- #define XHCI_ZHAOXIN_HOST	BIT_ULL(46)
- #define XHCI_WRITE_64_HI_LO	BIT_ULL(47)
+@@ -1660,6 +1660,7 @@ struct xhci_hcd {
  #define XHCI_CDNS_SCTX_QUIRK	BIT_ULL(48)
-+#define XHCI_FAKE_DOORBELL	BIT_ULL(49)
+ #define XHCI_ETRON_HOST	BIT_ULL(49)
+ #define XHCI_LIMIT_ENDPOINT_INTERVAL_9 BIT_ULL(50)
++#define XHCI_FAKE_DOORBELL	BIT_ULL(51)
  
  	unsigned int		num_active_eps;
  	unsigned int		limit_active_eps;
diff --git a/target/linux/bcm53xx/patches-6.6/700-bgmac-reduce-max-frame-size-to-support-just-MTU-1500.patch b/target/linux/bcm53xx/patches-6.6/700-bgmac-reduce-max-frame-size-to-support-just-MTU-1500.patch
deleted file mode 100644
index 3a2f4b06ed6d8c..00000000000000
--- a/target/linux/bcm53xx/patches-6.6/700-bgmac-reduce-max-frame-size-to-support-just-MTU-1500.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
-Date: Fri, 10 Jun 2022 13:10:47 +0200
-Subject: [PATCH] bgmac: reduce max frame size to support just MTU 1500
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-bgmac allocates new replacement buffer before handling each received
-frame. Allocating & DMA-preparing 9724 B each time consumes a lot of CPU
-time. Ideally bgmac should just respect currently set MTU but it isn't
-the case right now. For now just revert back to the old limited frame
-size.
-
-This change bumps NAT masquarade speed by ~95%.
-
-Ref: 8c7da63978f1 ("bgmac: configure MTU and add support for frames beyond 8192 byte size")
-Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
----
- drivers/net/ethernet/broadcom/bgmac.h | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
---- a/drivers/net/ethernet/broadcom/bgmac.h
-+++ b/drivers/net/ethernet/broadcom/bgmac.h
-@@ -328,8 +328,7 @@
- #define BGMAC_RX_FRAME_OFFSET			30		/* There are 2 unused bytes between header and real data */
- #define BGMAC_RX_BUF_OFFSET			(NET_SKB_PAD + NET_IP_ALIGN - \
- 						 BGMAC_RX_FRAME_OFFSET)
--/* Jumbo frame size with FCS */
--#define BGMAC_RX_MAX_FRAME_SIZE			9724
-+#define BGMAC_RX_MAX_FRAME_SIZE			1536
- #define BGMAC_RX_BUF_SIZE			(BGMAC_RX_FRAME_OFFSET + BGMAC_RX_MAX_FRAME_SIZE)
- #define BGMAC_RX_ALLOC_SIZE			(SKB_DATA_ALIGN(BGMAC_RX_BUF_SIZE + BGMAC_RX_BUF_OFFSET) + \
- 						 SKB_DATA_ALIGN(sizeof(struct skb_shared_info)))
diff --git a/target/linux/bmips/bcm6318/config-6.6 b/target/linux/bmips/bcm6318/config-6.6
index 665e7f28471042..ae4516cdcc0eb1 100644
--- a/target/linux/bmips/bcm6318/config-6.6
+++ b/target/linux/bmips/bcm6318/config-6.6
@@ -17,8 +17,6 @@ CONFIG_BCM7038_WDT=y
 CONFIG_BLK_MQ_PCI=y
 CONFIG_BLK_PM=y
 CONFIG_BMIPS_GENERIC=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
 # CONFIG_CLK_BCM63268_TIMER is not set
 CONFIG_CLK_BCM_63XX_GATE=y
@@ -86,7 +84,6 @@ CONFIG_FWNODE_MDIO=y
 CONFIG_FW_CFE=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CMOS_UPDATE=y
diff --git a/target/linux/bmips/bcm63268/base-files/etc/board.d/02_network b/target/linux/bmips/bcm63268/base-files/etc/board.d/02_network
index 328fb13df48621..70e5db05222969 100644
--- a/target/linux/bmips/bcm63268/base-files/etc/board.d/02_network
+++ b/target/linux/bmips/bcm63268/base-files/etc/board.d/02_network
@@ -5,6 +5,13 @@
 board_config_update
 
 case "$(board_name)" in
+actiontec,t1200h |\
+comtrend,vg-8050 |\
+sagem,fast-3864-op |\
+sercomm,shg2500)
+	ucidef_set_bridge_device switch
+	ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "wan"
+	;;
 comtrend,vr-3032u |\
 smartrg,sr505n)
 	ucidef_set_bridge_device switch
@@ -17,12 +24,6 @@ sercomm,h500-s-vfes)
 	ucidef_set_interface "qtn" device "wifi" protocol "static" ipaddr "1.1.1.1" netmask "255.255.255.252"
 	uci add_list firewall.@zone[0].network='qtn'
 	;;
-comtrend,vg-8050 |\
-sagem,fast-3864-op |\
-sercomm,shg2500)
-	ucidef_set_bridge_device switch
-	ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "wan"
-	;;
 esac
 
 board_config_flush
diff --git a/target/linux/bmips/bcm63268/base-files/lib/upgrade/platform.sh b/target/linux/bmips/bcm63268/base-files/lib/upgrade/platform.sh
index 00b23f742f9b85..b41b5e91401303 100644
--- a/target/linux/bmips/bcm63268/base-files/lib/upgrade/platform.sh
+++ b/target/linux/bmips/bcm63268/base-files/lib/upgrade/platform.sh
@@ -9,6 +9,7 @@ platform_check_image() {
 
 platform_do_upgrade() {
 	case "$(board_name)" in
+	actiontec,t1200h |\
 	comtrend,vg-8050 |\
 	comtrend,vr-3032u |\
 	sagem,fast-3864-op)
diff --git a/target/linux/bmips/bcm63268/config-6.6 b/target/linux/bmips/bcm63268/config-6.6
index 8e060fd77c2a8e..e71c70dce94363 100644
--- a/target/linux/bmips/bcm63268/config-6.6
+++ b/target/linux/bmips/bcm63268/config-6.6
@@ -17,8 +17,6 @@ CONFIG_BCM7038_WDT=y
 CONFIG_BLK_MQ_PCI=y
 CONFIG_BLK_PM=y
 CONFIG_BMIPS_GENERIC=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
 CONFIG_CLK_BCM63268_TIMER=y
 CONFIG_CLK_BCM_63XX_GATE=y
@@ -87,7 +85,6 @@ CONFIG_FWNODE_MDIO=y
 CONFIG_FW_CFE=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CMOS_UPDATE=y
diff --git a/target/linux/bmips/bcm6328/config-6.6 b/target/linux/bmips/bcm6328/config-6.6
index 95d0ce6c9e2995..741159b6d6ee8d 100644
--- a/target/linux/bmips/bcm6328/config-6.6
+++ b/target/linux/bmips/bcm6328/config-6.6
@@ -17,8 +17,6 @@ CONFIG_BCM7038_WDT=y
 CONFIG_BLK_MQ_PCI=y
 CONFIG_BLK_PM=y
 CONFIG_BMIPS_GENERIC=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
 # CONFIG_CLK_BCM63268_TIMER is not set
 CONFIG_CLK_BCM_63XX_GATE=y
@@ -87,7 +85,6 @@ CONFIG_FWNODE_MDIO=y
 CONFIG_FW_CFE=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CMOS_UPDATE=y
@@ -167,6 +164,7 @@ CONFIG_MTD_CFI_BE_BYTE_SWAP=y
 CONFIG_MTD_CFI_STAA=y
 CONFIG_MTD_JEDECPROBE=y
 CONFIG_MTD_NAND_BRCMNAND=y
+CONFIG_MTD_NAND_BRCMNAND_BCM63XX=y
 CONFIG_MTD_NAND_CORE=y
 CONFIG_MTD_NAND_ECC=y
 CONFIG_MTD_NAND_ECC_SW_HAMMING=y
diff --git a/target/linux/bmips/bcm6358/config-6.6 b/target/linux/bmips/bcm6358/config-6.6
index 8247e65e34b9de..0b3c0dd701fde0 100644
--- a/target/linux/bmips/bcm6358/config-6.6
+++ b/target/linux/bmips/bcm6358/config-6.6
@@ -15,8 +15,6 @@ CONFIG_BCM7038_WDT=y
 CONFIG_BLK_MQ_PCI=y
 CONFIG_BLK_PM=y
 CONFIG_BMIPS_GENERIC=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
 # CONFIG_CLK_BCM63268_TIMER is not set
 CONFIG_CLK_BCM_63XX_GATE=y
@@ -84,7 +82,6 @@ CONFIG_FWNODE_MDIO=y
 CONFIG_FW_CFE=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CMOS_UPDATE=y
diff --git a/target/linux/bmips/bcm6362/config-6.6 b/target/linux/bmips/bcm6362/config-6.6
index c47f72c1b69eb6..6c05f4072781c9 100644
--- a/target/linux/bmips/bcm6362/config-6.6
+++ b/target/linux/bmips/bcm6362/config-6.6
@@ -17,8 +17,6 @@ CONFIG_BCM7038_WDT=y
 CONFIG_BLK_MQ_PCI=y
 CONFIG_BLK_PM=y
 CONFIG_BMIPS_GENERIC=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
 # CONFIG_CLK_BCM63268_TIMER is not set
 CONFIG_CLK_BCM_63XX_GATE=y
@@ -87,7 +85,6 @@ CONFIG_FWNODE_MDIO=y
 CONFIG_FW_CFE=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CMOS_UPDATE=y
@@ -169,6 +166,7 @@ CONFIG_MTD_CFI_BE_BYTE_SWAP=y
 CONFIG_MTD_CFI_STAA=y
 CONFIG_MTD_JEDECPROBE=y
 CONFIG_MTD_NAND_BRCMNAND=y
+CONFIG_MTD_NAND_BRCMNAND_BCM63XX=y
 CONFIG_MTD_NAND_CORE=y
 CONFIG_MTD_NAND_ECC=y
 CONFIG_MTD_NAND_ECC_SW_HAMMING=y
diff --git a/target/linux/bmips/bcm6368/config-6.6 b/target/linux/bmips/bcm6368/config-6.6
index 204b1628a416f1..eda05386028094 100644
--- a/target/linux/bmips/bcm6368/config-6.6
+++ b/target/linux/bmips/bcm6368/config-6.6
@@ -16,8 +16,6 @@ CONFIG_BCM7038_WDT=y
 CONFIG_BLK_MQ_PCI=y
 CONFIG_BLK_PM=y
 CONFIG_BMIPS_GENERIC=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
 # CONFIG_CLK_BCM63268_TIMER is not set
 CONFIG_CLK_BCM_63XX_GATE=y
@@ -86,7 +84,6 @@ CONFIG_FWNODE_MDIO=y
 CONFIG_FW_CFE=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CMOS_UPDATE=y
@@ -168,6 +165,7 @@ CONFIG_MTD_CFI_BE_BYTE_SWAP=y
 CONFIG_MTD_CFI_STAA=y
 CONFIG_MTD_JEDECPROBE=y
 CONFIG_MTD_NAND_BRCMNAND=y
+CONFIG_MTD_NAND_BRCMNAND_BCM63XX=y
 CONFIG_MTD_NAND_CORE=y
 CONFIG_MTD_NAND_ECC=y
 CONFIG_MTD_NAND_ECC_SW_HAMMING=y
diff --git a/target/linux/bmips/dts/bcm63168-actiontec-t1200h.dts b/target/linux/bmips/dts/bcm63168-actiontec-t1200h.dts
new file mode 100644
index 00000000000000..86fce53a797e65
--- /dev/null
+++ b/target/linux/bmips/dts/bcm63168-actiontec-t1200h.dts
@@ -0,0 +1,253 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "bcm63268.dtsi"
+
+/ {
+	model = "Actiontec T1200H";
+	compatible = "actiontec,t1200h", "brcm,bcm63168", "brcm,bcm63268";
+
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_red;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_green;
+	};
+
+	keys {
+		compatible = "gpio-keys-polled";
+		poll-interval = <100>;
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 32 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 33 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			label = "red:internet";
+			color = <LED_COLOR_ID_RED>;
+			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
+		};
+
+		led-1 {
+			label = "green:internet";
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&gpio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		led-9 {
+			function = LED_FUNCTION_USB;
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&gpio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_green: led-20 {
+			function = LED_FUNCTION_POWER;
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&gpio 20 GPIO_ACTIVE_LOW>;
+		};
+
+		led-22 {
+			function = LED_FUNCTION_WAN;
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&gpio 22 GPIO_ACTIVE_LOW>;
+		};
+
+		led_power_red: led-35 {
+			function = LED_FUNCTION_POWER;
+			color = <LED_COLOR_ID_RED>;
+			gpios = <&gpio 35 GPIO_ACTIVE_LOW>;
+			panic-indicator;
+		};
+
+		led-39 {
+			function = LED_FUNCTION_WLAN;
+			color = <LED_COLOR_ID_RED>;
+			gpios = <&gpio 39 GPIO_ACTIVE_LOW>;
+		};
+
+		led-43 {
+			function = LED_FUNCTION_WPS;
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&gpio 43 GPIO_ACTIVE_LOW>;
+		};
+
+		led-44 {
+			function = LED_FUNCTION_WPS;
+			color = <LED_COLOR_ID_RED>;
+			gpios = <&gpio 44 GPIO_ACTIVE_LOW>;
+		};
+
+		led-46 {
+			label = "green:dsl";
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&gpio 46 GPIO_ACTIVE_LOW>;
+		};
+
+		led-49 {
+			label = "red:dsl";
+			color = <LED_COLOR_ID_RED>;
+			gpios = <&gpio 49 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&ehci {
+	status = "okay";
+};
+
+&ethernet {
+	status = "okay";
+
+	nvmem-cells = <&macaddr_cferom_6a0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&mdio_ext {
+	switch@1e {
+		compatible = "brcm,bcm53125";
+		reg = <0x1e>;
+
+		dsa,member = <1 0>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				label = "lan4";
+			};
+
+			port@1 {
+				reg = <1>;
+				label = "lan3";
+			};
+
+			port@2 {
+				reg = <2>;
+				label = "lan2";
+			};
+
+			port@3 {
+				reg = <3>;
+				label = "lan1";
+			};
+
+			port@8 {
+				reg = <0x8>;
+
+				phy-mode = "rgmii";
+				ethernet = <&switch0port6>;
+
+				fixed-link {
+					speed = <1000>;
+					full-duplex;
+				};
+			};
+		};
+	};
+};
+
+&nflash {
+	status = "okay";
+
+	nandcs@0 {
+		compatible = "brcm,nandcs";
+		reg = <0>;
+		nand-ecc-step-size = <512>;
+		nand-ecc-strength = <15>;
+		nand-on-flash-bbt;
+		brcm,nand-oob-sector-size = <64>;
+
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "cferom";
+				reg = <0x0 0x20000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_cferom_6a0: macaddr@6a0 {
+						reg = <0x6a0 0x6>;
+					};
+				};
+			};
+
+			partition@20000 {
+				compatible = "brcm,wfi-split";
+				label = "wfi";
+				reg = <0x20000 0x7ac0000>;
+			};
+
+			partition@7b00000 {
+				label = "data";
+				reg = <0x7b00000 0x400000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&ohci {
+	status = "okay";
+};
+
+&pcie {
+	status = "okay";
+};
+
+&switch0 {
+	dsa,member = <0 0>;
+
+	ports {
+		port@3 {
+			reg = <3>;
+			label = "wan";
+
+			phy-handle = <&phy4>;
+		};
+
+		switch0port6: port@6 {
+			reg = <6>;
+			label = "extsw";
+
+			phy-mode = "rgmii";
+
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usbh {
+	status = "okay";
+};
diff --git a/target/linux/bmips/dts/bcm63168-sercomm-shg2500.dts b/target/linux/bmips/dts/bcm63168-sercomm-shg2500.dts
index 7ea76bebc31424..3f9ca000cc11c1 100644
--- a/target/linux/bmips/dts/bcm63168-sercomm-shg2500.dts
+++ b/target/linux/bmips/dts/bcm63168-sercomm-shg2500.dts
@@ -68,6 +68,8 @@
 	status = "okay";
 
 	led-controller@1 {
+		#address-cells = <1>;
+		#size-cells = <0>;
 		compatible = "sercomm,msp430-leds";
 		reg = <1>;
 		spi-max-frequency = <500000>;
diff --git a/target/linux/bmips/dts/bcm63268.dtsi b/target/linux/bmips/dts/bcm63268.dtsi
index d1aed29018e3a0..5a8cb7193f913f 100644
--- a/target/linux/bmips/dts/bcm63268.dtsi
+++ b/target/linux/bmips/dts/bcm63268.dtsi
@@ -245,7 +245,7 @@
 
 				pinctrl_nand: nand-pins {
 					function = "nand";
-					group = "nand_grp";
+					pins = "nand_grp";
 				};
 
 				pinctrl_gpio35_alt: gpio35_alt-pins {
@@ -255,37 +255,37 @@
 
 				pinctrl_dectpd: dectpd-pins {
 					function = "dectpd";
-					group = "dectpd_grp";
+					pins = "dectpd_grp";
 				};
 
 				pinctrl_vdsl_phy_override_0: vdsl_phy_override_0-pins {
 					function = "vdsl_phy_override_0";
-					group = "vdsl_phy_override_0_grp";
+					pins = "vdsl_phy_override_0_grp";
 				};
 
 				pinctrl_vdsl_phy_override_1: vdsl_phy_override_1-pins {
 					function = "vdsl_phy_override_1";
-					group = "vdsl_phy_override_1_grp";
+					pins = "vdsl_phy_override_1_grp";
 				};
 
 				pinctrl_vdsl_phy_override_2: vdsl_phy_override_2-pins {
 					function = "vdsl_phy_override_2";
-					group = "vdsl_phy_override_2_grp";
+					pins = "vdsl_phy_override_2_grp";
 				};
 
 				pinctrl_vdsl_phy_override_3: vdsl_phy_override_3-pins {
 					function = "vdsl_phy_override_3";
-					group = "vdsl_phy_override_3_grp";
+					pins = "vdsl_phy_override_3_grp";
 				};
 
 				pinctrl_dsl_gpio8: dsl_gpio8-pins {
 					function = "dsl_gpio8";
-					group = "dsl_gpio8";
+					pins = "dsl_gpio8";
 				};
 
 				pinctrl_dsl_gpio9: dsl_gpio9-pins {
 					function = "dsl_gpio9";
-					group = "dsl_gpio9";
+					pins = "dsl_gpio9";
 				};
 			};
 		};
diff --git a/target/linux/bmips/dts/bcm6362.dtsi b/target/linux/bmips/dts/bcm6362.dtsi
index 1089d89350baa5..5722f6e30c2ebf 100644
--- a/target/linux/bmips/dts/bcm6362.dtsi
+++ b/target/linux/bmips/dts/bcm6362.dtsi
@@ -320,7 +320,7 @@
 
 				pinctrl_nand: nand-pins {
 					function = "nand";
-					group = "nand_grp";
+					pins = "nand_grp";
 				};
 			};
 		};
diff --git a/target/linux/bmips/dts/bcm6368.dtsi b/target/linux/bmips/dts/bcm6368.dtsi
index e50f7a1b0c64aa..a855ab340ac43b 100644
--- a/target/linux/bmips/dts/bcm6368.dtsi
+++ b/target/linux/bmips/dts/bcm6368.dtsi
@@ -334,7 +334,7 @@
 
 				pinctrl_uart1: uart1-pins {
 					function = "uart1";
-					group = "uart1_grp";
+					pins = "uart1_grp";
 				};
 			};
 		};
diff --git a/target/linux/bmips/image/bcm63268.mk b/target/linux/bmips/image/bcm63268.mk
index ed45bead7f8bf0..3f98acc56ff056 100644
--- a/target/linux/bmips/image/bcm63268.mk
+++ b/target/linux/bmips/image/bcm63268.mk
@@ -1,5 +1,24 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
+define Device/actiontec_t1200h
+  $(Device/bcm63xx-nand)
+  DEVICE_VENDOR := Actiontec
+  DEVICE_MODEL := T1200H
+  CHIP_ID := 63268
+  SOC := bcm63168
+  CFE_RAM_FILE := actiontec,t1200h/cferam.000
+  CFE_RAM_JFFS2_NAME := cferam.000
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  SUBPAGESIZE := 512
+  VID_HDR_OFFSET := 2048
+  DEVICE_PACKAGES += $(USB2_PACKAGES) \
+    kmod-leds-gpio
+  CFE_WFI_FLASH_TYPE := 3
+  CFE_WFI_VERSION := 0x5732
+endef
+TARGET_DEVICES += actiontec_t1200h
+
 define Device/comtrend_vg-8050
   $(Device/bcm63xx-nand)
   DEVICE_VENDOR := Comtrend
diff --git a/target/linux/d1/base-files/etc/board.d/02_network b/target/linux/d1/base-files/etc/board.d/02_network
index df48b431af5e2c..dc61e4bde51460 100644
--- a/target/linux/d1/base-files/etc/board.d/02_network
+++ b/target/linux/d1/base-files/etc/board.d/02_network
@@ -8,6 +8,10 @@
 board_config_update
 
 case "$(board_name)" in
+sipeed,lichee-rv-dock |\
+widora,mangopi-mq-pro)
+	ucidef_set_interface_lan "wlan0"
+	;;
 *)
 	ucidef_set_interface_lan 'eth0'
 	;;
diff --git a/target/linux/d1/config-6.6 b/target/linux/d1/config-6.6
index 5a5b4c3d36d379..0bfcdf79585a23 100644
--- a/target/linux/d1/config-6.6
+++ b/target/linux/d1/config-6.6
@@ -22,8 +22,6 @@ CONFIG_ASSOCIATIVE_ARRAY=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_BLK_MQ_PCI=y
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CLZ_TAB=y
@@ -219,7 +217,6 @@ CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
 CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
 # CONFIG_PAGE_TABLE_CHECK is not set
 CONFIG_PANIC_TIMEOUT=0
-CONFIG_PCPU_DEV_REFCNT=y
 CONFIG_PGTABLE_LEVELS=5
 CONFIG_PHYLIB=y
 CONFIG_PHYLINK=y
diff --git a/target/linux/d1/image/Makefile b/target/linux/d1/image/Makefile
index aadf1807e751af..ea41e65c760e09 100644
--- a/target/linux/d1/image/Makefile
+++ b/target/linux/d1/image/Makefile
@@ -49,43 +49,47 @@ define Device/FitImage
 	KERNEL_NAME := Image
 endef
 
-define Device/dongshan_nezha_stu
+define Device/100ask_dongshan-nezha-stu
   $(call Device/Default)
   DEVICE_VENDOR := Dongshan
   DEVICE_MODEL := Nezha STU devkit
   DEVICE_DTS := allwinner/sun20i-d1-dongshan-nezha-stu
+  SUPPORTED_DEVICES += dongshan_nezha_stu
   UBOOT := dongshan_nezha_stu
 endef
-TARGET_DEVICES += dongshan_nezha_stu
+TARGET_DEVICES += 100ask_dongshan-nezha-stu
 
-define Device/lichee_rv_dock
+define Device/sipeed_lichee-rv-dock
   $(call Device/Default)
   DEVICE_VENDOR := Sipeed
   DEVICE_MODEL := LicheePi RV (dock)
   DEVICE_DTS := allwinner/sun20i-d1-lichee-rv-dock
-  DEVICE_PACKAGES += kmod-rtl8723bs
+  SUPPORTED_DEVICES += lichee_rv_dock
+  DEVICE_PACKAGES += kmod-rtw88-8723ds wpad-basic-mbedtls
   UBOOT := lichee_rv_dock
 endef
-TARGET_DEVICES += lichee_rv_dock
+TARGET_DEVICES += sipeed_lichee-rv-dock
 
-define Device/mangopi_mq_pro
+define Device/widora_mangopi-mq-pro
   $(call Device/Default)
   DEVICE_VENDOR := MangoPi
   DEVICE_MODEL := MQ Pro
   DEVICE_DTS := allwinner/sun20i-d1-mangopi-mq-pro
-  DEVICE_PACKAGES += kmod-rtl8723bs
+  SUPPORTED_DEVICES += mangopi_mq_pro
+  DEVICE_PACKAGES += kmod-rtw88-8723ds wpad-basic-mbedtls
   UBOOT := mangopi_mq_pro
 endef
-TARGET_DEVICES += mangopi_mq_pro
+TARGET_DEVICES += widora_mangopi-mq-pro
 
-define Device/nezha
+define Device/allwinner_d1-nezha
   $(call Device/Default)
   DEVICE_VENDOR := Nezha
   DEVICE_MODEL := D1
   DEVICE_DTS := allwinner/sun20i-d1-nezha
+  SUPPORTED_DEVICES += nezha
   UBOOT := nezha
 endef
-TARGET_DEVICES += nezha
+TARGET_DEVICES += allwinner_d1-nezha
 
 define Image/Build
 	$(call Image/Build/$(1),$(1))
diff --git a/target/linux/d1/patches-6.6/0009-ASoC-sunxi-sun4i-codec-add-basic-support-for-D1-audi.patch b/target/linux/d1/patches-6.6/0009-ASoC-sunxi-sun4i-codec-add-basic-support-for-D1-audi.patch
index 242f8f7a0e4033..b8ee82150cd5bf 100644
--- a/target/linux/d1/patches-6.6/0009-ASoC-sunxi-sun4i-codec-add-basic-support-for-D1-audi.patch
+++ b/target/linux/d1/patches-6.6/0009-ASoC-sunxi-sun4i-codec-add-basic-support-for-D1-audi.patch
@@ -16,7 +16,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
 
 --- a/sound/soc/sunxi/sun4i-codec.c
 +++ b/sound/soc/sunxi/sun4i-codec.c
-@@ -232,15 +232,65 @@
+@@ -233,16 +233,66 @@
  
  /* TODO H3 DAP (Digital Audio Processing) bits */
  
@@ -76,6 +76,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
 +	struct clk	*clk_module_dac;
  	struct reset_control *rst;
  	struct gpio_desc *gpio_pa;
+ 	struct gpio_desc *gpio_hp;
 +	const struct sun4i_codec_quirks *quirks;
  
 -	/* ADC_FIFOC register is at different offset on different SoCs */
@@ -84,7 +85,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  	struct regmap_field *reg_adc_fifoc;
  
  	struct snd_dmaengine_dai_dma_data	capture_dma_data;
-@@ -250,33 +300,33 @@ struct sun4i_codec {
+@@ -252,33 +302,33 @@ struct sun4i_codec {
  static void sun4i_codec_start_playback(struct sun4i_codec *scodec)
  {
  	/* Flush TX FIFO */
@@ -126,7 +127,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  }
  
  static int sun4i_codec_trigger(struct snd_pcm_substream *substream, int cmd,
-@@ -325,8 +375,8 @@ static int sun4i_codec_prepare_capture(s
+@@ -327,8 +377,8 @@ static int sun4i_codec_prepare_capture(s
  
  	/* Set RX FIFO trigger level */
  	regmap_field_update_bits(scodec->reg_adc_fifoc,
@@ -137,7 +138,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  
  	/*
  	 * FIXME: Undocumented in the datasheet, but
-@@ -360,13 +410,13 @@ static int sun4i_codec_prepare_playback(
+@@ -362,13 +412,13 @@ static int sun4i_codec_prepare_playback(
  	u32 val;
  
  	/* Flush the TX FIFO */
@@ -156,7 +157,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  
  	if (substream->runtime->rate > 32000)
  		/* Use 64 bits FIR filter */
-@@ -375,13 +425,12 @@ static int sun4i_codec_prepare_playback(
+@@ -377,13 +427,12 @@ static int sun4i_codec_prepare_playback(
  		/* Use 32 bits FIR filter */
  		val = BIT(SUN4I_CODEC_DAC_FIFOC_FIR_VERSION);
  
@@ -174,7 +175,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  
  	return 0;
  };
-@@ -476,30 +525,32 @@ static int sun4i_codec_hw_params_capture
+@@ -478,30 +527,32 @@ static int sun4i_codec_hw_params_capture
  				 7 << SUN4I_CODEC_ADC_FIFOC_ADC_FS,
  				 hwrate << SUN4I_CODEC_ADC_FIFOC_ADC_FS);
  
@@ -218,7 +219,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  
  		scodec->capture_dma_data.addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES;
  	}
-@@ -514,9 +565,9 @@ static int sun4i_codec_hw_params_playbac
+@@ -516,9 +567,9 @@ static int sun4i_codec_hw_params_playbac
  	u32 val;
  
  	/* Set DAC sample rate */
@@ -231,7 +232,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  
  	/* Set the number of channels we want to use */
  	if (params_channels(params) == 1)
-@@ -524,27 +575,26 @@ static int sun4i_codec_hw_params_playbac
+@@ -526,27 +577,26 @@ static int sun4i_codec_hw_params_playbac
  	else
  		val = 0;
  
@@ -269,7 +270,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  
  		scodec->playback_dma_data.addr_width = DMA_SLAVE_BUSWIDTH_2_BYTES;
  	}
-@@ -565,7 +615,11 @@ static int sun4i_codec_hw_params(struct
+@@ -567,7 +617,11 @@ static int sun4i_codec_hw_params(struct
  	if (!clk_freq)
  		return -EINVAL;
  
@@ -282,7 +283,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  	if (ret)
  		return ret;
  
-@@ -607,10 +661,14 @@ static int sun4i_codec_startup(struct sn
+@@ -609,10 +663,14 @@ static int sun4i_codec_startup(struct sn
  	 * Stop issuing DRQ when we have room for less than 16 samples
  	 * in our TX FIFO
  	 */
@@ -300,7 +301,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  }
  
  static void sun4i_codec_shutdown(struct snd_pcm_substream *substream,
-@@ -619,7 +677,11 @@ static void sun4i_codec_shutdown(struct
+@@ -621,7 +679,11 @@ static void sun4i_codec_shutdown(struct
  	struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream);
  	struct sun4i_codec *scodec = snd_soc_card_get_drvdata(rtd->card);
  
@@ -313,7 +314,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  }
  
  static const struct snd_soc_dai_ops sun4i_codec_dai_ops = {
-@@ -1229,6 +1291,55 @@ static const struct snd_soc_component_dr
+@@ -1231,6 +1293,55 @@ static const struct snd_soc_component_dr
  	.endianness		= 1,
  };
  
@@ -369,7 +370,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  static const struct snd_soc_component_driver sun4i_codec_component = {
  	.name			= "sun4i-codec",
  	.legacy_dai_naming	= 1,
-@@ -1532,6 +1643,66 @@ static struct snd_soc_card *sun8i_v3s_co
+@@ -1578,6 +1689,66 @@ static struct snd_soc_card *sun8i_v3s_co
  	return card;
  };
  
@@ -436,7 +437,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  static const struct regmap_config sun4i_codec_regmap_config = {
  	.reg_bits	= 32,
  	.reg_stride	= 4,
-@@ -1574,21 +1745,22 @@ static const struct regmap_config sun8i_
+@@ -1620,21 +1791,22 @@ static const struct regmap_config sun8i_
  	.max_register	= SUN8I_H3_CODEC_ADC_DBG,
  };
  
@@ -467,7 +468,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  	.reg_dac_txdata	= SUN4I_CODEC_DAC_TXDATA,
  	.reg_adc_rxdata	= SUN4I_CODEC_ADC_RXDATA,
  };
-@@ -1597,7 +1769,11 @@ static const struct sun4i_codec_quirks s
+@@ -1643,7 +1815,11 @@ static const struct sun4i_codec_quirks s
  	.regmap_config	= &sun6i_codec_regmap_config,
  	.codec		= &sun6i_codec_codec,
  	.create_card	= sun6i_codec_create_card,
@@ -479,7 +480,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  	.reg_dac_txdata	= SUN4I_CODEC_DAC_TXDATA,
  	.reg_adc_rxdata	= SUN6I_CODEC_ADC_RXDATA,
  	.has_reset	= true,
-@@ -1607,7 +1783,11 @@ static const struct sun4i_codec_quirks s
+@@ -1653,7 +1829,11 @@ static const struct sun4i_codec_quirks s
  	.regmap_config	= &sun7i_codec_regmap_config,
  	.codec		= &sun7i_codec_codec,
  	.create_card	= sun4i_codec_create_card,
@@ -491,7 +492,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  	.reg_dac_txdata	= SUN4I_CODEC_DAC_TXDATA,
  	.reg_adc_rxdata	= SUN4I_CODEC_ADC_RXDATA,
  };
-@@ -1616,7 +1796,11 @@ static const struct sun4i_codec_quirks s
+@@ -1662,7 +1842,11 @@ static const struct sun4i_codec_quirks s
  	.regmap_config	= &sun8i_a23_codec_regmap_config,
  	.codec		= &sun8i_a23_codec_codec,
  	.create_card	= sun8i_a23_codec_create_card,
@@ -503,7 +504,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  	.reg_dac_txdata	= SUN4I_CODEC_DAC_TXDATA,
  	.reg_adc_rxdata	= SUN6I_CODEC_ADC_RXDATA,
  	.has_reset	= true,
-@@ -1631,7 +1815,11 @@ static const struct sun4i_codec_quirks s
+@@ -1677,7 +1861,11 @@ static const struct sun4i_codec_quirks s
  	 */
  	.codec		= &sun8i_a23_codec_codec,
  	.create_card	= sun8i_h3_codec_create_card,
@@ -515,7 +516,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  	.reg_dac_txdata	= SUN8I_H3_CODEC_DAC_TXDATA,
  	.reg_adc_rxdata	= SUN6I_CODEC_ADC_RXDATA,
  	.has_reset	= true,
-@@ -1645,12 +1833,31 @@ static const struct sun4i_codec_quirks s
+@@ -1691,12 +1879,31 @@ static const struct sun4i_codec_quirks s
  	 */
  	.codec		= &sun8i_a23_codec_codec,
  	.create_card	= sun8i_v3s_codec_create_card,
@@ -547,7 +548,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  static const struct of_device_id sun4i_codec_of_match[] = {
  	{
  		.compatible = "allwinner,sun4i-a10-codec",
-@@ -1676,6 +1883,10 @@ static const struct of_device_id sun4i_c
+@@ -1722,6 +1929,10 @@ static const struct of_device_id sun4i_c
  		.compatible = "allwinner,sun8i-v3s-codec",
  		.data = &sun8i_v3s_codec_quirks,
  	},
@@ -558,7 +559,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  	{}
  };
  MODULE_DEVICE_TABLE(of, sun4i_codec_of_match);
-@@ -1704,6 +1915,7 @@ static int sun4i_codec_probe(struct plat
+@@ -1750,6 +1961,7 @@ static int sun4i_codec_probe(struct plat
  		dev_err(&pdev->dev, "Failed to determine the quirks to use\n");
  		return -ENODEV;
  	}
@@ -566,7 +567,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  
  	scodec->regmap = devm_regmap_init_mmio(&pdev->dev, base,
  					       quirks->regmap_config);
-@@ -1719,10 +1931,24 @@ static int sun4i_codec_probe(struct plat
+@@ -1765,10 +1977,24 @@ static int sun4i_codec_probe(struct plat
  		return PTR_ERR(scodec->clk_apb);
  	}
  
@@ -595,7 +596,7 @@ Signed-off-by: Maksim Kiselev <bigunclemax@gmail.com>
  	}
  
  	if (quirks->has_reset) {
-@@ -1751,6 +1977,16 @@ static int sun4i_codec_probe(struct plat
+@@ -1804,6 +2030,16 @@ static int sun4i_codec_probe(struct plat
  		dev_err(&pdev->dev, "Failed to create regmap fields: %d\n",
  			ret);
  		return ret;
diff --git a/target/linux/gemini/config-6.6 b/target/linux/gemini/config-6.6
index a93297a423eba8..2e590540afa95f 100644
--- a/target/linux/gemini/config-6.6
+++ b/target/linux/gemini/config-6.6
@@ -35,8 +35,6 @@ CONFIG_BOUNCE=y
 CONFIG_BUFFER_HEAD=y
 CONFIG_CACHESTAT_SYSCALL=y
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CMA=y
@@ -187,7 +185,6 @@ CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
 # CONFIG_FW_LOADER_USER_HELPER_FALLBACK is not set
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_GEMINI_ETHERNET=y
 CONFIG_GENERIC_ALLOCATOR=y
diff --git a/target/linux/gemini/patches-6.6/0005-net-ethernet-cortina-Use-TSO-also-on-common-TCP.patch b/target/linux/gemini/patches-6.6/0005-net-ethernet-cortina-Use-TSO-also-on-common-TCP.patch
deleted file mode 100644
index c690b8fddb391c..00000000000000
--- a/target/linux/gemini/patches-6.6/0005-net-ethernet-cortina-Use-TSO-also-on-common-TCP.patch
+++ /dev/null
@@ -1,95 +0,0 @@
-From 91fb8a7328dda827bc6c0da240a1eb17028416cd Mon Sep 17 00:00:00 2001
-From: Linus Walleij <linus.walleij@linaro.org>
-Date: Thu, 9 May 2024 23:59:28 +0200
-Subject: [PATCH 2/5] net: ethernet: cortina: Use TSO also on common TCP
-
-It is possible to push the segment offloader to also
-process non-segmented frames: just pass the skb->len
-or desired MSS to the offloader and it will handle them.
-
-This is especially good if the user sets up the MTU
-and the frames get big, because the checksumming engine
-cannot handle any frames bigger than 1518 bytes, so
-segmenting them all to be at max that will be helpful
-for the hardware, which only need to quirk odd frames
-such as big UDP ping packets.
-
-The vendor driver always uses the TSO like this, and
-the driver seems more stable after this, so apparently
-the hardware may have been engineered to always use
-the TSO on anything it can handle.
-
-Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
----
- drivers/net/ethernet/cortina/gemini.c | 31 +++++++++++++++++++++------
- 1 file changed, 24 insertions(+), 7 deletions(-)
-
---- a/drivers/net/ethernet/cortina/gemini.c
-+++ b/drivers/net/ethernet/cortina/gemini.c
-@@ -1148,6 +1148,7 @@ static int gmac_map_tx_bufs(struct net_d
- 	struct gmac_txdesc *txd;
- 	skb_frag_t *skb_frag;
- 	dma_addr_t mapping;
-+	bool tcp = false;
- 	void *buffer;
- 	u16 mss;
- 	int ret;
-@@ -1155,6 +1156,13 @@ static int gmac_map_tx_bufs(struct net_d
- 	word1 = skb->len;
- 	word3 = SOF_BIT;
- 
-+	/* Determine if we are doing TCP */
-+	if (skb->protocol == htons(ETH_P_IP))
-+		tcp = (ip_hdr(skb)->protocol == IPPROTO_TCP);
-+	else
-+		/* IPv6 */
-+		tcp = (ipv6_hdr(skb)->nexthdr == IPPROTO_TCP);
-+
- 	mss = skb_shinfo(skb)->gso_size;
- 	if (mss) {
- 		/* This means we are dealing with TCP and skb->len is the
-@@ -1167,6 +1175,20 @@ static int gmac_map_tx_bufs(struct net_d
- 			   mss, skb->len);
- 		word1 |= TSS_MTU_ENABLE_BIT;
- 		word3 |= mss;
-+	} else if (tcp) {
-+		/* Even if we are not using TSO, use the segment offloader
-+		 * for transferring the TCP frame: the TSO engine will deal
-+		 * with chopping up frames that exceed ETH_DATA_LEN which
-+		 * the checksumming engine cannot handle (see below) into
-+		 * manageable chunks. It flawlessly deals with quite big
-+		 * frames and frames containing custom DSA EtherTypes.
-+		 */
-+		mss = netdev->mtu + skb_tcp_all_headers(skb);
-+		mss = min(mss, skb->len);
-+		netdev_dbg(netdev, "botched TSO len %04x mtu %04x mss %04x\n",
-+			   skb->len, netdev->mtu, mss);
-+		word1 |= TSS_MTU_ENABLE_BIT;
-+		word3 |= mss;
- 	} else if (skb->len >= ETH_FRAME_LEN) {
- 		/* Hardware offloaded checksumming isn't working on frames
- 		 * bigger than 1514 bytes. A hypothesis about this is that the
-@@ -1185,21 +1207,16 @@ static int gmac_map_tx_bufs(struct net_d
- 	}
- 
- 	if (skb->ip_summed == CHECKSUM_PARTIAL) {
--		int tcp = 0;
--
- 		/* We do not switch off the checksumming on non TCP/UDP
- 		 * frames: as is shown from tests, the checksumming engine
- 		 * is smart enough to see that a frame is not actually TCP
- 		 * or UDP and then just pass it through without any changes
- 		 * to the frame.
- 		 */
--		if (skb->protocol == htons(ETH_P_IP)) {
-+		if (skb->protocol == htons(ETH_P_IP))
- 			word1 |= TSS_IP_CHKSUM_BIT;
--			tcp = ip_hdr(skb)->protocol == IPPROTO_TCP;
--		} else { /* IPv6 */
-+		else
- 			word1 |= TSS_IPV6_ENABLE_BIT;
--			tcp = ipv6_hdr(skb)->nexthdr == IPPROTO_TCP;
--		}
- 
- 		word1 |= tcp ? TSS_TCP_CHKSUM_BIT : TSS_UDP_CHKSUM_BIT;
- 	}
diff --git a/target/linux/gemini/patches-6.6/0008-net-ethernet-cortina-Implement-.set_pauseparam.patch b/target/linux/gemini/patches-6.6/0008-net-ethernet-cortina-Implement-.set_pauseparam.patch
index ad7594e855c722..687c352911fce4 100644
--- a/target/linux/gemini/patches-6.6/0008-net-ethernet-cortina-Implement-.set_pauseparam.patch
+++ b/target/linux/gemini/patches-6.6/0008-net-ethernet-cortina-Implement-.set_pauseparam.patch
@@ -16,7 +16,7 @@ Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
 
 --- a/drivers/net/ethernet/cortina/gemini.c
 +++ b/drivers/net/ethernet/cortina/gemini.c
-@@ -2143,6 +2143,19 @@ static void gmac_get_pauseparam(struct n
+@@ -2147,6 +2147,19 @@ static void gmac_get_pauseparam(struct n
  	pparam->autoneg = true;
  }
  
@@ -36,7 +36,7 @@ Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
  static void gmac_get_ringparam(struct net_device *netdev,
  			       struct ethtool_ringparam *rp,
  			       struct kernel_ethtool_ringparam *kernel_rp,
-@@ -2263,6 +2276,7 @@ static const struct ethtool_ops gmac_351
+@@ -2267,6 +2280,7 @@ static const struct ethtool_ops gmac_351
  	.set_link_ksettings = gmac_set_ksettings,
  	.nway_reset	= gmac_nway_reset,
  	.get_pauseparam	= gmac_get_pauseparam,
diff --git a/target/linux/generic/backport-6.6/0080-v6.9-smp-Avoid-setup_max_cpus_namespace_collision_shadowing.patch b/target/linux/generic/backport-6.6/0080-v6.9-smp-Avoid-setup_max_cpus_namespace_collision_shadowing.patch
index 54ebaa1a80d3f6..f5459aaccd5e9f 100644
--- a/target/linux/generic/backport-6.6/0080-v6.9-smp-Avoid-setup_max_cpus_namespace_collision_shadowing.patch
+++ b/target/linux/generic/backport-6.6/0080-v6.9-smp-Avoid-setup_max_cpus_namespace_collision_shadowing.patch
@@ -21,7 +21,7 @@ Cc: linux-kernel@vger.kernel.org
 
 --- a/include/linux/cpu.h
 +++ b/include/linux/cpu.h
-@@ -109,7 +109,7 @@ void notify_cpu_starting(unsigned int cp
+@@ -112,7 +112,7 @@ void notify_cpu_starting(unsigned int cp
  extern void cpu_maps_update_begin(void);
  extern void cpu_maps_update_done(void);
  int bringup_hibernate_cpu(unsigned int sleep_cpu);
diff --git a/target/linux/generic/backport-6.6/400-v6.9-mtd-rawnand-brcmnand-Support-write-protection-settin.patch b/target/linux/generic/backport-6.6/400-v6.9-mtd-rawnand-brcmnand-Support-write-protection-settin.patch
index 257624164ac6a6..a7186208b2be25 100644
--- a/target/linux/generic/backport-6.6/400-v6.9-mtd-rawnand-brcmnand-Support-write-protection-settin.patch
+++ b/target/linux/generic/backport-6.6/400-v6.9-mtd-rawnand-brcmnand-Support-write-protection-settin.patch
@@ -23,7 +23,7 @@ Link: https://lore.kernel.org/linux-mtd/20240223034758.13753-14-william.zhang@br
 
 --- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
 +++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
-@@ -3189,6 +3189,10 @@ int brcmnand_probe(struct platform_devic
+@@ -3194,6 +3194,10 @@ int brcmnand_probe(struct platform_devic
  	/* Disable XOR addressing */
  	brcmnand_rmw_reg(ctrl, BRCMNAND_CS_XOR, 0xff, 0, 0);
  
diff --git a/target/linux/generic/backport-6.6/411-v6.7-mtd-spinand-add-support-for-FORESEE-F35SQA002G.patch b/target/linux/generic/backport-6.6/411-v6.7-mtd-spinand-add-support-for-FORESEE-F35SQA002G.patch
new file mode 100644
index 00000000000000..459dd4481e3a3d
--- /dev/null
+++ b/target/linux/generic/backport-6.6/411-v6.7-mtd-spinand-add-support-for-FORESEE-F35SQA002G.patch
@@ -0,0 +1,146 @@
+From 49c8e854869d673df8452f24dfa8989cd0f615a8 Mon Sep 17 00:00:00 2001
+From: Martin Kurbanov <mmkurbanov@salutedevices.com>
+Date: Mon, 2 Oct 2023 17:04:58 +0300
+Subject: [PATCH] mtd: spinand: add support for FORESEE F35SQA002G
+
+Add support for FORESEE F35SQA002G SPI NAND.
+Datasheet:
+  https://www.longsys.com/uploads/LM-00006FORESEEF35SQA002GDatasheet_1650183701.pdf
+
+Signed-off-by: Martin Kurbanov <mmkurbanov@salutedevices.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20231002140458.147605-1-mmkurbanov@salutedevices.com
+---
+ drivers/mtd/nand/spi/Makefile  |  2 +-
+ drivers/mtd/nand/spi/core.c    |  1 +
+ drivers/mtd/nand/spi/foresee.c | 95 ++++++++++++++++++++++++++++++++++
+ include/linux/mtd/spinand.h    |  1 +
+ 4 files changed, 98 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/mtd/nand/spi/foresee.c
+
+--- a/drivers/mtd/nand/spi/Makefile
++++ b/drivers/mtd/nand/spi/Makefile
+@@ -1,4 +1,4 @@
+ # SPDX-License-Identifier: GPL-2.0
+-spinand-objs := core.o alliancememory.o ato.o esmt.o gigadevice.o macronix.o
++spinand-objs := core.o alliancememory.o ato.o esmt.o foresee.o gigadevice.o macronix.o
+ spinand-objs += micron.o paragon.o toshiba.o winbond.o xtx.o
+ obj-$(CONFIG_MTD_SPI_NAND) += spinand.o
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -943,6 +943,7 @@ static const struct spinand_manufacturer
+ 	&alliancememory_spinand_manufacturer,
+ 	&ato_spinand_manufacturer,
+ 	&esmt_c8_spinand_manufacturer,
++	&foresee_spinand_manufacturer,
+ 	&gigadevice_spinand_manufacturer,
+ 	&macronix_spinand_manufacturer,
+ 	&micron_spinand_manufacturer,
+--- /dev/null
++++ b/drivers/mtd/nand/spi/foresee.c
+@@ -0,0 +1,95 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Copyright (c) 2023, SberDevices. All Rights Reserved.
++ *
++ * Author: Martin Kurbanov <mmkurbanov@salutedevices.com>
++ */
++
++#include <linux/device.h>
++#include <linux/kernel.h>
++#include <linux/mtd/spinand.h>
++
++#define SPINAND_MFR_FORESEE		0xCD
++
++static SPINAND_OP_VARIANTS(read_cache_variants,
++		SPINAND_PAGE_READ_FROM_CACHE_X4_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_X2_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_OP(true, 0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_OP(false, 0, 1, NULL, 0));
++
++static SPINAND_OP_VARIANTS(write_cache_variants,
++		SPINAND_PROG_LOAD_X4(true, 0, NULL, 0),
++		SPINAND_PROG_LOAD(true, 0, NULL, 0));
++
++static SPINAND_OP_VARIANTS(update_cache_variants,
++		SPINAND_PROG_LOAD_X4(false, 0, NULL, 0),
++		SPINAND_PROG_LOAD(false, 0, NULL, 0));
++
++static int f35sqa002g_ooblayout_ecc(struct mtd_info *mtd, int section,
++				    struct mtd_oob_region *region)
++{
++	return -ERANGE;
++}
++
++static int f35sqa002g_ooblayout_free(struct mtd_info *mtd, int section,
++				     struct mtd_oob_region *region)
++{
++	if (section)
++		return -ERANGE;
++
++	/* Reserve 2 bytes for the BBM. */
++	region->offset = 2;
++	region->length = 62;
++
++	return 0;
++}
++
++static const struct mtd_ooblayout_ops f35sqa002g_ooblayout = {
++	.ecc = f35sqa002g_ooblayout_ecc,
++	.free = f35sqa002g_ooblayout_free,
++};
++
++static int f35sqa002g_ecc_get_status(struct spinand_device *spinand, u8 status)
++{
++	struct nand_device *nand = spinand_to_nand(spinand);
++
++	switch (status & STATUS_ECC_MASK) {
++	case STATUS_ECC_NO_BITFLIPS:
++		return 0;
++
++	case STATUS_ECC_HAS_BITFLIPS:
++		return nanddev_get_ecc_conf(nand)->strength;
++
++	default:
++		break;
++	}
++
++	/* More than 1-bit error was detected in one or more sectors and
++	 * cannot be corrected.
++	 */
++	return -EBADMSG;
++}
++
++static const struct spinand_info foresee_spinand_table[] = {
++	SPINAND_INFO("F35SQA002G",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x72, 0x72),
++		     NAND_MEMORG(1, 2048, 64, 64, 2048, 40, 1, 1, 1),
++		     NAND_ECCREQ(1, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&f35sqa002g_ooblayout,
++				     f35sqa002g_ecc_get_status)),
++};
++
++static const struct spinand_manufacturer_ops foresee_spinand_manuf_ops = {
++};
++
++const struct spinand_manufacturer foresee_spinand_manufacturer = {
++	.id = SPINAND_MFR_FORESEE,
++	.name = "FORESEE",
++	.chips = foresee_spinand_table,
++	.nchips = ARRAY_SIZE(foresee_spinand_table),
++	.ops = &foresee_spinand_manuf_ops,
++};
+--- a/include/linux/mtd/spinand.h
++++ b/include/linux/mtd/spinand.h
+@@ -263,6 +263,7 @@ struct spinand_manufacturer {
+ extern const struct spinand_manufacturer alliancememory_spinand_manufacturer;
+ extern const struct spinand_manufacturer ato_spinand_manufacturer;
+ extern const struct spinand_manufacturer esmt_c8_spinand_manufacturer;
++extern const struct spinand_manufacturer foresee_spinand_manufacturer;
+ extern const struct spinand_manufacturer gigadevice_spinand_manufacturer;
+ extern const struct spinand_manufacturer macronix_spinand_manufacturer;
+ extern const struct spinand_manufacturer micron_spinand_manufacturer;
diff --git a/target/linux/generic/backport-6.6/412-v6.14-mtd-spinand-add-support-for-FORESEE-F35SQA001G.patch b/target/linux/generic/backport-6.6/412-v6.14-mtd-spinand-add-support-for-FORESEE-F35SQA001G.patch
new file mode 100644
index 00000000000000..84b3b2afee57a0
--- /dev/null
+++ b/target/linux/generic/backport-6.6/412-v6.14-mtd-spinand-add-support-for-FORESEE-F35SQA001G.patch
@@ -0,0 +1,38 @@
+From ae461cde5c559675fc4c0ba351c7c31ace705f56 Mon Sep 17 00:00:00 2001
+From: Bohdan Chubuk <chbgdn@gmail.com>
+Date: Sun, 10 Nov 2024 22:50:47 +0200
+Subject: [PATCH] mtd: spinand: add support for FORESEE F35SQA001G
+
+Add support for FORESEE F35SQA001G SPI NAND.
+
+Similar to F35SQA002G, but differs in capacity.
+Datasheet:
+  -  https://cdn.ozdisan.com/ETicaret_Dosya/704795_871495.pdf
+
+Tested on Xiaomi AX3000T flashed with OpenWRT.
+
+Signed-off-by: Bohdan Chubuk <chbgdn@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+---
+ drivers/mtd/nand/spi/foresee.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/mtd/nand/spi/foresee.c
++++ b/drivers/mtd/nand/spi/foresee.c
+@@ -81,6 +81,16 @@ static const struct spinand_info foresee
+ 		     SPINAND_HAS_QE_BIT,
+ 		     SPINAND_ECCINFO(&f35sqa002g_ooblayout,
+ 				     f35sqa002g_ecc_get_status)),
++	SPINAND_INFO("F35SQA001G",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x71, 0x71),
++		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
++		     NAND_ECCREQ(1, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&f35sqa002g_ooblayout,
++				     f35sqa002g_ecc_get_status)),
+ };
+ 
+ static const struct spinand_manufacturer_ops foresee_spinand_manuf_ops = {
diff --git a/target/linux/generic/backport-6.6/419-v6.17-mtd-spinand-add-support-for-FudanMicro-FM25S01A.patch b/target/linux/generic/backport-6.6/419-v6.17-mtd-spinand-add-support-for-FudanMicro-FM25S01A.patch
new file mode 100644
index 00000000000000..af6d87049dfffc
--- /dev/null
+++ b/target/linux/generic/backport-6.6/419-v6.17-mtd-spinand-add-support-for-FudanMicro-FM25S01A.patch
@@ -0,0 +1,124 @@
+From 5f284dc15ca8695d0394414045ac64616a3b0e69 Mon Sep 17 00:00:00 2001
+From: Tianling Shen <cnsztl@gmail.com>
+Date: Mon, 25 Aug 2025 01:00:13 +0800
+Subject: [PATCH] mtd: spinand: add support for FudanMicro FM25S01A
+
+Add support for FudanMicro FM25S01A SPI NAND.
+Datasheet: http://eng.fmsh.com/nvm/FM25S01A_ds_eng.pdf
+
+Signed-off-by: Tianling Shen <cnsztl@gmail.com>
+Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
+Link: https://lore.kernel.org/linux-mtd/20250824170013.3328777-1-cnsztl@gmail.com
+---
+ drivers/mtd/nand/spi/Makefile |  2 +-
+ drivers/mtd/nand/spi/core.c   |  1 +
+ drivers/mtd/nand/spi/fmsh.c   | 74 +++++++++++++++++++++++++++++++++++
+ include/linux/mtd/spinand.h   |  1 +
+ 4 files changed, 77 insertions(+), 1 deletion(-)
+ create mode 100644 drivers/mtd/nand/spi/fmsh.c
+
+--- a/drivers/mtd/nand/spi/Makefile
++++ b/drivers/mtd/nand/spi/Makefile
+@@ -1,4 +1,4 @@
+ # SPDX-License-Identifier: GPL-2.0
+-spinand-objs := core.o alliancememory.o ato.o esmt.o foresee.o gigadevice.o macronix.o
++spinand-objs := core.o alliancememory.o ato.o esmt.o fmsh.o foresee.o gigadevice.o macronix.o
+ spinand-objs += micron.o paragon.o toshiba.o winbond.o xtx.o
+ obj-$(CONFIG_MTD_SPI_NAND) += spinand.o
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -943,6 +943,7 @@ static const struct spinand_manufacturer
+ 	&alliancememory_spinand_manufacturer,
+ 	&ato_spinand_manufacturer,
+ 	&esmt_c8_spinand_manufacturer,
++	&fmsh_spinand_manufacturer,
+ 	&foresee_spinand_manufacturer,
+ 	&gigadevice_spinand_manufacturer,
+ 	&macronix_spinand_manufacturer,
+--- /dev/null
++++ b/drivers/mtd/nand/spi/fmsh.c
+@@ -0,0 +1,74 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Copyright (c) 2020-2021 Rockchip Electronics Co., Ltd.
++ *
++ * Author: Dingqiang Lin <jon.lin@rock-chips.com>
++ */
++
++#include <linux/device.h>
++#include <linux/kernel.h>
++#include <linux/mtd/spinand.h>
++
++#define SPINAND_MFR_FMSH		0xA1
++
++static SPINAND_OP_VARIANTS(read_cache_variants,
++		SPINAND_PAGE_READ_FROM_CACHE_QUADIO_OP(0, 2, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_X4_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_DUALIO_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_X2_OP(0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_OP(true, 0, 1, NULL, 0),
++		SPINAND_PAGE_READ_FROM_CACHE_OP(false, 0, 1, NULL, 0));
++
++static SPINAND_OP_VARIANTS(write_cache_variants,
++		SPINAND_PROG_LOAD_X4(true, 0, NULL, 0),
++		SPINAND_PROG_LOAD(true, 0, NULL, 0));
++
++static SPINAND_OP_VARIANTS(update_cache_variants,
++		SPINAND_PROG_LOAD_X4(false, 0, NULL, 0),
++		SPINAND_PROG_LOAD(false, 0, NULL, 0));
++
++static int fm25s01a_ooblayout_ecc(struct mtd_info *mtd, int section,
++				  struct mtd_oob_region *region)
++{
++	return -ERANGE;
++}
++
++static int fm25s01a_ooblayout_free(struct mtd_info *mtd, int section,
++				   struct mtd_oob_region *region)
++{
++	if (section)
++		return -ERANGE;
++
++	region->offset = 2;
++	region->length = 62;
++
++	return 0;
++}
++
++static const struct mtd_ooblayout_ops fm25s01a_ooblayout = {
++	.ecc = fm25s01a_ooblayout_ecc,
++	.free = fm25s01a_ooblayout_free,
++};
++
++static const struct spinand_info fmsh_spinand_table[] = {
++	SPINAND_INFO("FM25S01A",
++		     SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xE4),
++		     NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
++		     NAND_ECCREQ(1, 512),
++		     SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
++					      &write_cache_variants,
++					      &update_cache_variants),
++		     SPINAND_HAS_QE_BIT,
++		     SPINAND_ECCINFO(&fm25s01a_ooblayout, NULL)),
++};
++
++static const struct spinand_manufacturer_ops fmsh_spinand_manuf_ops = {
++};
++
++const struct spinand_manufacturer fmsh_spinand_manufacturer = {
++	.id = SPINAND_MFR_FMSH,
++	.name = "Fudan Micro",
++	.chips = fmsh_spinand_table,
++	.nchips = ARRAY_SIZE(fmsh_spinand_table),
++	.ops = &fmsh_spinand_manuf_ops,
++};
+--- a/include/linux/mtd/spinand.h
++++ b/include/linux/mtd/spinand.h
+@@ -263,6 +263,7 @@ struct spinand_manufacturer {
+ extern const struct spinand_manufacturer alliancememory_spinand_manufacturer;
+ extern const struct spinand_manufacturer ato_spinand_manufacturer;
+ extern const struct spinand_manufacturer esmt_c8_spinand_manufacturer;
++extern const struct spinand_manufacturer fmsh_spinand_manufacturer;
+ extern const struct spinand_manufacturer foresee_spinand_manufacturer;
+ extern const struct spinand_manufacturer gigadevice_spinand_manufacturer;
+ extern const struct spinand_manufacturer macronix_spinand_manufacturer;
diff --git a/target/linux/generic/backport-6.6/600-v6.10-net-Remove-conditional-threaded-NAPI-wakeup-based-on.patch b/target/linux/generic/backport-6.6/600-v6.10-net-Remove-conditional-threaded-NAPI-wakeup-based-on.patch
index 3f75dffde71999..9d95631facc6e6 100644
--- a/target/linux/generic/backport-6.6/600-v6.10-net-Remove-conditional-threaded-NAPI-wakeup-based-on.patch
+++ b/target/linux/generic/backport-6.6/600-v6.10-net-Remove-conditional-threaded-NAPI-wakeup-based-on.patch
@@ -32,7 +32,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -4477,13 +4477,7 @@ static inline void ____napi_schedule(str
+@@ -4526,13 +4526,7 @@ static inline void ____napi_schedule(str
  		 */
  		thread = READ_ONCE(napi->thread);
  		if (thread) {
@@ -47,7 +47,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  			wake_up_process(thread);
  			return;
  		}
-@@ -6639,8 +6633,6 @@ static int napi_poll(struct napi_struct
+@@ -6688,8 +6682,6 @@ static int napi_poll(struct napi_struct
  
  static int napi_thread_wait(struct napi_struct *napi)
  {
@@ -56,7 +56,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	set_current_state(TASK_INTERRUPTIBLE);
  
  	while (!kthread_should_stop()) {
-@@ -6649,15 +6641,13 @@ static int napi_thread_wait(struct napi_
+@@ -6698,15 +6690,13 @@ static int napi_thread_wait(struct napi_
  		 * Testing SCHED bit is not enough because SCHED bit might be
  		 * set by some other busy poll thread or by napi_disable().
  		 */
diff --git a/target/linux/generic/backport-6.6/601-v6.10-net-Allow-to-use-SMP-threads-for-backlog-NAPI.patch b/target/linux/generic/backport-6.6/601-v6.10-net-Allow-to-use-SMP-threads-for-backlog-NAPI.patch
index b343a3f9642a22..0c2de044848d38 100644
--- a/target/linux/generic/backport-6.6/601-v6.10-net-Allow-to-use-SMP-threads-for-backlog-NAPI.patch
+++ b/target/linux/generic/backport-6.6/601-v6.10-net-Allow-to-use-SMP-threads-for-backlog-NAPI.patch
@@ -108,7 +108,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  static inline void rps_lock_irqsave(struct softnet_data *sd,
  				    unsigned long *flags)
  {
-@@ -4445,6 +4471,7 @@ EXPORT_SYMBOL(__dev_direct_xmit);
+@@ -4494,6 +4520,7 @@ EXPORT_SYMBOL(__dev_direct_xmit);
  /*************************************************************************
   *			Receiver routines
   *************************************************************************/
@@ -116,7 +116,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  
  int netdev_max_backlog __read_mostly = 1000;
  EXPORT_SYMBOL(netdev_max_backlog);
-@@ -4477,12 +4504,16 @@ static inline void ____napi_schedule(str
+@@ -4526,12 +4553,16 @@ static inline void ____napi_schedule(str
  		 */
  		thread = READ_ONCE(napi->thread);
  		if (thread) {
@@ -133,7 +133,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	list_add_tail(&napi->poll_list, &sd->poll_list);
  	WRITE_ONCE(napi->list_owner, smp_processor_id());
  	/* If not called from net_rx_action()
-@@ -4728,6 +4759,11 @@ static void napi_schedule_rps(struct sof
+@@ -4777,6 +4808,11 @@ static void napi_schedule_rps(struct sof
  
  #ifdef CONFIG_RPS
  	if (sd != mysd) {
@@ -145,7 +145,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		sd->rps_ipi_next = mysd->rps_ipi_list;
  		mysd->rps_ipi_list = sd;
  
-@@ -5951,7 +5987,7 @@ static void net_rps_action_and_irq_enabl
+@@ -6000,7 +6036,7 @@ static void net_rps_action_and_irq_enabl
  #ifdef CONFIG_RPS
  	struct softnet_data *remsd = sd->rps_ipi_list;
  
@@ -154,7 +154,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		sd->rps_ipi_list = NULL;
  
  		local_irq_enable();
-@@ -5966,7 +6002,7 @@ static void net_rps_action_and_irq_enabl
+@@ -6015,7 +6051,7 @@ static void net_rps_action_and_irq_enabl
  static bool sd_has_rps_ipi_waiting(struct softnet_data *sd)
  {
  #ifdef CONFIG_RPS
@@ -163,7 +163,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  #else
  	return false;
  #endif
-@@ -6010,7 +6046,7 @@ static int process_backlog(struct napi_s
+@@ -6059,7 +6095,7 @@ static int process_backlog(struct napi_s
  			 * We can use a plain write instead of clear_bit(),
  			 * and we dont need an smp_mb() memory barrier.
  			 */
@@ -172,7 +172,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  			again = false;
  		} else {
  			skb_queue_splice_tail_init(&sd->input_pkt_queue,
-@@ -6676,43 +6712,48 @@ static void skb_defer_free_flush(struct
+@@ -6725,43 +6761,48 @@ static void skb_defer_free_flush(struct
  	}
  }
  
@@ -250,7 +250,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	return 0;
  }
  
-@@ -11293,7 +11334,7 @@ static int dev_cpu_dead(unsigned int old
+@@ -11346,7 +11387,7 @@ static int dev_cpu_dead(unsigned int old
  
  		list_del_init(&napi->poll_list);
  		if (napi->poll == process_backlog)
@@ -259,7 +259,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		else
  			____napi_schedule(sd, napi);
  	}
-@@ -11301,12 +11342,14 @@ static int dev_cpu_dead(unsigned int old
+@@ -11354,12 +11395,14 @@ static int dev_cpu_dead(unsigned int old
  	raise_softirq_irqoff(NET_TX_SOFTIRQ);
  	local_irq_enable();
  
@@ -278,7 +278,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  
  	/* Process offline CPU's input_pkt_queue */
  	while ((skb = __skb_dequeue(&oldsd->process_queue))) {
-@@ -11569,6 +11612,38 @@ static struct pernet_operations __net_in
+@@ -11622,6 +11665,38 @@ static struct pernet_operations __net_in
   *
   */
  
@@ -317,7 +317,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  /*
   *       This is called single threaded during boot, so no need
   *       to take the rtnl semaphore.
-@@ -11619,7 +11694,10 @@ static int __init net_dev_init(void)
+@@ -11672,7 +11747,10 @@ static int __init net_dev_init(void)
  		init_gro_hash(&sd->backlog);
  		sd->backlog.poll = process_backlog;
  		sd->backlog.weight = weight_p;
diff --git a/target/linux/generic/backport-6.6/602-v6.10-net-Use-backlog-NAPI-to-clean-up-the-defer_list.patch b/target/linux/generic/backport-6.6/602-v6.10-net-Use-backlog-NAPI-to-clean-up-the-defer_list.patch
index 3b1a64e4c64f46..d6ef75db6983c6 100644
--- a/target/linux/generic/backport-6.6/602-v6.10-net-Use-backlog-NAPI-to-clean-up-the-defer_list.patch
+++ b/target/linux/generic/backport-6.6/602-v6.10-net-Use-backlog-NAPI-to-clean-up-the-defer_list.patch
@@ -36,7 +36,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/include/linux/netdevice.h
 +++ b/include/linux/netdevice.h
-@@ -3300,6 +3300,7 @@ static inline void dev_xmit_recursion_de
+@@ -3309,6 +3309,7 @@ static inline void dev_xmit_recursion_de
  	__this_cpu_dec(softnet_data.xmit.recursion);
  }
  
@@ -82,7 +82,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		spin_unlock_irq(&sd->input_pkt_queue.lock);
  	else if (!IS_ENABLED(CONFIG_PREEMPT_RT))
  		local_irq_enable();
-@@ -4778,6 +4778,23 @@ static void napi_schedule_rps(struct sof
+@@ -4827,6 +4827,23 @@ static void napi_schedule_rps(struct sof
  	__napi_schedule_irqoff(&mysd->backlog);
  }
  
diff --git a/target/linux/generic/backport-6.6/603-v6.10-net-Rename-rps_lock-to-backlog_lock.patch b/target/linux/generic/backport-6.6/603-v6.10-net-Rename-rps_lock-to-backlog_lock.patch
index dab96763fc292f..ccb761cf5c33d4 100644
--- a/target/linux/generic/backport-6.6/603-v6.10-net-Rename-rps_lock-to-backlog_lock.patch
+++ b/target/linux/generic/backport-6.6/603-v6.10-net-Rename-rps_lock-to-backlog_lock.patch
@@ -67,7 +67,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  {
  	if (IS_ENABLED(CONFIG_RPS) || use_backlog_threads())
  		spin_unlock_irq(&sd->input_pkt_queue.lock);
-@@ -4783,12 +4783,12 @@ void kick_defer_list_purge(struct softne
+@@ -4832,12 +4832,12 @@ void kick_defer_list_purge(struct softne
  	unsigned long flags;
  
  	if (use_backlog_threads()) {
@@ -82,7 +82,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  
  	} else if (!cmpxchg(&sd->defer_ipi_scheduled, 0, 1)) {
  		smp_call_function_single_async(cpu, &sd->defer_csd);
-@@ -4850,7 +4850,7 @@ static int enqueue_to_backlog(struct sk_
+@@ -4899,7 +4899,7 @@ static int enqueue_to_backlog(struct sk_
  	reason = SKB_DROP_REASON_NOT_SPECIFIED;
  	sd = &per_cpu(softnet_data, cpu);
  
@@ -91,7 +91,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	if (!netif_running(skb->dev))
  		goto drop;
  	qlen = skb_queue_len(&sd->input_pkt_queue);
-@@ -4859,7 +4859,7 @@ static int enqueue_to_backlog(struct sk_
+@@ -4908,7 +4908,7 @@ static int enqueue_to_backlog(struct sk_
  enqueue:
  			__skb_queue_tail(&sd->input_pkt_queue, skb);
  			input_queue_tail_incr_save(sd, qtail);
@@ -100,7 +100,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  			return NET_RX_SUCCESS;
  		}
  
-@@ -4874,7 +4874,7 @@ enqueue:
+@@ -4923,7 +4923,7 @@ enqueue:
  
  drop:
  	sd->dropped++;
@@ -109,7 +109,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  
  	dev_core_stats_rx_dropped_inc(skb->dev);
  	kfree_skb_reason(skb, reason);
-@@ -5905,7 +5905,7 @@ static void flush_backlog(struct work_st
+@@ -5954,7 +5954,7 @@ static void flush_backlog(struct work_st
  	local_bh_disable();
  	sd = this_cpu_ptr(&softnet_data);
  
@@ -118,7 +118,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	skb_queue_walk_safe(&sd->input_pkt_queue, skb, tmp) {
  		if (skb->dev->reg_state == NETREG_UNREGISTERING) {
  			__skb_unlink(skb, &sd->input_pkt_queue);
-@@ -5913,7 +5913,7 @@ static void flush_backlog(struct work_st
+@@ -5962,7 +5962,7 @@ static void flush_backlog(struct work_st
  			input_queue_head_incr(sd);
  		}
  	}
@@ -127,7 +127,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  
  	skb_queue_walk_safe(&sd->process_queue, skb, tmp) {
  		if (skb->dev->reg_state == NETREG_UNREGISTERING) {
-@@ -5931,14 +5931,14 @@ static bool flush_required(int cpu)
+@@ -5980,14 +5980,14 @@ static bool flush_required(int cpu)
  	struct softnet_data *sd = &per_cpu(softnet_data, cpu);
  	bool do_flush;
  
@@ -144,7 +144,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  
  	return do_flush;
  #endif
-@@ -6053,7 +6053,7 @@ static int process_backlog(struct napi_s
+@@ -6102,7 +6102,7 @@ static int process_backlog(struct napi_s
  
  		}
  
@@ -153,7 +153,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		if (skb_queue_empty(&sd->input_pkt_queue)) {
  			/*
  			 * Inline a custom version of __napi_complete().
-@@ -6069,7 +6069,7 @@ static int process_backlog(struct napi_s
+@@ -6118,7 +6118,7 @@ static int process_backlog(struct napi_s
  			skb_queue_splice_tail_init(&sd->input_pkt_queue,
  						   &sd->process_queue);
  		}
diff --git a/target/linux/generic/backport-6.6/611-01-v6.11-udp-Allow-GSO-transmit-from-devices-with-no-checksum.patch b/target/linux/generic/backport-6.6/611-01-v6.11-udp-Allow-GSO-transmit-from-devices-with-no-checksum.patch
index 2f03074bc9ac8f..8edbce21685359 100644
--- a/target/linux/generic/backport-6.6/611-01-v6.11-udp-Allow-GSO-transmit-from-devices-with-no-checksum.patch
+++ b/target/linux/generic/backport-6.6/611-01-v6.11-udp-Allow-GSO-transmit-from-devices-with-no-checksum.patch
@@ -65,7 +65,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		}
 --- a/net/ipv4/udp_offload.c
 +++ b/net/ipv4/udp_offload.c
-@@ -380,6 +380,14 @@ struct sk_buff *__udp_gso_segment(struct
+@@ -448,6 +448,14 @@ struct sk_buff *__udp_gso_segment(struct
  	else
  		uh->check = gso_make_checksum(seg, ~check) ? : CSUM_MANGLED_0;
  
@@ -82,7 +82,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		int delta = sum_truesize - gso_skb->truesize;
 --- a/net/ipv6/udp.c
 +++ b/net/ipv6/udp.c
-@@ -1261,8 +1261,7 @@ static int udp_v6_send_skb(struct sk_buf
+@@ -1258,8 +1258,7 @@ static int udp_v6_send_skb(struct sk_buf
  			kfree_skb(skb);
  			return -EINVAL;
  		}
diff --git a/target/linux/generic/backport-6.6/611-02-v6.11-net-Make-USO-depend-on-CSUM-offload.patch b/target/linux/generic/backport-6.6/611-02-v6.11-net-Make-USO-depend-on-CSUM-offload.patch
index 30758f180f3e95..ae1a9a06391262 100644
--- a/target/linux/generic/backport-6.6/611-02-v6.11-net-Make-USO-depend-on-CSUM-offload.patch
+++ b/target/linux/generic/backport-6.6/611-02-v6.11-net-Make-USO-depend-on-CSUM-offload.patch
@@ -20,7 +20,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -9755,6 +9755,15 @@ static void netdev_sync_lower_features(s
+@@ -9808,6 +9808,15 @@ static void netdev_sync_lower_features(s
  	}
  }
  
@@ -36,7 +36,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  static netdev_features_t netdev_fix_features(struct net_device *dev,
  	netdev_features_t features)
  {
-@@ -9836,15 +9845,9 @@ static netdev_features_t netdev_fix_feat
+@@ -9889,15 +9898,9 @@ static netdev_features_t netdev_fix_feat
  		features &= ~NETIF_F_LRO;
  	}
  
@@ -55,7 +55,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	}
  
  	if ((features & NETIF_F_HW_TLS_RX) && !(features & NETIF_F_RXCSUM)) {
-@@ -9852,6 +9855,11 @@ static netdev_features_t netdev_fix_feat
+@@ -9905,6 +9908,11 @@ static netdev_features_t netdev_fix_feat
  		features &= ~NETIF_F_HW_TLS_RX;
  	}
  
diff --git a/target/linux/generic/backport-6.6/611-03-v6.11-udp-Fall-back-to-software-USO-if-IPv6-extension-head.patch b/target/linux/generic/backport-6.6/611-03-v6.11-udp-Fall-back-to-software-USO-if-IPv6-extension-head.patch
index e8eceb880c8dbd..2f75f5c3eea9f9 100644
--- a/target/linux/generic/backport-6.6/611-03-v6.11-udp-Fall-back-to-software-USO-if-IPv6-extension-head.patch
+++ b/target/linux/generic/backport-6.6/611-03-v6.11-udp-Fall-back-to-software-USO-if-IPv6-extension-head.patch
@@ -71,7 +71,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/net/ipv4/udp_offload.c
 +++ b/net/ipv4/udp_offload.c
-@@ -283,6 +283,12 @@ struct sk_buff *__udp_gso_segment(struct
+@@ -343,6 +343,12 @@ struct sk_buff *__udp_gso_segment(struct
  		     !(skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST)))
  		return ERR_PTR(-EINVAL);
  
diff --git a/target/linux/generic/backport-6.6/612-v6.9-net-get-stats64-if-device-if-driver-is-configured.patch b/target/linux/generic/backport-6.6/612-v6.9-net-get-stats64-if-device-if-driver-is-configured.patch
index 2db89c5a05a3dd..bf2c428eb4294e 100644
--- a/target/linux/generic/backport-6.6/612-v6.9-net-get-stats64-if-device-if-driver-is-configured.patch
+++ b/target/linux/generic/backport-6.6/612-v6.9-net-get-stats64-if-device-if-driver-is-configured.patch
@@ -18,7 +18,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -10662,6 +10662,8 @@ struct rtnl_link_stats64 *dev_get_stats(
+@@ -10715,6 +10715,8 @@ struct rtnl_link_stats64 *dev_get_stats(
  		ops->ndo_get_stats64(dev, storage);
  	} else if (ops->ndo_get_stats) {
  		netdev_stats_to_stats64(storage, ops->ndo_get_stats(dev));
diff --git a/target/linux/generic/backport-6.6/620-01-v6.7-page_pool-fragment-API-support-for-32-bit-arch-with-.patch b/target/linux/generic/backport-6.6/620-01-v6.7-page_pool-fragment-API-support-for-32-bit-arch-with-.patch
new file mode 100644
index 00000000000000..0f57e2ec663983
--- /dev/null
+++ b/target/linux/generic/backport-6.6/620-01-v6.7-page_pool-fragment-API-support-for-32-bit-arch-with-.patch
@@ -0,0 +1,139 @@
+From: Yunsheng Lin <linyunsheng@huawei.com>
+Date: Fri, 13 Oct 2023 14:48:21 +0800
+Subject: [PATCH] page_pool: fragment API support for 32-bit arch with 64-bit
+ DMA
+
+Currently page_pool_alloc_frag() is not supported in 32-bit
+arch with 64-bit DMA because of the overlap issue between
+pp_frag_count and dma_addr_upper in 'struct page' for those
+arches, which seems to be quite common, see [1], which means
+driver may need to handle it when using fragment API.
+
+It is assumed that the combination of the above arch with an
+address space >16TB does not exist, as all those arches have
+64b equivalent, it seems logical to use the 64b version for a
+system with a large address space. It is also assumed that dma
+address is page aligned when we are dma mapping a page aligned
+buffer, see [2].
+
+That means we're storing 12 bits of 0 at the lower end for a
+dma address, we can reuse those bits for the above arches to
+support 32b+12b, which is 16TB of memory.
+
+If we make a wrong assumption, a warning is emitted so that
+user can report to us.
+
+1. https://lore.kernel.org/all/20211117075652.58299-1-linyunsheng@huawei.com/
+2. https://lore.kernel.org/all/20230818145145.4b357c89@kernel.org/
+
+Tested-by: Alexander Lobakin <aleksander.lobakin@intel.com>
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+CC: Lorenzo Bianconi <lorenzo@kernel.org>
+CC: Alexander Duyck <alexander.duyck@gmail.com>
+CC: Liang Chen <liangchen.linux@gmail.com>
+CC: Guillaume Tucker <guillaume.tucker@collabora.com>
+CC: Matthew Wilcox <willy@infradead.org>
+CC: Linux-MM <linux-mm@kvack.org>
+Link: https://lore.kernel.org/r/20231013064827.61135-2-linyunsheng@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/include/linux/mm_types.h
++++ b/include/linux/mm_types.h
+@@ -125,18 +125,7 @@ struct page {
+ 			struct page_pool *pp;
+ 			unsigned long _pp_mapping_pad;
+ 			unsigned long dma_addr;
+-			union {
+-				/**
+-				 * dma_addr_upper: might require a 64-bit
+-				 * value on 32-bit architectures.
+-				 */
+-				unsigned long dma_addr_upper;
+-				/**
+-				 * For frag page support, not supported in
+-				 * 32-bit architectures with 64-bit DMA.
+-				 */
+-				atomic_long_t pp_frag_count;
+-			};
++			atomic_long_t pp_frag_count;
+ 		};
+ 		struct {	/* Tail pages of compound page */
+ 			unsigned long compound_head;	/* Bit zero is set */
+--- a/include/net/page_pool/helpers.h
++++ b/include/net/page_pool/helpers.h
+@@ -197,7 +197,7 @@ static inline void page_pool_recycle_dir
+ 	page_pool_put_full_page(pool, page, true);
+ }
+ 
+-#define PAGE_POOL_DMA_USE_PP_FRAG_COUNT	\
++#define PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA	\
+ 		(sizeof(dma_addr_t) > sizeof(unsigned long))
+ 
+ /**
+@@ -211,17 +211,25 @@ static inline dma_addr_t page_pool_get_d
+ {
+ 	dma_addr_t ret = page->dma_addr;
+ 
+-	if (PAGE_POOL_DMA_USE_PP_FRAG_COUNT)
+-		ret |= (dma_addr_t)page->dma_addr_upper << 16 << 16;
++	if (PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA)
++		ret <<= PAGE_SHIFT;
+ 
+ 	return ret;
+ }
+ 
+-static inline void page_pool_set_dma_addr(struct page *page, dma_addr_t addr)
++static inline bool page_pool_set_dma_addr(struct page *page, dma_addr_t addr)
+ {
++	if (PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA) {
++		page->dma_addr = addr >> PAGE_SHIFT;
++
++		/* We assume page alignment to shave off bottom bits,
++		 * if this "compression" doesn't work we need to drop.
++		 */
++		return addr != (dma_addr_t)page->dma_addr << PAGE_SHIFT;
++	}
++
+ 	page->dma_addr = addr;
+-	if (PAGE_POOL_DMA_USE_PP_FRAG_COUNT)
+-		page->dma_addr_upper = upper_32_bits(addr);
++	return false;
+ }
+ 
+ static inline bool page_pool_put(struct page_pool *pool)
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -211,10 +211,6 @@ static int page_pool_init(struct page_po
+ 		 */
+ 	}
+ 
+-	if (PAGE_POOL_DMA_USE_PP_FRAG_COUNT &&
+-	    pool->p.flags & PP_FLAG_PAGE_FRAG)
+-		return -EINVAL;
+-
+ #ifdef CONFIG_PAGE_POOL_STATS
+ 	pool->recycle_stats = alloc_percpu(struct page_pool_recycle_stats);
+ 	if (!pool->recycle_stats)
+@@ -363,12 +359,20 @@ static bool page_pool_dma_map(struct pag
+ 	if (dma_mapping_error(pool->p.dev, dma))
+ 		return false;
+ 
+-	page_pool_set_dma_addr(page, dma);
++	if (page_pool_set_dma_addr(page, dma))
++		goto unmap_failed;
+ 
+ 	if (pool->p.flags & PP_FLAG_DMA_SYNC_DEV)
+ 		page_pool_dma_sync_for_device(pool, page, pool->p.max_len);
+ 
+ 	return true;
++
++unmap_failed:
++	WARN_ON_ONCE("unexpected DMA address, please report to netdev@");
++	dma_unmap_page_attrs(pool->p.dev, dma,
++			     PAGE_SIZE << pool->p.order, pool->p.dma_dir,
++			     DMA_ATTR_SKIP_CPU_SYNC | DMA_ATTR_WEAK_ORDERING);
++	return false;
+ }
+ 
+ static void page_pool_set_pp_info(struct page_pool *pool,
diff --git a/target/linux/generic/backport-6.6/620-02-v6.7-page_pool-unify-frag_count-handling-in-page_pool_is_.patch b/target/linux/generic/backport-6.6/620-02-v6.7-page_pool-unify-frag_count-handling-in-page_pool_is_.patch
new file mode 100644
index 00000000000000..1ad0eb449d7622
--- /dev/null
+++ b/target/linux/generic/backport-6.6/620-02-v6.7-page_pool-unify-frag_count-handling-in-page_pool_is_.patch
@@ -0,0 +1,183 @@
+From: Yunsheng Lin <linyunsheng@huawei.com>
+Date: Fri, 20 Oct 2023 17:59:48 +0800
+Subject: [PATCH] page_pool: unify frag_count handling in
+ page_pool_is_last_frag()
+
+Currently when page_pool_create() is called with
+PP_FLAG_PAGE_FRAG flag, page_pool_alloc_pages() is only
+allowed to be called under the below constraints:
+1. page_pool_fragment_page() need to be called to setup
+   page->pp_frag_count immediately.
+2. page_pool_defrag_page() often need to be called to drain
+   the page->pp_frag_count when there is no more user will
+   be holding on to that page.
+
+Those constraints exist in order to support a page to be
+split into multi fragments.
+
+And those constraints have some overhead because of the
+cache line dirtying/bouncing and atomic update.
+
+Those constraints are unavoidable for case when we need a
+page to be split into more than one fragment, but there is
+also case that we want to avoid the above constraints and
+their overhead when a page can't be split as it can only
+hold a fragment as requested by user, depending on different
+use cases:
+use case 1: allocate page without page splitting.
+use case 2: allocate page with page splitting.
+use case 3: allocate page with or without page splitting
+            depending on the fragment size.
+
+Currently page pool only provide page_pool_alloc_pages() and
+page_pool_alloc_frag() API to enable the 1 & 2 separately,
+so we can not use a combination of 1 & 2 to enable 3, it is
+not possible yet because of the per page_pool flag
+PP_FLAG_PAGE_FRAG.
+
+So in order to allow allocating unsplit page without the
+overhead of split page while still allow allocating split
+page we need to remove the per page_pool flag in
+page_pool_is_last_frag(), as best as I can think of, it seems
+there are two methods as below:
+1. Add per page flag/bit to indicate a page is split or
+   not, which means we might need to update that flag/bit
+   everytime the page is recycled, dirtying the cache line
+   of 'struct page' for use case 1.
+2. Unify the page->pp_frag_count handling for both split and
+   unsplit page by assuming all pages in the page pool is split
+   into a big fragment initially.
+
+As page pool already supports use case 1 without dirtying the
+cache line of 'struct page' whenever a page is recyclable, we
+need to support the above use case 3 with minimal overhead,
+especially not adding any noticeable overhead for use case 1,
+and we are already doing an optimization by not updating
+pp_frag_count in page_pool_defrag_page() for the last fragment
+user, this patch chooses to unify the pp_frag_count handling
+to support the above use case 3.
+
+There is no noticeable performance degradation and some
+justification for unifying the frag_count handling with this
+patch applied using a micro-benchmark testing in [1].
+
+1. https://lore.kernel.org/all/bf2591f8-7b3c-4480-bb2c-31dc9da1d6ac@huawei.com/
+
+Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
+CC: Lorenzo Bianconi <lorenzo@kernel.org>
+CC: Alexander Duyck <alexander.duyck@gmail.com>
+CC: Liang Chen <liangchen.linux@gmail.com>
+CC: Alexander Lobakin <aleksander.lobakin@intel.com>
+Link: https://lore.kernel.org/r/20231020095952.11055-2-linyunsheng@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+
+--- a/include/net/page_pool/helpers.h
++++ b/include/net/page_pool/helpers.h
+@@ -115,28 +115,49 @@ static inline long page_pool_defrag_page
+ 	long ret;
+ 
+ 	/* If nr == pp_frag_count then we have cleared all remaining
+-	 * references to the page. No need to actually overwrite it, instead
+-	 * we can leave this to be overwritten by the calling function.
++	 * references to the page:
++	 * 1. 'n == 1': no need to actually overwrite it.
++	 * 2. 'n != 1': overwrite it with one, which is the rare case
++	 *              for pp_frag_count draining.
+ 	 *
+-	 * The main advantage to doing this is that an atomic_read is
+-	 * generally a much cheaper operation than an atomic update,
+-	 * especially when dealing with a page that may be partitioned
+-	 * into only 2 or 3 pieces.
++	 * The main advantage to doing this is that not only we avoid a atomic
++	 * update, as an atomic_read is generally a much cheaper operation than
++	 * an atomic update, especially when dealing with a page that may be
++	 * partitioned into only 2 or 3 pieces; but also unify the pp_frag_count
++	 * handling by ensuring all pages have partitioned into only 1 piece
++	 * initially, and only overwrite it when the page is partitioned into
++	 * more than one piece.
+ 	 */
+-	if (atomic_long_read(&page->pp_frag_count) == nr)
++	if (atomic_long_read(&page->pp_frag_count) == nr) {
++		/* As we have ensured nr is always one for constant case using
++		 * the BUILD_BUG_ON(), only need to handle the non-constant case
++		 * here for pp_frag_count draining, which is a rare case.
++		 */
++		BUILD_BUG_ON(__builtin_constant_p(nr) && nr != 1);
++		if (!__builtin_constant_p(nr))
++			atomic_long_set(&page->pp_frag_count, 1);
++
+ 		return 0;
++	}
+ 
+ 	ret = atomic_long_sub_return(nr, &page->pp_frag_count);
+ 	WARN_ON(ret < 0);
++
++	/* We are the last user here too, reset pp_frag_count back to 1 to
++	 * ensure all pages have been partitioned into 1 piece initially,
++	 * this should be the rare case when the last two fragment users call
++	 * page_pool_defrag_page() currently.
++	 */
++	if (unlikely(!ret))
++		atomic_long_set(&page->pp_frag_count, 1);
++
+ 	return ret;
+ }
+ 
+-static inline bool page_pool_is_last_frag(struct page_pool *pool,
+-					  struct page *page)
++static inline bool page_pool_is_last_frag(struct page *page)
+ {
+-	/* If fragments aren't enabled or count is 0 we were the last user */
+-	return !(pool->p.flags & PP_FLAG_PAGE_FRAG) ||
+-	       (page_pool_defrag_page(page, 1) == 0);
++	/* If page_pool_defrag_page() returns 0, we were the last user */
++	return page_pool_defrag_page(page, 1) == 0;
+ }
+ 
+ /**
+@@ -161,7 +182,7 @@ static inline void page_pool_put_page(st
+ 	 * allow registering MEM_TYPE_PAGE_POOL, but shield linker.
+ 	 */
+ #ifdef CONFIG_PAGE_POOL
+-	if (!page_pool_is_last_frag(pool, page))
++	if (!page_pool_is_last_frag(page))
+ 		return;
+ 
+ 	page_pool_put_defragged_page(pool, page, dma_sync_size, allow_direct);
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -380,6 +380,14 @@ static void page_pool_set_pp_info(struct
+ {
+ 	page->pp = pool;
+ 	page->pp_magic |= PP_SIGNATURE;
++
++	/* Ensuring all pages have been split into one fragment initially:
++	 * page_pool_set_pp_info() is only called once for every page when it
++	 * is allocated from the page allocator and page_pool_fragment_page()
++	 * is dirtying the same cache line as the page->pp_magic above, so
++	 * the overhead is negligible.
++	 */
++	page_pool_fragment_page(page, 1);
+ 	if (pool->p.init_callback)
+ 		pool->p.init_callback(page, pool->p.init_arg);
+ }
+@@ -676,7 +684,7 @@ void page_pool_put_page_bulk(struct page
+ 		struct page *page = virt_to_head_page(data[i]);
+ 
+ 		/* It is not the last user for the page frag case */
+-		if (!page_pool_is_last_frag(pool, page))
++		if (!page_pool_is_last_frag(page))
+ 			continue;
+ 
+ 		page = __page_pool_put_page(pool, page, -1, false);
+@@ -752,8 +760,7 @@ struct page *page_pool_alloc_frag(struct
+ 	unsigned int max_size = PAGE_SIZE << pool->p.order;
+ 	struct page *page = pool->frag_page;
+ 
+-	if (WARN_ON(!(pool->p.flags & PP_FLAG_PAGE_FRAG) ||
+-		    size > max_size))
++	if (WARN_ON(size > max_size))
+ 		return NULL;
+ 
+ 	size = ALIGN(size, dma_get_cache_alignment());
diff --git a/target/linux/generic/backport-6.6/621-proc-fix-missing-pde_set_flags.patch b/target/linux/generic/backport-6.6/621-proc-fix-missing-pde_set_flags.patch
new file mode 100644
index 00000000000000..ba026b9c3a1268
--- /dev/null
+++ b/target/linux/generic/backport-6.6/621-proc-fix-missing-pde_set_flags.patch
@@ -0,0 +1,121 @@
+From: wangzijie <wangzijie1@honor.com>
+To: <akpm@linux-foundation.org>, <brauner@kernel.org>,
+	<viro@zeniv.linux.org.uk>, <adobriyan@gmail.com>,
+	<rick.p.edgecombe@intel.com>, <ast@kernel.org>,
+	<k.shutemov@gmail.com>, <jirislaby@kernel.org>,
+	<linux-fsdevel@vger.kernel.org>
+Cc: <polynomial-c@gmx.de>, <gregkh@linuxfoundation.org>,
+	<stable@vger.kernel.org>, <regressions@lists.linux.dev>,
+	wangzijie <wangzijie1@honor.com>
+Subject: [PATCH v3] proc: fix missing pde_set_flags() for net proc files
+Date: Thu, 21 Aug 2025 18:58:06 +0800	[thread overview]
+Message-ID: <20250821105806.1453833-1-wangzijie1@honor.com> (raw)
+
+To avoid potential UAF issues during module removal races, we use pde_set_flags()
+to save proc_ops flags in PDE itself before proc_register(), and then use
+pde_has_proc_*() helpers instead of directly dereferencing pde->proc_ops->*.
+
+However, the pde_set_flags() call was missing when creating net related proc files.
+This omission caused incorrect behavior which FMODE_LSEEK was being cleared
+inappropriately in proc_reg_open() for net proc files. Lars reported it in this link[1].
+
+Fix this by ensuring pde_set_flags() is called when register proc entry, and add
+NULL check for proc_ops in pde_set_flags().
+
+[1]: https://lore.kernel.org/all/20250815195616.64497967@chagall.paradoxon.rec/
+
+Fixes: ff7ec8dc1b64 ("proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al")
+Cc: stable@vger.kernel.org
+Reported-by: Lars Wendler <polynomial-c@gmx.de>
+Signed-off-by: wangzijie <wangzijie1@honor.com>
+---
+v3:
+- followed by Christian's suggestion to stash pde->proc_ops in a local const variable
+v2:
+- followed by Jiri's suggestion to refractor code and reformat commit message
+---
+ fs/proc/generic.c | 38 +++++++++++++++++++++-----------------
+ 1 file changed, 21 insertions(+), 17 deletions(-)
+
+--- a/fs/proc/generic.c
++++ b/fs/proc/generic.c
+@@ -362,6 +362,25 @@ static const struct inode_operations pro
+ 	.setattr	= proc_notify_change,
+ };
+ 
++static void pde_set_flags(struct proc_dir_entry *pde)
++{
++	const struct proc_ops *proc_ops = pde->proc_ops;
++
++	if (!proc_ops)
++		return;
++
++	if (proc_ops->proc_flags & PROC_ENTRY_PERMANENT)
++		pde->flags |= PROC_ENTRY_PERMANENT;
++	if (proc_ops->proc_read_iter)
++		pde->flags |= PROC_ENTRY_proc_read_iter;
++#ifdef CONFIG_COMPAT
++	if (proc_ops->proc_compat_ioctl)
++		pde->flags |= PROC_ENTRY_proc_compat_ioctl;
++#endif
++	if (proc_ops->proc_lseek)
++		pde->flags |= PROC_ENTRY_proc_lseek;
++}
++
+ /* returns the registered entry, or frees dp and returns NULL on failure */
+ struct proc_dir_entry *proc_register(struct proc_dir_entry *dir,
+ 		struct proc_dir_entry *dp)
+@@ -369,6 +388,8 @@ struct proc_dir_entry *proc_register(str
+ 	if (proc_alloc_inum(&dp->low_ino))
+ 		goto out_free_entry;
+ 
++	pde_set_flags(dp);
++
+ 	write_lock(&proc_subdir_lock);
+ 	dp->parent = dir;
+ 	if (pde_subdir_insert(dir, dp) == false) {
+@@ -557,20 +578,6 @@ struct proc_dir_entry *proc_create_reg(c
+ 	return p;
+ }
+ 
+-static void pde_set_flags(struct proc_dir_entry *pde)
+-{
+-	if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT)
+-		pde->flags |= PROC_ENTRY_PERMANENT;
+-	if (pde->proc_ops->proc_read_iter)
+-		pde->flags |= PROC_ENTRY_proc_read_iter;
+-#ifdef CONFIG_COMPAT
+-	if (pde->proc_ops->proc_compat_ioctl)
+-		pde->flags |= PROC_ENTRY_proc_compat_ioctl;
+-#endif
+-	if (pde->proc_ops->proc_lseek)
+-		pde->flags |= PROC_ENTRY_proc_lseek;
+-}
+-
+ struct proc_dir_entry *proc_create_data(const char *name, umode_t mode,
+ 		struct proc_dir_entry *parent,
+ 		const struct proc_ops *proc_ops, void *data)
+@@ -581,7 +588,6 @@ struct proc_dir_entry *proc_create_data(
+ 	if (!p)
+ 		return NULL;
+ 	p->proc_ops = proc_ops;
+-	pde_set_flags(p);
+ 	return proc_register(parent, p);
+ }
+ EXPORT_SYMBOL(proc_create_data);
+@@ -632,7 +638,6 @@ struct proc_dir_entry *proc_create_seq_p
+ 	p->proc_ops = &proc_seq_ops;
+ 	p->seq_ops = ops;
+ 	p->state_size = state_size;
+-	pde_set_flags(p);
+ 	return proc_register(parent, p);
+ }
+ EXPORT_SYMBOL(proc_create_seq_private);
+@@ -663,7 +668,6 @@ struct proc_dir_entry *proc_create_singl
+ 		return NULL;
+ 	p->proc_ops = &proc_single_ops;
+ 	p->single_show = show;
+-	pde_set_flags(p);
+ 	return proc_register(parent, p);
+ }
+ EXPORT_SYMBOL(proc_create_single_data);
diff --git a/target/linux/generic/backport-6.6/700-v6.10-net-create-a-dummy-net_device-allocator.patch b/target/linux/generic/backport-6.6/700-v6.10-net-create-a-dummy-net_device-allocator.patch
index a17a91ec7c759c..c91d0428b87d15 100644
--- a/target/linux/generic/backport-6.6/700-v6.10-net-create-a-dummy-net_device-allocator.patch
+++ b/target/linux/generic/backport-6.6/700-v6.10-net-create-a-dummy-net_device-allocator.patch
@@ -37,7 +37,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/include/linux/netdevice.h
 +++ b/include/linux/netdevice.h
-@@ -4549,6 +4549,9 @@ static inline void netif_addr_unlock_bh(
+@@ -4581,6 +4581,9 @@ static inline void netif_addr_unlock_bh(
  
  void ether_setup(struct net_device *dev);
  
@@ -49,7 +49,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  				    unsigned char name_assign_type,
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -10349,25 +10349,12 @@ err_free_name:
+@@ -10402,25 +10402,12 @@ err_free_name:
  }
  EXPORT_SYMBOL(register_netdevice);
  
@@ -79,7 +79,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	/* make sure we BUG if trying to hit standard
  	 * register/unregister code path
  	 */
-@@ -10387,12 +10374,32 @@ int init_dummy_netdev(struct net_device
+@@ -10440,12 +10427,32 @@ int init_dummy_netdev(struct net_device
  	 * because users of this 'device' dont need to change
  	 * its refcount.
  	 */
@@ -113,7 +113,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  /**
   *	register_netdev	- register a network device
   *	@dev: device to register
-@@ -10986,6 +10993,19 @@ void free_netdev(struct net_device *dev)
+@@ -11039,6 +11046,19 @@ void free_netdev(struct net_device *dev)
  EXPORT_SYMBOL(free_netdev);
  
  /**
diff --git a/target/linux/generic/backport-6.6/703-v6.10-flow_offload-add-control-flag-checking-helpers.patch b/target/linux/generic/backport-6.6/703-v6.10-flow_offload-add-control-flag-checking-helpers.patch
new file mode 100644
index 00000000000000..457dac16d43b43
--- /dev/null
+++ b/target/linux/generic/backport-6.6/703-v6.10-flow_offload-add-control-flag-checking-helpers.patch
@@ -0,0 +1,101 @@
+From d11e63119432bdb55065d094cb6fd37e9147c70d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Asbj=C3=B8rn=20Sloth=20T=C3=B8nnesen?= <ast@fiberby.net>
+Date: Thu, 11 Apr 2024 10:52:54 +0000
+Subject: [PATCH] flow_offload: add control flag checking helpers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+These helpers aim to help drivers, with checking
+for the presence of unsupported control flags.
+
+For drivers supporting at least one control flag:
+  flow_rule_is_supp_control_flags()
+
+For drivers using flow_rule_match_control(), but not using flags:
+  flow_rule_has_control_flags()
+
+For drivers not using flow_rule_match_control():
+  flow_rule_match_has_control_flags()
+
+While primarily aimed at FLOW_DISSECTOR_KEY_CONTROL
+and flow_rule_match_control(), then the first two
+can also be used with FLOW_DISSECTOR_KEY_ENC_CONTROL
+and flow_rule_match_enc_control().
+
+These helpers mirrors the existing check done in sfc:
+  drivers/net/ethernet/sfc/tc.c +276
+
+Only compile-tested.
+
+Signed-off-by: Asbjørn Sloth Tønnesen <ast@fiberby.net>
+Reviewed-by: Louis Peens <louis.peens@corigine.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ include/net/flow_offload.h | 55 ++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 55 insertions(+)
+
+--- a/include/net/flow_offload.h
++++ b/include/net/flow_offload.h
+@@ -449,6 +449,61 @@ static inline bool flow_rule_match_key(c
+ 	return dissector_uses_key(rule->match.dissector, key);
+ }
+ 
++/**
++ * flow_rule_is_supp_control_flags() - check for supported control flags
++ * @supp_flags: control flags supported by driver
++ * @ctrl_flags: control flags present in rule
++ * @extack: The netlink extended ACK for reporting errors.
++ *
++ * Return: true if only supported control flags are set, false otherwise.
++ */
++static inline bool flow_rule_is_supp_control_flags(const u32 supp_flags,
++						   const u32 ctrl_flags,
++						   struct netlink_ext_ack *extack)
++{
++	if (likely((ctrl_flags & ~supp_flags) == 0))
++		return true;
++
++	NL_SET_ERR_MSG_FMT_MOD(extack,
++			       "Unsupported match on control.flags %#x",
++			       ctrl_flags);
++
++	return false;
++}
++
++/**
++ * flow_rule_has_control_flags() - check for presence of any control flags
++ * @ctrl_flags: control flags present in rule
++ * @extack: The netlink extended ACK for reporting errors.
++ *
++ * Return: true if control flags are set, false otherwise.
++ */
++static inline bool flow_rule_has_control_flags(const u32 ctrl_flags,
++					       struct netlink_ext_ack *extack)
++{
++	return !flow_rule_is_supp_control_flags(0, ctrl_flags, extack);
++}
++
++/**
++ * flow_rule_match_has_control_flags() - match and check for any control flags
++ * @rule: The flow_rule under evaluation.
++ * @extack: The netlink extended ACK for reporting errors.
++ *
++ * Return: true if control flags are set, false otherwise.
++ */
++static inline bool flow_rule_match_has_control_flags(struct flow_rule *rule,
++						     struct netlink_ext_ack *extack)
++{
++	struct flow_match_control match;
++
++	if (!flow_rule_match_key(rule, FLOW_DISSECTOR_KEY_CONTROL))
++		return false;
++
++	flow_rule_match_control(rule, &match);
++
++	return flow_rule_has_control_flags(match.mask->flags, extack);
++}
++
+ struct flow_stats {
+ 	u64	pkts;
+ 	u64	bytes;
diff --git a/target/linux/generic/backport-6.6/704-v6.12-ipv6-Add-ipv6_addr_-cpu_to_be32-be32_to_cpu-helpers.patch b/target/linux/generic/backport-6.6/704-v6.12-ipv6-Add-ipv6_addr_-cpu_to_be32-be32_to_cpu-helpers.patch
new file mode 100644
index 00000000000000..2f4eec6953f6cc
--- /dev/null
+++ b/target/linux/generic/backport-6.6/704-v6.12-ipv6-Add-ipv6_addr_-cpu_to_be32-be32_to_cpu-helpers.patch
@@ -0,0 +1,40 @@
+From f40a455d01f80c6638be382d75cb1c4e7748d8af Mon Sep 17 00:00:00 2001
+From: Simon Horman <horms@kernel.org>
+Date: Tue, 13 Aug 2024 14:33:47 +0100
+Subject: [PATCH] ipv6: Add ipv6_addr_{cpu_to_be32,be32_to_cpu} helpers
+
+Add helpers to convert an ipv6 addr, expressed as an array
+of words, from CPU to big-endian byte order, and vice versa.
+
+No functional change intended.
+Compile tested only.
+
+Suggested-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://lore.kernel.org/netdev/c7684349-535c-45a4-9a74-d47479a50020@lunn.ch/
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20240813-ipv6_addr-helpers-v2-1-5c974f8cca3e@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ include/net/ipv6.h | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -1382,4 +1382,16 @@ static inline void ip6_sock_set_recvpkti
+ 	release_sock(sk);
+ }
+ 
++#define IPV6_ADDR_WORDS 4
++
++static inline void ipv6_addr_cpu_to_be32(__be32 *dst, const u32 *src)
++{
++	cpu_to_be32_array(dst, src, IPV6_ADDR_WORDS);
++}
++
++static inline void ipv6_addr_be32_to_cpu(u32 *dst, const __be32 *src)
++{
++	be32_to_cpu_array(dst, src, IPV6_ADDR_WORDS);
++}
++
+ #endif /* _NET_IPV6_H */
diff --git a/target/linux/generic/backport-6.6/714-v6.8-02-net-phy-extend-PHY-package-API-to-support-multiple-g.patch b/target/linux/generic/backport-6.6/714-v6.8-02-net-phy-extend-PHY-package-API-to-support-multiple-g.patch
index 68f855283eecbe..514a80b298dfdb 100644
--- a/target/linux/generic/backport-6.6/714-v6.8-02-net-phy-extend-PHY-package-API-to-support-multiple-g.patch
+++ b/target/linux/generic/backport-6.6/714-v6.8-02-net-phy-extend-PHY-package-API-to-support-multiple-g.patch
@@ -87,7 +87,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	phy_unlock_mdio_bus(phydev);
 --- a/drivers/net/phy/mscc/mscc.h
 +++ b/drivers/net/phy/mscc/mscc.h
-@@ -416,6 +416,11 @@ struct vsc8531_private {
+@@ -428,6 +428,11 @@ struct vsc8531_private {
   * gpio_lock: used for PHC operations. Common for all PHYs as the load/save GPIO
   * is shared.
   */
@@ -242,7 +242,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	refcount_t refcnt;
  	unsigned long flags;
  	size_t priv_size;
-@@ -1969,10 +1970,10 @@ int phy_ethtool_get_link_ksettings(struc
+@@ -1966,10 +1967,10 @@ int phy_ethtool_get_link_ksettings(struc
  int phy_ethtool_set_link_ksettings(struct net_device *ndev,
  				   const struct ethtool_link_ksettings *cmd);
  int phy_ethtool_nway_reset(struct net_device *ndev);
@@ -255,7 +255,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  int __init mdio_bus_init(void);
  void mdio_bus_exit(void);
-@@ -1995,46 +1996,65 @@ int __phy_hwtstamp_set(struct phy_device
+@@ -1992,46 +1993,65 @@ int __phy_hwtstamp_set(struct phy_device
  		       struct kernel_hwtstamp_config *config,
  		       struct netlink_ext_ack *extack);
  
diff --git a/target/linux/generic/backport-6.6/714-v6.8-04-net-phy-add-support-for-PHY-package-MMD-read-write.patch b/target/linux/generic/backport-6.6/714-v6.8-04-net-phy-add-support-for-PHY-package-MMD-read-write.patch
index c20d2ec0c01b86..d42da1b71fef39 100644
--- a/target/linux/generic/backport-6.6/714-v6.8-04-net-phy-add-support-for-PHY-package-MMD-read-write.patch
+++ b/target/linux/generic/backport-6.6/714-v6.8-04-net-phy-add-support-for-PHY-package-MMD-read-write.patch
@@ -171,7 +171,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
   * @regnum: register number to modify
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -2057,6 +2057,22 @@ static inline int __phy_package_write(st
+@@ -2054,6 +2054,22 @@ static inline int __phy_package_write(st
  	return __mdiobus_write(phydev->mdio.bus, addr, regnum, val);
  }
  
diff --git a/target/linux/generic/backport-6.6/716-v6.9-03-net-phy-add-devm-of_phy_package_join-helper.patch b/target/linux/generic/backport-6.6/716-v6.9-03-net-phy-add-devm-of_phy_package_join-helper.patch
index 25f6c5ccdad87e..1fdd91497b26b3 100644
--- a/target/linux/generic/backport-6.6/716-v6.9-03-net-phy-add-devm-of_phy_package_join-helper.patch
+++ b/target/linux/generic/backport-6.6/716-v6.9-03-net-phy-add-devm-of_phy_package_join-helper.patch
@@ -170,7 +170,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	refcount_t refcnt;
  	unsigned long flags;
  	size_t priv_size;
-@@ -1971,9 +1974,12 @@ int phy_ethtool_set_link_ksettings(struc
+@@ -1968,9 +1971,12 @@ int phy_ethtool_set_link_ksettings(struc
  				   const struct ethtool_link_ksettings *cmd);
  int phy_ethtool_nway_reset(struct net_device *ndev);
  int phy_package_join(struct phy_device *phydev, int base_addr, size_t priv_size);
diff --git a/target/linux/generic/backport-6.6/716-v6.9-06-net-phy-provide-whether-link-has-changed-in-c37_read.patch b/target/linux/generic/backport-6.6/716-v6.9-06-net-phy-provide-whether-link-has-changed-in-c37_read.patch
index a96b9f1b6665e0..4bb44b921d45f3 100644
--- a/target/linux/generic/backport-6.6/716-v6.9-06-net-phy-provide-whether-link-has-changed-in-c37_read.patch
+++ b/target/linux/generic/backport-6.6/716-v6.9-06-net-phy-provide-whether-link-has-changed-in-c37_read.patch
@@ -41,7 +41,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -2615,12 +2615,15 @@ EXPORT_SYMBOL(genphy_read_status);
+@@ -2617,12 +2617,15 @@ EXPORT_SYMBOL(genphy_read_status);
  /**
   * genphy_c37_read_status - check the link status and update current link state
   * @phydev: target phy_device struct
@@ -58,7 +58,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  {
  	int lpa, err, old_link = phydev->link;
  
-@@ -2630,9 +2633,13 @@ int genphy_c37_read_status(struct phy_de
+@@ -2632,9 +2635,13 @@ int genphy_c37_read_status(struct phy_de
  		return err;
  
  	/* why bother the PHY if nothing can have changed */
@@ -89,7 +89,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  }
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -1849,7 +1849,7 @@ int genphy_write_mmd_unsupported(struct
+@@ -1846,7 +1846,7 @@ int genphy_write_mmd_unsupported(struct
  
  /* Clause 37 */
  int genphy_c37_config_aneg(struct phy_device *phydev);
diff --git a/target/linux/generic/backport-6.6/734-v6.8-net-phy-bcm54612e-add-suspend-resume.patch b/target/linux/generic/backport-6.6/734-v6.8-net-phy-bcm54612e-add-suspend-resume.patch
index 28524a3dcf4cd8..12a89dae74a3e3 100644
--- a/target/linux/generic/backport-6.6/734-v6.8-net-phy-bcm54612e-add-suspend-resume.patch
+++ b/target/linux/generic/backport-6.6/734-v6.8-net-phy-bcm54612e-add-suspend-resume.patch
@@ -16,12 +16,12 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/drivers/net/phy/broadcom.c
 +++ b/drivers/net/phy/broadcom.c
-@@ -1001,6 +1001,8 @@ static struct phy_driver broadcom_driver
- 	.config_intr	= bcm_phy_config_intr,
+@@ -1061,6 +1061,8 @@ static struct phy_driver broadcom_driver
  	.handle_interrupt = bcm_phy_handle_interrupt,
  	.link_change_notify	= bcm54xx_link_change_notify,
+ 	.led_brightness_set	= bcm_phy_led_brightness_set,
 +	.suspend	= bcm54xx_suspend,
 +	.resume		= bcm54xx_resume,
  }, {
- 	.phy_id		= PHY_ID_BCM5421,
+ 	.phy_id		= PHY_ID_BCM54616S,
  	.phy_id_mask	= 0xfffffff0,
diff --git a/target/linux/generic/backport-6.6/751-01-STABLE-net-ethernet-mediatek-split-tx-and-rx-fields-in-mtk_.patch b/target/linux/generic/backport-6.6/751-01-v6.8-net-ethernet-mediatek-split-tx-and-rx-fields-in-mtk_.patch
similarity index 91%
rename from target/linux/generic/backport-6.6/751-01-STABLE-net-ethernet-mediatek-split-tx-and-rx-fields-in-mtk_.patch
rename to target/linux/generic/backport-6.6/751-01-v6.8-net-ethernet-mediatek-split-tx-and-rx-fields-in-mtk_.patch
index 22aceecc534c59..7d232563cad504 100644
--- a/target/linux/generic/backport-6.6/751-01-STABLE-net-ethernet-mediatek-split-tx-and-rx-fields-in-mtk_.patch
+++ b/target/linux/generic/backport-6.6/751-01-v6.8-net-ethernet-mediatek-split-tx-and-rx-fields-in-mtk_.patch
@@ -167,7 +167,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  			skb->ip_summed = CHECKSUM_UNNECESSARY;
  		else
  			skb_checksum_none_assert(skb);
-@@ -2276,7 +2276,7 @@ static int mtk_poll_tx_qdma(struct mtk_e
+@@ -2280,7 +2280,7 @@ static int mtk_poll_tx_qdma(struct mtk_e
  			break;
  
  		tx_buf = mtk_desc_to_tx_buf(ring, desc,
@@ -176,7 +176,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		if (!tx_buf->data)
  			break;
  
-@@ -2327,7 +2327,7 @@ static int mtk_poll_tx_pdma(struct mtk_e
+@@ -2331,7 +2331,7 @@ static int mtk_poll_tx_pdma(struct mtk_e
  		}
  		mtk_tx_unmap(eth, tx_buf, &bq, true);
  
@@ -185,7 +185,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		ring->last_free = desc;
  		atomic_inc(&ring->free_count);
  
-@@ -2417,7 +2417,7 @@ static int mtk_napi_rx(struct napi_struc
+@@ -2421,7 +2421,7 @@ static int mtk_napi_rx(struct napi_struc
  	do {
  		int rx_done;
  
@@ -194,7 +194,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  			reg_map->pdma.irq_status);
  		rx_done = mtk_poll_rx(napi, budget - rx_done_total, eth);
  		rx_done_total += rx_done;
-@@ -2433,10 +2433,10 @@ static int mtk_napi_rx(struct napi_struc
+@@ -2437,10 +2437,10 @@ static int mtk_napi_rx(struct napi_struc
  			return budget;
  
  	} while (mtk_r32(eth, reg_map->pdma.irq_status) &
@@ -207,7 +207,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  
  	return rx_done_total;
  }
-@@ -2445,7 +2445,7 @@ static int mtk_tx_alloc(struct mtk_eth *
+@@ -2449,7 +2449,7 @@ static int mtk_tx_alloc(struct mtk_eth *
  {
  	const struct mtk_soc_data *soc = eth->soc;
  	struct mtk_tx_ring *ring = &eth->tx_ring;
@@ -216,7 +216,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	struct mtk_tx_dma_v2 *txd;
  	int ring_size;
  	u32 ofs, val;
-@@ -2568,14 +2568,14 @@ static void mtk_tx_clean(struct mtk_eth
+@@ -2572,14 +2572,14 @@ static void mtk_tx_clean(struct mtk_eth
  	}
  	if (!MTK_HAS_CAPS(soc->caps, MTK_SRAM) && ring->dma) {
  		dma_free_coherent(eth->dma_dev,
@@ -233,7 +233,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  				  ring->dma_pdma, ring->phys_pdma);
  		ring->dma_pdma = NULL;
  	}
-@@ -2630,15 +2630,15 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -2634,15 +2634,15 @@ static int mtk_rx_alloc(struct mtk_eth *
  	if (!MTK_HAS_CAPS(eth->soc->caps, MTK_SRAM) ||
  	    rx_flag != MTK_RX_FLAGS_NORMAL) {
  		ring->dma = dma_alloc_coherent(eth->dma_dev,
@@ -253,7 +253,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	}
  
  	if (!ring->dma)
-@@ -2649,7 +2649,7 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -2653,7 +2653,7 @@ static int mtk_rx_alloc(struct mtk_eth *
  		dma_addr_t dma_addr;
  		void *data;
  
@@ -262,7 +262,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		if (ring->page_pool) {
  			data = mtk_page_pool_get_buff(ring->page_pool,
  						      &dma_addr, GFP_KERNEL);
-@@ -2740,7 +2740,7 @@ static void mtk_rx_clean(struct mtk_eth
+@@ -2744,7 +2744,7 @@ static void mtk_rx_clean(struct mtk_eth
  			if (!ring->data[i])
  				continue;
  
@@ -271,7 +271,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  			if (!rxd->rxd1)
  				continue;
  
-@@ -2757,7 +2757,7 @@ static void mtk_rx_clean(struct mtk_eth
+@@ -2761,7 +2761,7 @@ static void mtk_rx_clean(struct mtk_eth
  
  	if (!in_sram && ring->dma) {
  		dma_free_coherent(eth->dma_dev,
@@ -280,8 +280,8 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  				  ring->dma, ring->phys);
  		ring->dma = NULL;
  	}
-@@ -3120,7 +3120,7 @@ static void mtk_dma_free(struct mtk_eth
- 			netdev_reset_queue(eth->netdev[i]);
+@@ -3132,7 +3132,7 @@ static void mtk_dma_free(struct mtk_eth
+ 
  	if (!MTK_HAS_CAPS(soc->caps, MTK_SRAM) && eth->scratch_ring) {
  		dma_free_coherent(eth->dma_dev,
 -				  MTK_QDMA_RING_SIZE * soc->txrx.txd_size,
@@ -289,7 +289,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  				  eth->scratch_ring, eth->phy_scratch_ring);
  		eth->scratch_ring = NULL;
  		eth->phy_scratch_ring = 0;
-@@ -3170,7 +3170,7 @@ static irqreturn_t mtk_handle_irq_rx(int
+@@ -3182,7 +3182,7 @@ static irqreturn_t mtk_handle_irq_rx(int
  
  	eth->rx_events++;
  	if (likely(napi_schedule_prep(&eth->rx_napi))) {
@@ -298,7 +298,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		__napi_schedule(&eth->rx_napi);
  	}
  
-@@ -3196,9 +3196,9 @@ static irqreturn_t mtk_handle_irq(int ir
+@@ -3208,9 +3208,9 @@ static irqreturn_t mtk_handle_irq(int ir
  	const struct mtk_reg_map *reg_map = eth->soc->reg_map;
  
  	if (mtk_r32(eth, reg_map->pdma.irq_mask) &
@@ -310,7 +310,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  			mtk_handle_irq_rx(irq, _eth);
  	}
  	if (mtk_r32(eth, reg_map->tx_irq_mask) & MTK_TX_DONE_INT) {
-@@ -3216,10 +3216,10 @@ static void mtk_poll_controller(struct n
+@@ -3228,10 +3228,10 @@ static void mtk_poll_controller(struct n
  	struct mtk_eth *eth = mac->hw;
  
  	mtk_tx_irq_disable(eth, MTK_TX_DONE_INT);
@@ -323,7 +323,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  }
  #endif
  
-@@ -3383,7 +3383,7 @@ static int mtk_open(struct net_device *d
+@@ -3395,7 +3395,7 @@ static int mtk_open(struct net_device *d
  		napi_enable(&eth->tx_napi);
  		napi_enable(&eth->rx_napi);
  		mtk_tx_irq_enable(eth, MTK_TX_DONE_INT);
@@ -332,7 +332,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		refcount_set(&eth->dma_refcnt, 1);
  	}
  	else
-@@ -3467,7 +3467,7 @@ static int mtk_stop(struct net_device *d
+@@ -3479,7 +3479,7 @@ static int mtk_stop(struct net_device *d
  	mtk_gdm_config(eth, MTK_GDMA_DROP_ALL);
  
  	mtk_tx_irq_disable(eth, MTK_TX_DONE_INT);
@@ -341,7 +341,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	napi_disable(&eth->tx_napi);
  	napi_disable(&eth->rx_napi);
  
-@@ -3943,9 +3943,9 @@ static int mtk_hw_init(struct mtk_eth *e
+@@ -3955,9 +3955,9 @@ static int mtk_hw_init(struct mtk_eth *e
  
  	/* FE int grouping */
  	mtk_w32(eth, MTK_TX_DONE_INT, reg_map->pdma.int_grp);
@@ -353,7 +353,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	mtk_w32(eth, 0x21021000, MTK_FE_INT_GRP);
  
  	if (mtk_is_netsys_v3_or_greater(eth)) {
-@@ -5037,11 +5037,15 @@ static const struct mtk_soc_data mt2701_
+@@ -5065,11 +5065,15 @@ static const struct mtk_soc_data mt2701_
  	.required_clks = MT7623_CLKS_BITMAP,
  	.required_pctl = true,
  	.version = 1,
@@ -374,7 +374,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
  	},
-@@ -5057,11 +5061,15 @@ static const struct mtk_soc_data mt7621_
+@@ -5085,11 +5089,15 @@ static const struct mtk_soc_data mt7621_
  	.offload_version = 1,
  	.hash_offset = 2,
  	.foe_entry_size = MTK_FOE_ENTRY_V1_SIZE,
@@ -395,7 +395,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
  	},
-@@ -5079,11 +5087,15 @@ static const struct mtk_soc_data mt7622_
+@@ -5107,11 +5115,15 @@ static const struct mtk_soc_data mt7622_
  	.hash_offset = 2,
  	.has_accounting = true,
  	.foe_entry_size = MTK_FOE_ENTRY_V1_SIZE,
@@ -416,7 +416,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
  	},
-@@ -5100,11 +5112,15 @@ static const struct mtk_soc_data mt7623_
+@@ -5128,11 +5140,15 @@ static const struct mtk_soc_data mt7623_
  	.hash_offset = 2,
  	.foe_entry_size = MTK_FOE_ENTRY_V1_SIZE,
  	.disable_pll_modes = true,
@@ -437,7 +437,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
  	},
-@@ -5119,11 +5135,15 @@ static const struct mtk_soc_data mt7629_
+@@ -5147,11 +5163,15 @@ static const struct mtk_soc_data mt7629_
  	.required_pctl = false,
  	.has_accounting = true,
  	.version = 1,
@@ -458,7 +458,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
  	},
-@@ -5141,11 +5161,15 @@ static const struct mtk_soc_data mt7981_
+@@ -5169,11 +5189,15 @@ static const struct mtk_soc_data mt7981_
  	.hash_offset = 4,
  	.has_accounting = true,
  	.foe_entry_size = MTK_FOE_ENTRY_V2_SIZE,
@@ -479,7 +479,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
  		.dma_len_offset = 8,
  	},
-@@ -5163,11 +5187,15 @@ static const struct mtk_soc_data mt7986_
+@@ -5191,11 +5215,15 @@ static const struct mtk_soc_data mt7986_
  	.hash_offset = 4,
  	.has_accounting = true,
  	.foe_entry_size = MTK_FOE_ENTRY_V2_SIZE,
@@ -500,7 +500,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
  		.dma_len_offset = 8,
  	},
-@@ -5185,11 +5213,15 @@ static const struct mtk_soc_data mt7988_
+@@ -5213,11 +5241,15 @@ static const struct mtk_soc_data mt7988_
  	.hash_offset = 4,
  	.has_accounting = true,
  	.foe_entry_size = MTK_FOE_ENTRY_V3_SIZE,
@@ -521,7 +521,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
  		.dma_len_offset = 8,
  	},
-@@ -5202,11 +5234,15 @@ static const struct mtk_soc_data rt5350_
+@@ -5230,11 +5262,15 @@ static const struct mtk_soc_data rt5350_
  	.required_clks = MT7628_CLKS_BITMAP,
  	.required_pctl = false,
  	.version = 1,
@@ -544,7 +544,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	},
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -327,8 +327,8 @@
+@@ -335,8 +335,8 @@
  /* QDMA descriptor txd3 */
  #define TX_DMA_OWNER_CPU	BIT(31)
  #define TX_DMA_LS0		BIT(30)
@@ -555,7 +555,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  #define TX_DMA_SWC		BIT(14)
  #define TX_DMA_PQID		GENMASK(3, 0)
  #define TX_DMA_ADDR64_MASK	GENMASK(3, 0)
-@@ -348,8 +348,8 @@
+@@ -356,8 +356,8 @@
  /* QDMA descriptor rxd2 */
  #define RX_DMA_DONE		BIT(31)
  #define RX_DMA_LSO		BIT(30)
@@ -566,7 +566,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  #define RX_DMA_VTAG		BIT(15)
  #define RX_DMA_ADDR64_MASK	GENMASK(3, 0)
  #if IS_ENABLED(CONFIG_64BIT)
-@@ -1153,10 +1153,9 @@ struct mtk_reg_map {
+@@ -1161,10 +1161,9 @@ struct mtk_reg_map {
   * @foe_entry_size		Foe table entry size.
   * @has_accounting		Bool indicating support for accounting of
   *				offloaded flows.
@@ -580,7 +580,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
   * @dma_max_len			Max DMA tx/rx buffer length.
   * @dma_len_offset		Tx/Rx DMA length field offset.
   */
-@@ -1174,13 +1173,17 @@ struct mtk_soc_data {
+@@ -1182,13 +1181,17 @@ struct mtk_soc_data {
  	bool		has_accounting;
  	bool		disable_pll_modes;
  	struct {
diff --git a/target/linux/generic/backport-6.6/751-02-STABLE-net-ethernet-mediatek-use-QDMA-instead-of-ADMAv2-on-.patch b/target/linux/generic/backport-6.6/751-02-v6.8-net-ethernet-mediatek-use-QDMA-instead-of-ADMAv2-on-.patch
similarity index 93%
rename from target/linux/generic/backport-6.6/751-02-STABLE-net-ethernet-mediatek-use-QDMA-instead-of-ADMAv2-on-.patch
rename to target/linux/generic/backport-6.6/751-02-v6.8-net-ethernet-mediatek-use-QDMA-instead-of-ADMAv2-on-.patch
index e71ff0923c8329..3531399b831558 100644
--- a/target/linux/generic/backport-6.6/751-02-STABLE-net-ethernet-mediatek-use-QDMA-instead-of-ADMAv2-on-.patch
+++ b/target/linux/generic/backport-6.6/751-02-v6.8-net-ethernet-mediatek-use-QDMA-instead-of-ADMAv2-on-.patch
@@ -76,7 +76,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  			reason = FIELD_GET(MTK_RXD5_PPE_CPU_REASON, trxd.rxd5);
  			hash = trxd.rxd5 & MTK_RXD5_FOE_ENTRY;
  			if (hash != MTK_RXD5_FOE_ENTRY)
-@@ -2686,7 +2686,7 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -2690,7 +2690,7 @@ static int mtk_rx_alloc(struct mtk_eth *
  
  		rxd->rxd3 = 0;
  		rxd->rxd4 = 0;
@@ -85,7 +85,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  			rxd->rxd5 = 0;
  			rxd->rxd6 = 0;
  			rxd->rxd7 = 0;
-@@ -3889,7 +3889,7 @@ static int mtk_hw_init(struct mtk_eth *e
+@@ -3901,7 +3901,7 @@ static int mtk_hw_init(struct mtk_eth *e
  	else
  		mtk_hw_reset(eth);
  
@@ -94,7 +94,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		/* Set FE to PDMAv2 if necessary */
  		val = mtk_r32(eth, MTK_FE_GLO_MISC);
  		mtk_w32(eth,  val | BIT(4), MTK_FE_GLO_MISC);
-@@ -5167,11 +5167,11 @@ static const struct mtk_soc_data mt7981_
+@@ -5195,11 +5195,11 @@ static const struct mtk_soc_data mt7981_
  		.dma_len_offset = 8,
  	},
  	.rx = {
@@ -110,7 +110,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	},
  };
  
-@@ -5193,11 +5193,11 @@ static const struct mtk_soc_data mt7986_
+@@ -5221,11 +5221,11 @@ static const struct mtk_soc_data mt7986_
  		.dma_len_offset = 8,
  	},
  	.rx = {
diff --git a/target/linux/generic/backport-6.6/751-04-v6.4-net-ethernet-mediatek-fix-ppe-flow-accounting-for-L2.patch b/target/linux/generic/backport-6.6/751-04-v6.4-net-ethernet-mediatek-fix-ppe-flow-accounting-for-L2.patch
index a93f80ac79df96..598362d252df22 100644
--- a/target/linux/generic/backport-6.6/751-04-v6.4-net-ethernet-mediatek-fix-ppe-flow-accounting-for-L2.patch
+++ b/target/linux/generic/backport-6.6/751-04-v6.4-net-ethernet-mediatek-fix-ppe-flow-accounting-for-L2.patch
@@ -309,7 +309,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		seq_printf(m, "%05x %s %7s", i,
 --- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
 +++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
-@@ -501,24 +501,21 @@ static int
+@@ -503,24 +503,21 @@ static int
  mtk_flow_offload_stats(struct mtk_eth *eth, struct flow_cls_offload *f)
  {
  	struct mtk_flow_entry *entry;
diff --git a/target/linux/generic/backport-6.6/752-03-v6.6-net-ethernet-mtk_eth_soc-rely-on-mtk_pse_port-defini.patch b/target/linux/generic/backport-6.6/752-03-v6.7-net-ethernet-mtk_eth_soc-rely-on-mtk_pse_port-defini.patch
similarity index 93%
rename from target/linux/generic/backport-6.6/752-03-v6.6-net-ethernet-mtk_eth_soc-rely-on-mtk_pse_port-defini.patch
rename to target/linux/generic/backport-6.6/752-03-v6.7-net-ethernet-mtk_eth_soc-rely-on-mtk_pse_port-defini.patch
index 0bf9dea24f0a16..e8b9bba1d8377f 100644
--- a/target/linux/generic/backport-6.6/752-03-v6.6-net-ethernet-mtk_eth_soc-rely-on-mtk_pse_port-defini.patch
+++ b/target/linux/generic/backport-6.6/752-03-v6.7-net-ethernet-mtk_eth_soc-rely-on-mtk_pse_port-defini.patch
@@ -14,7 +14,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
 +++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
-@@ -196,10 +196,10 @@ mtk_flow_set_output_device(struct mtk_et
+@@ -200,10 +200,10 @@ mtk_flow_set_output_device(struct mtk_et
  		if (mtk_is_netsys_v2_or_greater(eth)) {
  			switch (info.wdma_idx) {
  			case 0:
diff --git a/target/linux/generic/backport-6.6/752-06-v6.7-net-ethernet-mtk_wed-introduce-versioning-utility-ro.patch b/target/linux/generic/backport-6.6/752-06-v6.7-net-ethernet-mtk_wed-introduce-versioning-utility-ro.patch
index 323bc14c3ec20c..dc692b49687fc4 100644
--- a/target/linux/generic/backport-6.6/752-06-v6.7-net-ethernet-mtk_wed-introduce-versioning-utility-ro.patch
+++ b/target/linux/generic/backport-6.6/752-06-v6.7-net-ethernet-mtk_wed-introduce-versioning-utility-ro.patch
@@ -177,7 +177,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		return -EOPNOTSUPP;
  
  	switch (type) {
-@@ -1916,9 +1916,9 @@ void mtk_wed_add_hw(struct device_node *
+@@ -1915,9 +1915,9 @@ void mtk_wed_add_hw(struct device_node *
  	hw->wdma = wdma;
  	hw->index = index;
  	hw->irq = irq;
diff --git a/target/linux/generic/backport-6.6/752-13-v6.7-net-ethernet-mtk_wed-add-mtk_wed_soc_data-structure.patch b/target/linux/generic/backport-6.6/752-13-v6.7-net-ethernet-mtk_wed-add-mtk_wed_soc_data-structure.patch
index 6e2f8b19208afa..8ca733f3ed0203 100644
--- a/target/linux/generic/backport-6.6/752-13-v6.7-net-ethernet-mtk_wed-add-mtk_wed_soc_data-structure.patch
+++ b/target/linux/generic/backport-6.6/752-13-v6.7-net-ethernet-mtk_wed-add-mtk_wed_soc_data-structure.patch
@@ -142,7 +142,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		return -ENOMEM;
  
  	wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_BASE,
-@@ -1930,7 +1937,12 @@ void mtk_wed_add_hw(struct device_node *
+@@ -1929,7 +1936,12 @@ void mtk_wed_add_hw(struct device_node *
  	hw->irq = irq;
  	hw->version = eth->soc->version;
  
@@ -156,7 +156,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		hw->mirror = syscon_regmap_lookup_by_phandle(eth_np,
  				"mediatek,pcie-mirror");
  		hw->hifsys = syscon_regmap_lookup_by_phandle(eth_np,
-@@ -1944,6 +1956,8 @@ void mtk_wed_add_hw(struct device_node *
+@@ -1943,6 +1955,8 @@ void mtk_wed_add_hw(struct device_node *
  			regmap_write(hw->mirror, 0, 0);
  			regmap_write(hw->mirror, 4, 0);
  		}
diff --git a/target/linux/generic/backport-6.6/752-14-v6.7-net-ethernet-mtk_wed-introduce-WED-support-for-MT798.patch b/target/linux/generic/backport-6.6/752-14-v6.7-net-ethernet-mtk_wed-introduce-WED-support-for-MT798.patch
index f565b7631f1e37..aa6542a7d8b03b 100644
--- a/target/linux/generic/backport-6.6/752-14-v6.7-net-ethernet-mtk_wed-introduce-WED-support-for-MT798.patch
+++ b/target/linux/generic/backport-6.6/752-14-v6.7-net-ethernet-mtk_wed-introduce-WED-support-for-MT798.patch
@@ -23,7 +23,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	.pse_oq_sta		= 0x01a0,
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -1132,7 +1132,7 @@ struct mtk_reg_map {
+@@ -1140,7 +1140,7 @@ struct mtk_reg_map {
  	u32	gdm1_cnt;
  	u32	gdma_to_ppe;
  	u32	ppe_base;
@@ -34,7 +34,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  };
 --- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
 +++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
-@@ -201,6 +201,9 @@ mtk_flow_set_output_device(struct mtk_et
+@@ -205,6 +205,9 @@ mtk_flow_set_output_device(struct mtk_et
  			case 1:
  				pse_port = PSE_WDMA1_PORT;
  				break;
@@ -759,7 +759,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  
  	val = wed_r32(dev, MTK_WED_EXT_INT_STATUS);
  	wed_w32(dev, MTK_WED_EXT_INT_STATUS, val);
-@@ -1941,6 +2132,9 @@ void mtk_wed_add_hw(struct device_node *
+@@ -1940,6 +2131,9 @@ void mtk_wed_add_hw(struct device_node *
  	case 2:
  		hw->soc = &mt7986_data;
  		break;
diff --git a/target/linux/generic/backport-6.6/752-16-v6.7-net-ethernet-mtk_wed-introduce-partial-AMSDU-offload.patch b/target/linux/generic/backport-6.6/752-16-v6.7-net-ethernet-mtk_wed-introduce-partial-AMSDU-offload.patch
index 4e72ea128ab9b6..fc4da123dfaf73 100644
--- a/target/linux/generic/backport-6.6/752-16-v6.7-net-ethernet-mtk_wed-introduce-partial-AMSDU-offload.patch
+++ b/target/linux/generic/backport-6.6/752-16-v6.7-net-ethernet-mtk_wed-introduce-partial-AMSDU-offload.patch
@@ -77,7 +77,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  int mtk_foe_entry_commit(struct mtk_ppe *ppe, struct mtk_flow_entry *entry);
 --- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
 +++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
-@@ -111,6 +111,7 @@ mtk_flow_get_wdma_info(struct net_device
+@@ -115,6 +115,7 @@ mtk_flow_get_wdma_info(struct net_device
  	info->queue = path->mtk_wdma.queue;
  	info->bss = path->mtk_wdma.bss;
  	info->wcid = path->mtk_wdma.wcid;
@@ -85,7 +85,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  
  	return 0;
  }
-@@ -192,7 +193,7 @@ mtk_flow_set_output_device(struct mtk_et
+@@ -196,7 +197,7 @@ mtk_flow_set_output_device(struct mtk_et
  
  	if (mtk_flow_get_wdma_info(dev, dest_mac, &info) == 0) {
  		mtk_foe_entry_set_wdma(eth, foe, info.wdma_idx, info.queue,
diff --git a/target/linux/generic/backport-6.6/752-25-v6.10-net-ethernet-mtk_eth_soc-handle-dma-buffer-size-soc-.patch b/target/linux/generic/backport-6.6/752-25-v6.10-net-ethernet-mtk_eth_soc-handle-dma-buffer-size-soc-.patch
index 3d72a5f1dacfa8..0df5a680b3605f 100644
--- a/target/linux/generic/backport-6.6/752-25-v6.10-net-ethernet-mtk_eth_soc-handle-dma-buffer-size-soc-.patch
+++ b/target/linux/generic/backport-6.6/752-25-v6.10-net-ethernet-mtk_eth_soc-handle-dma-buffer-size-soc-.patch
@@ -123,7 +123,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		}
  	}
  
-@@ -2457,7 +2463,7 @@ static int mtk_tx_alloc(struct mtk_eth *
+@@ -2461,7 +2467,7 @@ static int mtk_tx_alloc(struct mtk_eth *
  	if (MTK_HAS_CAPS(soc->caps, MTK_QDMA))
  		ring_size = MTK_QDMA_RING_SIZE;
  	else
@@ -132,7 +132,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	ring->buf = kcalloc(ring_size, sizeof(*ring->buf),
  			       GFP_KERNEL);
-@@ -2465,8 +2471,8 @@ static int mtk_tx_alloc(struct mtk_eth *
+@@ -2469,8 +2475,8 @@ static int mtk_tx_alloc(struct mtk_eth *
  		goto no_tx_mem;
  
  	if (MTK_HAS_CAPS(soc->caps, MTK_SRAM)) {
@@ -143,7 +143,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	} else {
  		ring->dma = dma_alloc_coherent(eth->dma_dev, ring_size * sz,
  					       &ring->phys, GFP_KERNEL);
-@@ -2588,6 +2594,7 @@ static void mtk_tx_clean(struct mtk_eth
+@@ -2592,6 +2598,7 @@ static void mtk_tx_clean(struct mtk_eth
  static int mtk_rx_alloc(struct mtk_eth *eth, int ring_no, int rx_flag)
  {
  	const struct mtk_reg_map *reg_map = eth->soc->reg_map;
@@ -151,7 +151,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	struct mtk_rx_ring *ring;
  	int rx_data_len, rx_dma_size, tx_ring_size;
  	int i;
-@@ -2595,7 +2602,7 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -2599,7 +2606,7 @@ static int mtk_rx_alloc(struct mtk_eth *
  	if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA))
  		tx_ring_size = MTK_QDMA_RING_SIZE;
  	else
@@ -160,7 +160,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	if (rx_flag == MTK_RX_FLAGS_QDMA) {
  		if (ring_no)
-@@ -2610,7 +2617,7 @@ static int mtk_rx_alloc(struct mtk_eth *
+@@ -2614,7 +2621,7 @@ static int mtk_rx_alloc(struct mtk_eth *
  		rx_dma_size = MTK_HW_LRO_DMA_SIZE;
  	} else {
  		rx_data_len = ETH_DATA_LEN;
@@ -169,7 +169,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	}
  
  	ring->frag_size = mtk_max_frag_size(rx_data_len);
-@@ -3139,7 +3146,10 @@ static void mtk_dma_free(struct mtk_eth
+@@ -3151,7 +3158,10 @@ static void mtk_dma_free(struct mtk_eth
  			mtk_rx_clean(eth, &eth->rx_ring[i], false);
  	}
  
@@ -181,7 +181,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  }
  
  static bool mtk_hw_reset_check(struct mtk_eth *eth)
-@@ -5045,11 +5055,14 @@ static const struct mtk_soc_data mt2701_
+@@ -5073,11 +5083,14 @@ static const struct mtk_soc_data mt2701_
  		.desc_size = sizeof(struct mtk_tx_dma),
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
@@ -196,7 +196,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
  	},
-@@ -5069,11 +5082,14 @@ static const struct mtk_soc_data mt7621_
+@@ -5097,11 +5110,14 @@ static const struct mtk_soc_data mt7621_
  		.desc_size = sizeof(struct mtk_tx_dma),
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
@@ -211,7 +211,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
  	},
-@@ -5095,11 +5111,14 @@ static const struct mtk_soc_data mt7622_
+@@ -5123,11 +5139,14 @@ static const struct mtk_soc_data mt7622_
  		.desc_size = sizeof(struct mtk_tx_dma),
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
@@ -226,7 +226,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
  	},
-@@ -5120,11 +5139,14 @@ static const struct mtk_soc_data mt7623_
+@@ -5148,11 +5167,14 @@ static const struct mtk_soc_data mt7623_
  		.desc_size = sizeof(struct mtk_tx_dma),
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
@@ -241,7 +241,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
  	},
-@@ -5143,11 +5165,14 @@ static const struct mtk_soc_data mt7629_
+@@ -5171,11 +5193,14 @@ static const struct mtk_soc_data mt7629_
  		.desc_size = sizeof(struct mtk_tx_dma),
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
@@ -256,7 +256,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
  	},
-@@ -5169,6 +5194,8 @@ static const struct mtk_soc_data mt7981_
+@@ -5197,6 +5222,8 @@ static const struct mtk_soc_data mt7981_
  		.desc_size = sizeof(struct mtk_tx_dma_v2),
  		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
  		.dma_len_offset = 8,
@@ -265,7 +265,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	},
  	.rx = {
  		.desc_size = sizeof(struct mtk_rx_dma),
-@@ -5176,6 +5203,7 @@ static const struct mtk_soc_data mt7981_
+@@ -5204,6 +5231,7 @@ static const struct mtk_soc_data mt7981_
  		.dma_l4_valid = RX_DMA_L4_VALID_V2,
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
@@ -273,7 +273,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	},
  };
  
-@@ -5195,6 +5223,8 @@ static const struct mtk_soc_data mt7986_
+@@ -5223,6 +5251,8 @@ static const struct mtk_soc_data mt7986_
  		.desc_size = sizeof(struct mtk_tx_dma_v2),
  		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
  		.dma_len_offset = 8,
@@ -282,7 +282,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	},
  	.rx = {
  		.desc_size = sizeof(struct mtk_rx_dma),
-@@ -5202,6 +5232,7 @@ static const struct mtk_soc_data mt7986_
+@@ -5230,6 +5260,7 @@ static const struct mtk_soc_data mt7986_
  		.dma_l4_valid = RX_DMA_L4_VALID_V2,
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
@@ -290,7 +290,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	},
  };
  
-@@ -5221,6 +5252,8 @@ static const struct mtk_soc_data mt7988_
+@@ -5249,6 +5280,8 @@ static const struct mtk_soc_data mt7988_
  		.desc_size = sizeof(struct mtk_tx_dma_v2),
  		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
  		.dma_len_offset = 8,
@@ -299,7 +299,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	},
  	.rx = {
  		.desc_size = sizeof(struct mtk_rx_dma_v2),
-@@ -5228,6 +5261,7 @@ static const struct mtk_soc_data mt7988_
+@@ -5256,6 +5289,7 @@ static const struct mtk_soc_data mt7988_
  		.dma_l4_valid = RX_DMA_L4_VALID_V2,
  		.dma_max_len = MTK_TX_DMA_BUF_LEN_V2,
  		.dma_len_offset = 8,
@@ -307,7 +307,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	},
  };
  
-@@ -5242,6 +5276,7 @@ static const struct mtk_soc_data rt5350_
+@@ -5270,6 +5304,7 @@ static const struct mtk_soc_data rt5350_
  		.desc_size = sizeof(struct mtk_tx_dma),
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
@@ -315,7 +315,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	},
  	.rx = {
  		.desc_size = sizeof(struct mtk_rx_dma),
-@@ -5249,6 +5284,7 @@ static const struct mtk_soc_data rt5350_
+@@ -5277,6 +5312,7 @@ static const struct mtk_soc_data rt5350_
  		.dma_l4_valid = RX_DMA_L4_VALID_PDMA,
  		.dma_max_len = MTK_TX_DMA_BUF_LEN,
  		.dma_len_offset = 16,
@@ -336,7 +336,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  #define MTK_RX_ETH_HLEN		(ETH_HLEN + ETH_FCS_LEN)
  #define MTK_RX_HLEN		(NET_SKB_PAD + MTK_RX_ETH_HLEN + NET_IP_ALIGN)
  #define MTK_DMA_DUMMY_DESC	0xffffffff
-@@ -1176,6 +1178,8 @@ struct mtk_soc_data {
+@@ -1184,6 +1186,8 @@ struct mtk_soc_data {
  		u32	desc_size;
  		u32	dma_max_len;
  		u32	dma_len_offset;
@@ -345,7 +345,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	} tx;
  	struct {
  		u32	desc_size;
-@@ -1183,6 +1187,7 @@ struct mtk_soc_data {
+@@ -1191,6 +1195,7 @@ struct mtk_soc_data {
  		u32	dma_l4_valid;
  		u32	dma_max_len;
  		u32	dma_len_offset;
@@ -353,7 +353,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	} rx;
  };
  
-@@ -1264,7 +1269,7 @@ struct mtk_eth {
+@@ -1272,7 +1277,7 @@ struct mtk_eth {
  	struct napi_struct		rx_napi;
  	void				*scratch_ring;
  	dma_addr_t			phy_scratch_ring;
diff --git a/target/linux/generic/backport-6.6/752-26-v6.10-net-ethernet-mtk_eth_soc-ppe-add-support-for-multipl.patch b/target/linux/generic/backport-6.6/752-26-v6.10-net-ethernet-mtk_eth_soc-ppe-add-support-for-multipl.patch
index 07e7e863406fea..47478802f9dcde 100644
--- a/target/linux/generic/backport-6.6/752-26-v6.10-net-ethernet-mtk_eth_soc-ppe-add-support-for-multipl.patch
+++ b/target/linux/generic/backport-6.6/752-26-v6.10-net-ethernet-mtk_eth_soc-ppe-add-support-for-multipl.patch
@@ -85,7 +85,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  
  		skb_record_rx_queue(skb, 0);
  		napi_gro_receive(napi, skb);
-@@ -3276,37 +3287,27 @@ static int mtk_start_dma(struct mtk_eth
+@@ -3288,37 +3299,27 @@ static int mtk_start_dma(struct mtk_eth
  	return 0;
  }
  
@@ -134,7 +134,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  }
  
  
-@@ -3366,7 +3367,10 @@ static int mtk_open(struct net_device *d
+@@ -3378,7 +3379,10 @@ static int mtk_open(struct net_device *d
  {
  	struct mtk_mac *mac = netdev_priv(dev);
  	struct mtk_eth *eth = mac->hw;
@@ -146,7 +146,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  
  	err = phylink_of_phy_connect(mac->phylink, mac->of_node, 0);
  	if (err) {
-@@ -3390,18 +3394,38 @@ static int mtk_open(struct net_device *d
+@@ -3402,18 +3406,38 @@ static int mtk_open(struct net_device *d
  		for (i = 0; i < ARRAY_SIZE(eth->ppe); i++)
  			mtk_ppe_start(eth->ppe[i]);
  
@@ -190,7 +190,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  
  	phylink_start(mac->phylink);
  	netif_tx_start_all_queues(dev);
-@@ -3478,7 +3502,8 @@ static int mtk_stop(struct net_device *d
+@@ -3490,7 +3514,8 @@ static int mtk_stop(struct net_device *d
  	if (!refcount_dec_and_test(&eth->dma_refcnt))
  		return 0;
  
@@ -200,7 +200,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  
  	mtk_tx_irq_disable(eth, MTK_TX_DONE_INT);
  	mtk_rx_irq_disable(eth, eth->soc->rx.irq_done_mask);
-@@ -4957,23 +4982,24 @@ static int mtk_probe(struct platform_dev
+@@ -4985,23 +5010,24 @@ static int mtk_probe(struct platform_dev
  	}
  
  	if (eth->soc->offload_version) {
@@ -233,7 +233,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	}
  
  	for (i = 0; i < MTK_MAX_DEVS; i++) {
-@@ -5076,6 +5102,7 @@ static const struct mtk_soc_data mt7621_
+@@ -5104,6 +5130,7 @@ static const struct mtk_soc_data mt7621_
  	.required_pctl = false,
  	.version = 1,
  	.offload_version = 1,
@@ -241,7 +241,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	.hash_offset = 2,
  	.foe_entry_size = MTK_FOE_ENTRY_V1_SIZE,
  	.tx = {
-@@ -5104,6 +5131,7 @@ static const struct mtk_soc_data mt7622_
+@@ -5132,6 +5159,7 @@ static const struct mtk_soc_data mt7622_
  	.required_pctl = false,
  	.version = 1,
  	.offload_version = 2,
@@ -249,7 +249,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	.hash_offset = 2,
  	.has_accounting = true,
  	.foe_entry_size = MTK_FOE_ENTRY_V1_SIZE,
-@@ -5132,6 +5160,7 @@ static const struct mtk_soc_data mt7623_
+@@ -5160,6 +5188,7 @@ static const struct mtk_soc_data mt7623_
  	.required_pctl = true,
  	.version = 1,
  	.offload_version = 1,
@@ -257,7 +257,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	.hash_offset = 2,
  	.foe_entry_size = MTK_FOE_ENTRY_V1_SIZE,
  	.disable_pll_modes = true,
-@@ -5187,6 +5216,7 @@ static const struct mtk_soc_data mt7981_
+@@ -5215,6 +5244,7 @@ static const struct mtk_soc_data mt7981_
  	.required_pctl = false,
  	.version = 2,
  	.offload_version = 2,
@@ -265,7 +265,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	.hash_offset = 4,
  	.has_accounting = true,
  	.foe_entry_size = MTK_FOE_ENTRY_V2_SIZE,
-@@ -5216,6 +5246,7 @@ static const struct mtk_soc_data mt7986_
+@@ -5244,6 +5274,7 @@ static const struct mtk_soc_data mt7986_
  	.required_pctl = false,
  	.version = 2,
  	.offload_version = 2,
@@ -273,7 +273,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	.hash_offset = 4,
  	.has_accounting = true,
  	.foe_entry_size = MTK_FOE_ENTRY_V2_SIZE,
-@@ -5245,6 +5276,7 @@ static const struct mtk_soc_data mt7988_
+@@ -5273,6 +5304,7 @@ static const struct mtk_soc_data mt7988_
  	.required_pctl = false,
  	.version = 3,
  	.offload_version = 2,
@@ -283,7 +283,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	.foe_entry_size = MTK_FOE_ENTRY_V3_SIZE,
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -1132,7 +1132,7 @@ struct mtk_reg_map {
+@@ -1140,7 +1140,7 @@ struct mtk_reg_map {
  		u32	tx_sch_rate;	/* tx scheduler rate control registers */
  	} qdma;
  	u32	gdm1_cnt;
@@ -292,7 +292,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	u32	ppe_base;
  	u32	wdma_base[3];
  	u32	pse_iq_sta;
-@@ -1170,6 +1170,7 @@ struct mtk_soc_data {
+@@ -1178,6 +1178,7 @@ struct mtk_soc_data {
  	u8		offload_version;
  	u8		hash_offset;
  	u8		version;
@@ -300,7 +300,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	u16		foe_entry_size;
  	netdev_features_t hw_features;
  	bool		has_accounting;
-@@ -1294,7 +1295,7 @@ struct mtk_eth {
+@@ -1302,7 +1303,7 @@ struct mtk_eth {
  
  	struct metadata_dst		*dsa_meta[MTK_MAX_DSA_PORTS];
  
@@ -309,7 +309,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	struct rhashtable		flow_table;
  
  	struct bpf_prog			__rcu *prog;
-@@ -1319,6 +1320,7 @@ struct mtk_eth {
+@@ -1327,6 +1328,7 @@ struct mtk_eth {
  struct mtk_mac {
  	int				id;
  	phy_interface_t			interface;
@@ -317,7 +317,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	int				speed;
  	struct device_node		*of_node;
  	struct phylink			*phylink;
-@@ -1440,7 +1442,7 @@ int mtk_gmac_sgmii_path_setup(struct mtk
+@@ -1448,7 +1450,7 @@ int mtk_gmac_sgmii_path_setup(struct mtk
  int mtk_gmac_gephy_path_setup(struct mtk_eth *eth, int mac_id);
  int mtk_gmac_rgmii_path_setup(struct mtk_eth *eth, int mac_id);
  
@@ -328,7 +328,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  int mtk_flow_offload_cmd(struct mtk_eth *eth, struct flow_cls_offload *cls,
 --- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
 +++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
-@@ -245,10 +245,10 @@ mtk_flow_offload_replace(struct mtk_eth
+@@ -249,10 +249,10 @@ mtk_flow_offload_replace(struct mtk_eth
  			 int ppe_index)
  {
  	struct flow_rule *rule = flow_cls_offload_flow_rule(f);
@@ -340,7 +340,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	struct mtk_flow_entry *entry;
  	int offload_type = 0;
  	int wed_index = -1;
-@@ -264,6 +264,17 @@ mtk_flow_offload_replace(struct mtk_eth
+@@ -268,6 +268,17 @@ mtk_flow_offload_replace(struct mtk_eth
  		struct flow_match_meta match;
  
  		flow_rule_match_meta(rule, &match);
@@ -358,7 +358,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	} else {
  		return -EOPNOTSUPP;
  	}
-@@ -630,7 +641,9 @@ int mtk_eth_setup_tc(struct net_device *
+@@ -632,7 +643,9 @@ int mtk_eth_setup_tc(struct net_device *
  	}
  }
  
diff --git a/target/linux/generic/backport-6.6/752-27-v6.10-net-ethernet-mtk_eth_soc-ppe-prevent-ppe-update-for-.patch b/target/linux/generic/backport-6.6/752-27-v6.10-net-ethernet-mtk_eth_soc-ppe-prevent-ppe-update-for-.patch
index dbf574d80ac274..0ef6cd88b1a80a 100644
--- a/target/linux/generic/backport-6.6/752-27-v6.10-net-ethernet-mtk_eth_soc-ppe-prevent-ppe-update-for-.patch
+++ b/target/linux/generic/backport-6.6/752-27-v6.10-net-ethernet-mtk_eth_soc-ppe-prevent-ppe-update-for-.patch
@@ -19,7 +19,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
 +++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
-@@ -266,7 +266,7 @@ mtk_flow_offload_replace(struct mtk_eth
+@@ -270,7 +270,7 @@ mtk_flow_offload_replace(struct mtk_eth
  		flow_rule_match_meta(rule, &match);
  		if (mtk_is_netsys_v2_or_greater(eth)) {
  			idev = __dev_get_by_index(&init_net, match.key->ingress_ifindex);
diff --git a/target/linux/generic/backport-6.6/752-28-v6.10-net-ethernet-mediatek-Allow-gaps-in-MAC-allocation.patch b/target/linux/generic/backport-6.6/752-28-v6.10-net-ethernet-mediatek-Allow-gaps-in-MAC-allocation.patch
index b62586b992f6c9..27ad9dca2cb161 100644
--- a/target/linux/generic/backport-6.6/752-28-v6.10-net-ethernet-mediatek-Allow-gaps-in-MAC-allocation.patch
+++ b/target/linux/generic/backport-6.6/752-28-v6.10-net-ethernet-mediatek-Allow-gaps-in-MAC-allocation.patch
@@ -21,7 +21,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -3396,7 +3396,7 @@ static int mtk_open(struct net_device *d
+@@ -3408,7 +3408,7 @@ static int mtk_open(struct net_device *d
  
  		for (i = 0; i < MTK_MAX_DEVS; i++) {
  			if (!eth->netdev[i])
diff --git a/target/linux/generic/backport-6.6/752-30-v6.10-net-ethernet-mtk_eth_soc-implement-.-get-set-_pausep.patch b/target/linux/generic/backport-6.6/752-30-v6.10-net-ethernet-mtk_eth_soc-implement-.-get-set-_pausep.patch
index 09d7054965b224..b16910e18eba2b 100644
--- a/target/linux/generic/backport-6.6/752-30-v6.10-net-ethernet-mtk_eth_soc-implement-.-get-set-_pausep.patch
+++ b/target/linux/generic/backport-6.6/752-30-v6.10-net-ethernet-mtk_eth_soc-implement-.-get-set-_pausep.patch
@@ -20,7 +20,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -4462,6 +4462,20 @@ static int mtk_set_rxnfc(struct net_devi
+@@ -4490,6 +4490,20 @@ static int mtk_set_rxnfc(struct net_devi
  	return ret;
  }
  
@@ -41,7 +41,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  static u16 mtk_select_queue(struct net_device *dev, struct sk_buff *skb,
  			    struct net_device *sb_dev)
  {
-@@ -4490,8 +4504,10 @@ static const struct ethtool_ops mtk_etht
+@@ -4518,8 +4532,10 @@ static const struct ethtool_ops mtk_etht
  	.get_strings		= mtk_get_strings,
  	.get_sset_count		= mtk_get_sset_count,
  	.get_ethtool_stats	= mtk_get_ethtool_stats,
diff --git a/target/linux/generic/backport-6.6/764-v6.10-net-dsa-allow-DSA-switch-drivers-to-provide-their-ow.patch b/target/linux/generic/backport-6.6/764-v6.10-net-dsa-allow-DSA-switch-drivers-to-provide-their-ow.patch
index 7c9ab16d4af989..b86935f9af7b45 100644
--- a/target/linux/generic/backport-6.6/764-v6.10-net-dsa-allow-DSA-switch-drivers-to-provide-their-ow.patch
+++ b/target/linux/generic/backport-6.6/764-v6.10-net-dsa-allow-DSA-switch-drivers-to-provide-their-ow.patch
@@ -38,7 +38,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	u32			phys_mii_mask;
 --- a/net/dsa/dsa.c
 +++ b/net/dsa/dsa.c
-@@ -1510,6 +1510,17 @@ static int dsa_switch_probe(struct dsa_s
+@@ -1549,6 +1549,17 @@ static int dsa_switch_probe(struct dsa_s
  	if (!ds->num_ports)
  		return -EINVAL;
  
diff --git a/target/linux/generic/backport-6.6/770-net-introduce-napi_is_scheduled-helper.patch b/target/linux/generic/backport-6.6/770-v6.7-net-introduce-napi_is_scheduled-helper.patch
similarity index 96%
rename from target/linux/generic/backport-6.6/770-net-introduce-napi_is_scheduled-helper.patch
rename to target/linux/generic/backport-6.6/770-v6.7-net-introduce-napi_is_scheduled-helper.patch
index 838bd03c8c55ef..b9bf885d9d51bd 100644
--- a/target/linux/generic/backport-6.6/770-net-introduce-napi_is_scheduled-helper.patch
+++ b/target/linux/generic/backport-6.6/770-v6.7-net-introduce-napi_is_scheduled-helper.patch
@@ -42,7 +42,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
   *	@adap: the adapter
 --- a/drivers/net/wireless/realtek/rtw89/core.c
 +++ b/drivers/net/wireless/realtek/rtw89/core.c
-@@ -1744,7 +1744,7 @@ static void rtw89_core_rx_to_mac80211(st
+@@ -1749,7 +1749,7 @@ static void rtw89_core_rx_to_mac80211(st
  	struct napi_struct *napi = &rtwdev->napi;
  
  	/* In low power mode, napi isn't scheduled. Receive it to netif. */
@@ -85,7 +85,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  /**
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -6606,7 +6606,7 @@ static int __napi_poll(struct napi_struc
+@@ -6655,7 +6655,7 @@ static int __napi_poll(struct napi_struc
  	 * accidentally calling ->poll() when NAPI is not scheduled.
  	 */
  	work = 0;
diff --git a/target/linux/generic/backport-6.6/771-v6.7-01-net-stmmac-improve-TX-timer-arm-logic.patch b/target/linux/generic/backport-6.6/771-v6.7-01-net-stmmac-improve-TX-timer-arm-logic.patch
index a7da409aeb7809..cca517644a8034 100644
--- a/target/linux/generic/backport-6.6/771-v6.7-01-net-stmmac-improve-TX-timer-arm-logic.patch
+++ b/target/linux/generic/backport-6.6/771-v6.7-01-net-stmmac-improve-TX-timer-arm-logic.patch
@@ -46,7 +46,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
 +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
-@@ -2988,13 +2988,25 @@ static void stmmac_tx_timer_arm(struct s
+@@ -2994,13 +2994,25 @@ static void stmmac_tx_timer_arm(struct s
  {
  	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
  	u32 tx_coal_timer = priv->tx_coal_timer[queue];
diff --git a/target/linux/generic/backport-6.6/771-v6.7-02-net-stmmac-move-TX-timer-arm-after-DMA-enable.patch b/target/linux/generic/backport-6.6/771-v6.7-02-net-stmmac-move-TX-timer-arm-after-DMA-enable.patch
index 60dfe4c0357aaa..00829a15dfaf5a 100644
--- a/target/linux/generic/backport-6.6/771-v6.7-02-net-stmmac-move-TX-timer-arm-after-DMA-enable.patch
+++ b/target/linux/generic/backport-6.6/771-v6.7-02-net-stmmac-move-TX-timer-arm-after-DMA-enable.patch
@@ -18,7 +18,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
 +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
-@@ -2536,9 +2536,13 @@ static void stmmac_bump_dma_threshold(st
+@@ -2542,9 +2542,13 @@ static void stmmac_bump_dma_threshold(st
   * @priv: driver private structure
   * @budget: napi budget limiting this functions packet handling
   * @queue: TX queue index
@@ -33,7 +33,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  {
  	struct stmmac_tx_queue *tx_q = &priv->dma_conf.tx_queue[queue];
  	struct stmmac_txq_stats *txq_stats = &priv->xstats.txq_stats[queue];
-@@ -2698,7 +2702,7 @@ static int stmmac_tx_clean(struct stmmac
+@@ -2704,7 +2708,7 @@ static int stmmac_tx_clean(struct stmmac
  
  	/* We still have pending packets, let's call for a new scheduling */
  	if (tx_q->dirty_tx != tx_q->cur_tx)
@@ -42,7 +42,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  
  	u64_stats_update_begin(&txq_stats->napi_syncp);
  	u64_stats_add(&txq_stats->napi.tx_packets, tx_packets);
-@@ -5590,6 +5594,7 @@ static int stmmac_napi_poll_tx(struct na
+@@ -5611,6 +5615,7 @@ static int stmmac_napi_poll_tx(struct na
  		container_of(napi, struct stmmac_channel, tx_napi);
  	struct stmmac_priv *priv = ch->priv_data;
  	struct stmmac_txq_stats *txq_stats;
@@ -50,7 +50,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	u32 chan = ch->index;
  	int work_done;
  
-@@ -5598,7 +5603,7 @@ static int stmmac_napi_poll_tx(struct na
+@@ -5619,7 +5624,7 @@ static int stmmac_napi_poll_tx(struct na
  	u64_stats_inc(&txq_stats->napi.poll);
  	u64_stats_update_end(&txq_stats->napi_syncp);
  
@@ -59,7 +59,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	work_done = min(work_done, budget);
  
  	if (work_done < budget && napi_complete_done(napi, work_done)) {
-@@ -5609,6 +5614,10 @@ static int stmmac_napi_poll_tx(struct na
+@@ -5630,6 +5635,10 @@ static int stmmac_napi_poll_tx(struct na
  		spin_unlock_irqrestore(&ch->lock, flags);
  	}
  
@@ -70,7 +70,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	return work_done;
  }
  
-@@ -5617,6 +5626,7 @@ static int stmmac_napi_poll_rxtx(struct
+@@ -5638,6 +5647,7 @@ static int stmmac_napi_poll_rxtx(struct
  	struct stmmac_channel *ch =
  		container_of(napi, struct stmmac_channel, rxtx_napi);
  	struct stmmac_priv *priv = ch->priv_data;
@@ -78,7 +78,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	int rx_done, tx_done, rxtx_done;
  	struct stmmac_rxq_stats *rxq_stats;
  	struct stmmac_txq_stats *txq_stats;
-@@ -5632,7 +5642,7 @@ static int stmmac_napi_poll_rxtx(struct
+@@ -5653,7 +5663,7 @@ static int stmmac_napi_poll_rxtx(struct
  	u64_stats_inc(&txq_stats->napi.poll);
  	u64_stats_update_end(&txq_stats->napi_syncp);
  
@@ -87,7 +87,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	tx_done = min(tx_done, budget);
  
  	rx_done = stmmac_rx_zc(priv, budget, chan);
-@@ -5657,6 +5667,10 @@ static int stmmac_napi_poll_rxtx(struct
+@@ -5678,6 +5688,10 @@ static int stmmac_napi_poll_rxtx(struct
  		spin_unlock_irqrestore(&ch->lock, flags);
  	}
  
diff --git a/target/linux/generic/backport-6.6/777-netfilter-xtables-fix-typo-causing-some-targets-to-not-load-on-IPv6.patch b/target/linux/generic/backport-6.6/777-netfilter-xtables-fix-typo-causing-some-targets-to-not-load-on-IPv6.patch
deleted file mode 100644
index d29c7d463dd65e..00000000000000
--- a/target/linux/generic/backport-6.6/777-netfilter-xtables-fix-typo-causing-some-targets-to-not-load-on-IPv6.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-Subject: [PATCH v2] netfilter: xtables: fix typo causing some targets to not load on IPv6
-Date: Sat, 19 Oct 2024 08:05:07 +0300	[thread overview]
-Message-ID: <20241019-xtables-typos-v2-1-6b8b1735dc8e@0upti.me> (raw)
-
-These were added with the wrong family in 4cdc55e, which seems
-to just have been a typo, but now ip6tables rules with --set-mark
-don't work anymore, which is pretty bad.
-
-Fixes: 0bfcb7b71e73 ("netfilter: xtables: avoid NFPROTO_UNSPEC where needed")
-Reviewed-by: Phil Sutter <phil@nwl.cc>
-Signed-off-by: Ilya Katsnelson <me@0upti.me>
----
-Changes in v2:
-- Fixed a typo in the commit message (that's karma).
-- Replaced a reference to backport commit.
-- Link to v1: https://lore.kernel.org/r/20241018-xtables-typos-v1-1-02a51789c0ec@0upti.me
----
- net/netfilter/xt_NFLOG.c | 2 +-
- net/netfilter/xt_mark.c  | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
---- a/net/netfilter/xt_NFLOG.c
-+++ b/net/netfilter/xt_NFLOG.c
-@@ -79,7 +79,7 @@ static struct xt_target nflog_tg_reg[] _
- 	{
- 		.name       = "NFLOG",
- 		.revision   = 0,
--		.family     = NFPROTO_IPV4,
-+		.family     = NFPROTO_IPV6,
- 		.checkentry = nflog_tg_check,
- 		.destroy    = nflog_tg_destroy,
- 		.target     = nflog_tg,
---- a/net/netfilter/xt_mark.c
-+++ b/net/netfilter/xt_mark.c
-@@ -62,7 +62,7 @@ static struct xt_target mark_tg_reg[] __
- 	{
- 		.name           = "MARK",
- 		.revision       = 2,
--		.family         = NFPROTO_IPV4,
-+		.family         = NFPROTO_IPV6,
- 		.target         = mark_tg,
- 		.targetsize     = sizeof(struct xt_mark_tginfo2),
- 		.me             = THIS_MODULE,
diff --git a/target/linux/generic/backport-6.6/780-04-v6.8-r8169-improve-handling-task-scheduling.patch b/target/linux/generic/backport-6.6/780-04-v6.8-r8169-improve-handling-task-scheduling.patch
index f020284cc80a43..36ac67375a23b4 100644
--- a/target/linux/generic/backport-6.6/780-04-v6.8-r8169-improve-handling-task-scheduling.patch
+++ b/target/linux/generic/backport-6.6/780-04-v6.8-r8169-improve-handling-task-scheduling.patch
@@ -29,7 +29,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	set_bit(flag, tp->wk.flags);
  	schedule_work(&tp->wk.work);
  }
-@@ -4518,8 +4521,7 @@ static void rtl_task(struct work_struct
+@@ -4526,8 +4529,7 @@ static void rtl_task(struct work_struct
  
  	rtnl_lock();
  
diff --git a/target/linux/generic/backport-6.6/780-05-v6.8-r8169-add-support-for-LED-s-on-RTL8168-RTL8101.patch b/target/linux/generic/backport-6.6/780-05-v6.8-r8169-add-support-for-LED-s-on-RTL8168-RTL8101.patch
index 95245b9a54ce60..8bb543b9d6d1c1 100644
--- a/target/linux/generic/backport-6.6/780-05-v6.8-r8169-add-support-for-LED-s-on-RTL8168-RTL8101.patch
+++ b/target/linux/generic/backport-6.6/780-05-v6.8-r8169-add-support-for-LED-s-on-RTL8168-RTL8101.patch
@@ -296,7 +296,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  static void r8168fp_adjust_ocp_cmd(struct rtl8169_private *tp, u32 *cmd, int type)
  {
  	/* based on RTL8168FP_OOBMAC_BASE in vendor driver */
-@@ -5195,6 +5253,7 @@ static int rtl_init_one(struct pci_dev *
+@@ -5204,6 +5262,7 @@ static int rtl_init_one(struct pci_dev *
  	raw_spin_lock_init(&tp->cfg9346_usage_lock);
  	raw_spin_lock_init(&tp->config25_lock);
  	raw_spin_lock_init(&tp->mac_ocp_lock);
@@ -304,7 +304,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  
  	dev->tstats = devm_netdev_alloc_pcpu_stats(&pdev->dev,
  						   struct pcpu_sw_netstats);
-@@ -5351,6 +5410,12 @@ static int rtl_init_one(struct pci_dev *
+@@ -5360,6 +5419,12 @@ static int rtl_init_one(struct pci_dev *
  	if (rc)
  		return rc;
  
diff --git a/target/linux/generic/backport-6.6/780-06-v6.8-r8169-fix-building-with-CONFIG_LEDS_CLASS-m.patch b/target/linux/generic/backport-6.6/780-06-v6.8-r8169-fix-building-with-CONFIG_LEDS_CLASS-m.patch
index 819a611cb3f26d..fa79d911292c3b 100644
--- a/target/linux/generic/backport-6.6/780-06-v6.8-r8169-fix-building-with-CONFIG_LEDS_CLASS-m.patch
+++ b/target/linux/generic/backport-6.6/780-06-v6.8-r8169-fix-building-with-CONFIG_LEDS_CLASS-m.patch
@@ -59,7 +59,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  obj-$(CONFIG_R8169) += r8169.o
 --- a/drivers/net/ethernet/realtek/r8169_main.c
 +++ b/drivers/net/ethernet/realtek/r8169_main.c
-@@ -5410,11 +5410,10 @@ static int rtl_init_one(struct pci_dev *
+@@ -5419,11 +5419,10 @@ static int rtl_init_one(struct pci_dev *
  	if (rc)
  		return rc;
  
diff --git a/target/linux/generic/backport-6.6/780-07-v6.9-r8169-simplify-EEE-handling.patch b/target/linux/generic/backport-6.6/780-07-v6.9-r8169-simplify-EEE-handling.patch
index d3a26303ef0e57..e1fcb00b1d4b1e 100644
--- a/target/linux/generic/backport-6.6/780-07-v6.9-r8169-simplify-EEE-handling.patch
+++ b/target/linux/generic/backport-6.6/780-07-v6.9-r8169-simplify-EEE-handling.patch
@@ -75,7 +75,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	genphy_soft_reset(tp->phydev);
  }
  
-@@ -5112,7 +5087,9 @@ static int r8169_mdio_register(struct rt
+@@ -5121,7 +5096,9 @@ static int r8169_mdio_register(struct rt
  	}
  
  	tp->phydev->mac_managed_pm = true;
@@ -86,7 +86,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	phy_support_asym_pause(tp->phydev);
  
  	/* PHY will be woken up in rtl_open() */
-@@ -5247,7 +5224,6 @@ static int rtl_init_one(struct pci_dev *
+@@ -5256,7 +5233,6 @@ static int rtl_init_one(struct pci_dev *
  	tp->dev = dev;
  	tp->pci_dev = pdev;
  	tp->supports_gmii = ent->driver_data == RTL_CFG_NO_GBIT ? 0 : 1;
diff --git a/target/linux/generic/backport-6.6/780-08-v6.9-r8169-add-support-for-RTL8126A.patch b/target/linux/generic/backport-6.6/780-08-v6.9-r8169-add-support-for-RTL8126A.patch
index 6dfaa904a175e3..80b64d3bed9e6a 100644
--- a/target/linux/generic/backport-6.6/780-08-v6.9-r8169-add-support-for-RTL8126A.patch
+++ b/target/linux/generic/backport-6.6/780-08-v6.9-r8169-add-support-for-RTL8126A.patch
@@ -311,7 +311,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		rtl_enable_rxdvgate(tp);
  		fsleep(2000);
  		break;
-@@ -4105,8 +4163,7 @@ static unsigned int rtl_quirk_packet_pad
+@@ -4111,8 +4169,7 @@ static unsigned int rtl_quirk_packet_pad
  
  	switch (tp->mac_version) {
  	case RTL_GIGA_MAC_VER_34:
@@ -321,7 +321,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  		padto = max_t(unsigned int, padto, ETH_ZLEN);
  		break;
  	default:
-@@ -5139,7 +5196,7 @@ static void rtl_hw_initialize(struct rtl
+@@ -5148,7 +5205,7 @@ static void rtl_hw_initialize(struct rtl
  	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_48:
  		rtl_hw_init_8168g(tp);
  		break;
diff --git a/target/linux/generic/backport-6.6/780-10-v6.9-r8169-simplify-code-by-using-core-provided-pcpu-stat.patch b/target/linux/generic/backport-6.6/780-10-v6.9-r8169-simplify-code-by-using-core-provided-pcpu-stat.patch
index 0288dcb11e7aef..60f0cbf06c7672 100644
--- a/target/linux/generic/backport-6.6/780-10-v6.9-r8169-simplify-code-by-using-core-provided-pcpu-stat.patch
+++ b/target/linux/generic/backport-6.6/780-10-v6.9-r8169-simplify-code-by-using-core-provided-pcpu-stat.patch
@@ -16,7 +16,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/ethernet/realtek/r8169_main.c
 +++ b/drivers/net/ethernet/realtek/r8169_main.c
-@@ -5288,11 +5288,6 @@ static int rtl_init_one(struct pci_dev *
+@@ -5297,11 +5297,6 @@ static int rtl_init_one(struct pci_dev *
  	raw_spin_lock_init(&tp->mac_ocp_lock);
  	mutex_init(&tp->led_lock);
  
@@ -28,7 +28,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	/* Get the *optional* external "ether_clk" used on some boards */
  	tp->clk = devm_clk_get_optional_enabled(&pdev->dev, "ether_clk");
  	if (IS_ERR(tp->clk))
-@@ -5407,6 +5402,8 @@ static int rtl_init_one(struct pci_dev *
+@@ -5416,6 +5411,8 @@ static int rtl_init_one(struct pci_dev *
  	dev->hw_features |= NETIF_F_RXALL;
  	dev->hw_features |= NETIF_F_RXFCS;
  
diff --git a/target/linux/generic/backport-6.6/780-11-v6.9-r8169-add-LED-support-for-RTL8125-RTL8126.patch b/target/linux/generic/backport-6.6/780-11-v6.9-r8169-add-LED-support-for-RTL8125-RTL8126.patch
index 449aa11591a1d0..cd33fc1d752379 100644
--- a/target/linux/generic/backport-6.6/780-11-v6.9-r8169-add-LED-support-for-RTL8125-RTL8126.patch
+++ b/target/linux/generic/backport-6.6/780-11-v6.9-r8169-add-LED-support-for-RTL8125-RTL8126.patch
@@ -225,7 +225,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  void r8169_get_led_name(struct rtl8169_private *tp, int idx,
  			char *buf, int buf_len)
  {
-@@ -5440,10 +5491,12 @@ static int rtl_init_one(struct pci_dev *
+@@ -5449,10 +5500,12 @@ static int rtl_init_one(struct pci_dev *
  	if (rc)
  		return rc;
  
diff --git a/target/linux/generic/backport-6.6/780-16-v6.9-r8169-fix-LED-related-deadlock-on-module-removal.patch b/target/linux/generic/backport-6.6/780-16-v6.9-r8169-fix-LED-related-deadlock-on-module-removal.patch
index 6e0ff9b14bd566..857c2171d505b8 100644
--- a/target/linux/generic/backport-6.6/780-16-v6.9-r8169-fix-LED-related-deadlock-on-module-removal.patch
+++ b/target/linux/generic/backport-6.6/780-16-v6.9-r8169-fix-LED-related-deadlock-on-module-removal.patch
@@ -124,7 +124,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	u32 ocp_base;
  };
  
-@@ -5067,6 +5069,8 @@ static void rtl_remove_one(struct pci_de
+@@ -5075,6 +5077,8 @@ static void rtl_remove_one(struct pci_de
  
  	cancel_work_sync(&tp->wk.work);
  
@@ -133,7 +133,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
  	unregister_netdev(tp->dev);
  
  	if (tp->dash_type != RTL_DASH_NONE)
-@@ -5525,9 +5529,9 @@ static int rtl_init_one(struct pci_dev *
+@@ -5534,9 +5538,9 @@ static int rtl_init_one(struct pci_dev *
  
  	if (IS_ENABLED(CONFIG_R8169_LEDS)) {
  		if (rtl_is_8125(tp))
diff --git a/target/linux/generic/backport-6.6/780-17-v6.9-r8169-add-missing-conditional-compiling-for-call-to-.patch b/target/linux/generic/backport-6.6/780-17-v6.9-r8169-add-missing-conditional-compiling-for-call-to-.patch
index e647e18167e48a..265c715f5e4d56 100644
--- a/target/linux/generic/backport-6.6/780-17-v6.9-r8169-add-missing-conditional-compiling-for-call-to-.patch
+++ b/target/linux/generic/backport-6.6/780-17-v6.9-r8169-add-missing-conditional-compiling-for-call-to-.patch
@@ -19,7 +19,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/ethernet/realtek/r8169_main.c
 +++ b/drivers/net/ethernet/realtek/r8169_main.c
-@@ -5069,7 +5069,8 @@ static void rtl_remove_one(struct pci_de
+@@ -5077,7 +5077,8 @@ static void rtl_remove_one(struct pci_de
  
  	cancel_work_sync(&tp->wk.work);
  
diff --git a/target/linux/generic/backport-6.6/780-20-v6.11-r8169-disable-interrupt-source-RxOverflow.patch b/target/linux/generic/backport-6.6/780-20-v6.11-r8169-disable-interrupt-source-RxOverflow.patch
index 9389585f160355..9ded598665af0c 100644
--- a/target/linux/generic/backport-6.6/780-20-v6.11-r8169-disable-interrupt-source-RxOverflow.patch
+++ b/target/linux/generic/backport-6.6/780-20-v6.11-r8169-disable-interrupt-source-RxOverflow.patch
@@ -18,7 +18,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/ethernet/realtek/r8169_main.c
 +++ b/drivers/net/ethernet/realtek/r8169_main.c
-@@ -5110,12 +5110,10 @@ static void rtl_set_irq_mask(struct rtl8
+@@ -5118,12 +5118,10 @@ static void rtl_set_irq_mask(struct rtl8
  	tp->irq_mask = RxOK | RxErr | TxOK | TxErr | LinkChg;
  
  	if (tp->mac_version <= RTL_GIGA_MAC_VER_06)
diff --git a/target/linux/generic/backport-6.6/780-22-v6.12-r8169-add-support-for-RTL8126A-rev.b.patch b/target/linux/generic/backport-6.6/780-22-v6.12-r8169-add-support-for-RTL8126A-rev.b.patch
index dd90fc1a65a67e..628664b2f0e192 100644
--- a/target/linux/generic/backport-6.6/780-22-v6.12-r8169-add-support-for-RTL8126A-rev.b.patch
+++ b/target/linux/generic/backport-6.6/780-22-v6.12-r8169-add-support-for-RTL8126A-rev.b.patch
@@ -215,7 +215,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		rtl_enable_rxdvgate(tp);
  		fsleep(2000);
  		break;
-@@ -4252,7 +4264,7 @@ static unsigned int rtl_quirk_packet_pad
+@@ -4258,7 +4270,7 @@ static unsigned int rtl_quirk_packet_pad
  
  	switch (tp->mac_version) {
  	case RTL_GIGA_MAC_VER_34:
@@ -224,7 +224,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		padto = max_t(unsigned int, padto, ETH_ZLEN);
  		break;
  	default:
-@@ -5286,7 +5298,7 @@ static void rtl_hw_initialize(struct rtl
+@@ -5295,7 +5307,7 @@ static void rtl_hw_initialize(struct rtl
  	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_48:
  		rtl_hw_init_8168g(tp);
  		break;
diff --git a/target/linux/generic/backport-6.6/780-24-v6.12-r8169-avoid-unsolicited-interrupts.patch b/target/linux/generic/backport-6.6/780-24-v6.12-r8169-avoid-unsolicited-interrupts.patch
deleted file mode 100644
index 8332a285f9f085..00000000000000
--- a/target/linux/generic/backport-6.6/780-24-v6.12-r8169-avoid-unsolicited-interrupts.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From 10ce0db787004875f4dba068ea952207d1d8abeb Mon Sep 17 00:00:00 2001
-From: Heiner Kallweit <hkallweit1@gmail.com>
-Date: Fri, 18 Oct 2024 11:08:16 +0200
-Subject: [PATCH] r8169: avoid unsolicited interrupts
-
-It was reported that after resume from suspend a PCI error is logged
-and connectivity is broken. Error message is:
-PCI error (cmd = 0x0407, status_errs = 0x0000)
-The message seems to be a red herring as none of the error bits is set,
-and the PCI command register value also is normal. Exception handling
-for a PCI error includes a chip reset what apparently brakes connectivity
-here. The interrupt status bit triggering the PCI error handling isn't
-actually used on PCIe chip versions, so it's not clear why this bit is
-set by the chip. Fix this by ignoring this bit on PCIe chip versions.
-
-Fixes: 0e4851502f84 ("r8169: merge with version 8.001.00 of Realtek's r8168 driver")
-Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219388
-Tested-by: Atlas Yu <atlas.yu@canonical.com>
-Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
-Reviewed-by: Simon Horman <horms@kernel.org>
-Link: https://patch.msgid.link/78e2f535-438f-4212-ad94-a77637ac6c9c@gmail.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
----
- drivers/net/ethernet/realtek/r8169_main.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
---- a/drivers/net/ethernet/realtek/r8169_main.c
-+++ b/drivers/net/ethernet/realtek/r8169_main.c
-@@ -4683,7 +4683,9 @@ static irqreturn_t rtl8169_interrupt(int
- 	if ((status & 0xffff) == 0xffff || !(status & tp->irq_mask))
- 		return IRQ_NONE;
- 
--	if (unlikely(status & SYSErr)) {
-+	/* At least RTL8168fp may unexpectedly set the SYSErr bit */
-+	if (unlikely(status & SYSErr &&
-+	    tp->mac_version <= RTL_GIGA_MAC_VER_06)) {
- 		rtl8169_pcierr_interrupt(tp->dev);
- 		goto out;
- 	}
diff --git a/target/linux/generic/backport-6.6/780-25-v6.13-r8169-remove-original-workaround-for-RTL8125-broken-.patch b/target/linux/generic/backport-6.6/780-25-v6.13-r8169-remove-original-workaround-for-RTL8125-broken-.patch
new file mode 100644
index 00000000000000..dbf66bb81e8a2c
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-25-v6.13-r8169-remove-original-workaround-for-RTL8125-broken-.patch
@@ -0,0 +1,33 @@
+From 854d71c555dfc3383c1fde7d9989b6046e21093d Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 9 Oct 2024 07:48:05 +0200
+Subject: [PATCH] r8169: remove original workaround for RTL8125 broken rx issue
+
+Now that we have b9c7ac4fe22c ("r8169: disable ALDPS per default for
+RTL8125"), the first attempt to fix the issue shouldn't be needed
+any longer. So let's effectively revert 621735f59064 ("r8169: fix
+rare issue with broken rx after link-down on RTL8125") and see
+whether anybody complains.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/382d8c88-cbce-400f-ad62-fda0181c7e38@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -4778,11 +4778,7 @@ static void r8169_phylink_handler(struct
+ 	if (netif_carrier_ok(ndev)) {
+ 		rtl_link_chg_patch(tp);
+ 		pm_request_resume(d);
+-		netif_wake_queue(tp->dev);
+ 	} else {
+-		/* In few cases rx is broken after link-down otherwise */
+-		if (rtl_is_8125(tp))
+-			rtl_schedule_task(tp, RTL_FLAG_TASK_RESET_NO_QUEUE_WAKE);
+ 		pm_runtime_idle(d);
+ 	}
+ 
diff --git a/target/linux/generic/backport-6.6/780-26-v6.13-r8169-enable-SG-TSO-on-selected-chip-versions-per-de.patch b/target/linux/generic/backport-6.6/780-26-v6.13-r8169-enable-SG-TSO-on-selected-chip-versions-per-de.patch
new file mode 100644
index 00000000000000..15bdb433569096
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-26-v6.13-r8169-enable-SG-TSO-on-selected-chip-versions-per-de.patch
@@ -0,0 +1,52 @@
+From b8bf38440ba94e8ed8e2ae55c5dfb0276d30e843 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 10 Oct 2024 12:58:02 +0200
+Subject: [PATCH] r8169: enable SG/TSO on selected chip versions per default
+
+Due to problem reports in the past SG and TSO/TSO6 are disabled per
+default. It's not fully clear which chip versions are affected, so we
+may impact also users of unaffected chip versions, unless they know
+how to use ethtool for enabling SG/TSO/TSO6.
+Vendor drivers r8168/r8125 enable SG/TSO/TSO6 for selected chip
+versions per default, I'd interpret this as confirmation that these
+chip versions are unaffected. So let's do the same here.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 16 +++++++++++-----
+ 1 file changed, 11 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -5492,11 +5492,6 @@ static int rtl_init_one(struct pci_dev *
+ 
+ 	dev->features |= dev->hw_features;
+ 
+-	/* There has been a number of reports that using SG/TSO results in
+-	 * tx timeouts. However for a lot of people SG/TSO works fine.
+-	 * Therefore disable both features by default, but allow users to
+-	 * enable them. Use at own risk!
+-	 */
+ 	if (rtl_chip_supports_csum_v2(tp)) {
+ 		dev->hw_features |= NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6;
+ 		netif_set_tso_max_size(dev, RTL_GSO_MAX_SIZE_V2);
+@@ -5507,6 +5502,17 @@ static int rtl_init_one(struct pci_dev *
+ 		netif_set_tso_max_segs(dev, RTL_GSO_MAX_SEGS_V1);
+ 	}
+ 
++	/* There has been a number of reports that using SG/TSO results in
++	 * tx timeouts. However for a lot of people SG/TSO works fine.
++	 * It's not fully clear which chip versions are affected. Vendor
++	 * drivers enable SG/TSO for certain chip versions per default,
++	 * let's mimic this here. On other chip versions users can
++	 * use ethtool to enable SG/TSO, use at own risk!
++	 */
++	if (tp->mac_version >= RTL_GIGA_MAC_VER_46 &&
++	    tp->mac_version != RTL_GIGA_MAC_VER_61)
++		dev->features |= dev->hw_features;
++
+ 	dev->hw_features |= NETIF_F_RXALL;
+ 	dev->hw_features |= NETIF_F_RXFCS;
+ 
diff --git a/target/linux/generic/backport-6.6/780-27-v6.13-r8169-implement-additional-ethtool-stats-ops.patch b/target/linux/generic/backport-6.6/780-27-v6.13-r8169-implement-additional-ethtool-stats-ops.patch
new file mode 100644
index 00000000000000..29c8527b1cb95d
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-27-v6.13-r8169-implement-additional-ethtool-stats-ops.patch
@@ -0,0 +1,130 @@
+From e3fc5139bd8ffaa1498adc21be4e8ecbc6aed508 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Sun, 13 Oct 2024 11:17:39 +0200
+Subject: [PATCH] r8169: implement additional ethtool stats ops
+
+This adds support for ethtool standard statistics, and makes use of the
+extended hardware statistics being available from RTl8125.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/58e0da73-a7dd-4be3-82ae-d5b3f9069bde@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 82 +++++++++++++++++++++++
+ 1 file changed, 82 insertions(+)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -2161,6 +2161,19 @@ static void rtl8169_get_ringparam(struct
+ 	data->tx_pending = NUM_TX_DESC;
+ }
+ 
++static void rtl8169_get_pause_stats(struct net_device *dev,
++				    struct ethtool_pause_stats *pause_stats)
++{
++	struct rtl8169_private *tp = netdev_priv(dev);
++
++	if (!rtl_is_8125(tp))
++		return;
++
++	rtl8169_update_counters(tp);
++	pause_stats->tx_pause_frames = le32_to_cpu(tp->counters->tx_pause_on);
++	pause_stats->rx_pause_frames = le32_to_cpu(tp->counters->rx_pause_on);
++}
++
+ static void rtl8169_get_pauseparam(struct net_device *dev,
+ 				   struct ethtool_pauseparam *data)
+ {
+@@ -2187,6 +2200,69 @@ static int rtl8169_set_pauseparam(struct
+ 	return 0;
+ }
+ 
++static void rtl8169_get_eth_mac_stats(struct net_device *dev,
++				      struct ethtool_eth_mac_stats *mac_stats)
++{
++	struct rtl8169_private *tp = netdev_priv(dev);
++
++	rtl8169_update_counters(tp);
++
++	mac_stats->FramesTransmittedOK =
++		le64_to_cpu(tp->counters->tx_packets);
++	mac_stats->SingleCollisionFrames =
++		le32_to_cpu(tp->counters->tx_one_collision);
++	mac_stats->MultipleCollisionFrames =
++		le32_to_cpu(tp->counters->tx_multi_collision);
++	mac_stats->FramesReceivedOK =
++		le64_to_cpu(tp->counters->rx_packets);
++	mac_stats->AlignmentErrors =
++		le16_to_cpu(tp->counters->align_errors);
++	mac_stats->FramesLostDueToIntMACXmitError =
++		le64_to_cpu(tp->counters->tx_errors);
++	mac_stats->BroadcastFramesReceivedOK =
++		le64_to_cpu(tp->counters->rx_broadcast);
++	mac_stats->MulticastFramesReceivedOK =
++		le32_to_cpu(tp->counters->rx_multicast);
++
++	if (!rtl_is_8125(tp))
++		return;
++
++	mac_stats->AlignmentErrors =
++		le32_to_cpu(tp->counters->align_errors32);
++	mac_stats->OctetsTransmittedOK =
++		le64_to_cpu(tp->counters->tx_octets);
++	mac_stats->LateCollisions =
++		le32_to_cpu(tp->counters->tx_late_collision);
++	mac_stats->FramesAbortedDueToXSColls =
++		le32_to_cpu(tp->counters->tx_aborted32);
++	mac_stats->OctetsReceivedOK =
++		le64_to_cpu(tp->counters->rx_octets);
++	mac_stats->FramesLostDueToIntMACRcvError =
++		le32_to_cpu(tp->counters->rx_mac_error);
++	mac_stats->MulticastFramesXmittedOK =
++		le64_to_cpu(tp->counters->tx_multicast64);
++	mac_stats->BroadcastFramesXmittedOK =
++		le64_to_cpu(tp->counters->tx_broadcast64);
++	mac_stats->MulticastFramesReceivedOK =
++		le64_to_cpu(tp->counters->rx_multicast64);
++	 mac_stats->FrameTooLongErrors =
++		le32_to_cpu(tp->counters->rx_frame_too_long);
++}
++
++static void rtl8169_get_eth_ctrl_stats(struct net_device *dev,
++				       struct ethtool_eth_ctrl_stats *ctrl_stats)
++{
++	struct rtl8169_private *tp = netdev_priv(dev);
++
++	if (!rtl_is_8125(tp))
++		return;
++
++	rtl8169_update_counters(tp);
++
++	ctrl_stats->UnsupportedOpcodesReceived =
++		le32_to_cpu(tp->counters->rx_unknown_opcode);
++}
++
+ static const struct ethtool_ops rtl8169_ethtool_ops = {
+ 	.supported_coalesce_params = ETHTOOL_COALESCE_USECS |
+ 				     ETHTOOL_COALESCE_MAX_FRAMES,
+@@ -2208,8 +2284,11 @@ static const struct ethtool_ops rtl8169_
+ 	.get_link_ksettings	= phy_ethtool_get_link_ksettings,
+ 	.set_link_ksettings	= phy_ethtool_set_link_ksettings,
+ 	.get_ringparam		= rtl8169_get_ringparam,
++	.get_pause_stats	= rtl8169_get_pause_stats,
+ 	.get_pauseparam		= rtl8169_get_pauseparam,
+ 	.set_pauseparam		= rtl8169_set_pauseparam,
++	.get_eth_mac_stats	= rtl8169_get_eth_mac_stats,
++	.get_eth_ctrl_stats	= rtl8169_get_eth_ctrl_stats,
+ };
+ 
+ static enum mac_version rtl8169_get_mac_version(u16 xid, bool gmii)
+@@ -3894,6 +3973,9 @@ static void rtl_hw_start_8125(struct rtl
+ 		break;
+ 	}
+ 
++	/* enable extended tally counter */
++	r8168_mac_ocp_modify(tp, 0xea84, 0, BIT(1) | BIT(0));
++
+ 	rtl_hw_config(tp);
+ }
+ 
diff --git a/target/linux/generic/backport-6.6/780-28-v6.13-r8169-don-t-take-RTNL-lock-in-rtl_task.patch b/target/linux/generic/backport-6.6/780-28-v6.13-r8169-don-t-take-RTNL-lock-in-rtl_task.patch
new file mode 100644
index 00000000000000..3e495e19defbdd
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-28-v6.13-r8169-don-t-take-RTNL-lock-in-rtl_task.patch
@@ -0,0 +1,50 @@
+From ac48430368c1a4f4e6c2fa92243b4b93fd25bee4 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 16 Oct 2024 22:05:57 +0200
+Subject: [PATCH] r8169: don't take RTNL lock in rtl_task()
+
+There's not really a benefit here in taking the RTNL lock. The task
+handler does exception handling only, so we're in trouble anyway when
+we come here, and there's no need to protect against e.g. a parallel
+ethtool call.
+A benefit of removing the RTNL lock here is that we now can
+synchronously cancel the workqueue from a context holding the RTNL mutex.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 8 ++------
+ 1 file changed, 2 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -4801,10 +4801,8 @@ static void rtl_task(struct work_struct
+ 		container_of(work, struct rtl8169_private, wk.work);
+ 	int ret;
+ 
+-	rtnl_lock();
+-
+ 	if (!test_bit(RTL_FLAG_TASK_ENABLED, tp->wk.flags))
+-		goto out_unlock;
++		return;
+ 
+ 	if (test_and_clear_bit(RTL_FLAG_TASK_TX_TIMEOUT, tp->wk.flags)) {
+ 		/* if chip isn't accessible, reset bus to revive it */
+@@ -4813,7 +4811,7 @@ static void rtl_task(struct work_struct
+ 			if (ret < 0) {
+ 				netdev_err(tp->dev, "Can't reset secondary PCI bus, detach NIC\n");
+ 				netif_device_detach(tp->dev);
+-				goto out_unlock;
++				return;
+ 			}
+ 		}
+ 
+@@ -4832,8 +4830,6 @@ reset:
+ 	} else if (test_and_clear_bit(RTL_FLAG_TASK_RESET_NO_QUEUE_WAKE, tp->wk.flags)) {
+ 		rtl_reset_work(tp);
+ 	}
+-out_unlock:
+-	rtnl_unlock();
+ }
+ 
+ static int rtl8169_poll(struct napi_struct *napi, int budget)
diff --git a/target/linux/generic/backport-6.6/780-30-v6.13-r8169-avoid-duplicated-messages-if-loading-firmware-.patch b/target/linux/generic/backport-6.6/780-30-v6.13-r8169-avoid-duplicated-messages-if-loading-firmware-.patch
new file mode 100644
index 00000000000000..6430d32252b125
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-30-v6.13-r8169-avoid-duplicated-messages-if-loading-firmware-.patch
@@ -0,0 +1,41 @@
+From 1c105bacb160b5918e917ab811552b7be69fc69c Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 16 Oct 2024 22:29:39 +0200
+Subject: [PATCH] r8169: avoid duplicated messages if loading firmware fails
+ and switch to warn level
+
+In case of a problem with firmware loading we inform at the driver level,
+in addition the firmware load code itself issues warnings. Therefore
+switch to firmware_request_nowarn() to avoid duplicated error messages.
+In addition switch to warn level because the firmware is optional and
+typically just fixes compatibility issues.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Message-ID: <d9c5094c-89a6-40e2-b5fe-8df7df4624ef@gmail.com>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+---
+ drivers/net/ethernet/realtek/r8169_firmware.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_firmware.c
++++ b/drivers/net/ethernet/realtek/r8169_firmware.c
+@@ -215,7 +215,7 @@ int rtl_fw_request_firmware(struct rtl_f
+ {
+ 	int rc;
+ 
+-	rc = request_firmware(&rtl_fw->fw, rtl_fw->fw_name, rtl_fw->dev);
++	rc = firmware_request_nowarn(&rtl_fw->fw, rtl_fw->fw_name, rtl_fw->dev);
+ 	if (rc < 0)
+ 		goto out;
+ 
+@@ -227,7 +227,7 @@ int rtl_fw_request_firmware(struct rtl_f
+ 
+ 	return 0;
+ out:
+-	dev_err(rtl_fw->dev, "Unable to load firmware %s (%d)\n",
+-		rtl_fw->fw_name, rc);
++	dev_warn(rtl_fw->dev, "Unable to load firmware %s (%d)\n",
++		 rtl_fw->fw_name, rc);
+ 	return rc;
+ }
diff --git a/target/linux/generic/backport-6.6/780-31-v6.13-r8169-remove-rtl_dash_loop_wait_high-low.patch b/target/linux/generic/backport-6.6/780-31-v6.13-r8169-remove-rtl_dash_loop_wait_high-low.patch
new file mode 100644
index 00000000000000..0c0e80c92dc197
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-31-v6.13-r8169-remove-rtl_dash_loop_wait_high-low.patch
@@ -0,0 +1,82 @@
+From d64113c6bb5ea5a70b7c9c3a6bcadef307638187 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 16 Oct 2024 22:31:10 +0200
+Subject: [PATCH] r8169: remove rtl_dash_loop_wait_high/low
+
+Remove rtl_dash_loop_wait_high/low to simplify the code.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Message-ID: <fb8c490c-2d92-48f5-8bbf-1fc1f2ee1649@gmail.com>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 35 ++++++-----------------
+ 1 file changed, 8 insertions(+), 27 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -1346,40 +1346,19 @@ static void rtl8168ep_stop_cmac(struct r
+ 	RTL_W8(tp, IBCR0, RTL_R8(tp, IBCR0) & ~0x01);
+ }
+ 
+-static void rtl_dash_loop_wait(struct rtl8169_private *tp,
+-			       const struct rtl_cond *c,
+-			       unsigned long usecs, int n, bool high)
+-{
+-	if (!tp->dash_enabled)
+-		return;
+-	rtl_loop_wait(tp, c, usecs, n, high);
+-}
+-
+-static void rtl_dash_loop_wait_high(struct rtl8169_private *tp,
+-				    const struct rtl_cond *c,
+-				    unsigned long d, int n)
+-{
+-	rtl_dash_loop_wait(tp, c, d, n, true);
+-}
+-
+-static void rtl_dash_loop_wait_low(struct rtl8169_private *tp,
+-				   const struct rtl_cond *c,
+-				   unsigned long d, int n)
+-{
+-	rtl_dash_loop_wait(tp, c, d, n, false);
+-}
+-
+ static void rtl8168dp_driver_start(struct rtl8169_private *tp)
+ {
+ 	r8168dp_oob_notify(tp, OOB_CMD_DRIVER_START);
+-	rtl_dash_loop_wait_high(tp, &rtl_dp_ocp_read_cond, 10000, 10);
++	if (tp->dash_enabled)
++		rtl_loop_wait_high(tp, &rtl_dp_ocp_read_cond, 10000, 10);
+ }
+ 
+ static void rtl8168ep_driver_start(struct rtl8169_private *tp)
+ {
+ 	r8168ep_ocp_write(tp, 0x01, 0x180, OOB_CMD_DRIVER_START);
+ 	r8168ep_ocp_write(tp, 0x01, 0x30, r8168ep_ocp_read(tp, 0x30) | 0x01);
+-	rtl_dash_loop_wait_high(tp, &rtl_ep_ocp_read_cond, 10000, 30);
++	if (tp->dash_enabled)
++		rtl_loop_wait_high(tp, &rtl_ep_ocp_read_cond, 10000, 30);
+ }
+ 
+ static void rtl8168_driver_start(struct rtl8169_private *tp)
+@@ -1393,7 +1372,8 @@ static void rtl8168_driver_start(struct
+ static void rtl8168dp_driver_stop(struct rtl8169_private *tp)
+ {
+ 	r8168dp_oob_notify(tp, OOB_CMD_DRIVER_STOP);
+-	rtl_dash_loop_wait_low(tp, &rtl_dp_ocp_read_cond, 10000, 10);
++	if (tp->dash_enabled)
++		rtl_loop_wait_low(tp, &rtl_dp_ocp_read_cond, 10000, 10);
+ }
+ 
+ static void rtl8168ep_driver_stop(struct rtl8169_private *tp)
+@@ -1401,7 +1381,8 @@ static void rtl8168ep_driver_stop(struct
+ 	rtl8168ep_stop_cmac(tp);
+ 	r8168ep_ocp_write(tp, 0x01, 0x180, OOB_CMD_DRIVER_STOP);
+ 	r8168ep_ocp_write(tp, 0x01, 0x30, r8168ep_ocp_read(tp, 0x30) | 0x01);
+-	rtl_dash_loop_wait_low(tp, &rtl_ep_ocp_read_cond, 10000, 10);
++	if (tp->dash_enabled)
++		rtl_loop_wait_low(tp, &rtl_ep_ocp_read_cond, 10000, 10);
+ }
+ 
+ static void rtl8168_driver_stop(struct rtl8169_private *tp)
diff --git a/target/linux/generic/backport-6.6/780-32-v6.13-r8169-enable-EEE-at-2.5G-per-default-on-RTL8125B.patch b/target/linux/generic/backport-6.6/780-32-v6.13-r8169-enable-EEE-at-2.5G-per-default-on-RTL8125B.patch
new file mode 100644
index 00000000000000..4ec06cc6019526
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-32-v6.13-r8169-enable-EEE-at-2.5G-per-default-on-RTL8125B.patch
@@ -0,0 +1,28 @@
+From c4e64095c00cb2de413cd6b90be047c273bcd491 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 17 Oct 2024 22:27:44 +0200
+Subject: [PATCH] r8169: enable EEE at 2.5G per default on RTL8125B
+
+Register a6d/12 is shadowing register MDIO_AN_EEE_ADV2. So this line
+disables advertisement of EEE at 2.5G. Latest vendor driver r8125
+doesn't do this (any longer?), so this mode seems to be safe.
+EEE saves quite some energy, therefore enable this mode per default.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Message-ID: <95dd5a0c-09ea-4847-94d9-b7aa3063e8ff@gmail.com>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+---
+ drivers/net/ethernet/realtek/r8169_phy_config.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -99,7 +99,6 @@ static void rtl8125a_config_eee_phy(stru
+ 
+ static void rtl8125b_config_eee_phy(struct phy_device *phydev)
+ {
+-	phy_modify_paged(phydev, 0xa6d, 0x12, 0x0001, 0x0000);
+ 	phy_modify_paged(phydev, 0xa6d, 0x14, 0x0010, 0x0000);
+ 	phy_modify_paged(phydev, 0xa42, 0x14, 0x0080, 0x0000);
+ 	phy_modify_paged(phydev, 0xa4a, 0x11, 0x0200, 0x0000);
diff --git a/target/linux/generic/backport-6.6/780-33-v6.13-r8169-add-support-for-RTL8125D.patch b/target/linux/generic/backport-6.6/780-33-v6.13-r8169-add-support-for-RTL8125D.patch
new file mode 100644
index 00000000000000..687ed445dafb0e
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-33-v6.13-r8169-add-support-for-RTL8125D.patch
@@ -0,0 +1,143 @@
+From f75d1fbe7809bc5ed134204b920fd9e2fc5db1df Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 24 Oct 2024 22:42:33 +0200
+Subject: [PATCH] r8169: add support for RTL8125D
+
+This adds support for new chip version RTL8125D, which can be found on
+boards like Gigabyte X870E AORUS ELITE WIFI7. Firmware rtl8125d-1.fw
+for this chip version is available in linux-firmware already.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/d0306912-e88e-4c25-8b5d-545ae8834c0c@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169.h          |  1 +
+ drivers/net/ethernet/realtek/r8169_main.c     | 23 +++++++++++++------
+ .../net/ethernet/realtek/r8169_phy_config.c   | 10 ++++++++
+ 3 files changed, 27 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169.h
++++ b/drivers/net/ethernet/realtek/r8169.h
+@@ -68,6 +68,7 @@ enum mac_version {
+ 	/* support for RTL_GIGA_MAC_VER_60 has been removed */
+ 	RTL_GIGA_MAC_VER_61,
+ 	RTL_GIGA_MAC_VER_63,
++	RTL_GIGA_MAC_VER_64,
+ 	RTL_GIGA_MAC_VER_65,
+ 	RTL_GIGA_MAC_VER_66,
+ 	RTL_GIGA_MAC_NONE
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -55,6 +55,7 @@
+ #define FIRMWARE_8107E_2	"rtl_nic/rtl8107e-2.fw"
+ #define FIRMWARE_8125A_3	"rtl_nic/rtl8125a-3.fw"
+ #define FIRMWARE_8125B_2	"rtl_nic/rtl8125b-2.fw"
++#define FIRMWARE_8125D_1	"rtl_nic/rtl8125d-1.fw"
+ #define FIRMWARE_8126A_2	"rtl_nic/rtl8126a-2.fw"
+ #define FIRMWARE_8126A_3	"rtl_nic/rtl8126a-3.fw"
+ 
+@@ -138,6 +139,7 @@ static const struct {
+ 	[RTL_GIGA_MAC_VER_61] = {"RTL8125A",		FIRMWARE_8125A_3},
+ 	/* reserve 62 for CFG_METHOD_4 in the vendor driver */
+ 	[RTL_GIGA_MAC_VER_63] = {"RTL8125B",		FIRMWARE_8125B_2},
++	[RTL_GIGA_MAC_VER_64] = {"RTL8125D",		FIRMWARE_8125D_1},
+ 	[RTL_GIGA_MAC_VER_65] = {"RTL8126A",		FIRMWARE_8126A_2},
+ 	[RTL_GIGA_MAC_VER_66] = {"RTL8126A",		FIRMWARE_8126A_3},
+ };
+@@ -707,6 +709,7 @@ MODULE_FIRMWARE(FIRMWARE_8168FP_3);
+ MODULE_FIRMWARE(FIRMWARE_8107E_2);
+ MODULE_FIRMWARE(FIRMWARE_8125A_3);
+ MODULE_FIRMWARE(FIRMWARE_8125B_2);
++MODULE_FIRMWARE(FIRMWARE_8125D_1);
+ MODULE_FIRMWARE(FIRMWARE_8126A_2);
+ MODULE_FIRMWARE(FIRMWARE_8126A_3);
+ 
+@@ -2079,10 +2082,7 @@ static void rtl_set_eee_txidle_timer(str
+ 		tp->tx_lpi_timer = timer_val;
+ 		r8168_mac_ocp_write(tp, 0xe048, timer_val);
+ 		break;
+-	case RTL_GIGA_MAC_VER_61:
+-	case RTL_GIGA_MAC_VER_63:
+-	case RTL_GIGA_MAC_VER_65:
+-	case RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_66:
+ 		tp->tx_lpi_timer = timer_val;
+ 		RTL_W16(tp, EEE_TXIDLE_TIMER_8125, timer_val);
+ 		break;
+@@ -2294,6 +2294,9 @@ static enum mac_version rtl8169_get_mac_
+ 		{ 0x7cf, 0x64a,	RTL_GIGA_MAC_VER_66 },
+ 		{ 0x7cf, 0x649,	RTL_GIGA_MAC_VER_65 },
+ 
++		/* 8125D family. */
++		{ 0x7cf, 0x688,	RTL_GIGA_MAC_VER_64 },
++
+ 		/* 8125B family. */
+ 		{ 0x7cf, 0x641,	RTL_GIGA_MAC_VER_63 },
+ 
+@@ -2561,9 +2564,7 @@ static void rtl_init_rxcfg(struct rtl816
+ 	case RTL_GIGA_MAC_VER_61:
+ 		RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST);
+ 		break;
+-	case RTL_GIGA_MAC_VER_63:
+-	case RTL_GIGA_MAC_VER_65:
+-	case RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_63 ... RTL_GIGA_MAC_VER_66:
+ 		RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST |
+ 			RX_PAUSE_SLOT_ON);
+ 		break;
+@@ -3875,6 +3876,12 @@ static void rtl_hw_start_8125b(struct rt
+ 	rtl_hw_start_8125_common(tp);
+ }
+ 
++static void rtl_hw_start_8125d(struct rtl8169_private *tp)
++{
++	rtl_set_def_aspm_entry_latency(tp);
++	rtl_hw_start_8125_common(tp);
++}
++
+ static void rtl_hw_start_8126a(struct rtl8169_private *tp)
+ {
+ 	rtl_set_def_aspm_entry_latency(tp);
+@@ -3923,6 +3930,7 @@ static void rtl_hw_config(struct rtl8169
+ 		[RTL_GIGA_MAC_VER_53] = rtl_hw_start_8117,
+ 		[RTL_GIGA_MAC_VER_61] = rtl_hw_start_8125a_2,
+ 		[RTL_GIGA_MAC_VER_63] = rtl_hw_start_8125b,
++		[RTL_GIGA_MAC_VER_64] = rtl_hw_start_8125d,
+ 		[RTL_GIGA_MAC_VER_65] = rtl_hw_start_8126a,
+ 		[RTL_GIGA_MAC_VER_66] = rtl_hw_start_8126a,
+ 	};
+@@ -3940,6 +3948,7 @@ static void rtl_hw_start_8125(struct rtl
+ 	/* disable interrupt coalescing */
+ 	switch (tp->mac_version) {
+ 	case RTL_GIGA_MAC_VER_61:
++	case RTL_GIGA_MAC_VER_64:
+ 		for (i = 0xa00; i < 0xb00; i += 4)
+ 			RTL_W32(tp, i, 0);
+ 		break;
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -1103,6 +1103,15 @@ static void rtl8125b_hw_phy_config(struc
+ 	rtl8125b_config_eee_phy(phydev);
+ }
+ 
++static void rtl8125d_hw_phy_config(struct rtl8169_private *tp,
++				   struct phy_device *phydev)
++{
++	r8169_apply_firmware(tp);
++	rtl8125_legacy_force_mode(phydev);
++	rtl8168g_disable_aldps(phydev);
++	rtl8125b_config_eee_phy(phydev);
++}
++
+ static void rtl8126a_hw_phy_config(struct rtl8169_private *tp,
+ 				   struct phy_device *phydev)
+ {
+@@ -1159,6 +1168,7 @@ void r8169_hw_phy_config(struct rtl8169_
+ 		[RTL_GIGA_MAC_VER_53] = rtl8117_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_61] = rtl8125a_2_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_63] = rtl8125b_hw_phy_config,
++		[RTL_GIGA_MAC_VER_64] = rtl8125d_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_65] = rtl8126a_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_66] = rtl8126a_hw_phy_config,
+ 	};
diff --git a/target/linux/generic/backport-6.6/780-34-v6.13-r8169-fix-inconsistent-indenting-in-rtl8169_get_eth_.patch b/target/linux/generic/backport-6.6/780-34-v6.13-r8169-fix-inconsistent-indenting-in-rtl8169_get_eth_.patch
new file mode 100644
index 00000000000000..2f65f066af1287
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-34-v6.13-r8169-fix-inconsistent-indenting-in-rtl8169_get_eth_.patch
@@ -0,0 +1,30 @@
+From b8bd8c44a266c9a7dcb907eab10fbb119e3f6494 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 24 Oct 2024 22:48:59 +0200
+Subject: [PATCH] r8169: fix inconsistent indenting in
+ rtl8169_get_eth_mac_stats
+
+This fixes an inconsistent indenting introduced with e3fc5139bd8f
+("r8169: implement additional ethtool stats ops").
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202410220413.1gAxIJ4t-lkp@intel.com/
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/20fd6f39-3c1b-4af0-9adc-7d1f49728fad@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -2226,7 +2226,7 @@ static void rtl8169_get_eth_mac_stats(st
+ 		le64_to_cpu(tp->counters->tx_broadcast64);
+ 	mac_stats->MulticastFramesReceivedOK =
+ 		le64_to_cpu(tp->counters->rx_multicast64);
+-	 mac_stats->FrameTooLongErrors =
++	mac_stats->FrameTooLongErrors =
+ 		le32_to_cpu(tp->counters->rx_frame_too_long);
+ }
+ 
diff --git a/target/linux/generic/backport-6.6/780-35-v6.13-r8169-align-RTL8125-EEE-config-with-vendor-driver.patch b/target/linux/generic/backport-6.6/780-35-v6.13-r8169-align-RTL8125-EEE-config-with-vendor-driver.patch
new file mode 100644
index 00000000000000..de2be0165c26e6
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-35-v6.13-r8169-align-RTL8125-EEE-config-with-vendor-driver.patch
@@ -0,0 +1,49 @@
+From eb90f876b7961d702d7fc549e14614860f531e60 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 31 Oct 2024 22:42:52 +0100
+Subject: [PATCH] r8169: align RTL8125 EEE config with vendor driver
+
+Align the EEE config for RTL8125A/RTL8125B with vendor driver r8125.
+This should help to avoid compatibility issues.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/044c925e-8669-4b98-87df-95b4056f4f5f@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ .../net/ethernet/realtek/r8169_phy_config.c    | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -89,19 +89,25 @@ static void rtl8168h_config_eee_phy(stru
+ 	phy_modify_paged(phydev, 0xa42, 0x14, 0x0000, 0x0080);
+ }
+ 
+-static void rtl8125a_config_eee_phy(struct phy_device *phydev)
++static void rtl8125_common_config_eee_phy(struct phy_device *phydev)
+ {
+-	rtl8168h_config_eee_phy(phydev);
++	phy_modify_paged(phydev, 0xa6d, 0x14, 0x0010, 0x0000);
++	phy_modify_paged(phydev, 0xa42, 0x14, 0x0080, 0x0000);
++	phy_modify_paged(phydev, 0xa4a, 0x11, 0x0200, 0x0000);
++}
+ 
++static void rtl8125a_config_eee_phy(struct phy_device *phydev)
++{
++	rtl8168g_config_eee_phy(phydev);
++	/* disable EEE at 2.5Gbps */
+ 	phy_modify_paged(phydev, 0xa6d, 0x12, 0x0001, 0x0000);
+-	phy_modify_paged(phydev, 0xa6d, 0x14, 0x0010, 0x0000);
++	rtl8125_common_config_eee_phy(phydev);
+ }
+ 
+ static void rtl8125b_config_eee_phy(struct phy_device *phydev)
+ {
+-	phy_modify_paged(phydev, 0xa6d, 0x14, 0x0010, 0x0000);
+-	phy_modify_paged(phydev, 0xa42, 0x14, 0x0080, 0x0000);
+-	phy_modify_paged(phydev, 0xa4a, 0x11, 0x0200, 0x0000);
++	rtl8168g_config_eee_phy(phydev);
++	rtl8125_common_config_eee_phy(phydev);
+ }
+ 
+ static void rtl8169s_hw_phy_config(struct rtl8169_private *tp,
diff --git a/target/linux/generic/backport-6.6/780-36-v6.13-r8169-align-RTL8125-RTL8126-PHY-config-with-vendor-d.patch b/target/linux/generic/backport-6.6/780-36-v6.13-r8169-align-RTL8125-RTL8126-PHY-config-with-vendor-d.patch
new file mode 100644
index 00000000000000..a546c426b4905a
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-36-v6.13-r8169-align-RTL8125-RTL8126-PHY-config-with-vendor-d.patch
@@ -0,0 +1,46 @@
+From 4af2f60bf7378bd5c92b15a528d8c6c7d02bed6c Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 31 Oct 2024 22:43:45 +0100
+Subject: [PATCH] r8169: align RTL8125/RTL8126 PHY config with vendor driver
+
+This aligns some parameters with vendor driver r8125/r8126 to avoid
+compatibility issues. Note that for RTL8125B there's no functional
+change, just the open-coded version of the function is replaced.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/a8a9d896-fbe6-41f2-bf87-666567d3cdb3@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_phy_config.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -1073,8 +1073,8 @@ static void rtl8125b_hw_phy_config(struc
+ 				   struct phy_device *phydev)
+ {
+ 	r8169_apply_firmware(tp);
++	rtl8168g_enable_gphy_10m(phydev);
+ 
+-	phy_modify_paged(phydev, 0xa44, 0x11, 0x0000, 0x0800);
+ 	phy_modify_paged(phydev, 0xac4, 0x13, 0x00f0, 0x0090);
+ 	phy_modify_paged(phydev, 0xad3, 0x10, 0x0003, 0x0001);
+ 
+@@ -1113,6 +1113,7 @@ static void rtl8125d_hw_phy_config(struc
+ 				   struct phy_device *phydev)
+ {
+ 	r8169_apply_firmware(tp);
++	rtl8168g_enable_gphy_10m(phydev);
+ 	rtl8125_legacy_force_mode(phydev);
+ 	rtl8168g_disable_aldps(phydev);
+ 	rtl8125b_config_eee_phy(phydev);
+@@ -1122,6 +1123,9 @@ static void rtl8126a_hw_phy_config(struc
+ 				   struct phy_device *phydev)
+ {
+ 	r8169_apply_firmware(tp);
++	rtl8168g_enable_gphy_10m(phydev);
++	rtl8125_legacy_force_mode(phydev);
++	rtl8168g_disable_aldps(phydev);
+ }
+ 
+ void r8169_hw_phy_config(struct rtl8169_private *tp, struct phy_device *phydev,
diff --git a/target/linux/generic/backport-6.6/780-37-v6.13-r8169-align-RTL8126-EEE-config-with-vendor-driver.patch b/target/linux/generic/backport-6.6/780-37-v6.13-r8169-align-RTL8126-EEE-config-with-vendor-driver.patch
new file mode 100644
index 00000000000000..36c8041c94e60e
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-37-v6.13-r8169-align-RTL8126-EEE-config-with-vendor-driver.patch
@@ -0,0 +1,25 @@
+From a3d8520e6a19ab018da6c7fc22512c913697a829 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 31 Oct 2024 22:44:36 +0100
+Subject: [PATCH] r8169: align RTL8126 EEE config with vendor driver
+
+Align the EEE config for RTL8126A with vendor driver r8126 to avoid
+compatibility issues.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/71e4859e-4cd0-4b6b-b7fa-621d7721992f@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_phy_config.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -1126,6 +1126,7 @@ static void rtl8126a_hw_phy_config(struc
+ 	rtl8168g_enable_gphy_10m(phydev);
+ 	rtl8125_legacy_force_mode(phydev);
+ 	rtl8168g_disable_aldps(phydev);
++	rtl8125_common_config_eee_phy(phydev);
+ }
+ 
+ void r8169_hw_phy_config(struct rtl8169_private *tp, struct phy_device *phydev,
diff --git a/target/linux/generic/backport-6.6/780-38-v6.13-r8169-improve-initialization-of-RSS-registers-on-RTL.patch b/target/linux/generic/backport-6.6/780-38-v6.13-r8169-improve-initialization-of-RSS-registers-on-RTL.patch
new file mode 100644
index 00000000000000..c2f6d755a5cb21
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-38-v6.13-r8169-improve-initialization-of-RSS-registers-on-RTL.patch
@@ -0,0 +1,38 @@
+From 2cd02f2fdd8a92e5b6b85ff64eab0fc549b30c07 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Sat, 2 Nov 2024 14:49:01 +0100
+Subject: [PATCH] r8169: improve initialization of RSS registers on
+ RTL8125/RTL8126
+
+Replace the register addresses with the names used in r8125/r8126
+vendor driver, and consider that RSS_CTRL_8125 is a 32 bit register.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/3bf2f340-b369-4174-97bf-fd38d4217492@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -346,6 +346,8 @@ enum rtl8125_registers {
+ 	TxPoll_8125		= 0x90,
+ 	LEDSEL3			= 0x96,
+ 	MAC0_BKP		= 0x19e0,
++	RSS_CTRL_8125		= 0x4500,
++	Q_NUM_CTRL_8125		= 0x4800,
+ 	EEE_TXIDLE_TIMER_8125	= 0x6048,
+ };
+ 
+@@ -3769,8 +3771,8 @@ static void rtl_hw_start_8125_common(str
+ 	rtl_pcie_state_l2l3_disable(tp);
+ 
+ 	RTL_W16(tp, 0x382, 0x221b);
+-	RTL_W8(tp, 0x4500, 0);
+-	RTL_W16(tp, 0x4800, 0);
++	RTL_W32(tp, RSS_CTRL_8125, 0);
++	RTL_W16(tp, Q_NUM_CTRL_8125, 0);
+ 
+ 	/* disable UPS */
+ 	r8168_mac_ocp_modify(tp, 0xd40a, 0x0010, 0x0000);
diff --git a/target/linux/generic/backport-6.6/780-39-v6.13-r8169-remove-leftover-locks-after-reverted-change.patch b/target/linux/generic/backport-6.6/780-39-v6.13-r8169-remove-leftover-locks-after-reverted-change.patch
new file mode 100644
index 00000000000000..90b7c8c7678a31
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-39-v6.13-r8169-remove-leftover-locks-after-reverted-change.patch
@@ -0,0 +1,113 @@
+From 83cb4b470c66b37b19a347a35cea01e0cbdd258d Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Mon, 4 Nov 2024 23:16:20 +0100
+Subject: [PATCH] r8169: remove leftover locks after reverted change
+
+After e31a9fedc7d8 ("Revert "r8169: disable ASPM during NAPI poll"")
+these locks aren't needed any longer.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/680f2606-ac7d-4ced-8694-e5033855da9b@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 29 ++---------------------
+ 1 file changed, 2 insertions(+), 27 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -662,13 +662,9 @@ struct rtl8169_private {
+ 		struct work_struct work;
+ 	} wk;
+ 
+-	raw_spinlock_t config25_lock;
+ 	raw_spinlock_t mac_ocp_lock;
+ 	struct mutex led_lock;	/* serialize LED ctrl RMW access */
+ 
+-	raw_spinlock_t cfg9346_usage_lock;
+-	int cfg9346_usage_count;
+-
+ 	unsigned supports_gmii:1;
+ 	unsigned aspm_manageable:1;
+ 	unsigned dash_enabled:1;
+@@ -722,22 +718,12 @@ static inline struct device *tp_to_dev(s
+ 
+ static void rtl_lock_config_regs(struct rtl8169_private *tp)
+ {
+-	unsigned long flags;
+-
+-	raw_spin_lock_irqsave(&tp->cfg9346_usage_lock, flags);
+-	if (!--tp->cfg9346_usage_count)
+-		RTL_W8(tp, Cfg9346, Cfg9346_Lock);
+-	raw_spin_unlock_irqrestore(&tp->cfg9346_usage_lock, flags);
++	RTL_W8(tp, Cfg9346, Cfg9346_Lock);
+ }
+ 
+ static void rtl_unlock_config_regs(struct rtl8169_private *tp)
+ {
+-	unsigned long flags;
+-
+-	raw_spin_lock_irqsave(&tp->cfg9346_usage_lock, flags);
+-	if (!tp->cfg9346_usage_count++)
+-		RTL_W8(tp, Cfg9346, Cfg9346_Unlock);
+-	raw_spin_unlock_irqrestore(&tp->cfg9346_usage_lock, flags);
++	RTL_W8(tp, Cfg9346, Cfg9346_Unlock);
+ }
+ 
+ static void rtl_pci_commit(struct rtl8169_private *tp)
+@@ -748,24 +734,18 @@ static void rtl_pci_commit(struct rtl816
+ 
+ static void rtl_mod_config2(struct rtl8169_private *tp, u8 clear, u8 set)
+ {
+-	unsigned long flags;
+ 	u8 val;
+ 
+-	raw_spin_lock_irqsave(&tp->config25_lock, flags);
+ 	val = RTL_R8(tp, Config2);
+ 	RTL_W8(tp, Config2, (val & ~clear) | set);
+-	raw_spin_unlock_irqrestore(&tp->config25_lock, flags);
+ }
+ 
+ static void rtl_mod_config5(struct rtl8169_private *tp, u8 clear, u8 set)
+ {
+-	unsigned long flags;
+ 	u8 val;
+ 
+-	raw_spin_lock_irqsave(&tp->config25_lock, flags);
+ 	val = RTL_R8(tp, Config5);
+ 	RTL_W8(tp, Config5, (val & ~clear) | set);
+-	raw_spin_unlock_irqrestore(&tp->config25_lock, flags);
+ }
+ 
+ static bool rtl_is_8125(struct rtl8169_private *tp)
+@@ -1571,7 +1551,6 @@ static void __rtl8169_set_wol(struct rtl
+ 		{ WAKE_MAGIC, Config3, MagicPacket }
+ 	};
+ 	unsigned int i, tmp = ARRAY_SIZE(cfg);
+-	unsigned long flags;
+ 	u8 options;
+ 
+ 	rtl_unlock_config_regs(tp);
+@@ -1590,14 +1569,12 @@ static void __rtl8169_set_wol(struct rtl
+ 			r8168_mac_ocp_modify(tp, 0xc0b6, BIT(0), 0);
+ 	}
+ 
+-	raw_spin_lock_irqsave(&tp->config25_lock, flags);
+ 	for (i = 0; i < tmp; i++) {
+ 		options = RTL_R8(tp, cfg[i].reg) & ~cfg[i].mask;
+ 		if (wolopts & cfg[i].opt)
+ 			options |= cfg[i].mask;
+ 		RTL_W8(tp, cfg[i].reg, options);
+ 	}
+-	raw_spin_unlock_irqrestore(&tp->config25_lock, flags);
+ 
+ 	switch (tp->mac_version) {
+ 	case RTL_GIGA_MAC_VER_02 ... RTL_GIGA_MAC_VER_06:
+@@ -5461,8 +5438,6 @@ static int rtl_init_one(struct pci_dev *
+ 	tp->supports_gmii = ent->driver_data == RTL_CFG_NO_GBIT ? 0 : 1;
+ 	tp->ocp_base = OCP_STD_PHY_BASE;
+ 
+-	raw_spin_lock_init(&tp->cfg9346_usage_lock);
+-	raw_spin_lock_init(&tp->config25_lock);
+ 	raw_spin_lock_init(&tp->mac_ocp_lock);
+ 	mutex_init(&tp->led_lock);
+ 
diff --git a/target/linux/generic/backport-6.6/780-40-v6.13-r8169-improve-__rtl8169_set_wol.patch b/target/linux/generic/backport-6.6/780-40-v6.13-r8169-improve-__rtl8169_set_wol.patch
new file mode 100644
index 00000000000000..e468d637c93815
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-40-v6.13-r8169-improve-__rtl8169_set_wol.patch
@@ -0,0 +1,108 @@
+From c507e96b5763b36b63ad50ad804341f72ea000e4 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 6 Nov 2024 17:55:45 +0100
+Subject: [PATCH] r8169: improve __rtl8169_set_wol
+
+Add helper r8169_mod_reg8_cond() what allows to significantly simplify
+__rtl8169_set_wol().
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/697b197a-8eac-40c6-8847-27093cacec36@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 55 ++++++++++-------------
+ 1 file changed, 24 insertions(+), 31 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -748,6 +748,20 @@ static void rtl_mod_config5(struct rtl81
+ 	RTL_W8(tp, Config5, (val & ~clear) | set);
+ }
+ 
++static void r8169_mod_reg8_cond(struct rtl8169_private *tp, int reg,
++				u8 bits, bool cond)
++{
++	u8 val, old_val;
++
++	old_val = RTL_R8(tp, reg);
++	if (cond)
++		val = old_val | bits;
++	else
++		val = old_val & ~bits;
++	if (val != old_val)
++		RTL_W8(tp, reg, val);
++}
++
+ static bool rtl_is_8125(struct rtl8169_private *tp)
+ {
+ 	return tp->mac_version >= RTL_GIGA_MAC_VER_61;
+@@ -1538,58 +1552,37 @@ static void rtl8169_get_wol(struct net_d
+ 
+ static void __rtl8169_set_wol(struct rtl8169_private *tp, u32 wolopts)
+ {
+-	static const struct {
+-		u32 opt;
+-		u16 reg;
+-		u8  mask;
+-	} cfg[] = {
+-		{ WAKE_PHY,   Config3, LinkUp },
+-		{ WAKE_UCAST, Config5, UWF },
+-		{ WAKE_BCAST, Config5, BWF },
+-		{ WAKE_MCAST, Config5, MWF },
+-		{ WAKE_ANY,   Config5, LanWake },
+-		{ WAKE_MAGIC, Config3, MagicPacket }
+-	};
+-	unsigned int i, tmp = ARRAY_SIZE(cfg);
+-	u8 options;
+-
+ 	rtl_unlock_config_regs(tp);
+ 
+ 	if (rtl_is_8168evl_up(tp)) {
+-		tmp--;
+ 		if (wolopts & WAKE_MAGIC)
+ 			rtl_eri_set_bits(tp, 0x0dc, MagicPacket_v2);
+ 		else
+ 			rtl_eri_clear_bits(tp, 0x0dc, MagicPacket_v2);
+ 	} else if (rtl_is_8125(tp)) {
+-		tmp--;
+ 		if (wolopts & WAKE_MAGIC)
+ 			r8168_mac_ocp_modify(tp, 0xc0b6, 0, BIT(0));
+ 		else
+ 			r8168_mac_ocp_modify(tp, 0xc0b6, BIT(0), 0);
++	} else {
++		r8169_mod_reg8_cond(tp, Config3, MagicPacket,
++				    wolopts & WAKE_MAGIC);
+ 	}
+ 
+-	for (i = 0; i < tmp; i++) {
+-		options = RTL_R8(tp, cfg[i].reg) & ~cfg[i].mask;
+-		if (wolopts & cfg[i].opt)
+-			options |= cfg[i].mask;
+-		RTL_W8(tp, cfg[i].reg, options);
+-	}
++	r8169_mod_reg8_cond(tp, Config3, LinkUp, wolopts & WAKE_PHY);
++	r8169_mod_reg8_cond(tp, Config5, UWF, wolopts & WAKE_UCAST);
++	r8169_mod_reg8_cond(tp, Config5, BWF, wolopts & WAKE_BCAST);
++	r8169_mod_reg8_cond(tp, Config5, MWF, wolopts & WAKE_MCAST);
++	r8169_mod_reg8_cond(tp, Config5, LanWake, wolopts);
+ 
+ 	switch (tp->mac_version) {
+ 	case RTL_GIGA_MAC_VER_02 ... RTL_GIGA_MAC_VER_06:
+-		options = RTL_R8(tp, Config1) & ~PMEnable;
+-		if (wolopts)
+-			options |= PMEnable;
+-		RTL_W8(tp, Config1, options);
++		r8169_mod_reg8_cond(tp, Config1, PMEnable, wolopts);
+ 		break;
+ 	case RTL_GIGA_MAC_VER_34:
+ 	case RTL_GIGA_MAC_VER_37:
+ 	case RTL_GIGA_MAC_VER_39 ... RTL_GIGA_MAC_VER_66:
+-		if (wolopts)
+-			rtl_mod_config2(tp, 0, PME_SIGNAL);
+-		else
+-			rtl_mod_config2(tp, PME_SIGNAL, 0);
++		r8169_mod_reg8_cond(tp, Config2, PME_SIGNAL, wolopts);
+ 		break;
+ 	default:
+ 		break;
diff --git a/target/linux/generic/backport-6.6/780-41-v6.13-r8169-improve-rtl_set_d3_pll_down.patch b/target/linux/generic/backport-6.6/780-41-v6.13-r8169-improve-rtl_set_d3_pll_down.patch
new file mode 100644
index 00000000000000..aeafebb2140500
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-41-v6.13-r8169-improve-rtl_set_d3_pll_down.patch
@@ -0,0 +1,44 @@
+From 330dc2297c82953dff402e0b4176a5383a618538 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 6 Nov 2024 17:56:28 +0100
+Subject: [PATCH] r8169: improve rtl_set_d3_pll_down
+
+Make use of new helper r8169_mod_reg8_cond() and move from a switch()
+to an if() clause. Benefit is that we don't have to touch this piece of
+code each time support for a new chip version is added.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/e1ccdb85-a4ed-4800-89c2-89770ff06452@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 18 +++++-------------
+ 1 file changed, 5 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -1431,19 +1431,11 @@ static enum rtl_dash_type rtl_get_dash_t
+ 
+ static void rtl_set_d3_pll_down(struct rtl8169_private *tp, bool enable)
+ {
+-	switch (tp->mac_version) {
+-	case RTL_GIGA_MAC_VER_25 ... RTL_GIGA_MAC_VER_26:
+-	case RTL_GIGA_MAC_VER_29 ... RTL_GIGA_MAC_VER_30:
+-	case RTL_GIGA_MAC_VER_32 ... RTL_GIGA_MAC_VER_37:
+-	case RTL_GIGA_MAC_VER_39 ... RTL_GIGA_MAC_VER_66:
+-		if (enable)
+-			RTL_W8(tp, PMCH, RTL_R8(tp, PMCH) & ~D3_NO_PLL_DOWN);
+-		else
+-			RTL_W8(tp, PMCH, RTL_R8(tp, PMCH) | D3_NO_PLL_DOWN);
+-		break;
+-	default:
+-		break;
+-	}
++	if (tp->mac_version >= RTL_GIGA_MAC_VER_25 &&
++	    tp->mac_version != RTL_GIGA_MAC_VER_28 &&
++	    tp->mac_version != RTL_GIGA_MAC_VER_31 &&
++	    tp->mac_version != RTL_GIGA_MAC_VER_38)
++		r8169_mod_reg8_cond(tp, PMCH, D3_NO_PLL_DOWN, !enable);
+ }
+ 
+ static void rtl_reset_packet_filter(struct rtl8169_private *tp)
diff --git a/target/linux/generic/backport-6.6/780-42-v6.13-r8169-align-WAKE_PHY-handling-with-r8125-r8126-vendo.patch b/target/linux/generic/backport-6.6/780-42-v6.13-r8169-align-WAKE_PHY-handling-with-r8125-r8126-vendo.patch
new file mode 100644
index 00000000000000..26c362dd6ca260
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-42-v6.13-r8169-align-WAKE_PHY-handling-with-r8125-r8126-vendo.patch
@@ -0,0 +1,29 @@
+From e3e9e9039fa6ae885c7d5c954d7b9f105fa23e8f Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 6 Nov 2024 17:57:08 +0100
+Subject: [PATCH] r8169: align WAKE_PHY handling with r8125/r8126 vendor
+ drivers
+
+Vendor drivers r8125/r8126 apply this additional magic setting when
+enabling WAKE_PHY, so do the same here.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/51130715-45be-4db5-abb7-05d87e1f5df9@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -1562,6 +1562,9 @@ static void __rtl8169_set_wol(struct rtl
+ 	}
+ 
+ 	r8169_mod_reg8_cond(tp, Config3, LinkUp, wolopts & WAKE_PHY);
++	if (rtl_is_8125(tp))
++		r8168_mac_ocp_modify(tp, 0xe0c6, 0x3f,
++				     wolopts & WAKE_PHY ? 0x13 : 0);
+ 	r8169_mod_reg8_cond(tp, Config5, UWF, wolopts & WAKE_UCAST);
+ 	r8169_mod_reg8_cond(tp, Config5, BWF, wolopts & WAKE_BCAST);
+ 	r8169_mod_reg8_cond(tp, Config5, MWF, wolopts & WAKE_MCAST);
diff --git a/target/linux/generic/backport-6.6/780-43-v6.13-r8169-use-helper-r8169_mod_reg8_cond-to-simplify-rtl.patch b/target/linux/generic/backport-6.6/780-43-v6.13-r8169-use-helper-r8169_mod_reg8_cond-to-simplify-rtl.patch
new file mode 100644
index 00000000000000..bdeb46eeb85146
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-43-v6.13-r8169-use-helper-r8169_mod_reg8_cond-to-simplify-rtl.patch
@@ -0,0 +1,117 @@
+From 7a3bcd39ae1f0e3ab896d9df62339ab4297a0bfd Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Sat, 9 Nov 2024 23:12:12 +0100
+Subject: [PATCH] r8169: use helper r8169_mod_reg8_cond to simplify
+ rtl_jumbo_config
+
+Use recently added helper r8169_mod_reg8_cond() to simplify jumbo
+mode configuration.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/3df1d484-a02e-46e7-8f75-db5b428e422e@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 77 ++++-------------------
+ 1 file changed, 11 insertions(+), 66 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -2546,86 +2546,31 @@ static void rtl8169_init_ring_indexes(st
+ 	tp->dirty_tx = tp->cur_tx = tp->cur_rx = 0;
+ }
+ 
+-static void r8168c_hw_jumbo_enable(struct rtl8169_private *tp)
+-{
+-	RTL_W8(tp, Config3, RTL_R8(tp, Config3) | Jumbo_En0);
+-	RTL_W8(tp, Config4, RTL_R8(tp, Config4) | Jumbo_En1);
+-}
+-
+-static void r8168c_hw_jumbo_disable(struct rtl8169_private *tp)
+-{
+-	RTL_W8(tp, Config3, RTL_R8(tp, Config3) & ~Jumbo_En0);
+-	RTL_W8(tp, Config4, RTL_R8(tp, Config4) & ~Jumbo_En1);
+-}
+-
+-static void r8168dp_hw_jumbo_enable(struct rtl8169_private *tp)
+-{
+-	RTL_W8(tp, Config3, RTL_R8(tp, Config3) | Jumbo_En0);
+-}
+-
+-static void r8168dp_hw_jumbo_disable(struct rtl8169_private *tp)
+-{
+-	RTL_W8(tp, Config3, RTL_R8(tp, Config3) & ~Jumbo_En0);
+-}
+-
+-static void r8168e_hw_jumbo_enable(struct rtl8169_private *tp)
+-{
+-	RTL_W8(tp, MaxTxPacketSize, 0x24);
+-	RTL_W8(tp, Config3, RTL_R8(tp, Config3) | Jumbo_En0);
+-	RTL_W8(tp, Config4, RTL_R8(tp, Config4) | 0x01);
+-}
+-
+-static void r8168e_hw_jumbo_disable(struct rtl8169_private *tp)
+-{
+-	RTL_W8(tp, MaxTxPacketSize, 0x3f);
+-	RTL_W8(tp, Config3, RTL_R8(tp, Config3) & ~Jumbo_En0);
+-	RTL_W8(tp, Config4, RTL_R8(tp, Config4) & ~0x01);
+-}
+-
+-static void r8168b_1_hw_jumbo_enable(struct rtl8169_private *tp)
+-{
+-	RTL_W8(tp, Config4, RTL_R8(tp, Config4) | (1 << 0));
+-}
+-
+-static void r8168b_1_hw_jumbo_disable(struct rtl8169_private *tp)
+-{
+-	RTL_W8(tp, Config4, RTL_R8(tp, Config4) & ~(1 << 0));
+-}
+-
+ static void rtl_jumbo_config(struct rtl8169_private *tp)
+ {
+ 	bool jumbo = tp->dev->mtu > ETH_DATA_LEN;
+ 	int readrq = 4096;
+ 
++	if (jumbo && tp->mac_version >= RTL_GIGA_MAC_VER_17 &&
++	    tp->mac_version <= RTL_GIGA_MAC_VER_26)
++		readrq = 512;
++
+ 	rtl_unlock_config_regs(tp);
+ 	switch (tp->mac_version) {
+ 	case RTL_GIGA_MAC_VER_17:
+-		if (jumbo) {
+-			readrq = 512;
+-			r8168b_1_hw_jumbo_enable(tp);
+-		} else {
+-			r8168b_1_hw_jumbo_disable(tp);
+-		}
++		r8169_mod_reg8_cond(tp, Config4, BIT(0), jumbo);
+ 		break;
+ 	case RTL_GIGA_MAC_VER_18 ... RTL_GIGA_MAC_VER_26:
+-		if (jumbo) {
+-			readrq = 512;
+-			r8168c_hw_jumbo_enable(tp);
+-		} else {
+-			r8168c_hw_jumbo_disable(tp);
+-		}
++		r8169_mod_reg8_cond(tp, Config3, Jumbo_En0, jumbo);
++		r8169_mod_reg8_cond(tp, Config4, Jumbo_En1, jumbo);
+ 		break;
+ 	case RTL_GIGA_MAC_VER_28:
+-		if (jumbo)
+-			r8168dp_hw_jumbo_enable(tp);
+-		else
+-			r8168dp_hw_jumbo_disable(tp);
++		r8169_mod_reg8_cond(tp, Config3, Jumbo_En0, jumbo);
+ 		break;
+ 	case RTL_GIGA_MAC_VER_31 ... RTL_GIGA_MAC_VER_33:
+-		if (jumbo)
+-			r8168e_hw_jumbo_enable(tp);
+-		else
+-			r8168e_hw_jumbo_disable(tp);
++		RTL_W8(tp, MaxTxPacketSize, jumbo ? 0x24 : 0x3f);
++		r8169_mod_reg8_cond(tp, Config3, Jumbo_En0, jumbo);
++		r8169_mod_reg8_cond(tp, Config4, BIT(0), jumbo);
+ 		break;
+ 	default:
+ 		break;
diff --git a/target/linux/generic/backport-6.6/780-44-v6.13-r8169-copy-vendor-driver-2.5G-5G-EEE-advertisement-c.patch b/target/linux/generic/backport-6.6/780-44-v6.13-r8169-copy-vendor-driver-2.5G-5G-EEE-advertisement-c.patch
new file mode 100644
index 00000000000000..6da3bf59a864c2
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-44-v6.13-r8169-copy-vendor-driver-2.5G-5G-EEE-advertisement-c.patch
@@ -0,0 +1,82 @@
+From e340bff27e63ed61a1e9895bed546107859e48a7 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Fri, 8 Nov 2024 08:08:24 +0100
+Subject: [PATCH] r8169: copy vendor driver 2.5G/5G EEE advertisement
+ constraints
+
+Vendor driver r8125 doesn't advertise 2.5G EEE on RTL8125A, and r8126
+doesn't advertise 5G EEE. Likely there are compatibility issues,
+therefore do the same in r8169.
+With this change we don't have to disable 2.5G EEE advertisement in
+rtl8125a_config_eee_phy() any longer.
+We use new phylib accessor phy_set_eee_broken() to mark the respective
+EEE modes as broken.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/ce185e10-8a2f-4cf8-a49b-fd8fb3c3c8a1@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c       |  6 ++++++
+ drivers/net/ethernet/realtek/r8169_phy_config.c | 16 ++++------------
+ 2 files changed, 10 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -5237,6 +5237,11 @@ static int r8169_mdio_register(struct rt
+ 			      tp->phydev->supported_eee);
+ 	phy_support_asym_pause(tp->phydev);
+ 
++	/* mimic behavior of r8125/r8126 vendor drivers */
++	if (tp->mac_version == RTL_GIGA_MAC_VER_61)
++		tp->phydev->eee_broken_modes |= MDIO_EEE_2_5GT;
++	tp->phydev->eee_broken_modes |= MDIO_EEE_5GT;
++
+ 	/* PHY will be woken up in rtl_open() */
+ 	phy_suspend(tp->phydev);
+ 
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -96,15 +96,7 @@ static void rtl8125_common_config_eee_ph
+ 	phy_modify_paged(phydev, 0xa4a, 0x11, 0x0200, 0x0000);
+ }
+ 
+-static void rtl8125a_config_eee_phy(struct phy_device *phydev)
+-{
+-	rtl8168g_config_eee_phy(phydev);
+-	/* disable EEE at 2.5Gbps */
+-	phy_modify_paged(phydev, 0xa6d, 0x12, 0x0001, 0x0000);
+-	rtl8125_common_config_eee_phy(phydev);
+-}
+-
+-static void rtl8125b_config_eee_phy(struct phy_device *phydev)
++static void rtl8125_config_eee_phy(struct phy_device *phydev)
+ {
+ 	rtl8168g_config_eee_phy(phydev);
+ 	rtl8125_common_config_eee_phy(phydev);
+@@ -1066,7 +1058,7 @@ static void rtl8125a_2_hw_phy_config(str
+ 	rtl8168g_enable_gphy_10m(phydev);
+ 
+ 	rtl8168g_disable_aldps(phydev);
+-	rtl8125a_config_eee_phy(phydev);
++	rtl8125_config_eee_phy(phydev);
+ }
+ 
+ static void rtl8125b_hw_phy_config(struct rtl8169_private *tp,
+@@ -1106,7 +1098,7 @@ static void rtl8125b_hw_phy_config(struc
+ 
+ 	rtl8125_legacy_force_mode(phydev);
+ 	rtl8168g_disable_aldps(phydev);
+-	rtl8125b_config_eee_phy(phydev);
++	rtl8125_config_eee_phy(phydev);
+ }
+ 
+ static void rtl8125d_hw_phy_config(struct rtl8169_private *tp,
+@@ -1116,7 +1108,7 @@ static void rtl8125d_hw_phy_config(struc
+ 	rtl8168g_enable_gphy_10m(phydev);
+ 	rtl8125_legacy_force_mode(phydev);
+ 	rtl8168g_disable_aldps(phydev);
+-	rtl8125b_config_eee_phy(phydev);
++	rtl8125_config_eee_phy(phydev);
+ }
+ 
+ static void rtl8126a_hw_phy_config(struct rtl8169_private *tp,
diff --git a/target/linux/generic/backport-6.6/780-45-v6.14-r8169-remove-unused-flag-RTL_FLAG_TASK_RESET_NO_QUEU.patch b/target/linux/generic/backport-6.6/780-45-v6.14-r8169-remove-unused-flag-RTL_FLAG_TASK_RESET_NO_QUEU.patch
new file mode 100644
index 00000000000000..476f7a576044e3
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-45-v6.14-r8169-remove-unused-flag-RTL_FLAG_TASK_RESET_NO_QUEU.patch
@@ -0,0 +1,35 @@
+From 2e20bf8cc05766dcd0357cdfcada49e1bc45512b Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Mon, 2 Dec 2024 21:14:35 +0100
+Subject: [PATCH] r8169: remove unused flag RTL_FLAG_TASK_RESET_NO_QUEUE_WAKE
+
+After 854d71c555dfc3 ("r8169: remove original workaround for RTL8125
+broken rx issue") this flag isn't used any longer. So remove it.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Link: https://patch.msgid.link/d9dd214b-3027-4f60-b0e8-6f34a0c76582@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 3 ---
+ 1 file changed, 3 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -623,7 +623,6 @@ struct rtl8169_tc_offsets {
+ enum rtl_flag {
+ 	RTL_FLAG_TASK_ENABLED = 0,
+ 	RTL_FLAG_TASK_RESET_PENDING,
+-	RTL_FLAG_TASK_RESET_NO_QUEUE_WAKE,
+ 	RTL_FLAG_TASK_TX_TIMEOUT,
+ 	RTL_FLAG_MAX
+ };
+@@ -4729,8 +4728,6 @@ static void rtl_task(struct work_struct
+ reset:
+ 		rtl_reset_work(tp);
+ 		netif_wake_queue(tp->dev);
+-	} else if (test_and_clear_bit(RTL_FLAG_TASK_RESET_NO_QUEUE_WAKE, tp->wk.flags)) {
+-		rtl_reset_work(tp);
+ 	}
+ }
+ 
diff --git a/target/linux/generic/backport-6.6/780-46-v6.14-r8169-remove-support-for-chip-version-11.patch b/target/linux/generic/backport-6.6/780-46-v6.14-r8169-remove-support-for-chip-version-11.patch
new file mode 100644
index 00000000000000..e4af737edc5061
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-46-v6.14-r8169-remove-support-for-chip-version-11.patch
@@ -0,0 +1,114 @@
+From bb18265c3aba92b91a1355609769f3e967b65dee Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Mon, 2 Dec 2024 21:20:02 +0100
+Subject: [PATCH] r8169: remove support for chip version 11
+
+This is a follow-up to 982300c115d2 ("r8169: remove detection of chip
+version 11 (early RTL8168b)"). Nobody complained yet, so remove
+support for this chip version.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/b689ab6d-20b5-4b64-bd7e-531a0a972ba3@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169.h            |  2 +-
+ drivers/net/ethernet/realtek/r8169_main.c       | 14 +-------------
+ drivers/net/ethernet/realtek/r8169_phy_config.c | 10 ----------
+ 3 files changed, 2 insertions(+), 24 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169.h
++++ b/drivers/net/ethernet/realtek/r8169.h
+@@ -23,7 +23,7 @@ enum mac_version {
+ 	RTL_GIGA_MAC_VER_08,
+ 	RTL_GIGA_MAC_VER_09,
+ 	RTL_GIGA_MAC_VER_10,
+-	RTL_GIGA_MAC_VER_11,
++	/* support for RTL_GIGA_MAC_VER_11 has been removed */
+ 	/* RTL_GIGA_MAC_VER_12 was handled the same as VER_17 */
+ 	/* RTL_GIGA_MAC_VER_13 was merged with VER_10 */
+ 	RTL_GIGA_MAC_VER_14,
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -103,7 +103,6 @@ static const struct {
+ 	[RTL_GIGA_MAC_VER_08] = {"RTL8102e"				},
+ 	[RTL_GIGA_MAC_VER_09] = {"RTL8102e/RTL8103e"			},
+ 	[RTL_GIGA_MAC_VER_10] = {"RTL8101e/RTL8100e"			},
+-	[RTL_GIGA_MAC_VER_11] = {"RTL8168b/8111b"			},
+ 	[RTL_GIGA_MAC_VER_14] = {"RTL8401"				},
+ 	[RTL_GIGA_MAC_VER_17] = {"RTL8168b/8111b"			},
+ 	[RTL_GIGA_MAC_VER_18] = {"RTL8168cp/8111cp"			},
+@@ -2336,7 +2335,7 @@ static enum mac_version rtl8169_get_mac_
+ 
+ 		/* 8168B family. */
+ 		{ 0x7c8, 0x380,	RTL_GIGA_MAC_VER_17 },
+-		/* This one is very old and rare, let's see if anybody complains.
++		/* This one is very old and rare, support has been removed.
+ 		 * { 0x7c8, 0x300,	RTL_GIGA_MAC_VER_11 },
+ 		 */
+ 
+@@ -3806,7 +3805,6 @@ static void rtl_hw_config(struct rtl8169
+ 		[RTL_GIGA_MAC_VER_08] = rtl_hw_start_8102e_3,
+ 		[RTL_GIGA_MAC_VER_09] = rtl_hw_start_8102e_2,
+ 		[RTL_GIGA_MAC_VER_10] = NULL,
+-		[RTL_GIGA_MAC_VER_11] = rtl_hw_start_8168b,
+ 		[RTL_GIGA_MAC_VER_14] = rtl_hw_start_8401,
+ 		[RTL_GIGA_MAC_VER_17] = rtl_hw_start_8168b,
+ 		[RTL_GIGA_MAC_VER_18] = rtl_hw_start_8168cp_1,
+@@ -4682,12 +4680,6 @@ static irqreturn_t rtl8169_interrupt(int
+ 	if (status & LinkChg)
+ 		phy_mac_interrupt(tp->phydev);
+ 
+-	if (unlikely(status & RxFIFOOver &&
+-	    tp->mac_version == RTL_GIGA_MAC_VER_11)) {
+-		netif_stop_queue(tp->dev);
+-		rtl_schedule_task(tp, RTL_FLAG_TASK_RESET_PENDING);
+-	}
+-
+ 	rtl_irq_disable(tp);
+ 	napi_schedule(&tp->napi);
+ out:
+@@ -5107,9 +5099,6 @@ static void rtl_set_irq_mask(struct rtl8
+ 
+ 	if (tp->mac_version <= RTL_GIGA_MAC_VER_06)
+ 		tp->irq_mask |= SYSErr | RxFIFOOver;
+-	else if (tp->mac_version == RTL_GIGA_MAC_VER_11)
+-		/* special workaround needed */
+-		tp->irq_mask |= RxFIFOOver;
+ }
+ 
+ static int rtl_alloc_irq(struct rtl8169_private *tp)
+@@ -5305,7 +5294,6 @@ static int rtl_jumbo_max(struct rtl8169_
+ 	case RTL_GIGA_MAC_VER_02 ... RTL_GIGA_MAC_VER_06:
+ 		return JUMBO_7K;
+ 	/* RTL8168b */
+-	case RTL_GIGA_MAC_VER_11:
+ 	case RTL_GIGA_MAC_VER_17:
+ 		return JUMBO_4K;
+ 	/* RTL8168c */
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -276,15 +276,6 @@ static void rtl8169sce_hw_phy_config(str
+ 	rtl_writephy_batch(phydev, phy_reg_init);
+ }
+ 
+-static void rtl8168bb_hw_phy_config(struct rtl8169_private *tp,
+-				    struct phy_device *phydev)
+-{
+-	phy_write(phydev, 0x1f, 0x0001);
+-	phy_set_bits(phydev, 0x16, BIT(0));
+-	phy_write(phydev, 0x10, 0xf41b);
+-	phy_write(phydev, 0x1f, 0x0000);
+-}
+-
+ static void rtl8168bef_hw_phy_config(struct rtl8169_private *tp,
+ 				     struct phy_device *phydev)
+ {
+@@ -1136,7 +1127,6 @@ void r8169_hw_phy_config(struct rtl8169_
+ 		[RTL_GIGA_MAC_VER_08] = rtl8102e_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_09] = rtl8102e_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_10] = NULL,
+-		[RTL_GIGA_MAC_VER_11] = rtl8168bb_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_14] = rtl8401_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_17] = rtl8168bef_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_18] = rtl8168cp_1_hw_phy_config,
diff --git a/target/linux/generic/backport-6.6/780-47-v6.14-r8169-adjust-version-numbering-for-RTL8126.patch b/target/linux/generic/backport-6.6/780-47-v6.14-r8169-adjust-version-numbering-for-RTL8126.patch
new file mode 100644
index 00000000000000..8c30506904ad3f
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-47-v6.14-r8169-adjust-version-numbering-for-RTL8126.patch
@@ -0,0 +1,257 @@
+From b299ea0069284186b0d3d54aebe87f0d195d457a Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Fri, 13 Dec 2024 20:01:41 +0100
+Subject: [PATCH] r8169: adjust version numbering for RTL8126
+
+Adjust version numbering for RTL8126, so that it doesn't overlap with
+new RTL8125 versions.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/6a354364-20e9-48ad-a198-468264288757@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169.h          |  4 +-
+ drivers/net/ethernet/realtek/r8169_main.c     | 62 +++++++++----------
+ .../net/ethernet/realtek/r8169_phy_config.c   |  4 +-
+ 3 files changed, 35 insertions(+), 35 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169.h
++++ b/drivers/net/ethernet/realtek/r8169.h
+@@ -69,8 +69,8 @@ enum mac_version {
+ 	RTL_GIGA_MAC_VER_61,
+ 	RTL_GIGA_MAC_VER_63,
+ 	RTL_GIGA_MAC_VER_64,
+-	RTL_GIGA_MAC_VER_65,
+-	RTL_GIGA_MAC_VER_66,
++	RTL_GIGA_MAC_VER_70,
++	RTL_GIGA_MAC_VER_71,
+ 	RTL_GIGA_MAC_NONE
+ };
+ 
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -139,8 +139,8 @@ static const struct {
+ 	/* reserve 62 for CFG_METHOD_4 in the vendor driver */
+ 	[RTL_GIGA_MAC_VER_63] = {"RTL8125B",		FIRMWARE_8125B_2},
+ 	[RTL_GIGA_MAC_VER_64] = {"RTL8125D",		FIRMWARE_8125D_1},
+-	[RTL_GIGA_MAC_VER_65] = {"RTL8126A",		FIRMWARE_8126A_2},
+-	[RTL_GIGA_MAC_VER_66] = {"RTL8126A",		FIRMWARE_8126A_3},
++	[RTL_GIGA_MAC_VER_70] = {"RTL8126A",		FIRMWARE_8126A_2},
++	[RTL_GIGA_MAC_VER_71] = {"RTL8126A",		FIRMWARE_8126A_3},
+ };
+ 
+ static const struct pci_device_id rtl8169_pci_tbl[] = {
+@@ -1228,7 +1228,7 @@ static void rtl_writephy(struct rtl8169_
+ 	case RTL_GIGA_MAC_VER_31:
+ 		r8168dp_2_mdio_write(tp, location, val);
+ 		break;
+-	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_71:
+ 		r8168g_mdio_write(tp, location, val);
+ 		break;
+ 	default:
+@@ -1243,7 +1243,7 @@ static int rtl_readphy(struct rtl8169_pr
+ 	case RTL_GIGA_MAC_VER_28:
+ 	case RTL_GIGA_MAC_VER_31:
+ 		return r8168dp_2_mdio_read(tp, location);
+-	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_71:
+ 		return r8168g_mdio_read(tp, location);
+ 	default:
+ 		return r8169_mdio_read(tp, location);
+@@ -1574,7 +1574,7 @@ static void __rtl8169_set_wol(struct rtl
+ 		break;
+ 	case RTL_GIGA_MAC_VER_34:
+ 	case RTL_GIGA_MAC_VER_37:
+-	case RTL_GIGA_MAC_VER_39 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_39 ... RTL_GIGA_MAC_VER_71:
+ 		r8169_mod_reg8_cond(tp, Config2, PME_SIGNAL, wolopts);
+ 		break;
+ 	default:
+@@ -2047,7 +2047,7 @@ static void rtl_set_eee_txidle_timer(str
+ 		tp->tx_lpi_timer = timer_val;
+ 		r8168_mac_ocp_write(tp, 0xe048, timer_val);
+ 		break;
+-	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_71:
+ 		tp->tx_lpi_timer = timer_val;
+ 		RTL_W16(tp, EEE_TXIDLE_TIMER_8125, timer_val);
+ 		break;
+@@ -2256,8 +2256,8 @@ static enum mac_version rtl8169_get_mac_
+ 		enum mac_version ver;
+ 	} mac_info[] = {
+ 		/* 8126A family. */
+-		{ 0x7cf, 0x64a,	RTL_GIGA_MAC_VER_66 },
+-		{ 0x7cf, 0x649,	RTL_GIGA_MAC_VER_65 },
++		{ 0x7cf, 0x64a,	RTL_GIGA_MAC_VER_71 },
++		{ 0x7cf, 0x649,	RTL_GIGA_MAC_VER_70 },
+ 
+ 		/* 8125D family. */
+ 		{ 0x7cf, 0x688,	RTL_GIGA_MAC_VER_64 },
+@@ -2529,7 +2529,7 @@ static void rtl_init_rxcfg(struct rtl816
+ 	case RTL_GIGA_MAC_VER_61:
+ 		RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST);
+ 		break;
+-	case RTL_GIGA_MAC_VER_63 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_63 ... RTL_GIGA_MAC_VER_71:
+ 		RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST |
+ 			RX_PAUSE_SLOT_ON);
+ 		break;
+@@ -2661,7 +2661,7 @@ static void rtl_wait_txrx_fifo_empty(str
+ 	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_61:
+ 		rtl_loop_wait_high(tp, &rtl_rxtx_empty_cond, 100, 42);
+ 		break;
+-	case RTL_GIGA_MAC_VER_63 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_63 ... RTL_GIGA_MAC_VER_71:
+ 		RTL_W8(tp, ChipCmd, RTL_R8(tp, ChipCmd) | StopReq);
+ 		rtl_loop_wait_high(tp, &rtl_rxtx_empty_cond, 100, 42);
+ 		rtl_loop_wait_high(tp, &rtl_rxtx_empty_cond_2, 100, 42);
+@@ -2904,7 +2904,7 @@ static void rtl_enable_exit_l1(struct rt
+ 	case RTL_GIGA_MAC_VER_37 ... RTL_GIGA_MAC_VER_38:
+ 		rtl_eri_set_bits(tp, 0xd4, 0x0c00);
+ 		break;
+-	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_71:
+ 		r8168_mac_ocp_modify(tp, 0xc0ac, 0, 0x1f80);
+ 		break;
+ 	default:
+@@ -2918,7 +2918,7 @@ static void rtl_disable_exit_l1(struct r
+ 	case RTL_GIGA_MAC_VER_34 ... RTL_GIGA_MAC_VER_38:
+ 		rtl_eri_clear_bits(tp, 0xd4, 0x1f00);
+ 		break;
+-	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_71:
+ 		r8168_mac_ocp_modify(tp, 0xc0ac, 0x1f80, 0);
+ 		break;
+ 	default:
+@@ -2944,8 +2944,8 @@ static void rtl_hw_aspm_clkreq_enable(st
+ 
+ 		rtl_mod_config5(tp, 0, ASPM_en);
+ 		switch (tp->mac_version) {
+-		case RTL_GIGA_MAC_VER_65:
+-		case RTL_GIGA_MAC_VER_66:
++		case RTL_GIGA_MAC_VER_70:
++		case RTL_GIGA_MAC_VER_71:
+ 			val8 = RTL_R8(tp, INT_CFG0_8125) | INT_CFG0_CLKREQEN;
+ 			RTL_W8(tp, INT_CFG0_8125, val8);
+ 			break;
+@@ -2956,7 +2956,7 @@ static void rtl_hw_aspm_clkreq_enable(st
+ 
+ 		switch (tp->mac_version) {
+ 		case RTL_GIGA_MAC_VER_46 ... RTL_GIGA_MAC_VER_48:
+-		case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_66:
++		case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_71:
+ 			/* reset ephy tx/rx disable timer */
+ 			r8168_mac_ocp_modify(tp, 0xe094, 0xff00, 0);
+ 			/* chip can trigger L1.2 */
+@@ -2968,7 +2968,7 @@ static void rtl_hw_aspm_clkreq_enable(st
+ 	} else {
+ 		switch (tp->mac_version) {
+ 		case RTL_GIGA_MAC_VER_46 ... RTL_GIGA_MAC_VER_48:
+-		case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_66:
++		case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_71:
+ 			r8168_mac_ocp_modify(tp, 0xe092, 0x00ff, 0);
+ 			break;
+ 		default:
+@@ -2976,8 +2976,8 @@ static void rtl_hw_aspm_clkreq_enable(st
+ 		}
+ 
+ 		switch (tp->mac_version) {
+-		case RTL_GIGA_MAC_VER_65:
+-		case RTL_GIGA_MAC_VER_66:
++		case RTL_GIGA_MAC_VER_70:
++		case RTL_GIGA_MAC_VER_71:
+ 			val8 = RTL_R8(tp, INT_CFG0_8125) & ~INT_CFG0_CLKREQEN;
+ 			RTL_W8(tp, INT_CFG0_8125, val8);
+ 			break;
+@@ -3697,12 +3697,12 @@ static void rtl_hw_start_8125_common(str
+ 	/* disable new tx descriptor format */
+ 	r8168_mac_ocp_modify(tp, 0xeb58, 0x0001, 0x0000);
+ 
+-	if (tp->mac_version == RTL_GIGA_MAC_VER_65 ||
+-	    tp->mac_version == RTL_GIGA_MAC_VER_66)
++	if (tp->mac_version == RTL_GIGA_MAC_VER_70 ||
++	    tp->mac_version == RTL_GIGA_MAC_VER_71)
+ 		RTL_W8(tp, 0xD8, RTL_R8(tp, 0xD8) & ~0x02);
+ 
+-	if (tp->mac_version == RTL_GIGA_MAC_VER_65 ||
+-	    tp->mac_version == RTL_GIGA_MAC_VER_66)
++	if (tp->mac_version == RTL_GIGA_MAC_VER_70 ||
++	    tp->mac_version == RTL_GIGA_MAC_VER_71)
+ 		r8168_mac_ocp_modify(tp, 0xe614, 0x0700, 0x0400);
+ 	else if (tp->mac_version == RTL_GIGA_MAC_VER_63)
+ 		r8168_mac_ocp_modify(tp, 0xe614, 0x0700, 0x0200);
+@@ -3720,8 +3720,8 @@ static void rtl_hw_start_8125_common(str
+ 	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0030);
+ 	r8168_mac_ocp_modify(tp, 0xe040, 0x1000, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xea1c, 0x0003, 0x0001);
+-	if (tp->mac_version == RTL_GIGA_MAC_VER_65 ||
+-	    tp->mac_version == RTL_GIGA_MAC_VER_66)
++	if (tp->mac_version == RTL_GIGA_MAC_VER_70 ||
++	    tp->mac_version == RTL_GIGA_MAC_VER_71)
+ 		r8168_mac_ocp_modify(tp, 0xea1c, 0x0300, 0x0000);
+ 	else
+ 		r8168_mac_ocp_modify(tp, 0xea1c, 0x0004, 0x0000);
+@@ -3840,8 +3840,8 @@ static void rtl_hw_config(struct rtl8169
+ 		[RTL_GIGA_MAC_VER_61] = rtl_hw_start_8125a_2,
+ 		[RTL_GIGA_MAC_VER_63] = rtl_hw_start_8125b,
+ 		[RTL_GIGA_MAC_VER_64] = rtl_hw_start_8125d,
+-		[RTL_GIGA_MAC_VER_65] = rtl_hw_start_8126a,
+-		[RTL_GIGA_MAC_VER_66] = rtl_hw_start_8126a,
++		[RTL_GIGA_MAC_VER_70] = rtl_hw_start_8126a,
++		[RTL_GIGA_MAC_VER_71] = rtl_hw_start_8126a,
+ 	};
+ 
+ 	if (hw_configs[tp->mac_version])
+@@ -3862,8 +3862,8 @@ static void rtl_hw_start_8125(struct rtl
+ 			RTL_W32(tp, i, 0);
+ 		break;
+ 	case RTL_GIGA_MAC_VER_63:
+-	case RTL_GIGA_MAC_VER_65:
+-	case RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_70:
++	case RTL_GIGA_MAC_VER_71:
+ 		for (i = 0xa00; i < 0xa80; i += 4)
+ 			RTL_W32(tp, i, 0);
+ 		RTL_W16(tp, INT_CFG1_8125, 0x0000);
+@@ -4095,7 +4095,7 @@ static void rtl8169_cleanup(struct rtl81
+ 		RTL_W8(tp, ChipCmd, RTL_R8(tp, ChipCmd) | StopReq);
+ 		rtl_loop_wait_high(tp, &rtl_txcfg_empty_cond, 100, 666);
+ 		break;
+-	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_71:
+ 		rtl_enable_rxdvgate(tp);
+ 		fsleep(2000);
+ 		break;
+@@ -4252,7 +4252,7 @@ static unsigned int rtl_quirk_packet_pad
+ 
+ 	switch (tp->mac_version) {
+ 	case RTL_GIGA_MAC_VER_34:
+-	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_71:
+ 		padto = max_t(unsigned int, padto, ETH_ZLEN);
+ 		break;
+ 	default:
+@@ -5275,7 +5275,7 @@ static void rtl_hw_initialize(struct rtl
+ 	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_48:
+ 		rtl_hw_init_8168g(tp);
+ 		break;
+-	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_71:
+ 		rtl_hw_init_8125(tp);
+ 		break;
+ 	default:
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -1162,8 +1162,8 @@ void r8169_hw_phy_config(struct rtl8169_
+ 		[RTL_GIGA_MAC_VER_61] = rtl8125a_2_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_63] = rtl8125b_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_64] = rtl8125d_hw_phy_config,
+-		[RTL_GIGA_MAC_VER_65] = rtl8126a_hw_phy_config,
+-		[RTL_GIGA_MAC_VER_66] = rtl8126a_hw_phy_config,
++		[RTL_GIGA_MAC_VER_70] = rtl8126a_hw_phy_config,
++		[RTL_GIGA_MAC_VER_71] = rtl8126a_hw_phy_config,
+ 	};
+ 
+ 	if (phy_configs[ver])
diff --git a/target/linux/generic/backport-6.6/780-48-v6.14-r8169-add-support-for-RTL8125D-rev.b.patch b/target/linux/generic/backport-6.6/780-48-v6.14-r8169-add-support-for-RTL8125D-rev.b.patch
new file mode 100644
index 00000000000000..eeede542af61e4
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-48-v6.14-r8169-add-support-for-RTL8125D-rev.b.patch
@@ -0,0 +1,90 @@
+From b3593df26ab19f114d613693fa8a92ab202803d0 Mon Sep 17 00:00:00 2001
+From: ChunHao Lin <hau@realtek.com>
+Date: Fri, 13 Dec 2024 20:02:58 +0100
+Subject: [PATCH] r8169: add support for RTL8125D rev.b
+
+Add support for RTL8125D rev.b. Its XID is 0x689. It is basically
+based on the one with XID 0x688, but with different firmware file.
+
+Signed-off-by: ChunHao Lin <hau@realtek.com>
+[hkallweit1@gmail.com: rebased after adjusted version numbering]
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/75e5e9ec-d01f-43ac-b0f4-e7456baf18d1@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169.h            | 1 +
+ drivers/net/ethernet/realtek/r8169_main.c       | 6 ++++++
+ drivers/net/ethernet/realtek/r8169_phy_config.c | 1 +
+ 3 files changed, 8 insertions(+)
+
+--- a/drivers/net/ethernet/realtek/r8169.h
++++ b/drivers/net/ethernet/realtek/r8169.h
+@@ -69,6 +69,7 @@ enum mac_version {
+ 	RTL_GIGA_MAC_VER_61,
+ 	RTL_GIGA_MAC_VER_63,
+ 	RTL_GIGA_MAC_VER_64,
++	RTL_GIGA_MAC_VER_65,
+ 	RTL_GIGA_MAC_VER_70,
+ 	RTL_GIGA_MAC_VER_71,
+ 	RTL_GIGA_MAC_NONE
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -56,6 +56,7 @@
+ #define FIRMWARE_8125A_3	"rtl_nic/rtl8125a-3.fw"
+ #define FIRMWARE_8125B_2	"rtl_nic/rtl8125b-2.fw"
+ #define FIRMWARE_8125D_1	"rtl_nic/rtl8125d-1.fw"
++#define FIRMWARE_8125D_2	"rtl_nic/rtl8125d-2.fw"
+ #define FIRMWARE_8126A_2	"rtl_nic/rtl8126a-2.fw"
+ #define FIRMWARE_8126A_3	"rtl_nic/rtl8126a-3.fw"
+ 
+@@ -139,6 +140,7 @@ static const struct {
+ 	/* reserve 62 for CFG_METHOD_4 in the vendor driver */
+ 	[RTL_GIGA_MAC_VER_63] = {"RTL8125B",		FIRMWARE_8125B_2},
+ 	[RTL_GIGA_MAC_VER_64] = {"RTL8125D",		FIRMWARE_8125D_1},
++	[RTL_GIGA_MAC_VER_65] = {"RTL8125D",		FIRMWARE_8125D_2},
+ 	[RTL_GIGA_MAC_VER_70] = {"RTL8126A",		FIRMWARE_8126A_2},
+ 	[RTL_GIGA_MAC_VER_71] = {"RTL8126A",		FIRMWARE_8126A_3},
+ };
+@@ -706,6 +708,7 @@ MODULE_FIRMWARE(FIRMWARE_8107E_2);
+ MODULE_FIRMWARE(FIRMWARE_8125A_3);
+ MODULE_FIRMWARE(FIRMWARE_8125B_2);
+ MODULE_FIRMWARE(FIRMWARE_8125D_1);
++MODULE_FIRMWARE(FIRMWARE_8125D_2);
+ MODULE_FIRMWARE(FIRMWARE_8126A_2);
+ MODULE_FIRMWARE(FIRMWARE_8126A_3);
+ 
+@@ -2260,6 +2263,7 @@ static enum mac_version rtl8169_get_mac_
+ 		{ 0x7cf, 0x649,	RTL_GIGA_MAC_VER_70 },
+ 
+ 		/* 8125D family. */
++		{ 0x7cf, 0x689,	RTL_GIGA_MAC_VER_65 },
+ 		{ 0x7cf, 0x688,	RTL_GIGA_MAC_VER_64 },
+ 
+ 		/* 8125B family. */
+@@ -3840,6 +3844,7 @@ static void rtl_hw_config(struct rtl8169
+ 		[RTL_GIGA_MAC_VER_61] = rtl_hw_start_8125a_2,
+ 		[RTL_GIGA_MAC_VER_63] = rtl_hw_start_8125b,
+ 		[RTL_GIGA_MAC_VER_64] = rtl_hw_start_8125d,
++		[RTL_GIGA_MAC_VER_65] = rtl_hw_start_8125d,
+ 		[RTL_GIGA_MAC_VER_70] = rtl_hw_start_8126a,
+ 		[RTL_GIGA_MAC_VER_71] = rtl_hw_start_8126a,
+ 	};
+@@ -3858,6 +3863,7 @@ static void rtl_hw_start_8125(struct rtl
+ 	switch (tp->mac_version) {
+ 	case RTL_GIGA_MAC_VER_61:
+ 	case RTL_GIGA_MAC_VER_64:
++	case RTL_GIGA_MAC_VER_65:
+ 		for (i = 0xa00; i < 0xb00; i += 4)
+ 			RTL_W32(tp, i, 0);
+ 		break;
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -1162,6 +1162,7 @@ void r8169_hw_phy_config(struct rtl8169_
+ 		[RTL_GIGA_MAC_VER_61] = rtl8125a_2_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_63] = rtl8125b_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_64] = rtl8125d_hw_phy_config,
++		[RTL_GIGA_MAC_VER_65] = rtl8125d_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_70] = rtl8126a_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_71] = rtl8126a_hw_phy_config,
+ 	};
diff --git a/target/linux/generic/backport-6.6/780-49-v6.14-r8169-add-support-for-RTL8125BP-rev.b.patch b/target/linux/generic/backport-6.6/780-49-v6.14-r8169-add-support-for-RTL8125BP-rev.b.patch
new file mode 100644
index 00000000000000..f101bdc6fb7471
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-49-v6.14-r8169-add-support-for-RTL8125BP-rev.b.patch
@@ -0,0 +1,184 @@
+From b11bff90f2ad52c5c55c822ecd20326619a73898 Mon Sep 17 00:00:00 2001
+From: ChunHao Lin <hau@realtek.com>
+Date: Tue, 7 Jan 2025 14:43:55 +0800
+Subject: [PATCH] r8169: add support for RTL8125BP rev.b
+
+Add support for RTL8125BP rev.b. Its XID is 0x689. This chip supports
+DASH and its dash type is "RTL_DASH_25_BP".
+
+Signed-off-by: ChunHao Lin <hau@realtek.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/20250107064355.104711-1-hau@realtek.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/ethernet/realtek/r8169.h          |  1 +
+ drivers/net/ethernet/realtek/r8169_main.c     | 30 +++++++++++++++++++
+ .../net/ethernet/realtek/r8169_phy_config.c   | 23 ++++++++++++++
+ 3 files changed, 54 insertions(+)
+
+--- a/drivers/net/ethernet/realtek/r8169.h
++++ b/drivers/net/ethernet/realtek/r8169.h
+@@ -70,6 +70,7 @@ enum mac_version {
+ 	RTL_GIGA_MAC_VER_63,
+ 	RTL_GIGA_MAC_VER_64,
+ 	RTL_GIGA_MAC_VER_65,
++	RTL_GIGA_MAC_VER_66,
+ 	RTL_GIGA_MAC_VER_70,
+ 	RTL_GIGA_MAC_VER_71,
+ 	RTL_GIGA_MAC_NONE
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -57,6 +57,7 @@
+ #define FIRMWARE_8125B_2	"rtl_nic/rtl8125b-2.fw"
+ #define FIRMWARE_8125D_1	"rtl_nic/rtl8125d-1.fw"
+ #define FIRMWARE_8125D_2	"rtl_nic/rtl8125d-2.fw"
++#define FIRMWARE_8125BP_2	"rtl_nic/rtl8125bp-2.fw"
+ #define FIRMWARE_8126A_2	"rtl_nic/rtl8126a-2.fw"
+ #define FIRMWARE_8126A_3	"rtl_nic/rtl8126a-3.fw"
+ 
+@@ -141,6 +142,7 @@ static const struct {
+ 	[RTL_GIGA_MAC_VER_63] = {"RTL8125B",		FIRMWARE_8125B_2},
+ 	[RTL_GIGA_MAC_VER_64] = {"RTL8125D",		FIRMWARE_8125D_1},
+ 	[RTL_GIGA_MAC_VER_65] = {"RTL8125D",		FIRMWARE_8125D_2},
++	[RTL_GIGA_MAC_VER_66] = {"RTL8125BP",		FIRMWARE_8125BP_2},
+ 	[RTL_GIGA_MAC_VER_70] = {"RTL8126A",		FIRMWARE_8126A_2},
+ 	[RTL_GIGA_MAC_VER_71] = {"RTL8126A",		FIRMWARE_8126A_3},
+ };
+@@ -632,6 +634,7 @@ enum rtl_dash_type {
+ 	RTL_DASH_NONE,
+ 	RTL_DASH_DP,
+ 	RTL_DASH_EP,
++	RTL_DASH_25_BP,
+ };
+ 
+ struct rtl8169_private {
+@@ -709,6 +712,7 @@ MODULE_FIRMWARE(FIRMWARE_8125A_3);
+ MODULE_FIRMWARE(FIRMWARE_8125B_2);
+ MODULE_FIRMWARE(FIRMWARE_8125D_1);
+ MODULE_FIRMWARE(FIRMWARE_8125D_2);
++MODULE_FIRMWARE(FIRMWARE_8125BP_2);
+ MODULE_FIRMWARE(FIRMWARE_8126A_2);
+ MODULE_FIRMWARE(FIRMWARE_8126A_3);
+ 
+@@ -1361,10 +1365,19 @@ static void rtl8168ep_driver_start(struc
+ 		rtl_loop_wait_high(tp, &rtl_ep_ocp_read_cond, 10000, 30);
+ }
+ 
++static void rtl8125bp_driver_start(struct rtl8169_private *tp)
++{
++	r8168ep_ocp_write(tp, 0x01, 0x14, OOB_CMD_DRIVER_START);
++	r8168ep_ocp_write(tp, 0x01, 0x18, 0x00);
++	r8168ep_ocp_write(tp, 0x01, 0x10, 0x01);
++}
++
+ static void rtl8168_driver_start(struct rtl8169_private *tp)
+ {
+ 	if (tp->dash_type == RTL_DASH_DP)
+ 		rtl8168dp_driver_start(tp);
++	else if (tp->dash_type == RTL_DASH_25_BP)
++		rtl8125bp_driver_start(tp);
+ 	else
+ 		rtl8168ep_driver_start(tp);
+ }
+@@ -1385,10 +1398,19 @@ static void rtl8168ep_driver_stop(struct
+ 		rtl_loop_wait_low(tp, &rtl_ep_ocp_read_cond, 10000, 10);
+ }
+ 
++static void rtl8125bp_driver_stop(struct rtl8169_private *tp)
++{
++	r8168ep_ocp_write(tp, 0x01, 0x14, OOB_CMD_DRIVER_STOP);
++	r8168ep_ocp_write(tp, 0x01, 0x18, 0x00);
++	r8168ep_ocp_write(tp, 0x01, 0x10, 0x01);
++}
++
+ static void rtl8168_driver_stop(struct rtl8169_private *tp)
+ {
+ 	if (tp->dash_type == RTL_DASH_DP)
+ 		rtl8168dp_driver_stop(tp);
++	else if (tp->dash_type == RTL_DASH_25_BP)
++		rtl8125bp_driver_stop(tp);
+ 	else
+ 		rtl8168ep_driver_stop(tp);
+ }
+@@ -1411,6 +1433,7 @@ static bool rtl_dash_is_enabled(struct r
+ 	case RTL_DASH_DP:
+ 		return r8168dp_check_dash(tp);
+ 	case RTL_DASH_EP:
++	case RTL_DASH_25_BP:
+ 		return r8168ep_check_dash(tp);
+ 	default:
+ 		return false;
+@@ -1425,6 +1448,8 @@ static enum rtl_dash_type rtl_get_dash_t
+ 		return RTL_DASH_DP;
+ 	case RTL_GIGA_MAC_VER_51 ... RTL_GIGA_MAC_VER_53:
+ 		return RTL_DASH_EP;
++	case RTL_GIGA_MAC_VER_66:
++		return RTL_DASH_25_BP;
+ 	default:
+ 		return RTL_DASH_NONE;
+ 	}
+@@ -2262,6 +2287,9 @@ static enum mac_version rtl8169_get_mac_
+ 		{ 0x7cf, 0x64a,	RTL_GIGA_MAC_VER_71 },
+ 		{ 0x7cf, 0x649,	RTL_GIGA_MAC_VER_70 },
+ 
++		/* 8125BP family. */
++		{ 0x7cf, 0x681,	RTL_GIGA_MAC_VER_66 },
++
+ 		/* 8125D family. */
+ 		{ 0x7cf, 0x689,	RTL_GIGA_MAC_VER_65 },
+ 		{ 0x7cf, 0x688,	RTL_GIGA_MAC_VER_64 },
+@@ -3845,6 +3873,7 @@ static void rtl_hw_config(struct rtl8169
+ 		[RTL_GIGA_MAC_VER_63] = rtl_hw_start_8125b,
+ 		[RTL_GIGA_MAC_VER_64] = rtl_hw_start_8125d,
+ 		[RTL_GIGA_MAC_VER_65] = rtl_hw_start_8125d,
++		[RTL_GIGA_MAC_VER_66] = rtl_hw_start_8125d,
+ 		[RTL_GIGA_MAC_VER_70] = rtl_hw_start_8126a,
+ 		[RTL_GIGA_MAC_VER_71] = rtl_hw_start_8126a,
+ 	};
+@@ -3864,6 +3893,7 @@ static void rtl_hw_start_8125(struct rtl
+ 	case RTL_GIGA_MAC_VER_61:
+ 	case RTL_GIGA_MAC_VER_64:
+ 	case RTL_GIGA_MAC_VER_65:
++	case RTL_GIGA_MAC_VER_66:
+ 		for (i = 0xa00; i < 0xb00; i += 4)
+ 			RTL_W32(tp, i, 0);
+ 		break;
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -1102,6 +1102,28 @@ static void rtl8125d_hw_phy_config(struc
+ 	rtl8125_config_eee_phy(phydev);
+ }
+ 
++static void rtl8125bp_hw_phy_config(struct rtl8169_private *tp,
++				    struct phy_device *phydev)
++{
++	r8169_apply_firmware(tp);
++	rtl8168g_enable_gphy_10m(phydev);
++
++	r8168g_phy_param(phydev, 0x8010, 0x0800, 0x0000);
++
++	phy_write(phydev, 0x1f, 0x0b87);
++	phy_write(phydev, 0x16, 0x8088);
++	phy_modify(phydev, 0x17, 0xff00, 0x9000);
++	phy_write(phydev, 0x16, 0x808f);
++	phy_modify(phydev, 0x17, 0xff00, 0x9000);
++	phy_write(phydev, 0x1f, 0x0000);
++
++	r8168g_phy_param(phydev, 0x8174, 0x2000, 0x1800);
++
++	rtl8125_legacy_force_mode(phydev);
++	rtl8168g_disable_aldps(phydev);
++	rtl8125_config_eee_phy(phydev);
++}
++
+ static void rtl8126a_hw_phy_config(struct rtl8169_private *tp,
+ 				   struct phy_device *phydev)
+ {
+@@ -1163,6 +1185,7 @@ void r8169_hw_phy_config(struct rtl8169_
+ 		[RTL_GIGA_MAC_VER_63] = rtl8125b_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_64] = rtl8125d_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_65] = rtl8125d_hw_phy_config,
++		[RTL_GIGA_MAC_VER_66] = rtl8125bp_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_70] = rtl8126a_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_71] = rtl8126a_hw_phy_config,
+ 	};
diff --git a/target/linux/generic/backport-6.6/780-50-v6.15-r8169-make-Kconfig-option-for-LED-support-user-visib.patch b/target/linux/generic/backport-6.6/780-50-v6.15-r8169-make-Kconfig-option-for-LED-support-user-visib.patch
new file mode 100644
index 00000000000000..62acd269639091
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-50-v6.15-r8169-make-Kconfig-option-for-LED-support-user-visib.patch
@@ -0,0 +1,28 @@
+From 135c3c86a7cef4ba3d368da15b16c275b74582d3 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Mon, 3 Feb 2025 21:35:24 +0100
+Subject: [PATCH] r8169: make Kconfig option for LED support user-visible
+
+Make config option R8169_LEDS user-visible, so that users can remove
+support if not needed.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/d29f0cdb-32bf-435f-b59d-dc96bca1e3ab@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/Kconfig | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/realtek/Kconfig
++++ b/drivers/net/ethernet/realtek/Kconfig
+@@ -114,7 +114,8 @@ config R8169
+ 	  will be called r8169.  This is recommended.
+ 
+ config R8169_LEDS
+-	def_bool R8169 && LEDS_TRIGGER_NETDEV
++	bool "Support for controlling the NIC LEDs"
++	depends on R8169 && LEDS_TRIGGER_NETDEV
+ 	depends on !(R8169=y && LEDS_CLASS=m)
+ 	help
+ 	  Optional support for controlling the NIC LED's with the netdev
diff --git a/target/linux/generic/backport-6.6/780-52-v6.15-r8169-add-support-for-Intel-Killer-E5000.patch b/target/linux/generic/backport-6.6/780-52-v6.15-r8169-add-support-for-Intel-Killer-E5000.patch
new file mode 100644
index 00000000000000..d741d193ab536d
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-52-v6.15-r8169-add-support-for-Intel-Killer-E5000.patch
@@ -0,0 +1,25 @@
+From d30460f42675fef5cd4b44ffbc49b545524555e3 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 12 Feb 2025 08:03:56 +0100
+Subject: [PATCH] r8169: add support for Intel Killer E5000
+
+This adds support for the Intel Killer E5000 which seems to be a
+rebranded RTL8126. Copied from r8126 vendor driver.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/9db73e9b-e2e8-45de-97a5-041c5f71d774@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -169,6 +169,7 @@ static const struct pci_device_id rtl816
+ 	{ PCI_VDEVICE(REALTEK,	0x8125) },
+ 	{ PCI_VDEVICE(REALTEK,	0x8126) },
+ 	{ PCI_VDEVICE(REALTEK,	0x3000) },
++	{ PCI_VDEVICE(REALTEK,	0x5000) },
+ 	{}
+ };
+ 
diff --git a/target/linux/generic/backport-6.6/780-53-v6.15-r8169-add-PHY-c45-ops-for-MDIO_MMD_VENDOR2-registers.patch b/target/linux/generic/backport-6.6/780-53-v6.15-r8169-add-PHY-c45-ops-for-MDIO_MMD_VENDOR2-registers.patch
new file mode 100644
index 00000000000000..010a8abc021224
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-53-v6.15-r8169-add-PHY-c45-ops-for-MDIO_MMD_VENDOR2-registers.patch
@@ -0,0 +1,67 @@
+From 853e80369cfceb2331bf34f251ba11c6602cc67f Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 13 Feb 2025 20:15:42 +0100
+Subject: [PATCH] r8169: add PHY c45 ops for MDIO_MMD_VENDOR2 registers
+
+The integrated PHYs on chip versions from RTL8168g allow to address
+MDIO_MMD_VEND2 registers. All c22 standard registers are mapped to
+MDIO_MMD_VEND2 registers. So far the paging mechanism is used to
+address PHY registers. Add support for c45 ops to address MDIO_MMD_VEND2
+registers directly, w/o the paging.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/d6f97eaa-0f13-468f-89cb-75a41087bc4a@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 32 +++++++++++++++++++++++
+ 1 file changed, 32 insertions(+)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -5208,6 +5208,33 @@ static int r8169_mdio_write_reg(struct m
+ 	return 0;
+ }
+ 
++static int r8169_mdio_read_reg_c45(struct mii_bus *mii_bus, int addr,
++				   int devnum, int regnum)
++{
++	struct rtl8169_private *tp = mii_bus->priv;
++
++	if (addr > 0)
++		return -ENODEV;
++
++	if (devnum == MDIO_MMD_VEND2 && regnum > MDIO_STAT2)
++		return r8168_phy_ocp_read(tp, regnum);
++
++	return 0;
++}
++
++static int r8169_mdio_write_reg_c45(struct mii_bus *mii_bus, int addr,
++				    int devnum, int regnum, u16 val)
++{
++	struct rtl8169_private *tp = mii_bus->priv;
++
++	if (addr > 0 || devnum != MDIO_MMD_VEND2 || regnum <= MDIO_STAT2)
++		return -ENODEV;
++
++	r8168_phy_ocp_write(tp, regnum, val);
++
++	return 0;
++}
++
+ static int r8169_mdio_register(struct rtl8169_private *tp)
+ {
+ 	struct pci_dev *pdev = tp->pci_dev;
+@@ -5238,6 +5265,11 @@ static int r8169_mdio_register(struct rt
+ 	new_bus->read = r8169_mdio_read_reg;
+ 	new_bus->write = r8169_mdio_write_reg;
+ 
++	if (tp->mac_version >= RTL_GIGA_MAC_VER_40) {
++		new_bus->read_c45 = r8169_mdio_read_reg_c45;
++		new_bus->write_c45 = r8169_mdio_write_reg_c45;
++	}
++
+ 	ret = devm_mdiobus_register(&pdev->dev, new_bus);
+ 	if (ret)
+ 		return ret;
diff --git a/target/linux/generic/backport-6.6/780-54-v6.15-r8169-increase-max-jumbo-packet-size-on-RTL8125-RTL8.patch b/target/linux/generic/backport-6.6/780-54-v6.15-r8169-increase-max-jumbo-packet-size-on-RTL8125-RTL8.patch
new file mode 100644
index 00000000000000..f8d7e8008adaff
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-54-v6.15-r8169-increase-max-jumbo-packet-size-on-RTL8125-RTL8.patch
@@ -0,0 +1,40 @@
+From 473367a5ffe1607a61be481e2feda684eb5faea9 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Fri, 7 Mar 2025 08:29:47 +0100
+Subject: [PATCH] r8169: increase max jumbo packet size on RTL8125/RTL8126
+
+Realtek confirmed that all RTL8125/RTL8126 chip versions support up to
+16K jumbo packets. Reflect this in the driver.
+
+Tested by Rui on RTL8125B with 12K jumbo packets.
+
+Suggested-by: Rui Salvaterra <rsalvaterra@gmail.com>
+Tested-by: Rui Salvaterra <rsalvaterra@gmail.com>
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/396762ad-cc65-4e60-b01e-8847db89e98b@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -89,6 +89,7 @@
+ #define JUMBO_6K	(6 * SZ_1K - VLAN_ETH_HLEN - ETH_FCS_LEN)
+ #define JUMBO_7K	(7 * SZ_1K - VLAN_ETH_HLEN - ETH_FCS_LEN)
+ #define JUMBO_9K	(9 * SZ_1K - VLAN_ETH_HLEN - ETH_FCS_LEN)
++#define JUMBO_16K	(SZ_16K - VLAN_ETH_HLEN - ETH_FCS_LEN)
+ 
+ static const struct {
+ 	const char *name;
+@@ -5368,6 +5369,9 @@ static int rtl_jumbo_max(struct rtl8169_
+ 	/* RTL8168c */
+ 	case RTL_GIGA_MAC_VER_18 ... RTL_GIGA_MAC_VER_24:
+ 		return JUMBO_6K;
++	/* RTL8125/8126 */
++	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_71:
++		return JUMBO_16K;
+ 	default:
+ 		return JUMBO_9K;
+ 	}
diff --git a/target/linux/generic/backport-6.6/780-55-v6.15-r8169-enable-RTL8168H-RTL8168EP-RTL8168FP-ASPM-suppo.patch b/target/linux/generic/backport-6.6/780-55-v6.15-r8169-enable-RTL8168H-RTL8168EP-RTL8168FP-ASPM-suppo.patch
new file mode 100644
index 00000000000000..32623e235843cd
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-55-v6.15-r8169-enable-RTL8168H-RTL8168EP-RTL8168FP-ASPM-suppo.patch
@@ -0,0 +1,27 @@
+From 3d9b8ac5341269d31e59fd5d58d47266ac78bc32 Mon Sep 17 00:00:00 2001
+From: ChunHao Lin <hau@realtek.com>
+Date: Tue, 18 Mar 2025 16:37:20 +0800
+Subject: [PATCH] r8169: enable RTL8168H/RTL8168EP/RTL8168FP ASPM support
+
+This patch will enable RTL8168H/RTL8168EP/RTL8168FP ASPM support on
+the platforms that have tested with ASPM enabled.
+
+Signed-off-by: ChunHao Lin <hau@realtek.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/20250318083721.4127-2-hau@realtek.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -5406,7 +5406,7 @@ done:
+ /* register is set if system vendor successfully tested ASPM 1.2 */
+ static bool rtl_aspm_is_safe(struct rtl8169_private *tp)
+ {
+-	if (tp->mac_version >= RTL_GIGA_MAC_VER_61 &&
++	if (tp->mac_version >= RTL_GIGA_MAC_VER_46 &&
+ 	    r8168_mac_ocp_read(tp, 0xc0b2) & 0xf)
+ 		return true;
+ 
diff --git a/target/linux/generic/backport-6.6/780-56-v6.15-r8169-disable-RTL8126-ZRX-DC-timeout.patch b/target/linux/generic/backport-6.6/780-56-v6.15-r8169-disable-RTL8126-ZRX-DC-timeout.patch
new file mode 100644
index 00000000000000..3f81f4b54bf0b4
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-56-v6.15-r8169-disable-RTL8126-ZRX-DC-timeout.patch
@@ -0,0 +1,60 @@
+From b48688ea3c9ac8d5d910c6e91fb7f80d846581f0 Mon Sep 17 00:00:00 2001
+From: ChunHao Lin <hau@realtek.com>
+Date: Tue, 18 Mar 2025 16:37:21 +0800
+Subject: [PATCH] r8169: disable RTL8126 ZRX-DC timeout
+
+Disable it due to it dose not meet ZRX-DC specification. If it is enabled,
+device will exit L1 substate every 100ms. Disable it for saving more power
+in L1 substate.
+
+Signed-off-by: ChunHao Lin <hau@realtek.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/20250318083721.4127-3-hau@realtek.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 27 +++++++++++++++++++++++
+ 1 file changed, 27 insertions(+)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -2856,6 +2856,32 @@ static u32 rtl_csi_read(struct rtl8169_p
+ 		RTL_R32(tp, CSIDR) : ~0;
+ }
+ 
++static void rtl_disable_zrxdc_timeout(struct rtl8169_private *tp)
++{
++	struct pci_dev *pdev = tp->pci_dev;
++	u32 csi;
++	int rc;
++	u8 val;
++
++#define RTL_GEN3_RELATED_OFF	0x0890
++#define RTL_GEN3_ZRXDC_NONCOMPL	0x1
++	if (pdev->cfg_size > RTL_GEN3_RELATED_OFF) {
++		rc = pci_read_config_byte(pdev, RTL_GEN3_RELATED_OFF, &val);
++		if (rc == PCIBIOS_SUCCESSFUL) {
++			val &= ~RTL_GEN3_ZRXDC_NONCOMPL;
++			rc = pci_write_config_byte(pdev, RTL_GEN3_RELATED_OFF,
++						   val);
++			if (rc == PCIBIOS_SUCCESSFUL)
++				return;
++		}
++	}
++
++	netdev_notice_once(tp->dev,
++		"No native access to PCI extended config space, falling back to CSI\n");
++	csi = rtl_csi_read(tp, RTL_GEN3_RELATED_OFF);
++	rtl_csi_write(tp, RTL_GEN3_RELATED_OFF, csi & ~RTL_GEN3_ZRXDC_NONCOMPL);
++}
++
+ static void rtl_set_aspm_entry_latency(struct rtl8169_private *tp, u8 val)
+ {
+ 	struct pci_dev *pdev = tp->pci_dev;
+@@ -3828,6 +3854,7 @@ static void rtl_hw_start_8125d(struct rt
+ 
+ static void rtl_hw_start_8126a(struct rtl8169_private *tp)
+ {
++	rtl_disable_zrxdc_timeout(tp);
+ 	rtl_set_def_aspm_entry_latency(tp);
+ 	rtl_hw_start_8125_common(tp);
+ }
diff --git a/target/linux/generic/backport-6.6/780-57-v6.16-r8169-add-helper-rtl_csi_mod-for-accessing-extended.patch b/target/linux/generic/backport-6.6/780-57-v6.16-r8169-add-helper-rtl_csi_mod-for-accessing-extended.patch
new file mode 100644
index 00000000000000..0c5db62c9b52f1
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-57-v6.16-r8169-add-helper-rtl_csi_mod-for-accessing-extended.patch
@@ -0,0 +1,74 @@
+From 8c40d99e5f43e0545a3f4fea9156313847e2eb79 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 9 Apr 2025 21:05:37 +0200
+Subject: [PATCH] r8169: add helper rtl_csi_mod for accessing extended config
+ space
+
+Add a helper for the Realtek-specific mechanism for accessing extended
+config space if native access isn't possible.
+This avoids code duplication.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/b368fd91-57d7-4cb5-9342-98b4d8fe9aea@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 26 ++++++++++++++---------
+ 1 file changed, 16 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -2856,10 +2856,23 @@ static u32 rtl_csi_read(struct rtl8169_p
+ 		RTL_R32(tp, CSIDR) : ~0;
+ }
+ 
++static void rtl_csi_mod(struct rtl8169_private *tp, int addr,
++			u32 mask, u32 set)
++{
++	u32 val;
++
++	WARN(addr % 4, "Invalid CSI address %#x\n", addr);
++
++	netdev_notice_once(tp->dev,
++		"No native access to PCI extended config space, falling back to CSI\n");
++
++	val = rtl_csi_read(tp, addr);
++	rtl_csi_write(tp, addr, (val & ~mask) | set);
++}
++
+ static void rtl_disable_zrxdc_timeout(struct rtl8169_private *tp)
+ {
+ 	struct pci_dev *pdev = tp->pci_dev;
+-	u32 csi;
+ 	int rc;
+ 	u8 val;
+ 
+@@ -2876,16 +2889,12 @@ static void rtl_disable_zrxdc_timeout(st
+ 		}
+ 	}
+ 
+-	netdev_notice_once(tp->dev,
+-		"No native access to PCI extended config space, falling back to CSI\n");
+-	csi = rtl_csi_read(tp, RTL_GEN3_RELATED_OFF);
+-	rtl_csi_write(tp, RTL_GEN3_RELATED_OFF, csi & ~RTL_GEN3_ZRXDC_NONCOMPL);
++	rtl_csi_mod(tp, RTL_GEN3_RELATED_OFF, RTL_GEN3_ZRXDC_NONCOMPL, 0);
+ }
+ 
+ static void rtl_set_aspm_entry_latency(struct rtl8169_private *tp, u8 val)
+ {
+ 	struct pci_dev *pdev = tp->pci_dev;
+-	u32 csi;
+ 
+ 	/* According to Realtek the value at config space address 0x070f
+ 	 * controls the L0s/L1 entrance latency. We try standard ECAM access
+@@ -2897,10 +2906,7 @@ static void rtl_set_aspm_entry_latency(s
+ 	    pci_write_config_byte(pdev, 0x070f, val) == PCIBIOS_SUCCESSFUL)
+ 		return;
+ 
+-	netdev_notice_once(tp->dev,
+-		"No native access to PCI extended config space, falling back to CSI\n");
+-	csi = rtl_csi_read(tp, 0x070c) & 0x00ffffff;
+-	rtl_csi_write(tp, 0x070c, csi | val << 24);
++	rtl_csi_mod(tp, 0x070c, 0xff000000, val << 24);
+ }
+ 
+ static void rtl_set_def_aspm_entry_latency(struct rtl8169_private *tp)
diff --git a/target/linux/generic/backport-6.6/780-58-v6.16-r8169-add-helper-rtl8125_phy_param.patch b/target/linux/generic/backport-6.6/780-58-v6.16-r8169-add-helper-rtl8125_phy_param.patch
new file mode 100644
index 00000000000000..30ebb4b6f4806d
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-58-v6.16-r8169-add-helper-rtl8125_phy_param.patch
@@ -0,0 +1,82 @@
+From 0c49baf099ba2147a6ff3bbdc3197c6ddbee5469 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Wed, 9 Apr 2025 21:14:47 +0200
+Subject: [PATCH] r8169: add helper rtl8125_phy_param
+
+The integrated PHY's of RTL8125/8126 have an own mechanism to access
+PHY parameters, similar to what r8168g_phy_param does on earlier PHY
+versions. Add helper rtl8125_phy_param to simplify the code.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/847b7356-12d6-441b-ade9-4b6e1539b84a@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ .../net/ethernet/realtek/r8169_phy_config.c   | 36 +++++++++----------
+ 1 file changed, 16 insertions(+), 20 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -50,6 +50,15 @@ static void r8168g_phy_param(struct phy_
+ 	phy_restore_page(phydev, oldpage, 0);
+ }
+ 
++static void rtl8125_phy_param(struct phy_device *phydev, u16 parm,
++			      u16 mask, u16 val)
++{
++	phy_lock_mdio_bus(phydev);
++	__phy_write_mmd(phydev, MDIO_MMD_VEND2, 0xb87c, parm);
++	__phy_modify_mmd(phydev, MDIO_MMD_VEND2, 0xb87e, mask, val);
++	phy_unlock_mdio_bus(phydev);
++}
++
+ struct phy_reg {
+ 	u16 reg;
+ 	u16 val;
+@@ -1004,12 +1013,8 @@ static void rtl8125a_2_hw_phy_config(str
+ 	phy_write_paged(phydev, 0xac5, 0x16, 0x01ff);
+ 	phy_modify_paged(phydev, 0xac8, 0x15, 0x00f0, 0x0030);
+ 
+-	phy_write(phydev, 0x1f, 0x0b87);
+-	phy_write(phydev, 0x16, 0x80a2);
+-	phy_write(phydev, 0x17, 0x0153);
+-	phy_write(phydev, 0x16, 0x809c);
+-	phy_write(phydev, 0x17, 0x0153);
+-	phy_write(phydev, 0x1f, 0x0000);
++	rtl8125_phy_param(phydev, 0x80a2, 0xffff, 0x0153);
++	rtl8125_phy_param(phydev, 0x809c, 0xffff, 0x0153);
+ 
+ 	phy_write(phydev, 0x1f, 0x0a43);
+ 	phy_write(phydev, 0x13, 0x81B3);
+@@ -1061,14 +1066,9 @@ static void rtl8125b_hw_phy_config(struc
+ 	phy_modify_paged(phydev, 0xac4, 0x13, 0x00f0, 0x0090);
+ 	phy_modify_paged(phydev, 0xad3, 0x10, 0x0003, 0x0001);
+ 
+-	phy_write(phydev, 0x1f, 0x0b87);
+-	phy_write(phydev, 0x16, 0x80f5);
+-	phy_write(phydev, 0x17, 0x760e);
+-	phy_write(phydev, 0x16, 0x8107);
+-	phy_write(phydev, 0x17, 0x360e);
+-	phy_write(phydev, 0x16, 0x8551);
+-	phy_modify(phydev, 0x17, 0xff00, 0x0800);
+-	phy_write(phydev, 0x1f, 0x0000);
++	rtl8125_phy_param(phydev, 0x80f5, 0xffff, 0x760e);
++	rtl8125_phy_param(phydev, 0x8107, 0xffff, 0x360e);
++	rtl8125_phy_param(phydev, 0x8551, 0xff00, 0x0800);
+ 
+ 	phy_modify_paged(phydev, 0xbf0, 0x10, 0xe000, 0xa000);
+ 	phy_modify_paged(phydev, 0xbf4, 0x13, 0x0f00, 0x0300);
+@@ -1110,12 +1110,8 @@ static void rtl8125bp_hw_phy_config(stru
+ 
+ 	r8168g_phy_param(phydev, 0x8010, 0x0800, 0x0000);
+ 
+-	phy_write(phydev, 0x1f, 0x0b87);
+-	phy_write(phydev, 0x16, 0x8088);
+-	phy_modify(phydev, 0x17, 0xff00, 0x9000);
+-	phy_write(phydev, 0x16, 0x808f);
+-	phy_modify(phydev, 0x17, 0xff00, 0x9000);
+-	phy_write(phydev, 0x1f, 0x0000);
++	rtl8125_phy_param(phydev, 0x8088, 0xff00, 0x9000);
++	rtl8125_phy_param(phydev, 0x808f, 0xff00, 0x9000);
+ 
+ 	r8168g_phy_param(phydev, 0x8174, 0x2000, 0x1800);
+ 
diff --git a/target/linux/generic/backport-6.6/780-59-v6.16-r8169-refactor-chip-version-detection.patch b/target/linux/generic/backport-6.6/780-59-v6.16-r8169-refactor-chip-version-detection.patch
new file mode 100644
index 00000000000000..7ffff5dc9be0ad
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-59-v6.16-r8169-refactor-chip-version-detection.patch
@@ -0,0 +1,401 @@
+From 2b065c098c37a3ed28df7c3be59dca61b9da8402 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Tue, 15 Apr 2025 21:29:34 +0200
+Subject: [PATCH] r8169: refactor chip version detection
+
+Refactor chip version detection and merge both configuration tables.
+Apart from reducing the code by a third, this paves the way for
+merging chip version handling if only difference is the firmware.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Link: https://patch.msgid.link/1fea533a-dd5a-4198-a9e2-895e11083947@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 325 +++++++++-------------
+ 1 file changed, 128 insertions(+), 197 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -91,61 +91,114 @@
+ #define JUMBO_9K	(9 * SZ_1K - VLAN_ETH_HLEN - ETH_FCS_LEN)
+ #define JUMBO_16K	(SZ_16K - VLAN_ETH_HLEN - ETH_FCS_LEN)
+ 
+-static const struct {
++static const struct rtl_chip_info {
++	u16 mask;
++	u16 val;
++	enum mac_version mac_version;
+ 	const char *name;
+ 	const char *fw_name;
+ } rtl_chip_infos[] = {
+-	/* PCI devices. */
+-	[RTL_GIGA_MAC_VER_02] = {"RTL8169s"				},
+-	[RTL_GIGA_MAC_VER_03] = {"RTL8110s"				},
+-	[RTL_GIGA_MAC_VER_04] = {"RTL8169sb/8110sb"			},
+-	[RTL_GIGA_MAC_VER_05] = {"RTL8169sc/8110sc"			},
+-	[RTL_GIGA_MAC_VER_06] = {"RTL8169sc/8110sc"			},
+-	/* PCI-E devices. */
+-	[RTL_GIGA_MAC_VER_07] = {"RTL8102e"				},
+-	[RTL_GIGA_MAC_VER_08] = {"RTL8102e"				},
+-	[RTL_GIGA_MAC_VER_09] = {"RTL8102e/RTL8103e"			},
+-	[RTL_GIGA_MAC_VER_10] = {"RTL8101e/RTL8100e"			},
+-	[RTL_GIGA_MAC_VER_14] = {"RTL8401"				},
+-	[RTL_GIGA_MAC_VER_17] = {"RTL8168b/8111b"			},
+-	[RTL_GIGA_MAC_VER_18] = {"RTL8168cp/8111cp"			},
+-	[RTL_GIGA_MAC_VER_19] = {"RTL8168c/8111c"			},
+-	[RTL_GIGA_MAC_VER_20] = {"RTL8168c/8111c"			},
+-	[RTL_GIGA_MAC_VER_21] = {"RTL8168c/8111c"			},
+-	[RTL_GIGA_MAC_VER_22] = {"RTL8168c/8111c"			},
+-	[RTL_GIGA_MAC_VER_23] = {"RTL8168cp/8111cp"			},
+-	[RTL_GIGA_MAC_VER_24] = {"RTL8168cp/8111cp"			},
+-	[RTL_GIGA_MAC_VER_25] = {"RTL8168d/8111d",	FIRMWARE_8168D_1},
+-	[RTL_GIGA_MAC_VER_26] = {"RTL8168d/8111d",	FIRMWARE_8168D_2},
+-	[RTL_GIGA_MAC_VER_28] = {"RTL8168dp/8111dp"			},
+-	[RTL_GIGA_MAC_VER_29] = {"RTL8105e",		FIRMWARE_8105E_1},
+-	[RTL_GIGA_MAC_VER_30] = {"RTL8105e",		FIRMWARE_8105E_1},
+-	[RTL_GIGA_MAC_VER_31] = {"RTL8168dp/8111dp"			},
+-	[RTL_GIGA_MAC_VER_32] = {"RTL8168e/8111e",	FIRMWARE_8168E_1},
+-	[RTL_GIGA_MAC_VER_33] = {"RTL8168e/8111e",	FIRMWARE_8168E_2},
+-	[RTL_GIGA_MAC_VER_34] = {"RTL8168evl/8111evl",	FIRMWARE_8168E_3},
+-	[RTL_GIGA_MAC_VER_35] = {"RTL8168f/8111f",	FIRMWARE_8168F_1},
+-	[RTL_GIGA_MAC_VER_36] = {"RTL8168f/8111f",	FIRMWARE_8168F_2},
+-	[RTL_GIGA_MAC_VER_37] = {"RTL8402",		FIRMWARE_8402_1 },
+-	[RTL_GIGA_MAC_VER_38] = {"RTL8411",		FIRMWARE_8411_1 },
+-	[RTL_GIGA_MAC_VER_39] = {"RTL8106e",		FIRMWARE_8106E_1},
+-	[RTL_GIGA_MAC_VER_40] = {"RTL8168g/8111g",	FIRMWARE_8168G_2},
+-	[RTL_GIGA_MAC_VER_42] = {"RTL8168gu/8111gu",	FIRMWARE_8168G_3},
+-	[RTL_GIGA_MAC_VER_43] = {"RTL8106eus",		FIRMWARE_8106E_2},
+-	[RTL_GIGA_MAC_VER_44] = {"RTL8411b",		FIRMWARE_8411_2 },
+-	[RTL_GIGA_MAC_VER_46] = {"RTL8168h/8111h",	FIRMWARE_8168H_2},
+-	[RTL_GIGA_MAC_VER_48] = {"RTL8107e",		FIRMWARE_8107E_2},
+-	[RTL_GIGA_MAC_VER_51] = {"RTL8168ep/8111ep"			},
+-	[RTL_GIGA_MAC_VER_52] = {"RTL8168fp/RTL8117",  FIRMWARE_8168FP_3},
+-	[RTL_GIGA_MAC_VER_53] = {"RTL8168fp/RTL8117",			},
+-	[RTL_GIGA_MAC_VER_61] = {"RTL8125A",		FIRMWARE_8125A_3},
+-	/* reserve 62 for CFG_METHOD_4 in the vendor driver */
+-	[RTL_GIGA_MAC_VER_63] = {"RTL8125B",		FIRMWARE_8125B_2},
+-	[RTL_GIGA_MAC_VER_64] = {"RTL8125D",		FIRMWARE_8125D_1},
+-	[RTL_GIGA_MAC_VER_65] = {"RTL8125D",		FIRMWARE_8125D_2},
+-	[RTL_GIGA_MAC_VER_66] = {"RTL8125BP",		FIRMWARE_8125BP_2},
+-	[RTL_GIGA_MAC_VER_70] = {"RTL8126A",		FIRMWARE_8126A_2},
+-	[RTL_GIGA_MAC_VER_71] = {"RTL8126A",		FIRMWARE_8126A_3},
++	/* 8126A family. */
++	{ 0x7cf, 0x64a,	RTL_GIGA_MAC_VER_71, "RTL8126A", FIRMWARE_8126A_3 },
++	{ 0x7cf, 0x649,	RTL_GIGA_MAC_VER_70, "RTL8126A", FIRMWARE_8126A_2 },
++
++	/* 8125BP family. */
++	{ 0x7cf, 0x681,	RTL_GIGA_MAC_VER_66, "RTL8125BP", FIRMWARE_8125BP_2 },
++
++	/* 8125D family. */
++	{ 0x7cf, 0x689,	RTL_GIGA_MAC_VER_65, "RTL8125D", FIRMWARE_8125D_2 },
++	{ 0x7cf, 0x688,	RTL_GIGA_MAC_VER_64, "RTL8125D", FIRMWARE_8125D_1 },
++
++	/* 8125B family. */
++	{ 0x7cf, 0x641,	RTL_GIGA_MAC_VER_63, "RTL8125B", FIRMWARE_8125B_2 },
++
++	/* 8125A family. */
++	{ 0x7cf, 0x609,	RTL_GIGA_MAC_VER_61, "RTL8125A", FIRMWARE_8125A_3 },
++
++	/* RTL8117 */
++	{ 0x7cf, 0x54b,	RTL_GIGA_MAC_VER_53, "RTL8168fp/RTL8117" },
++	{ 0x7cf, 0x54a,	RTL_GIGA_MAC_VER_52, "RTL8168fp/RTL8117",
++	  FIRMWARE_8168FP_3 },
++
++	/* 8168EP family. */
++	{ 0x7cf, 0x502,	RTL_GIGA_MAC_VER_51, "RTL8168ep/8111ep" },
++
++	/* 8168H family. */
++	{ 0x7cf, 0x541,	RTL_GIGA_MAC_VER_46, "RTL8168h/8111h",
++	  FIRMWARE_8168H_2 },
++	/* Realtek calls it RTL8168M, but it's handled like RTL8168H */
++	{ 0x7cf, 0x6c0,	RTL_GIGA_MAC_VER_46, "RTL8168M", FIRMWARE_8168H_2 },
++
++	/* 8168G family. */
++	{ 0x7cf, 0x5c8,	RTL_GIGA_MAC_VER_44, "RTL8411b", FIRMWARE_8411_2 },
++	{ 0x7cf, 0x509,	RTL_GIGA_MAC_VER_42, "RTL8168gu/8111gu",
++	  FIRMWARE_8168G_3 },
++	{ 0x7cf, 0x4c0,	RTL_GIGA_MAC_VER_40, "RTL8168g/8111g",
++	  FIRMWARE_8168G_2 },
++
++	/* 8168F family. */
++	{ 0x7c8, 0x488,	RTL_GIGA_MAC_VER_38, "RTL8411", FIRMWARE_8411_1 },
++	{ 0x7cf, 0x481,	RTL_GIGA_MAC_VER_36, "RTL8168f/8111f",
++	  FIRMWARE_8168F_2 },
++	{ 0x7cf, 0x480,	RTL_GIGA_MAC_VER_35, "RTL8168f/8111f",
++	  FIRMWARE_8168F_1 },
++
++	/* 8168E family. */
++	{ 0x7c8, 0x2c8,	RTL_GIGA_MAC_VER_34, "RTL8168evl/8111evl",
++	  FIRMWARE_8168E_3 },
++	{ 0x7cf, 0x2c1,	RTL_GIGA_MAC_VER_32, "RTL8168e/8111e",
++	  FIRMWARE_8168E_1 },
++	{ 0x7c8, 0x2c0,	RTL_GIGA_MAC_VER_33, "RTL8168e/8111e",
++	  FIRMWARE_8168E_2 },
++
++	/* 8168D family. */
++	{ 0x7cf, 0x281,	RTL_GIGA_MAC_VER_25, "RTL8168d/8111d",
++	  FIRMWARE_8168D_1 },
++	{ 0x7c8, 0x280,	RTL_GIGA_MAC_VER_26, "RTL8168d/8111d",
++	  FIRMWARE_8168D_2 },
++
++	/* 8168DP family. */
++	{ 0x7cf, 0x28a,	RTL_GIGA_MAC_VER_28, "RTL8168dp/8111dp" },
++	{ 0x7cf, 0x28b,	RTL_GIGA_MAC_VER_31, "RTL8168dp/8111dp" },
++
++	/* 8168C family. */
++	{ 0x7cf, 0x3c9,	RTL_GIGA_MAC_VER_23, "RTL8168cp/8111cp" },
++	{ 0x7cf, 0x3c8,	RTL_GIGA_MAC_VER_18, "RTL8168cp/8111cp" },
++	{ 0x7c8, 0x3c8,	RTL_GIGA_MAC_VER_24, "RTL8168cp/8111cp" },
++	{ 0x7cf, 0x3c0,	RTL_GIGA_MAC_VER_19, "RTL8168c/8111c" },
++	{ 0x7cf, 0x3c2,	RTL_GIGA_MAC_VER_20, "RTL8168c/8111c" },
++	{ 0x7cf, 0x3c3,	RTL_GIGA_MAC_VER_21, "RTL8168c/8111c" },
++	{ 0x7c8, 0x3c0,	RTL_GIGA_MAC_VER_22, "RTL8168c/8111c" },
++
++	/* 8168B family. */
++	{ 0x7c8, 0x380,	RTL_GIGA_MAC_VER_17, "RTL8168b/8111b" },
++	/* This one is very old and rare, support has been removed.
++	 * { 0x7c8, 0x300, RTL_GIGA_MAC_VER_11, "RTL8168b/8111b" },
++	 */
++
++	/* 8101 family. */
++	{ 0x7c8, 0x448,	RTL_GIGA_MAC_VER_39, "RTL8106e", FIRMWARE_8106E_1 },
++	{ 0x7c8, 0x440,	RTL_GIGA_MAC_VER_37, "RTL8402", FIRMWARE_8402_1 },
++	{ 0x7cf, 0x409,	RTL_GIGA_MAC_VER_29, "RTL8105e", FIRMWARE_8105E_1 },
++	{ 0x7c8, 0x408,	RTL_GIGA_MAC_VER_30, "RTL8105e", FIRMWARE_8105E_1 },
++	{ 0x7cf, 0x349,	RTL_GIGA_MAC_VER_08, "RTL8102e" },
++	{ 0x7cf, 0x249,	RTL_GIGA_MAC_VER_08, "RTL8102e" },
++	{ 0x7cf, 0x348,	RTL_GIGA_MAC_VER_07, "RTL8102e" },
++	{ 0x7cf, 0x248,	RTL_GIGA_MAC_VER_07, "RTL8102e" },
++	{ 0x7cf, 0x240,	RTL_GIGA_MAC_VER_14, "RTL8401" },
++	{ 0x7c8, 0x348,	RTL_GIGA_MAC_VER_09, "RTL8102e/RTL8103e" },
++	{ 0x7c8, 0x248,	RTL_GIGA_MAC_VER_09, "RTL8102e/RTL8103e" },
++	{ 0x7c8, 0x340,	RTL_GIGA_MAC_VER_10, "RTL8101e/RTL8100e" },
++
++	/* 8110 family. */
++	{ 0xfc8, 0x980,	RTL_GIGA_MAC_VER_06, "RTL8169sc/8110sc" },
++	{ 0xfc8, 0x180,	RTL_GIGA_MAC_VER_05, "RTL8169sc/8110sc" },
++	{ 0xfc8, 0x100,	RTL_GIGA_MAC_VER_04, "RTL8169sb/8110sb" },
++	{ 0xfc8, 0x040,	RTL_GIGA_MAC_VER_03, "RTL8110s" },
++	{ 0xfc8, 0x008,	RTL_GIGA_MAC_VER_02, "RTL8169s" },
++
++	/* Catch-all */
++	{ 0x000, 0x000,	RTL_GIGA_MAC_NONE }
+ };
+ 
+ static const struct pci_device_id rtl8169_pci_tbl[] = {
+@@ -2267,151 +2320,30 @@ static const struct ethtool_ops rtl8169_
+ 	.get_eth_ctrl_stats	= rtl8169_get_eth_ctrl_stats,
+ };
+ 
+-static enum mac_version rtl8169_get_mac_version(u16 xid, bool gmii)
++static const struct rtl_chip_info *rtl8169_get_chip_version(u16 xid, bool gmii)
+ {
+-	/*
+-	 * The driver currently handles the 8168Bf and the 8168Be identically
+-	 * but they can be identified more specifically through the test below
+-	 * if needed:
+-	 *
+-	 * (RTL_R32(tp, TxConfig) & 0x700000) == 0x500000 ? 8168Bf : 8168Be
+-	 *
+-	 * Same thing for the 8101Eb and the 8101Ec:
+-	 *
+-	 * (RTL_R32(tp, TxConfig) & 0x700000) == 0x200000 ? 8101Eb : 8101Ec
+-	 */
+-	static const struct rtl_mac_info {
+-		u16 mask;
+-		u16 val;
+-		enum mac_version ver;
+-	} mac_info[] = {
+-		/* 8126A family. */
+-		{ 0x7cf, 0x64a,	RTL_GIGA_MAC_VER_71 },
+-		{ 0x7cf, 0x649,	RTL_GIGA_MAC_VER_70 },
+-
+-		/* 8125BP family. */
+-		{ 0x7cf, 0x681,	RTL_GIGA_MAC_VER_66 },
+-
+-		/* 8125D family. */
+-		{ 0x7cf, 0x689,	RTL_GIGA_MAC_VER_65 },
+-		{ 0x7cf, 0x688,	RTL_GIGA_MAC_VER_64 },
+-
+-		/* 8125B family. */
+-		{ 0x7cf, 0x641,	RTL_GIGA_MAC_VER_63 },
+-
+-		/* 8125A family. */
+-		{ 0x7cf, 0x609,	RTL_GIGA_MAC_VER_61 },
+-		/* It seems only XID 609 made it to the mass market.
+-		 * { 0x7cf, 0x608,	RTL_GIGA_MAC_VER_60 },
+-		 * { 0x7c8, 0x608,	RTL_GIGA_MAC_VER_61 },
+-		 */
+-
+-		/* RTL8117 */
+-		{ 0x7cf, 0x54b,	RTL_GIGA_MAC_VER_53 },
+-		{ 0x7cf, 0x54a,	RTL_GIGA_MAC_VER_52 },
+-
+-		/* 8168EP family. */
+-		{ 0x7cf, 0x502,	RTL_GIGA_MAC_VER_51 },
+-		/* It seems this chip version never made it to
+-		 * the wild. Let's disable detection.
+-		 * { 0x7cf, 0x501,      RTL_GIGA_MAC_VER_50 },
+-		 * { 0x7cf, 0x500,      RTL_GIGA_MAC_VER_49 },
+-		 */
+-
+-		/* 8168H family. */
+-		{ 0x7cf, 0x541,	RTL_GIGA_MAC_VER_46 },
+-		/* It seems this chip version never made it to
+-		 * the wild. Let's disable detection.
+-		 * { 0x7cf, 0x540,	RTL_GIGA_MAC_VER_45 },
+-		 */
+-		/* Realtek calls it RTL8168M, but it's handled like RTL8168H */
+-		{ 0x7cf, 0x6c0,	RTL_GIGA_MAC_VER_46 },
+-
+-		/* 8168G family. */
+-		{ 0x7cf, 0x5c8,	RTL_GIGA_MAC_VER_44 },
+-		{ 0x7cf, 0x509,	RTL_GIGA_MAC_VER_42 },
+-		/* It seems this chip version never made it to
+-		 * the wild. Let's disable detection.
+-		 * { 0x7cf, 0x4c1,	RTL_GIGA_MAC_VER_41 },
+-		 */
+-		{ 0x7cf, 0x4c0,	RTL_GIGA_MAC_VER_40 },
+-
+-		/* 8168F family. */
+-		{ 0x7c8, 0x488,	RTL_GIGA_MAC_VER_38 },
+-		{ 0x7cf, 0x481,	RTL_GIGA_MAC_VER_36 },
+-		{ 0x7cf, 0x480,	RTL_GIGA_MAC_VER_35 },
+-
+-		/* 8168E family. */
+-		{ 0x7c8, 0x2c8,	RTL_GIGA_MAC_VER_34 },
+-		{ 0x7cf, 0x2c1,	RTL_GIGA_MAC_VER_32 },
+-		{ 0x7c8, 0x2c0,	RTL_GIGA_MAC_VER_33 },
+-
+-		/* 8168D family. */
+-		{ 0x7cf, 0x281,	RTL_GIGA_MAC_VER_25 },
+-		{ 0x7c8, 0x280,	RTL_GIGA_MAC_VER_26 },
+-
+-		/* 8168DP family. */
+-		/* It seems this early RTL8168dp version never made it to
+-		 * the wild. Support has been removed.
+-		 * { 0x7cf, 0x288,      RTL_GIGA_MAC_VER_27 },
+-		 */
+-		{ 0x7cf, 0x28a,	RTL_GIGA_MAC_VER_28 },
+-		{ 0x7cf, 0x28b,	RTL_GIGA_MAC_VER_31 },
+-
+-		/* 8168C family. */
+-		{ 0x7cf, 0x3c9,	RTL_GIGA_MAC_VER_23 },
+-		{ 0x7cf, 0x3c8,	RTL_GIGA_MAC_VER_18 },
+-		{ 0x7c8, 0x3c8,	RTL_GIGA_MAC_VER_24 },
+-		{ 0x7cf, 0x3c0,	RTL_GIGA_MAC_VER_19 },
+-		{ 0x7cf, 0x3c2,	RTL_GIGA_MAC_VER_20 },
+-		{ 0x7cf, 0x3c3,	RTL_GIGA_MAC_VER_21 },
+-		{ 0x7c8, 0x3c0,	RTL_GIGA_MAC_VER_22 },
+-
+-		/* 8168B family. */
+-		{ 0x7c8, 0x380,	RTL_GIGA_MAC_VER_17 },
+-		/* This one is very old and rare, support has been removed.
+-		 * { 0x7c8, 0x300,	RTL_GIGA_MAC_VER_11 },
+-		 */
+-
+-		/* 8101 family. */
+-		{ 0x7c8, 0x448,	RTL_GIGA_MAC_VER_39 },
+-		{ 0x7c8, 0x440,	RTL_GIGA_MAC_VER_37 },
+-		{ 0x7cf, 0x409,	RTL_GIGA_MAC_VER_29 },
+-		{ 0x7c8, 0x408,	RTL_GIGA_MAC_VER_30 },
+-		{ 0x7cf, 0x349,	RTL_GIGA_MAC_VER_08 },
+-		{ 0x7cf, 0x249,	RTL_GIGA_MAC_VER_08 },
+-		{ 0x7cf, 0x348,	RTL_GIGA_MAC_VER_07 },
+-		{ 0x7cf, 0x248,	RTL_GIGA_MAC_VER_07 },
+-		{ 0x7cf, 0x240,	RTL_GIGA_MAC_VER_14 },
+-		{ 0x7c8, 0x348,	RTL_GIGA_MAC_VER_09 },
+-		{ 0x7c8, 0x248,	RTL_GIGA_MAC_VER_09 },
+-		{ 0x7c8, 0x340,	RTL_GIGA_MAC_VER_10 },
+-
+-		/* 8110 family. */
+-		{ 0xfc8, 0x980,	RTL_GIGA_MAC_VER_06 },
+-		{ 0xfc8, 0x180,	RTL_GIGA_MAC_VER_05 },
+-		{ 0xfc8, 0x100,	RTL_GIGA_MAC_VER_04 },
+-		{ 0xfc8, 0x040,	RTL_GIGA_MAC_VER_03 },
+-		{ 0xfc8, 0x008,	RTL_GIGA_MAC_VER_02 },
+-
+-		/* Catch-all */
+-		{ 0x000, 0x000,	RTL_GIGA_MAC_NONE   }
++	/* Chips combining a 1Gbps MAC with a 100Mbps PHY */
++	static const struct rtl_chip_info rtl8106eus_info = {
++		.mac_version = RTL_GIGA_MAC_VER_43,
++		.name = "RTL8106eus",
++		.fw_name = FIRMWARE_8106E_2,
+ 	};
+-	const struct rtl_mac_info *p = mac_info;
+-	enum mac_version ver;
++	static const struct rtl_chip_info rtl8107e_info = {
++		.mac_version = RTL_GIGA_MAC_VER_48,
++		.name = "RTL8107e",
++		.fw_name = FIRMWARE_8107E_2,
++	};
++	const struct rtl_chip_info *p = rtl_chip_infos;
+ 
+ 	while ((xid & p->mask) != p->val)
+ 		p++;
+-	ver = p->ver;
+ 
+-	if (ver != RTL_GIGA_MAC_NONE && !gmii) {
+-		if (ver == RTL_GIGA_MAC_VER_42)
+-			ver = RTL_GIGA_MAC_VER_43;
+-		else if (ver == RTL_GIGA_MAC_VER_46)
+-			ver = RTL_GIGA_MAC_VER_48;
+-	}
++	if (p->mac_version == RTL_GIGA_MAC_VER_42 && !gmii)
++		return &rtl8106eus_info;
++	if (p->mac_version == RTL_GIGA_MAC_VER_46 && !gmii)
++		return &rtl8107e_info;
+ 
+-	return ver;
++	return p;
+ }
+ 
+ static void rtl_release_firmware(struct rtl8169_private *tp)
+@@ -5448,9 +5380,9 @@ static bool rtl_aspm_is_safe(struct rtl8
+ 
+ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ {
++	const struct rtl_chip_info *chip;
+ 	struct rtl8169_private *tp;
+ 	int jumbo_max, region, rc;
+-	enum mac_version chipset;
+ 	struct net_device *dev;
+ 	u32 txconfig;
+ 	u16 xid;
+@@ -5501,12 +5433,13 @@ static int rtl_init_one(struct pci_dev *
+ 	xid = (txconfig >> 20) & 0xfcf;
+ 
+ 	/* Identify chip attached to board */
+-	chipset = rtl8169_get_mac_version(xid, tp->supports_gmii);
+-	if (chipset == RTL_GIGA_MAC_NONE)
++	chip = rtl8169_get_chip_version(xid, tp->supports_gmii);
++	if (chip->mac_version == RTL_GIGA_MAC_NONE)
+ 		return dev_err_probe(&pdev->dev, -ENODEV,
+ 				     "unknown chip XID %03x, contact r8169 maintainers (see MAINTAINERS file)\n",
+ 				     xid);
+-	tp->mac_version = chipset;
++	tp->mac_version = chip->mac_version;
++	tp->fw_name = chip->fw_name;
+ 
+ 	/* Disable ASPM L1 as that cause random device stop working
+ 	 * problems as well as full system hangs for some PCIe devices users.
+@@ -5610,8 +5543,6 @@ static int rtl_init_one(struct pci_dev *
+ 
+ 	rtl_set_irq_mask(tp);
+ 
+-	tp->fw_name = rtl_chip_infos[chipset].fw_name;
+-
+ 	tp->counters = dmam_alloc_coherent (&pdev->dev, sizeof(*tp->counters),
+ 					    &tp->counters_phys_addr,
+ 					    GFP_KERNEL);
+@@ -5636,7 +5567,7 @@ static int rtl_init_one(struct pci_dev *
+ 	}
+ 
+ 	netdev_info(dev, "%s, %pM, XID %03x, IRQ %d\n",
+-		    rtl_chip_infos[chipset].name, dev->dev_addr, xid, tp->irq);
++		    chip->name, dev->dev_addr, xid, tp->irq);
+ 
+ 	if (jumbo_max)
+ 		netdev_info(dev, "jumbo features [frames: %d bytes, tx checksumming: %s]\n",
diff --git a/target/linux/generic/backport-6.6/780-60-v6.16-r8169-add-RTL_GIGA_MAC_VER_LAST-to-facilitate-adding.patch b/target/linux/generic/backport-6.6/780-60-v6.16-r8169-add-RTL_GIGA_MAC_VER_LAST-to-facilitate-adding.patch
new file mode 100644
index 00000000000000..b46d331a3c8ff6
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-60-v6.16-r8169-add-RTL_GIGA_MAC_VER_LAST-to-facilitate-adding.patch
@@ -0,0 +1,159 @@
+From fe733618b27a8c033f0d246c2efff56fca322656 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Tue, 15 Apr 2025 21:39:23 +0200
+Subject: [PATCH] r8169: add RTL_GIGA_MAC_VER_LAST to facilitate adding support
+ for new chip versions
+
+Add a new mac_version enum value RTL_GIGA_MAC_VER_LAST. Benefit is that
+when adding support for a new chip version we have to touch less code,
+except something changes fundamentally.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/06991f47-2aec-4aa2-8918-2c6e79332303@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169.h      |  3 ++-
+ drivers/net/ethernet/realtek/r8169_main.c | 28 +++++++++++------------
+ 2 files changed, 16 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169.h
++++ b/drivers/net/ethernet/realtek/r8169.h
+@@ -73,7 +73,8 @@ enum mac_version {
+ 	RTL_GIGA_MAC_VER_66,
+ 	RTL_GIGA_MAC_VER_70,
+ 	RTL_GIGA_MAC_VER_71,
+-	RTL_GIGA_MAC_NONE
++	RTL_GIGA_MAC_NONE,
++	RTL_GIGA_MAC_VER_LAST = RTL_GIGA_MAC_NONE - 1
+ };
+ 
+ struct rtl8169_private;
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -1290,7 +1290,7 @@ static void rtl_writephy(struct rtl8169_
+ 	case RTL_GIGA_MAC_VER_31:
+ 		r8168dp_2_mdio_write(tp, location, val);
+ 		break;
+-	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_71:
++	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_LAST:
+ 		r8168g_mdio_write(tp, location, val);
+ 		break;
+ 	default:
+@@ -1305,7 +1305,7 @@ static int rtl_readphy(struct rtl8169_pr
+ 	case RTL_GIGA_MAC_VER_28:
+ 	case RTL_GIGA_MAC_VER_31:
+ 		return r8168dp_2_mdio_read(tp, location);
+-	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_71:
++	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_LAST:
+ 		return r8168g_mdio_read(tp, location);
+ 	default:
+ 		return r8169_mdio_read(tp, location);
+@@ -1657,7 +1657,7 @@ static void __rtl8169_set_wol(struct rtl
+ 		break;
+ 	case RTL_GIGA_MAC_VER_34:
+ 	case RTL_GIGA_MAC_VER_37:
+-	case RTL_GIGA_MAC_VER_39 ... RTL_GIGA_MAC_VER_71:
++	case RTL_GIGA_MAC_VER_39 ... RTL_GIGA_MAC_VER_LAST:
+ 		r8169_mod_reg8_cond(tp, Config2, PME_SIGNAL, wolopts);
+ 		break;
+ 	default:
+@@ -2130,7 +2130,7 @@ static void rtl_set_eee_txidle_timer(str
+ 		tp->tx_lpi_timer = timer_val;
+ 		r8168_mac_ocp_write(tp, 0xe048, timer_val);
+ 		break;
+-	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_71:
++	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_LAST:
+ 		tp->tx_lpi_timer = timer_val;
+ 		RTL_W16(tp, EEE_TXIDLE_TIMER_8125, timer_val);
+ 		break;
+@@ -2495,7 +2495,7 @@ static void rtl_init_rxcfg(struct rtl816
+ 	case RTL_GIGA_MAC_VER_61:
+ 		RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST);
+ 		break;
+-	case RTL_GIGA_MAC_VER_63 ... RTL_GIGA_MAC_VER_71:
++	case RTL_GIGA_MAC_VER_63 ... RTL_GIGA_MAC_VER_LAST:
+ 		RTL_W32(tp, RxConfig, RX_FETCH_DFLT_8125 | RX_DMA_BURST |
+ 			RX_PAUSE_SLOT_ON);
+ 		break;
+@@ -2627,7 +2627,7 @@ static void rtl_wait_txrx_fifo_empty(str
+ 	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_61:
+ 		rtl_loop_wait_high(tp, &rtl_rxtx_empty_cond, 100, 42);
+ 		break;
+-	case RTL_GIGA_MAC_VER_63 ... RTL_GIGA_MAC_VER_71:
++	case RTL_GIGA_MAC_VER_63 ... RTL_GIGA_MAC_VER_LAST:
+ 		RTL_W8(tp, ChipCmd, RTL_R8(tp, ChipCmd) | StopReq);
+ 		rtl_loop_wait_high(tp, &rtl_rxtx_empty_cond, 100, 42);
+ 		rtl_loop_wait_high(tp, &rtl_rxtx_empty_cond_2, 100, 42);
+@@ -2902,7 +2902,7 @@ static void rtl_enable_exit_l1(struct rt
+ 	case RTL_GIGA_MAC_VER_37 ... RTL_GIGA_MAC_VER_38:
+ 		rtl_eri_set_bits(tp, 0xd4, 0x0c00);
+ 		break;
+-	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_71:
++	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_LAST:
+ 		r8168_mac_ocp_modify(tp, 0xc0ac, 0, 0x1f80);
+ 		break;
+ 	default:
+@@ -2916,7 +2916,7 @@ static void rtl_disable_exit_l1(struct r
+ 	case RTL_GIGA_MAC_VER_34 ... RTL_GIGA_MAC_VER_38:
+ 		rtl_eri_clear_bits(tp, 0xd4, 0x1f00);
+ 		break;
+-	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_71:
++	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_LAST:
+ 		r8168_mac_ocp_modify(tp, 0xc0ac, 0x1f80, 0);
+ 		break;
+ 	default:
+@@ -2954,7 +2954,7 @@ static void rtl_hw_aspm_clkreq_enable(st
+ 
+ 		switch (tp->mac_version) {
+ 		case RTL_GIGA_MAC_VER_46 ... RTL_GIGA_MAC_VER_48:
+-		case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_71:
++		case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_LAST:
+ 			/* reset ephy tx/rx disable timer */
+ 			r8168_mac_ocp_modify(tp, 0xe094, 0xff00, 0);
+ 			/* chip can trigger L1.2 */
+@@ -2966,7 +2966,7 @@ static void rtl_hw_aspm_clkreq_enable(st
+ 	} else {
+ 		switch (tp->mac_version) {
+ 		case RTL_GIGA_MAC_VER_46 ... RTL_GIGA_MAC_VER_48:
+-		case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_71:
++		case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_LAST:
+ 			r8168_mac_ocp_modify(tp, 0xe092, 0x00ff, 0);
+ 			break;
+ 		default:
+@@ -4098,7 +4098,7 @@ static void rtl8169_cleanup(struct rtl81
+ 		RTL_W8(tp, ChipCmd, RTL_R8(tp, ChipCmd) | StopReq);
+ 		rtl_loop_wait_high(tp, &rtl_txcfg_empty_cond, 100, 666);
+ 		break;
+-	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_71:
++	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_LAST:
+ 		rtl_enable_rxdvgate(tp);
+ 		fsleep(2000);
+ 		break;
+@@ -4255,7 +4255,7 @@ static unsigned int rtl_quirk_packet_pad
+ 
+ 	switch (tp->mac_version) {
+ 	case RTL_GIGA_MAC_VER_34:
+-	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_71:
++	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_LAST:
+ 		padto = max_t(unsigned int, padto, ETH_ZLEN);
+ 		break;
+ 	default:
+@@ -5310,7 +5310,7 @@ static void rtl_hw_initialize(struct rtl
+ 	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_48:
+ 		rtl_hw_init_8168g(tp);
+ 		break;
+-	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_71:
++	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_LAST:
+ 		rtl_hw_init_8125(tp);
+ 		break;
+ 	default:
+@@ -5335,7 +5335,7 @@ static int rtl_jumbo_max(struct rtl8169_
+ 	case RTL_GIGA_MAC_VER_18 ... RTL_GIGA_MAC_VER_24:
+ 		return JUMBO_6K;
+ 	/* RTL8125/8126 */
+-	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_71:
++	case RTL_GIGA_MAC_VER_61 ... RTL_GIGA_MAC_VER_LAST:
+ 		return JUMBO_16K;
+ 	default:
+ 		return JUMBO_9K;
diff --git a/target/linux/generic/backport-6.6/780-61-v6.16-r8169-use-pci_prepare_to_sleep-in-rtl_shutdown.patch b/target/linux/generic/backport-6.6/780-61-v6.16-r8169-use-pci_prepare_to_sleep-in-rtl_shutdown.patch
new file mode 100644
index 00000000000000..21fdca103157c8
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-61-v6.16-r8169-use-pci_prepare_to_sleep-in-rtl_shutdown.patch
@@ -0,0 +1,37 @@
+From b7ed5d5a78fccee96cf8919ac2c7a064c2f4c45b Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Mon, 21 Apr 2025 11:25:18 +0200
+Subject: [PATCH] r8169: use pci_prepare_to_sleep in rtl_shutdown
+
+Use pci_prepare_to_sleep() like PCI core does in pci_pm_suspend_noirq.
+This aligns setting a low-power mode during shutdown with the handling
+of the transition to system suspend. Also the transition to runtime
+suspend uses pci_target_state() instead of setting D3hot unconditionally.
+
+Note: pci_prepare_to_sleep() uses device_may_wakeup() to check whether
+      device may generate wakeup events. So we don't lose anything by
+      not passing tp->saved_wolopts any longer.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/f573fdbd-ba6d-41c1-b68f-311d3c88db2c@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169_main.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -5047,10 +5047,8 @@ static void rtl_shutdown(struct pci_dev
+ 	/* Restore original MAC address */
+ 	rtl_rar_set(tp, tp->dev->perm_addr);
+ 
+-	if (system_state == SYSTEM_POWER_OFF && !tp->dash_enabled) {
+-		pci_wake_from_d3(pdev, tp->saved_wolopts);
+-		pci_set_power_state(pdev, PCI_D3hot);
+-	}
++	if (system_state == SYSTEM_POWER_OFF && !tp->dash_enabled)
++		pci_prepare_to_sleep(pdev);
+ }
+ 
+ static void rtl_remove_one(struct pci_dev *pdev)
diff --git a/target/linux/generic/backport-6.6/780-62-v6.16-r8169-merge-chip-versions-70-and-71-RTL8126A.patch b/target/linux/generic/backport-6.6/780-62-v6.16-r8169-merge-chip-versions-70-and-71-RTL8126A.patch
new file mode 100644
index 00000000000000..08f7d4f90ad861
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-62-v6.16-r8169-merge-chip-versions-70-and-71-RTL8126A.patch
@@ -0,0 +1,106 @@
+From 4dec0702b8627c364a0e1f2c5b249e06709a1c24 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Fri, 18 Apr 2025 11:23:45 +0200
+Subject: [PATCH] r8169: merge chip versions 70 and 71 (RTL8126A)
+
+Handling of both chip versions is the same, only difference is
+the firmware. So we can merge handling of both chip versions.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/97d7ae79-d021-4b6b-b424-89e5e305b029@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169.h            |  1 -
+ drivers/net/ethernet/realtek/r8169_main.c       | 15 ++++-----------
+ drivers/net/ethernet/realtek/r8169_phy_config.c |  1 -
+ 3 files changed, 4 insertions(+), 13 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169.h
++++ b/drivers/net/ethernet/realtek/r8169.h
+@@ -72,7 +72,6 @@ enum mac_version {
+ 	RTL_GIGA_MAC_VER_65,
+ 	RTL_GIGA_MAC_VER_66,
+ 	RTL_GIGA_MAC_VER_70,
+-	RTL_GIGA_MAC_VER_71,
+ 	RTL_GIGA_MAC_NONE,
+ 	RTL_GIGA_MAC_VER_LAST = RTL_GIGA_MAC_NONE - 1
+ };
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -99,7 +99,7 @@ static const struct rtl_chip_info {
+ 	const char *fw_name;
+ } rtl_chip_infos[] = {
+ 	/* 8126A family. */
+-	{ 0x7cf, 0x64a,	RTL_GIGA_MAC_VER_71, "RTL8126A", FIRMWARE_8126A_3 },
++	{ 0x7cf, 0x64a,	RTL_GIGA_MAC_VER_70, "RTL8126A", FIRMWARE_8126A_3 },
+ 	{ 0x7cf, 0x649,	RTL_GIGA_MAC_VER_70, "RTL8126A", FIRMWARE_8126A_2 },
+ 
+ 	/* 8125BP family. */
+@@ -2943,7 +2943,6 @@ static void rtl_hw_aspm_clkreq_enable(st
+ 		rtl_mod_config5(tp, 0, ASPM_en);
+ 		switch (tp->mac_version) {
+ 		case RTL_GIGA_MAC_VER_70:
+-		case RTL_GIGA_MAC_VER_71:
+ 			val8 = RTL_R8(tp, INT_CFG0_8125) | INT_CFG0_CLKREQEN;
+ 			RTL_W8(tp, INT_CFG0_8125, val8);
+ 			break;
+@@ -2975,7 +2974,6 @@ static void rtl_hw_aspm_clkreq_enable(st
+ 
+ 		switch (tp->mac_version) {
+ 		case RTL_GIGA_MAC_VER_70:
+-		case RTL_GIGA_MAC_VER_71:
+ 			val8 = RTL_R8(tp, INT_CFG0_8125) & ~INT_CFG0_CLKREQEN;
+ 			RTL_W8(tp, INT_CFG0_8125, val8);
+ 			break;
+@@ -3695,12 +3693,10 @@ static void rtl_hw_start_8125_common(str
+ 	/* disable new tx descriptor format */
+ 	r8168_mac_ocp_modify(tp, 0xeb58, 0x0001, 0x0000);
+ 
+-	if (tp->mac_version == RTL_GIGA_MAC_VER_70 ||
+-	    tp->mac_version == RTL_GIGA_MAC_VER_71)
++	if (tp->mac_version == RTL_GIGA_MAC_VER_70)
+ 		RTL_W8(tp, 0xD8, RTL_R8(tp, 0xD8) & ~0x02);
+ 
+-	if (tp->mac_version == RTL_GIGA_MAC_VER_70 ||
+-	    tp->mac_version == RTL_GIGA_MAC_VER_71)
++	if (tp->mac_version == RTL_GIGA_MAC_VER_70)
+ 		r8168_mac_ocp_modify(tp, 0xe614, 0x0700, 0x0400);
+ 	else if (tp->mac_version == RTL_GIGA_MAC_VER_63)
+ 		r8168_mac_ocp_modify(tp, 0xe614, 0x0700, 0x0200);
+@@ -3718,8 +3714,7 @@ static void rtl_hw_start_8125_common(str
+ 	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0030);
+ 	r8168_mac_ocp_modify(tp, 0xe040, 0x1000, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xea1c, 0x0003, 0x0001);
+-	if (tp->mac_version == RTL_GIGA_MAC_VER_70 ||
+-	    tp->mac_version == RTL_GIGA_MAC_VER_71)
++	if (tp->mac_version == RTL_GIGA_MAC_VER_70)
+ 		r8168_mac_ocp_modify(tp, 0xea1c, 0x0300, 0x0000);
+ 	else
+ 		r8168_mac_ocp_modify(tp, 0xea1c, 0x0004, 0x0000);
+@@ -3842,7 +3837,6 @@ static void rtl_hw_config(struct rtl8169
+ 		[RTL_GIGA_MAC_VER_65] = rtl_hw_start_8125d,
+ 		[RTL_GIGA_MAC_VER_66] = rtl_hw_start_8125d,
+ 		[RTL_GIGA_MAC_VER_70] = rtl_hw_start_8126a,
+-		[RTL_GIGA_MAC_VER_71] = rtl_hw_start_8126a,
+ 	};
+ 
+ 	if (hw_configs[tp->mac_version])
+@@ -3866,7 +3860,6 @@ static void rtl_hw_start_8125(struct rtl
+ 		break;
+ 	case RTL_GIGA_MAC_VER_63:
+ 	case RTL_GIGA_MAC_VER_70:
+-	case RTL_GIGA_MAC_VER_71:
+ 		for (i = 0xa00; i < 0xa80; i += 4)
+ 			RTL_W32(tp, i, 0);
+ 		RTL_W16(tp, INT_CFG1_8125, 0x0000);
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -1183,7 +1183,6 @@ void r8169_hw_phy_config(struct rtl8169_
+ 		[RTL_GIGA_MAC_VER_65] = rtl8125d_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_66] = rtl8125bp_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_70] = rtl8126a_hw_phy_config,
+-		[RTL_GIGA_MAC_VER_71] = rtl8126a_hw_phy_config,
+ 	};
+ 
+ 	if (phy_configs[ver])
diff --git a/target/linux/generic/backport-6.6/780-63-v6.16-r8169-merge-chip-versions-64-and-65-RTL8125D.patch b/target/linux/generic/backport-6.6/780-63-v6.16-r8169-merge-chip-versions-64-and-65-RTL8125D.patch
new file mode 100644
index 00000000000000..5b29ccd0a10237
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-63-v6.16-r8169-merge-chip-versions-64-and-65-RTL8125D.patch
@@ -0,0 +1,65 @@
+From f372ef6ed5a6b0401c884561d4bba1843e54d46a Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Fri, 18 Apr 2025 11:24:30 +0200
+Subject: [PATCH] r8169: merge chip versions 64 and 65 (RTL8125D)
+
+Handling of both chip versions is the same, only difference is
+the firmware. So we can merge handling of both chip versions.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/0baad123-c679-4154-923f-fdc12783e900@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169.h            | 1 -
+ drivers/net/ethernet/realtek/r8169_main.c       | 4 +---
+ drivers/net/ethernet/realtek/r8169_phy_config.c | 1 -
+ 3 files changed, 1 insertion(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169.h
++++ b/drivers/net/ethernet/realtek/r8169.h
+@@ -69,7 +69,6 @@ enum mac_version {
+ 	RTL_GIGA_MAC_VER_61,
+ 	RTL_GIGA_MAC_VER_63,
+ 	RTL_GIGA_MAC_VER_64,
+-	RTL_GIGA_MAC_VER_65,
+ 	RTL_GIGA_MAC_VER_66,
+ 	RTL_GIGA_MAC_VER_70,
+ 	RTL_GIGA_MAC_NONE,
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -106,7 +106,7 @@ static const struct rtl_chip_info {
+ 	{ 0x7cf, 0x681,	RTL_GIGA_MAC_VER_66, "RTL8125BP", FIRMWARE_8125BP_2 },
+ 
+ 	/* 8125D family. */
+-	{ 0x7cf, 0x689,	RTL_GIGA_MAC_VER_65, "RTL8125D", FIRMWARE_8125D_2 },
++	{ 0x7cf, 0x689,	RTL_GIGA_MAC_VER_64, "RTL8125D", FIRMWARE_8125D_2 },
+ 	{ 0x7cf, 0x688,	RTL_GIGA_MAC_VER_64, "RTL8125D", FIRMWARE_8125D_1 },
+ 
+ 	/* 8125B family. */
+@@ -3834,7 +3834,6 @@ static void rtl_hw_config(struct rtl8169
+ 		[RTL_GIGA_MAC_VER_61] = rtl_hw_start_8125a_2,
+ 		[RTL_GIGA_MAC_VER_63] = rtl_hw_start_8125b,
+ 		[RTL_GIGA_MAC_VER_64] = rtl_hw_start_8125d,
+-		[RTL_GIGA_MAC_VER_65] = rtl_hw_start_8125d,
+ 		[RTL_GIGA_MAC_VER_66] = rtl_hw_start_8125d,
+ 		[RTL_GIGA_MAC_VER_70] = rtl_hw_start_8126a,
+ 	};
+@@ -3853,7 +3852,6 @@ static void rtl_hw_start_8125(struct rtl
+ 	switch (tp->mac_version) {
+ 	case RTL_GIGA_MAC_VER_61:
+ 	case RTL_GIGA_MAC_VER_64:
+-	case RTL_GIGA_MAC_VER_65:
+ 	case RTL_GIGA_MAC_VER_66:
+ 		for (i = 0xa00; i < 0xb00; i += 4)
+ 			RTL_W32(tp, i, 0);
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -1180,7 +1180,6 @@ void r8169_hw_phy_config(struct rtl8169_
+ 		[RTL_GIGA_MAC_VER_61] = rtl8125a_2_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_63] = rtl8125b_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_64] = rtl8125d_hw_phy_config,
+-		[RTL_GIGA_MAC_VER_65] = rtl8125d_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_66] = rtl8125bp_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_70] = rtl8126a_hw_phy_config,
+ 	};
diff --git a/target/linux/generic/backport-6.6/780-64-v6.16-r8169-merge-chip-versions-52-and-53-RTL8117.patch b/target/linux/generic/backport-6.6/780-64-v6.16-r8169-merge-chip-versions-52-and-53-RTL8117.patch
new file mode 100644
index 00000000000000..a03eb9f208b026
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-64-v6.16-r8169-merge-chip-versions-52-and-53-RTL8117.patch
@@ -0,0 +1,113 @@
+From 4f51e7d370a04122fa78470b031d6487c52298b1 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Fri, 18 Apr 2025 11:25:17 +0200
+Subject: [PATCH] r8169: merge chip versions 52 and 53 (RTL8117)
+
+Handling of both chip versions is the same, only difference is
+the firmware. So we can merge handling of both chip versions.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/ae866b71-c904-434e-befb-848c831e33ff@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169.h            |  1 -
+ drivers/net/ethernet/realtek/r8169_main.c       | 17 +++++++----------
+ drivers/net/ethernet/realtek/r8169_phy_config.c |  1 -
+ 3 files changed, 7 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169.h
++++ b/drivers/net/ethernet/realtek/r8169.h
+@@ -64,7 +64,6 @@ enum mac_version {
+ 	/* support for RTL_GIGA_MAC_VER_50 has been removed */
+ 	RTL_GIGA_MAC_VER_51,
+ 	RTL_GIGA_MAC_VER_52,
+-	RTL_GIGA_MAC_VER_53,
+ 	/* support for RTL_GIGA_MAC_VER_60 has been removed */
+ 	RTL_GIGA_MAC_VER_61,
+ 	RTL_GIGA_MAC_VER_63,
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -116,7 +116,7 @@ static const struct rtl_chip_info {
+ 	{ 0x7cf, 0x609,	RTL_GIGA_MAC_VER_61, "RTL8125A", FIRMWARE_8125A_3 },
+ 
+ 	/* RTL8117 */
+-	{ 0x7cf, 0x54b,	RTL_GIGA_MAC_VER_53, "RTL8168fp/RTL8117" },
++	{ 0x7cf, 0x54b,	RTL_GIGA_MAC_VER_52, "RTL8168fp/RTL8117" },
+ 	{ 0x7cf, 0x54a,	RTL_GIGA_MAC_VER_52, "RTL8168fp/RTL8117",
+ 	  FIRMWARE_8168FP_3 },
+ 
+@@ -831,7 +831,7 @@ static bool rtl_is_8168evl_up(struct rtl
+ {
+ 	return tp->mac_version >= RTL_GIGA_MAC_VER_34 &&
+ 	       tp->mac_version != RTL_GIGA_MAC_VER_39 &&
+-	       tp->mac_version <= RTL_GIGA_MAC_VER_53;
++	       tp->mac_version <= RTL_GIGA_MAC_VER_52;
+ }
+ 
+ static bool rtl_supports_eee(struct rtl8169_private *tp)
+@@ -999,9 +999,7 @@ void r8169_get_led_name(struct rtl8169_p
+ static void r8168fp_adjust_ocp_cmd(struct rtl8169_private *tp, u32 *cmd, int type)
+ {
+ 	/* based on RTL8168FP_OOBMAC_BASE in vendor driver */
+-	if (type == ERIAR_OOB &&
+-	    (tp->mac_version == RTL_GIGA_MAC_VER_52 ||
+-	     tp->mac_version == RTL_GIGA_MAC_VER_53))
++	if (type == ERIAR_OOB && tp->mac_version == RTL_GIGA_MAC_VER_52)
+ 		*cmd |= 0xf70 << 18;
+ }
+ 
+@@ -1501,7 +1499,7 @@ static enum rtl_dash_type rtl_get_dash_t
+ 	case RTL_GIGA_MAC_VER_28:
+ 	case RTL_GIGA_MAC_VER_31:
+ 		return RTL_DASH_DP;
+-	case RTL_GIGA_MAC_VER_51 ... RTL_GIGA_MAC_VER_53:
++	case RTL_GIGA_MAC_VER_51 ... RTL_GIGA_MAC_VER_52:
+ 		return RTL_DASH_EP;
+ 	case RTL_GIGA_MAC_VER_66:
+ 		return RTL_DASH_25_BP;
+@@ -2489,7 +2487,7 @@ static void rtl_init_rxcfg(struct rtl816
+ 	case RTL_GIGA_MAC_VER_38:
+ 		RTL_W32(tp, RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST);
+ 		break;
+-	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_53:
++	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_52:
+ 		RTL_W32(tp, RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
+ 		break;
+ 	case RTL_GIGA_MAC_VER_61:
+@@ -2620,7 +2618,7 @@ DECLARE_RTL_COND(rtl_rxtx_empty_cond_2)
+ static void rtl_wait_txrx_fifo_empty(struct rtl8169_private *tp)
+ {
+ 	switch (tp->mac_version) {
+-	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_53:
++	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_52:
+ 		rtl_loop_wait_high(tp, &rtl_txcfg_empty_cond, 100, 42);
+ 		rtl_loop_wait_high(tp, &rtl_rxtx_empty_cond, 100, 42);
+ 		break;
+@@ -3830,7 +3828,6 @@ static void rtl_hw_config(struct rtl8169
+ 		[RTL_GIGA_MAC_VER_48] = rtl_hw_start_8168h_1,
+ 		[RTL_GIGA_MAC_VER_51] = rtl_hw_start_8168ep_3,
+ 		[RTL_GIGA_MAC_VER_52] = rtl_hw_start_8117,
+-		[RTL_GIGA_MAC_VER_53] = rtl_hw_start_8117,
+ 		[RTL_GIGA_MAC_VER_61] = rtl_hw_start_8125a_2,
+ 		[RTL_GIGA_MAC_VER_63] = rtl_hw_start_8125b,
+ 		[RTL_GIGA_MAC_VER_64] = rtl_hw_start_8125d,
+@@ -5293,7 +5290,7 @@ static void rtl_hw_init_8125(struct rtl8
+ static void rtl_hw_initialize(struct rtl8169_private *tp)
+ {
+ 	switch (tp->mac_version) {
+-	case RTL_GIGA_MAC_VER_51 ... RTL_GIGA_MAC_VER_53:
++	case RTL_GIGA_MAC_VER_51 ... RTL_GIGA_MAC_VER_52:
+ 		rtl8168ep_stop_cmac(tp);
+ 		fallthrough;
+ 	case RTL_GIGA_MAC_VER_40 ... RTL_GIGA_MAC_VER_48:
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -1176,7 +1176,6 @@ void r8169_hw_phy_config(struct rtl8169_
+ 		[RTL_GIGA_MAC_VER_48] = rtl8168h_2_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_51] = rtl8168ep_2_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_52] = rtl8117_hw_phy_config,
+-		[RTL_GIGA_MAC_VER_53] = rtl8117_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_61] = rtl8125a_2_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_63] = rtl8125b_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_64] = rtl8125d_hw_phy_config,
diff --git a/target/linux/generic/backport-6.6/780-65-v6.16-r8169-add-support-for-RTL8127A.patch b/target/linux/generic/backport-6.6/780-65-v6.16-r8169-add-support-for-RTL8127A.patch
new file mode 100644
index 00000000000000..93f7bbc0cf2a37
--- /dev/null
+++ b/target/linux/generic/backport-6.6/780-65-v6.16-r8169-add-support-for-RTL8127A.patch
@@ -0,0 +1,323 @@
+From f24f7b2f3af9e008ded20f804d7829ee2efd43f2 Mon Sep 17 00:00:00 2001
+From: ChunHao Lin <hau@realtek.com>
+Date: Thu, 15 May 2025 17:53:03 +0800
+Subject: [PATCH] r8169: add support for RTL8127A
+
+This adds support for 10Gbs chip RTL8127A.
+
+Signed-off-by: ChunHao Lin <hau@realtek.com>
+Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/20250515095303.3138-1-hau@realtek.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/ethernet/realtek/r8169.h          |   1 +
+ drivers/net/ethernet/realtek/r8169_main.c     |  29 ++-
+ .../net/ethernet/realtek/r8169_phy_config.c   | 166 ++++++++++++++++++
+ 3 files changed, 193 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/r8169.h
++++ b/drivers/net/ethernet/realtek/r8169.h
+@@ -70,6 +70,7 @@ enum mac_version {
+ 	RTL_GIGA_MAC_VER_64,
+ 	RTL_GIGA_MAC_VER_66,
+ 	RTL_GIGA_MAC_VER_70,
++	RTL_GIGA_MAC_VER_80,
+ 	RTL_GIGA_MAC_NONE,
+ 	RTL_GIGA_MAC_VER_LAST = RTL_GIGA_MAC_NONE - 1
+ };
+--- a/drivers/net/ethernet/realtek/r8169_main.c
++++ b/drivers/net/ethernet/realtek/r8169_main.c
+@@ -60,6 +60,7 @@
+ #define FIRMWARE_8125BP_2	"rtl_nic/rtl8125bp-2.fw"
+ #define FIRMWARE_8126A_2	"rtl_nic/rtl8126a-2.fw"
+ #define FIRMWARE_8126A_3	"rtl_nic/rtl8126a-3.fw"
++#define FIRMWARE_8127A_1	"rtl_nic/rtl8127a-1.fw"
+ 
+ #define TX_DMA_BURST	7	/* Maximum PCI burst, '7' is unlimited */
+ #define InterFrameGap	0x03	/* 3 means InterFrameGap = the shortest one */
+@@ -98,6 +99,9 @@ static const struct rtl_chip_info {
+ 	const char *name;
+ 	const char *fw_name;
+ } rtl_chip_infos[] = {
++	/* 8127A family. */
++	{ 0x7cf, 0x6c9,	RTL_GIGA_MAC_VER_80, "RTL8127A", FIRMWARE_8127A_1 },
++
+ 	/* 8126A family. */
+ 	{ 0x7cf, 0x64a,	RTL_GIGA_MAC_VER_70, "RTL8126A", FIRMWARE_8126A_3 },
+ 	{ 0x7cf, 0x649,	RTL_GIGA_MAC_VER_70, "RTL8126A", FIRMWARE_8126A_2 },
+@@ -222,8 +226,10 @@ static const struct pci_device_id rtl816
+ 	{ 0x0001, 0x8168, PCI_ANY_ID, 0x2410 },
+ 	{ PCI_VDEVICE(REALTEK,	0x8125) },
+ 	{ PCI_VDEVICE(REALTEK,	0x8126) },
++	{ PCI_VDEVICE(REALTEK,	0x8127) },
+ 	{ PCI_VDEVICE(REALTEK,	0x3000) },
+ 	{ PCI_VDEVICE(REALTEK,	0x5000) },
++	{ PCI_VDEVICE(REALTEK,	0x0e10) },
+ 	{}
+ };
+ 
+@@ -770,6 +776,7 @@ MODULE_FIRMWARE(FIRMWARE_8125D_2);
+ MODULE_FIRMWARE(FIRMWARE_8125BP_2);
+ MODULE_FIRMWARE(FIRMWARE_8126A_2);
+ MODULE_FIRMWARE(FIRMWARE_8126A_3);
++MODULE_FIRMWARE(FIRMWARE_8127A_1);
+ 
+ static inline struct device *tp_to_dev(struct rtl8169_private *tp)
+ {
+@@ -2941,6 +2948,7 @@ static void rtl_hw_aspm_clkreq_enable(st
+ 		rtl_mod_config5(tp, 0, ASPM_en);
+ 		switch (tp->mac_version) {
+ 		case RTL_GIGA_MAC_VER_70:
++		case RTL_GIGA_MAC_VER_80:
+ 			val8 = RTL_R8(tp, INT_CFG0_8125) | INT_CFG0_CLKREQEN;
+ 			RTL_W8(tp, INT_CFG0_8125, val8);
+ 			break;
+@@ -2972,6 +2980,7 @@ static void rtl_hw_aspm_clkreq_enable(st
+ 
+ 		switch (tp->mac_version) {
+ 		case RTL_GIGA_MAC_VER_70:
++		case RTL_GIGA_MAC_VER_80:
+ 			val8 = RTL_R8(tp, INT_CFG0_8125) & ~INT_CFG0_CLKREQEN;
+ 			RTL_W8(tp, INT_CFG0_8125, val8);
+ 			break;
+@@ -3691,10 +3700,13 @@ static void rtl_hw_start_8125_common(str
+ 	/* disable new tx descriptor format */
+ 	r8168_mac_ocp_modify(tp, 0xeb58, 0x0001, 0x0000);
+ 
+-	if (tp->mac_version == RTL_GIGA_MAC_VER_70)
++	if (tp->mac_version == RTL_GIGA_MAC_VER_70 ||
++	    tp->mac_version == RTL_GIGA_MAC_VER_80)
+ 		RTL_W8(tp, 0xD8, RTL_R8(tp, 0xD8) & ~0x02);
+ 
+-	if (tp->mac_version == RTL_GIGA_MAC_VER_70)
++	if (tp->mac_version == RTL_GIGA_MAC_VER_80)
++		r8168_mac_ocp_modify(tp, 0xe614, 0x0f00, 0x0f00);
++	else if (tp->mac_version == RTL_GIGA_MAC_VER_70)
+ 		r8168_mac_ocp_modify(tp, 0xe614, 0x0700, 0x0400);
+ 	else if (tp->mac_version == RTL_GIGA_MAC_VER_63)
+ 		r8168_mac_ocp_modify(tp, 0xe614, 0x0700, 0x0200);
+@@ -3712,7 +3724,8 @@ static void rtl_hw_start_8125_common(str
+ 	r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0030);
+ 	r8168_mac_ocp_modify(tp, 0xe040, 0x1000, 0x0000);
+ 	r8168_mac_ocp_modify(tp, 0xea1c, 0x0003, 0x0001);
+-	if (tp->mac_version == RTL_GIGA_MAC_VER_70)
++	if (tp->mac_version == RTL_GIGA_MAC_VER_70 ||
++	    tp->mac_version == RTL_GIGA_MAC_VER_80)
+ 		r8168_mac_ocp_modify(tp, 0xea1c, 0x0300, 0x0000);
+ 	else
+ 		r8168_mac_ocp_modify(tp, 0xea1c, 0x0004, 0x0000);
+@@ -3790,6 +3803,12 @@ static void rtl_hw_start_8126a(struct rt
+ 	rtl_hw_start_8125_common(tp);
+ }
+ 
++static void rtl_hw_start_8127a(struct rtl8169_private *tp)
++{
++	rtl_set_def_aspm_entry_latency(tp);
++	rtl_hw_start_8125_common(tp);
++}
++
+ static void rtl_hw_config(struct rtl8169_private *tp)
+ {
+ 	static const rtl_generic_fct hw_configs[] = {
+@@ -3833,6 +3852,7 @@ static void rtl_hw_config(struct rtl8169
+ 		[RTL_GIGA_MAC_VER_64] = rtl_hw_start_8125d,
+ 		[RTL_GIGA_MAC_VER_66] = rtl_hw_start_8125d,
+ 		[RTL_GIGA_MAC_VER_70] = rtl_hw_start_8126a,
++		[RTL_GIGA_MAC_VER_80] = rtl_hw_start_8127a,
+ 	};
+ 
+ 	if (hw_configs[tp->mac_version])
+@@ -3850,8 +3870,11 @@ static void rtl_hw_start_8125(struct rtl
+ 	case RTL_GIGA_MAC_VER_61:
+ 	case RTL_GIGA_MAC_VER_64:
+ 	case RTL_GIGA_MAC_VER_66:
++	case RTL_GIGA_MAC_VER_80:
+ 		for (i = 0xa00; i < 0xb00; i += 4)
+ 			RTL_W32(tp, i, 0);
++		if (tp->mac_version == RTL_GIGA_MAC_VER_80)
++			RTL_W16(tp, INT_CFG1_8125, 0x0000);
+ 		break;
+ 	case RTL_GIGA_MAC_VER_63:
+ 	case RTL_GIGA_MAC_VER_70:
+--- a/drivers/net/ethernet/realtek/r8169_phy_config.c
++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c
+@@ -1130,6 +1130,171 @@ static void rtl8126a_hw_phy_config(struc
+ 	rtl8125_common_config_eee_phy(phydev);
+ }
+ 
++static void rtl8127a_1_hw_phy_config(struct rtl8169_private *tp,
++				     struct phy_device *phydev)
++{
++	r8169_apply_firmware(tp);
++	rtl8168g_enable_gphy_10m(phydev);
++
++	r8168g_phy_param(phydev, 0x8415, 0xff00, 0x9300);
++	r8168g_phy_param(phydev, 0x81a3, 0xff00, 0x0f00);
++	r8168g_phy_param(phydev, 0x81ae, 0xff00, 0x0f00);
++	r8168g_phy_param(phydev, 0x81b9, 0xff00, 0xb900);
++	rtl8125_phy_param(phydev, 0x83b0, 0x0e00, 0x0000);
++	rtl8125_phy_param(phydev, 0x83C5, 0x0e00, 0x0000);
++	rtl8125_phy_param(phydev, 0x83da, 0x0e00, 0x0000);
++	rtl8125_phy_param(phydev, 0x83ef, 0x0e00, 0x0000);
++	phy_modify_paged(phydev, 0x0bf3, 0x14, 0x01f0, 0x0160);
++	phy_modify_paged(phydev, 0x0bf3, 0x15, 0x001f, 0x0014);
++	phy_modify_paged(phydev, 0x0bf2, 0x14, 0x6000, 0x0000);
++	phy_modify_paged(phydev, 0x0bf2, 0x16, 0xc000, 0x0000);
++	phy_modify_paged(phydev, 0x0bf2, 0x14, 0x1fff, 0x0187);
++	phy_modify_paged(phydev, 0x0bf2, 0x15, 0x003f, 0x0003);
++
++	r8168g_phy_param(phydev, 0x8173, 0xffff, 0x8620);
++	r8168g_phy_param(phydev, 0x8175, 0xffff, 0x8671);
++	r8168g_phy_param(phydev, 0x817c, 0x0000, 0x2000);
++	r8168g_phy_param(phydev, 0x8187, 0x0000, 0x2000);
++	r8168g_phy_param(phydev, 0x8192, 0x0000, 0x2000);
++	r8168g_phy_param(phydev, 0x819d, 0x0000, 0x2000);
++	r8168g_phy_param(phydev, 0x81a8, 0x2000, 0x0000);
++	r8168g_phy_param(phydev, 0x81b3, 0x2000, 0x0000);
++	r8168g_phy_param(phydev, 0x81be, 0x0000, 0x2000);
++	r8168g_phy_param(phydev, 0x817d, 0xff00, 0xa600);
++	r8168g_phy_param(phydev, 0x8188, 0xff00, 0xa600);
++	r8168g_phy_param(phydev, 0x8193, 0xff00, 0xa600);
++	r8168g_phy_param(phydev, 0x819e, 0xff00, 0xa600);
++	r8168g_phy_param(phydev, 0x81a9, 0xff00, 0x1400);
++	r8168g_phy_param(phydev, 0x81b4, 0xff00, 0x1400);
++	r8168g_phy_param(phydev, 0x81bf, 0xff00, 0xa600);
++
++	phy_modify_paged(phydev, 0x0aea, 0x15, 0x0028, 0x0000);
++
++	rtl8125_phy_param(phydev, 0x84f0, 0xffff, 0x201c);
++	rtl8125_phy_param(phydev, 0x84f2, 0xffff, 0x3117);
++
++	phy_write_paged(phydev, 0x0aec, 0x13, 0x0000);
++	phy_write_paged(phydev, 0x0ae2, 0x10, 0xffff);
++	phy_write_paged(phydev, 0x0aec, 0x17, 0xffff);
++	phy_write_paged(phydev, 0x0aed, 0x11, 0xffff);
++	phy_write_paged(phydev, 0x0aec, 0x14, 0x0000);
++	phy_modify_paged(phydev, 0x0aed, 0x10, 0x0001, 0x0000);
++	phy_write_paged(phydev, 0x0adb, 0x14, 0x0150);
++	rtl8125_phy_param(phydev, 0x8197, 0xff00, 0x5000);
++	rtl8125_phy_param(phydev, 0x8231, 0xff00, 0x5000);
++	rtl8125_phy_param(phydev, 0x82cb, 0xff00, 0x5000);
++	rtl8125_phy_param(phydev, 0x82cd, 0xff00, 0x5700);
++	rtl8125_phy_param(phydev, 0x8233, 0xff00, 0x5700);
++	rtl8125_phy_param(phydev, 0x8199, 0xff00, 0x5700);
++
++	rtl8125_phy_param(phydev, 0x815a, 0xffff, 0x0150);
++	rtl8125_phy_param(phydev, 0x81f4, 0xffff, 0x0150);
++	rtl8125_phy_param(phydev, 0x828e, 0xffff, 0x0150);
++	rtl8125_phy_param(phydev, 0x81b1, 0xffff, 0x0000);
++	rtl8125_phy_param(phydev, 0x824b, 0xffff, 0x0000);
++	rtl8125_phy_param(phydev, 0x82e5, 0xffff, 0x0000);
++
++	rtl8125_phy_param(phydev, 0x84f7, 0xff00, 0x2800);
++	phy_modify_paged(phydev, 0x0aec, 0x11, 0x0000, 0x1000);
++	rtl8125_phy_param(phydev, 0x81b3, 0xff00, 0xad00);
++	rtl8125_phy_param(phydev, 0x824d, 0xff00, 0xad00);
++	rtl8125_phy_param(phydev, 0x82e7, 0xff00, 0xad00);
++	phy_modify_paged(phydev, 0x0ae4, 0x17, 0x000f, 0x0001);
++	rtl8125_phy_param(phydev, 0x82ce, 0xf000, 0x4000);
++
++	rtl8125_phy_param(phydev, 0x84ac, 0xffff, 0x0000);
++	rtl8125_phy_param(phydev, 0x84ae, 0xffff, 0x0000);
++	rtl8125_phy_param(phydev, 0x84b0, 0xffff, 0xf818);
++	rtl8125_phy_param(phydev, 0x84b2, 0xff00, 0x6000);
++
++	rtl8125_phy_param(phydev, 0x8ffc, 0xffff, 0x6008);
++	rtl8125_phy_param(phydev, 0x8ffe, 0xffff, 0xf450);
++
++	rtl8125_phy_param(phydev, 0x8015, 0x0000, 0x0200);
++	rtl8125_phy_param(phydev, 0x8016, 0x0800, 0x0000);
++	rtl8125_phy_param(phydev, 0x8fe6, 0xff00, 0x0800);
++	rtl8125_phy_param(phydev, 0x8fe4, 0xffff, 0x2114);
++
++	rtl8125_phy_param(phydev, 0x8647, 0xffff, 0xa7b1);
++	rtl8125_phy_param(phydev, 0x8649, 0xffff, 0xbbca);
++	rtl8125_phy_param(phydev, 0x864b, 0xff00, 0xdc00);
++
++	rtl8125_phy_param(phydev, 0x8154, 0xc000, 0x4000);
++	rtl8125_phy_param(phydev, 0x8158, 0xc000, 0x0000);
++
++	rtl8125_phy_param(phydev, 0x826c, 0xffff, 0xffff);
++	rtl8125_phy_param(phydev, 0x826e, 0xffff, 0xffff);
++
++	rtl8125_phy_param(phydev, 0x8872, 0xff00, 0x0e00);
++	r8168g_phy_param(phydev, 0x8012, 0x0000, 0x0800);
++	r8168g_phy_param(phydev, 0x8012, 0x0000, 0x4000);
++	phy_modify_paged(phydev, 0x0b57, 0x13, 0x0000, 0x0001);
++	r8168g_phy_param(phydev, 0x834a, 0xff00, 0x0700);
++	rtl8125_phy_param(phydev, 0x8217, 0x3f00, 0x2a00);
++	r8168g_phy_param(phydev, 0x81b1, 0xff00, 0x0b00);
++	rtl8125_phy_param(phydev, 0x8fed, 0xff00, 0x4e00);
++
++	rtl8125_phy_param(phydev, 0x88ac, 0xff00, 0x2300);
++	phy_modify_paged(phydev, 0x0bf0, 0x16, 0x0000, 0x3800);
++	rtl8125_phy_param(phydev, 0x88de, 0xff00, 0x0000);
++	rtl8125_phy_param(phydev, 0x80b4, 0xffff, 0x5195);
++
++	r8168g_phy_param(phydev, 0x8370, 0xffff, 0x8671);
++	r8168g_phy_param(phydev, 0x8372, 0xffff, 0x86c8);
++
++	r8168g_phy_param(phydev, 0x8401, 0xffff, 0x86c8);
++	r8168g_phy_param(phydev, 0x8403, 0xffff, 0x86da);
++	r8168g_phy_param(phydev, 0x8406, 0x1800, 0x1000);
++	r8168g_phy_param(phydev, 0x8408, 0x1800, 0x1000);
++	r8168g_phy_param(phydev, 0x840a, 0x1800, 0x1000);
++	r8168g_phy_param(phydev, 0x840c, 0x1800, 0x1000);
++	r8168g_phy_param(phydev, 0x840e, 0x1800, 0x1000);
++	r8168g_phy_param(phydev, 0x8410, 0x1800, 0x1000);
++	r8168g_phy_param(phydev, 0x8412, 0x1800, 0x1000);
++	r8168g_phy_param(phydev, 0x8414, 0x1800, 0x1000);
++	r8168g_phy_param(phydev, 0x8416, 0x1800, 0x1000);
++
++	r8168g_phy_param(phydev, 0x82bd, 0xffff, 0x1f40);
++
++	phy_modify_paged(phydev, 0x0bfb, 0x12, 0x07ff, 0x0328);
++	phy_write_paged(phydev, 0x0bfb, 0x13, 0x3e14);
++
++	r8168g_phy_param(phydev, 0x81c4, 0xffff, 0x003b);
++	r8168g_phy_param(phydev, 0x81c6, 0xffff, 0x0086);
++	r8168g_phy_param(phydev, 0x81c8, 0xffff, 0x00b7);
++	r8168g_phy_param(phydev, 0x81ca, 0xffff, 0x00db);
++	r8168g_phy_param(phydev, 0x81cc, 0xffff, 0x00fe);
++	r8168g_phy_param(phydev, 0x81ce, 0xffff, 0x00fe);
++	r8168g_phy_param(phydev, 0x81d0, 0xffff, 0x00fe);
++	r8168g_phy_param(phydev, 0x81d2, 0xffff, 0x00fe);
++	r8168g_phy_param(phydev, 0x81d4, 0xffff, 0x00c3);
++	r8168g_phy_param(phydev, 0x81d6, 0xffff, 0x0078);
++	r8168g_phy_param(phydev, 0x81d8, 0xffff, 0x0047);
++	r8168g_phy_param(phydev, 0x81da, 0xffff, 0x0023);
++
++	rtl8125_phy_param(phydev, 0x88d7, 0xffff, 0x01a0);
++	rtl8125_phy_param(phydev, 0x88d9, 0xffff, 0x01a0);
++	rtl8125_phy_param(phydev, 0x8ffa, 0xffff, 0x002a);
++
++	rtl8125_phy_param(phydev, 0x8fee, 0xffff, 0xffdf);
++	rtl8125_phy_param(phydev, 0x8ff0, 0xffff, 0xffff);
++	rtl8125_phy_param(phydev, 0x8ff2, 0xffff, 0x0a4a);
++	rtl8125_phy_param(phydev, 0x8ff4, 0xffff, 0xaa5a);
++	rtl8125_phy_param(phydev, 0x8ff6, 0xffff, 0x0a4a);
++
++	rtl8125_phy_param(phydev, 0x8ff8, 0xffff, 0xaa5a);
++	rtl8125_phy_param(phydev, 0x88d5, 0xff00, 0x0200);
++
++	r8168g_phy_param(phydev, 0x84bb, 0xff00, 0x0a00);
++	r8168g_phy_param(phydev, 0x84c0, 0xff00, 0x1600);
++
++	phy_modify_paged(phydev, 0x0a43, 0x10, 0x0000, 0x0003);
++
++	rtl8125_legacy_force_mode(phydev);
++	rtl8168g_disable_aldps(phydev);
++	rtl8125_common_config_eee_phy(phydev);
++}
++
+ void r8169_hw_phy_config(struct rtl8169_private *tp, struct phy_device *phydev,
+ 			 enum mac_version ver)
+ {
+@@ -1181,6 +1346,7 @@ void r8169_hw_phy_config(struct rtl8169_
+ 		[RTL_GIGA_MAC_VER_64] = rtl8125d_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_66] = rtl8125bp_hw_phy_config,
+ 		[RTL_GIGA_MAC_VER_70] = rtl8126a_hw_phy_config,
++		[RTL_GIGA_MAC_VER_80] = rtl8127a_1_hw_phy_config,
+ 	};
+ 
+ 	if (phy_configs[ver])
diff --git a/target/linux/generic/backport-6.6/781-18-v6.13-net-phy-realtek-merge-the-drivers-for-internal-NBase.patch b/target/linux/generic/backport-6.6/781-18-v6.13-net-phy-realtek-merge-the-drivers-for-internal-NBase.patch
new file mode 100644
index 00000000000000..771f60df91c524
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-18-v6.13-net-phy-realtek-merge-the-drivers-for-internal-NBase.patch
@@ -0,0 +1,136 @@
+From f87a17ed3b51fba4dfdd8f8b643b5423a85fc551 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Tue, 15 Oct 2024 07:47:14 +0200
+Subject: [PATCH] net: phy: realtek: merge the drivers for internal NBase-T
+ PHY's
+
+The Realtek RTL8125/RTL8126 NBase-T MAC/PHY chips have internal PHY's
+which are register-compatible, at least for the registers we use here.
+So let's use just one PHY driver to support all of them.
+These internal PHY's exist also as external C45 PHY's, but on the
+internal PHY's no access to MMD registers is possible. This can be
+used to differentiate between the internal and external version.
+
+As a side effect the drivers for two now external-only drivers don't
+require read_mmd/write_mmd hooks any longer.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://patch.msgid.link/c57081a6-811f-4571-ab35-34f4ca6de9af@gmail.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/phy/realtek.c | 53 +++++++++++++++++++++++++++++++--------
+ 1 file changed, 43 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -95,6 +95,7 @@
+ 
+ #define RTL_GENERIC_PHYID			0x001cc800
+ #define RTL_8211FVD_PHYID			0x001cc878
++#define RTL_8221B				0x001cc840
+ #define RTL_8221B_VB_CG				0x001cc849
+ #define RTL_8221B_VN_CG				0x001cc84a
+ #define RTL_8251B				0x001cc862
+@@ -1077,6 +1078,23 @@ static bool rtlgen_supports_2_5gbps(stru
+ 	return val >= 0 && val & MDIO_PMA_SPEED_2_5G;
+ }
+ 
++/* On internal PHY's MMD reads over C22 always return 0.
++ * Check a MMD register which is known to be non-zero.
++ */
++static bool rtlgen_supports_mmd(struct phy_device *phydev)
++{
++	int val;
++
++	phy_lock_mdio_bus(phydev);
++	__phy_write(phydev, MII_MMD_CTRL, MDIO_MMD_PCS);
++	__phy_write(phydev, MII_MMD_DATA, MDIO_PCS_EEE_ABLE);
++	__phy_write(phydev, MII_MMD_CTRL, MDIO_MMD_PCS | MII_MMD_CTRL_NOINCR);
++	val = __phy_read(phydev, MII_MMD_DATA);
++	phy_unlock_mdio_bus(phydev);
++
++	return val > 0;
++}
++
+ static int rtlgen_match_phy_device(struct phy_device *phydev)
+ {
+ 	return phydev->phy_id == RTL_GENERIC_PHYID &&
+@@ -1086,7 +1104,8 @@ static int rtlgen_match_phy_device(struc
+ static int rtl8226_match_phy_device(struct phy_device *phydev)
+ {
+ 	return phydev->phy_id == RTL_GENERIC_PHYID &&
+-	       rtlgen_supports_2_5gbps(phydev);
++	       rtlgen_supports_2_5gbps(phydev) &&
++	       rtlgen_supports_mmd(phydev);
+ }
+ 
+ static int rtlgen_is_c45_match(struct phy_device *phydev, unsigned int id,
+@@ -1098,6 +1117,11 @@ static int rtlgen_is_c45_match(struct ph
+ 		return !is_c45 && (id == phydev->phy_id);
+ }
+ 
++static int rtl8221b_match_phy_device(struct phy_device *phydev)
++{
++	return phydev->phy_id == RTL_8221B && rtlgen_supports_mmd(phydev);
++}
++
+ static int rtl8221b_vb_cg_c22_match_phy_device(struct phy_device *phydev)
+ {
+ 	return rtlgen_is_c45_match(phydev, RTL_8221B_VB_CG, false);
+@@ -1118,9 +1142,21 @@ static int rtl8221b_vn_cg_c45_match_phy_
+ 	return rtlgen_is_c45_match(phydev, RTL_8221B_VN_CG, true);
+ }
+ 
+-static int rtl8251b_c22_match_phy_device(struct phy_device *phydev)
++static int rtl_internal_nbaset_match_phy_device(struct phy_device *phydev)
+ {
+-	return rtlgen_is_c45_match(phydev, RTL_8251B, false);
++	if (phydev->is_c45)
++		return false;
++
++	switch (phydev->phy_id) {
++	case RTL_GENERIC_PHYID:
++	case RTL_8221B:
++	case RTL_8251B:
++		break;
++	default:
++		return false;
++	}
++
++	return rtlgen_supports_2_5gbps(phydev) && !rtlgen_supports_mmd(phydev);
+ }
+ 
+ static int rtl8251b_c45_match_phy_device(struct phy_device *phydev)
+@@ -1382,10 +1418,8 @@ static struct phy_driver realtek_drvs[]
+ 		.resume		= rtlgen_resume,
+ 		.read_page	= rtl821x_read_page,
+ 		.write_page	= rtl821x_write_page,
+-		.read_mmd	= rtl822x_read_mmd,
+-		.write_mmd	= rtl822x_write_mmd,
+ 	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc840),
++		.match_phy_device = rtl8221b_match_phy_device,
+ 		.name		= "RTL8226B_RTL8221B 2.5Gbps PHY",
+ 		.get_features	= rtl822x_get_features,
+ 		.config_aneg	= rtl822x_config_aneg,
+@@ -1396,8 +1430,6 @@ static struct phy_driver realtek_drvs[]
+ 		.resume		= rtlgen_resume,
+ 		.read_page	= rtl821x_read_page,
+ 		.write_page	= rtl821x_write_page,
+-		.read_mmd	= rtl822x_read_mmd,
+-		.write_mmd	= rtl822x_write_mmd,
+ 	}, {
+ 		PHY_ID_MATCH_EXACT(0x001cc838),
+ 		.name           = "RTL8226-CG 2.5Gbps PHY",
+@@ -1475,8 +1507,9 @@ static struct phy_driver realtek_drvs[]
+ 		.read_page      = rtl821x_read_page,
+ 		.write_page     = rtl821x_write_page,
+ 	}, {
+-		.match_phy_device = rtl8251b_c22_match_phy_device,
+-		.name           = "RTL8126A-internal 5Gbps PHY",
++		.match_phy_device = rtl_internal_nbaset_match_phy_device,
++		.name           = "Realtek Internal NBASE-T PHY",
++		.flags		= PHY_IS_INTERNAL,
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
+ 		.read_status    = rtl822x_read_status,
diff --git a/target/linux/generic/backport-6.6/781-19-v6.13-net-phy-realtek-add-RTL8125D-internal-PHY.patch b/target/linux/generic/backport-6.6/781-19-v6.13-net-phy-realtek-add-RTL8125D-internal-PHY.patch
new file mode 100644
index 00000000000000..4b9b9e8d48b3ff
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-19-v6.13-net-phy-realtek-add-RTL8125D-internal-PHY.patch
@@ -0,0 +1,29 @@
+From 8989bad541133c43550bff2b80edbe37b8fb9659 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 17 Oct 2024 18:01:13 +0200
+Subject: [PATCH] net: phy: realtek: add RTL8125D-internal PHY
+
+The first boards show up with Realtek's RTL8125D. This MAC/PHY chip
+comes with an integrated 2.5Gbps PHY with ID 0x001cc841. It's not
+clear yet whether there's an external version of this PHY and how
+Realtek calls it, therefore use the numeric id for now.
+
+Link: https://lore.kernel.org/netdev/2ada65e1-5dfa-456c-9334-2bc51272e9da@gmail.com/T/
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Message-ID: <7d2924de-053b-44d2-a479-870dc3878170@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+---
+ drivers/net/phy/realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -1151,6 +1151,7 @@ static int rtl_internal_nbaset_match_phy
+ 	case RTL_GENERIC_PHYID:
+ 	case RTL_8221B:
+ 	case RTL_8251B:
++	case 0x001cc841:
+ 		break;
+ 	default:
+ 		return false;
diff --git a/target/linux/generic/backport-6.6/781-20-v6.14-net-phy-realtek-clear-1000Base-T-lpa-if-link-is-down.patch b/target/linux/generic/backport-6.6/781-20-v6.14-net-phy-realtek-clear-1000Base-T-lpa-if-link-is-down.patch
new file mode 100644
index 00000000000000..3e9631e4a313f9
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-20-v6.14-net-phy-realtek-clear-1000Base-T-lpa-if-link-is-down.patch
@@ -0,0 +1,52 @@
+From 34d5a86ff7bbe225fba3ad91f9b4dc85fb408e18 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 15 Jan 2025 14:43:35 +0000
+Subject: [PATCH] net: phy: realtek: clear 1000Base-T lpa if link is down
+
+Only read 1000Base-T link partner advertisement if autonegotiation has
+completed and otherwise 1000Base-T link partner advertisement bits.
+
+This fixes bogus 1000Base-T link partner advertisement after link goes
+down (eg. by disconnecting the wire).
+Fixes: 5cb409b3960e ("net: phy: realtek: clear 1000Base-T link partner advertisement")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/realtek.c | 19 ++++++++-----------
+ 1 file changed, 8 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -1023,23 +1023,20 @@ static int rtl822x_c45_read_status(struc
+ {
+ 	int ret, val;
+ 
+-	ret = genphy_c45_read_status(phydev);
+-	if (ret < 0)
+-		return ret;
+-
+-	if (phydev->autoneg == AUTONEG_DISABLE ||
+-	    !genphy_c45_aneg_done(phydev))
+-		mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising, 0);
+-
+ 	/* Vendor register as C45 has no standardized support for 1000BaseT */
+-	if (phydev->autoneg == AUTONEG_ENABLE) {
++	if (phydev->autoneg == AUTONEG_ENABLE && genphy_c45_aneg_done(phydev)) {
+ 		val = phy_read_mmd(phydev, MDIO_MMD_VEND2,
+ 				   RTL822X_VND2_GANLPAR);
+ 		if (val < 0)
+ 			return val;
+-
+-		mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising, val);
++	} else {
++		val = 0;
+ 	}
++	mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising, val);
++
++	ret = genphy_c45_read_status(phydev);
++	if (ret < 0)
++		return ret;
+ 
+ 	if (!phydev->link)
+ 		return 0;
diff --git a/target/linux/generic/backport-6.6/781-21-v6.14-net-phy-realtek-clear-master_slave_state-if-link-is-.patch b/target/linux/generic/backport-6.6/781-21-v6.14-net-phy-realtek-clear-master_slave_state-if-link-is-.patch
new file mode 100644
index 00000000000000..778602d3e5b501
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-21-v6.14-net-phy-realtek-clear-master_slave_state-if-link-is-.patch
@@ -0,0 +1,35 @@
+From ea8318cb33e593bbfc59d637eae45a69732c5387 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 15 Jan 2025 14:43:43 +0000
+Subject: [PATCH] net: phy: realtek: clear master_slave_state if link is down
+
+rtlgen_decode_physr() which sets master_slave_state isn't called in case
+the link is down and other than rtlgen_read_status(),
+rtl822x_c45_read_status() doesn't implicitely clear master_slave_state.
+
+Avoid stale master_slave_state by always setting it to
+MASTER_SLAVE_STATE_UNKNOWN in rtl822x_c45_read_status() in case the link
+is down.
+
+Fixes: 081c9c0265c9 ("net: phy: realtek: read duplex and gbit master from PHYSR register")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/realtek.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -1038,8 +1038,10 @@ static int rtl822x_c45_read_status(struc
+ 	if (ret < 0)
+ 		return ret;
+ 
+-	if (!phydev->link)
++	if (!phydev->link) {
++		phydev->master_slave_state = MASTER_SLAVE_STATE_UNKNOWN;
+ 		return 0;
++	}
+ 
+ 	/* Read actual speed from vendor register. */
+ 	val = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL_VND2_PHYSR);
diff --git a/target/linux/generic/backport-6.6/781-22-v6.14-net-phy-realtek-always-clear-NBase-T-lpa.patch b/target/linux/generic/backport-6.6/781-22-v6.14-net-phy-realtek-always-clear-NBase-T-lpa.patch
new file mode 100644
index 00000000000000..d365ed0ad24761
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-22-v6.14-net-phy-realtek-always-clear-NBase-T-lpa.patch
@@ -0,0 +1,42 @@
+From d3eb58549842c60ed46f37da7f4da969e3d6ecd3 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Wed, 15 Jan 2025 14:45:00 +0000
+Subject: [PATCH] net: phy: realtek: always clear NBase-T lpa
+
+Clear NBase-T link partner advertisement before calling
+rtlgen_read_status() to avoid phy_resolve_aneg_linkmode() wrongly
+setting speed and duplex.
+
+This fixes bogus 2.5G/5G/10G link partner advertisement and thus
+speed and duplex being set by phy_resolve_aneg_linkmode() due to stale
+NBase-T lpa.
+
+Fixes: 68d5cd09e891 ("net: phy: realtek: change order of calls in C22 read_status()")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/realtek.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -952,15 +952,15 @@ static int rtl822x_read_status(struct ph
+ {
+ 	int lpadv, ret;
+ 
++	mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising, 0);
++
+ 	ret = rtlgen_read_status(phydev);
+ 	if (ret < 0)
+ 		return ret;
+ 
+ 	if (phydev->autoneg == AUTONEG_DISABLE ||
+-	    !phydev->autoneg_complete) {
+-		mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising, 0);
++	    !phydev->autoneg_complete)
+ 		return 0;
+-	}
+ 
+ 	lpadv = phy_read_paged(phydev, 0xa5d, 0x13);
+ 	if (lpadv < 0)
diff --git a/target/linux/generic/backport-6.6/781-23-v6.14-net-phy-realtek-add-support-for-reading-MDIO_MMD_VEN.patch b/target/linux/generic/backport-6.6/781-23-v6.14-net-phy-realtek-add-support-for-reading-MDIO_MMD_VEN.patch
new file mode 100644
index 00000000000000..2add672f441a9d
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-23-v6.14-net-phy-realtek-add-support-for-reading-MDIO_MMD_VEN.patch
@@ -0,0 +1,47 @@
+From 3d483a10327f38595f714f9f9e9dde43a622cb0f Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Sat, 11 Jan 2025 21:49:31 +0100
+Subject: [PATCH] net: phy: realtek: add support for reading MDIO_MMD_VEND2
+ regs on RTL8125/RTL8126
+
+RTL8125/RTL8126 don't support MMD access to the internal PHY, but
+provide a mechanism to access at least all MDIO_MMD_VEND2 registers.
+By exposing this mechanism standard MMD access functions can be used
+to access the MDIO_MMD_VEND2 registers.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/e821b302-5fe6-49ab-aabd-05da500581c0@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/realtek.c | 12 ++++++++++--
+ 1 file changed, 10 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/phy/realtek.c
++++ b/drivers/net/phy/realtek.c
+@@ -736,7 +736,11 @@ static int rtlgen_read_mmd(struct phy_de
+ {
+ 	int ret;
+ 
+-	if (devnum == MDIO_MMD_PCS && regnum == MDIO_PCS_EEE_ABLE) {
++	if (devnum == MDIO_MMD_VEND2) {
++		rtl821x_write_page(phydev, regnum >> 4);
++		ret = __phy_read(phydev, 0x10 + ((regnum & 0xf) >> 1));
++		rtl821x_write_page(phydev, 0);
++	} else if (devnum == MDIO_MMD_PCS && regnum == MDIO_PCS_EEE_ABLE) {
+ 		rtl821x_write_page(phydev, 0xa5c);
+ 		ret = __phy_read(phydev, 0x12);
+ 		rtl821x_write_page(phydev, 0);
+@@ -760,7 +764,11 @@ static int rtlgen_write_mmd(struct phy_d
+ {
+ 	int ret;
+ 
+-	if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV) {
++	if (devnum == MDIO_MMD_VEND2) {
++		rtl821x_write_page(phydev, regnum >> 4);
++		ret = __phy_write(phydev, 0x10 + ((regnum & 0xf) >> 1), val);
++		rtl821x_write_page(phydev, 0);
++	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV) {
+ 		rtl821x_write_page(phydev, 0xa5d);
+ 		ret = __phy_write(phydev, 0x10, val);
+ 		rtl821x_write_page(phydev, 0);
diff --git a/target/linux/generic/backport-6.6/781-24-v6.14-net-phy-move-realtek-PHY-driver-to-its-own-subdirect.patch b/target/linux/generic/backport-6.6/781-24-v6.14-net-phy-move-realtek-PHY-driver-to-its-own-subdirect.patch
new file mode 100644
index 00000000000000..e66d724a981f66
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-24-v6.14-net-phy-move-realtek-PHY-driver-to-its-own-subdirect.patch
@@ -0,0 +1,3247 @@
+From 1416a9b2ba710d31954131c06d46f298e340aa2c Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Sat, 11 Jan 2025 21:50:19 +0100
+Subject: [PATCH] net: phy: move realtek PHY driver to its own subdirectory
+
+In preparation of adding a source file with hwmon support, move the
+Realtek PHY driver to its own subdirectory and rename realtek.c to
+realtek_main.c.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/c566551b-c915-4e34-9b33-129a6ddd6e4c@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/Kconfig                               | 5 +----
+ drivers/net/phy/Makefile                              | 2 +-
+ drivers/net/phy/realtek/Kconfig                       | 5 +++++
+ drivers/net/phy/realtek/Makefile                      | 3 +++
+ drivers/net/phy/{realtek.c => realtek/realtek_main.c} | 0
+ 5 files changed, 10 insertions(+), 5 deletions(-)
+ create mode 100644 drivers/net/phy/realtek/Kconfig
+ create mode 100644 drivers/net/phy/realtek/Makefile
+ rename drivers/net/phy/{realtek.c => realtek/realtek_main.c} (100%)
+
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -325,10 +325,7 @@ config QSEMI_PHY
+ 	help
+ 	  Currently supports the qs6612
+ 
+-config REALTEK_PHY
+-	tristate "Realtek PHYs"
+-	help
+-	  Supports the Realtek 821x PHY.
++source "drivers/net/phy/realtek/Kconfig"
+ 
+ config RENESAS_PHY
+ 	tristate "Renesas PHYs"
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -83,7 +83,7 @@ obj-$(CONFIG_NXP_CBTX_PHY)	+= nxp-cbtx.o
+ obj-$(CONFIG_NXP_TJA11XX_PHY)	+= nxp-tja11xx.o
+ obj-y				+= qcom/
+ obj-$(CONFIG_QSEMI_PHY)		+= qsemi.o
+-obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
++obj-$(CONFIG_REALTEK_PHY)	+= realtek/
+ obj-$(CONFIG_RENESAS_PHY)	+= uPD60620.o
+ obj-$(CONFIG_ROCKCHIP_PHY)	+= rockchip.o
+ obj-$(CONFIG_SMSC_PHY)		+= smsc.o
+--- /dev/null
++++ b/drivers/net/phy/realtek/Kconfig
+@@ -0,0 +1,5 @@
++# SPDX-License-Identifier: GPL-2.0-only
++config REALTEK_PHY
++	tristate "Realtek PHYs"
++	help
++	  Currently supports RTL821x/RTL822x and fast ethernet PHYs
+--- /dev/null
++++ b/drivers/net/phy/realtek/Makefile
+@@ -0,0 +1,3 @@
++# SPDX-License-Identifier: GPL-2.0
++realtek-y			+= realtek_main.o
++obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
+--- a/drivers/net/phy/realtek.c
++++ /dev/null
+@@ -1,1589 +0,0 @@
+-// SPDX-License-Identifier: GPL-2.0+
+-/* drivers/net/phy/realtek.c
+- *
+- * Driver for Realtek PHYs
+- *
+- * Author: Johnson Leung <r58129@freescale.com>
+- *
+- * Copyright (c) 2004 Freescale Semiconductor, Inc.
+- */
+-#include <linux/bitops.h>
+-#include <linux/of.h>
+-#include <linux/phy.h>
+-#include <linux/module.h>
+-#include <linux/delay.h>
+-#include <linux/clk.h>
+-
+-#define RTL821x_PHYSR				0x11
+-#define RTL821x_PHYSR_DUPLEX			BIT(13)
+-#define RTL821x_PHYSR_SPEED			GENMASK(15, 14)
+-
+-#define RTL821x_INER				0x12
+-#define RTL8211B_INER_INIT			0x6400
+-#define RTL8211E_INER_LINK_STATUS		BIT(10)
+-#define RTL8211F_INER_LINK_STATUS		BIT(4)
+-
+-#define RTL821x_INSR				0x13
+-
+-#define RTL821x_EXT_PAGE_SELECT			0x1e
+-#define RTL821x_PAGE_SELECT			0x1f
+-
+-#define RTL8211F_PHYCR1				0x18
+-#define RTL8211F_PHYCR2				0x19
+-#define RTL8211F_INSR				0x1d
+-
+-#define RTL8211F_LEDCR				0x10
+-#define RTL8211F_LEDCR_MODE			BIT(15)
+-#define RTL8211F_LEDCR_ACT_TXRX			BIT(4)
+-#define RTL8211F_LEDCR_LINK_1000		BIT(3)
+-#define RTL8211F_LEDCR_LINK_100			BIT(1)
+-#define RTL8211F_LEDCR_LINK_10			BIT(0)
+-#define RTL8211F_LEDCR_MASK			GENMASK(4, 0)
+-#define RTL8211F_LEDCR_SHIFT			5
+-
+-#define RTL8211F_TX_DELAY			BIT(8)
+-#define RTL8211F_RX_DELAY			BIT(3)
+-
+-#define RTL8211F_ALDPS_PLL_OFF			BIT(1)
+-#define RTL8211F_ALDPS_ENABLE			BIT(2)
+-#define RTL8211F_ALDPS_XTAL_OFF			BIT(12)
+-
+-#define RTL8211E_CTRL_DELAY			BIT(13)
+-#define RTL8211E_TX_DELAY			BIT(12)
+-#define RTL8211E_RX_DELAY			BIT(11)
+-
+-#define RTL8211F_CLKOUT_EN			BIT(0)
+-
+-#define RTL8201F_ISR				0x1e
+-#define RTL8201F_ISR_ANERR			BIT(15)
+-#define RTL8201F_ISR_DUPLEX			BIT(13)
+-#define RTL8201F_ISR_LINK			BIT(11)
+-#define RTL8201F_ISR_MASK			(RTL8201F_ISR_ANERR | \
+-						 RTL8201F_ISR_DUPLEX | \
+-						 RTL8201F_ISR_LINK)
+-#define RTL8201F_IER				0x13
+-
+-#define RTL822X_VND1_SERDES_OPTION			0x697a
+-#define RTL822X_VND1_SERDES_OPTION_MODE_MASK		GENMASK(5, 0)
+-#define RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX_SGMII		0
+-#define RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX		2
+-
+-#define RTL822X_VND1_SERDES_CTRL3			0x7580
+-#define RTL822X_VND1_SERDES_CTRL3_MODE_MASK		GENMASK(5, 0)
+-#define RTL822X_VND1_SERDES_CTRL3_MODE_SGMII			0x02
+-#define RTL822X_VND1_SERDES_CTRL3_MODE_2500BASEX		0x16
+-
+-/* RTL822X_VND2_XXXXX registers are only accessible when phydev->is_c45
+- * is set, they cannot be accessed by C45-over-C22.
+- */
+-#define RTL822X_VND2_GBCR				0xa412
+-
+-#define RTL822X_VND2_GANLPAR				0xa414
+-
+-#define RTL8366RB_POWER_SAVE			0x15
+-#define RTL8366RB_POWER_SAVE_ON			BIT(12)
+-
+-#define RTL9000A_GINMR				0x14
+-#define RTL9000A_GINMR_LINK_STATUS		BIT(4)
+-
+-#define RTL_VND2_PHYSR				0xa434
+-#define RTL_VND2_PHYSR_DUPLEX			BIT(3)
+-#define RTL_VND2_PHYSR_SPEEDL			GENMASK(5, 4)
+-#define RTL_VND2_PHYSR_SPEEDH			GENMASK(10, 9)
+-#define RTL_VND2_PHYSR_MASTER			BIT(11)
+-#define RTL_VND2_PHYSR_SPEED_MASK		(RTL_VND2_PHYSR_SPEEDL | RTL_VND2_PHYSR_SPEEDH)
+-
+-#define RTL_GENERIC_PHYID			0x001cc800
+-#define RTL_8211FVD_PHYID			0x001cc878
+-#define RTL_8221B				0x001cc840
+-#define RTL_8221B_VB_CG				0x001cc849
+-#define RTL_8221B_VN_CG				0x001cc84a
+-#define RTL_8251B				0x001cc862
+-
+-#define RTL8211F_LED_COUNT			3
+-
+-MODULE_DESCRIPTION("Realtek PHY driver");
+-MODULE_AUTHOR("Johnson Leung");
+-MODULE_LICENSE("GPL");
+-
+-struct rtl821x_priv {
+-	u16 phycr1;
+-	u16 phycr2;
+-	bool has_phycr2;
+-	struct clk *clk;
+-};
+-
+-static int rtl821x_read_page(struct phy_device *phydev)
+-{
+-	return __phy_read(phydev, RTL821x_PAGE_SELECT);
+-}
+-
+-static int rtl821x_write_page(struct phy_device *phydev, int page)
+-{
+-	return __phy_write(phydev, RTL821x_PAGE_SELECT, page);
+-}
+-
+-static int rtl821x_probe(struct phy_device *phydev)
+-{
+-	struct device *dev = &phydev->mdio.dev;
+-	struct rtl821x_priv *priv;
+-	u32 phy_id = phydev->drv->phy_id;
+-	int ret;
+-
+-	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+-	if (!priv)
+-		return -ENOMEM;
+-
+-	priv->clk = devm_clk_get_optional_enabled(dev, NULL);
+-	if (IS_ERR(priv->clk))
+-		return dev_err_probe(dev, PTR_ERR(priv->clk),
+-				     "failed to get phy clock\n");
+-
+-	ret = phy_read_paged(phydev, 0xa43, RTL8211F_PHYCR1);
+-	if (ret < 0)
+-		return ret;
+-
+-	priv->phycr1 = ret & (RTL8211F_ALDPS_PLL_OFF | RTL8211F_ALDPS_ENABLE | RTL8211F_ALDPS_XTAL_OFF);
+-	if (of_property_read_bool(dev->of_node, "realtek,aldps-enable"))
+-		priv->phycr1 |= RTL8211F_ALDPS_PLL_OFF | RTL8211F_ALDPS_ENABLE | RTL8211F_ALDPS_XTAL_OFF;
+-
+-	priv->has_phycr2 = !(phy_id == RTL_8211FVD_PHYID);
+-	if (priv->has_phycr2) {
+-		ret = phy_read_paged(phydev, 0xa43, RTL8211F_PHYCR2);
+-		if (ret < 0)
+-			return ret;
+-
+-		priv->phycr2 = ret & RTL8211F_CLKOUT_EN;
+-		if (of_property_read_bool(dev->of_node, "realtek,clkout-disable"))
+-			priv->phycr2 &= ~RTL8211F_CLKOUT_EN;
+-	}
+-
+-	phydev->priv = priv;
+-
+-	return 0;
+-}
+-
+-static int rtl8201_ack_interrupt(struct phy_device *phydev)
+-{
+-	int err;
+-
+-	err = phy_read(phydev, RTL8201F_ISR);
+-
+-	return (err < 0) ? err : 0;
+-}
+-
+-static int rtl821x_ack_interrupt(struct phy_device *phydev)
+-{
+-	int err;
+-
+-	err = phy_read(phydev, RTL821x_INSR);
+-
+-	return (err < 0) ? err : 0;
+-}
+-
+-static int rtl8211f_ack_interrupt(struct phy_device *phydev)
+-{
+-	int err;
+-
+-	err = phy_read_paged(phydev, 0xa43, RTL8211F_INSR);
+-
+-	return (err < 0) ? err : 0;
+-}
+-
+-static int rtl8201_config_intr(struct phy_device *phydev)
+-{
+-	u16 val;
+-	int err;
+-
+-	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
+-		err = rtl8201_ack_interrupt(phydev);
+-		if (err)
+-			return err;
+-
+-		val = BIT(13) | BIT(12) | BIT(11);
+-		err = phy_write_paged(phydev, 0x7, RTL8201F_IER, val);
+-	} else {
+-		val = 0;
+-		err = phy_write_paged(phydev, 0x7, RTL8201F_IER, val);
+-		if (err)
+-			return err;
+-
+-		err = rtl8201_ack_interrupt(phydev);
+-	}
+-
+-	return err;
+-}
+-
+-static int rtl8211b_config_intr(struct phy_device *phydev)
+-{
+-	int err;
+-
+-	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
+-		err = rtl821x_ack_interrupt(phydev);
+-		if (err)
+-			return err;
+-
+-		err = phy_write(phydev, RTL821x_INER,
+-				RTL8211B_INER_INIT);
+-	} else {
+-		err = phy_write(phydev, RTL821x_INER, 0);
+-		if (err)
+-			return err;
+-
+-		err = rtl821x_ack_interrupt(phydev);
+-	}
+-
+-	return err;
+-}
+-
+-static int rtl8211e_config_intr(struct phy_device *phydev)
+-{
+-	int err;
+-
+-	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
+-		err = rtl821x_ack_interrupt(phydev);
+-		if (err)
+-			return err;
+-
+-		err = phy_write(phydev, RTL821x_INER,
+-				RTL8211E_INER_LINK_STATUS);
+-	} else {
+-		err = phy_write(phydev, RTL821x_INER, 0);
+-		if (err)
+-			return err;
+-
+-		err = rtl821x_ack_interrupt(phydev);
+-	}
+-
+-	return err;
+-}
+-
+-static int rtl8211f_config_intr(struct phy_device *phydev)
+-{
+-	u16 val;
+-	int err;
+-
+-	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
+-		err = rtl8211f_ack_interrupt(phydev);
+-		if (err)
+-			return err;
+-
+-		val = RTL8211F_INER_LINK_STATUS;
+-		err = phy_write_paged(phydev, 0xa42, RTL821x_INER, val);
+-	} else {
+-		val = 0;
+-		err = phy_write_paged(phydev, 0xa42, RTL821x_INER, val);
+-		if (err)
+-			return err;
+-
+-		err = rtl8211f_ack_interrupt(phydev);
+-	}
+-
+-	return err;
+-}
+-
+-static irqreturn_t rtl8201_handle_interrupt(struct phy_device *phydev)
+-{
+-	int irq_status;
+-
+-	irq_status = phy_read(phydev, RTL8201F_ISR);
+-	if (irq_status < 0) {
+-		phy_error(phydev);
+-		return IRQ_NONE;
+-	}
+-
+-	if (!(irq_status & RTL8201F_ISR_MASK))
+-		return IRQ_NONE;
+-
+-	phy_trigger_machine(phydev);
+-
+-	return IRQ_HANDLED;
+-}
+-
+-static irqreturn_t rtl821x_handle_interrupt(struct phy_device *phydev)
+-{
+-	int irq_status, irq_enabled;
+-
+-	irq_status = phy_read(phydev, RTL821x_INSR);
+-	if (irq_status < 0) {
+-		phy_error(phydev);
+-		return IRQ_NONE;
+-	}
+-
+-	irq_enabled = phy_read(phydev, RTL821x_INER);
+-	if (irq_enabled < 0) {
+-		phy_error(phydev);
+-		return IRQ_NONE;
+-	}
+-
+-	if (!(irq_status & irq_enabled))
+-		return IRQ_NONE;
+-
+-	phy_trigger_machine(phydev);
+-
+-	return IRQ_HANDLED;
+-}
+-
+-static irqreturn_t rtl8211f_handle_interrupt(struct phy_device *phydev)
+-{
+-	int irq_status;
+-
+-	irq_status = phy_read_paged(phydev, 0xa43, RTL8211F_INSR);
+-	if (irq_status < 0) {
+-		phy_error(phydev);
+-		return IRQ_NONE;
+-	}
+-
+-	if (!(irq_status & RTL8211F_INER_LINK_STATUS))
+-		return IRQ_NONE;
+-
+-	phy_trigger_machine(phydev);
+-
+-	return IRQ_HANDLED;
+-}
+-
+-static int rtl8211_config_aneg(struct phy_device *phydev)
+-{
+-	int ret;
+-
+-	ret = genphy_config_aneg(phydev);
+-	if (ret < 0)
+-		return ret;
+-
+-	/* Quirk was copied from vendor driver. Unfortunately it includes no
+-	 * description of the magic numbers.
+-	 */
+-	if (phydev->speed == SPEED_100 && phydev->autoneg == AUTONEG_DISABLE) {
+-		phy_write(phydev, 0x17, 0x2138);
+-		phy_write(phydev, 0x0e, 0x0260);
+-	} else {
+-		phy_write(phydev, 0x17, 0x2108);
+-		phy_write(phydev, 0x0e, 0x0000);
+-	}
+-
+-	return 0;
+-}
+-
+-static int rtl8211c_config_init(struct phy_device *phydev)
+-{
+-	/* RTL8211C has an issue when operating in Gigabit slave mode */
+-	return phy_set_bits(phydev, MII_CTRL1000,
+-			    CTL1000_ENABLE_MASTER | CTL1000_AS_MASTER);
+-}
+-
+-static int rtl8211f_config_init(struct phy_device *phydev)
+-{
+-	struct rtl821x_priv *priv = phydev->priv;
+-	struct device *dev = &phydev->mdio.dev;
+-	u16 val_txdly, val_rxdly;
+-	int ret;
+-
+-	ret = phy_modify_paged_changed(phydev, 0xa43, RTL8211F_PHYCR1,
+-				       RTL8211F_ALDPS_PLL_OFF | RTL8211F_ALDPS_ENABLE | RTL8211F_ALDPS_XTAL_OFF,
+-				       priv->phycr1);
+-	if (ret < 0) {
+-		dev_err(dev, "aldps mode  configuration failed: %pe\n",
+-			ERR_PTR(ret));
+-		return ret;
+-	}
+-
+-	switch (phydev->interface) {
+-	case PHY_INTERFACE_MODE_RGMII:
+-		val_txdly = 0;
+-		val_rxdly = 0;
+-		break;
+-
+-	case PHY_INTERFACE_MODE_RGMII_RXID:
+-		val_txdly = 0;
+-		val_rxdly = RTL8211F_RX_DELAY;
+-		break;
+-
+-	case PHY_INTERFACE_MODE_RGMII_TXID:
+-		val_txdly = RTL8211F_TX_DELAY;
+-		val_rxdly = 0;
+-		break;
+-
+-	case PHY_INTERFACE_MODE_RGMII_ID:
+-		val_txdly = RTL8211F_TX_DELAY;
+-		val_rxdly = RTL8211F_RX_DELAY;
+-		break;
+-
+-	default: /* the rest of the modes imply leaving delay as is. */
+-		return 0;
+-	}
+-
+-	ret = phy_modify_paged_changed(phydev, 0xd08, 0x11, RTL8211F_TX_DELAY,
+-				       val_txdly);
+-	if (ret < 0) {
+-		dev_err(dev, "Failed to update the TX delay register\n");
+-		return ret;
+-	} else if (ret) {
+-		dev_dbg(dev,
+-			"%s 2ns TX delay (and changing the value from pin-strapping RXD1 or the bootloader)\n",
+-			val_txdly ? "Enabling" : "Disabling");
+-	} else {
+-		dev_dbg(dev,
+-			"2ns TX delay was already %s (by pin-strapping RXD1 or bootloader configuration)\n",
+-			val_txdly ? "enabled" : "disabled");
+-	}
+-
+-	ret = phy_modify_paged_changed(phydev, 0xd08, 0x15, RTL8211F_RX_DELAY,
+-				       val_rxdly);
+-	if (ret < 0) {
+-		dev_err(dev, "Failed to update the RX delay register\n");
+-		return ret;
+-	} else if (ret) {
+-		dev_dbg(dev,
+-			"%s 2ns RX delay (and changing the value from pin-strapping RXD0 or the bootloader)\n",
+-			val_rxdly ? "Enabling" : "Disabling");
+-	} else {
+-		dev_dbg(dev,
+-			"2ns RX delay was already %s (by pin-strapping RXD0 or bootloader configuration)\n",
+-			val_rxdly ? "enabled" : "disabled");
+-	}
+-
+-	if (priv->has_phycr2) {
+-		ret = phy_modify_paged(phydev, 0xa43, RTL8211F_PHYCR2,
+-				       RTL8211F_CLKOUT_EN, priv->phycr2);
+-		if (ret < 0) {
+-			dev_err(dev, "clkout configuration failed: %pe\n",
+-				ERR_PTR(ret));
+-			return ret;
+-		}
+-
+-		return genphy_soft_reset(phydev);
+-	}
+-
+-	return 0;
+-}
+-
+-static int rtl821x_suspend(struct phy_device *phydev)
+-{
+-	struct rtl821x_priv *priv = phydev->priv;
+-	int ret = 0;
+-
+-	if (!phydev->wol_enabled) {
+-		ret = genphy_suspend(phydev);
+-
+-		if (ret)
+-			return ret;
+-
+-		clk_disable_unprepare(priv->clk);
+-	}
+-
+-	return ret;
+-}
+-
+-static int rtl821x_resume(struct phy_device *phydev)
+-{
+-	struct rtl821x_priv *priv = phydev->priv;
+-	int ret;
+-
+-	if (!phydev->wol_enabled)
+-		clk_prepare_enable(priv->clk);
+-
+-	ret = genphy_resume(phydev);
+-	if (ret < 0)
+-		return ret;
+-
+-	msleep(20);
+-
+-	return 0;
+-}
+-
+-static int rtl8211f_led_hw_is_supported(struct phy_device *phydev, u8 index,
+-					unsigned long rules)
+-{
+-	const unsigned long mask = BIT(TRIGGER_NETDEV_LINK_10) |
+-				   BIT(TRIGGER_NETDEV_LINK_100) |
+-				   BIT(TRIGGER_NETDEV_LINK_1000) |
+-				   BIT(TRIGGER_NETDEV_RX) |
+-				   BIT(TRIGGER_NETDEV_TX);
+-
+-	/* The RTL8211F PHY supports these LED settings on up to three LEDs:
+-	 * - Link: Configurable subset of 10/100/1000 link rates
+-	 * - Active: Blink on activity, RX or TX is not differentiated
+-	 * The Active option has two modes, A and B:
+-	 * - A: Link and Active indication at configurable, but matching,
+-	 *      subset of 10/100/1000 link rates
+-	 * - B: Link indication at configurable subset of 10/100/1000 link
+-	 *      rates and Active indication always at all three 10+100+1000
+-	 *      link rates.
+-	 * This code currently uses mode B only.
+-	 */
+-
+-	if (index >= RTL8211F_LED_COUNT)
+-		return -EINVAL;
+-
+-	/* Filter out any other unsupported triggers. */
+-	if (rules & ~mask)
+-		return -EOPNOTSUPP;
+-
+-	/* RX and TX are not differentiated, either both are set or not set. */
+-	if (!(rules & BIT(TRIGGER_NETDEV_RX)) ^ !(rules & BIT(TRIGGER_NETDEV_TX)))
+-		return -EOPNOTSUPP;
+-
+-	return 0;
+-}
+-
+-static int rtl8211f_led_hw_control_get(struct phy_device *phydev, u8 index,
+-				       unsigned long *rules)
+-{
+-	int val;
+-
+-	if (index >= RTL8211F_LED_COUNT)
+-		return -EINVAL;
+-
+-	val = phy_read_paged(phydev, 0xd04, RTL8211F_LEDCR);
+-	if (val < 0)
+-		return val;
+-
+-	val >>= RTL8211F_LEDCR_SHIFT * index;
+-	val &= RTL8211F_LEDCR_MASK;
+-
+-	if (val & RTL8211F_LEDCR_LINK_10)
+-		set_bit(TRIGGER_NETDEV_LINK_10, rules);
+-
+-	if (val & RTL8211F_LEDCR_LINK_100)
+-		set_bit(TRIGGER_NETDEV_LINK_100, rules);
+-
+-	if (val & RTL8211F_LEDCR_LINK_1000)
+-		set_bit(TRIGGER_NETDEV_LINK_1000, rules);
+-
+-	if (val & RTL8211F_LEDCR_ACT_TXRX) {
+-		set_bit(TRIGGER_NETDEV_RX, rules);
+-		set_bit(TRIGGER_NETDEV_TX, rules);
+-	}
+-
+-	return 0;
+-}
+-
+-static int rtl8211f_led_hw_control_set(struct phy_device *phydev, u8 index,
+-				       unsigned long rules)
+-{
+-	const u16 mask = RTL8211F_LEDCR_MASK << (RTL8211F_LEDCR_SHIFT * index);
+-	u16 reg = 0;
+-
+-	if (index >= RTL8211F_LED_COUNT)
+-		return -EINVAL;
+-
+-	if (test_bit(TRIGGER_NETDEV_LINK_10, &rules))
+-		reg |= RTL8211F_LEDCR_LINK_10;
+-
+-	if (test_bit(TRIGGER_NETDEV_LINK_100, &rules))
+-		reg |= RTL8211F_LEDCR_LINK_100;
+-
+-	if (test_bit(TRIGGER_NETDEV_LINK_1000, &rules))
+-		reg |= RTL8211F_LEDCR_LINK_1000;
+-
+-	if (test_bit(TRIGGER_NETDEV_RX, &rules) ||
+-	    test_bit(TRIGGER_NETDEV_TX, &rules)) {
+-		reg |= RTL8211F_LEDCR_ACT_TXRX;
+-	}
+-
+-	reg <<= RTL8211F_LEDCR_SHIFT * index;
+-	reg |= RTL8211F_LEDCR_MODE;	 /* Mode B */
+-
+-	return phy_modify_paged(phydev, 0xd04, RTL8211F_LEDCR, mask, reg);
+-}
+-
+-static int rtl8211e_config_init(struct phy_device *phydev)
+-{
+-	int ret = 0, oldpage;
+-	u16 val;
+-
+-	/* enable TX/RX delay for rgmii-* modes, and disable them for rgmii. */
+-	switch (phydev->interface) {
+-	case PHY_INTERFACE_MODE_RGMII:
+-		val = RTL8211E_CTRL_DELAY | 0;
+-		break;
+-	case PHY_INTERFACE_MODE_RGMII_ID:
+-		val = RTL8211E_CTRL_DELAY | RTL8211E_TX_DELAY | RTL8211E_RX_DELAY;
+-		break;
+-	case PHY_INTERFACE_MODE_RGMII_RXID:
+-		val = RTL8211E_CTRL_DELAY | RTL8211E_RX_DELAY;
+-		break;
+-	case PHY_INTERFACE_MODE_RGMII_TXID:
+-		val = RTL8211E_CTRL_DELAY | RTL8211E_TX_DELAY;
+-		break;
+-	default: /* the rest of the modes imply leaving delays as is. */
+-		return 0;
+-	}
+-
+-	/* According to a sample driver there is a 0x1c config register on the
+-	 * 0xa4 extension page (0x7) layout. It can be used to disable/enable
+-	 * the RX/TX delays otherwise controlled by RXDLY/TXDLY pins.
+-	 * The configuration register definition:
+-	 * 14 = reserved
+-	 * 13 = Force Tx RX Delay controlled by bit12 bit11,
+-	 * 12 = RX Delay, 11 = TX Delay
+-	 * 10:0 = Test && debug settings reserved by realtek
+-	 */
+-	oldpage = phy_select_page(phydev, 0x7);
+-	if (oldpage < 0)
+-		goto err_restore_page;
+-
+-	ret = __phy_write(phydev, RTL821x_EXT_PAGE_SELECT, 0xa4);
+-	if (ret)
+-		goto err_restore_page;
+-
+-	ret = __phy_modify(phydev, 0x1c, RTL8211E_CTRL_DELAY
+-			   | RTL8211E_TX_DELAY | RTL8211E_RX_DELAY,
+-			   val);
+-
+-err_restore_page:
+-	return phy_restore_page(phydev, oldpage, ret);
+-}
+-
+-static int rtl8211b_suspend(struct phy_device *phydev)
+-{
+-	phy_write(phydev, MII_MMD_DATA, BIT(9));
+-
+-	return genphy_suspend(phydev);
+-}
+-
+-static int rtl8211b_resume(struct phy_device *phydev)
+-{
+-	phy_write(phydev, MII_MMD_DATA, 0);
+-
+-	return genphy_resume(phydev);
+-}
+-
+-static int rtl8366rb_config_init(struct phy_device *phydev)
+-{
+-	int ret;
+-
+-	ret = phy_set_bits(phydev, RTL8366RB_POWER_SAVE,
+-			   RTL8366RB_POWER_SAVE_ON);
+-	if (ret) {
+-		dev_err(&phydev->mdio.dev,
+-			"error enabling power management\n");
+-	}
+-
+-	return ret;
+-}
+-
+-/* get actual speed to cover the downshift case */
+-static void rtlgen_decode_physr(struct phy_device *phydev, int val)
+-{
+-	/* bit 3
+-	 * 0: Half Duplex
+-	 * 1: Full Duplex
+-	 */
+-	if (val & RTL_VND2_PHYSR_DUPLEX)
+-		phydev->duplex = DUPLEX_FULL;
+-	else
+-		phydev->duplex = DUPLEX_HALF;
+-
+-	switch (val & RTL_VND2_PHYSR_SPEED_MASK) {
+-	case 0x0000:
+-		phydev->speed = SPEED_10;
+-		break;
+-	case 0x0010:
+-		phydev->speed = SPEED_100;
+-		break;
+-	case 0x0020:
+-		phydev->speed = SPEED_1000;
+-		break;
+-	case 0x0200:
+-		phydev->speed = SPEED_10000;
+-		break;
+-	case 0x0210:
+-		phydev->speed = SPEED_2500;
+-		break;
+-	case 0x0220:
+-		phydev->speed = SPEED_5000;
+-		break;
+-	default:
+-		break;
+-	}
+-
+-	/* bit 11
+-	 * 0: Slave Mode
+-	 * 1: Master Mode
+-	 */
+-	if (phydev->speed >= 1000) {
+-		if (val & RTL_VND2_PHYSR_MASTER)
+-			phydev->master_slave_state = MASTER_SLAVE_STATE_MASTER;
+-		else
+-			phydev->master_slave_state = MASTER_SLAVE_STATE_SLAVE;
+-	} else {
+-		phydev->master_slave_state = MASTER_SLAVE_STATE_UNSUPPORTED;
+-	}
+-}
+-
+-static int rtlgen_read_status(struct phy_device *phydev)
+-{
+-	int ret, val;
+-
+-	ret = genphy_read_status(phydev);
+-	if (ret < 0)
+-		return ret;
+-
+-	if (!phydev->link)
+-		return 0;
+-
+-	val = phy_read_paged(phydev, 0xa43, 0x12);
+-	if (val < 0)
+-		return val;
+-
+-	rtlgen_decode_physr(phydev, val);
+-
+-	return 0;
+-}
+-
+-static int rtlgen_read_mmd(struct phy_device *phydev, int devnum, u16 regnum)
+-{
+-	int ret;
+-
+-	if (devnum == MDIO_MMD_VEND2) {
+-		rtl821x_write_page(phydev, regnum >> 4);
+-		ret = __phy_read(phydev, 0x10 + ((regnum & 0xf) >> 1));
+-		rtl821x_write_page(phydev, 0);
+-	} else if (devnum == MDIO_MMD_PCS && regnum == MDIO_PCS_EEE_ABLE) {
+-		rtl821x_write_page(phydev, 0xa5c);
+-		ret = __phy_read(phydev, 0x12);
+-		rtl821x_write_page(phydev, 0);
+-	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV) {
+-		rtl821x_write_page(phydev, 0xa5d);
+-		ret = __phy_read(phydev, 0x10);
+-		rtl821x_write_page(phydev, 0);
+-	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_LPABLE) {
+-		rtl821x_write_page(phydev, 0xa5d);
+-		ret = __phy_read(phydev, 0x11);
+-		rtl821x_write_page(phydev, 0);
+-	} else {
+-		ret = -EOPNOTSUPP;
+-	}
+-
+-	return ret;
+-}
+-
+-static int rtlgen_write_mmd(struct phy_device *phydev, int devnum, u16 regnum,
+-			    u16 val)
+-{
+-	int ret;
+-
+-	if (devnum == MDIO_MMD_VEND2) {
+-		rtl821x_write_page(phydev, regnum >> 4);
+-		ret = __phy_write(phydev, 0x10 + ((regnum & 0xf) >> 1), val);
+-		rtl821x_write_page(phydev, 0);
+-	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV) {
+-		rtl821x_write_page(phydev, 0xa5d);
+-		ret = __phy_write(phydev, 0x10, val);
+-		rtl821x_write_page(phydev, 0);
+-	} else {
+-		ret = -EOPNOTSUPP;
+-	}
+-
+-	return ret;
+-}
+-
+-static int rtl822x_read_mmd(struct phy_device *phydev, int devnum, u16 regnum)
+-{
+-	int ret = rtlgen_read_mmd(phydev, devnum, regnum);
+-
+-	if (ret != -EOPNOTSUPP)
+-		return ret;
+-
+-	if (devnum == MDIO_MMD_PCS && regnum == MDIO_PCS_EEE_ABLE2) {
+-		rtl821x_write_page(phydev, 0xa6e);
+-		ret = __phy_read(phydev, 0x16);
+-		rtl821x_write_page(phydev, 0);
+-	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV2) {
+-		rtl821x_write_page(phydev, 0xa6d);
+-		ret = __phy_read(phydev, 0x12);
+-		rtl821x_write_page(phydev, 0);
+-	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_LPABLE2) {
+-		rtl821x_write_page(phydev, 0xa6d);
+-		ret = __phy_read(phydev, 0x10);
+-		rtl821x_write_page(phydev, 0);
+-	}
+-
+-	return ret;
+-}
+-
+-static int rtl822x_write_mmd(struct phy_device *phydev, int devnum, u16 regnum,
+-			     u16 val)
+-{
+-	int ret = rtlgen_write_mmd(phydev, devnum, regnum, val);
+-
+-	if (ret != -EOPNOTSUPP)
+-		return ret;
+-
+-	if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV2) {
+-		rtl821x_write_page(phydev, 0xa6d);
+-		ret = __phy_write(phydev, 0x12, val);
+-		rtl821x_write_page(phydev, 0);
+-	}
+-
+-	return ret;
+-}
+-
+-static int rtl822xb_config_init(struct phy_device *phydev)
+-{
+-	bool has_2500, has_sgmii;
+-	u16 mode;
+-	int ret;
+-
+-	has_2500 = test_bit(PHY_INTERFACE_MODE_2500BASEX,
+-			    phydev->host_interfaces) ||
+-		   phydev->interface == PHY_INTERFACE_MODE_2500BASEX;
+-
+-	has_sgmii = test_bit(PHY_INTERFACE_MODE_SGMII,
+-			     phydev->host_interfaces) ||
+-		    phydev->interface == PHY_INTERFACE_MODE_SGMII;
+-
+-	/* fill in possible interfaces */
+-	__assign_bit(PHY_INTERFACE_MODE_2500BASEX, phydev->possible_interfaces,
+-		     has_2500);
+-	__assign_bit(PHY_INTERFACE_MODE_SGMII, phydev->possible_interfaces,
+-		     has_sgmii);
+-
+-	if (!has_2500 && !has_sgmii)
+-		return 0;
+-
+-	/* determine SerDes option mode */
+-	if (has_2500 && !has_sgmii) {
+-		mode = RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX;
+-		phydev->rate_matching = RATE_MATCH_PAUSE;
+-	} else {
+-		mode = RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX_SGMII;
+-		phydev->rate_matching = RATE_MATCH_NONE;
+-	}
+-
+-	/* the following sequence with magic numbers sets up the SerDes
+-	 * option mode
+-	 */
+-	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x75f3, 0);
+-	if (ret < 0)
+-		return ret;
+-
+-	ret = phy_modify_mmd_changed(phydev, MDIO_MMD_VEND1,
+-				     RTL822X_VND1_SERDES_OPTION,
+-				     RTL822X_VND1_SERDES_OPTION_MODE_MASK,
+-				     mode);
+-	if (ret < 0)
+-		return ret;
+-
+-	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x6a04, 0x0503);
+-	if (ret < 0)
+-		return ret;
+-
+-	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x6f10, 0xd455);
+-	if (ret < 0)
+-		return ret;
+-
+-	return phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x6f11, 0x8020);
+-}
+-
+-static int rtl822xb_get_rate_matching(struct phy_device *phydev,
+-				      phy_interface_t iface)
+-{
+-	int val;
+-
+-	/* Only rate matching at 2500base-x */
+-	if (iface != PHY_INTERFACE_MODE_2500BASEX)
+-		return RATE_MATCH_NONE;
+-
+-	val = phy_read_mmd(phydev, MDIO_MMD_VEND1, RTL822X_VND1_SERDES_OPTION);
+-	if (val < 0)
+-		return val;
+-
+-	if ((val & RTL822X_VND1_SERDES_OPTION_MODE_MASK) ==
+-	    RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX)
+-		return RATE_MATCH_PAUSE;
+-
+-	/* RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX_SGMII */
+-	return RATE_MATCH_NONE;
+-}
+-
+-static int rtl822x_get_features(struct phy_device *phydev)
+-{
+-	int val;
+-
+-	val = phy_read_paged(phydev, 0xa61, 0x13);
+-	if (val < 0)
+-		return val;
+-
+-	linkmode_mod_bit(ETHTOOL_LINK_MODE_2500baseT_Full_BIT,
+-			 phydev->supported, val & MDIO_PMA_SPEED_2_5G);
+-	linkmode_mod_bit(ETHTOOL_LINK_MODE_5000baseT_Full_BIT,
+-			 phydev->supported, val & MDIO_PMA_SPEED_5G);
+-	linkmode_mod_bit(ETHTOOL_LINK_MODE_10000baseT_Full_BIT,
+-			 phydev->supported, val & MDIO_SPEED_10G);
+-
+-	return genphy_read_abilities(phydev);
+-}
+-
+-static int rtl822x_config_aneg(struct phy_device *phydev)
+-{
+-	int ret = 0;
+-
+-	if (phydev->autoneg == AUTONEG_ENABLE) {
+-		u16 adv = linkmode_adv_to_mii_10gbt_adv_t(phydev->advertising);
+-
+-		ret = phy_modify_paged_changed(phydev, 0xa5d, 0x12,
+-					       MDIO_AN_10GBT_CTRL_ADV2_5G |
+-					       MDIO_AN_10GBT_CTRL_ADV5G,
+-					       adv);
+-		if (ret < 0)
+-			return ret;
+-	}
+-
+-	return __genphy_config_aneg(phydev, ret);
+-}
+-
+-static void rtl822xb_update_interface(struct phy_device *phydev)
+-{
+-	int val;
+-
+-	if (!phydev->link)
+-		return;
+-
+-	/* Change interface according to serdes mode */
+-	val = phy_read_mmd(phydev, MDIO_MMD_VEND1, RTL822X_VND1_SERDES_CTRL3);
+-	if (val < 0)
+-		return;
+-
+-	switch (val & RTL822X_VND1_SERDES_CTRL3_MODE_MASK) {
+-	case RTL822X_VND1_SERDES_CTRL3_MODE_2500BASEX:
+-		phydev->interface = PHY_INTERFACE_MODE_2500BASEX;
+-		break;
+-	case RTL822X_VND1_SERDES_CTRL3_MODE_SGMII:
+-		phydev->interface = PHY_INTERFACE_MODE_SGMII;
+-		break;
+-	}
+-}
+-
+-static int rtl822x_read_status(struct phy_device *phydev)
+-{
+-	int lpadv, ret;
+-
+-	mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising, 0);
+-
+-	ret = rtlgen_read_status(phydev);
+-	if (ret < 0)
+-		return ret;
+-
+-	if (phydev->autoneg == AUTONEG_DISABLE ||
+-	    !phydev->autoneg_complete)
+-		return 0;
+-
+-	lpadv = phy_read_paged(phydev, 0xa5d, 0x13);
+-	if (lpadv < 0)
+-		return lpadv;
+-
+-	mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising, lpadv);
+-
+-	return 0;
+-}
+-
+-static int rtl822xb_read_status(struct phy_device *phydev)
+-{
+-	int ret;
+-
+-	ret = rtl822x_read_status(phydev);
+-	if (ret < 0)
+-		return ret;
+-
+-	rtl822xb_update_interface(phydev);
+-
+-	return 0;
+-}
+-
+-static int rtl822x_c45_get_features(struct phy_device *phydev)
+-{
+-	linkmode_set_bit(ETHTOOL_LINK_MODE_TP_BIT,
+-			 phydev->supported);
+-
+-	return genphy_c45_pma_read_abilities(phydev);
+-}
+-
+-static int rtl822x_c45_config_aneg(struct phy_device *phydev)
+-{
+-	bool changed = false;
+-	int ret, val;
+-
+-	if (phydev->autoneg == AUTONEG_DISABLE)
+-		return genphy_c45_pma_setup_forced(phydev);
+-
+-	ret = genphy_c45_an_config_aneg(phydev);
+-	if (ret < 0)
+-		return ret;
+-	if (ret > 0)
+-		changed = true;
+-
+-	val = linkmode_adv_to_mii_ctrl1000_t(phydev->advertising);
+-
+-	/* Vendor register as C45 has no standardized support for 1000BaseT */
+-	ret = phy_modify_mmd_changed(phydev, MDIO_MMD_VEND2, RTL822X_VND2_GBCR,
+-				     ADVERTISE_1000FULL, val);
+-	if (ret < 0)
+-		return ret;
+-	if (ret > 0)
+-		changed = true;
+-
+-	return genphy_c45_check_and_restart_aneg(phydev, changed);
+-}
+-
+-static int rtl822x_c45_read_status(struct phy_device *phydev)
+-{
+-	int ret, val;
+-
+-	/* Vendor register as C45 has no standardized support for 1000BaseT */
+-	if (phydev->autoneg == AUTONEG_ENABLE && genphy_c45_aneg_done(phydev)) {
+-		val = phy_read_mmd(phydev, MDIO_MMD_VEND2,
+-				   RTL822X_VND2_GANLPAR);
+-		if (val < 0)
+-			return val;
+-	} else {
+-		val = 0;
+-	}
+-	mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising, val);
+-
+-	ret = genphy_c45_read_status(phydev);
+-	if (ret < 0)
+-		return ret;
+-
+-	if (!phydev->link) {
+-		phydev->master_slave_state = MASTER_SLAVE_STATE_UNKNOWN;
+-		return 0;
+-	}
+-
+-	/* Read actual speed from vendor register. */
+-	val = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL_VND2_PHYSR);
+-	if (val < 0)
+-		return val;
+-
+-	rtlgen_decode_physr(phydev, val);
+-
+-	return 0;
+-}
+-
+-static int rtl822xb_c45_read_status(struct phy_device *phydev)
+-{
+-	int ret;
+-
+-	ret = rtl822x_c45_read_status(phydev);
+-	if (ret < 0)
+-		return ret;
+-
+-	rtl822xb_update_interface(phydev);
+-
+-	return 0;
+-}
+-
+-static bool rtlgen_supports_2_5gbps(struct phy_device *phydev)
+-{
+-	int val;
+-
+-	phy_write(phydev, RTL821x_PAGE_SELECT, 0xa61);
+-	val = phy_read(phydev, 0x13);
+-	phy_write(phydev, RTL821x_PAGE_SELECT, 0);
+-
+-	return val >= 0 && val & MDIO_PMA_SPEED_2_5G;
+-}
+-
+-/* On internal PHY's MMD reads over C22 always return 0.
+- * Check a MMD register which is known to be non-zero.
+- */
+-static bool rtlgen_supports_mmd(struct phy_device *phydev)
+-{
+-	int val;
+-
+-	phy_lock_mdio_bus(phydev);
+-	__phy_write(phydev, MII_MMD_CTRL, MDIO_MMD_PCS);
+-	__phy_write(phydev, MII_MMD_DATA, MDIO_PCS_EEE_ABLE);
+-	__phy_write(phydev, MII_MMD_CTRL, MDIO_MMD_PCS | MII_MMD_CTRL_NOINCR);
+-	val = __phy_read(phydev, MII_MMD_DATA);
+-	phy_unlock_mdio_bus(phydev);
+-
+-	return val > 0;
+-}
+-
+-static int rtlgen_match_phy_device(struct phy_device *phydev)
+-{
+-	return phydev->phy_id == RTL_GENERIC_PHYID &&
+-	       !rtlgen_supports_2_5gbps(phydev);
+-}
+-
+-static int rtl8226_match_phy_device(struct phy_device *phydev)
+-{
+-	return phydev->phy_id == RTL_GENERIC_PHYID &&
+-	       rtlgen_supports_2_5gbps(phydev) &&
+-	       rtlgen_supports_mmd(phydev);
+-}
+-
+-static int rtlgen_is_c45_match(struct phy_device *phydev, unsigned int id,
+-			       bool is_c45)
+-{
+-	if (phydev->is_c45)
+-		return is_c45 && (id == phydev->c45_ids.device_ids[1]);
+-	else
+-		return !is_c45 && (id == phydev->phy_id);
+-}
+-
+-static int rtl8221b_match_phy_device(struct phy_device *phydev)
+-{
+-	return phydev->phy_id == RTL_8221B && rtlgen_supports_mmd(phydev);
+-}
+-
+-static int rtl8221b_vb_cg_c22_match_phy_device(struct phy_device *phydev)
+-{
+-	return rtlgen_is_c45_match(phydev, RTL_8221B_VB_CG, false);
+-}
+-
+-static int rtl8221b_vb_cg_c45_match_phy_device(struct phy_device *phydev)
+-{
+-	return rtlgen_is_c45_match(phydev, RTL_8221B_VB_CG, true);
+-}
+-
+-static int rtl8221b_vn_cg_c22_match_phy_device(struct phy_device *phydev)
+-{
+-	return rtlgen_is_c45_match(phydev, RTL_8221B_VN_CG, false);
+-}
+-
+-static int rtl8221b_vn_cg_c45_match_phy_device(struct phy_device *phydev)
+-{
+-	return rtlgen_is_c45_match(phydev, RTL_8221B_VN_CG, true);
+-}
+-
+-static int rtl_internal_nbaset_match_phy_device(struct phy_device *phydev)
+-{
+-	if (phydev->is_c45)
+-		return false;
+-
+-	switch (phydev->phy_id) {
+-	case RTL_GENERIC_PHYID:
+-	case RTL_8221B:
+-	case RTL_8251B:
+-	case 0x001cc841:
+-		break;
+-	default:
+-		return false;
+-	}
+-
+-	return rtlgen_supports_2_5gbps(phydev) && !rtlgen_supports_mmd(phydev);
+-}
+-
+-static int rtl8251b_c45_match_phy_device(struct phy_device *phydev)
+-{
+-	return rtlgen_is_c45_match(phydev, RTL_8251B, true);
+-}
+-
+-static int rtlgen_resume(struct phy_device *phydev)
+-{
+-	int ret = genphy_resume(phydev);
+-
+-	/* Internal PHY's from RTL8168h up may not be instantly ready */
+-	msleep(20);
+-
+-	return ret;
+-}
+-
+-static int rtlgen_c45_resume(struct phy_device *phydev)
+-{
+-	int ret = genphy_c45_pma_resume(phydev);
+-
+-	msleep(20);
+-
+-	return ret;
+-}
+-
+-static int rtl9000a_config_init(struct phy_device *phydev)
+-{
+-	phydev->autoneg = AUTONEG_DISABLE;
+-	phydev->speed = SPEED_100;
+-	phydev->duplex = DUPLEX_FULL;
+-
+-	return 0;
+-}
+-
+-static int rtl9000a_config_aneg(struct phy_device *phydev)
+-{
+-	int ret;
+-	u16 ctl = 0;
+-
+-	switch (phydev->master_slave_set) {
+-	case MASTER_SLAVE_CFG_MASTER_FORCE:
+-		ctl |= CTL1000_AS_MASTER;
+-		break;
+-	case MASTER_SLAVE_CFG_SLAVE_FORCE:
+-		break;
+-	case MASTER_SLAVE_CFG_UNKNOWN:
+-	case MASTER_SLAVE_CFG_UNSUPPORTED:
+-		return 0;
+-	default:
+-		phydev_warn(phydev, "Unsupported Master/Slave mode\n");
+-		return -EOPNOTSUPP;
+-	}
+-
+-	ret = phy_modify_changed(phydev, MII_CTRL1000, CTL1000_AS_MASTER, ctl);
+-	if (ret == 1)
+-		ret = genphy_soft_reset(phydev);
+-
+-	return ret;
+-}
+-
+-static int rtl9000a_read_status(struct phy_device *phydev)
+-{
+-	int ret;
+-
+-	phydev->master_slave_get = MASTER_SLAVE_CFG_UNKNOWN;
+-	phydev->master_slave_state = MASTER_SLAVE_STATE_UNKNOWN;
+-
+-	ret = genphy_update_link(phydev);
+-	if (ret)
+-		return ret;
+-
+-	ret = phy_read(phydev, MII_CTRL1000);
+-	if (ret < 0)
+-		return ret;
+-	if (ret & CTL1000_AS_MASTER)
+-		phydev->master_slave_get = MASTER_SLAVE_CFG_MASTER_FORCE;
+-	else
+-		phydev->master_slave_get = MASTER_SLAVE_CFG_SLAVE_FORCE;
+-
+-	ret = phy_read(phydev, MII_STAT1000);
+-	if (ret < 0)
+-		return ret;
+-	if (ret & LPA_1000MSRES)
+-		phydev->master_slave_state = MASTER_SLAVE_STATE_MASTER;
+-	else
+-		phydev->master_slave_state = MASTER_SLAVE_STATE_SLAVE;
+-
+-	return 0;
+-}
+-
+-static int rtl9000a_ack_interrupt(struct phy_device *phydev)
+-{
+-	int err;
+-
+-	err = phy_read(phydev, RTL8211F_INSR);
+-
+-	return (err < 0) ? err : 0;
+-}
+-
+-static int rtl9000a_config_intr(struct phy_device *phydev)
+-{
+-	u16 val;
+-	int err;
+-
+-	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
+-		err = rtl9000a_ack_interrupt(phydev);
+-		if (err)
+-			return err;
+-
+-		val = (u16)~RTL9000A_GINMR_LINK_STATUS;
+-		err = phy_write_paged(phydev, 0xa42, RTL9000A_GINMR, val);
+-	} else {
+-		val = ~0;
+-		err = phy_write_paged(phydev, 0xa42, RTL9000A_GINMR, val);
+-		if (err)
+-			return err;
+-
+-		err = rtl9000a_ack_interrupt(phydev);
+-	}
+-
+-	return phy_write_paged(phydev, 0xa42, RTL9000A_GINMR, val);
+-}
+-
+-static irqreturn_t rtl9000a_handle_interrupt(struct phy_device *phydev)
+-{
+-	int irq_status;
+-
+-	irq_status = phy_read(phydev, RTL8211F_INSR);
+-	if (irq_status < 0) {
+-		phy_error(phydev);
+-		return IRQ_NONE;
+-	}
+-
+-	if (!(irq_status & RTL8211F_INER_LINK_STATUS))
+-		return IRQ_NONE;
+-
+-	phy_trigger_machine(phydev);
+-
+-	return IRQ_HANDLED;
+-}
+-
+-static struct phy_driver realtek_drvs[] = {
+-	{
+-		PHY_ID_MATCH_EXACT(0x00008201),
+-		.name           = "RTL8201CP Ethernet",
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc816),
+-		.name		= "RTL8201F Fast Ethernet",
+-		.config_intr	= &rtl8201_config_intr,
+-		.handle_interrupt = rtl8201_handle_interrupt,
+-		.suspend	= genphy_suspend,
+-		.resume		= genphy_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_MODEL(0x001cc880),
+-		.name		= "RTL8208 Fast Ethernet",
+-		.read_mmd	= genphy_read_mmd_unsupported,
+-		.write_mmd	= genphy_write_mmd_unsupported,
+-		.suspend	= genphy_suspend,
+-		.resume		= genphy_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc910),
+-		.name		= "RTL8211 Gigabit Ethernet",
+-		.config_aneg	= rtl8211_config_aneg,
+-		.read_mmd	= &genphy_read_mmd_unsupported,
+-		.write_mmd	= &genphy_write_mmd_unsupported,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc912),
+-		.name		= "RTL8211B Gigabit Ethernet",
+-		.config_intr	= &rtl8211b_config_intr,
+-		.handle_interrupt = rtl821x_handle_interrupt,
+-		.read_mmd	= &genphy_read_mmd_unsupported,
+-		.write_mmd	= &genphy_write_mmd_unsupported,
+-		.suspend	= rtl8211b_suspend,
+-		.resume		= rtl8211b_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc913),
+-		.name		= "RTL8211C Gigabit Ethernet",
+-		.config_init	= rtl8211c_config_init,
+-		.read_mmd	= &genphy_read_mmd_unsupported,
+-		.write_mmd	= &genphy_write_mmd_unsupported,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc914),
+-		.name		= "RTL8211DN Gigabit Ethernet",
+-		.config_intr	= rtl8211e_config_intr,
+-		.handle_interrupt = rtl821x_handle_interrupt,
+-		.suspend	= genphy_suspend,
+-		.resume		= genphy_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc915),
+-		.name		= "RTL8211E Gigabit Ethernet",
+-		.config_init	= &rtl8211e_config_init,
+-		.config_intr	= &rtl8211e_config_intr,
+-		.handle_interrupt = rtl821x_handle_interrupt,
+-		.suspend	= genphy_suspend,
+-		.resume		= genphy_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc916),
+-		.name		= "RTL8211F Gigabit Ethernet",
+-		.probe		= rtl821x_probe,
+-		.config_init	= &rtl8211f_config_init,
+-		.read_status	= rtlgen_read_status,
+-		.config_intr	= &rtl8211f_config_intr,
+-		.handle_interrupt = rtl8211f_handle_interrupt,
+-		.suspend	= rtl821x_suspend,
+-		.resume		= rtl821x_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-		.flags		= PHY_ALWAYS_CALL_SUSPEND,
+-		.led_hw_is_supported = rtl8211f_led_hw_is_supported,
+-		.led_hw_control_get = rtl8211f_led_hw_control_get,
+-		.led_hw_control_set = rtl8211f_led_hw_control_set,
+-	}, {
+-		PHY_ID_MATCH_EXACT(RTL_8211FVD_PHYID),
+-		.name		= "RTL8211F-VD Gigabit Ethernet",
+-		.probe		= rtl821x_probe,
+-		.config_init	= &rtl8211f_config_init,
+-		.read_status	= rtlgen_read_status,
+-		.config_intr	= &rtl8211f_config_intr,
+-		.handle_interrupt = rtl8211f_handle_interrupt,
+-		.suspend	= rtl821x_suspend,
+-		.resume		= rtl821x_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-		.flags		= PHY_ALWAYS_CALL_SUSPEND,
+-	}, {
+-		.name		= "Generic FE-GE Realtek PHY",
+-		.match_phy_device = rtlgen_match_phy_device,
+-		.read_status	= rtlgen_read_status,
+-		.suspend	= genphy_suspend,
+-		.resume		= rtlgen_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-		.read_mmd	= rtlgen_read_mmd,
+-		.write_mmd	= rtlgen_write_mmd,
+-	}, {
+-		.name		= "RTL8226 2.5Gbps PHY",
+-		.match_phy_device = rtl8226_match_phy_device,
+-		.get_features	= rtl822x_get_features,
+-		.config_aneg	= rtl822x_config_aneg,
+-		.read_status	= rtl822x_read_status,
+-		.suspend	= genphy_suspend,
+-		.resume		= rtlgen_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		.match_phy_device = rtl8221b_match_phy_device,
+-		.name		= "RTL8226B_RTL8221B 2.5Gbps PHY",
+-		.get_features	= rtl822x_get_features,
+-		.config_aneg	= rtl822x_config_aneg,
+-		.config_init    = rtl822xb_config_init,
+-		.get_rate_matching = rtl822xb_get_rate_matching,
+-		.read_status	= rtl822xb_read_status,
+-		.suspend	= genphy_suspend,
+-		.resume		= rtlgen_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc838),
+-		.name           = "RTL8226-CG 2.5Gbps PHY",
+-		.get_features   = rtl822x_get_features,
+-		.config_aneg    = rtl822x_config_aneg,
+-		.read_status    = rtl822x_read_status,
+-		.suspend        = genphy_suspend,
+-		.resume         = rtlgen_resume,
+-		.read_page      = rtl821x_read_page,
+-		.write_page     = rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc848),
+-		.name           = "RTL8226B-CG_RTL8221B-CG 2.5Gbps PHY",
+-		.get_features   = rtl822x_get_features,
+-		.config_aneg    = rtl822x_config_aneg,
+-		.config_init    = rtl822xb_config_init,
+-		.get_rate_matching = rtl822xb_get_rate_matching,
+-		.read_status    = rtl822xb_read_status,
+-		.suspend        = genphy_suspend,
+-		.resume         = rtlgen_resume,
+-		.read_page      = rtl821x_read_page,
+-		.write_page     = rtl821x_write_page,
+-	}, {
+-		.match_phy_device = rtl8221b_vb_cg_c22_match_phy_device,
+-		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C22)",
+-		.get_features   = rtl822x_get_features,
+-		.config_aneg    = rtl822x_config_aneg,
+-		.config_init    = rtl822xb_config_init,
+-		.get_rate_matching = rtl822xb_get_rate_matching,
+-		.read_status    = rtl822xb_read_status,
+-		.suspend        = genphy_suspend,
+-		.resume         = rtlgen_resume,
+-		.read_page      = rtl821x_read_page,
+-		.write_page     = rtl821x_write_page,
+-	}, {
+-		.match_phy_device = rtl8221b_vb_cg_c45_match_phy_device,
+-		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C45)",
+-		.config_init    = rtl822xb_config_init,
+-		.get_rate_matching = rtl822xb_get_rate_matching,
+-		.get_features   = rtl822x_c45_get_features,
+-		.config_aneg    = rtl822x_c45_config_aneg,
+-		.read_status    = rtl822xb_c45_read_status,
+-		.suspend        = genphy_c45_pma_suspend,
+-		.resume         = rtlgen_c45_resume,
+-	}, {
+-		.match_phy_device = rtl8221b_vn_cg_c22_match_phy_device,
+-		.name           = "RTL8221B-VM-CG 2.5Gbps PHY (C22)",
+-		.get_features   = rtl822x_get_features,
+-		.config_aneg    = rtl822x_config_aneg,
+-		.config_init    = rtl822xb_config_init,
+-		.get_rate_matching = rtl822xb_get_rate_matching,
+-		.read_status    = rtl822xb_read_status,
+-		.suspend        = genphy_suspend,
+-		.resume         = rtlgen_resume,
+-		.read_page      = rtl821x_read_page,
+-		.write_page     = rtl821x_write_page,
+-	}, {
+-		.match_phy_device = rtl8221b_vn_cg_c45_match_phy_device,
+-		.name           = "RTL8221B-VN-CG 2.5Gbps PHY (C45)",
+-		.config_init    = rtl822xb_config_init,
+-		.get_rate_matching = rtl822xb_get_rate_matching,
+-		.get_features   = rtl822x_c45_get_features,
+-		.config_aneg    = rtl822x_c45_config_aneg,
+-		.read_status    = rtl822xb_c45_read_status,
+-		.suspend        = genphy_c45_pma_suspend,
+-		.resume         = rtlgen_c45_resume,
+-	}, {
+-		.match_phy_device = rtl8251b_c45_match_phy_device,
+-		.name           = "RTL8251B 5Gbps PHY",
+-		.get_features   = rtl822x_get_features,
+-		.config_aneg    = rtl822x_config_aneg,
+-		.read_status    = rtl822x_read_status,
+-		.suspend        = genphy_suspend,
+-		.resume         = rtlgen_resume,
+-		.read_page      = rtl821x_read_page,
+-		.write_page     = rtl821x_write_page,
+-	}, {
+-		.match_phy_device = rtl_internal_nbaset_match_phy_device,
+-		.name           = "Realtek Internal NBASE-T PHY",
+-		.flags		= PHY_IS_INTERNAL,
+-		.get_features   = rtl822x_get_features,
+-		.config_aneg    = rtl822x_config_aneg,
+-		.read_status    = rtl822x_read_status,
+-		.suspend        = genphy_suspend,
+-		.resume         = rtlgen_resume,
+-		.read_page      = rtl821x_read_page,
+-		.write_page     = rtl821x_write_page,
+-		.read_mmd	= rtl822x_read_mmd,
+-		.write_mmd	= rtl822x_write_mmd,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001ccad0),
+-		.name		= "RTL8224 2.5Gbps PHY",
+-		.get_features   = rtl822x_c45_get_features,
+-		.config_aneg    = rtl822x_c45_config_aneg,
+-		.read_status    = rtl822x_c45_read_status,
+-		.suspend        = genphy_c45_pma_suspend,
+-		.resume         = rtlgen_c45_resume,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc961),
+-		.name		= "RTL8366RB Gigabit Ethernet",
+-		.config_init	= &rtl8366rb_config_init,
+-		/* These interrupts are handled by the irq controller
+-		 * embedded inside the RTL8366RB, they get unmasked when the
+-		 * irq is requested and ACKed by reading the status register,
+-		 * which is done by the irqchip code.
+-		 */
+-		.config_intr	= genphy_no_config_intr,
+-		.handle_interrupt = genphy_handle_interrupt_no_ack,
+-		.suspend	= genphy_suspend,
+-		.resume		= genphy_resume,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001ccb00),
+-		.name		= "RTL9000AA_RTL9000AN Ethernet",
+-		.features       = PHY_BASIC_T1_FEATURES,
+-		.config_init	= rtl9000a_config_init,
+-		.config_aneg	= rtl9000a_config_aneg,
+-		.read_status	= rtl9000a_read_status,
+-		.config_intr	= rtl9000a_config_intr,
+-		.handle_interrupt = rtl9000a_handle_interrupt,
+-		.suspend	= genphy_suspend,
+-		.resume		= genphy_resume,
+-		.read_page	= rtl821x_read_page,
+-		.write_page	= rtl821x_write_page,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc942),
+-		.name		= "RTL8365MB-VC Gigabit Ethernet",
+-		/* Interrupt handling analogous to RTL8366RB */
+-		.config_intr	= genphy_no_config_intr,
+-		.handle_interrupt = genphy_handle_interrupt_no_ack,
+-		.suspend	= genphy_suspend,
+-		.resume		= genphy_resume,
+-	}, {
+-		PHY_ID_MATCH_EXACT(0x001cc960),
+-		.name		= "RTL8366S Gigabit Ethernet",
+-		.suspend	= genphy_suspend,
+-		.resume		= genphy_resume,
+-		.read_mmd	= genphy_read_mmd_unsupported,
+-		.write_mmd	= genphy_write_mmd_unsupported,
+-	},
+-};
+-
+-module_phy_driver(realtek_drvs);
+-
+-static const struct mdio_device_id __maybe_unused realtek_tbl[] = {
+-	{ PHY_ID_MATCH_VENDOR(0x001cc800) },
+-	{ }
+-};
+-
+-MODULE_DEVICE_TABLE(mdio, realtek_tbl);
+--- /dev/null
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -0,0 +1,1589 @@
++// SPDX-License-Identifier: GPL-2.0+
++/* drivers/net/phy/realtek.c
++ *
++ * Driver for Realtek PHYs
++ *
++ * Author: Johnson Leung <r58129@freescale.com>
++ *
++ * Copyright (c) 2004 Freescale Semiconductor, Inc.
++ */
++#include <linux/bitops.h>
++#include <linux/of.h>
++#include <linux/phy.h>
++#include <linux/module.h>
++#include <linux/delay.h>
++#include <linux/clk.h>
++
++#define RTL821x_PHYSR				0x11
++#define RTL821x_PHYSR_DUPLEX			BIT(13)
++#define RTL821x_PHYSR_SPEED			GENMASK(15, 14)
++
++#define RTL821x_INER				0x12
++#define RTL8211B_INER_INIT			0x6400
++#define RTL8211E_INER_LINK_STATUS		BIT(10)
++#define RTL8211F_INER_LINK_STATUS		BIT(4)
++
++#define RTL821x_INSR				0x13
++
++#define RTL821x_EXT_PAGE_SELECT			0x1e
++#define RTL821x_PAGE_SELECT			0x1f
++
++#define RTL8211F_PHYCR1				0x18
++#define RTL8211F_PHYCR2				0x19
++#define RTL8211F_INSR				0x1d
++
++#define RTL8211F_LEDCR				0x10
++#define RTL8211F_LEDCR_MODE			BIT(15)
++#define RTL8211F_LEDCR_ACT_TXRX			BIT(4)
++#define RTL8211F_LEDCR_LINK_1000		BIT(3)
++#define RTL8211F_LEDCR_LINK_100			BIT(1)
++#define RTL8211F_LEDCR_LINK_10			BIT(0)
++#define RTL8211F_LEDCR_MASK			GENMASK(4, 0)
++#define RTL8211F_LEDCR_SHIFT			5
++
++#define RTL8211F_TX_DELAY			BIT(8)
++#define RTL8211F_RX_DELAY			BIT(3)
++
++#define RTL8211F_ALDPS_PLL_OFF			BIT(1)
++#define RTL8211F_ALDPS_ENABLE			BIT(2)
++#define RTL8211F_ALDPS_XTAL_OFF			BIT(12)
++
++#define RTL8211E_CTRL_DELAY			BIT(13)
++#define RTL8211E_TX_DELAY			BIT(12)
++#define RTL8211E_RX_DELAY			BIT(11)
++
++#define RTL8211F_CLKOUT_EN			BIT(0)
++
++#define RTL8201F_ISR				0x1e
++#define RTL8201F_ISR_ANERR			BIT(15)
++#define RTL8201F_ISR_DUPLEX			BIT(13)
++#define RTL8201F_ISR_LINK			BIT(11)
++#define RTL8201F_ISR_MASK			(RTL8201F_ISR_ANERR | \
++						 RTL8201F_ISR_DUPLEX | \
++						 RTL8201F_ISR_LINK)
++#define RTL8201F_IER				0x13
++
++#define RTL822X_VND1_SERDES_OPTION			0x697a
++#define RTL822X_VND1_SERDES_OPTION_MODE_MASK		GENMASK(5, 0)
++#define RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX_SGMII		0
++#define RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX		2
++
++#define RTL822X_VND1_SERDES_CTRL3			0x7580
++#define RTL822X_VND1_SERDES_CTRL3_MODE_MASK		GENMASK(5, 0)
++#define RTL822X_VND1_SERDES_CTRL3_MODE_SGMII			0x02
++#define RTL822X_VND1_SERDES_CTRL3_MODE_2500BASEX		0x16
++
++/* RTL822X_VND2_XXXXX registers are only accessible when phydev->is_c45
++ * is set, they cannot be accessed by C45-over-C22.
++ */
++#define RTL822X_VND2_GBCR				0xa412
++
++#define RTL822X_VND2_GANLPAR				0xa414
++
++#define RTL8366RB_POWER_SAVE			0x15
++#define RTL8366RB_POWER_SAVE_ON			BIT(12)
++
++#define RTL9000A_GINMR				0x14
++#define RTL9000A_GINMR_LINK_STATUS		BIT(4)
++
++#define RTL_VND2_PHYSR				0xa434
++#define RTL_VND2_PHYSR_DUPLEX			BIT(3)
++#define RTL_VND2_PHYSR_SPEEDL			GENMASK(5, 4)
++#define RTL_VND2_PHYSR_SPEEDH			GENMASK(10, 9)
++#define RTL_VND2_PHYSR_MASTER			BIT(11)
++#define RTL_VND2_PHYSR_SPEED_MASK		(RTL_VND2_PHYSR_SPEEDL | RTL_VND2_PHYSR_SPEEDH)
++
++#define RTL_GENERIC_PHYID			0x001cc800
++#define RTL_8211FVD_PHYID			0x001cc878
++#define RTL_8221B				0x001cc840
++#define RTL_8221B_VB_CG				0x001cc849
++#define RTL_8221B_VN_CG				0x001cc84a
++#define RTL_8251B				0x001cc862
++
++#define RTL8211F_LED_COUNT			3
++
++MODULE_DESCRIPTION("Realtek PHY driver");
++MODULE_AUTHOR("Johnson Leung");
++MODULE_LICENSE("GPL");
++
++struct rtl821x_priv {
++	u16 phycr1;
++	u16 phycr2;
++	bool has_phycr2;
++	struct clk *clk;
++};
++
++static int rtl821x_read_page(struct phy_device *phydev)
++{
++	return __phy_read(phydev, RTL821x_PAGE_SELECT);
++}
++
++static int rtl821x_write_page(struct phy_device *phydev, int page)
++{
++	return __phy_write(phydev, RTL821x_PAGE_SELECT, page);
++}
++
++static int rtl821x_probe(struct phy_device *phydev)
++{
++	struct device *dev = &phydev->mdio.dev;
++	struct rtl821x_priv *priv;
++	u32 phy_id = phydev->drv->phy_id;
++	int ret;
++
++	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	priv->clk = devm_clk_get_optional_enabled(dev, NULL);
++	if (IS_ERR(priv->clk))
++		return dev_err_probe(dev, PTR_ERR(priv->clk),
++				     "failed to get phy clock\n");
++
++	ret = phy_read_paged(phydev, 0xa43, RTL8211F_PHYCR1);
++	if (ret < 0)
++		return ret;
++
++	priv->phycr1 = ret & (RTL8211F_ALDPS_PLL_OFF | RTL8211F_ALDPS_ENABLE | RTL8211F_ALDPS_XTAL_OFF);
++	if (of_property_read_bool(dev->of_node, "realtek,aldps-enable"))
++		priv->phycr1 |= RTL8211F_ALDPS_PLL_OFF | RTL8211F_ALDPS_ENABLE | RTL8211F_ALDPS_XTAL_OFF;
++
++	priv->has_phycr2 = !(phy_id == RTL_8211FVD_PHYID);
++	if (priv->has_phycr2) {
++		ret = phy_read_paged(phydev, 0xa43, RTL8211F_PHYCR2);
++		if (ret < 0)
++			return ret;
++
++		priv->phycr2 = ret & RTL8211F_CLKOUT_EN;
++		if (of_property_read_bool(dev->of_node, "realtek,clkout-disable"))
++			priv->phycr2 &= ~RTL8211F_CLKOUT_EN;
++	}
++
++	phydev->priv = priv;
++
++	return 0;
++}
++
++static int rtl8201_ack_interrupt(struct phy_device *phydev)
++{
++	int err;
++
++	err = phy_read(phydev, RTL8201F_ISR);
++
++	return (err < 0) ? err : 0;
++}
++
++static int rtl821x_ack_interrupt(struct phy_device *phydev)
++{
++	int err;
++
++	err = phy_read(phydev, RTL821x_INSR);
++
++	return (err < 0) ? err : 0;
++}
++
++static int rtl8211f_ack_interrupt(struct phy_device *phydev)
++{
++	int err;
++
++	err = phy_read_paged(phydev, 0xa43, RTL8211F_INSR);
++
++	return (err < 0) ? err : 0;
++}
++
++static int rtl8201_config_intr(struct phy_device *phydev)
++{
++	u16 val;
++	int err;
++
++	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
++		err = rtl8201_ack_interrupt(phydev);
++		if (err)
++			return err;
++
++		val = BIT(13) | BIT(12) | BIT(11);
++		err = phy_write_paged(phydev, 0x7, RTL8201F_IER, val);
++	} else {
++		val = 0;
++		err = phy_write_paged(phydev, 0x7, RTL8201F_IER, val);
++		if (err)
++			return err;
++
++		err = rtl8201_ack_interrupt(phydev);
++	}
++
++	return err;
++}
++
++static int rtl8211b_config_intr(struct phy_device *phydev)
++{
++	int err;
++
++	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
++		err = rtl821x_ack_interrupt(phydev);
++		if (err)
++			return err;
++
++		err = phy_write(phydev, RTL821x_INER,
++				RTL8211B_INER_INIT);
++	} else {
++		err = phy_write(phydev, RTL821x_INER, 0);
++		if (err)
++			return err;
++
++		err = rtl821x_ack_interrupt(phydev);
++	}
++
++	return err;
++}
++
++static int rtl8211e_config_intr(struct phy_device *phydev)
++{
++	int err;
++
++	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
++		err = rtl821x_ack_interrupt(phydev);
++		if (err)
++			return err;
++
++		err = phy_write(phydev, RTL821x_INER,
++				RTL8211E_INER_LINK_STATUS);
++	} else {
++		err = phy_write(phydev, RTL821x_INER, 0);
++		if (err)
++			return err;
++
++		err = rtl821x_ack_interrupt(phydev);
++	}
++
++	return err;
++}
++
++static int rtl8211f_config_intr(struct phy_device *phydev)
++{
++	u16 val;
++	int err;
++
++	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
++		err = rtl8211f_ack_interrupt(phydev);
++		if (err)
++			return err;
++
++		val = RTL8211F_INER_LINK_STATUS;
++		err = phy_write_paged(phydev, 0xa42, RTL821x_INER, val);
++	} else {
++		val = 0;
++		err = phy_write_paged(phydev, 0xa42, RTL821x_INER, val);
++		if (err)
++			return err;
++
++		err = rtl8211f_ack_interrupt(phydev);
++	}
++
++	return err;
++}
++
++static irqreturn_t rtl8201_handle_interrupt(struct phy_device *phydev)
++{
++	int irq_status;
++
++	irq_status = phy_read(phydev, RTL8201F_ISR);
++	if (irq_status < 0) {
++		phy_error(phydev);
++		return IRQ_NONE;
++	}
++
++	if (!(irq_status & RTL8201F_ISR_MASK))
++		return IRQ_NONE;
++
++	phy_trigger_machine(phydev);
++
++	return IRQ_HANDLED;
++}
++
++static irqreturn_t rtl821x_handle_interrupt(struct phy_device *phydev)
++{
++	int irq_status, irq_enabled;
++
++	irq_status = phy_read(phydev, RTL821x_INSR);
++	if (irq_status < 0) {
++		phy_error(phydev);
++		return IRQ_NONE;
++	}
++
++	irq_enabled = phy_read(phydev, RTL821x_INER);
++	if (irq_enabled < 0) {
++		phy_error(phydev);
++		return IRQ_NONE;
++	}
++
++	if (!(irq_status & irq_enabled))
++		return IRQ_NONE;
++
++	phy_trigger_machine(phydev);
++
++	return IRQ_HANDLED;
++}
++
++static irqreturn_t rtl8211f_handle_interrupt(struct phy_device *phydev)
++{
++	int irq_status;
++
++	irq_status = phy_read_paged(phydev, 0xa43, RTL8211F_INSR);
++	if (irq_status < 0) {
++		phy_error(phydev);
++		return IRQ_NONE;
++	}
++
++	if (!(irq_status & RTL8211F_INER_LINK_STATUS))
++		return IRQ_NONE;
++
++	phy_trigger_machine(phydev);
++
++	return IRQ_HANDLED;
++}
++
++static int rtl8211_config_aneg(struct phy_device *phydev)
++{
++	int ret;
++
++	ret = genphy_config_aneg(phydev);
++	if (ret < 0)
++		return ret;
++
++	/* Quirk was copied from vendor driver. Unfortunately it includes no
++	 * description of the magic numbers.
++	 */
++	if (phydev->speed == SPEED_100 && phydev->autoneg == AUTONEG_DISABLE) {
++		phy_write(phydev, 0x17, 0x2138);
++		phy_write(phydev, 0x0e, 0x0260);
++	} else {
++		phy_write(phydev, 0x17, 0x2108);
++		phy_write(phydev, 0x0e, 0x0000);
++	}
++
++	return 0;
++}
++
++static int rtl8211c_config_init(struct phy_device *phydev)
++{
++	/* RTL8211C has an issue when operating in Gigabit slave mode */
++	return phy_set_bits(phydev, MII_CTRL1000,
++			    CTL1000_ENABLE_MASTER | CTL1000_AS_MASTER);
++}
++
++static int rtl8211f_config_init(struct phy_device *phydev)
++{
++	struct rtl821x_priv *priv = phydev->priv;
++	struct device *dev = &phydev->mdio.dev;
++	u16 val_txdly, val_rxdly;
++	int ret;
++
++	ret = phy_modify_paged_changed(phydev, 0xa43, RTL8211F_PHYCR1,
++				       RTL8211F_ALDPS_PLL_OFF | RTL8211F_ALDPS_ENABLE | RTL8211F_ALDPS_XTAL_OFF,
++				       priv->phycr1);
++	if (ret < 0) {
++		dev_err(dev, "aldps mode  configuration failed: %pe\n",
++			ERR_PTR(ret));
++		return ret;
++	}
++
++	switch (phydev->interface) {
++	case PHY_INTERFACE_MODE_RGMII:
++		val_txdly = 0;
++		val_rxdly = 0;
++		break;
++
++	case PHY_INTERFACE_MODE_RGMII_RXID:
++		val_txdly = 0;
++		val_rxdly = RTL8211F_RX_DELAY;
++		break;
++
++	case PHY_INTERFACE_MODE_RGMII_TXID:
++		val_txdly = RTL8211F_TX_DELAY;
++		val_rxdly = 0;
++		break;
++
++	case PHY_INTERFACE_MODE_RGMII_ID:
++		val_txdly = RTL8211F_TX_DELAY;
++		val_rxdly = RTL8211F_RX_DELAY;
++		break;
++
++	default: /* the rest of the modes imply leaving delay as is. */
++		return 0;
++	}
++
++	ret = phy_modify_paged_changed(phydev, 0xd08, 0x11, RTL8211F_TX_DELAY,
++				       val_txdly);
++	if (ret < 0) {
++		dev_err(dev, "Failed to update the TX delay register\n");
++		return ret;
++	} else if (ret) {
++		dev_dbg(dev,
++			"%s 2ns TX delay (and changing the value from pin-strapping RXD1 or the bootloader)\n",
++			val_txdly ? "Enabling" : "Disabling");
++	} else {
++		dev_dbg(dev,
++			"2ns TX delay was already %s (by pin-strapping RXD1 or bootloader configuration)\n",
++			val_txdly ? "enabled" : "disabled");
++	}
++
++	ret = phy_modify_paged_changed(phydev, 0xd08, 0x15, RTL8211F_RX_DELAY,
++				       val_rxdly);
++	if (ret < 0) {
++		dev_err(dev, "Failed to update the RX delay register\n");
++		return ret;
++	} else if (ret) {
++		dev_dbg(dev,
++			"%s 2ns RX delay (and changing the value from pin-strapping RXD0 or the bootloader)\n",
++			val_rxdly ? "Enabling" : "Disabling");
++	} else {
++		dev_dbg(dev,
++			"2ns RX delay was already %s (by pin-strapping RXD0 or bootloader configuration)\n",
++			val_rxdly ? "enabled" : "disabled");
++	}
++
++	if (priv->has_phycr2) {
++		ret = phy_modify_paged(phydev, 0xa43, RTL8211F_PHYCR2,
++				       RTL8211F_CLKOUT_EN, priv->phycr2);
++		if (ret < 0) {
++			dev_err(dev, "clkout configuration failed: %pe\n",
++				ERR_PTR(ret));
++			return ret;
++		}
++
++		return genphy_soft_reset(phydev);
++	}
++
++	return 0;
++}
++
++static int rtl821x_suspend(struct phy_device *phydev)
++{
++	struct rtl821x_priv *priv = phydev->priv;
++	int ret = 0;
++
++	if (!phydev->wol_enabled) {
++		ret = genphy_suspend(phydev);
++
++		if (ret)
++			return ret;
++
++		clk_disable_unprepare(priv->clk);
++	}
++
++	return ret;
++}
++
++static int rtl821x_resume(struct phy_device *phydev)
++{
++	struct rtl821x_priv *priv = phydev->priv;
++	int ret;
++
++	if (!phydev->wol_enabled)
++		clk_prepare_enable(priv->clk);
++
++	ret = genphy_resume(phydev);
++	if (ret < 0)
++		return ret;
++
++	msleep(20);
++
++	return 0;
++}
++
++static int rtl8211f_led_hw_is_supported(struct phy_device *phydev, u8 index,
++					unsigned long rules)
++{
++	const unsigned long mask = BIT(TRIGGER_NETDEV_LINK_10) |
++				   BIT(TRIGGER_NETDEV_LINK_100) |
++				   BIT(TRIGGER_NETDEV_LINK_1000) |
++				   BIT(TRIGGER_NETDEV_RX) |
++				   BIT(TRIGGER_NETDEV_TX);
++
++	/* The RTL8211F PHY supports these LED settings on up to three LEDs:
++	 * - Link: Configurable subset of 10/100/1000 link rates
++	 * - Active: Blink on activity, RX or TX is not differentiated
++	 * The Active option has two modes, A and B:
++	 * - A: Link and Active indication at configurable, but matching,
++	 *      subset of 10/100/1000 link rates
++	 * - B: Link indication at configurable subset of 10/100/1000 link
++	 *      rates and Active indication always at all three 10+100+1000
++	 *      link rates.
++	 * This code currently uses mode B only.
++	 */
++
++	if (index >= RTL8211F_LED_COUNT)
++		return -EINVAL;
++
++	/* Filter out any other unsupported triggers. */
++	if (rules & ~mask)
++		return -EOPNOTSUPP;
++
++	/* RX and TX are not differentiated, either both are set or not set. */
++	if (!(rules & BIT(TRIGGER_NETDEV_RX)) ^ !(rules & BIT(TRIGGER_NETDEV_TX)))
++		return -EOPNOTSUPP;
++
++	return 0;
++}
++
++static int rtl8211f_led_hw_control_get(struct phy_device *phydev, u8 index,
++				       unsigned long *rules)
++{
++	int val;
++
++	if (index >= RTL8211F_LED_COUNT)
++		return -EINVAL;
++
++	val = phy_read_paged(phydev, 0xd04, RTL8211F_LEDCR);
++	if (val < 0)
++		return val;
++
++	val >>= RTL8211F_LEDCR_SHIFT * index;
++	val &= RTL8211F_LEDCR_MASK;
++
++	if (val & RTL8211F_LEDCR_LINK_10)
++		set_bit(TRIGGER_NETDEV_LINK_10, rules);
++
++	if (val & RTL8211F_LEDCR_LINK_100)
++		set_bit(TRIGGER_NETDEV_LINK_100, rules);
++
++	if (val & RTL8211F_LEDCR_LINK_1000)
++		set_bit(TRIGGER_NETDEV_LINK_1000, rules);
++
++	if (val & RTL8211F_LEDCR_ACT_TXRX) {
++		set_bit(TRIGGER_NETDEV_RX, rules);
++		set_bit(TRIGGER_NETDEV_TX, rules);
++	}
++
++	return 0;
++}
++
++static int rtl8211f_led_hw_control_set(struct phy_device *phydev, u8 index,
++				       unsigned long rules)
++{
++	const u16 mask = RTL8211F_LEDCR_MASK << (RTL8211F_LEDCR_SHIFT * index);
++	u16 reg = 0;
++
++	if (index >= RTL8211F_LED_COUNT)
++		return -EINVAL;
++
++	if (test_bit(TRIGGER_NETDEV_LINK_10, &rules))
++		reg |= RTL8211F_LEDCR_LINK_10;
++
++	if (test_bit(TRIGGER_NETDEV_LINK_100, &rules))
++		reg |= RTL8211F_LEDCR_LINK_100;
++
++	if (test_bit(TRIGGER_NETDEV_LINK_1000, &rules))
++		reg |= RTL8211F_LEDCR_LINK_1000;
++
++	if (test_bit(TRIGGER_NETDEV_RX, &rules) ||
++	    test_bit(TRIGGER_NETDEV_TX, &rules)) {
++		reg |= RTL8211F_LEDCR_ACT_TXRX;
++	}
++
++	reg <<= RTL8211F_LEDCR_SHIFT * index;
++	reg |= RTL8211F_LEDCR_MODE;	 /* Mode B */
++
++	return phy_modify_paged(phydev, 0xd04, RTL8211F_LEDCR, mask, reg);
++}
++
++static int rtl8211e_config_init(struct phy_device *phydev)
++{
++	int ret = 0, oldpage;
++	u16 val;
++
++	/* enable TX/RX delay for rgmii-* modes, and disable them for rgmii. */
++	switch (phydev->interface) {
++	case PHY_INTERFACE_MODE_RGMII:
++		val = RTL8211E_CTRL_DELAY | 0;
++		break;
++	case PHY_INTERFACE_MODE_RGMII_ID:
++		val = RTL8211E_CTRL_DELAY | RTL8211E_TX_DELAY | RTL8211E_RX_DELAY;
++		break;
++	case PHY_INTERFACE_MODE_RGMII_RXID:
++		val = RTL8211E_CTRL_DELAY | RTL8211E_RX_DELAY;
++		break;
++	case PHY_INTERFACE_MODE_RGMII_TXID:
++		val = RTL8211E_CTRL_DELAY | RTL8211E_TX_DELAY;
++		break;
++	default: /* the rest of the modes imply leaving delays as is. */
++		return 0;
++	}
++
++	/* According to a sample driver there is a 0x1c config register on the
++	 * 0xa4 extension page (0x7) layout. It can be used to disable/enable
++	 * the RX/TX delays otherwise controlled by RXDLY/TXDLY pins.
++	 * The configuration register definition:
++	 * 14 = reserved
++	 * 13 = Force Tx RX Delay controlled by bit12 bit11,
++	 * 12 = RX Delay, 11 = TX Delay
++	 * 10:0 = Test && debug settings reserved by realtek
++	 */
++	oldpage = phy_select_page(phydev, 0x7);
++	if (oldpage < 0)
++		goto err_restore_page;
++
++	ret = __phy_write(phydev, RTL821x_EXT_PAGE_SELECT, 0xa4);
++	if (ret)
++		goto err_restore_page;
++
++	ret = __phy_modify(phydev, 0x1c, RTL8211E_CTRL_DELAY
++			   | RTL8211E_TX_DELAY | RTL8211E_RX_DELAY,
++			   val);
++
++err_restore_page:
++	return phy_restore_page(phydev, oldpage, ret);
++}
++
++static int rtl8211b_suspend(struct phy_device *phydev)
++{
++	phy_write(phydev, MII_MMD_DATA, BIT(9));
++
++	return genphy_suspend(phydev);
++}
++
++static int rtl8211b_resume(struct phy_device *phydev)
++{
++	phy_write(phydev, MII_MMD_DATA, 0);
++
++	return genphy_resume(phydev);
++}
++
++static int rtl8366rb_config_init(struct phy_device *phydev)
++{
++	int ret;
++
++	ret = phy_set_bits(phydev, RTL8366RB_POWER_SAVE,
++			   RTL8366RB_POWER_SAVE_ON);
++	if (ret) {
++		dev_err(&phydev->mdio.dev,
++			"error enabling power management\n");
++	}
++
++	return ret;
++}
++
++/* get actual speed to cover the downshift case */
++static void rtlgen_decode_physr(struct phy_device *phydev, int val)
++{
++	/* bit 3
++	 * 0: Half Duplex
++	 * 1: Full Duplex
++	 */
++	if (val & RTL_VND2_PHYSR_DUPLEX)
++		phydev->duplex = DUPLEX_FULL;
++	else
++		phydev->duplex = DUPLEX_HALF;
++
++	switch (val & RTL_VND2_PHYSR_SPEED_MASK) {
++	case 0x0000:
++		phydev->speed = SPEED_10;
++		break;
++	case 0x0010:
++		phydev->speed = SPEED_100;
++		break;
++	case 0x0020:
++		phydev->speed = SPEED_1000;
++		break;
++	case 0x0200:
++		phydev->speed = SPEED_10000;
++		break;
++	case 0x0210:
++		phydev->speed = SPEED_2500;
++		break;
++	case 0x0220:
++		phydev->speed = SPEED_5000;
++		break;
++	default:
++		break;
++	}
++
++	/* bit 11
++	 * 0: Slave Mode
++	 * 1: Master Mode
++	 */
++	if (phydev->speed >= 1000) {
++		if (val & RTL_VND2_PHYSR_MASTER)
++			phydev->master_slave_state = MASTER_SLAVE_STATE_MASTER;
++		else
++			phydev->master_slave_state = MASTER_SLAVE_STATE_SLAVE;
++	} else {
++		phydev->master_slave_state = MASTER_SLAVE_STATE_UNSUPPORTED;
++	}
++}
++
++static int rtlgen_read_status(struct phy_device *phydev)
++{
++	int ret, val;
++
++	ret = genphy_read_status(phydev);
++	if (ret < 0)
++		return ret;
++
++	if (!phydev->link)
++		return 0;
++
++	val = phy_read_paged(phydev, 0xa43, 0x12);
++	if (val < 0)
++		return val;
++
++	rtlgen_decode_physr(phydev, val);
++
++	return 0;
++}
++
++static int rtlgen_read_mmd(struct phy_device *phydev, int devnum, u16 regnum)
++{
++	int ret;
++
++	if (devnum == MDIO_MMD_VEND2) {
++		rtl821x_write_page(phydev, regnum >> 4);
++		ret = __phy_read(phydev, 0x10 + ((regnum & 0xf) >> 1));
++		rtl821x_write_page(phydev, 0);
++	} else if (devnum == MDIO_MMD_PCS && regnum == MDIO_PCS_EEE_ABLE) {
++		rtl821x_write_page(phydev, 0xa5c);
++		ret = __phy_read(phydev, 0x12);
++		rtl821x_write_page(phydev, 0);
++	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV) {
++		rtl821x_write_page(phydev, 0xa5d);
++		ret = __phy_read(phydev, 0x10);
++		rtl821x_write_page(phydev, 0);
++	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_LPABLE) {
++		rtl821x_write_page(phydev, 0xa5d);
++		ret = __phy_read(phydev, 0x11);
++		rtl821x_write_page(phydev, 0);
++	} else {
++		ret = -EOPNOTSUPP;
++	}
++
++	return ret;
++}
++
++static int rtlgen_write_mmd(struct phy_device *phydev, int devnum, u16 regnum,
++			    u16 val)
++{
++	int ret;
++
++	if (devnum == MDIO_MMD_VEND2) {
++		rtl821x_write_page(phydev, regnum >> 4);
++		ret = __phy_write(phydev, 0x10 + ((regnum & 0xf) >> 1), val);
++		rtl821x_write_page(phydev, 0);
++	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV) {
++		rtl821x_write_page(phydev, 0xa5d);
++		ret = __phy_write(phydev, 0x10, val);
++		rtl821x_write_page(phydev, 0);
++	} else {
++		ret = -EOPNOTSUPP;
++	}
++
++	return ret;
++}
++
++static int rtl822x_read_mmd(struct phy_device *phydev, int devnum, u16 regnum)
++{
++	int ret = rtlgen_read_mmd(phydev, devnum, regnum);
++
++	if (ret != -EOPNOTSUPP)
++		return ret;
++
++	if (devnum == MDIO_MMD_PCS && regnum == MDIO_PCS_EEE_ABLE2) {
++		rtl821x_write_page(phydev, 0xa6e);
++		ret = __phy_read(phydev, 0x16);
++		rtl821x_write_page(phydev, 0);
++	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV2) {
++		rtl821x_write_page(phydev, 0xa6d);
++		ret = __phy_read(phydev, 0x12);
++		rtl821x_write_page(phydev, 0);
++	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_LPABLE2) {
++		rtl821x_write_page(phydev, 0xa6d);
++		ret = __phy_read(phydev, 0x10);
++		rtl821x_write_page(phydev, 0);
++	}
++
++	return ret;
++}
++
++static int rtl822x_write_mmd(struct phy_device *phydev, int devnum, u16 regnum,
++			     u16 val)
++{
++	int ret = rtlgen_write_mmd(phydev, devnum, regnum, val);
++
++	if (ret != -EOPNOTSUPP)
++		return ret;
++
++	if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV2) {
++		rtl821x_write_page(phydev, 0xa6d);
++		ret = __phy_write(phydev, 0x12, val);
++		rtl821x_write_page(phydev, 0);
++	}
++
++	return ret;
++}
++
++static int rtl822xb_config_init(struct phy_device *phydev)
++{
++	bool has_2500, has_sgmii;
++	u16 mode;
++	int ret;
++
++	has_2500 = test_bit(PHY_INTERFACE_MODE_2500BASEX,
++			    phydev->host_interfaces) ||
++		   phydev->interface == PHY_INTERFACE_MODE_2500BASEX;
++
++	has_sgmii = test_bit(PHY_INTERFACE_MODE_SGMII,
++			     phydev->host_interfaces) ||
++		    phydev->interface == PHY_INTERFACE_MODE_SGMII;
++
++	/* fill in possible interfaces */
++	__assign_bit(PHY_INTERFACE_MODE_2500BASEX, phydev->possible_interfaces,
++		     has_2500);
++	__assign_bit(PHY_INTERFACE_MODE_SGMII, phydev->possible_interfaces,
++		     has_sgmii);
++
++	if (!has_2500 && !has_sgmii)
++		return 0;
++
++	/* determine SerDes option mode */
++	if (has_2500 && !has_sgmii) {
++		mode = RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX;
++		phydev->rate_matching = RATE_MATCH_PAUSE;
++	} else {
++		mode = RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX_SGMII;
++		phydev->rate_matching = RATE_MATCH_NONE;
++	}
++
++	/* the following sequence with magic numbers sets up the SerDes
++	 * option mode
++	 */
++	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x75f3, 0);
++	if (ret < 0)
++		return ret;
++
++	ret = phy_modify_mmd_changed(phydev, MDIO_MMD_VEND1,
++				     RTL822X_VND1_SERDES_OPTION,
++				     RTL822X_VND1_SERDES_OPTION_MODE_MASK,
++				     mode);
++	if (ret < 0)
++		return ret;
++
++	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x6a04, 0x0503);
++	if (ret < 0)
++		return ret;
++
++	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x6f10, 0xd455);
++	if (ret < 0)
++		return ret;
++
++	return phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x6f11, 0x8020);
++}
++
++static int rtl822xb_get_rate_matching(struct phy_device *phydev,
++				      phy_interface_t iface)
++{
++	int val;
++
++	/* Only rate matching at 2500base-x */
++	if (iface != PHY_INTERFACE_MODE_2500BASEX)
++		return RATE_MATCH_NONE;
++
++	val = phy_read_mmd(phydev, MDIO_MMD_VEND1, RTL822X_VND1_SERDES_OPTION);
++	if (val < 0)
++		return val;
++
++	if ((val & RTL822X_VND1_SERDES_OPTION_MODE_MASK) ==
++	    RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX)
++		return RATE_MATCH_PAUSE;
++
++	/* RTL822X_VND1_SERDES_OPTION_MODE_2500BASEX_SGMII */
++	return RATE_MATCH_NONE;
++}
++
++static int rtl822x_get_features(struct phy_device *phydev)
++{
++	int val;
++
++	val = phy_read_paged(phydev, 0xa61, 0x13);
++	if (val < 0)
++		return val;
++
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_2500baseT_Full_BIT,
++			 phydev->supported, val & MDIO_PMA_SPEED_2_5G);
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_5000baseT_Full_BIT,
++			 phydev->supported, val & MDIO_PMA_SPEED_5G);
++	linkmode_mod_bit(ETHTOOL_LINK_MODE_10000baseT_Full_BIT,
++			 phydev->supported, val & MDIO_SPEED_10G);
++
++	return genphy_read_abilities(phydev);
++}
++
++static int rtl822x_config_aneg(struct phy_device *phydev)
++{
++	int ret = 0;
++
++	if (phydev->autoneg == AUTONEG_ENABLE) {
++		u16 adv = linkmode_adv_to_mii_10gbt_adv_t(phydev->advertising);
++
++		ret = phy_modify_paged_changed(phydev, 0xa5d, 0x12,
++					       MDIO_AN_10GBT_CTRL_ADV2_5G |
++					       MDIO_AN_10GBT_CTRL_ADV5G,
++					       adv);
++		if (ret < 0)
++			return ret;
++	}
++
++	return __genphy_config_aneg(phydev, ret);
++}
++
++static void rtl822xb_update_interface(struct phy_device *phydev)
++{
++	int val;
++
++	if (!phydev->link)
++		return;
++
++	/* Change interface according to serdes mode */
++	val = phy_read_mmd(phydev, MDIO_MMD_VEND1, RTL822X_VND1_SERDES_CTRL3);
++	if (val < 0)
++		return;
++
++	switch (val & RTL822X_VND1_SERDES_CTRL3_MODE_MASK) {
++	case RTL822X_VND1_SERDES_CTRL3_MODE_2500BASEX:
++		phydev->interface = PHY_INTERFACE_MODE_2500BASEX;
++		break;
++	case RTL822X_VND1_SERDES_CTRL3_MODE_SGMII:
++		phydev->interface = PHY_INTERFACE_MODE_SGMII;
++		break;
++	}
++}
++
++static int rtl822x_read_status(struct phy_device *phydev)
++{
++	int lpadv, ret;
++
++	mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising, 0);
++
++	ret = rtlgen_read_status(phydev);
++	if (ret < 0)
++		return ret;
++
++	if (phydev->autoneg == AUTONEG_DISABLE ||
++	    !phydev->autoneg_complete)
++		return 0;
++
++	lpadv = phy_read_paged(phydev, 0xa5d, 0x13);
++	if (lpadv < 0)
++		return lpadv;
++
++	mii_10gbt_stat_mod_linkmode_lpa_t(phydev->lp_advertising, lpadv);
++
++	return 0;
++}
++
++static int rtl822xb_read_status(struct phy_device *phydev)
++{
++	int ret;
++
++	ret = rtl822x_read_status(phydev);
++	if (ret < 0)
++		return ret;
++
++	rtl822xb_update_interface(phydev);
++
++	return 0;
++}
++
++static int rtl822x_c45_get_features(struct phy_device *phydev)
++{
++	linkmode_set_bit(ETHTOOL_LINK_MODE_TP_BIT,
++			 phydev->supported);
++
++	return genphy_c45_pma_read_abilities(phydev);
++}
++
++static int rtl822x_c45_config_aneg(struct phy_device *phydev)
++{
++	bool changed = false;
++	int ret, val;
++
++	if (phydev->autoneg == AUTONEG_DISABLE)
++		return genphy_c45_pma_setup_forced(phydev);
++
++	ret = genphy_c45_an_config_aneg(phydev);
++	if (ret < 0)
++		return ret;
++	if (ret > 0)
++		changed = true;
++
++	val = linkmode_adv_to_mii_ctrl1000_t(phydev->advertising);
++
++	/* Vendor register as C45 has no standardized support for 1000BaseT */
++	ret = phy_modify_mmd_changed(phydev, MDIO_MMD_VEND2, RTL822X_VND2_GBCR,
++				     ADVERTISE_1000FULL, val);
++	if (ret < 0)
++		return ret;
++	if (ret > 0)
++		changed = true;
++
++	return genphy_c45_check_and_restart_aneg(phydev, changed);
++}
++
++static int rtl822x_c45_read_status(struct phy_device *phydev)
++{
++	int ret, val;
++
++	/* Vendor register as C45 has no standardized support for 1000BaseT */
++	if (phydev->autoneg == AUTONEG_ENABLE && genphy_c45_aneg_done(phydev)) {
++		val = phy_read_mmd(phydev, MDIO_MMD_VEND2,
++				   RTL822X_VND2_GANLPAR);
++		if (val < 0)
++			return val;
++	} else {
++		val = 0;
++	}
++	mii_stat1000_mod_linkmode_lpa_t(phydev->lp_advertising, val);
++
++	ret = genphy_c45_read_status(phydev);
++	if (ret < 0)
++		return ret;
++
++	if (!phydev->link) {
++		phydev->master_slave_state = MASTER_SLAVE_STATE_UNKNOWN;
++		return 0;
++	}
++
++	/* Read actual speed from vendor register. */
++	val = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL_VND2_PHYSR);
++	if (val < 0)
++		return val;
++
++	rtlgen_decode_physr(phydev, val);
++
++	return 0;
++}
++
++static int rtl822xb_c45_read_status(struct phy_device *phydev)
++{
++	int ret;
++
++	ret = rtl822x_c45_read_status(phydev);
++	if (ret < 0)
++		return ret;
++
++	rtl822xb_update_interface(phydev);
++
++	return 0;
++}
++
++static bool rtlgen_supports_2_5gbps(struct phy_device *phydev)
++{
++	int val;
++
++	phy_write(phydev, RTL821x_PAGE_SELECT, 0xa61);
++	val = phy_read(phydev, 0x13);
++	phy_write(phydev, RTL821x_PAGE_SELECT, 0);
++
++	return val >= 0 && val & MDIO_PMA_SPEED_2_5G;
++}
++
++/* On internal PHY's MMD reads over C22 always return 0.
++ * Check a MMD register which is known to be non-zero.
++ */
++static bool rtlgen_supports_mmd(struct phy_device *phydev)
++{
++	int val;
++
++	phy_lock_mdio_bus(phydev);
++	__phy_write(phydev, MII_MMD_CTRL, MDIO_MMD_PCS);
++	__phy_write(phydev, MII_MMD_DATA, MDIO_PCS_EEE_ABLE);
++	__phy_write(phydev, MII_MMD_CTRL, MDIO_MMD_PCS | MII_MMD_CTRL_NOINCR);
++	val = __phy_read(phydev, MII_MMD_DATA);
++	phy_unlock_mdio_bus(phydev);
++
++	return val > 0;
++}
++
++static int rtlgen_match_phy_device(struct phy_device *phydev)
++{
++	return phydev->phy_id == RTL_GENERIC_PHYID &&
++	       !rtlgen_supports_2_5gbps(phydev);
++}
++
++static int rtl8226_match_phy_device(struct phy_device *phydev)
++{
++	return phydev->phy_id == RTL_GENERIC_PHYID &&
++	       rtlgen_supports_2_5gbps(phydev) &&
++	       rtlgen_supports_mmd(phydev);
++}
++
++static int rtlgen_is_c45_match(struct phy_device *phydev, unsigned int id,
++			       bool is_c45)
++{
++	if (phydev->is_c45)
++		return is_c45 && (id == phydev->c45_ids.device_ids[1]);
++	else
++		return !is_c45 && (id == phydev->phy_id);
++}
++
++static int rtl8221b_match_phy_device(struct phy_device *phydev)
++{
++	return phydev->phy_id == RTL_8221B && rtlgen_supports_mmd(phydev);
++}
++
++static int rtl8221b_vb_cg_c22_match_phy_device(struct phy_device *phydev)
++{
++	return rtlgen_is_c45_match(phydev, RTL_8221B_VB_CG, false);
++}
++
++static int rtl8221b_vb_cg_c45_match_phy_device(struct phy_device *phydev)
++{
++	return rtlgen_is_c45_match(phydev, RTL_8221B_VB_CG, true);
++}
++
++static int rtl8221b_vn_cg_c22_match_phy_device(struct phy_device *phydev)
++{
++	return rtlgen_is_c45_match(phydev, RTL_8221B_VN_CG, false);
++}
++
++static int rtl8221b_vn_cg_c45_match_phy_device(struct phy_device *phydev)
++{
++	return rtlgen_is_c45_match(phydev, RTL_8221B_VN_CG, true);
++}
++
++static int rtl_internal_nbaset_match_phy_device(struct phy_device *phydev)
++{
++	if (phydev->is_c45)
++		return false;
++
++	switch (phydev->phy_id) {
++	case RTL_GENERIC_PHYID:
++	case RTL_8221B:
++	case RTL_8251B:
++	case 0x001cc841:
++		break;
++	default:
++		return false;
++	}
++
++	return rtlgen_supports_2_5gbps(phydev) && !rtlgen_supports_mmd(phydev);
++}
++
++static int rtl8251b_c45_match_phy_device(struct phy_device *phydev)
++{
++	return rtlgen_is_c45_match(phydev, RTL_8251B, true);
++}
++
++static int rtlgen_resume(struct phy_device *phydev)
++{
++	int ret = genphy_resume(phydev);
++
++	/* Internal PHY's from RTL8168h up may not be instantly ready */
++	msleep(20);
++
++	return ret;
++}
++
++static int rtlgen_c45_resume(struct phy_device *phydev)
++{
++	int ret = genphy_c45_pma_resume(phydev);
++
++	msleep(20);
++
++	return ret;
++}
++
++static int rtl9000a_config_init(struct phy_device *phydev)
++{
++	phydev->autoneg = AUTONEG_DISABLE;
++	phydev->speed = SPEED_100;
++	phydev->duplex = DUPLEX_FULL;
++
++	return 0;
++}
++
++static int rtl9000a_config_aneg(struct phy_device *phydev)
++{
++	int ret;
++	u16 ctl = 0;
++
++	switch (phydev->master_slave_set) {
++	case MASTER_SLAVE_CFG_MASTER_FORCE:
++		ctl |= CTL1000_AS_MASTER;
++		break;
++	case MASTER_SLAVE_CFG_SLAVE_FORCE:
++		break;
++	case MASTER_SLAVE_CFG_UNKNOWN:
++	case MASTER_SLAVE_CFG_UNSUPPORTED:
++		return 0;
++	default:
++		phydev_warn(phydev, "Unsupported Master/Slave mode\n");
++		return -EOPNOTSUPP;
++	}
++
++	ret = phy_modify_changed(phydev, MII_CTRL1000, CTL1000_AS_MASTER, ctl);
++	if (ret == 1)
++		ret = genphy_soft_reset(phydev);
++
++	return ret;
++}
++
++static int rtl9000a_read_status(struct phy_device *phydev)
++{
++	int ret;
++
++	phydev->master_slave_get = MASTER_SLAVE_CFG_UNKNOWN;
++	phydev->master_slave_state = MASTER_SLAVE_STATE_UNKNOWN;
++
++	ret = genphy_update_link(phydev);
++	if (ret)
++		return ret;
++
++	ret = phy_read(phydev, MII_CTRL1000);
++	if (ret < 0)
++		return ret;
++	if (ret & CTL1000_AS_MASTER)
++		phydev->master_slave_get = MASTER_SLAVE_CFG_MASTER_FORCE;
++	else
++		phydev->master_slave_get = MASTER_SLAVE_CFG_SLAVE_FORCE;
++
++	ret = phy_read(phydev, MII_STAT1000);
++	if (ret < 0)
++		return ret;
++	if (ret & LPA_1000MSRES)
++		phydev->master_slave_state = MASTER_SLAVE_STATE_MASTER;
++	else
++		phydev->master_slave_state = MASTER_SLAVE_STATE_SLAVE;
++
++	return 0;
++}
++
++static int rtl9000a_ack_interrupt(struct phy_device *phydev)
++{
++	int err;
++
++	err = phy_read(phydev, RTL8211F_INSR);
++
++	return (err < 0) ? err : 0;
++}
++
++static int rtl9000a_config_intr(struct phy_device *phydev)
++{
++	u16 val;
++	int err;
++
++	if (phydev->interrupts == PHY_INTERRUPT_ENABLED) {
++		err = rtl9000a_ack_interrupt(phydev);
++		if (err)
++			return err;
++
++		val = (u16)~RTL9000A_GINMR_LINK_STATUS;
++		err = phy_write_paged(phydev, 0xa42, RTL9000A_GINMR, val);
++	} else {
++		val = ~0;
++		err = phy_write_paged(phydev, 0xa42, RTL9000A_GINMR, val);
++		if (err)
++			return err;
++
++		err = rtl9000a_ack_interrupt(phydev);
++	}
++
++	return phy_write_paged(phydev, 0xa42, RTL9000A_GINMR, val);
++}
++
++static irqreturn_t rtl9000a_handle_interrupt(struct phy_device *phydev)
++{
++	int irq_status;
++
++	irq_status = phy_read(phydev, RTL8211F_INSR);
++	if (irq_status < 0) {
++		phy_error(phydev);
++		return IRQ_NONE;
++	}
++
++	if (!(irq_status & RTL8211F_INER_LINK_STATUS))
++		return IRQ_NONE;
++
++	phy_trigger_machine(phydev);
++
++	return IRQ_HANDLED;
++}
++
++static struct phy_driver realtek_drvs[] = {
++	{
++		PHY_ID_MATCH_EXACT(0x00008201),
++		.name           = "RTL8201CP Ethernet",
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc816),
++		.name		= "RTL8201F Fast Ethernet",
++		.config_intr	= &rtl8201_config_intr,
++		.handle_interrupt = rtl8201_handle_interrupt,
++		.suspend	= genphy_suspend,
++		.resume		= genphy_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_MODEL(0x001cc880),
++		.name		= "RTL8208 Fast Ethernet",
++		.read_mmd	= genphy_read_mmd_unsupported,
++		.write_mmd	= genphy_write_mmd_unsupported,
++		.suspend	= genphy_suspend,
++		.resume		= genphy_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc910),
++		.name		= "RTL8211 Gigabit Ethernet",
++		.config_aneg	= rtl8211_config_aneg,
++		.read_mmd	= &genphy_read_mmd_unsupported,
++		.write_mmd	= &genphy_write_mmd_unsupported,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc912),
++		.name		= "RTL8211B Gigabit Ethernet",
++		.config_intr	= &rtl8211b_config_intr,
++		.handle_interrupt = rtl821x_handle_interrupt,
++		.read_mmd	= &genphy_read_mmd_unsupported,
++		.write_mmd	= &genphy_write_mmd_unsupported,
++		.suspend	= rtl8211b_suspend,
++		.resume		= rtl8211b_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc913),
++		.name		= "RTL8211C Gigabit Ethernet",
++		.config_init	= rtl8211c_config_init,
++		.read_mmd	= &genphy_read_mmd_unsupported,
++		.write_mmd	= &genphy_write_mmd_unsupported,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc914),
++		.name		= "RTL8211DN Gigabit Ethernet",
++		.config_intr	= rtl8211e_config_intr,
++		.handle_interrupt = rtl821x_handle_interrupt,
++		.suspend	= genphy_suspend,
++		.resume		= genphy_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc915),
++		.name		= "RTL8211E Gigabit Ethernet",
++		.config_init	= &rtl8211e_config_init,
++		.config_intr	= &rtl8211e_config_intr,
++		.handle_interrupt = rtl821x_handle_interrupt,
++		.suspend	= genphy_suspend,
++		.resume		= genphy_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc916),
++		.name		= "RTL8211F Gigabit Ethernet",
++		.probe		= rtl821x_probe,
++		.config_init	= &rtl8211f_config_init,
++		.read_status	= rtlgen_read_status,
++		.config_intr	= &rtl8211f_config_intr,
++		.handle_interrupt = rtl8211f_handle_interrupt,
++		.suspend	= rtl821x_suspend,
++		.resume		= rtl821x_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++		.flags		= PHY_ALWAYS_CALL_SUSPEND,
++		.led_hw_is_supported = rtl8211f_led_hw_is_supported,
++		.led_hw_control_get = rtl8211f_led_hw_control_get,
++		.led_hw_control_set = rtl8211f_led_hw_control_set,
++	}, {
++		PHY_ID_MATCH_EXACT(RTL_8211FVD_PHYID),
++		.name		= "RTL8211F-VD Gigabit Ethernet",
++		.probe		= rtl821x_probe,
++		.config_init	= &rtl8211f_config_init,
++		.read_status	= rtlgen_read_status,
++		.config_intr	= &rtl8211f_config_intr,
++		.handle_interrupt = rtl8211f_handle_interrupt,
++		.suspend	= rtl821x_suspend,
++		.resume		= rtl821x_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++		.flags		= PHY_ALWAYS_CALL_SUSPEND,
++	}, {
++		.name		= "Generic FE-GE Realtek PHY",
++		.match_phy_device = rtlgen_match_phy_device,
++		.read_status	= rtlgen_read_status,
++		.suspend	= genphy_suspend,
++		.resume		= rtlgen_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++		.read_mmd	= rtlgen_read_mmd,
++		.write_mmd	= rtlgen_write_mmd,
++	}, {
++		.name		= "RTL8226 2.5Gbps PHY",
++		.match_phy_device = rtl8226_match_phy_device,
++		.get_features	= rtl822x_get_features,
++		.config_aneg	= rtl822x_config_aneg,
++		.read_status	= rtl822x_read_status,
++		.suspend	= genphy_suspend,
++		.resume		= rtlgen_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		.match_phy_device = rtl8221b_match_phy_device,
++		.name		= "RTL8226B_RTL8221B 2.5Gbps PHY",
++		.get_features	= rtl822x_get_features,
++		.config_aneg	= rtl822x_config_aneg,
++		.config_init    = rtl822xb_config_init,
++		.get_rate_matching = rtl822xb_get_rate_matching,
++		.read_status	= rtl822xb_read_status,
++		.suspend	= genphy_suspend,
++		.resume		= rtlgen_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc838),
++		.name           = "RTL8226-CG 2.5Gbps PHY",
++		.get_features   = rtl822x_get_features,
++		.config_aneg    = rtl822x_config_aneg,
++		.read_status    = rtl822x_read_status,
++		.suspend        = genphy_suspend,
++		.resume         = rtlgen_resume,
++		.read_page      = rtl821x_read_page,
++		.write_page     = rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc848),
++		.name           = "RTL8226B-CG_RTL8221B-CG 2.5Gbps PHY",
++		.get_features   = rtl822x_get_features,
++		.config_aneg    = rtl822x_config_aneg,
++		.config_init    = rtl822xb_config_init,
++		.get_rate_matching = rtl822xb_get_rate_matching,
++		.read_status    = rtl822xb_read_status,
++		.suspend        = genphy_suspend,
++		.resume         = rtlgen_resume,
++		.read_page      = rtl821x_read_page,
++		.write_page     = rtl821x_write_page,
++	}, {
++		.match_phy_device = rtl8221b_vb_cg_c22_match_phy_device,
++		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C22)",
++		.get_features   = rtl822x_get_features,
++		.config_aneg    = rtl822x_config_aneg,
++		.config_init    = rtl822xb_config_init,
++		.get_rate_matching = rtl822xb_get_rate_matching,
++		.read_status    = rtl822xb_read_status,
++		.suspend        = genphy_suspend,
++		.resume         = rtlgen_resume,
++		.read_page      = rtl821x_read_page,
++		.write_page     = rtl821x_write_page,
++	}, {
++		.match_phy_device = rtl8221b_vb_cg_c45_match_phy_device,
++		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C45)",
++		.config_init    = rtl822xb_config_init,
++		.get_rate_matching = rtl822xb_get_rate_matching,
++		.get_features   = rtl822x_c45_get_features,
++		.config_aneg    = rtl822x_c45_config_aneg,
++		.read_status    = rtl822xb_c45_read_status,
++		.suspend        = genphy_c45_pma_suspend,
++		.resume         = rtlgen_c45_resume,
++	}, {
++		.match_phy_device = rtl8221b_vn_cg_c22_match_phy_device,
++		.name           = "RTL8221B-VM-CG 2.5Gbps PHY (C22)",
++		.get_features   = rtl822x_get_features,
++		.config_aneg    = rtl822x_config_aneg,
++		.config_init    = rtl822xb_config_init,
++		.get_rate_matching = rtl822xb_get_rate_matching,
++		.read_status    = rtl822xb_read_status,
++		.suspend        = genphy_suspend,
++		.resume         = rtlgen_resume,
++		.read_page      = rtl821x_read_page,
++		.write_page     = rtl821x_write_page,
++	}, {
++		.match_phy_device = rtl8221b_vn_cg_c45_match_phy_device,
++		.name           = "RTL8221B-VN-CG 2.5Gbps PHY (C45)",
++		.config_init    = rtl822xb_config_init,
++		.get_rate_matching = rtl822xb_get_rate_matching,
++		.get_features   = rtl822x_c45_get_features,
++		.config_aneg    = rtl822x_c45_config_aneg,
++		.read_status    = rtl822xb_c45_read_status,
++		.suspend        = genphy_c45_pma_suspend,
++		.resume         = rtlgen_c45_resume,
++	}, {
++		.match_phy_device = rtl8251b_c45_match_phy_device,
++		.name           = "RTL8251B 5Gbps PHY",
++		.get_features   = rtl822x_get_features,
++		.config_aneg    = rtl822x_config_aneg,
++		.read_status    = rtl822x_read_status,
++		.suspend        = genphy_suspend,
++		.resume         = rtlgen_resume,
++		.read_page      = rtl821x_read_page,
++		.write_page     = rtl821x_write_page,
++	}, {
++		.match_phy_device = rtl_internal_nbaset_match_phy_device,
++		.name           = "Realtek Internal NBASE-T PHY",
++		.flags		= PHY_IS_INTERNAL,
++		.get_features   = rtl822x_get_features,
++		.config_aneg    = rtl822x_config_aneg,
++		.read_status    = rtl822x_read_status,
++		.suspend        = genphy_suspend,
++		.resume         = rtlgen_resume,
++		.read_page      = rtl821x_read_page,
++		.write_page     = rtl821x_write_page,
++		.read_mmd	= rtl822x_read_mmd,
++		.write_mmd	= rtl822x_write_mmd,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001ccad0),
++		.name		= "RTL8224 2.5Gbps PHY",
++		.get_features   = rtl822x_c45_get_features,
++		.config_aneg    = rtl822x_c45_config_aneg,
++		.read_status    = rtl822x_c45_read_status,
++		.suspend        = genphy_c45_pma_suspend,
++		.resume         = rtlgen_c45_resume,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc961),
++		.name		= "RTL8366RB Gigabit Ethernet",
++		.config_init	= &rtl8366rb_config_init,
++		/* These interrupts are handled by the irq controller
++		 * embedded inside the RTL8366RB, they get unmasked when the
++		 * irq is requested and ACKed by reading the status register,
++		 * which is done by the irqchip code.
++		 */
++		.config_intr	= genphy_no_config_intr,
++		.handle_interrupt = genphy_handle_interrupt_no_ack,
++		.suspend	= genphy_suspend,
++		.resume		= genphy_resume,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001ccb00),
++		.name		= "RTL9000AA_RTL9000AN Ethernet",
++		.features       = PHY_BASIC_T1_FEATURES,
++		.config_init	= rtl9000a_config_init,
++		.config_aneg	= rtl9000a_config_aneg,
++		.read_status	= rtl9000a_read_status,
++		.config_intr	= rtl9000a_config_intr,
++		.handle_interrupt = rtl9000a_handle_interrupt,
++		.suspend	= genphy_suspend,
++		.resume		= genphy_resume,
++		.read_page	= rtl821x_read_page,
++		.write_page	= rtl821x_write_page,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc942),
++		.name		= "RTL8365MB-VC Gigabit Ethernet",
++		/* Interrupt handling analogous to RTL8366RB */
++		.config_intr	= genphy_no_config_intr,
++		.handle_interrupt = genphy_handle_interrupt_no_ack,
++		.suspend	= genphy_suspend,
++		.resume		= genphy_resume,
++	}, {
++		PHY_ID_MATCH_EXACT(0x001cc960),
++		.name		= "RTL8366S Gigabit Ethernet",
++		.suspend	= genphy_suspend,
++		.resume		= genphy_resume,
++		.read_mmd	= genphy_read_mmd_unsupported,
++		.write_mmd	= genphy_write_mmd_unsupported,
++	},
++};
++
++module_phy_driver(realtek_drvs);
++
++static const struct mdio_device_id __maybe_unused realtek_tbl[] = {
++	{ PHY_ID_MATCH_VENDOR(0x001cc800) },
++	{ }
++};
++
++MODULE_DEVICE_TABLE(mdio, realtek_tbl);
diff --git a/target/linux/generic/backport-6.6/781-25-v6.14-net-phy-realtek-add-hwmon-support-for-temp-sensor-on.patch b/target/linux/generic/backport-6.6/781-25-v6.14-net-phy-realtek-add-hwmon-support-for-temp-sensor-on.patch
new file mode 100644
index 00000000000000..7c1fe542672ba8
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-25-v6.14-net-phy-realtek-add-hwmon-support-for-temp-sensor-on.patch
@@ -0,0 +1,180 @@
+From 33700ca45b7d2e1655d4cad95e25671e8a94e2f0 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Sat, 11 Jan 2025 21:51:24 +0100
+Subject: [PATCH] net: phy: realtek: add hwmon support for temp sensor on
+ RTL822x
+
+This adds hwmon support for the temperature sensor on RTL822x.
+It's available on the standalone versions of the PHY's, and on
+the integrated PHY's in RTL8125B/RTL8125D/RTL8126.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/ad6bfe9f-6375-4a00-84b4-bfb38a21bd71@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/realtek/Kconfig         |  6 ++
+ drivers/net/phy/realtek/Makefile        |  1 +
+ drivers/net/phy/realtek/realtek.h       | 10 ++++
+ drivers/net/phy/realtek/realtek_hwmon.c | 79 +++++++++++++++++++++++++
+ drivers/net/phy/realtek/realtek_main.c  | 12 ++++
+ 5 files changed, 108 insertions(+)
+ create mode 100644 drivers/net/phy/realtek/realtek.h
+ create mode 100644 drivers/net/phy/realtek/realtek_hwmon.c
+
+--- a/drivers/net/phy/realtek/Kconfig
++++ b/drivers/net/phy/realtek/Kconfig
+@@ -3,3 +3,9 @@ config REALTEK_PHY
+ 	tristate "Realtek PHYs"
+ 	help
+ 	  Currently supports RTL821x/RTL822x and fast ethernet PHYs
++
++config REALTEK_PHY_HWMON
++	def_bool REALTEK_PHY && HWMON
++	depends on !(REALTEK_PHY=y && HWMON=m)
++	help
++	  Optional hwmon support for the temperature sensor
+--- a/drivers/net/phy/realtek/Makefile
++++ b/drivers/net/phy/realtek/Makefile
+@@ -1,3 +1,4 @@
+ # SPDX-License-Identifier: GPL-2.0
+ realtek-y			+= realtek_main.o
++realtek-$(CONFIG_REALTEK_PHY_HWMON) += realtek_hwmon.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
+--- /dev/null
++++ b/drivers/net/phy/realtek/realtek.h
+@@ -0,0 +1,10 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++
++#ifndef REALTEK_H
++#define REALTEK_H
++
++#include <linux/phy.h>
++
++int rtl822x_hwmon_init(struct phy_device *phydev);
++
++#endif /* REALTEK_H */
+--- /dev/null
++++ b/drivers/net/phy/realtek/realtek_hwmon.c
+@@ -0,0 +1,86 @@
++// SPDX-License-Identifier: GPL-2.0+
++/*
++ * HWMON support for Realtek PHY's
++ *
++ * Author: Heiner Kallweit <hkallweit1@gmail.com>
++ */
++
++#include <linux/hwmon.h>
++#include <linux/phy.h>
++
++#include "realtek.h"
++
++#define RTL822X_VND2_TSALRM				0xa662
++#define RTL822X_VND2_TSRR				0xbd84
++#define RTL822X_VND2_TSSR				0xb54c
++
++static umode_t rtl822x_hwmon_is_visible(const void *drvdata,
++				        enum hwmon_sensor_types type,
++				        u32 attr, int channel)
++{
++	return 0444;
++}
++
++static int rtl822x_hwmon_get_temp(int raw)
++{
++	if (raw >= 512)
++		raw -= 1024;
++
++	return 1000 * raw / 2;
++}
++
++static int rtl822x_hwmon_read(struct device *dev, enum hwmon_sensor_types type,
++			      u32 attr, int channel, long *val)
++{
++	struct phy_device *phydev = dev_get_drvdata(dev);
++	int raw;
++
++	switch (attr) {
++	case hwmon_temp_input:
++		raw = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL822X_VND2_TSRR) & 0x3ff;
++		*val = rtl822x_hwmon_get_temp(raw);
++		break;
++	case hwmon_temp_max:
++		/* Chip reduces speed to 1G if threshold is exceeded */
++		raw = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL822X_VND2_TSSR) >> 6;
++		*val = rtl822x_hwmon_get_temp(raw);
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static const struct hwmon_ops rtl822x_hwmon_ops = {
++	.is_visible = rtl822x_hwmon_is_visible,
++	.read = rtl822x_hwmon_read,
++};
++
++static const struct hwmon_channel_info * const rtl822x_hwmon_info[] = {
++	HWMON_CHANNEL_INFO(temp, HWMON_T_INPUT | HWMON_T_MAX),
++	NULL
++};
++
++static const struct hwmon_chip_info rtl822x_hwmon_chip_info = {
++	.ops = &rtl822x_hwmon_ops,
++	.info = rtl822x_hwmon_info,
++};
++
++int rtl822x_hwmon_init(struct phy_device *phydev)
++{
++	struct device *hwdev, *dev = &phydev->mdio.dev;
++	const char *name;
++
++	/* Ensure over-temp alarm is reset. */
++	phy_clear_bits_mmd(phydev, MDIO_MMD_VEND2, RTL822X_VND2_TSALRM, 3);
++
++	name = devm_hwmon_sanitize_name(dev, dev_name(dev));
++	if (IS_ERR(name))
++		return PTR_ERR(name);
++
++	hwdev = devm_hwmon_device_register_with_info(dev, name, phydev,
++						     &rtl822x_hwmon_chip_info,
++						     NULL);
++	return PTR_ERR_OR_ZERO(hwdev);
++}
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -14,6 +14,8 @@
+ #include <linux/delay.h>
+ #include <linux/clk.h>
+ 
++#include "realtek.h"
++
+ #define RTL821x_PHYSR				0x11
+ #define RTL821x_PHYSR_DUPLEX			BIT(13)
+ #define RTL821x_PHYSR_SPEED			GENMASK(15, 14)
+@@ -820,6 +822,15 @@ static int rtl822x_write_mmd(struct phy_
+ 	return ret;
+ }
+ 
++static int rtl822x_probe(struct phy_device *phydev)
++{
++	if (IS_ENABLED(CONFIG_REALTEK_PHY_HWMON) &&
++	    phydev->phy_id != RTL_GENERIC_PHYID)
++		return rtl822x_hwmon_init(phydev);
++
++	return 0;
++}
++
+ static int rtl822xb_config_init(struct phy_device *phydev)
+ {
+ 	bool has_2500, has_sgmii;
+@@ -1518,6 +1529,7 @@ static struct phy_driver realtek_drvs[]
+ 		.match_phy_device = rtl_internal_nbaset_match_phy_device,
+ 		.name           = "Realtek Internal NBASE-T PHY",
+ 		.flags		= PHY_IS_INTERNAL,
++		.probe		= rtl822x_probe,
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
+ 		.read_status    = rtl822x_read_status,
diff --git a/target/linux/generic/backport-6.6/781-26-v6.14-net-phy-realtek-HWMON-support-for-standalone-version.patch b/target/linux/generic/backport-6.6/781-26-v6.14-net-phy-realtek-HWMON-support-for-standalone-version.patch
new file mode 100644
index 00000000000000..8b8c97c54f4d39
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-26-v6.14-net-phy-realtek-HWMON-support-for-standalone-version.patch
@@ -0,0 +1,64 @@
+From 64ff63aeefb03139ae27454bd4208244579ae88e Mon Sep 17 00:00:00 2001
+From: Aleksander Jan Bajkowski <olek2@wp.pl>
+Date: Fri, 17 Jan 2025 23:24:21 +0100
+Subject: [PATCH] net: phy: realtek: HWMON support for standalone versions of
+ RTL8221B and RTL8251
+
+HWMON support has been added for the RTL8221/8251 PHYs integrated together
+with the MAC inside the RTL8125/8126 chips. This patch extends temperature
+reading support for standalone variants of the mentioned PHYs.
+
+I don't know whether the earlier revisions of the RTL8226 also have a
+built-in temperature sensor, so they have been skipped for now.
+
+Tested on RTL8221B-VB-CG.
+
+Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/realtek/realtek_main.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -1474,6 +1474,7 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8221b_vb_cg_c22_match_phy_device,
+ 		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C22)",
++		.probe		= rtl822x_probe,
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
+ 		.config_init    = rtl822xb_config_init,
+@@ -1486,6 +1487,7 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8221b_vb_cg_c45_match_phy_device,
+ 		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C45)",
++		.probe		= rtl822x_probe,
+ 		.config_init    = rtl822xb_config_init,
+ 		.get_rate_matching = rtl822xb_get_rate_matching,
+ 		.get_features   = rtl822x_c45_get_features,
+@@ -1496,6 +1498,7 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8221b_vn_cg_c22_match_phy_device,
+ 		.name           = "RTL8221B-VM-CG 2.5Gbps PHY (C22)",
++		.probe		= rtl822x_probe,
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
+ 		.config_init    = rtl822xb_config_init,
+@@ -1508,6 +1511,7 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8221b_vn_cg_c45_match_phy_device,
+ 		.name           = "RTL8221B-VN-CG 2.5Gbps PHY (C45)",
++		.probe		= rtl822x_probe,
+ 		.config_init    = rtl822xb_config_init,
+ 		.get_rate_matching = rtl822xb_get_rate_matching,
+ 		.get_features   = rtl822x_c45_get_features,
+@@ -1518,6 +1522,7 @@ static struct phy_driver realtek_drvs[]
+ 	}, {
+ 		.match_phy_device = rtl8251b_c45_match_phy_device,
+ 		.name           = "RTL8251B 5Gbps PHY",
++		.probe		= rtl822x_probe,
+ 		.get_features   = rtl822x_get_features,
+ 		.config_aneg    = rtl822x_config_aneg,
+ 		.read_status    = rtl822x_read_status,
diff --git a/target/linux/generic/backport-6.6/781-27-v6.15-net-phy-realtek-make-HWMON-support-a-user-visible-Kc.patch b/target/linux/generic/backport-6.6/781-27-v6.15-net-phy-realtek-make-HWMON-support-a-user-visible-Kc.patch
new file mode 100644
index 00000000000000..821d7ee8798765
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-27-v6.15-net-phy-realtek-make-HWMON-support-a-user-visible-Kc.patch
@@ -0,0 +1,35 @@
+From 51773846fab24a353bed4ebb660997ced4bc32d7 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Mon, 3 Feb 2025 21:33:39 +0100
+Subject: [PATCH] net: phy: realtek: make HWMON support a user-visible Kconfig
+ symbol
+
+Make config symbol REALTEK_PHY_HWMON user-visible, so that users can
+remove support if not needed.
+
+Suggested-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Link: https://patch.msgid.link/3466ee92-166a-4b0f-9ae7-42b9e046f333@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/realtek/Kconfig | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/phy/realtek/Kconfig
++++ b/drivers/net/phy/realtek/Kconfig
+@@ -4,8 +4,12 @@ config REALTEK_PHY
+ 	help
+ 	  Currently supports RTL821x/RTL822x and fast ethernet PHYs
+ 
++if REALTEK_PHY
++
+ config REALTEK_PHY_HWMON
+-	def_bool REALTEK_PHY && HWMON
+-	depends on !(REALTEK_PHY=y && HWMON=m)
++	bool "HWMON support for Realtek PHYs"
++	depends on HWMON && !(REALTEK_PHY=y && HWMON=m)
+ 	help
+ 	  Optional hwmon support for the temperature sensor
++
++endif # REALTEK_PHY
diff --git a/target/linux/generic/backport-6.6/781-28-v6.15-net-phy-realtek-use-string-choices-helpers.patch b/target/linux/generic/backport-6.6/781-28-v6.15-net-phy-realtek-use-string-choices-helpers.patch
new file mode 100644
index 00000000000000..d3e09bc7cdda93
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-28-v6.15-net-phy-realtek-use-string-choices-helpers.patch
@@ -0,0 +1,54 @@
+From 0bea93fdbaf8675b7e8124bdcaf51497dcc8bcfa Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Mon, 3 Feb 2025 21:41:36 +0100
+Subject: [PATCH] net: phy: realtek: use string choices helpers
+
+Use string choices helpers to simplify the code.
+
+Reported-by: kernel test robot <lkp@intel.com>
+Closes: https://lore.kernel.org/oe-kbuild-all/202501190707.qQS8PGHW-lkp@intel.com/
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Simon Horman <horms@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/realtek/realtek_main.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -13,6 +13,7 @@
+ #include <linux/module.h>
+ #include <linux/delay.h>
+ #include <linux/clk.h>
++#include <linux/string_choices.h>
+ 
+ #include "realtek.h"
+ 
+@@ -422,11 +423,11 @@ static int rtl8211f_config_init(struct p
+ 	} else if (ret) {
+ 		dev_dbg(dev,
+ 			"%s 2ns TX delay (and changing the value from pin-strapping RXD1 or the bootloader)\n",
+-			val_txdly ? "Enabling" : "Disabling");
++			str_enable_disable(val_txdly));
+ 	} else {
+ 		dev_dbg(dev,
+ 			"2ns TX delay was already %s (by pin-strapping RXD1 or bootloader configuration)\n",
+-			val_txdly ? "enabled" : "disabled");
++			str_enabled_disabled(val_txdly));
+ 	}
+ 
+ 	ret = phy_modify_paged_changed(phydev, 0xd08, 0x15, RTL8211F_RX_DELAY,
+@@ -437,11 +438,11 @@ static int rtl8211f_config_init(struct p
+ 	} else if (ret) {
+ 		dev_dbg(dev,
+ 			"%s 2ns RX delay (and changing the value from pin-strapping RXD0 or the bootloader)\n",
+-			val_rxdly ? "Enabling" : "Disabling");
++			str_enable_disable(val_rxdly));
+ 	} else {
+ 		dev_dbg(dev,
+ 			"2ns RX delay was already %s (by pin-strapping RXD0 or bootloader configuration)\n",
+-			val_rxdly ? "enabled" : "disabled");
++			str_enabled_disabled(val_rxdly));
+ 	}
+ 
+ 	if (priv->has_phycr2) {
diff --git a/target/linux/generic/backport-6.6/781-29-v6.15-net-phy-realtek-improve-mmd-register-access-for-inte.patch b/target/linux/generic/backport-6.6/781-29-v6.15-net-phy-realtek-improve-mmd-register-access-for-inte.patch
new file mode 100644
index 00000000000000..3a3a20d58be8ad
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-29-v6.15-net-phy-realtek-improve-mmd-register-access-for-inte.patch
@@ -0,0 +1,134 @@
+From da681ed73fb980286fc29de707b35d76bb33e123 Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 13 Feb 2025 20:18:17 +0100
+Subject: [PATCH] net: phy: realtek: improve mmd register access for internal
+ PHY's
+
+r8169 provides the MDIO bus for the internal PHY's. It has been extended
+with c45 access functions for addressing MDIO_MMD_VEND2 registers.
+So we can switch from paged access to directly addressing the
+MDIO_MMD_VEND2 registers.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/a5f2333c-dda9-48ad-9801-77049766e632@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/realtek/realtek_main.c | 79 +++++++++++---------------
+ 1 file changed, 33 insertions(+), 46 deletions(-)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -735,29 +735,31 @@ static int rtlgen_read_status(struct phy
+ 	return 0;
+ }
+ 
++static int rtlgen_read_vend2(struct phy_device *phydev, int regnum)
++{
++	return __mdiobus_c45_read(phydev->mdio.bus, 0, MDIO_MMD_VEND2, regnum);
++}
++
++static int rtlgen_write_vend2(struct phy_device *phydev, int regnum, u16 val)
++{
++	return __mdiobus_c45_write(phydev->mdio.bus, 0, MDIO_MMD_VEND2, regnum,
++				   val);
++}
++
+ static int rtlgen_read_mmd(struct phy_device *phydev, int devnum, u16 regnum)
+ {
+ 	int ret;
+ 
+-	if (devnum == MDIO_MMD_VEND2) {
+-		rtl821x_write_page(phydev, regnum >> 4);
+-		ret = __phy_read(phydev, 0x10 + ((regnum & 0xf) >> 1));
+-		rtl821x_write_page(phydev, 0);
+-	} else if (devnum == MDIO_MMD_PCS && regnum == MDIO_PCS_EEE_ABLE) {
+-		rtl821x_write_page(phydev, 0xa5c);
+-		ret = __phy_read(phydev, 0x12);
+-		rtl821x_write_page(phydev, 0);
+-	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV) {
+-		rtl821x_write_page(phydev, 0xa5d);
+-		ret = __phy_read(phydev, 0x10);
+-		rtl821x_write_page(phydev, 0);
+-	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_LPABLE) {
+-		rtl821x_write_page(phydev, 0xa5d);
+-		ret = __phy_read(phydev, 0x11);
+-		rtl821x_write_page(phydev, 0);
+-	} else {
++	if (devnum == MDIO_MMD_VEND2)
++		ret = rtlgen_read_vend2(phydev, regnum);
++	else if (devnum == MDIO_MMD_PCS && regnum == MDIO_PCS_EEE_ABLE)
++		ret = rtlgen_read_vend2(phydev, 0xa5c4);
++	else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV)
++		ret = rtlgen_read_vend2(phydev, 0xa5d0);
++	else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_LPABLE)
++		ret = rtlgen_read_vend2(phydev, 0xa5d2);
++	else
+ 		ret = -EOPNOTSUPP;
+-	}
+ 
+ 	return ret;
+ }
+@@ -767,17 +769,12 @@ static int rtlgen_write_mmd(struct phy_d
+ {
+ 	int ret;
+ 
+-	if (devnum == MDIO_MMD_VEND2) {
+-		rtl821x_write_page(phydev, regnum >> 4);
+-		ret = __phy_write(phydev, 0x10 + ((regnum & 0xf) >> 1), val);
+-		rtl821x_write_page(phydev, 0);
+-	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV) {
+-		rtl821x_write_page(phydev, 0xa5d);
+-		ret = __phy_write(phydev, 0x10, val);
+-		rtl821x_write_page(phydev, 0);
+-	} else {
++	if (devnum == MDIO_MMD_VEND2)
++		ret = rtlgen_write_vend2(phydev, regnum, val);
++	else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV)
++		ret = rtlgen_write_vend2(phydev, regnum, 0xa5d0);
++	else
+ 		ret = -EOPNOTSUPP;
+-	}
+ 
+ 	return ret;
+ }
+@@ -789,19 +786,12 @@ static int rtl822x_read_mmd(struct phy_d
+ 	if (ret != -EOPNOTSUPP)
+ 		return ret;
+ 
+-	if (devnum == MDIO_MMD_PCS && regnum == MDIO_PCS_EEE_ABLE2) {
+-		rtl821x_write_page(phydev, 0xa6e);
+-		ret = __phy_read(phydev, 0x16);
+-		rtl821x_write_page(phydev, 0);
+-	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV2) {
+-		rtl821x_write_page(phydev, 0xa6d);
+-		ret = __phy_read(phydev, 0x12);
+-		rtl821x_write_page(phydev, 0);
+-	} else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_LPABLE2) {
+-		rtl821x_write_page(phydev, 0xa6d);
+-		ret = __phy_read(phydev, 0x10);
+-		rtl821x_write_page(phydev, 0);
+-	}
++	if (devnum == MDIO_MMD_PCS && regnum == MDIO_PCS_EEE_ABLE2)
++		ret = rtlgen_read_vend2(phydev, 0xa6ec);
++	else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV2)
++		ret = rtlgen_read_vend2(phydev, 0xa6d4);
++	else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_LPABLE2)
++		ret = rtlgen_read_vend2(phydev, 0xa6d0);
+ 
+ 	return ret;
+ }
+@@ -814,11 +804,8 @@ static int rtl822x_write_mmd(struct phy_
+ 	if (ret != -EOPNOTSUPP)
+ 		return ret;
+ 
+-	if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV2) {
+-		rtl821x_write_page(phydev, 0xa6d);
+-		ret = __phy_write(phydev, 0x12, val);
+-		rtl821x_write_page(phydev, 0);
+-	}
++	if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV2)
++		ret = rtlgen_write_vend2(phydev, 0xa6d4, val);
+ 
+ 	return ret;
+ }
diff --git a/target/linux/generic/backport-6.6/781-30-v6.15-net-phy-realtek-switch-from-paged-to-MMD-ops-in-rtl8.patch b/target/linux/generic/backport-6.6/781-30-v6.15-net-phy-realtek-switch-from-paged-to-MMD-ops-in-rtl8.patch
new file mode 100644
index 00000000000000..5e3c3ce70a0f62
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-30-v6.15-net-phy-realtek-switch-from-paged-to-MMD-ops-in-rtl8.patch
@@ -0,0 +1,52 @@
+From 02d3b306ac2f0b174753d1c5b9e4e5fb8ec5057e Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Thu, 13 Feb 2025 20:19:14 +0100
+Subject: [PATCH] net: phy: realtek: switch from paged to MMD ops in rtl822x
+ functions
+
+The MDIO bus provided by r8169 for the internal PHY's now supports
+c45 ops for the MDIO_MMD_VEND2 device. So we can switch to standard
+MMD ops here.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/81416f95-0fac-4225-87b4-828e3738b8ed@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/realtek/realtek_main.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -901,7 +901,7 @@ static int rtl822x_get_features(struct p
+ {
+ 	int val;
+ 
+-	val = phy_read_paged(phydev, 0xa61, 0x13);
++	val = phy_read_mmd(phydev, MDIO_MMD_VEND2, 0xa616);
+ 	if (val < 0)
+ 		return val;
+ 
+@@ -922,10 +922,9 @@ static int rtl822x_config_aneg(struct ph
+ 	if (phydev->autoneg == AUTONEG_ENABLE) {
+ 		u16 adv = linkmode_adv_to_mii_10gbt_adv_t(phydev->advertising);
+ 
+-		ret = phy_modify_paged_changed(phydev, 0xa5d, 0x12,
+-					       MDIO_AN_10GBT_CTRL_ADV2_5G |
+-					       MDIO_AN_10GBT_CTRL_ADV5G,
+-					       adv);
++		ret = phy_modify_mmd_changed(phydev, MDIO_MMD_VEND2, 0xa5d4,
++					     MDIO_AN_10GBT_CTRL_ADV2_5G |
++					     MDIO_AN_10GBT_CTRL_ADV5G, adv);
+ 		if (ret < 0)
+ 			return ret;
+ 	}
+@@ -969,7 +968,7 @@ static int rtl822x_read_status(struct ph
+ 	    !phydev->autoneg_complete)
+ 		return 0;
+ 
+-	lpadv = phy_read_paged(phydev, 0xa5d, 0x13);
++	lpadv = phy_read_mmd(phydev, MDIO_MMD_VEND2, 0xa5d6);
+ 	if (lpadv < 0)
+ 		return lpadv;
+ 
diff --git a/target/linux/generic/backport-6.6/781-31-v6.15-net-phy-realtek-add-helper-RTL822X_VND2_C22_REG.patch b/target/linux/generic/backport-6.6/781-31-v6.15-net-phy-realtek-add-helper-RTL822X_VND2_C22_REG.patch
new file mode 100644
index 00000000000000..5134d08b1cc40f
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-31-v6.15-net-phy-realtek-add-helper-RTL822X_VND2_C22_REG.patch
@@ -0,0 +1,48 @@
+From 8af2136e77989a64fae0284bf76fd584e32edd3a Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Fri, 14 Feb 2025 21:31:14 +0100
+Subject: [PATCH] net: phy: realtek: add helper RTL822X_VND2_C22_REG
+
+C22 register space is mapped to 0xa400 in MMD VEND2 register space.
+Add a helper to access mapped C22 registers.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/6344277b-c5c7-449b-ac89-d5425306ca76@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/realtek/realtek_main.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -79,9 +79,7 @@
+ /* RTL822X_VND2_XXXXX registers are only accessible when phydev->is_c45
+  * is set, they cannot be accessed by C45-over-C22.
+  */
+-#define RTL822X_VND2_GBCR				0xa412
+-
+-#define RTL822X_VND2_GANLPAR				0xa414
++#define RTL822X_VND2_C22_REG(reg)		(0xa400 + 2 * (reg))
+ 
+ #define RTL8366RB_POWER_SAVE			0x15
+ #define RTL8366RB_POWER_SAVE_ON			BIT(12)
+@@ -1015,7 +1013,8 @@ static int rtl822x_c45_config_aneg(struc
+ 	val = linkmode_adv_to_mii_ctrl1000_t(phydev->advertising);
+ 
+ 	/* Vendor register as C45 has no standardized support for 1000BaseT */
+-	ret = phy_modify_mmd_changed(phydev, MDIO_MMD_VEND2, RTL822X_VND2_GBCR,
++	ret = phy_modify_mmd_changed(phydev, MDIO_MMD_VEND2,
++				     RTL822X_VND2_C22_REG(MII_CTRL1000),
+ 				     ADVERTISE_1000FULL, val);
+ 	if (ret < 0)
+ 		return ret;
+@@ -1032,7 +1031,7 @@ static int rtl822x_c45_read_status(struc
+ 	/* Vendor register as C45 has no standardized support for 1000BaseT */
+ 	if (phydev->autoneg == AUTONEG_ENABLE && genphy_c45_aneg_done(phydev)) {
+ 		val = phy_read_mmd(phydev, MDIO_MMD_VEND2,
+-				   RTL822X_VND2_GANLPAR);
++				   RTL822X_VND2_C22_REG(MII_STAT1000));
+ 		if (val < 0)
+ 			return val;
+ 	} else {
diff --git a/target/linux/generic/backport-6.6/781-32-v6.15-net-phy-realtek-add-defines-for-shadowed-c45-standar.patch b/target/linux/generic/backport-6.6/781-32-v6.15-net-phy-realtek-add-defines-for-shadowed-c45-standar.patch
new file mode 100644
index 00000000000000..ff7d5b1fb6aa04
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-32-v6.15-net-phy-realtek-add-defines-for-shadowed-c45-standar.patch
@@ -0,0 +1,113 @@
+From fabcfd6d10999024a721ae1b965b57eb8a305ace Mon Sep 17 00:00:00 2001
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Sat, 15 Feb 2025 14:29:15 +0100
+Subject: [PATCH] net: phy: realtek: add defines for shadowed c45 standard
+ registers
+
+Realtek shadows standard c45 registers in VEND2 device register space.
+Add defines for these VEND2 registers, based on the names of the
+standard c45 registers.
+
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/c90bdf76-f8b8-4d06-9656-7a52d5658ee6@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/realtek/realtek_main.c | 33 +++++++++++++++++---------
+ 1 file changed, 22 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -94,6 +94,16 @@
+ #define RTL_VND2_PHYSR_MASTER			BIT(11)
+ #define RTL_VND2_PHYSR_SPEED_MASK		(RTL_VND2_PHYSR_SPEEDL | RTL_VND2_PHYSR_SPEEDH)
+ 
++#define	RTL_MDIO_PCS_EEE_ABLE			0xa5c4
++#define	RTL_MDIO_AN_EEE_ADV			0xa5d0
++#define	RTL_MDIO_AN_EEE_LPABLE			0xa5d2
++#define	RTL_MDIO_AN_10GBT_CTRL			0xa5d4
++#define	RTL_MDIO_AN_10GBT_STAT			0xa5d6
++#define	RTL_MDIO_PMA_SPEED			0xa616
++#define	RTL_MDIO_AN_EEE_LPABLE2			0xa6d0
++#define	RTL_MDIO_AN_EEE_ADV2			0xa6d4
++#define	RTL_MDIO_PCS_EEE_ABLE2			0xa6ec
++
+ #define RTL_GENERIC_PHYID			0x001cc800
+ #define RTL_8211FVD_PHYID			0x001cc878
+ #define RTL_8221B				0x001cc840
+@@ -751,11 +761,11 @@ static int rtlgen_read_mmd(struct phy_de
+ 	if (devnum == MDIO_MMD_VEND2)
+ 		ret = rtlgen_read_vend2(phydev, regnum);
+ 	else if (devnum == MDIO_MMD_PCS && regnum == MDIO_PCS_EEE_ABLE)
+-		ret = rtlgen_read_vend2(phydev, 0xa5c4);
++		ret = rtlgen_read_vend2(phydev, RTL_MDIO_PCS_EEE_ABLE);
+ 	else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV)
+-		ret = rtlgen_read_vend2(phydev, 0xa5d0);
++		ret = rtlgen_read_vend2(phydev, RTL_MDIO_AN_EEE_ADV);
+ 	else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_LPABLE)
+-		ret = rtlgen_read_vend2(phydev, 0xa5d2);
++		ret = rtlgen_read_vend2(phydev, RTL_MDIO_AN_EEE_LPABLE);
+ 	else
+ 		ret = -EOPNOTSUPP;
+ 
+@@ -770,7 +780,7 @@ static int rtlgen_write_mmd(struct phy_d
+ 	if (devnum == MDIO_MMD_VEND2)
+ 		ret = rtlgen_write_vend2(phydev, regnum, val);
+ 	else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV)
+-		ret = rtlgen_write_vend2(phydev, regnum, 0xa5d0);
++		ret = rtlgen_write_vend2(phydev, regnum, RTL_MDIO_AN_EEE_ADV);
+ 	else
+ 		ret = -EOPNOTSUPP;
+ 
+@@ -785,11 +795,11 @@ static int rtl822x_read_mmd(struct phy_d
+ 		return ret;
+ 
+ 	if (devnum == MDIO_MMD_PCS && regnum == MDIO_PCS_EEE_ABLE2)
+-		ret = rtlgen_read_vend2(phydev, 0xa6ec);
++		ret = rtlgen_read_vend2(phydev, RTL_MDIO_PCS_EEE_ABLE2);
+ 	else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV2)
+-		ret = rtlgen_read_vend2(phydev, 0xa6d4);
++		ret = rtlgen_read_vend2(phydev, RTL_MDIO_AN_EEE_ADV2);
+ 	else if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_LPABLE2)
+-		ret = rtlgen_read_vend2(phydev, 0xa6d0);
++		ret = rtlgen_read_vend2(phydev, RTL_MDIO_AN_EEE_LPABLE2);
+ 
+ 	return ret;
+ }
+@@ -803,7 +813,7 @@ static int rtl822x_write_mmd(struct phy_
+ 		return ret;
+ 
+ 	if (devnum == MDIO_MMD_AN && regnum == MDIO_AN_EEE_ADV2)
+-		ret = rtlgen_write_vend2(phydev, 0xa6d4, val);
++		ret = rtlgen_write_vend2(phydev, RTL_MDIO_AN_EEE_ADV2, val);
+ 
+ 	return ret;
+ }
+@@ -899,7 +909,7 @@ static int rtl822x_get_features(struct p
+ {
+ 	int val;
+ 
+-	val = phy_read_mmd(phydev, MDIO_MMD_VEND2, 0xa616);
++	val = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL_MDIO_PMA_SPEED);
+ 	if (val < 0)
+ 		return val;
+ 
+@@ -920,7 +930,8 @@ static int rtl822x_config_aneg(struct ph
+ 	if (phydev->autoneg == AUTONEG_ENABLE) {
+ 		u16 adv = linkmode_adv_to_mii_10gbt_adv_t(phydev->advertising);
+ 
+-		ret = phy_modify_mmd_changed(phydev, MDIO_MMD_VEND2, 0xa5d4,
++		ret = phy_modify_mmd_changed(phydev, MDIO_MMD_VEND2,
++					     RTL_MDIO_AN_10GBT_CTRL,
+ 					     MDIO_AN_10GBT_CTRL_ADV2_5G |
+ 					     MDIO_AN_10GBT_CTRL_ADV5G, adv);
+ 		if (ret < 0)
+@@ -966,7 +977,7 @@ static int rtl822x_read_status(struct ph
+ 	    !phydev->autoneg_complete)
+ 		return 0;
+ 
+-	lpadv = phy_read_mmd(phydev, MDIO_MMD_VEND2, 0xa5d6);
++	lpadv = phy_read_mmd(phydev, MDIO_MMD_VEND2, RTL_MDIO_AN_10GBT_STAT);
+ 	if (lpadv < 0)
+ 		return lpadv;
+ 
diff --git a/target/linux/generic/backport-6.6/781-33-v6.15-net-phy-realtek-disable-PHY-mode-EEE.patch b/target/linux/generic/backport-6.6/781-33-v6.15-net-phy-realtek-disable-PHY-mode-EEE.patch
new file mode 100644
index 00000000000000..4d755d4e22a405
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-33-v6.15-net-phy-realtek-disable-PHY-mode-EEE.patch
@@ -0,0 +1,54 @@
+From bfc17c1658353f22843c7c13e27c2d31950f1887 Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Sun, 16 Mar 2025 12:39:54 +0000
+Subject: [PATCH] net: phy: realtek: disable PHY-mode EEE
+
+Realtek RTL8211F has a "PHY-mode" EEE support which interferes with an
+IEEE 802.3 compliant implementation. This mode defaults to enabled, and
+results in the MAC receive path not seeing the link transition to LPI
+state.
+
+Fix this by disabling PHY-mode EEE.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/E1ttnHW-00785s-Uq@rmk-PC.armlinux.org.uk
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/phy/realtek/realtek_main.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -33,6 +33,9 @@
+ 
+ #define RTL8211F_PHYCR1				0x18
+ #define RTL8211F_PHYCR2				0x19
++#define RTL8211F_CLKOUT_EN			BIT(0)
++#define RTL8211F_PHYCR2_PHY_EEE_ENABLE		BIT(5)
++
+ #define RTL8211F_INSR				0x1d
+ 
+ #define RTL8211F_LEDCR				0x10
+@@ -55,8 +58,6 @@
+ #define RTL8211E_TX_DELAY			BIT(12)
+ #define RTL8211E_RX_DELAY			BIT(11)
+ 
+-#define RTL8211F_CLKOUT_EN			BIT(0)
+-
+ #define RTL8201F_ISR				0x1e
+ #define RTL8201F_ISR_ANERR			BIT(15)
+ #define RTL8201F_ISR_DUPLEX			BIT(13)
+@@ -453,6 +454,12 @@ static int rtl8211f_config_init(struct p
+ 			str_enabled_disabled(val_rxdly));
+ 	}
+ 
++	/* Disable PHY-mode EEE so LPI is passed to the MAC */
++	ret = phy_modify_paged(phydev, 0xa43, RTL8211F_PHYCR2,
++			       RTL8211F_PHYCR2_PHY_EEE_ENABLE, 0);
++	if (ret)
++		return ret;
++
+ 	if (priv->has_phycr2) {
+ 		ret = phy_modify_paged(phydev, 0xa43, RTL8211F_PHYCR2,
+ 				       RTL8211F_CLKOUT_EN, priv->phycr2);
diff --git a/target/linux/generic/backport-6.6/781-34-v6.16-net-phy-realtek-Add-support-for-WOL-magic-packet-on.patch b/target/linux/generic/backport-6.6/781-34-v6.16-net-phy-realtek-Add-support-for-WOL-magic-packet-on.patch
new file mode 100644
index 00000000000000..4ba06cc3dd2a0f
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-34-v6.16-net-phy-realtek-Add-support-for-WOL-magic-packet-on.patch
@@ -0,0 +1,126 @@
+From 7840e4d6f48a75413470935ebdc4bab4fc0c035e Mon Sep 17 00:00:00 2001
+From: Daniel Braunwarth <daniel.braunwarth@kuka.com>
+Date: Tue, 29 Apr 2025 13:33:37 +0200
+Subject: [PATCH] net: phy: realtek: Add support for WOL magic packet on
+ RTL8211F
+
+The RTL8211F supports multiple WOL modes. This patch adds support for
+magic packets.
+
+The PHY notifies the system via the INTB/PMEB pin when a WOL event
+occurs.
+
+Signed-off-by: Daniel Braunwarth <daniel.braunwarth@kuka.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250429-realtek_wol-v2-1-8f84def1ef2c@kuka.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/realtek/realtek_main.c | 69 ++++++++++++++++++++++++++
+ 1 file changed, 69 insertions(+)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -10,6 +10,7 @@
+ #include <linux/bitops.h>
+ #include <linux/of.h>
+ #include <linux/phy.h>
++#include <linux/netdevice.h>
+ #include <linux/module.h>
+ #include <linux/delay.h>
+ #include <linux/clk.h>
+@@ -38,6 +39,24 @@
+ 
+ #define RTL8211F_INSR				0x1d
+ 
++/* RTL8211F WOL interrupt configuration */
++#define RTL8211F_INTBCR_PAGE			0xd40
++#define RTL8211F_INTBCR				0x16
++#define RTL8211F_INTBCR_INTB_PMEB		BIT(5)
++
++/* RTL8211F WOL settings */
++#define RTL8211F_WOL_SETTINGS_PAGE		0xd8a
++#define RTL8211F_WOL_SETTINGS_EVENTS		16
++#define RTL8211F_WOL_EVENT_MAGIC		BIT(12)
++#define RTL8211F_WOL_SETTINGS_STATUS		17
++#define RTL8211F_WOL_STATUS_RESET		(BIT(15) | 0x1fff)
++
++/* RTL8211F Unique phyiscal and multicast address (WOL) */
++#define RTL8211F_PHYSICAL_ADDR_PAGE		0xd8c
++#define RTL8211F_PHYSICAL_ADDR_WORD0		16
++#define RTL8211F_PHYSICAL_ADDR_WORD1		17
++#define RTL8211F_PHYSICAL_ADDR_WORD2		18
++
+ #define RTL8211F_LEDCR				0x10
+ #define RTL8211F_LEDCR_MODE			BIT(15)
+ #define RTL8211F_LEDCR_ACT_TXRX			BIT(4)
+@@ -123,6 +142,7 @@ struct rtl821x_priv {
+ 	u16 phycr2;
+ 	bool has_phycr2;
+ 	struct clk *clk;
++	u32 saved_wolopts;
+ };
+ 
+ static int rtl821x_read_page(struct phy_device *phydev)
+@@ -354,6 +374,53 @@ static irqreturn_t rtl8211f_handle_inter
+ 	return IRQ_HANDLED;
+ }
+ 
++static void rtl8211f_get_wol(struct phy_device *dev, struct ethtool_wolinfo *wol)
++{
++	wol->supported = WAKE_MAGIC;
++	if (phy_read_paged(dev, RTL8211F_WOL_SETTINGS_PAGE, RTL8211F_WOL_SETTINGS_EVENTS)
++	    & RTL8211F_WOL_EVENT_MAGIC)
++		wol->wolopts = WAKE_MAGIC;
++}
++
++static int rtl8211f_set_wol(struct phy_device *dev, struct ethtool_wolinfo *wol)
++{
++	const u8 *mac_addr = dev->attached_dev->dev_addr;
++	int oldpage;
++
++	oldpage = phy_save_page(dev);
++	if (oldpage < 0)
++		goto err;
++
++	if (wol->wolopts & WAKE_MAGIC) {
++		/* Store the device address for the magic packet */
++		rtl821x_write_page(dev, RTL8211F_PHYSICAL_ADDR_PAGE);
++		__phy_write(dev, RTL8211F_PHYSICAL_ADDR_WORD0, mac_addr[1] << 8 | (mac_addr[0]));
++		__phy_write(dev, RTL8211F_PHYSICAL_ADDR_WORD1, mac_addr[3] << 8 | (mac_addr[2]));
++		__phy_write(dev, RTL8211F_PHYSICAL_ADDR_WORD2, mac_addr[5] << 8 | (mac_addr[4]));
++
++		/* Enable magic packet matching and reset WOL status */
++		rtl821x_write_page(dev, RTL8211F_WOL_SETTINGS_PAGE);
++		__phy_write(dev, RTL8211F_WOL_SETTINGS_EVENTS, RTL8211F_WOL_EVENT_MAGIC);
++		__phy_write(dev, RTL8211F_WOL_SETTINGS_STATUS, RTL8211F_WOL_STATUS_RESET);
++
++		/* Enable the WOL interrupt */
++		rtl821x_write_page(dev, RTL8211F_INTBCR_PAGE);
++		__phy_set_bits(dev, RTL8211F_INTBCR, RTL8211F_INTBCR_INTB_PMEB);
++	} else {
++		/* Disable the WOL interrupt */
++		rtl821x_write_page(dev, RTL8211F_INTBCR_PAGE);
++		__phy_clear_bits(dev, RTL8211F_INTBCR, RTL8211F_INTBCR_INTB_PMEB);
++
++		/* Disable magic packet matching and reset WOL status */
++		rtl821x_write_page(dev, RTL8211F_WOL_SETTINGS_PAGE);
++		__phy_write(dev, RTL8211F_WOL_SETTINGS_EVENTS, 0);
++		__phy_write(dev, RTL8211F_WOL_SETTINGS_STATUS, RTL8211F_WOL_STATUS_RESET);
++	}
++
++err:
++	return phy_restore_page(dev, oldpage, 0);
++}
++
+ static int rtl8211_config_aneg(struct phy_device *phydev)
+ {
+ 	int ret;
+@@ -1400,6 +1467,8 @@ static struct phy_driver realtek_drvs[]
+ 		.read_status	= rtlgen_read_status,
+ 		.config_intr	= &rtl8211f_config_intr,
+ 		.handle_interrupt = rtl8211f_handle_interrupt,
++		.set_wol	= rtl8211f_set_wol,
++		.get_wol	= rtl8211f_get_wol,
+ 		.suspend	= rtl821x_suspend,
+ 		.resume		= rtl821x_resume,
+ 		.read_page	= rtl821x_read_page,
diff --git a/target/linux/generic/backport-6.6/781-35-v6.16-net-phy-realtek-remove-unsed-RTL821x_PHYSR-macros.patch b/target/linux/generic/backport-6.6/781-35-v6.16-net-phy-realtek-remove-unsed-RTL821x_PHYSR-macros.patch
new file mode 100644
index 00000000000000..e054937fdd2d2c
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-35-v6.16-net-phy-realtek-remove-unsed-RTL821x_PHYSR-macros.patch
@@ -0,0 +1,28 @@
+From f3b265358b911fe9e495619bdfa7797749474f95 Mon Sep 17 00:00:00 2001
+From: Michael Klein <michael@fossekall.de>
+Date: Sun, 4 May 2025 19:29:11 +0200
+Subject: [PATCH] net: phy: realtek: remove unsed RTL821x_PHYSR* macros
+
+These macros have there since the first revision but were never used, so
+let's just remove them.
+
+Signed-off-by: Michael Klein <michael@fossekall.de>
+Link: https://patch.msgid.link/20250504172916.243185-2-michael@fossekall.de
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/phy/realtek/realtek_main.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -18,10 +18,6 @@
+ 
+ #include "realtek.h"
+ 
+-#define RTL821x_PHYSR				0x11
+-#define RTL821x_PHYSR_DUPLEX			BIT(13)
+-#define RTL821x_PHYSR_SPEED			GENMASK(15, 14)
+-
+ #define RTL821x_INER				0x12
+ #define RTL8211B_INER_INIT			0x6400
+ #define RTL8211E_INER_LINK_STATUS		BIT(10)
diff --git a/target/linux/generic/backport-6.6/781-36-v6.16-net-phy-realtek-Clean-up-RTL821x-ExtPage-access.patch b/target/linux/generic/backport-6.6/781-36-v6.16-net-phy-realtek-Clean-up-RTL821x-ExtPage-access.patch
new file mode 100644
index 00000000000000..62bbf32f1a7ed2
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-36-v6.16-net-phy-realtek-Clean-up-RTL821x-ExtPage-access.patch
@@ -0,0 +1,95 @@
+From 7c6fa3ffd2650347b1d37f028e232e53d617c1af Mon Sep 17 00:00:00 2001
+From: Michael Klein <michael@fossekall.de>
+Date: Sun, 4 May 2025 19:29:12 +0200
+Subject: [PATCH] net: phy: realtek: Clean up RTL821x ExtPage access
+
+Factor out RTL8211E extension page access code to
+rtl821x_modify_ext_page() and clean up rtl8211e_config_init()
+
+Signed-off-by: Michael Klein <michael@fossekall.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250504172916.243185-3-michael@fossekall.de
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/phy/realtek/realtek_main.c | 38 ++++++++++++++++----------
+ 1 file changed, 23 insertions(+), 15 deletions(-)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -26,7 +26,9 @@
+ #define RTL821x_INSR				0x13
+ 
+ #define RTL821x_EXT_PAGE_SELECT			0x1e
++
+ #define RTL821x_PAGE_SELECT			0x1f
++#define RTL821x_SET_EXT_PAGE			0x07
+ 
+ #define RTL8211F_PHYCR1				0x18
+ #define RTL8211F_PHYCR2				0x19
+@@ -69,9 +71,12 @@
+ #define RTL8211F_ALDPS_ENABLE			BIT(2)
+ #define RTL8211F_ALDPS_XTAL_OFF			BIT(12)
+ 
++#define RTL8211E_RGMII_EXT_PAGE			0xa4
++#define RTL8211E_RGMII_DELAY			0x1c
+ #define RTL8211E_CTRL_DELAY			BIT(13)
+ #define RTL8211E_TX_DELAY			BIT(12)
+ #define RTL8211E_RX_DELAY			BIT(11)
++#define RTL8211E_DELAY_MASK			GENMASK(13, 11)
+ 
+ #define RTL8201F_ISR				0x1e
+ #define RTL8201F_ISR_ANERR			BIT(15)
+@@ -151,6 +156,21 @@ static int rtl821x_write_page(struct phy
+ 	return __phy_write(phydev, RTL821x_PAGE_SELECT, page);
+ }
+ 
++static int rtl821x_modify_ext_page(struct phy_device *phydev, u16 ext_page,
++				   u32 regnum, u16 mask, u16 set)
++{
++	int oldpage, ret = 0;
++
++	oldpage = phy_select_page(phydev, RTL821x_SET_EXT_PAGE);
++	if (oldpage >= 0) {
++		ret = __phy_write(phydev, RTL821x_EXT_PAGE_SELECT, ext_page);
++		if (ret == 0)
++			ret = __phy_modify(phydev, regnum, mask, set);
++	}
++
++	return phy_restore_page(phydev, oldpage, ret);
++}
++
+ static int rtl821x_probe(struct phy_device *phydev)
+ {
+ 	struct device *dev = &phydev->mdio.dev;
+@@ -670,7 +690,6 @@ static int rtl8211f_led_hw_control_set(s
+ 
+ static int rtl8211e_config_init(struct phy_device *phydev)
+ {
+-	int ret = 0, oldpage;
+ 	u16 val;
+ 
+ 	/* enable TX/RX delay for rgmii-* modes, and disable them for rgmii. */
+@@ -700,20 +719,9 @@ static int rtl8211e_config_init(struct p
+ 	 * 12 = RX Delay, 11 = TX Delay
+ 	 * 10:0 = Test && debug settings reserved by realtek
+ 	 */
+-	oldpage = phy_select_page(phydev, 0x7);
+-	if (oldpage < 0)
+-		goto err_restore_page;
+-
+-	ret = __phy_write(phydev, RTL821x_EXT_PAGE_SELECT, 0xa4);
+-	if (ret)
+-		goto err_restore_page;
+-
+-	ret = __phy_modify(phydev, 0x1c, RTL8211E_CTRL_DELAY
+-			   | RTL8211E_TX_DELAY | RTL8211E_RX_DELAY,
+-			   val);
+-
+-err_restore_page:
+-	return phy_restore_page(phydev, oldpage, ret);
++	return rtl821x_modify_ext_page(phydev, RTL8211E_RGMII_EXT_PAGE,
++				       RTL8211E_RGMII_DELAY,
++				       RTL8211E_DELAY_MASK, val);
+ }
+ 
+ static int rtl8211b_suspend(struct phy_device *phydev)
diff --git a/target/linux/generic/backport-6.6/781-37-v6.16-net-phy-realtek-add-RTL8211F-register-defines.patch b/target/linux/generic/backport-6.6/781-37-v6.16-net-phy-realtek-add-RTL8211F-register-defines.patch
new file mode 100644
index 00000000000000..9116992832276a
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-37-v6.16-net-phy-realtek-add-RTL8211F-register-defines.patch
@@ -0,0 +1,139 @@
+From 12d40df259e38851a0d973535e6023b33e2ea4f9 Mon Sep 17 00:00:00 2001
+From: Michael Klein <michael@fossekall.de>
+Date: Sun, 4 May 2025 19:29:13 +0200
+Subject: [PATCH] net: phy: realtek: add RTL8211F register defines
+
+Add some more defines for RTL8211F page and register numbers.
+
+Signed-off-by: Michael Klein <michael@fossekall.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250504172916.243185-4-michael@fossekall.de
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/phy/realtek/realtek_main.c | 34 ++++++++++++++++++--------
+ 1 file changed, 24 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -30,11 +30,14 @@
+ #define RTL821x_PAGE_SELECT			0x1f
+ #define RTL821x_SET_EXT_PAGE			0x07
+ 
++/* RTL8211F PHY configuration */
++#define RTL8211F_PHYCR_PAGE			0xa43
+ #define RTL8211F_PHYCR1				0x18
+ #define RTL8211F_PHYCR2				0x19
+ #define RTL8211F_CLKOUT_EN			BIT(0)
+ #define RTL8211F_PHYCR2_PHY_EEE_ENABLE		BIT(5)
+ 
++#define RTL8211F_INSR_PAGE			0xa43
+ #define RTL8211F_INSR				0x1d
+ 
+ /* RTL8211F WOL interrupt configuration */
+@@ -55,6 +58,8 @@
+ #define RTL8211F_PHYSICAL_ADDR_WORD1		17
+ #define RTL8211F_PHYSICAL_ADDR_WORD2		18
+ 
++/* RTL8211F LED configuration */
++#define RTL8211F_LEDCR_PAGE			0xd04
+ #define RTL8211F_LEDCR				0x10
+ #define RTL8211F_LEDCR_MODE			BIT(15)
+ #define RTL8211F_LEDCR_ACT_TXRX			BIT(4)
+@@ -64,7 +69,13 @@
+ #define RTL8211F_LEDCR_MASK			GENMASK(4, 0)
+ #define RTL8211F_LEDCR_SHIFT			5
+ 
++/* RTL8211F RGMII configuration */
++#define RTL8211F_RGMII_PAGE			0xd08
++
++#define RTL8211F_TXCR				0x11
+ #define RTL8211F_TX_DELAY			BIT(8)
++
++#define RTL8211F_RXCR				0x15
+ #define RTL8211F_RX_DELAY			BIT(3)
+ 
+ #define RTL8211F_ALDPS_PLL_OFF			BIT(1)
+@@ -187,7 +198,7 @@ static int rtl821x_probe(struct phy_devi
+ 		return dev_err_probe(dev, PTR_ERR(priv->clk),
+ 				     "failed to get phy clock\n");
+ 
+-	ret = phy_read_paged(phydev, 0xa43, RTL8211F_PHYCR1);
++	ret = phy_read_paged(phydev, RTL8211F_PHYCR_PAGE, RTL8211F_PHYCR1);
+ 	if (ret < 0)
+ 		return ret;
+ 
+@@ -197,7 +208,7 @@ static int rtl821x_probe(struct phy_devi
+ 
+ 	priv->has_phycr2 = !(phy_id == RTL_8211FVD_PHYID);
+ 	if (priv->has_phycr2) {
+-		ret = phy_read_paged(phydev, 0xa43, RTL8211F_PHYCR2);
++		ret = phy_read_paged(phydev, RTL8211F_PHYCR_PAGE, RTL8211F_PHYCR2);
+ 		if (ret < 0)
+ 			return ret;
+ 
+@@ -233,7 +244,7 @@ static int rtl8211f_ack_interrupt(struct
+ {
+ 	int err;
+ 
+-	err = phy_read_paged(phydev, 0xa43, RTL8211F_INSR);
++	err = phy_read_paged(phydev, RTL8211F_INSR_PAGE, RTL8211F_INSR);
+ 
+ 	return (err < 0) ? err : 0;
+ }
+@@ -376,7 +387,7 @@ static irqreturn_t rtl8211f_handle_inter
+ {
+ 	int irq_status;
+ 
+-	irq_status = phy_read_paged(phydev, 0xa43, RTL8211F_INSR);
++	irq_status = phy_read_paged(phydev, RTL8211F_INSR_PAGE, RTL8211F_INSR);
+ 	if (irq_status < 0) {
+ 		phy_error(phydev);
+ 		return IRQ_NONE;
+@@ -473,7 +484,7 @@ static int rtl8211f_config_init(struct p
+ 	u16 val_txdly, val_rxdly;
+ 	int ret;
+ 
+-	ret = phy_modify_paged_changed(phydev, 0xa43, RTL8211F_PHYCR1,
++	ret = phy_modify_paged_changed(phydev, RTL8211F_PHYCR_PAGE, RTL8211F_PHYCR1,
+ 				       RTL8211F_ALDPS_PLL_OFF | RTL8211F_ALDPS_ENABLE | RTL8211F_ALDPS_XTAL_OFF,
+ 				       priv->phycr1);
+ 	if (ret < 0) {
+@@ -507,7 +518,8 @@ static int rtl8211f_config_init(struct p
+ 		return 0;
+ 	}
+ 
+-	ret = phy_modify_paged_changed(phydev, 0xd08, 0x11, RTL8211F_TX_DELAY,
++	ret = phy_modify_paged_changed(phydev, RTL8211F_RGMII_PAGE,
++				       RTL8211F_TXCR, RTL8211F_TX_DELAY,
+ 				       val_txdly);
+ 	if (ret < 0) {
+ 		dev_err(dev, "Failed to update the TX delay register\n");
+@@ -522,7 +534,8 @@ static int rtl8211f_config_init(struct p
+ 			str_enabled_disabled(val_txdly));
+ 	}
+ 
+-	ret = phy_modify_paged_changed(phydev, 0xd08, 0x15, RTL8211F_RX_DELAY,
++	ret = phy_modify_paged_changed(phydev, RTL8211F_RGMII_PAGE,
++				       RTL8211F_RXCR, RTL8211F_RX_DELAY,
+ 				       val_rxdly);
+ 	if (ret < 0) {
+ 		dev_err(dev, "Failed to update the RX delay register\n");
+@@ -538,14 +551,15 @@ static int rtl8211f_config_init(struct p
+ 	}
+ 
+ 	/* Disable PHY-mode EEE so LPI is passed to the MAC */
+-	ret = phy_modify_paged(phydev, 0xa43, RTL8211F_PHYCR2,
++	ret = phy_modify_paged(phydev, RTL8211F_PHYCR_PAGE, RTL8211F_PHYCR2,
+ 			       RTL8211F_PHYCR2_PHY_EEE_ENABLE, 0);
+ 	if (ret)
+ 		return ret;
+ 
+ 	if (priv->has_phycr2) {
+-		ret = phy_modify_paged(phydev, 0xa43, RTL8211F_PHYCR2,
+-				       RTL8211F_CLKOUT_EN, priv->phycr2);
++		ret = phy_modify_paged(phydev, RTL8211F_PHYCR_PAGE,
++				       RTL8211F_PHYCR2, RTL8211F_CLKOUT_EN,
++				       priv->phycr2);
+ 		if (ret < 0) {
+ 			dev_err(dev, "clkout configuration failed: %pe\n",
+ 				ERR_PTR(ret));
diff --git a/target/linux/generic/backport-6.6/781-38-v6.16-net-phy-realtek-Group-RTL82-macro-definitions.patch b/target/linux/generic/backport-6.6/781-38-v6.16-net-phy-realtek-Group-RTL82-macro-definitions.patch
new file mode 100644
index 00000000000000..0319a2b109a294
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-38-v6.16-net-phy-realtek-Group-RTL82-macro-definitions.patch
@@ -0,0 +1,123 @@
+From 8c4d0172657c1f2d86b9c19172150abcd0e35c39 Mon Sep 17 00:00:00 2001
+From: Michael Klein <michael@fossekall.de>
+Date: Sun, 4 May 2025 19:29:14 +0200
+Subject: [PATCH] net: phy: realtek: Group RTL82* macro definitions
+
+Group macro definitions by PHY in lexicographic order. Within each PHY
+block, definitions are order by page number and then register number.
+
+Signed-off-by: Michael Klein <michael@fossekall.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250504172916.243185-5-michael@fossekall.de
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/phy/realtek/realtek_main.c | 72 +++++++++++++-------------
+ 1 file changed, 37 insertions(+), 35 deletions(-)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -18,6 +18,16 @@
+ 
+ #include "realtek.h"
+ 
++#define RTL8201F_IER				0x13
++
++#define RTL8201F_ISR				0x1e
++#define RTL8201F_ISR_ANERR			BIT(15)
++#define RTL8201F_ISR_DUPLEX			BIT(13)
++#define RTL8201F_ISR_LINK			BIT(11)
++#define RTL8201F_ISR_MASK			(RTL8201F_ISR_ANERR | \
++						 RTL8201F_ISR_DUPLEX | \
++						 RTL8201F_ISR_LINK)
++
+ #define RTL821x_INER				0x12
+ #define RTL8211B_INER_INIT			0x6400
+ #define RTL8211E_INER_LINK_STATUS		BIT(10)
+@@ -30,9 +40,21 @@
+ #define RTL821x_PAGE_SELECT			0x1f
+ #define RTL821x_SET_EXT_PAGE			0x07
+ 
++/* RTL8211E extension page 164/0xa4 */
++#define RTL8211E_RGMII_EXT_PAGE			0xa4
++#define RTL8211E_RGMII_DELAY			0x1c
++#define RTL8211E_CTRL_DELAY			BIT(13)
++#define RTL8211E_TX_DELAY			BIT(12)
++#define RTL8211E_RX_DELAY			BIT(11)
++#define RTL8211E_DELAY_MASK			GENMASK(13, 11)
++
+ /* RTL8211F PHY configuration */
+ #define RTL8211F_PHYCR_PAGE			0xa43
+ #define RTL8211F_PHYCR1				0x18
++#define RTL8211F_ALDPS_PLL_OFF			BIT(1)
++#define RTL8211F_ALDPS_ENABLE			BIT(2)
++#define RTL8211F_ALDPS_XTAL_OFF			BIT(12)
++
+ #define RTL8211F_PHYCR2				0x19
+ #define RTL8211F_CLKOUT_EN			BIT(0)
+ #define RTL8211F_PHYCR2_PHY_EEE_ENABLE		BIT(5)
+@@ -40,24 +62,6 @@
+ #define RTL8211F_INSR_PAGE			0xa43
+ #define RTL8211F_INSR				0x1d
+ 
+-/* RTL8211F WOL interrupt configuration */
+-#define RTL8211F_INTBCR_PAGE			0xd40
+-#define RTL8211F_INTBCR				0x16
+-#define RTL8211F_INTBCR_INTB_PMEB		BIT(5)
+-
+-/* RTL8211F WOL settings */
+-#define RTL8211F_WOL_SETTINGS_PAGE		0xd8a
+-#define RTL8211F_WOL_SETTINGS_EVENTS		16
+-#define RTL8211F_WOL_EVENT_MAGIC		BIT(12)
+-#define RTL8211F_WOL_SETTINGS_STATUS		17
+-#define RTL8211F_WOL_STATUS_RESET		(BIT(15) | 0x1fff)
+-
+-/* RTL8211F Unique phyiscal and multicast address (WOL) */
+-#define RTL8211F_PHYSICAL_ADDR_PAGE		0xd8c
+-#define RTL8211F_PHYSICAL_ADDR_WORD0		16
+-#define RTL8211F_PHYSICAL_ADDR_WORD1		17
+-#define RTL8211F_PHYSICAL_ADDR_WORD2		18
+-
+ /* RTL8211F LED configuration */
+ #define RTL8211F_LEDCR_PAGE			0xd04
+ #define RTL8211F_LEDCR				0x10
+@@ -78,25 +82,23 @@
+ #define RTL8211F_RXCR				0x15
+ #define RTL8211F_RX_DELAY			BIT(3)
+ 
+-#define RTL8211F_ALDPS_PLL_OFF			BIT(1)
+-#define RTL8211F_ALDPS_ENABLE			BIT(2)
+-#define RTL8211F_ALDPS_XTAL_OFF			BIT(12)
++/* RTL8211F WOL interrupt configuration */
++#define RTL8211F_INTBCR_PAGE			0xd40
++#define RTL8211F_INTBCR				0x16
++#define RTL8211F_INTBCR_INTB_PMEB		BIT(5)
+ 
+-#define RTL8211E_RGMII_EXT_PAGE			0xa4
+-#define RTL8211E_RGMII_DELAY			0x1c
+-#define RTL8211E_CTRL_DELAY			BIT(13)
+-#define RTL8211E_TX_DELAY			BIT(12)
+-#define RTL8211E_RX_DELAY			BIT(11)
+-#define RTL8211E_DELAY_MASK			GENMASK(13, 11)
++/* RTL8211F WOL settings */
++#define RTL8211F_WOL_SETTINGS_PAGE		0xd8a
++#define RTL8211F_WOL_SETTINGS_EVENTS		16
++#define RTL8211F_WOL_EVENT_MAGIC		BIT(12)
++#define RTL8211F_WOL_SETTINGS_STATUS		17
++#define RTL8211F_WOL_STATUS_RESET		(BIT(15) | 0x1fff)
+ 
+-#define RTL8201F_ISR				0x1e
+-#define RTL8201F_ISR_ANERR			BIT(15)
+-#define RTL8201F_ISR_DUPLEX			BIT(13)
+-#define RTL8201F_ISR_LINK			BIT(11)
+-#define RTL8201F_ISR_MASK			(RTL8201F_ISR_ANERR | \
+-						 RTL8201F_ISR_DUPLEX | \
+-						 RTL8201F_ISR_LINK)
+-#define RTL8201F_IER				0x13
++/* RTL8211F Unique phyiscal and multicast address (WOL) */
++#define RTL8211F_PHYSICAL_ADDR_PAGE		0xd8c
++#define RTL8211F_PHYSICAL_ADDR_WORD0		16
++#define RTL8211F_PHYSICAL_ADDR_WORD1		17
++#define RTL8211F_PHYSICAL_ADDR_WORD2		18
+ 
+ #define RTL822X_VND1_SERDES_OPTION			0x697a
+ #define RTL822X_VND1_SERDES_OPTION_MODE_MASK		GENMASK(5, 0)
diff --git a/target/linux/generic/backport-6.6/781-39-v6.16-net-phy-realtek-use-__set_bit-in-rtl8211f_led_hw_con.patch b/target/linux/generic/backport-6.6/781-39-v6.16-net-phy-realtek-use-__set_bit-in-rtl8211f_led_hw_con.patch
new file mode 100644
index 00000000000000..a9e3f9037d1f11
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-39-v6.16-net-phy-realtek-use-__set_bit-in-rtl8211f_led_hw_con.patch
@@ -0,0 +1,42 @@
+From be1cc96ddf82bb0c0a159751f73239d6d3e9594a Mon Sep 17 00:00:00 2001
+From: Michael Klein <michael@fossekall.de>
+Date: Sun, 4 May 2025 19:29:15 +0200
+Subject: [PATCH] net: phy: realtek: use __set_bit() in
+ rtl8211f_led_hw_control_get()
+
+rtl8211f_led_hw_control_get() does not need atomic bit operations,
+replace set_bit() by __set_bit().
+
+Signed-off-by: Michael Klein <michael@fossekall.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250504172916.243185-6-michael@fossekall.de
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/phy/realtek/realtek_main.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -659,17 +659,17 @@ static int rtl8211f_led_hw_control_get(s
+ 	val &= RTL8211F_LEDCR_MASK;
+ 
+ 	if (val & RTL8211F_LEDCR_LINK_10)
+-		set_bit(TRIGGER_NETDEV_LINK_10, rules);
++		__set_bit(TRIGGER_NETDEV_LINK_10, rules);
+ 
+ 	if (val & RTL8211F_LEDCR_LINK_100)
+-		set_bit(TRIGGER_NETDEV_LINK_100, rules);
++		__set_bit(TRIGGER_NETDEV_LINK_100, rules);
+ 
+ 	if (val & RTL8211F_LEDCR_LINK_1000)
+-		set_bit(TRIGGER_NETDEV_LINK_1000, rules);
++		__set_bit(TRIGGER_NETDEV_LINK_1000, rules);
+ 
+ 	if (val & RTL8211F_LEDCR_ACT_TXRX) {
+-		set_bit(TRIGGER_NETDEV_RX, rules);
+-		set_bit(TRIGGER_NETDEV_TX, rules);
++		__set_bit(TRIGGER_NETDEV_RX, rules);
++		__set_bit(TRIGGER_NETDEV_TX, rules);
+ 	}
+ 
+ 	return 0;
diff --git a/target/linux/generic/backport-6.6/781-40-v6.16-net-phy-realtek-Add-support-for-PHY-LEDs-on-RTL8211E.patch b/target/linux/generic/backport-6.6/781-40-v6.16-net-phy-realtek-Add-support-for-PHY-LEDs-on-RTL8211E.patch
new file mode 100644
index 00000000000000..a4b6450e92d231
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-40-v6.16-net-phy-realtek-Add-support-for-PHY-LEDs-on-RTL8211E.patch
@@ -0,0 +1,215 @@
+From 708686132ba02659267c0cebcc414348ece389a5 Mon Sep 17 00:00:00 2001
+From: Michael Klein <michael@fossekall.de>
+Date: Sun, 4 May 2025 19:29:16 +0200
+Subject: [PATCH] net: phy: realtek: Add support for PHY LEDs on RTL8211E
+
+Like the RTL8211F, the RTL8211E PHY supports up to three LEDs.
+Add netdev trigger support for them, too.
+
+Signed-off-by: Michael Klein <michael@fossekall.de>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250504172916.243185-7-michael@fossekall.de
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ drivers/net/phy/realtek/realtek_main.c | 125 +++++++++++++++++++++++--
+ 1 file changed, 119 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -40,6 +40,20 @@
+ #define RTL821x_PAGE_SELECT			0x1f
+ #define RTL821x_SET_EXT_PAGE			0x07
+ 
++/* RTL8211E extension page 44/0x2c */
++#define RTL8211E_LEDCR_EXT_PAGE			0x2c
++#define RTL8211E_LEDCR1				0x1a
++#define RTL8211E_LEDCR1_ACT_TXRX		BIT(4)
++#define RTL8211E_LEDCR1_MASK			BIT(4)
++#define RTL8211E_LEDCR1_SHIFT			1
++
++#define RTL8211E_LEDCR2				0x1c
++#define RTL8211E_LEDCR2_LINK_1000		BIT(2)
++#define RTL8211E_LEDCR2_LINK_100		BIT(1)
++#define RTL8211E_LEDCR2_LINK_10			BIT(0)
++#define RTL8211E_LEDCR2_MASK			GENMASK(2, 0)
++#define RTL8211E_LEDCR2_SHIFT			4
++
+ /* RTL8211E extension page 164/0xa4 */
+ #define RTL8211E_RGMII_EXT_PAGE			0xa4
+ #define RTL8211E_RGMII_DELAY			0x1c
+@@ -145,7 +159,8 @@
+ #define RTL_8221B_VN_CG				0x001cc84a
+ #define RTL_8251B				0x001cc862
+ 
+-#define RTL8211F_LED_COUNT			3
++/* RTL8211E and RTL8211F support up to three LEDs */
++#define RTL8211x_LED_COUNT			3
+ 
+ MODULE_DESCRIPTION("Realtek PHY driver");
+ MODULE_AUTHOR("Johnson Leung");
+@@ -169,6 +184,21 @@ static int rtl821x_write_page(struct phy
+ 	return __phy_write(phydev, RTL821x_PAGE_SELECT, page);
+ }
+ 
++static int rtl821x_read_ext_page(struct phy_device *phydev, u16 ext_page,
++				 u32 regnum)
++{
++	int oldpage, ret = 0;
++
++	oldpage = phy_select_page(phydev, RTL821x_SET_EXT_PAGE);
++	if (oldpage >= 0) {
++		ret = __phy_write(phydev, RTL821x_EXT_PAGE_SELECT, ext_page);
++		if (ret == 0)
++			ret = __phy_read(phydev, regnum);
++	}
++
++	return phy_restore_page(phydev, oldpage, ret);
++}
++
+ static int rtl821x_modify_ext_page(struct phy_device *phydev, u16 ext_page,
+ 				   u32 regnum, u16 mask, u16 set)
+ {
+@@ -608,7 +638,7 @@ static int rtl821x_resume(struct phy_dev
+ 	return 0;
+ }
+ 
+-static int rtl8211f_led_hw_is_supported(struct phy_device *phydev, u8 index,
++static int rtl8211x_led_hw_is_supported(struct phy_device *phydev, u8 index,
+ 					unsigned long rules)
+ {
+ 	const unsigned long mask = BIT(TRIGGER_NETDEV_LINK_10) |
+@@ -627,9 +657,11 @@ static int rtl8211f_led_hw_is_supported(
+ 	 *      rates and Active indication always at all three 10+100+1000
+ 	 *      link rates.
+ 	 * This code currently uses mode B only.
++	 *
++	 * RTL8211E PHY LED has one mode, which works like RTL8211F mode B.
+ 	 */
+ 
+-	if (index >= RTL8211F_LED_COUNT)
++	if (index >= RTL8211x_LED_COUNT)
+ 		return -EINVAL;
+ 
+ 	/* Filter out any other unsupported triggers. */
+@@ -648,7 +680,7 @@ static int rtl8211f_led_hw_control_get(s
+ {
+ 	int val;
+ 
+-	if (index >= RTL8211F_LED_COUNT)
++	if (index >= RTL8211x_LED_COUNT)
+ 		return -EINVAL;
+ 
+ 	val = phy_read_paged(phydev, 0xd04, RTL8211F_LEDCR);
+@@ -681,7 +713,7 @@ static int rtl8211f_led_hw_control_set(s
+ 	const u16 mask = RTL8211F_LEDCR_MASK << (RTL8211F_LEDCR_SHIFT * index);
+ 	u16 reg = 0;
+ 
+-	if (index >= RTL8211F_LED_COUNT)
++	if (index >= RTL8211x_LED_COUNT)
+ 		return -EINVAL;
+ 
+ 	if (test_bit(TRIGGER_NETDEV_LINK_10, &rules))
+@@ -704,6 +736,84 @@ static int rtl8211f_led_hw_control_set(s
+ 	return phy_modify_paged(phydev, 0xd04, RTL8211F_LEDCR, mask, reg);
+ }
+ 
++static int rtl8211e_led_hw_control_get(struct phy_device *phydev, u8 index,
++				       unsigned long *rules)
++{
++	int ret;
++	u16 cr1, cr2;
++
++	if (index >= RTL8211x_LED_COUNT)
++		return -EINVAL;
++
++	ret = rtl821x_read_ext_page(phydev, RTL8211E_LEDCR_EXT_PAGE,
++				    RTL8211E_LEDCR1);
++	if (ret < 0)
++		return ret;
++
++	cr1 = ret >> RTL8211E_LEDCR1_SHIFT * index;
++	if (cr1 & RTL8211E_LEDCR1_ACT_TXRX) {
++		__set_bit(TRIGGER_NETDEV_RX, rules);
++		__set_bit(TRIGGER_NETDEV_TX, rules);
++	}
++
++	ret = rtl821x_read_ext_page(phydev, RTL8211E_LEDCR_EXT_PAGE,
++				    RTL8211E_LEDCR2);
++	if (ret < 0)
++		return ret;
++
++	cr2 = ret >> RTL8211E_LEDCR2_SHIFT * index;
++	if (cr2 & RTL8211E_LEDCR2_LINK_10)
++		__set_bit(TRIGGER_NETDEV_LINK_10, rules);
++
++	if (cr2 & RTL8211E_LEDCR2_LINK_100)
++		__set_bit(TRIGGER_NETDEV_LINK_100, rules);
++
++	if (cr2 & RTL8211E_LEDCR2_LINK_1000)
++		__set_bit(TRIGGER_NETDEV_LINK_1000, rules);
++
++	return ret;
++}
++
++static int rtl8211e_led_hw_control_set(struct phy_device *phydev, u8 index,
++				       unsigned long rules)
++{
++	const u16 cr1mask =
++		RTL8211E_LEDCR1_MASK << (RTL8211E_LEDCR1_SHIFT * index);
++	const u16 cr2mask =
++		RTL8211E_LEDCR2_MASK << (RTL8211E_LEDCR2_SHIFT * index);
++	u16 cr1 = 0, cr2 = 0;
++	int ret;
++
++	if (index >= RTL8211x_LED_COUNT)
++		return -EINVAL;
++
++	if (test_bit(TRIGGER_NETDEV_RX, &rules) ||
++	    test_bit(TRIGGER_NETDEV_TX, &rules)) {
++		cr1 |= RTL8211E_LEDCR1_ACT_TXRX;
++	}
++
++	cr1 <<= RTL8211E_LEDCR1_SHIFT * index;
++	ret = rtl821x_modify_ext_page(phydev, RTL8211E_LEDCR_EXT_PAGE,
++				      RTL8211E_LEDCR1, cr1mask, cr1);
++	if (ret < 0)
++		return ret;
++
++	if (test_bit(TRIGGER_NETDEV_LINK_10, &rules))
++		cr2 |= RTL8211E_LEDCR2_LINK_10;
++
++	if (test_bit(TRIGGER_NETDEV_LINK_100, &rules))
++		cr2 |= RTL8211E_LEDCR2_LINK_100;
++
++	if (test_bit(TRIGGER_NETDEV_LINK_1000, &rules))
++		cr2 |= RTL8211E_LEDCR2_LINK_1000;
++
++	cr2 <<= RTL8211E_LEDCR2_SHIFT * index;
++	ret = rtl821x_modify_ext_page(phydev, RTL8211E_LEDCR_EXT_PAGE,
++				      RTL8211E_LEDCR2, cr2mask, cr2);
++
++	return ret;
++}
++
+ static int rtl8211e_config_init(struct phy_device *phydev)
+ {
+ 	u16 val;
+@@ -1479,6 +1589,9 @@ static struct phy_driver realtek_drvs[]
+ 		.resume		= genphy_resume,
+ 		.read_page	= rtl821x_read_page,
+ 		.write_page	= rtl821x_write_page,
++		.led_hw_is_supported = rtl8211x_led_hw_is_supported,
++		.led_hw_control_get = rtl8211e_led_hw_control_get,
++		.led_hw_control_set = rtl8211e_led_hw_control_set,
+ 	}, {
+ 		PHY_ID_MATCH_EXACT(0x001cc916),
+ 		.name		= "RTL8211F Gigabit Ethernet",
+@@ -1494,7 +1607,7 @@ static struct phy_driver realtek_drvs[]
+ 		.read_page	= rtl821x_read_page,
+ 		.write_page	= rtl821x_write_page,
+ 		.flags		= PHY_ALWAYS_CALL_SUSPEND,
+-		.led_hw_is_supported = rtl8211f_led_hw_is_supported,
++		.led_hw_is_supported = rtl8211x_led_hw_is_supported,
+ 		.led_hw_control_get = rtl8211f_led_hw_control_get,
+ 		.led_hw_control_set = rtl8211f_led_hw_control_set,
+ 	}, {
diff --git a/target/linux/generic/backport-6.6/781-41-v6.16-net-phy-realtek-add-RTL8127-internal-PHY.patch b/target/linux/generic/backport-6.6/781-41-v6.16-net-phy-realtek-add-RTL8127-internal-PHY.patch
new file mode 100644
index 00000000000000..04c631dfe58e1f
--- /dev/null
+++ b/target/linux/generic/backport-6.6/781-41-v6.16-net-phy-realtek-add-RTL8127-internal-PHY.patch
@@ -0,0 +1,35 @@
+From 83d9623161283f5f6883ee3fdb88ef2177b8a5f1 Mon Sep 17 00:00:00 2001
+From: ChunHao Lin <hau@realtek.com>
+Date: Fri, 16 May 2025 13:56:22 +0800
+Subject: [PATCH] net: phy: realtek: add RTL8127-internal PHY
+
+RTL8127-internal PHY is RTL8261C which is a integrated 10Gbps PHY with ID
+0x001cc890. It follows the code path of RTL8125/RTL8126 internal NBase-T
+PHY.
+
+Signed-off-by: ChunHao Lin <hau@realtek.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Link: https://patch.msgid.link/20250516055622.3772-1-hau@realtek.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/realtek/realtek_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -158,6 +158,7 @@
+ #define RTL_8221B_VB_CG				0x001cc849
+ #define RTL_8221B_VN_CG				0x001cc84a
+ #define RTL_8251B				0x001cc862
++#define RTL_8261C				0x001cc890
+ 
+ /* RTL8211E and RTL8211F support up to three LEDs */
+ #define RTL8211x_LED_COUNT			3
+@@ -1370,6 +1371,7 @@ static int rtl_internal_nbaset_match_phy
+ 	case RTL_GENERIC_PHYID:
+ 	case RTL_8221B:
+ 	case RTL_8251B:
++	case RTL_8261C:
+ 	case 0x001cc841:
+ 		break;
+ 	default:
diff --git a/target/linux/generic/backport-6.6/785-01-v6.8-net-sfp-rework-the-RollBall-PHY-waiting-code.patch b/target/linux/generic/backport-6.6/785-01-v6.8-net-sfp-rework-the-RollBall-PHY-waiting-code.patch
new file mode 100644
index 00000000000000..a15346346dc49e
--- /dev/null
+++ b/target/linux/generic/backport-6.6/785-01-v6.8-net-sfp-rework-the-RollBall-PHY-waiting-code.patch
@@ -0,0 +1,134 @@
+From 2f3ce7a56c6e02bc0b258507f3a82b7511f62f9e Mon Sep 17 00:00:00 2001
+From: Marek Behún <kabel@kernel.org>
+Date: Tue, 21 Nov 2023 18:20:24 +0100
+Subject: net: sfp: rework the RollBall PHY waiting code
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RollBall SFP modules allow the access to PHY registers only after a
+certain time has passed. Until then, the registers read 0xffff.
+
+Currently we have quirks for modules where we need to wait either 25
+seconds or 4 seconds, but recently I got hands on another module where
+the wait is even shorter.
+
+Instead of hardcoding different wait times, lets rework the code:
+- increase the PHY retry count to 25
+- when RollBall module is detected, increase the PHY retry time from
+  50ms to 1s
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/sfp.c | 41 +++++++++++++++++++++--------------------
+ 1 file changed, 21 insertions(+), 20 deletions(-)
+
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -191,7 +191,7 @@ static const enum gpiod_flags gpio_flags
+  * R_PHY_RETRY is the number of attempts.
+  */
+ #define T_PHY_RETRY		msecs_to_jiffies(50)
+-#define R_PHY_RETRY		12
++#define R_PHY_RETRY		25
+ 
+ /* SFP module presence detection is poor: the three MOD DEF signals are
+  * the same length on the PCB, which means it's possible for MOD DEF 0 to
+@@ -273,7 +273,7 @@ struct sfp {
+ 	struct sfp_eeprom_id id;
+ 	unsigned int module_power_mW;
+ 	unsigned int module_t_start_up;
+-	unsigned int module_t_wait;
++	unsigned int phy_t_retry;
+ 
+ 	unsigned int rate_kbd;
+ 	unsigned int rs_threshold_kbd;
+@@ -357,18 +357,22 @@ static void sfp_fixup_10gbaset_30m(struc
+ 	sfp->id.base.extended_cc = SFF8024_ECC_10GBASE_T_SR;
+ }
+ 
+-static void sfp_fixup_rollball_proto(struct sfp *sfp, unsigned int secs)
++static void sfp_fixup_rollball(struct sfp *sfp)
+ {
+ 	sfp->mdio_protocol = MDIO_I2C_ROLLBALL;
+-	sfp->module_t_wait = msecs_to_jiffies(secs * 1000);
++
++	/* RollBall modules may disallow access to PHY registers for up to 25
++	 * seconds, and the reads return 0xffff before that. Increase the time
++	 * between PHY probe retries from 50ms to 1s so that we will wait for
++	 * the PHY for a sufficient amount of time.
++	 */
++	sfp->phy_t_retry = msecs_to_jiffies(1000);
+ }
+ 
+ static void sfp_fixup_fs_10gt(struct sfp *sfp)
+ {
+ 	sfp_fixup_10gbaset_30m(sfp);
+-
+-	// These SFPs need 4 seconds before the PHY can be accessed
+-	sfp_fixup_rollball_proto(sfp, 4);
++	sfp_fixup_rollball(sfp);
+ }
+ 
+ static void sfp_fixup_halny_gsfp(struct sfp *sfp)
+@@ -380,12 +384,6 @@ static void sfp_fixup_halny_gsfp(struct
+ 	sfp->state_hw_mask &= ~(SFP_F_TX_FAULT | SFP_F_LOS);
+ }
+ 
+-static void sfp_fixup_rollball(struct sfp *sfp)
+-{
+-	// Rollball SFPs need 25 seconds before the PHY can be accessed
+-	sfp_fixup_rollball_proto(sfp, 25);
+-}
+-
+ static void sfp_fixup_rollball_cc(struct sfp *sfp)
+ {
+ 	sfp_fixup_rollball(sfp);
+@@ -2321,7 +2319,7 @@ static int sfp_sm_mod_probe(struct sfp *
+ 		mask |= SFP_F_RS1;
+ 
+ 	sfp->module_t_start_up = T_START_UP;
+-	sfp->module_t_wait = T_WAIT;
++	sfp->phy_t_retry = T_PHY_RETRY;
+ 
+ 	sfp->tx_fault_ignore = false;
+ 
+@@ -2555,10 +2553,9 @@ static void sfp_sm_main(struct sfp *sfp,
+ 
+ 		/* We need to check the TX_FAULT state, which is not defined
+ 		 * while TX_DISABLE is asserted. The earliest we want to do
+-		 * anything (such as probe for a PHY) is 50ms (or more on
+-		 * specific modules).
++		 * anything (such as probe for a PHY) is 50ms.
+ 		 */
+-		sfp_sm_next(sfp, SFP_S_WAIT, sfp->module_t_wait);
++		sfp_sm_next(sfp, SFP_S_WAIT, T_WAIT);
+ 		break;
+ 
+ 	case SFP_S_WAIT:
+@@ -2572,8 +2569,8 @@ static void sfp_sm_main(struct sfp *sfp,
+ 			 * deasserting.
+ 			 */
+ 			timeout = sfp->module_t_start_up;
+-			if (timeout > sfp->module_t_wait)
+-				timeout -= sfp->module_t_wait;
++			if (timeout > T_WAIT)
++				timeout -= T_WAIT;
+ 			else
+ 				timeout = 1;
+ 
+@@ -2616,7 +2613,11 @@ static void sfp_sm_main(struct sfp *sfp,
+ 		ret = sfp_sm_probe_for_phy(sfp);
+ 		if (ret == -ENODEV) {
+ 			if (--sfp->sm_phy_retries) {
+-				sfp_sm_next(sfp, SFP_S_INIT_PHY, T_PHY_RETRY);
++				sfp_sm_next(sfp, SFP_S_INIT_PHY,
++					    sfp->phy_t_retry);
++				dev_dbg(sfp->dev,
++					"no PHY detected, %u tries left\n",
++					sfp->sm_phy_retries);
+ 				break;
+ 			} else {
+ 				dev_info(sfp->dev, "no PHY detected\n");
diff --git a/target/linux/generic/backport-6.6/785-02-v6.8-net-sfp-fix-PHY-discovery-for-FS-SFP-10G-T-module.patch b/target/linux/generic/backport-6.6/785-02-v6.8-net-sfp-fix-PHY-discovery-for-FS-SFP-10G-T-module.patch
new file mode 100644
index 00000000000000..e14a69236f5b71
--- /dev/null
+++ b/target/linux/generic/backport-6.6/785-02-v6.8-net-sfp-fix-PHY-discovery-for-FS-SFP-10G-T-module.patch
@@ -0,0 +1,85 @@
+From e9301af385e7864dea353f5e58cad7339dd6c718 Mon Sep 17 00:00:00 2001
+From: Marek Behún <kabel@kernel.org>
+Date: Tue, 19 Dec 2023 17:24:15 +0100
+Subject: net: sfp: fix PHY discovery for FS SFP-10G-T module
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Commit 2f3ce7a56c6e ("net: sfp: rework the RollBall PHY waiting code")
+changed the long wait before accessing RollBall / FS modules into
+probing for PHY every 1 second, and trying 25 times.
+
+Wei Lei reports that this does not work correctly on FS modules: when
+initializing, they may report values different from 0xffff in PHY ID
+registers for some MMDs, causing get_phy_c45_ids() to find some bogus
+MMD.
+
+Fix this by adding the module_t_wait member back, and setting it to 4
+seconds for FS modules.
+
+Fixes: 2f3ce7a56c6e ("net: sfp: rework the RollBall PHY waiting code")
+Reported-by: Wei Lei <quic_leiwei@quicinc.com>
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Tested-by: Lei Wei <quic_leiwei@quicinc.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/sfp.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -273,6 +273,7 @@ struct sfp {
+ 	struct sfp_eeprom_id id;
+ 	unsigned int module_power_mW;
+ 	unsigned int module_t_start_up;
++	unsigned int module_t_wait;
+ 	unsigned int phy_t_retry;
+ 
+ 	unsigned int rate_kbd;
+@@ -373,6 +374,12 @@ static void sfp_fixup_fs_10gt(struct sfp
+ {
+ 	sfp_fixup_10gbaset_30m(sfp);
+ 	sfp_fixup_rollball(sfp);
++
++	/* The RollBall fixup is not enough for FS modules, the AQR chip inside
++	 * them does not return 0xffff for PHY ID registers in all MMDs for the
++	 * while initializing. They need a 4 second wait before accessing PHY.
++	 */
++	sfp->module_t_wait = msecs_to_jiffies(4000);
+ }
+ 
+ static void sfp_fixup_halny_gsfp(struct sfp *sfp)
+@@ -2319,6 +2326,7 @@ static int sfp_sm_mod_probe(struct sfp *
+ 		mask |= SFP_F_RS1;
+ 
+ 	sfp->module_t_start_up = T_START_UP;
++	sfp->module_t_wait = T_WAIT;
+ 	sfp->phy_t_retry = T_PHY_RETRY;
+ 
+ 	sfp->tx_fault_ignore = false;
+@@ -2553,9 +2561,10 @@ static void sfp_sm_main(struct sfp *sfp,
+ 
+ 		/* We need to check the TX_FAULT state, which is not defined
+ 		 * while TX_DISABLE is asserted. The earliest we want to do
+-		 * anything (such as probe for a PHY) is 50ms.
++		 * anything (such as probe for a PHY) is 50ms (or more on
++		 * specific modules).
+ 		 */
+-		sfp_sm_next(sfp, SFP_S_WAIT, T_WAIT);
++		sfp_sm_next(sfp, SFP_S_WAIT, sfp->module_t_wait);
+ 		break;
+ 
+ 	case SFP_S_WAIT:
+@@ -2569,8 +2578,8 @@ static void sfp_sm_main(struct sfp *sfp,
+ 			 * deasserting.
+ 			 */
+ 			timeout = sfp->module_t_start_up;
+-			if (timeout > T_WAIT)
+-				timeout -= T_WAIT;
++			if (timeout > sfp->module_t_wait)
++				timeout -= sfp->module_t_wait;
+ 			else
+ 				timeout = 1;
+ 
diff --git a/target/linux/generic/backport-6.6/785-03-v6.10-net-sfp-update-comment-for-FS-SFP-10G-T-quirk.patch b/target/linux/generic/backport-6.6/785-03-v6.10-net-sfp-update-comment-for-FS-SFP-10G-T-quirk.patch
new file mode 100644
index 00000000000000..f9e5019e94ff03
--- /dev/null
+++ b/target/linux/generic/backport-6.6/785-03-v6.10-net-sfp-update-comment-for-FS-SFP-10G-T-quirk.patch
@@ -0,0 +1,36 @@
+From 6999e0fc9a552ce98fcc66bee3dca7e55fba0ed3 Mon Sep 17 00:00:00 2001
+From: Marek Behún <kabel@kernel.org>
+Date: Tue, 23 Apr 2024 10:50:38 +0200
+Subject: net: sfp: update comment for FS SFP-10G-T quirk
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Update the comment for the Fibrestore SFP-10G-T module: since commit
+e9301af385e7 ("net: sfp: fix PHY discovery for FS SFP-10G-T module")
+we also do a 4 second wait before probing the PHY.
+
+Fixes: e9301af385e7 ("net: sfp: fix PHY discovery for FS SFP-10G-T module")
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Link: https://lore.kernel.org/r/20240423085039.26957-1-kabel@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/sfp.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -454,8 +454,9 @@ static const struct sfp_quirk sfp_quirks
+ 	SFP_QUIRK("ALCATELLUCENT", "3FE46541AA", sfp_quirk_2500basex,
+ 		  sfp_fixup_long_startup),
+ 
+-	// Fiberstore SFP-10G-T doesn't identify as copper, and uses the
+-	// Rollball protocol to talk to the PHY.
++	// Fiberstore SFP-10G-T doesn't identify as copper, uses the Rollball
++	// protocol to talk to the PHY and needs 4 sec wait before probing the
++	// PHY.
+ 	SFP_QUIRK_F("FS", "SFP-10G-T", sfp_fixup_fs_10gt),
+ 
+ 	// Fiberstore GPON-ONU-34-20BI can operate at 2500base-X, but report 1.2GBd
diff --git a/target/linux/generic/backport-6.6/785-04-v6.10-net-sfp-enhance-quirk-for-Fibrestore-2.5G-copper-SFP-module.patch b/target/linux/generic/backport-6.6/785-04-v6.10-net-sfp-enhance-quirk-for-Fibrestore-2.5G-copper-SFP-module.patch
new file mode 100644
index 00000000000000..6b83d3db1dded6
--- /dev/null
+++ b/target/linux/generic/backport-6.6/785-04-v6.10-net-sfp-enhance-quirk-for-Fibrestore-2.5G-copper-SFP-module.patch
@@ -0,0 +1,77 @@
+From cd4a32e60061789676f7f018a94fcc9ec56732a0 Mon Sep 17 00:00:00 2001
+From: Marek Behún <kabel@kernel.org>
+Date: Tue, 23 Apr 2024 10:50:39 +0200
+Subject: net: sfp: enhance quirk for Fibrestore 2.5G copper SFP module
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Enhance the quirk for Fibrestore 2.5G copper SFP module. The original
+commit e27aca3760c0 ("net: sfp: add quirk for FS's 2.5G copper SFP")
+introducing the quirk says that the PHY is inaccessible, but that is
+not true.
+
+The module uses Rollball protocol to talk to the PHY, and needs a 4
+second wait before probing it, same as FS 10G module.
+
+The PHY inside the module is Realtek RTL8221B-VB-CG PHY. The realtek
+driver recently gained support to set it up via clause 45 accesses.
+
+Signed-off-by: Marek Behún <kabel@kernel.org>
+Reviewed-by: Jiri Pirko <jiri@nvidia.com>
+Link: https://lore.kernel.org/r/20240423085039.26957-2-kabel@kernel.org
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/sfp.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -370,18 +370,23 @@ static void sfp_fixup_rollball(struct sf
+ 	sfp->phy_t_retry = msecs_to_jiffies(1000);
+ }
+ 
+-static void sfp_fixup_fs_10gt(struct sfp *sfp)
++static void sfp_fixup_fs_2_5gt(struct sfp *sfp)
+ {
+-	sfp_fixup_10gbaset_30m(sfp);
+ 	sfp_fixup_rollball(sfp);
+ 
+-	/* The RollBall fixup is not enough for FS modules, the AQR chip inside
++	/* The RollBall fixup is not enough for FS modules, the PHY chip inside
+ 	 * them does not return 0xffff for PHY ID registers in all MMDs for the
+ 	 * while initializing. They need a 4 second wait before accessing PHY.
+ 	 */
+ 	sfp->module_t_wait = msecs_to_jiffies(4000);
+ }
+ 
++static void sfp_fixup_fs_10gt(struct sfp *sfp)
++{
++	sfp_fixup_10gbaset_30m(sfp);
++	sfp_fixup_fs_2_5gt(sfp);
++}
++
+ static void sfp_fixup_halny_gsfp(struct sfp *sfp)
+ {
+ 	/* Ignore the TX_FAULT and LOS signals on this module.
+@@ -459,6 +464,10 @@ static const struct sfp_quirk sfp_quirks
+ 	// PHY.
+ 	SFP_QUIRK_F("FS", "SFP-10G-T", sfp_fixup_fs_10gt),
+ 
++	// Fiberstore SFP-2.5G-T uses Rollball protocol to talk to the PHY and
++	// needs 4 sec wait before probing the PHY.
++	SFP_QUIRK_F("FS", "SFP-2.5G-T", sfp_fixup_fs_2_5gt),
++
+ 	// Fiberstore GPON-ONU-34-20BI can operate at 2500base-X, but report 1.2GBd
+ 	// NRZ in their EEPROM
+ 	SFP_QUIRK("FS", "GPON-ONU-34-20BI", sfp_quirk_2500basex,
+@@ -475,9 +484,6 @@ static const struct sfp_quirk sfp_quirks
+ 	SFP_QUIRK("HUAWEI", "MA5671A", sfp_quirk_2500basex,
+ 		  sfp_fixup_ignore_tx_fault),
+ 
+-	// FS 2.5G Base-T
+-	SFP_QUIRK_M("FS", "SFP-2.5G-T", sfp_quirk_oem_2_5g),
+-
+ 	// Lantech 8330-262D-E can operate at 2500base-X, but incorrectly report
+ 	// 2500MBd NRZ in their EEPROM
+ 	SFP_QUIRK_M("Lantech", "8330-262D-E", sfp_quirk_2500basex),
diff --git a/target/linux/generic/backport-6.6/785-05-v6.15-net-sfp-add-quirk-for-FS-SFP-10GM-T-copper-SFP-module.patch b/target/linux/generic/backport-6.6/785-05-v6.15-net-sfp-add-quirk-for-FS-SFP-10GM-T-copper-SFP-module.patch
new file mode 100644
index 00000000000000..37657612d7b953
--- /dev/null
+++ b/target/linux/generic/backport-6.6/785-05-v6.15-net-sfp-add-quirk-for-FS-SFP-10GM-T-copper-SFP-module.patch
@@ -0,0 +1,50 @@
+From 05ec5c085eb7ae044d49e04a3cff194a0b2a3251 Mon Sep 17 00:00:00 2001
+From: Martin Schiller <ms@dev.tdt.de>
+Date: Thu, 27 Feb 2025 08:10:58 +0100
+Subject: net: sfp: add quirk for FS SFP-10GM-T copper SFP+ module
+
+Add quirk for a copper SFP that identifies itself as "FS" "SFP-10GM-T".
+It uses RollBall protocol to talk to the PHY and needs 4 sec wait before
+probing the PHY.
+
+Signed-off-by: Martin Schiller <ms@dev.tdt.de>
+Link: https://patch.msgid.link/20250227071058.1520027-1-ms@dev.tdt.de
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+---
+ drivers/net/phy/sfp.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -370,7 +370,7 @@ static void sfp_fixup_rollball(struct sf
+ 	sfp->phy_t_retry = msecs_to_jiffies(1000);
+ }
+ 
+-static void sfp_fixup_fs_2_5gt(struct sfp *sfp)
++static void sfp_fixup_rollball_wait4s(struct sfp *sfp)
+ {
+ 	sfp_fixup_rollball(sfp);
+ 
+@@ -384,7 +384,7 @@ static void sfp_fixup_fs_2_5gt(struct sf
+ static void sfp_fixup_fs_10gt(struct sfp *sfp)
+ {
+ 	sfp_fixup_10gbaset_30m(sfp);
+-	sfp_fixup_fs_2_5gt(sfp);
++	sfp_fixup_rollball_wait4s(sfp);
+ }
+ 
+ static void sfp_fixup_halny_gsfp(struct sfp *sfp)
+@@ -464,9 +464,10 @@ static const struct sfp_quirk sfp_quirks
+ 	// PHY.
+ 	SFP_QUIRK_F("FS", "SFP-10G-T", sfp_fixup_fs_10gt),
+ 
+-	// Fiberstore SFP-2.5G-T uses Rollball protocol to talk to the PHY and
+-	// needs 4 sec wait before probing the PHY.
+-	SFP_QUIRK_F("FS", "SFP-2.5G-T", sfp_fixup_fs_2_5gt),
++	// Fiberstore SFP-2.5G-T and SFP-10GM-T uses Rollball protocol to talk
++	// to the PHY and needs 4 sec wait before probing the PHY.
++	SFP_QUIRK_F("FS", "SFP-2.5G-T", sfp_fixup_rollball_wait4s),
++	SFP_QUIRK_F("FS", "SFP-10GM-T", sfp_fixup_rollball_wait4s),
+ 
+ 	// Fiberstore GPON-ONU-34-20BI can operate at 2500base-X, but report 1.2GBd
+ 	// NRZ in their EEPROM
diff --git a/target/linux/generic/backport-6.6/790-02-v6.7-net-dsa-mt753x-remove-mt753x_phylink_pcs_link_up.patch b/target/linux/generic/backport-6.6/790-02-v6.7-net-dsa-mt753x-remove-mt753x_phylink_pcs_link_up.patch
index 506024379e0a63..d99822a2e07101 100644
--- a/target/linux/generic/backport-6.6/790-02-v6.7-net-dsa-mt753x-remove-mt753x_phylink_pcs_link_up.patch
+++ b/target/linux/generic/backport-6.6/790-02-v6.7-net-dsa-mt753x-remove-mt753x_phylink_pcs_link_up.patch
@@ -24,7 +24,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -3037,15 +3037,6 @@ static void mt753x_phylink_mac_link_down
+@@ -3033,15 +3033,6 @@ static void mt753x_phylink_mac_link_down
  	mt7530_clear(priv, MT7530_PMCR_P(port), PMCR_LINK_SETTINGS_MASK);
  }
  
@@ -40,7 +40,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  static void mt753x_phylink_mac_link_up(struct dsa_switch *ds, int port,
  				       unsigned int mode,
  				       phy_interface_t interface,
-@@ -3133,8 +3124,6 @@ mt7531_cpu_port_config(struct dsa_switch
+@@ -3129,8 +3120,6 @@ mt7531_cpu_port_config(struct dsa_switch
  		return ret;
  	mt7530_write(priv, MT7530_PMCR_P(port),
  		     PMCR_CPU_PORT_SETTING(priv->id));
diff --git a/target/linux/generic/backport-6.6/790-05-v6.9-net-dsa-mt7530-always-trap-frames-to-active-CPU-port.patch b/target/linux/generic/backport-6.6/790-05-v6.9-net-dsa-mt7530-always-trap-frames-to-active-CPU-port.patch
index 8c73ea94a103bc..8fab36a4aa8198 100644
--- a/target/linux/generic/backport-6.6/790-05-v6.9-net-dsa-mt7530-always-trap-frames-to-active-CPU-port.patch
+++ b/target/linux/generic/backport-6.6/790-05-v6.9-net-dsa-mt7530-always-trap-frames-to-active-CPU-port.patch
@@ -49,7 +49,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	/* Add the CPU port to the CPU port bitmap for MT7531 and the switch on
  	 * the MT7988 SoC. Trapped frames will be forwarded to the CPU port that
  	 * is affine to the inbound user port.
-@@ -3305,6 +3301,36 @@ static int mt753x_set_mac_eee(struct dsa
+@@ -3301,6 +3297,36 @@ static int mt753x_set_mac_eee(struct dsa
  	return 0;
  }
  
@@ -86,7 +86,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  static int mt7988_pad_setup(struct dsa_switch *ds, phy_interface_t interface)
  {
  	return 0;
-@@ -3360,6 +3386,7 @@ const struct dsa_switch_ops mt7530_switc
+@@ -3356,6 +3382,7 @@ const struct dsa_switch_ops mt7530_switc
  	.phylink_mac_link_up	= mt753x_phylink_mac_link_up,
  	.get_mac_eee		= mt753x_get_mac_eee,
  	.set_mac_eee		= mt753x_set_mac_eee,
diff --git a/target/linux/generic/backport-6.6/790-07-v6.9-net-dsa-mt7530-store-port-5-SGMII-capability-of-MT75.patch b/target/linux/generic/backport-6.6/790-07-v6.9-net-dsa-mt7530-store-port-5-SGMII-capability-of-MT75.patch
index 426a7bcc2f3921..43730f8aaa78eb 100644
--- a/target/linux/generic/backport-6.6/790-07-v6.9-net-dsa-mt7530-store-port-5-SGMII-capability-of-MT75.patch
+++ b/target/linux/generic/backport-6.6/790-07-v6.9-net-dsa-mt7530-store-port-5-SGMII-capability-of-MT75.patch
@@ -100,7 +100,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	default:
  		return "unknown";
  	}
-@@ -2694,6 +2680,12 @@ mt7531_setup(struct dsa_switch *ds)
+@@ -2698,6 +2684,12 @@ mt7531_setup(struct dsa_switch *ds)
  		return -ENODEV;
  	}
  
@@ -113,7 +113,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	/* all MACs must be forced link-down before sw reset */
  	for (i = 0; i < MT7530_NUM_PORTS; i++)
  		mt7530_write(priv, MT7530_PMCR_P(i), MT7531_FORCE_LNK);
-@@ -2703,21 +2695,18 @@ mt7531_setup(struct dsa_switch *ds)
+@@ -2707,21 +2699,18 @@ mt7531_setup(struct dsa_switch *ds)
  		     SYS_CTRL_PHY_RST | SYS_CTRL_SW_RST |
  		     SYS_CTRL_REG_RST);
  
@@ -141,7 +141,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  
  	mt7530_rmw(priv, MT7531_GPIO_MODE0, MT7531_GPIO0_MASK,
  		   MT7531_GPIO0_INTERRUPT);
-@@ -2784,11 +2773,6 @@ static void mt7530_mac_port_get_caps(str
+@@ -2780,11 +2769,6 @@ static void mt7530_mac_port_get_caps(str
  	}
  }
  
@@ -153,7 +153,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  static void mt7531_mac_port_get_caps(struct dsa_switch *ds, int port,
  				     struct phylink_config *config)
  {
-@@ -2801,7 +2785,7 @@ static void mt7531_mac_port_get_caps(str
+@@ -2797,7 +2781,7 @@ static void mt7531_mac_port_get_caps(str
  		break;
  
  	case 5: /* 2nd cpu port supports either rgmii or sgmii/8023z */
@@ -162,7 +162,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  			phy_interface_set_rgmii(config->supported_interfaces);
  			break;
  		}
-@@ -2868,7 +2852,7 @@ static int mt7531_rgmii_setup(struct mt7
+@@ -2864,7 +2848,7 @@ static int mt7531_rgmii_setup(struct mt7
  {
  	u32 val;
  
@@ -171,7 +171,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		dev_err(priv->dev, "RGMII mode is not available for port %d\n",
  			port);
  		return -EINVAL;
-@@ -3111,7 +3095,7 @@ mt7531_cpu_port_config(struct dsa_switch
+@@ -3107,7 +3091,7 @@ mt7531_cpu_port_config(struct dsa_switch
  
  	switch (port) {
  	case 5:
@@ -180,7 +180,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  			interface = PHY_INTERFACE_MODE_RGMII;
  		else
  			interface = PHY_INTERFACE_MODE_2500BASEX;
-@@ -3263,7 +3247,7 @@ mt753x_setup(struct dsa_switch *ds)
+@@ -3259,7 +3243,7 @@ mt753x_setup(struct dsa_switch *ds)
  		mt7530_free_irq_common(priv);
  
  	if (priv->create_sgmii) {
diff --git a/target/linux/generic/backport-6.6/790-08-v6.9-net-dsa-mt7530-improve-comments-regarding-switch-por.patch b/target/linux/generic/backport-6.6/790-08-v6.9-net-dsa-mt7530-improve-comments-regarding-switch-por.patch
index 3309e248c94f31..3dddbbeee8b9a1 100644
--- a/target/linux/generic/backport-6.6/790-08-v6.9-net-dsa-mt7530-improve-comments-regarding-switch-por.patch
+++ b/target/linux/generic/backport-6.6/790-08-v6.9-net-dsa-mt7530-improve-comments-regarding-switch-por.patch
@@ -37,7 +37,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2751,12 +2751,14 @@ static void mt7530_mac_port_get_caps(str
+@@ -2747,12 +2747,14 @@ static void mt7530_mac_port_get_caps(str
  				     struct phylink_config *config)
  {
  	switch (port) {
@@ -54,7 +54,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		phy_interface_set_rgmii(config->supported_interfaces);
  		__set_bit(PHY_INTERFACE_MODE_MII,
  			  config->supported_interfaces);
-@@ -2764,7 +2766,8 @@ static void mt7530_mac_port_get_caps(str
+@@ -2760,7 +2762,8 @@ static void mt7530_mac_port_get_caps(str
  			  config->supported_interfaces);
  		break;
  
@@ -64,7 +64,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		__set_bit(PHY_INTERFACE_MODE_RGMII,
  			  config->supported_interfaces);
  		__set_bit(PHY_INTERFACE_MODE_TRGMII,
-@@ -2779,19 +2782,24 @@ static void mt7531_mac_port_get_caps(str
+@@ -2775,19 +2778,24 @@ static void mt7531_mac_port_get_caps(str
  	struct mt7530_priv *priv = ds->priv;
  
  	switch (port) {
@@ -92,7 +92,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		__set_bit(PHY_INTERFACE_MODE_SGMII,
  			  config->supported_interfaces);
  		__set_bit(PHY_INTERFACE_MODE_1000BASEX,
-@@ -2810,11 +2818,13 @@ static void mt7988_mac_port_get_caps(str
+@@ -2806,11 +2814,13 @@ static void mt7988_mac_port_get_caps(str
  	phy_interface_zero(config->supported_interfaces);
  
  	switch (port) {
@@ -107,7 +107,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	case 6:
  		__set_bit(PHY_INTERFACE_MODE_INTERNAL,
  			  config->supported_interfaces);
-@@ -2978,12 +2988,12 @@ mt753x_phylink_mac_config(struct dsa_swi
+@@ -2974,12 +2984,12 @@ mt753x_phylink_mac_config(struct dsa_swi
  	u32 mcr_cur, mcr_new;
  
  	switch (port) {
@@ -122,7 +122,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		if (priv->p5_interface == state->interface)
  			break;
  
-@@ -2993,7 +3003,7 @@ mt753x_phylink_mac_config(struct dsa_swi
+@@ -2989,7 +2999,7 @@ mt753x_phylink_mac_config(struct dsa_swi
  		if (priv->p5_intf_sel != P5_DISABLED)
  			priv->p5_interface = state->interface;
  		break;
diff --git a/target/linux/generic/backport-6.6/790-15-v6.9-net-dsa-mt7530-call-port-6-setup-from-mt7530_mac_con.patch b/target/linux/generic/backport-6.6/790-15-v6.9-net-dsa-mt7530-call-port-6-setup-from-mt7530_mac_con.patch
index 330a92e7d4d8ae..2180436abac0a9 100644
--- a/target/linux/generic/backport-6.6/790-15-v6.9-net-dsa-mt7530-call-port-6-setup-from-mt7530_mac_con.patch
+++ b/target/linux/generic/backport-6.6/790-15-v6.9-net-dsa-mt7530-call-port-6-setup-from-mt7530_mac_con.patch
@@ -79,7 +79,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	return 0;
  }
  
-@@ -2826,11 +2830,10 @@ mt7530_mac_config(struct dsa_switch *ds,
+@@ -2822,11 +2826,10 @@ mt7530_mac_config(struct dsa_switch *ds,
  {
  	struct mt7530_priv *priv = ds->priv;
  
diff --git a/target/linux/generic/backport-6.6/790-16-v6.9-net-dsa-mt7530-remove-pad_setup-function-pointer.patch b/target/linux/generic/backport-6.6/790-16-v6.9-net-dsa-mt7530-remove-pad_setup-function-pointer.patch
index dcf1afa16e8116..c7e2af8ca89617 100644
--- a/target/linux/generic/backport-6.6/790-16-v6.9-net-dsa-mt7530-remove-pad_setup-function-pointer.patch
+++ b/target/linux/generic/backport-6.6/790-16-v6.9-net-dsa-mt7530-remove-pad_setup-function-pointer.patch
@@ -47,7 +47,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  static void
  mt7531_pll_setup(struct mt7530_priv *priv)
  {
-@@ -2817,14 +2805,6 @@ static void mt7988_mac_port_get_caps(str
+@@ -2813,14 +2801,6 @@ static void mt7988_mac_port_get_caps(str
  }
  
  static int
@@ -62,7 +62,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  mt7530_mac_config(struct dsa_switch *ds, int port, unsigned int mode,
  		  phy_interface_t interface)
  {
-@@ -2989,8 +2969,6 @@ mt753x_phylink_mac_config(struct dsa_swi
+@@ -2985,8 +2965,6 @@ mt753x_phylink_mac_config(struct dsa_swi
  		if (priv->p6_interface == state->interface)
  			break;
  
@@ -71,7 +71,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		if (mt753x_mac_config(ds, port, mode, state) < 0)
  			goto unsupported;
  
-@@ -3307,11 +3285,6 @@ mt753x_conduit_state_change(struct dsa_s
+@@ -3303,11 +3281,6 @@ mt753x_conduit_state_change(struct dsa_s
  	mt7530_rmw(priv, MT7530_MFC, CPU_EN | CPU_PORT_MASK, val);
  }
  
@@ -83,7 +83,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  static int mt7988_setup(struct dsa_switch *ds)
  {
  	struct mt7530_priv *priv = ds->priv;
-@@ -3375,7 +3348,6 @@ const struct mt753x_info mt753x_table[]
+@@ -3371,7 +3344,6 @@ const struct mt753x_info mt753x_table[]
  		.phy_write_c22 = mt7530_phy_write_c22,
  		.phy_read_c45 = mt7530_phy_read_c45,
  		.phy_write_c45 = mt7530_phy_write_c45,
@@ -91,7 +91,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		.mac_port_get_caps = mt7530_mac_port_get_caps,
  		.mac_port_config = mt7530_mac_config,
  	},
-@@ -3387,7 +3359,6 @@ const struct mt753x_info mt753x_table[]
+@@ -3383,7 +3355,6 @@ const struct mt753x_info mt753x_table[]
  		.phy_write_c22 = mt7530_phy_write_c22,
  		.phy_read_c45 = mt7530_phy_read_c45,
  		.phy_write_c45 = mt7530_phy_write_c45,
@@ -99,7 +99,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		.mac_port_get_caps = mt7530_mac_port_get_caps,
  		.mac_port_config = mt7530_mac_config,
  	},
-@@ -3399,7 +3370,6 @@ const struct mt753x_info mt753x_table[]
+@@ -3395,7 +3366,6 @@ const struct mt753x_info mt753x_table[]
  		.phy_write_c22 = mt7531_ind_c22_phy_write,
  		.phy_read_c45 = mt7531_ind_c45_phy_read,
  		.phy_write_c45 = mt7531_ind_c45_phy_write,
@@ -107,7 +107,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		.cpu_port_config = mt7531_cpu_port_config,
  		.mac_port_get_caps = mt7531_mac_port_get_caps,
  		.mac_port_config = mt7531_mac_config,
-@@ -3412,7 +3382,6 @@ const struct mt753x_info mt753x_table[]
+@@ -3408,7 +3378,6 @@ const struct mt753x_info mt753x_table[]
  		.phy_write_c22 = mt7531_ind_c22_phy_write,
  		.phy_read_c45 = mt7531_ind_c45_phy_read,
  		.phy_write_c45 = mt7531_ind_c45_phy_write,
@@ -115,7 +115,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		.cpu_port_config = mt7988_cpu_port_config,
  		.mac_port_get_caps = mt7988_mac_port_get_caps,
  		.mac_port_config = mt7988_mac_config,
-@@ -3442,9 +3411,8 @@ mt7530_probe_common(struct mt7530_priv *
+@@ -3438,9 +3407,8 @@ mt7530_probe_common(struct mt7530_priv *
  	/* Sanity check if these required device operations are filled
  	 * properly.
  	 */
diff --git a/target/linux/generic/backport-6.6/790-17-v6.9-net-dsa-mt7530-correct-port-capabilities-of-MT7988.patch b/target/linux/generic/backport-6.6/790-17-v6.9-net-dsa-mt7530-correct-port-capabilities-of-MT7988.patch
index f6c2919eaf6e8e..b833522deb5b42 100644
--- a/target/linux/generic/backport-6.6/790-17-v6.9-net-dsa-mt7530-correct-port-capabilities-of-MT7988.patch
+++ b/target/linux/generic/backport-6.6/790-17-v6.9-net-dsa-mt7530-correct-port-capabilities-of-MT7988.patch
@@ -25,7 +25,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2790,7 +2790,7 @@ static void mt7988_mac_port_get_caps(str
+@@ -2786,7 +2786,7 @@ static void mt7988_mac_port_get_caps(str
  
  	switch (port) {
  	/* Ports which are connected to switch PHYs. There is no MII pinout. */
diff --git a/target/linux/generic/backport-6.6/790-18-v6.9-net-dsa-mt7530-do-not-clear-config-supported_interfa.patch b/target/linux/generic/backport-6.6/790-18-v6.9-net-dsa-mt7530-do-not-clear-config-supported_interfa.patch
index 66a9158507f23a..2b12c3bc71f013 100644
--- a/target/linux/generic/backport-6.6/790-18-v6.9-net-dsa-mt7530-do-not-clear-config-supported_interfa.patch
+++ b/target/linux/generic/backport-6.6/790-18-v6.9-net-dsa-mt7530-do-not-clear-config-supported_interfa.patch
@@ -27,7 +27,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2786,8 +2786,6 @@ static void mt7531_mac_port_get_caps(str
+@@ -2782,8 +2782,6 @@ static void mt7531_mac_port_get_caps(str
  static void mt7988_mac_port_get_caps(struct dsa_switch *ds, int port,
  				     struct phylink_config *config)
  {
diff --git a/target/linux/generic/backport-6.6/790-19-v6.9-net-dsa-mt7530-remove-.mac_port_config-for-MT7988-an.patch b/target/linux/generic/backport-6.6/790-19-v6.9-net-dsa-mt7530-remove-.mac_port_config-for-MT7988-an.patch
index abc1108116477b..f38c0e80e8089c 100644
--- a/target/linux/generic/backport-6.6/790-19-v6.9-net-dsa-mt7530-remove-.mac_port_config-for-MT7988-an.patch
+++ b/target/linux/generic/backport-6.6/790-19-v6.9-net-dsa-mt7530-remove-.mac_port_config-for-MT7988-an.patch
@@ -33,7 +33,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2869,17 +2869,6 @@ static bool mt753x_is_mac_port(u32 port)
+@@ -2865,17 +2865,6 @@ static bool mt753x_is_mac_port(u32 port)
  }
  
  static int
@@ -51,7 +51,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  mt7531_mac_config(struct dsa_switch *ds, int port, unsigned int mode,
  		  phy_interface_t interface)
  {
-@@ -2919,6 +2908,9 @@ mt753x_mac_config(struct dsa_switch *ds,
+@@ -2915,6 +2904,9 @@ mt753x_mac_config(struct dsa_switch *ds,
  {
  	struct mt7530_priv *priv = ds->priv;
  
@@ -61,7 +61,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	return priv->info->mac_port_config(ds, port, mode, state->interface);
  }
  
-@@ -3382,7 +3374,6 @@ const struct mt753x_info mt753x_table[]
+@@ -3378,7 +3370,6 @@ const struct mt753x_info mt753x_table[]
  		.phy_write_c45 = mt7531_ind_c45_phy_write,
  		.cpu_port_config = mt7988_cpu_port_config,
  		.mac_port_get_caps = mt7988_mac_port_get_caps,
@@ -69,7 +69,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	},
  };
  EXPORT_SYMBOL_GPL(mt753x_table);
-@@ -3410,8 +3401,7 @@ mt7530_probe_common(struct mt7530_priv *
+@@ -3406,8 +3397,7 @@ mt7530_probe_common(struct mt7530_priv *
  	 * properly.
  	 */
  	if (!priv->info->sw_setup || !priv->info->phy_read_c22 ||
diff --git a/target/linux/generic/backport-6.6/790-21-v6.9-net-dsa-mt7530-do-not-use-SW_PHY_RST-to-reset-MT7531.patch b/target/linux/generic/backport-6.6/790-21-v6.9-net-dsa-mt7530-do-not-use-SW_PHY_RST-to-reset-MT7531.patch
index 735775d97a56b9..95bf3caaa8c757 100644
--- a/target/linux/generic/backport-6.6/790-21-v6.9-net-dsa-mt7530-do-not-use-SW_PHY_RST-to-reset-MT7531.patch
+++ b/target/linux/generic/backport-6.6/790-21-v6.9-net-dsa-mt7530-do-not-use-SW_PHY_RST-to-reset-MT7531.patch
@@ -22,7 +22,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2657,14 +2657,12 @@ mt7531_setup(struct dsa_switch *ds)
+@@ -2661,14 +2661,12 @@ mt7531_setup(struct dsa_switch *ds)
  	val = mt7530_read(priv, MT7531_TOP_SIG_SR);
  	priv->p5_sgmii = !!(val & PAD_DUAL_SGMII_EN);
  
diff --git a/target/linux/generic/backport-6.6/790-22-v6.9-net-dsa-mt7530-get-rid-of-useless-error-returns-on-p.patch b/target/linux/generic/backport-6.6/790-22-v6.9-net-dsa-mt7530-get-rid-of-useless-error-returns-on-p.patch
index c9159a1c680bf6..e037c9883e80af 100644
--- a/target/linux/generic/backport-6.6/790-22-v6.9-net-dsa-mt7530-get-rid-of-useless-error-returns-on-p.patch
+++ b/target/linux/generic/backport-6.6/790-22-v6.9-net-dsa-mt7530-get-rid-of-useless-error-returns-on-p.patch
@@ -36,7 +36,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2800,7 +2800,7 @@ static void mt7988_mac_port_get_caps(str
+@@ -2796,7 +2796,7 @@ static void mt7988_mac_port_get_caps(str
  	}
  }
  
@@ -45,7 +45,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  mt7530_mac_config(struct dsa_switch *ds, int port, unsigned int mode,
  		  phy_interface_t interface)
  {
-@@ -2810,22 +2810,14 @@ mt7530_mac_config(struct dsa_switch *ds,
+@@ -2806,22 +2806,14 @@ mt7530_mac_config(struct dsa_switch *ds,
  		mt7530_setup_port5(priv->ds, interface);
  	else if (port == 6)
  		mt7530_setup_port6(priv->ds, interface);
@@ -71,7 +71,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	val = mt7530_read(priv, MT7531_CLKGEN_CTRL);
  	val |= GP_CLK_EN;
  	val &= ~GP_MODE_MASK;
-@@ -2853,20 +2845,14 @@ static int mt7531_rgmii_setup(struct mt7
+@@ -2849,20 +2841,14 @@ static int mt7531_rgmii_setup(struct mt7
  		case PHY_INTERFACE_MODE_RGMII_ID:
  			break;
  		default:
@@ -95,7 +95,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  mt7531_mac_config(struct dsa_switch *ds, int port, unsigned int mode,
  		  phy_interface_t interface)
  {
-@@ -2874,42 +2860,21 @@ mt7531_mac_config(struct dsa_switch *ds,
+@@ -2870,42 +2856,21 @@ mt7531_mac_config(struct dsa_switch *ds,
  	struct phy_device *phydev;
  	struct dsa_port *dp;
  
@@ -143,7 +143,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  }
  
  static struct phylink_pcs *
-@@ -2938,17 +2903,11 @@ mt753x_phylink_mac_config(struct dsa_swi
+@@ -2934,17 +2899,11 @@ mt753x_phylink_mac_config(struct dsa_swi
  	u32 mcr_cur, mcr_new;
  
  	switch (port) {
@@ -162,7 +162,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  
  		if (priv->p5_intf_sel != P5_DISABLED)
  			priv->p5_interface = state->interface;
-@@ -2957,16 +2916,10 @@ mt753x_phylink_mac_config(struct dsa_swi
+@@ -2953,16 +2912,10 @@ mt753x_phylink_mac_config(struct dsa_swi
  		if (priv->p6_interface == state->interface)
  			break;
  
@@ -180,7 +180,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	}
  
  	mcr_cur = mt7530_read(priv, MT7530_PMCR_P(port));
-@@ -3049,7 +3002,6 @@ mt7531_cpu_port_config(struct dsa_switch
+@@ -3045,7 +2998,6 @@ mt7531_cpu_port_config(struct dsa_switch
  	struct mt7530_priv *priv = ds->priv;
  	phy_interface_t interface;
  	int speed;
@@ -188,7 +188,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  
  	switch (port) {
  	case 5:
-@@ -3074,9 +3026,8 @@ mt7531_cpu_port_config(struct dsa_switch
+@@ -3070,9 +3022,8 @@ mt7531_cpu_port_config(struct dsa_switch
  	else
  		speed = SPEED_1000;
  
diff --git a/target/linux/generic/backport-6.6/790-23-v6.9-net-dsa-mt7530-get-rid-of-priv-info-cpu_port_config.patch b/target/linux/generic/backport-6.6/790-23-v6.9-net-dsa-mt7530-get-rid-of-priv-info-cpu_port_config.patch
index c52cb0d5ea0b3c..eef308d787ec4f 100644
--- a/target/linux/generic/backport-6.6/790-23-v6.9-net-dsa-mt7530-get-rid-of-priv-info-cpu_port_config.patch
+++ b/target/linux/generic/backport-6.6/790-23-v6.9-net-dsa-mt7530-get-rid-of-priv-info-cpu_port_config.patch
@@ -106,7 +106,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		} else {
  			mt7530_port_disable(ds, i);
  
-@@ -2586,9 +2572,7 @@ mt7531_setup_common(struct dsa_switch *d
+@@ -2589,9 +2575,7 @@ mt7531_setup_common(struct dsa_switch *d
  		mt7530_set(priv, MT7531_DBG_CNT(i), MT7531_DIS_CLR);
  
  		if (dsa_is_cpu_port(ds, i)) {
@@ -117,7 +117,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		} else {
  			mt7530_port_disable(ds, i);
  
-@@ -2680,10 +2664,6 @@ mt7531_setup(struct dsa_switch *ds)
+@@ -2684,10 +2668,6 @@ mt7531_setup(struct dsa_switch *ds)
  	mt7530_rmw(priv, MT7531_GPIO_MODE0, MT7531_GPIO0_MASK,
  		   MT7531_GPIO0_INTERRUPT);
  
@@ -128,7 +128,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	/* Enable Energy-Efficient Ethernet (EEE) and PHY core PLL, since
  	 * phy_device has not yet been created provided for
  	 * phy_[read,write]_mmd_indirect is called, we provide our own
-@@ -2902,26 +2882,9 @@ mt753x_phylink_mac_config(struct dsa_swi
+@@ -2898,26 +2878,9 @@ mt753x_phylink_mac_config(struct dsa_swi
  	struct mt7530_priv *priv = ds->priv;
  	u32 mcr_cur, mcr_new;
  
@@ -156,7 +156,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	mcr_cur = mt7530_read(priv, MT7530_PMCR_P(port));
  	mcr_new = mcr_cur;
  	mcr_new &= ~PMCR_LINK_SETTINGS_MASK;
-@@ -2957,17 +2920,10 @@ static void mt753x_phylink_mac_link_up(s
+@@ -2953,17 +2916,10 @@ static void mt753x_phylink_mac_link_up(s
  
  	mcr = PMCR_RX_EN | PMCR_TX_EN | PMCR_FORCE_LNK;
  
@@ -176,7 +176,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		mcr |= PMCR_FORCE_SPEED_1000;
  		break;
  	case SPEED_100:
-@@ -2985,6 +2941,7 @@ static void mt753x_phylink_mac_link_up(s
+@@ -2981,6 +2937,7 @@ static void mt753x_phylink_mac_link_up(s
  	if (mode == MLO_AN_PHY && phydev && phy_init_eee(phydev, false) >= 0) {
  		switch (speed) {
  		case SPEED_1000:
@@ -184,7 +184,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  			mcr |= PMCR_FORCE_EEE1G;
  			break;
  		case SPEED_100:
-@@ -2996,61 +2953,6 @@ static void mt753x_phylink_mac_link_up(s
+@@ -2992,61 +2949,6 @@ static void mt753x_phylink_mac_link_up(s
  	mt7530_set(priv, MT7530_PMCR_P(port), mcr);
  }
  
@@ -246,7 +246,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  static void mt753x_phylink_get_caps(struct dsa_switch *ds, int port,
  				    struct phylink_config *config)
  {
-@@ -3309,7 +3211,6 @@ const struct mt753x_info mt753x_table[]
+@@ -3305,7 +3207,6 @@ const struct mt753x_info mt753x_table[]
  		.phy_write_c22 = mt7531_ind_c22_phy_write,
  		.phy_read_c45 = mt7531_ind_c45_phy_read,
  		.phy_write_c45 = mt7531_ind_c45_phy_write,
@@ -254,7 +254,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		.mac_port_get_caps = mt7531_mac_port_get_caps,
  		.mac_port_config = mt7531_mac_config,
  	},
-@@ -3321,7 +3222,6 @@ const struct mt753x_info mt753x_table[]
+@@ -3317,7 +3218,6 @@ const struct mt753x_info mt753x_table[]
  		.phy_write_c22 = mt7531_ind_c22_phy_write,
  		.phy_read_c45 = mt7531_ind_c45_phy_read,
  		.phy_write_c45 = mt7531_ind_c45_phy_write,
diff --git a/target/linux/generic/backport-6.6/790-24-v6.9-net-dsa-mt7530-get-rid-of-mt753x_mac_config.patch b/target/linux/generic/backport-6.6/790-24-v6.9-net-dsa-mt7530-get-rid-of-mt753x_mac_config.patch
index 7fe77c506e7f09..47b77fca529417 100644
--- a/target/linux/generic/backport-6.6/790-24-v6.9-net-dsa-mt7530-get-rid-of-mt753x_mac_config.patch
+++ b/target/linux/generic/backport-6.6/790-24-v6.9-net-dsa-mt7530-get-rid-of-mt753x_mac_config.patch
@@ -18,7 +18,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2847,16 +2847,6 @@ mt7531_mac_config(struct dsa_switch *ds,
+@@ -2843,16 +2843,6 @@ mt7531_mac_config(struct dsa_switch *ds,
  	}
  }
  
@@ -35,7 +35,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  static struct phylink_pcs *
  mt753x_phylink_mac_select_pcs(struct dsa_switch *ds, int port,
  			      phy_interface_t interface)
-@@ -2882,8 +2872,8 @@ mt753x_phylink_mac_config(struct dsa_swi
+@@ -2878,8 +2868,8 @@ mt753x_phylink_mac_config(struct dsa_swi
  	struct mt7530_priv *priv = ds->priv;
  	u32 mcr_cur, mcr_new;
  
diff --git a/target/linux/generic/backport-6.6/790-25-v6.9-net-dsa-mt7530-put-initialising-PCS-devices-code-bac.patch b/target/linux/generic/backport-6.6/790-25-v6.9-net-dsa-mt7530-put-initialising-PCS-devices-code-bac.patch
index bd5c9b97720715..84b6430937f9bb 100644
--- a/target/linux/generic/backport-6.6/790-25-v6.9-net-dsa-mt7530-put-initialising-PCS-devices-code-bac.patch
+++ b/target/linux/generic/backport-6.6/790-25-v6.9-net-dsa-mt7530-put-initialising-PCS-devices-code-bac.patch
@@ -20,7 +20,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -3025,17 +3025,9 @@ static int
+@@ -3021,17 +3021,9 @@ static int
  mt753x_setup(struct dsa_switch *ds)
  {
  	struct mt7530_priv *priv = ds->priv;
@@ -40,7 +40,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	if (ret)
  		return ret;
  
-@@ -3047,6 +3039,14 @@ mt753x_setup(struct dsa_switch *ds)
+@@ -3043,6 +3035,14 @@ mt753x_setup(struct dsa_switch *ds)
  	if (ret && priv->irq)
  		mt7530_free_irq_common(priv);
  
diff --git a/target/linux/generic/backport-6.6/790-26-v6.9-net-dsa-mt7530-sort-link-settings-ops-and-force-link.patch b/target/linux/generic/backport-6.6/790-26-v6.9-net-dsa-mt7530-sort-link-settings-ops-and-force-link.patch
index 348c35e1ac9901..7632a5a9f0ea52 100644
--- a/target/linux/generic/backport-6.6/790-26-v6.9-net-dsa-mt7530-sort-link-settings-ops-and-force-link.patch
+++ b/target/linux/generic/backport-6.6/790-26-v6.9-net-dsa-mt7530-sort-link-settings-ops-and-force-link.patch
@@ -53,7 +53,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		/* Disable forwarding by default on all ports */
  		mt7530_rmw(priv, MT7530_PCR_P(i), PCR_MATRIX_MASK,
  			   PCR_MATRIX_CLR);
-@@ -2562,6 +2566,12 @@ mt7531_setup_common(struct dsa_switch *d
+@@ -2565,6 +2569,12 @@ mt7531_setup_common(struct dsa_switch *d
  		     UNU_FFP_MASK);
  
  	for (i = 0; i < MT7530_NUM_PORTS; i++) {
diff --git a/target/linux/generic/backport-6.6/790-27-v6.9-net-dsa-mt7530-simplify-link-operations.patch b/target/linux/generic/backport-6.6/790-27-v6.9-net-dsa-mt7530-simplify-link-operations.patch
index 54f5a59a64aa38..51ccc693514124 100644
--- a/target/linux/generic/backport-6.6/790-27-v6.9-net-dsa-mt7530-simplify-link-operations.patch
+++ b/target/linux/generic/backport-6.6/790-27-v6.9-net-dsa-mt7530-simplify-link-operations.patch
@@ -45,7 +45,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2880,23 +2880,13 @@ mt753x_phylink_mac_config(struct dsa_swi
+@@ -2876,23 +2876,13 @@ mt753x_phylink_mac_config(struct dsa_swi
  			  const struct phylink_link_state *state)
  {
  	struct mt7530_priv *priv = ds->priv;
diff --git a/target/linux/generic/backport-6.6/790-33-v6.10-net-dsa-mt7530-provide-own-phylink-MAC-operations.patch b/target/linux/generic/backport-6.6/790-33-v6.10-net-dsa-mt7530-provide-own-phylink-MAC-operations.patch
index 5eade735ec0435..15d876d29c797d 100644
--- a/target/linux/generic/backport-6.6/790-33-v6.10-net-dsa-mt7530-provide-own-phylink-MAC-operations.patch
+++ b/target/linux/generic/backport-6.6/790-33-v6.10-net-dsa-mt7530-provide-own-phylink-MAC-operations.patch
@@ -19,7 +19,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2858,28 +2858,34 @@ mt7531_mac_config(struct dsa_switch *ds,
+@@ -2854,28 +2854,34 @@ mt7531_mac_config(struct dsa_switch *ds,
  }
  
  static struct phylink_pcs *
@@ -60,7 +60,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  
  	if ((port == 5 || port == 6) && priv->info->mac_port_config)
  		priv->info->mac_port_config(ds, port, mode, state->interface);
-@@ -2889,23 +2895,25 @@ mt753x_phylink_mac_config(struct dsa_swi
+@@ -2885,23 +2891,25 @@ mt753x_phylink_mac_config(struct dsa_swi
  		mt7530_set(priv, MT7530_PMCR_P(port), PMCR_EXT_PHY);
  }
  
@@ -92,7 +92,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  	u32 mcr;
  
  	mcr = PMCR_RX_EN | PMCR_TX_EN | PMCR_FORCE_LNK;
-@@ -2940,7 +2948,7 @@ static void mt753x_phylink_mac_link_up(s
+@@ -2936,7 +2944,7 @@ static void mt753x_phylink_mac_link_up(s
  		}
  	}
  
@@ -101,7 +101,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  }
  
  static void mt753x_phylink_get_caps(struct dsa_switch *ds, int port,
-@@ -3160,16 +3168,19 @@ const struct dsa_switch_ops mt7530_switc
+@@ -3156,16 +3164,19 @@ const struct dsa_switch_ops mt7530_switc
  	.port_mirror_add	= mt753x_port_mirror_add,
  	.port_mirror_del	= mt753x_port_mirror_del,
  	.phylink_get_caps	= mt753x_phylink_get_caps,
@@ -125,7 +125,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  const struct mt753x_info mt753x_table[] = {
  	[ID_MT7621] = {
  		.id = ID_MT7621,
-@@ -3247,6 +3258,7 @@ mt7530_probe_common(struct mt7530_priv *
+@@ -3243,6 +3254,7 @@ mt7530_probe_common(struct mt7530_priv *
  	priv->dev = dev;
  	priv->ds->priv = priv;
  	priv->ds->ops = &mt7530_switch_ops;
diff --git a/target/linux/generic/backport-6.6/790-36-v6.10-net-dsa-mt7530-mdio-read-PHY-address-of-switch-from-.patch b/target/linux/generic/backport-6.6/790-36-v6.10-net-dsa-mt7530-mdio-read-PHY-address-of-switch-from-.patch
index a6cbb0fc6b88ab..896bc9914b2680 100644
--- a/target/linux/generic/backport-6.6/790-36-v6.10-net-dsa-mt7530-mdio-read-PHY-address-of-switch-from-.patch
+++ b/target/linux/generic/backport-6.6/790-36-v6.10-net-dsa-mt7530-mdio-read-PHY-address-of-switch-from-.patch
@@ -184,7 +184,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  err:
  	if (ret < 0)
  		dev_err(&bus->dev,
-@@ -2679,16 +2687,19 @@ mt7531_setup(struct dsa_switch *ds)
+@@ -2683,16 +2691,19 @@ mt7531_setup(struct dsa_switch *ds)
  	 * phy_[read,write]_mmd_indirect is called, we provide our own
  	 * mt7531_ind_mmd_phy_[read,write] to complete this function.
  	 */
diff --git a/target/linux/generic/backport-6.6/790-39-v6.10-net-dsa-mt7530-refactor-MT7530_PMCR_P.patch b/target/linux/generic/backport-6.6/790-39-v6.10-net-dsa-mt7530-refactor-MT7530_PMCR_P.patch
index 89fad45dd5d7a0..33f9fc182f696c 100644
--- a/target/linux/generic/backport-6.6/790-39-v6.10-net-dsa-mt7530-refactor-MT7530_PMCR_P.patch
+++ b/target/linux/generic/backport-6.6/790-39-v6.10-net-dsa-mt7530-refactor-MT7530_PMCR_P.patch
@@ -53,7 +53,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
  
  		/* Disable forwarding by default on all ports */
  		mt7530_rmw(priv, MT7530_PCR_P(i), PCR_MATRIX_MASK,
-@@ -2555,8 +2555,8 @@ mt7531_setup_common(struct dsa_switch *d
+@@ -2558,8 +2558,8 @@ mt7531_setup_common(struct dsa_switch *d
  		/* Clear link settings and enable force mode to force link down
  		 * on all ports until they're enabled later.
  		 */
@@ -64,7 +64,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
  
  		/* Disable forwarding by default on all ports */
  		mt7530_rmw(priv, MT7530_PCR_P(i), PCR_MATRIX_MASK,
-@@ -2639,7 +2639,7 @@ mt7531_setup(struct dsa_switch *ds)
+@@ -2643,7 +2643,7 @@ mt7531_setup(struct dsa_switch *ds)
  
  	/* Force link down on all ports before internal reset */
  	for (i = 0; i < MT7530_NUM_PORTS; i++)
@@ -73,7 +73,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
  
  	/* Reset the switch through internal reset */
  	mt7530_write(priv, MT7530_SYS_CTRL, SYS_CTRL_SW_RST | SYS_CTRL_REG_RST);
-@@ -2881,7 +2881,7 @@ mt753x_phylink_mac_config(struct phylink
+@@ -2877,7 +2877,7 @@ mt753x_phylink_mac_config(struct phylink
  
  	/* Are we connected to external phy */
  	if (port == 5 && dsa_is_user_port(ds, 5))
@@ -82,7 +82,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
  }
  
  static void mt753x_phylink_mac_link_down(struct phylink_config *config,
-@@ -2891,7 +2891,7 @@ static void mt753x_phylink_mac_link_down
+@@ -2887,7 +2887,7 @@ static void mt753x_phylink_mac_link_down
  	struct dsa_port *dp = dsa_phylink_to_port(config);
  	struct mt7530_priv *priv = dp->ds->priv;
  
@@ -91,7 +91,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
  }
  
  static void mt753x_phylink_mac_link_up(struct phylink_config *config,
-@@ -2905,7 +2905,7 @@ static void mt753x_phylink_mac_link_up(s
+@@ -2901,7 +2901,7 @@ static void mt753x_phylink_mac_link_up(s
  	struct mt7530_priv *priv = dp->ds->priv;
  	u32 mcr;
  
@@ -100,7 +100,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
  
  	switch (speed) {
  	case SPEED_1000:
-@@ -2920,9 +2920,9 @@ static void mt753x_phylink_mac_link_up(s
+@@ -2916,9 +2916,9 @@ static void mt753x_phylink_mac_link_up(s
  	if (duplex == DUPLEX_FULL) {
  		mcr |= PMCR_FORCE_FDX;
  		if (tx_pause)
@@ -112,7 +112,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
  	}
  
  	if (mode == MLO_AN_PHY && phydev && phy_init_eee(phydev, false) >= 0) {
-@@ -2937,7 +2937,7 @@ static void mt753x_phylink_mac_link_up(s
+@@ -2933,7 +2933,7 @@ static void mt753x_phylink_mac_link_up(s
  		}
  	}
  
diff --git a/target/linux/generic/backport-6.6/790-40-v6.10-net-dsa-mt7530-rename-p5_intf_sel-and-use-only-for-M.patch b/target/linux/generic/backport-6.6/790-40-v6.10-net-dsa-mt7530-rename-p5_intf_sel-and-use-only-for-M.patch
index 601171a5949fc0..a2c191c56e7ed9 100644
--- a/target/linux/generic/backport-6.6/790-40-v6.10-net-dsa-mt7530-rename-p5_intf_sel-and-use-only-for-M.patch
+++ b/target/linux/generic/backport-6.6/790-40-v6.10-net-dsa-mt7530-rename-p5_intf_sel-and-use-only-for-M.patch
@@ -135,7 +135,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
  			mt7530_setup_port5(ds, interface);
  	}
  
-@@ -2654,9 +2647,6 @@ mt7531_setup(struct dsa_switch *ds)
+@@ -2658,9 +2651,6 @@ mt7531_setup(struct dsa_switch *ds)
  			   MT7531_EXT_P_MDIO_12);
  	}
  
diff --git a/target/linux/generic/backport-6.6/790-42-v6.10-net-dsa-mt7530-refactor-MT7530_MFC-and-MT7531_CFC-ad.patch b/target/linux/generic/backport-6.6/790-42-v6.10-net-dsa-mt7530-refactor-MT7530_MFC-and-MT7531_CFC-ad.patch
index a5d293b509516a..542c8c84ce00e0 100644
--- a/target/linux/generic/backport-6.6/790-42-v6.10-net-dsa-mt7530-refactor-MT7530_MFC-and-MT7531_CFC-ad.patch
+++ b/target/linux/generic/backport-6.6/790-42-v6.10-net-dsa-mt7530-refactor-MT7530_MFC-and-MT7531_CFC-ad.patch
@@ -92,7 +92,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
  	mt7530_write(priv, MT753X_MIRROR_REG(priv->id), val);
  
  	val = mt7530_read(priv, MT7530_PCR_P(port));
-@@ -2533,7 +2519,7 @@ mt7531_setup_common(struct dsa_switch *d
+@@ -2536,7 +2522,7 @@ mt7531_setup_common(struct dsa_switch *d
  	mt7530_mib_reset(ds);
  
  	/* Disable flooding on all ports */
@@ -101,7 +101,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
  		     UNU_FFP_MASK);
  
  	for (i = 0; i < MT7530_NUM_PORTS; i++) {
-@@ -3089,10 +3075,12 @@ mt753x_conduit_state_change(struct dsa_s
+@@ -3085,10 +3071,12 @@ mt753x_conduit_state_change(struct dsa_s
  	else
  		priv->active_cpu_ports &= ~mask;
  
diff --git a/target/linux/generic/backport-6.6/790-43-v6.10-net-dsa-mt7530-refactor-MT7530_HWTRAP-and-MT7530_MHW.patch b/target/linux/generic/backport-6.6/790-43-v6.10-net-dsa-mt7530-refactor-MT7530_HWTRAP-and-MT7530_MHW.patch
index 1f66575f02c149..4b1e18bccd5227 100644
--- a/target/linux/generic/backport-6.6/790-43-v6.10-net-dsa-mt7530-refactor-MT7530_HWTRAP-and-MT7530_MHW.patch
+++ b/target/linux/generic/backport-6.6/790-43-v6.10-net-dsa-mt7530-refactor-MT7530_HWTRAP-and-MT7530_MHW.patch
@@ -189,7 +189,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
  		mt7530_pll_setup(priv);
  
  	mt753x_trap_frames(priv);
-@@ -2586,7 +2587,7 @@ mt7531_setup(struct dsa_switch *ds)
+@@ -2590,7 +2591,7 @@ mt7531_setup(struct dsa_switch *ds)
  	}
  
  	/* Waiting for MT7530 got to stable */
diff --git a/target/linux/generic/backport-6.6/790-45-v6.10-net-dsa-mt7530-return-mt7530_setup_mdio-mt7531_setup.patch b/target/linux/generic/backport-6.6/790-45-v6.10-net-dsa-mt7530-return-mt7530_setup_mdio-mt7531_setup.patch
index 2eaa77c8cf6a62..1e2b965c1c8f89 100644
--- a/target/linux/generic/backport-6.6/790-45-v6.10-net-dsa-mt7530-return-mt7530_setup_mdio-mt7531_setup.patch
+++ b/target/linux/generic/backport-6.6/790-45-v6.10-net-dsa-mt7530-return-mt7530_setup_mdio-mt7531_setup.patch
@@ -17,7 +17,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2667,7 +2667,9 @@ mt7531_setup(struct dsa_switch *ds)
+@@ -2671,7 +2671,9 @@ mt7531_setup(struct dsa_switch *ds)
  					 0);
  	}
  
@@ -26,9 +26,9 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
 +	if (ret)
 +		return ret;
  
- 	/* Setup VLAN ID 0 for VLAN-unaware bridges */
- 	ret = mt7530_setup_vlan0(priv);
-@@ -3020,6 +3022,8 @@ mt753x_setup(struct dsa_switch *ds)
+ 	return 0;
+ }
+@@ -3016,6 +3018,8 @@ mt753x_setup(struct dsa_switch *ds)
  	ret = mt7530_setup_mdio(priv);
  	if (ret && priv->irq)
  		mt7530_free_irq_common(priv);
diff --git a/target/linux/generic/backport-6.6/790-46-v6.10-net-dsa-mt7530-define-MAC-speed-capabilities-per-swi.patch b/target/linux/generic/backport-6.6/790-46-v6.10-net-dsa-mt7530-define-MAC-speed-capabilities-per-swi.patch
index 9a592c759d69a0..b7c2edf4c3416e 100644
--- a/target/linux/generic/backport-6.6/790-46-v6.10-net-dsa-mt7530-define-MAC-speed-capabilities-per-swi.patch
+++ b/target/linux/generic/backport-6.6/790-46-v6.10-net-dsa-mt7530-define-MAC-speed-capabilities-per-swi.patch
@@ -24,7 +24,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2685,6 +2685,8 @@ mt7531_setup(struct dsa_switch *ds)
+@@ -2681,6 +2681,8 @@ mt7531_setup(struct dsa_switch *ds)
  static void mt7530_mac_port_get_caps(struct dsa_switch *ds, int port,
  				     struct phylink_config *config)
  {
@@ -33,7 +33,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
  	switch (port) {
  	/* Ports which are connected to switch PHYs. There is no MII pinout. */
  	case 0 ... 4:
-@@ -2716,6 +2718,8 @@ static void mt7531_mac_port_get_caps(str
+@@ -2712,6 +2714,8 @@ static void mt7531_mac_port_get_caps(str
  {
  	struct mt7530_priv *priv = ds->priv;
  
@@ -42,7 +42,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
  	switch (port) {
  	/* Ports which are connected to switch PHYs. There is no MII pinout. */
  	case 0 ... 4:
-@@ -2755,14 +2759,17 @@ static void mt7988_mac_port_get_caps(str
+@@ -2751,14 +2755,17 @@ static void mt7988_mac_port_get_caps(str
  	case 0 ... 3:
  		__set_bit(PHY_INTERFACE_MODE_INTERNAL,
  			  config->supported_interfaces);
@@ -62,7 +62,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
  	}
  }
  
-@@ -2932,9 +2939,7 @@ static void mt753x_phylink_get_caps(stru
+@@ -2928,9 +2935,7 @@ static void mt753x_phylink_get_caps(stru
  {
  	struct mt7530_priv *priv = ds->priv;
  
diff --git a/target/linux/generic/backport-6.6/790-47-v6.10-net-dsa-mt7530-get-rid-of-function-sanity-check.patch b/target/linux/generic/backport-6.6/790-47-v6.10-net-dsa-mt7530-get-rid-of-function-sanity-check.patch
index bc84ecb778d0ee..8a933f0066cf37 100644
--- a/target/linux/generic/backport-6.6/790-47-v6.10-net-dsa-mt7530-get-rid-of-function-sanity-check.patch
+++ b/target/linux/generic/backport-6.6/790-47-v6.10-net-dsa-mt7530-get-rid-of-function-sanity-check.patch
@@ -17,7 +17,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -3232,13 +3232,6 @@ mt7530_probe_common(struct mt7530_priv *
+@@ -3228,13 +3228,6 @@ mt7530_probe_common(struct mt7530_priv *
  	if (!priv->info)
  		return -EINVAL;
  
diff --git a/target/linux/generic/backport-6.6/790-48-v6.10-net-dsa-mt7530-refactor-MT7530_PMEEECR_P.patch b/target/linux/generic/backport-6.6/790-48-v6.10-net-dsa-mt7530-refactor-MT7530_PMEEECR_P.patch
index e75db9ba3040a7..50616f0524eb92 100644
--- a/target/linux/generic/backport-6.6/790-48-v6.10-net-dsa-mt7530-refactor-MT7530_PMEEECR_P.patch
+++ b/target/linux/generic/backport-6.6/790-48-v6.10-net-dsa-mt7530-refactor-MT7530_PMEEECR_P.patch
@@ -19,7 +19,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -3051,10 +3051,10 @@ static int mt753x_get_mac_eee(struct dsa
+@@ -3047,10 +3047,10 @@ static int mt753x_get_mac_eee(struct dsa
  			      struct ethtool_eee *e)
  {
  	struct mt7530_priv *priv = ds->priv;
@@ -32,7 +32,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
  
  	return 0;
  }
-@@ -3068,11 +3068,11 @@ static int mt753x_set_mac_eee(struct dsa
+@@ -3064,11 +3064,11 @@ static int mt753x_set_mac_eee(struct dsa
  	if (e->tx_lpi_timer > 0xFFF)
  		return -EINVAL;
  
diff --git a/target/linux/generic/backport-6.6/790-50-v6.10-net-dsa-mt7530-use-priv-ds-num_ports-instead-of-MT75.patch b/target/linux/generic/backport-6.6/790-50-v6.10-net-dsa-mt7530-use-priv-ds-num_ports-instead-of-MT75.patch
index f63d4d7705d6e6..4173bee9a0e853 100644
--- a/target/linux/generic/backport-6.6/790-50-v6.10-net-dsa-mt7530-use-priv-ds-num_ports-instead-of-MT75.patch
+++ b/target/linux/generic/backport-6.6/790-50-v6.10-net-dsa-mt7530-use-priv-ds-num_ports-instead-of-MT75.patch
@@ -37,7 +37,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
  		/* Clear link settings and enable force mode to force link down
  		 * on all ports until they're enabled later.
  		 */
-@@ -2539,7 +2539,7 @@ mt7531_setup_common(struct dsa_switch *d
+@@ -2542,7 +2542,7 @@ mt7531_setup_common(struct dsa_switch *d
  	mt7530_clear(priv, MT753X_MFC, BC_FFP_MASK | UNM_FFP_MASK |
  		     UNU_FFP_MASK);
  
@@ -46,7 +46,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
  		/* Clear link settings and enable force mode to force link down
  		 * on all ports until they're enabled later.
  		 */
-@@ -2626,7 +2626,7 @@ mt7531_setup(struct dsa_switch *ds)
+@@ -2630,7 +2630,7 @@ mt7531_setup(struct dsa_switch *ds)
  	priv->p5_sgmii = !!(val & PAD_DUAL_SGMII_EN);
  
  	/* Force link down on all ports before internal reset */
diff --git a/target/linux/generic/backport-6.6/790-51-v6.10-net-dsa-mt7530-do-not-pass-port-variable-to-mt7531_r.patch b/target/linux/generic/backport-6.6/790-51-v6.10-net-dsa-mt7530-do-not-pass-port-variable-to-mt7531_r.patch
index 9ba12b1269f1d2..5d2a815ccee3a1 100644
--- a/target/linux/generic/backport-6.6/790-51-v6.10-net-dsa-mt7530-do-not-pass-port-variable-to-mt7531_r.patch
+++ b/target/linux/generic/backport-6.6/790-51-v6.10-net-dsa-mt7530-do-not-pass-port-variable-to-mt7531_r.patch
@@ -17,7 +17,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2785,7 +2785,7 @@ mt7530_mac_config(struct dsa_switch *ds,
+@@ -2781,7 +2781,7 @@ mt7530_mac_config(struct dsa_switch *ds,
  		mt7530_setup_port6(priv->ds, interface);
  }
  
@@ -26,7 +26,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
  			       phy_interface_t interface,
  			       struct phy_device *phydev)
  {
-@@ -2836,7 +2836,7 @@ mt7531_mac_config(struct dsa_switch *ds,
+@@ -2832,7 +2832,7 @@ mt7531_mac_config(struct dsa_switch *ds,
  	if (phy_interface_mode_is_rgmii(interface)) {
  		dp = dsa_to_port(ds, port);
  		phydev = dp->slave->phydev;
diff --git a/target/linux/generic/backport-6.6/790-52-v6.10-net-dsa-mt7530-explain-exposing-MDIO-bus-of-MT7531AE.patch b/target/linux/generic/backport-6.6/790-52-v6.10-net-dsa-mt7530-explain-exposing-MDIO-bus-of-MT7531AE.patch
index 58c3e0bc3ce671..c6bc25837ffa40 100644
--- a/target/linux/generic/backport-6.6/790-52-v6.10-net-dsa-mt7530-explain-exposing-MDIO-bus-of-MT7531AE.patch
+++ b/target/linux/generic/backport-6.6/790-52-v6.10-net-dsa-mt7530-explain-exposing-MDIO-bus-of-MT7531AE.patch
@@ -19,7 +19,7 @@ Signed-off-by: Arınç ÜNAL <arinc.unal@arinc9.com>
 
 --- a/drivers/net/dsa/mt7530.c
 +++ b/drivers/net/dsa/mt7530.c
-@@ -2635,7 +2635,10 @@ mt7531_setup(struct dsa_switch *ds)
+@@ -2639,7 +2639,10 @@ mt7531_setup(struct dsa_switch *ds)
  	if (!priv->p5_sgmii) {
  		mt7531_pll_setup(priv);
  	} else {
diff --git a/target/linux/generic/backport-6.6/792-v6.16-igc-enable-HW-vlan-tag-insertion-stripping-by-defaul.patch b/target/linux/generic/backport-6.6/792-v6.16-igc-enable-HW-vlan-tag-insertion-stripping-by-defaul.patch
new file mode 100644
index 00000000000000..5be2e83ccea42a
--- /dev/null
+++ b/target/linux/generic/backport-6.6/792-v6.16-igc-enable-HW-vlan-tag-insertion-stripping-by-defaul.patch
@@ -0,0 +1,32 @@
+From 8cae5a0d91fea01d90ce7c1827e26934a22ca2fa Mon Sep 17 00:00:00 2001
+From: Rui Salvaterra <rsalvaterra@gmail.com>
+Date: Wed, 5 Mar 2025 11:53:56 +0000
+Subject: [PATCH] igc: enable HW vlan tag insertion/stripping by default
+
+This is enabled by default in other Intel drivers I've checked (e1000, e1000e,
+iavf, igb and ice). Fixes an out-of-the-box performance issue when running
+OpenWrt on typical mini-PCs with igc-supported Ethernet controllers and 802.1Q
+VLAN configurations, as ethtool isn't part of the default packages and sane
+defaults are expected.
+
+In my specific case, with an Intel N100-based machine with four I226-V Ethernet
+controllers, my upload performance increased from under 30 Mb/s to the expected
+~1 Gb/s.
+
+Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
+---
+ drivers/net/ethernet/intel/igc/igc_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/intel/igc/igc_main.c
++++ b/drivers/net/ethernet/intel/igc/igc_main.c
+@@ -6854,6 +6854,9 @@ static int igc_probe(struct pci_dev *pde
+ 	netdev->xdp_features = NETDEV_XDP_ACT_BASIC | NETDEV_XDP_ACT_REDIRECT |
+ 			       NETDEV_XDP_ACT_XSK_ZEROCOPY;
+ 
++	/* enable HW vlan tag insertion/stripping by default */
++	netdev->features |= NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX;
++
+ 	/* MTU range: 68 - 9216 */
+ 	netdev->min_mtu = ETH_MIN_MTU;
+ 	netdev->max_mtu = MAX_STD_JUMBO_FRAME_SIZE;
diff --git a/target/linux/generic/backport-6.6/793-01-v6.11-net-dsa-qca8k-do-not-write-port-mask-twice-in-bridge.patch b/target/linux/generic/backport-6.6/793-01-v6.11-net-dsa-qca8k-do-not-write-port-mask-twice-in-bridge.patch
new file mode 100644
index 00000000000000..22b544c4333873
--- /dev/null
+++ b/target/linux/generic/backport-6.6/793-01-v6.11-net-dsa-qca8k-do-not-write-port-mask-twice-in-bridge.patch
@@ -0,0 +1,58 @@
+From e85d3e6fea05c8ae21a40809a3c6b7adc97411c7 Mon Sep 17 00:00:00 2001
+Message-ID: <e85d3e6fea05c8ae21a40809a3c6b7adc97411c7.1728674648.git.mschiffer@universe-factory.net>
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Thu, 20 Jun 2024 19:25:48 +0200
+Subject: [PATCH] net: dsa: qca8k: do not write port mask twice in bridge
+ join/leave
+
+qca8k_port_bridge_join() set QCA8K_PORT_LOOKUP_CTRL() for i == port twice,
+once in the loop handling all other port's masks, and finally at the end
+with the accumulated port_mask.
+
+The first time it would incorrectly set the port's own bit in the mask,
+only to correct the mistake a moment later. qca8k_port_bridge_leave() had
+the same issue, but here the regmap_clear_bits() was a no-op rather than
+setting an unintended value.
+
+Remove the duplicate assignment by skipping the whole loop iteration for
+i == port. The unintended bit setting doesn't seem to have any negative
+effects (even when not reverted right away), so the change is submitted
+as a simple cleanup rather than a fix.
+
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-common.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-common.c
++++ b/drivers/net/dsa/qca/qca8k-common.c
+@@ -654,6 +654,8 @@ int qca8k_port_bridge_join(struct dsa_sw
+ 	port_mask = BIT(cpu_port);
+ 
+ 	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
++		if (i == port)
++			continue;
+ 		if (dsa_is_cpu_port(ds, i))
+ 			continue;
+ 		if (!dsa_port_offloads_bridge(dsa_to_port(ds, i), &bridge))
+@@ -666,8 +668,7 @@ int qca8k_port_bridge_join(struct dsa_sw
+ 				      BIT(port));
+ 		if (ret)
+ 			return ret;
+-		if (i != port)
+-			port_mask |= BIT(i);
++		port_mask |= BIT(i);
+ 	}
+ 
+ 	/* Add all other ports to this ports portvlan mask */
+@@ -686,6 +687,8 @@ void qca8k_port_bridge_leave(struct dsa_
+ 	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
+ 
+ 	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
++		if (i == port)
++			continue;
+ 		if (dsa_is_cpu_port(ds, i))
+ 			continue;
+ 		if (!dsa_port_offloads_bridge(dsa_to_port(ds, i), &bridge))
diff --git a/target/linux/generic/backport-6.6/793-02-v6.11-net-dsa-qca8k-factor-out-bridge-join-leave-logic.patch b/target/linux/generic/backport-6.6/793-02-v6.11-net-dsa-qca8k-factor-out-bridge-join-leave-logic.patch
new file mode 100644
index 00000000000000..fdb7e7b8b6d480
--- /dev/null
+++ b/target/linux/generic/backport-6.6/793-02-v6.11-net-dsa-qca8k-factor-out-bridge-join-leave-logic.patch
@@ -0,0 +1,153 @@
+From 412e1775f413c944b8c51bdadb675be957d83dc8 Mon Sep 17 00:00:00 2001
+Message-ID: <412e1775f413c944b8c51bdadb675be957d83dc8.1728674648.git.mschiffer@universe-factory.net>
+In-Reply-To: <e85d3e6fea05c8ae21a40809a3c6b7adc97411c7.1728674648.git.mschiffer@universe-factory.net>
+References: <e85d3e6fea05c8ae21a40809a3c6b7adc97411c7.1728674648.git.mschiffer@universe-factory.net>
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Thu, 20 Jun 2024 19:25:49 +0200
+Subject: [PATCH] net: dsa: qca8k: factor out bridge join/leave logic
+
+Most of the logic in qca8k_port_bridge_join() and qca8k_port_bridge_leave()
+is the same. Refactor to reduce duplication and prepare for reusing the
+code for implementing bridge port isolation.
+
+dsa_port_offloads_bridge_dev() is used instead of
+dsa_port_offloads_bridge(), passing the bridge in as a struct netdevice *,
+as we won't have a struct dsa_bridge in qca8k_port_bridge_flags().
+
+The error handling is changed slightly in the bridge leave case,
+returning early and emitting an error message when a regmap access fails.
+This shouldn't matter in practice, as there isn't much we can do if
+communication with the switch breaks down in the middle of reconfiguration.
+
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-common.c | 101 ++++++++++++++---------------
+ 1 file changed, 50 insertions(+), 51 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-common.c
++++ b/drivers/net/dsa/qca/qca8k-common.c
+@@ -615,6 +615,49 @@ void qca8k_port_stp_state_set(struct dsa
+ 	qca8k_port_configure_learning(ds, port, learning);
+ }
+ 
++static int qca8k_update_port_member(struct qca8k_priv *priv, int port,
++				    const struct net_device *bridge_dev,
++				    bool join)
++{
++	struct dsa_port *dp = dsa_to_port(priv->ds, port), *other_dp;
++	u32 port_mask = BIT(dp->cpu_dp->index);
++	int i, ret;
++
++	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
++		if (i == port)
++			continue;
++		if (dsa_is_cpu_port(priv->ds, i))
++			continue;
++
++		other_dp = dsa_to_port(priv->ds, i);
++		if (!dsa_port_offloads_bridge_dev(other_dp, bridge_dev))
++			continue;
++
++		/* Add/remove this port to/from the portvlan mask of the other
++		 * ports in the bridge
++		 */
++		if (join) {
++			port_mask |= BIT(i);
++			ret = regmap_set_bits(priv->regmap,
++					      QCA8K_PORT_LOOKUP_CTRL(i),
++					      BIT(port));
++		} else {
++			ret = regmap_clear_bits(priv->regmap,
++						QCA8K_PORT_LOOKUP_CTRL(i),
++						BIT(port));
++		}
++
++		if (ret)
++			return ret;
++	}
++
++	/* Add/remove all other ports to/from this port's portvlan mask */
++	ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
++			QCA8K_PORT_LOOKUP_MEMBER, port_mask);
++
++	return ret;
++}
++
+ int qca8k_port_pre_bridge_flags(struct dsa_switch *ds, int port,
+ 				struct switchdev_brport_flags flags,
+ 				struct netlink_ext_ack *extack)
+@@ -647,65 +690,21 @@ int qca8k_port_bridge_join(struct dsa_sw
+ 			   struct netlink_ext_ack *extack)
+ {
+ 	struct qca8k_priv *priv = ds->priv;
+-	int port_mask, cpu_port;
+-	int i, ret;
+-
+-	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
+-	port_mask = BIT(cpu_port);
+ 
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+-		if (i == port)
+-			continue;
+-		if (dsa_is_cpu_port(ds, i))
+-			continue;
+-		if (!dsa_port_offloads_bridge(dsa_to_port(ds, i), &bridge))
+-			continue;
+-		/* Add this port to the portvlan mask of the other ports
+-		 * in the bridge
+-		 */
+-		ret = regmap_set_bits(priv->regmap,
+-				      QCA8K_PORT_LOOKUP_CTRL(i),
+-				      BIT(port));
+-		if (ret)
+-			return ret;
+-		port_mask |= BIT(i);
+-	}
+-
+-	/* Add all other ports to this ports portvlan mask */
+-	ret = qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-			QCA8K_PORT_LOOKUP_MEMBER, port_mask);
+-
+-	return ret;
++	return qca8k_update_port_member(priv, port, bridge.dev, true);
+ }
+ 
+ void qca8k_port_bridge_leave(struct dsa_switch *ds, int port,
+ 			     struct dsa_bridge bridge)
+ {
+ 	struct qca8k_priv *priv = ds->priv;
+-	int cpu_port, i;
+-
+-	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
+-
+-	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
+-		if (i == port)
+-			continue;
+-		if (dsa_is_cpu_port(ds, i))
+-			continue;
+-		if (!dsa_port_offloads_bridge(dsa_to_port(ds, i), &bridge))
+-			continue;
+-		/* Remove this port to the portvlan mask of the other ports
+-		 * in the bridge
+-		 */
+-		regmap_clear_bits(priv->regmap,
+-				  QCA8K_PORT_LOOKUP_CTRL(i),
+-				  BIT(port));
+-	}
++	int err;
+ 
+-	/* Set the cpu port to be the only one in the portvlan mask of
+-	 * this port
+-	 */
+-	qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(port),
+-		  QCA8K_PORT_LOOKUP_MEMBER, BIT(cpu_port));
++	err = qca8k_update_port_member(priv, port, bridge.dev, false);
++	if (err)
++		dev_err(priv->dev,
++			"Failed to update switch config for bridge leave: %d\n",
++			err);
+ }
+ 
+ void qca8k_port_fast_age(struct dsa_switch *ds, int port)
diff --git a/target/linux/generic/backport-6.6/793-03-v6.11-net-dsa-qca8k-add-support-for-bridge-port-isolation.patch b/target/linux/generic/backport-6.6/793-03-v6.11-net-dsa-qca8k-add-support-for-bridge-port-isolation.patch
new file mode 100644
index 00000000000000..263fe10d4b9d12
--- /dev/null
+++ b/target/linux/generic/backport-6.6/793-03-v6.11-net-dsa-qca8k-add-support-for-bridge-port-isolation.patch
@@ -0,0 +1,91 @@
+From 422b64025ec10981c48f9367311846bf4bd38042 Mon Sep 17 00:00:00 2001
+Message-ID: <422b64025ec10981c48f9367311846bf4bd38042.1728674648.git.mschiffer@universe-factory.net>
+In-Reply-To: <e85d3e6fea05c8ae21a40809a3c6b7adc97411c7.1728674648.git.mschiffer@universe-factory.net>
+References: <e85d3e6fea05c8ae21a40809a3c6b7adc97411c7.1728674648.git.mschiffer@universe-factory.net>
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Thu, 20 Jun 2024 19:25:50 +0200
+Subject: [PATCH] net: dsa: qca8k: add support for bridge port isolation
+
+Remove a pair of ports from the port matrix when both ports have the
+isolated flag set.
+
+Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
+Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/dsa/qca/qca8k-common.c | 22 ++++++++++++++++++++--
+ drivers/net/dsa/qca/qca8k.h        |  1 +
+ 2 files changed, 21 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/dsa/qca/qca8k-common.c
++++ b/drivers/net/dsa/qca/qca8k-common.c
+@@ -619,6 +619,7 @@ static int qca8k_update_port_member(stru
+ 				    const struct net_device *bridge_dev,
+ 				    bool join)
+ {
++	bool isolated = !!(priv->port_isolated_map & BIT(port)), other_isolated;
+ 	struct dsa_port *dp = dsa_to_port(priv->ds, port), *other_dp;
+ 	u32 port_mask = BIT(dp->cpu_dp->index);
+ 	int i, ret;
+@@ -633,10 +634,12 @@ static int qca8k_update_port_member(stru
+ 		if (!dsa_port_offloads_bridge_dev(other_dp, bridge_dev))
+ 			continue;
+ 
++		other_isolated = !!(priv->port_isolated_map & BIT(i));
++
+ 		/* Add/remove this port to/from the portvlan mask of the other
+ 		 * ports in the bridge
+ 		 */
+-		if (join) {
++		if (join && !(isolated && other_isolated)) {
+ 			port_mask |= BIT(i);
+ 			ret = regmap_set_bits(priv->regmap,
+ 					      QCA8K_PORT_LOOKUP_CTRL(i),
+@@ -662,7 +665,7 @@ int qca8k_port_pre_bridge_flags(struct d
+ 				struct switchdev_brport_flags flags,
+ 				struct netlink_ext_ack *extack)
+ {
+-	if (flags.mask & ~BR_LEARNING)
++	if (flags.mask & ~(BR_LEARNING | BR_ISOLATED))
+ 		return -EINVAL;
+ 
+ 	return 0;
+@@ -672,6 +675,7 @@ int qca8k_port_bridge_flags(struct dsa_s
+ 			    struct switchdev_brport_flags flags,
+ 			    struct netlink_ext_ack *extack)
+ {
++	struct qca8k_priv *priv = ds->priv;
+ 	int ret;
+ 
+ 	if (flags.mask & BR_LEARNING) {
+@@ -680,6 +684,20 @@ int qca8k_port_bridge_flags(struct dsa_s
+ 		if (ret)
+ 			return ret;
+ 	}
++
++	if (flags.mask & BR_ISOLATED) {
++		struct dsa_port *dp = dsa_to_port(ds, port);
++		struct net_device *bridge_dev = dsa_port_bridge_dev_get(dp);
++
++		if (flags.val & BR_ISOLATED)
++			priv->port_isolated_map |= BIT(port);
++		else
++			priv->port_isolated_map &= ~BIT(port);
++
++		ret = qca8k_update_port_member(priv, port, bridge_dev, true);
++		if (ret)
++			return ret;
++	}
+ 
+ 	return 0;
+ }
+--- a/drivers/net/dsa/qca/qca8k.h
++++ b/drivers/net/dsa/qca/qca8k.h
+@@ -451,6 +451,7 @@ struct qca8k_priv {
+ 	 * Bit 1: port enabled. Bit 0: port disabled.
+ 	 */
+ 	u8 port_enabled_map;
++	u8 port_isolated_map;
+ 	struct qca8k_ports_config ports_config;
+ 	struct regmap *regmap;
+ 	struct mii_bus *bus;
diff --git a/target/linux/generic/backport-6.6/795-v6.7-16-r8152-use-napi_gro_frags.patch b/target/linux/generic/backport-6.6/795-v6.7-16-r8152-use-napi_gro_frags.patch
index 85b320f15aa5b4..73adadc4351df1 100644
--- a/target/linux/generic/backport-6.6/795-v6.7-16-r8152-use-napi_gro_frags.patch
+++ b/target/linux/generic/backport-6.6/795-v6.7-16-r8152-use-napi_gro_frags.patch
@@ -15,7 +15,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/usb/r8152.c
 +++ b/drivers/net/usb/r8152.c
-@@ -2584,8 +2584,9 @@ static int rx_bottom(struct r8152 *tp, i
+@@ -2585,8 +2585,9 @@ static int rx_bottom(struct r8152 *tp, i
  		while (urb->actual_length > len_used) {
  			struct net_device *netdev = tp->netdev;
  			struct net_device_stats *stats = &netdev->stats;
@@ -26,7 +26,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  
  			WARN_ON_ONCE(skb_queue_len(&tp->rx_queue) >= 1000);
  
-@@ -2598,45 +2599,77 @@ static int rx_bottom(struct r8152 *tp, i
+@@ -2599,45 +2600,77 @@ static int rx_bottom(struct r8152 *tp, i
  				break;
  
  			pkt_len -= ETH_FCS_LEN;
diff --git a/target/linux/generic/backport-6.6/798-v6.10-net-phy-air_en8811h-Add-the-Airoha-EN8811H-PHY-drive.patch b/target/linux/generic/backport-6.6/798-v6.10-01-net-phy-air_en8811h-Add-the-Airoha-EN8811H-PHY-drive.patch
similarity index 100%
rename from target/linux/generic/backport-6.6/798-v6.10-net-phy-air_en8811h-Add-the-Airoha-EN8811H-PHY-drive.patch
rename to target/linux/generic/backport-6.6/798-v6.10-01-net-phy-air_en8811h-Add-the-Airoha-EN8811H-PHY-drive.patch
diff --git a/target/linux/generic/backport-6.6/799-v6.10-net-phy-air_en8811h-fix-some-error-codes.patch b/target/linux/generic/backport-6.6/798-v6.10-02-net-phy-air_en8811h-fix-some-error-codes.patch
similarity index 100%
rename from target/linux/generic/backport-6.6/799-v6.10-net-phy-air_en8811h-fix-some-error-codes.patch
rename to target/linux/generic/backport-6.6/798-v6.10-02-net-phy-air_en8811h-fix-some-error-codes.patch
diff --git a/target/linux/generic/pending-6.6/742-net-phy-air_en8811h-reset-netdev-rules-when-LED-is-s.patch b/target/linux/generic/backport-6.6/798-v6.10-03-net-phy-air_en8811h-reset-netdev-rules-when-LED-is-s.patch
similarity index 100%
rename from target/linux/generic/pending-6.6/742-net-phy-air_en8811h-reset-netdev-rules-when-LED-is-s.patch
rename to target/linux/generic/backport-6.6/798-v6.10-03-net-phy-air_en8811h-reset-netdev-rules-when-LED-is-s.patch
diff --git a/target/linux/generic/backport-6.6/816-v6.7-0001-nvmem-qfprom-Mark-core-clk-as-optional.patch b/target/linux/generic/backport-6.6/816-v6.7-0001-nvmem-qfprom-Mark-core-clk-as-optional.patch
index c83d4fc579013e..cb8572ffe1e4a3 100644
--- a/target/linux/generic/backport-6.6/816-v6.7-0001-nvmem-qfprom-Mark-core-clk-as-optional.patch
+++ b/target/linux/generic/backport-6.6/816-v6.7-0001-nvmem-qfprom-Mark-core-clk-as-optional.patch
@@ -19,7 +19,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 
 --- a/drivers/nvmem/qfprom.c
 +++ b/drivers/nvmem/qfprom.c
-@@ -424,12 +424,12 @@ static int qfprom_probe(struct platform_
+@@ -438,12 +438,12 @@ static int qfprom_probe(struct platform_
  		if (IS_ERR(priv->vcc))
  			return PTR_ERR(priv->vcc);
  
diff --git a/target/linux/generic/backport-6.6/816-v6.7-0004-Revert-nvmem-add-new-config-option.patch b/target/linux/generic/backport-6.6/816-v6.7-0004-Revert-nvmem-add-new-config-option.patch
index 36d15248b8a966..4f8d837ef1977d 100644
--- a/target/linux/generic/backport-6.6/816-v6.7-0004-Revert-nvmem-add-new-config-option.patch
+++ b/target/linux/generic/backport-6.6/816-v6.7-0004-Revert-nvmem-add-new-config-option.patch
@@ -48,7 +48,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  	mtd->nvmem = nvmem_register(&config);
 --- a/drivers/nvmem/core.c
 +++ b/drivers/nvmem/core.c
-@@ -940,7 +940,7 @@ struct nvmem_device *nvmem_register(cons
+@@ -932,7 +932,7 @@ struct nvmem_device *nvmem_register(cons
  	nvmem->nkeepout = config->nkeepout;
  	if (config->of_node)
  		nvmem->dev.of_node = config->of_node;
@@ -59,7 +59,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  	switch (config->id) {
 --- a/include/linux/nvmem-provider.h
 +++ b/include/linux/nvmem-provider.h
-@@ -89,7 +89,6 @@ struct nvmem_cell_info {
+@@ -91,7 +91,6 @@ struct nvmem_cell_info {
   * @read_only:	Device is read-only.
   * @root_only:	Device is accessibly to root only.
   * @of_node:	If given, this will be used instead of the parent's of_node.
@@ -67,7 +67,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
   * @reg_read:	Callback to read data.
   * @reg_write:	Callback to write data.
   * @size:	Device size.
-@@ -122,7 +121,6 @@ struct nvmem_config {
+@@ -126,7 +125,6 @@ struct nvmem_config {
  	bool			ignore_wp;
  	struct nvmem_layout	*layout;
  	struct device_node	*of_node;
diff --git a/target/linux/generic/backport-6.6/819-v6.8-0001-nvmem-Move-of_nvmem_layout_get_container-in-another-.patch b/target/linux/generic/backport-6.6/819-v6.8-0001-nvmem-Move-of_nvmem_layout_get_container-in-another-.patch
index 0290d648984b13..f80e8756b12264 100644
--- a/target/linux/generic/backport-6.6/819-v6.8-0001-nvmem-Move-of_nvmem_layout_get_container-in-another-.patch
+++ b/target/linux/generic/backport-6.6/819-v6.8-0001-nvmem-Move-of_nvmem_layout_get_container-in-another-.patch
@@ -25,7 +25,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 
 --- a/drivers/nvmem/core.c
 +++ b/drivers/nvmem/core.c
-@@ -846,14 +846,6 @@ static int nvmem_add_cells_from_layout(s
+@@ -837,14 +837,6 @@ static int nvmem_add_cells_from_layout(s
  }
  
  #if IS_ENABLED(CONFIG_OF)
@@ -65,7 +65,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  #endif  /* ifndef _LINUX_NVMEM_CONSUMER_H */
 --- a/include/linux/nvmem-provider.h
 +++ b/include/linux/nvmem-provider.h
-@@ -244,6 +244,27 @@ nvmem_layout_get_match_data(struct nvmem
+@@ -241,6 +241,27 @@ nvmem_layout_get_match_data(struct nvmem
  
  #endif /* CONFIG_NVMEM */
  
diff --git a/target/linux/generic/backport-6.6/819-v6.8-0002-nvmem-Create-a-header-for-internal-sharing.patch b/target/linux/generic/backport-6.6/819-v6.8-0002-nvmem-Create-a-header-for-internal-sharing.patch
deleted file mode 100644
index b03ce680927573..00000000000000
--- a/target/linux/generic/backport-6.6/819-v6.8-0002-nvmem-Create-a-header-for-internal-sharing.patch
+++ /dev/null
@@ -1,91 +0,0 @@
-From ec9c08a1cb8dc5e8e003f95f5f62de41dde235bb Mon Sep 17 00:00:00 2001
-From: Miquel Raynal <miquel.raynal@bootlin.com>
-Date: Fri, 15 Dec 2023 11:15:29 +0000
-Subject: [PATCH] nvmem: Create a header for internal sharing
-
-Before adding all the NVMEM layout bus infrastructure to the core, let's
-move the main nvmem_device structure in an internal header, only
-available to the core. This way all the additional code can be added in
-a dedicated file in order to keep the current core file tidy.
-
-Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
-Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
-Link: https://lore.kernel.org/r/20231215111536.316972-4-srinivas.kandagatla@linaro.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/nvmem/core.c      | 24 +-----------------------
- drivers/nvmem/internals.h | 35 +++++++++++++++++++++++++++++++++++
- 2 files changed, 36 insertions(+), 23 deletions(-)
- create mode 100644 drivers/nvmem/internals.h
-
---- a/drivers/nvmem/core.c
-+++ b/drivers/nvmem/core.c
-@@ -19,29 +19,7 @@
- #include <linux/of.h>
- #include <linux/slab.h>
- 
--struct nvmem_device {
--	struct module		*owner;
--	struct device		dev;
--	int			stride;
--	int			word_size;
--	int			id;
--	struct kref		refcnt;
--	size_t			size;
--	bool			read_only;
--	bool			root_only;
--	int			flags;
--	enum nvmem_type		type;
--	struct bin_attribute	eeprom;
--	struct device		*base_dev;
--	struct list_head	cells;
--	const struct nvmem_keepout *keepout;
--	unsigned int		nkeepout;
--	nvmem_reg_read_t	reg_read;
--	nvmem_reg_write_t	reg_write;
--	struct gpio_desc	*wp_gpio;
--	struct nvmem_layout	*layout;
--	void *priv;
--};
-+#include "internals.h"
- 
- #define to_nvmem_device(d) container_of(d, struct nvmem_device, dev)
- 
---- /dev/null
-+++ b/drivers/nvmem/internals.h
-@@ -0,0 +1,35 @@
-+/* SPDX-License-Identifier: GPL-2.0 */
-+
-+#ifndef _LINUX_NVMEM_INTERNALS_H
-+#define _LINUX_NVMEM_INTERNALS_H
-+
-+#include <linux/device.h>
-+#include <linux/nvmem-consumer.h>
-+#include <linux/nvmem-provider.h>
-+
-+struct nvmem_device {
-+	struct module		*owner;
-+	struct device		dev;
-+	struct list_head	node;
-+	int			stride;
-+	int			word_size;
-+	int			id;
-+	struct kref		refcnt;
-+	size_t			size;
-+	bool			read_only;
-+	bool			root_only;
-+	int			flags;
-+	enum nvmem_type		type;
-+	struct bin_attribute	eeprom;
-+	struct device		*base_dev;
-+	struct list_head	cells;
-+	const struct nvmem_keepout *keepout;
-+	unsigned int		nkeepout;
-+	nvmem_reg_read_t	reg_read;
-+	nvmem_reg_write_t	reg_write;
-+	struct gpio_desc	*wp_gpio;
-+	struct nvmem_layout	*layout;
-+	void *priv;
-+};
-+
-+#endif  /* ifndef _LINUX_NVMEM_INTERNALS_H */
diff --git a/target/linux/generic/backport-6.6/819-v6.8-0003-nvmem-Simplify-the-add_cells-hook.patch b/target/linux/generic/backport-6.6/819-v6.8-0003-nvmem-Simplify-the-add_cells-hook.patch
deleted file mode 100644
index dac691e117af03..00000000000000
--- a/target/linux/generic/backport-6.6/819-v6.8-0003-nvmem-Simplify-the-add_cells-hook.patch
+++ /dev/null
@@ -1,79 +0,0 @@
-From 1b7c298a4ecbc28cc6ee94005734bff55eb83d22 Mon Sep 17 00:00:00 2001
-From: Miquel Raynal <miquel.raynal@bootlin.com>
-Date: Fri, 15 Dec 2023 11:15:30 +0000
-Subject: [PATCH] nvmem: Simplify the ->add_cells() hook
-
-The layout entry is not used and will anyway be made useless by the new
-layout bus infrastructure coming next, so drop it. While at it, clarify
-the kdoc entry.
-
-Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
-Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
-Link: https://lore.kernel.org/r/20231215111536.316972-5-srinivas.kandagatla@linaro.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/nvmem/core.c             | 2 +-
- drivers/nvmem/layouts/onie-tlv.c | 3 +--
- drivers/nvmem/layouts/sl28vpd.c  | 3 +--
- include/linux/nvmem-provider.h   | 8 +++-----
- 4 files changed, 6 insertions(+), 10 deletions(-)
-
---- a/drivers/nvmem/core.c
-+++ b/drivers/nvmem/core.c
-@@ -815,7 +815,7 @@ static int nvmem_add_cells_from_layout(s
- 	int ret;
- 
- 	if (layout && layout->add_cells) {
--		ret = layout->add_cells(&nvmem->dev, nvmem, layout);
-+		ret = layout->add_cells(&nvmem->dev, nvmem);
- 		if (ret)
- 			return ret;
- 	}
---- a/drivers/nvmem/layouts/onie-tlv.c
-+++ b/drivers/nvmem/layouts/onie-tlv.c
-@@ -182,8 +182,7 @@ static bool onie_tlv_crc_is_valid(struct
- 	return true;
- }
- 
--static int onie_tlv_parse_table(struct device *dev, struct nvmem_device *nvmem,
--				struct nvmem_layout *layout)
-+static int onie_tlv_parse_table(struct device *dev, struct nvmem_device *nvmem)
- {
- 	struct onie_tlv_hdr hdr;
- 	size_t table_len, data_len, hdr_len;
---- a/drivers/nvmem/layouts/sl28vpd.c
-+++ b/drivers/nvmem/layouts/sl28vpd.c
-@@ -80,8 +80,7 @@ static int sl28vpd_v1_check_crc(struct d
- 	return 0;
- }
- 
--static int sl28vpd_add_cells(struct device *dev, struct nvmem_device *nvmem,
--			     struct nvmem_layout *layout)
-+static int sl28vpd_add_cells(struct device *dev, struct nvmem_device *nvmem)
- {
- 	const struct nvmem_cell_info *pinfo;
- 	struct nvmem_cell_info info = {0};
---- a/include/linux/nvmem-provider.h
-+++ b/include/linux/nvmem-provider.h
-@@ -156,9 +156,8 @@ struct nvmem_cell_table {
-  *
-  * @name:		Layout name.
-  * @of_match_table:	Open firmware match table.
-- * @add_cells:		Will be called if a nvmem device is found which
-- *			has this layout. The function will add layout
-- *			specific cells with nvmem_add_one_cell().
-+ * @add_cells:		Called to populate the layout using
-+ *			nvmem_add_one_cell().
-  * @fixup_cell_info:	Will be called before a cell is added. Can be
-  *			used to modify the nvmem_cell_info.
-  * @owner:		Pointer to struct module.
-@@ -172,8 +171,7 @@ struct nvmem_cell_table {
- struct nvmem_layout {
- 	const char *name;
- 	const struct of_device_id *of_match_table;
--	int (*add_cells)(struct device *dev, struct nvmem_device *nvmem,
--			 struct nvmem_layout *layout);
-+	int (*add_cells)(struct device *dev, struct nvmem_device *nvmem);
- 	void (*fixup_cell_info)(struct nvmem_device *nvmem,
- 				struct nvmem_layout *layout,
- 				struct nvmem_cell_info *cell);
diff --git a/target/linux/generic/backport-6.6/819-v6.8-0004-nvmem-Move-and-rename-fixup_cell_info.patch b/target/linux/generic/backport-6.6/819-v6.8-0004-nvmem-Move-and-rename-fixup_cell_info.patch
deleted file mode 100644
index 0a614fc13dd884..00000000000000
--- a/target/linux/generic/backport-6.6/819-v6.8-0004-nvmem-Move-and-rename-fixup_cell_info.patch
+++ /dev/null
@@ -1,169 +0,0 @@
-From 1172460e716784ac7e1049a537bdca8edbf97360 Mon Sep 17 00:00:00 2001
-From: Miquel Raynal <miquel.raynal@bootlin.com>
-Date: Fri, 15 Dec 2023 11:15:31 +0000
-Subject: [PATCH] nvmem: Move and rename ->fixup_cell_info()
-
-This hook is meant to be used by any provider and instantiating a layout
-just for this is useless. Let's instead move this hook to the nvmem
-device and add it to the config structure to be easily shared by the
-providers.
-
-While at moving this hook, rename it ->fixup_dt_cell_info() to clarify
-its main intended purpose.
-
-Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
-Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
-Link: https://lore.kernel.org/r/20231215111536.316972-6-srinivas.kandagatla@linaro.org
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/nvmem/core.c           |  6 +++---
- drivers/nvmem/imx-ocotp.c      | 11 +++--------
- drivers/nvmem/internals.h      |  2 ++
- drivers/nvmem/mtk-efuse.c      | 11 +++--------
- include/linux/nvmem-provider.h |  9 ++++-----
- 5 files changed, 15 insertions(+), 24 deletions(-)
-
---- a/drivers/nvmem/core.c
-+++ b/drivers/nvmem/core.c
-@@ -674,7 +674,6 @@ static int nvmem_validate_keepouts(struc
- 
- static int nvmem_add_cells_from_dt(struct nvmem_device *nvmem, struct device_node *np)
- {
--	struct nvmem_layout *layout = nvmem->layout;
- 	struct device *dev = &nvmem->dev;
- 	struct device_node *child;
- 	const __be32 *addr;
-@@ -704,8 +703,8 @@ static int nvmem_add_cells_from_dt(struc
- 
- 		info.np = of_node_get(child);
- 
--		if (layout && layout->fixup_cell_info)
--			layout->fixup_cell_info(nvmem, layout, &info);
-+		if (nvmem->fixup_dt_cell_info)
-+			nvmem->fixup_dt_cell_info(nvmem, &info);
- 
- 		ret = nvmem_add_one_cell(nvmem, &info);
- 		kfree(info.name);
-@@ -894,6 +893,7 @@ struct nvmem_device *nvmem_register(cons
- 
- 	kref_init(&nvmem->refcnt);
- 	INIT_LIST_HEAD(&nvmem->cells);
-+	nvmem->fixup_dt_cell_info = config->fixup_dt_cell_info;
- 
- 	nvmem->owner = config->owner;
- 	if (!nvmem->owner && config->dev->driver)
---- a/drivers/nvmem/imx-ocotp.c
-+++ b/drivers/nvmem/imx-ocotp.c
-@@ -583,17 +583,12 @@ static const struct of_device_id imx_oco
- };
- MODULE_DEVICE_TABLE(of, imx_ocotp_dt_ids);
- 
--static void imx_ocotp_fixup_cell_info(struct nvmem_device *nvmem,
--				      struct nvmem_layout *layout,
--				      struct nvmem_cell_info *cell)
-+static void imx_ocotp_fixup_dt_cell_info(struct nvmem_device *nvmem,
-+					 struct nvmem_cell_info *cell)
- {
- 	cell->read_post_process = imx_ocotp_cell_pp;
- }
- 
--static struct nvmem_layout imx_ocotp_layout = {
--	.fixup_cell_info = imx_ocotp_fixup_cell_info,
--};
--
- static int imx_ocotp_probe(struct platform_device *pdev)
- {
- 	struct device *dev = &pdev->dev;
-@@ -619,7 +614,7 @@ static int imx_ocotp_probe(struct platfo
- 	imx_ocotp_nvmem_config.size = 4 * priv->params->nregs;
- 	imx_ocotp_nvmem_config.dev = dev;
- 	imx_ocotp_nvmem_config.priv = priv;
--	imx_ocotp_nvmem_config.layout = &imx_ocotp_layout;
-+	imx_ocotp_nvmem_config.fixup_dt_cell_info = &imx_ocotp_fixup_dt_cell_info;
- 
- 	priv->config = &imx_ocotp_nvmem_config;
- 
---- a/drivers/nvmem/internals.h
-+++ b/drivers/nvmem/internals.h
-@@ -23,6 +23,8 @@ struct nvmem_device {
- 	struct bin_attribute	eeprom;
- 	struct device		*base_dev;
- 	struct list_head	cells;
-+	void (*fixup_dt_cell_info)(struct nvmem_device *nvmem,
-+				   struct nvmem_cell_info *cell);
- 	const struct nvmem_keepout *keepout;
- 	unsigned int		nkeepout;
- 	nvmem_reg_read_t	reg_read;
---- a/drivers/nvmem/mtk-efuse.c
-+++ b/drivers/nvmem/mtk-efuse.c
-@@ -45,9 +45,8 @@ static int mtk_efuse_gpu_speedbin_pp(voi
- 	return 0;
- }
- 
--static void mtk_efuse_fixup_cell_info(struct nvmem_device *nvmem,
--				      struct nvmem_layout *layout,
--				      struct nvmem_cell_info *cell)
-+static void mtk_efuse_fixup_dt_cell_info(struct nvmem_device *nvmem,
-+					 struct nvmem_cell_info *cell)
- {
- 	size_t sz = strlen(cell->name);
- 
-@@ -61,10 +60,6 @@ static void mtk_efuse_fixup_cell_info(st
- 		cell->read_post_process = mtk_efuse_gpu_speedbin_pp;
- }
- 
--static struct nvmem_layout mtk_efuse_layout = {
--	.fixup_cell_info = mtk_efuse_fixup_cell_info,
--};
--
- static int mtk_efuse_probe(struct platform_device *pdev)
- {
- 	struct device *dev = &pdev->dev;
-@@ -91,7 +86,7 @@ static int mtk_efuse_probe(struct platfo
- 	econfig.priv = priv;
- 	econfig.dev = dev;
- 	if (pdata->uses_post_processing)
--		econfig.layout = &mtk_efuse_layout;
-+		econfig.fixup_dt_cell_info = &mtk_efuse_fixup_dt_cell_info;
- 	nvmem = devm_nvmem_register(dev, &econfig);
- 
- 	return PTR_ERR_OR_ZERO(nvmem);
---- a/include/linux/nvmem-provider.h
-+++ b/include/linux/nvmem-provider.h
-@@ -83,6 +83,8 @@ struct nvmem_cell_info {
-  * @cells:	Optional array of pre-defined NVMEM cells.
-  * @ncells:	Number of elements in cells.
-  * @add_legacy_fixed_of_cells:	Read fixed NVMEM cells from old OF syntax.
-+ * @fixup_dt_cell_info: Will be called before a cell is added. Can be
-+ *		used to modify the nvmem_cell_info.
-  * @keepout:	Optional array of keepout ranges (sorted ascending by start).
-  * @nkeepout:	Number of elements in the keepout array.
-  * @type:	Type of the nvmem storage
-@@ -113,6 +115,8 @@ struct nvmem_config {
- 	const struct nvmem_cell_info	*cells;
- 	int			ncells;
- 	bool			add_legacy_fixed_of_cells;
-+	void (*fixup_dt_cell_info)(struct nvmem_device *nvmem,
-+				   struct nvmem_cell_info *cell);
- 	const struct nvmem_keepout *keepout;
- 	unsigned int		nkeepout;
- 	enum nvmem_type		type;
-@@ -158,8 +162,6 @@ struct nvmem_cell_table {
-  * @of_match_table:	Open firmware match table.
-  * @add_cells:		Called to populate the layout using
-  *			nvmem_add_one_cell().
-- * @fixup_cell_info:	Will be called before a cell is added. Can be
-- *			used to modify the nvmem_cell_info.
-  * @owner:		Pointer to struct module.
-  * @node:		List node.
-  *
-@@ -172,9 +174,6 @@ struct nvmem_layout {
- 	const char *name;
- 	const struct of_device_id *of_match_table;
- 	int (*add_cells)(struct device *dev, struct nvmem_device *nvmem);
--	void (*fixup_cell_info)(struct nvmem_device *nvmem,
--				struct nvmem_layout *layout,
--				struct nvmem_cell_info *cell);
- 
- 	/* private */
- 	struct module *owner;
diff --git a/target/linux/generic/backport-6.6/819-v6.8-0005-nvmem-core-Rework-layouts-to-become-regular-devices.patch b/target/linux/generic/backport-6.6/819-v6.8-0005-nvmem-core-Rework-layouts-to-become-regular-devices.patch
index c846c485e0242e..1747587c7c3b56 100644
--- a/target/linux/generic/backport-6.6/819-v6.8-0005-nvmem-core-Rework-layouts-to-become-regular-devices.patch
+++ b/target/linux/generic/backport-6.6/819-v6.8-0005-nvmem-core-Rework-layouts-to-become-regular-devices.patch
@@ -84,7 +84,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  static int __nvmem_reg_read(struct nvmem_device *nvmem, unsigned int offset,
  			    void *val, size_t bytes)
  {
-@@ -739,97 +736,22 @@ static int nvmem_add_cells_from_fixed_la
+@@ -753,97 +750,22 @@ static int nvmem_add_cells_from_fixed_la
  	return err;
  }
  
@@ -189,7 +189,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  const void *nvmem_layout_get_match_data(struct nvmem_device *nvmem,
  					struct nvmem_layout *layout)
  {
-@@ -837,7 +759,7 @@ const void *nvmem_layout_get_match_data(
+@@ -851,7 +773,7 @@ const void *nvmem_layout_get_match_data(
  	const struct of_device_id *match;
  
  	layout_np = of_nvmem_layout_get_container(nvmem);
@@ -198,7 +198,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  
  	return match ? match->data : NULL;
  }
-@@ -949,19 +871,6 @@ struct nvmem_device *nvmem_register(cons
+@@ -963,19 +885,6 @@ struct nvmem_device *nvmem_register(cons
  			goto err_put_device;
  	}
  
@@ -218,7 +218,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  	if (config->cells) {
  		rval = nvmem_add_cells(nvmem, config->cells, config->ncells);
  		if (rval)
-@@ -982,24 +891,24 @@ struct nvmem_device *nvmem_register(cons
+@@ -996,24 +905,24 @@ struct nvmem_device *nvmem_register(cons
  	if (rval)
  		goto err_remove_cells;
  
@@ -249,7 +249,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  	if (config->compat)
  		nvmem_sysfs_remove_compat(nvmem, config);
  err_put_device:
-@@ -1021,7 +930,7 @@ static void nvmem_device_release(struct
+@@ -1035,7 +944,7 @@ static void nvmem_device_release(struct
  		device_remove_bin_file(nvmem->base_dev, &nvmem->eeprom);
  
  	nvmem_device_remove_all_cells(nvmem);
@@ -258,7 +258,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  	device_unregister(&nvmem->dev);
  }
  
-@@ -1323,6 +1232,12 @@ nvmem_cell_get_from_lookup(struct device
+@@ -1337,6 +1246,12 @@ nvmem_cell_get_from_lookup(struct device
  	return cell;
  }
  
@@ -271,7 +271,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  #if IS_ENABLED(CONFIG_OF)
  static struct nvmem_cell_entry *
  nvmem_find_cell_entry_by_node(struct nvmem_device *nvmem, struct device_node *np)
-@@ -1341,6 +1256,18 @@ nvmem_find_cell_entry_by_node(struct nvm
+@@ -1355,6 +1270,18 @@ nvmem_find_cell_entry_by_node(struct nvm
  	return cell;
  }
  
@@ -290,7 +290,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  /**
   * of_nvmem_cell_get() - Get a nvmem cell from given device node and cell id
   *
-@@ -1403,16 +1330,29 @@ struct nvmem_cell *of_nvmem_cell_get(str
+@@ -1417,16 +1344,29 @@ struct nvmem_cell *of_nvmem_cell_get(str
  		return ERR_CAST(nvmem);
  	}
  
@@ -322,7 +322,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  
  	return cell;
  }
-@@ -1526,6 +1466,7 @@ void nvmem_cell_put(struct nvmem_cell *c
+@@ -1540,6 +1480,7 @@ void nvmem_cell_put(struct nvmem_cell *c
  
  	kfree(cell);
  	__nvmem_device_put(nvmem);
@@ -330,7 +330,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  }
  EXPORT_SYMBOL_GPL(nvmem_cell_put);
  
-@@ -2116,11 +2057,22 @@ EXPORT_SYMBOL_GPL(nvmem_dev_size);
+@@ -2132,11 +2073,22 @@ EXPORT_SYMBOL_GPL(nvmem_dev_size);
  
  static int __init nvmem_init(void)
  {
diff --git a/target/linux/generic/backport-6.6/819-v6.8-0006-nvmem-core-Expose-cells-through-sysfs.patch b/target/linux/generic/backport-6.6/819-v6.8-0006-nvmem-core-Expose-cells-through-sysfs.patch
index 8442636b091544..478efdba05f22a 100644
--- a/target/linux/generic/backport-6.6/819-v6.8-0006-nvmem-core-Expose-cells-through-sysfs.patch
+++ b/target/linux/generic/backport-6.6/819-v6.8-0006-nvmem-core-Expose-cells-through-sysfs.patch
@@ -180,7 +180,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  #else /* CONFIG_NVMEM_SYSFS */
  
  static int nvmem_sysfs_setup_compat(struct nvmem_device *nvmem,
-@@ -738,11 +847,25 @@ static int nvmem_add_cells_from_fixed_la
+@@ -752,11 +861,25 @@ static int nvmem_add_cells_from_fixed_la
  
  int nvmem_layout_register(struct nvmem_layout *layout)
  {
@@ -207,7 +207,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  }
  EXPORT_SYMBOL_GPL(nvmem_layout_register);
  
-@@ -901,10 +1024,20 @@ struct nvmem_device *nvmem_register(cons
+@@ -915,10 +1038,20 @@ struct nvmem_device *nvmem_register(cons
  	if (rval)
  		goto err_remove_dev;
  
diff --git a/target/linux/generic/backport-6.6/819-v6.8-0008-nvmem-layouts-refactor-.add_cells-callback-arguments.patch b/target/linux/generic/backport-6.6/819-v6.8-0008-nvmem-layouts-refactor-.add_cells-callback-arguments.patch
index a95770a05906a1..536d10edfdf864 100644
--- a/target/linux/generic/backport-6.6/819-v6.8-0008-nvmem-layouts-refactor-.add_cells-callback-arguments.patch
+++ b/target/linux/generic/backport-6.6/819-v6.8-0008-nvmem-layouts-refactor-.add_cells-callback-arguments.patch
@@ -44,7 +44,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 
 --- a/drivers/nvmem/core.c
 +++ b/drivers/nvmem/core.c
-@@ -853,7 +853,7 @@ int nvmem_layout_register(struct nvmem_l
+@@ -867,7 +867,7 @@ int nvmem_layout_register(struct nvmem_l
  		return -EINVAL;
  
  	/* Populate the cells */
diff --git a/target/linux/generic/backport-6.6/819-v6.8-0009-nvmem-drop-nvmem_layout_get_match_data.patch b/target/linux/generic/backport-6.6/819-v6.8-0009-nvmem-drop-nvmem_layout_get_match_data.patch
index 291854bcb579d5..b55696e4245b37 100644
--- a/target/linux/generic/backport-6.6/819-v6.8-0009-nvmem-drop-nvmem_layout_get_match_data.patch
+++ b/target/linux/generic/backport-6.6/819-v6.8-0009-nvmem-drop-nvmem_layout_get_match_data.patch
@@ -24,7 +24,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 
 --- a/drivers/nvmem/core.c
 +++ b/drivers/nvmem/core.c
-@@ -875,19 +875,6 @@ void nvmem_layout_unregister(struct nvme
+@@ -889,19 +889,6 @@ void nvmem_layout_unregister(struct nvme
  }
  EXPORT_SYMBOL_GPL(nvmem_layout_unregister);
  
diff --git a/target/linux/generic/backport-6.6/820-v6.9-0007-nvmem-core-Print-error-on-wrong-bits-DT-property.patch b/target/linux/generic/backport-6.6/820-v6.9-0007-nvmem-core-Print-error-on-wrong-bits-DT-property.patch
index aa4e0ab04a8a20..17a47a12277c1c 100644
--- a/target/linux/generic/backport-6.6/820-v6.9-0007-nvmem-core-Print-error-on-wrong-bits-DT-property.patch
+++ b/target/linux/generic/backport-6.6/820-v6.9-0007-nvmem-core-Print-error-on-wrong-bits-DT-property.patch
@@ -18,7 +18,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 
 --- a/drivers/nvmem/core.c
 +++ b/drivers/nvmem/core.c
-@@ -805,6 +805,11 @@ static int nvmem_add_cells_from_dt(struc
+@@ -819,6 +819,11 @@ static int nvmem_add_cells_from_dt(struc
  		if (addr && len == (2 * sizeof(u32))) {
  			info.bit_offset = be32_to_cpup(addr++);
  			info.nbits = be32_to_cpup(addr);
diff --git a/target/linux/generic/backport-6.6/823-v6.12-0001-nvmem-imx-ocotp-ele-support-i.MX95.patch b/target/linux/generic/backport-6.6/823-v6.12-0001-nvmem-imx-ocotp-ele-support-i.MX95.patch
index c19931b3fa01e6..04ac6f1334e93f 100644
--- a/target/linux/generic/backport-6.6/823-v6.12-0001-nvmem-imx-ocotp-ele-support-i.MX95.patch
+++ b/target/linux/generic/backport-6.6/823-v6.12-0001-nvmem-imx-ocotp-ele-support-i.MX95.patch
@@ -16,8 +16,8 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 
 --- a/drivers/nvmem/imx-ocotp-ele.c
 +++ b/drivers/nvmem/imx-ocotp-ele.c
-@@ -14,8 +14,9 @@
- #include <linux/slab.h>
+@@ -15,8 +15,9 @@
+ #include <linux/if_ether.h>	/* ETH_ALEN */
  
  enum fuse_type {
 -	FUSE_FSB = 1,
@@ -28,7 +28,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  	FUSE_INVALID = -1
  };
  
-@@ -93,7 +94,10 @@ static int imx_ocotp_reg_read(void *cont
+@@ -96,7 +97,10 @@ static int imx_ocotp_reg_read(void *cont
  			continue;
  		}
  
@@ -39,8 +39,8 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 +			*buf++ = readl_relaxed(reg + (i << 2));
  	}
  
- 	memcpy(val, (u8 *)p, bytes);
-@@ -155,8 +159,30 @@ static const struct ocotp_devtype_data i
+ 	memcpy(val, ((u8 *)p) + skipbytes, bytes);
+@@ -182,8 +186,30 @@ static const struct ocotp_devtype_data i
  	},
  };
  
diff --git a/target/linux/generic/backport-6.6/823-v6.12-0003-nvmem-layouts-add-U-Boot-env-layout.patch b/target/linux/generic/backport-6.6/823-v6.12-0003-nvmem-layouts-add-U-Boot-env-layout.patch
index 15a0f77bb33192..3f105cfd2b9078 100644
--- a/target/linux/generic/backport-6.6/823-v6.12-0003-nvmem-layouts-add-U-Boot-env-layout.patch
+++ b/target/linux/generic/backport-6.6/823-v6.12-0003-nvmem-layouts-add-U-Boot-env-layout.patch
@@ -41,7 +41,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -21988,6 +21988,7 @@ U-BOOT ENVIRONMENT VARIABLES
+@@ -21989,6 +21989,7 @@ U-BOOT ENVIRONMENT VARIABLES
  M:	Rafał Miłecki <rafal@milecki.pl>
  S:	Maintained
  F:	Documentation/devicetree/bindings/nvmem/u-boot,env.yaml
@@ -185,7 +185,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 +	size_t crc32_data_offset;
 +	size_t crc32_data_len;
 +	size_t crc32_offset;
-+	__le32 *crc32_addr;
++	uint32_t *crc32_addr;
 +	size_t data_offset;
 +	size_t data_len;
 +	size_t dev_size;
@@ -236,8 +236,8 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 +		goto err_kfree;
 +	}
 +
-+	crc32_addr = (__le32 *)(buf + crc32_offset);
-+	crc32 = le32_to_cpu(*crc32_addr);
++	crc32_addr = (uint32_t *)(buf + crc32_offset);
++	crc32 = *crc32_addr;
 +	crc32_data_len = dev_size - crc32_data_offset;
 +	data_len = dev_size - data_offset;
 +
@@ -439,7 +439,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -	size_t crc32_data_offset;
 -	size_t crc32_data_len;
 -	size_t crc32_offset;
--	__le32 *crc32_addr;
+-	uint32_t *crc32_addr;
 -	size_t data_offset;
 -	size_t data_len;
 -	size_t dev_size;
@@ -490,8 +490,8 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -		goto err_kfree;
 -	}
 -
--	crc32_addr = (__le32 *)(buf + crc32_offset);
--	crc32 = le32_to_cpu(*crc32_addr);
+-	crc32_addr = (uint32_t *)(buf + crc32_offset);
+-	crc32 = *crc32_addr;
 -	crc32_data_len = dev_size - crc32_data_offset;
 -	data_len = dev_size - data_offset;
 -
diff --git a/target/linux/generic/backport-6.6/835-v6.9-net-phy-add-support-for-PHY-LEDs-polarity-modes.patch b/target/linux/generic/backport-6.6/835-v6.9-net-phy-add-support-for-PHY-LEDs-polarity-modes.patch
index 1fe0e3f890cc5e..54932436c747c4 100644
--- a/target/linux/generic/backport-6.6/835-v6.9-net-phy-add-support-for-PHY-LEDs-polarity-modes.patch
+++ b/target/linux/generic/backport-6.6/835-v6.9-net-phy-add-support-for-PHY-LEDs-polarity-modes.patch
@@ -28,7 +28,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -3202,6 +3202,7 @@ static int of_phy_led(struct phy_device
+@@ -3204,6 +3204,7 @@ static int of_phy_led(struct phy_device
  	struct device *dev = &phydev->mdio.dev;
  	struct led_init_data init_data = {};
  	struct led_classdev *cdev;
@@ -36,7 +36,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  	struct phy_led *phyled;
  	u32 index;
  	int err;
-@@ -3219,6 +3220,21 @@ static int of_phy_led(struct phy_device
+@@ -3221,6 +3222,21 @@ static int of_phy_led(struct phy_device
  	if (index > U8_MAX)
  		return -EINVAL;
  
@@ -60,7 +60,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  		cdev->brightness_set_blocking = phy_led_set_brightness;
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -870,6 +870,15 @@ struct phy_led {
+@@ -867,6 +867,15 @@ struct phy_led {
  
  #define to_phy_led(d) container_of(d, struct phy_led, led_cdev)
  
@@ -76,7 +76,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
  /**
   * struct phy_driver - Driver structure for a particular PHY type
   *
-@@ -1146,6 +1155,19 @@ struct phy_driver {
+@@ -1143,6 +1152,19 @@ struct phy_driver {
  	int (*led_hw_control_get)(struct phy_device *dev, u8 index,
  				  unsigned long *rules);
  
diff --git a/target/linux/generic/backport-6.6/841-v6.13-net-phy-support-active-high-property-for-PHY-LEDs.patch b/target/linux/generic/backport-6.6/841-v6.13-net-phy-support-active-high-property-for-PHY-LEDs.patch
index 729a31562337dc..3d8a15bd1e0869 100644
--- a/target/linux/generic/backport-6.6/841-v6.13-net-phy-support-active-high-property-for-PHY-LEDs.patch
+++ b/target/linux/generic/backport-6.6/841-v6.13-net-phy-support-active-high-property-for-PHY-LEDs.patch
@@ -19,7 +19,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -3220,11 +3220,17 @@ static int of_phy_led(struct phy_device
+@@ -3222,11 +3222,17 @@ static int of_phy_led(struct phy_device
  	if (index > U8_MAX)
  		return -EINVAL;
  
@@ -39,7 +39,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
  		if (!phydev->drv->led_polarity_set)
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -872,8 +872,9 @@ struct phy_led {
+@@ -869,8 +869,9 @@ struct phy_led {
  
  /* Modes for PHY LED configuration */
  enum phy_led_modes {
diff --git a/target/linux/generic/backport-6.6/850-v6.8-bus-mhi-host-Add-a-separate-timeout-parameter-for-wa.patch b/target/linux/generic/backport-6.6/850-v6.8-bus-mhi-host-Add-a-separate-timeout-parameter-for-wa.patch
index 94d9bcd93d7c3d..4aad22248af463 100644
--- a/target/linux/generic/backport-6.6/850-v6.8-bus-mhi-host-Add-a-separate-timeout-parameter-for-wa.patch
+++ b/target/linux/generic/backport-6.6/850-v6.8-bus-mhi-host-Add-a-separate-timeout-parameter-for-wa.patch
@@ -109,7 +109,7 @@ Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
  			if (ret)
  				dev_err(dev, "Device failed to enter READY state\n");
  		}
-@@ -1125,7 +1130,8 @@ int mhi_async_power_up(struct mhi_contro
+@@ -1141,7 +1146,8 @@ int mhi_async_power_up(struct mhi_contro
  	if (state == MHI_STATE_SYS_ERR) {
  		mhi_set_mhi_state(mhi_cntrl, MHI_STATE_RESET);
  		ret = mhi_poll_reg_field(mhi_cntrl, mhi_cntrl->regs, MHICTRL,
@@ -119,7 +119,7 @@ Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
  		if (ret) {
  			dev_info(dev, "Failed to reset MHI due to syserr state\n");
  			goto error_exit;
-@@ -1216,14 +1222,18 @@ EXPORT_SYMBOL_GPL(mhi_power_down);
+@@ -1232,14 +1238,18 @@ EXPORT_SYMBOL_GPL(mhi_power_down);
  int mhi_sync_power_up(struct mhi_controller *mhi_cntrl)
  {
  	int ret = mhi_async_power_up(mhi_cntrl);
diff --git a/target/linux/generic/backport-6.6/853-v6.10-bus-mhi-host-Add-mhi_power_down_keep_dev-API-to-supp.patch b/target/linux/generic/backport-6.6/853-v6.10-bus-mhi-host-Add-mhi_power_down_keep_dev-API-to-supp.patch
index 826b39b51855a3..b3e702bd627604 100644
--- a/target/linux/generic/backport-6.6/853-v6.10-bus-mhi-host-Add-mhi_power_down_keep_dev-API-to-supp.patch
+++ b/target/linux/generic/backport-6.6/853-v6.10-bus-mhi-host-Add-mhi_power_down_keep_dev-API-to-supp.patch
@@ -49,7 +49,7 @@
  
  	mutex_lock(&mhi_cntrl->pm_mutex);
  
-@@ -820,7 +829,10 @@ void mhi_pm_st_worker(struct work_struct
+@@ -836,7 +845,10 @@ void mhi_pm_st_worker(struct work_struct
  			mhi_pm_sys_error_transition(mhi_cntrl);
  			break;
  		case DEV_ST_TRANSITION_DISABLE:
@@ -61,7 +61,7 @@
  			break;
  		default:
  			break;
-@@ -1174,7 +1186,8 @@ error_exit:
+@@ -1190,7 +1202,8 @@ error_exit:
  }
  EXPORT_SYMBOL_GPL(mhi_async_power_up);
  
@@ -71,7 +71,7 @@
  {
  	enum mhi_pm_state cur_state, transition_state;
  	struct device *dev = &mhi_cntrl->mhi_dev->dev;
-@@ -1210,15 +1223,32 @@ void mhi_power_down(struct mhi_controlle
+@@ -1226,15 +1239,32 @@ void mhi_power_down(struct mhi_controlle
  	write_unlock_irq(&mhi_cntrl->pm_lock);
  	mutex_unlock(&mhi_cntrl->pm_mutex);
  
diff --git a/target/linux/generic/backport-6.6/860-v6.7-leds-add-ktd202x-driver.patch b/target/linux/generic/backport-6.6/860-v6.7-leds-add-ktd202x-driver.patch
new file mode 100644
index 00000000000000..fb767c5d9998be
--- /dev/null
+++ b/target/linux/generic/backport-6.6/860-v6.7-leds-add-ktd202x-driver.patch
@@ -0,0 +1,682 @@
+From 0ebdb7210943eb345992bea9892adbd15a206193 Mon Sep 17 00:00:00 2001
+From: André Apitzsch <git@apitzsch.eu>
+Date: Mon, 2 Oct 2023 18:48:28 +0200
+Subject: leds: Add ktd202x driver
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This commit adds support for Kinetic KTD2026/7 RGB/White LED driver.
+
+Signed-off-by: André Apitzsch <git@apitzsch.eu>
+Link: https://lore.kernel.org/r/20231002-ktd202x-v6-2-26be8eefeb88@apitzsch.eu
+Signed-off-by: Lee Jones <lee@kernel.org>
+---
+ drivers/leds/rgb/Kconfig        |  13 +
+ drivers/leds/rgb/Makefile       |   1 +
+ drivers/leds/rgb/leds-ktd202x.c | 625 ++++++++++++++++++++++++++++++++++++++++
+ 3 files changed, 639 insertions(+)
+ create mode 100644 drivers/leds/rgb/leds-ktd202x.c
+
+(limited to 'drivers/leds/rgb')
+
+--- a/drivers/leds/rgb/Kconfig
++++ b/drivers/leds/rgb/Kconfig
+@@ -14,6 +14,19 @@ config LEDS_GROUP_MULTICOLOR
+ 	  To compile this driver as a module, choose M here: the module
+ 	  will be called leds-group-multicolor.
+ 
++config LEDS_KTD202X
++	tristate "LED support for KTD202x Chips"
++	depends on I2C
++	depends on OF
++	select REGMAP_I2C
++	help
++	  This option enables support for the Kinetic KTD2026/KTD2027
++	  RGB/White LED driver found in different BQ mobile phones.
++	  It is a 3 or 4 channel LED driver programmed via an I2C interface.
++
++	  To compile this driver as a module, choose M here: the module
++	  will be called leds-ktd202x.
++
+ config LEDS_PWM_MULTICOLOR
+ 	tristate "PWM driven multi-color LED Support"
+ 	depends on PWM
+--- a/drivers/leds/rgb/Makefile
++++ b/drivers/leds/rgb/Makefile
+@@ -1,6 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ 
+ obj-$(CONFIG_LEDS_GROUP_MULTICOLOR)	+= leds-group-multicolor.o
++obj-$(CONFIG_LEDS_KTD202X)		+= leds-ktd202x.o
+ obj-$(CONFIG_LEDS_PWM_MULTICOLOR)	+= leds-pwm-multicolor.o
+ obj-$(CONFIG_LEDS_QCOM_LPG)		+= leds-qcom-lpg.o
+ obj-$(CONFIG_LEDS_MT6370_RGB)		+= leds-mt6370-rgb.o
+--- /dev/null
++++ b/drivers/leds/rgb/leds-ktd202x.c
+@@ -0,0 +1,625 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * Kinetic KTD2026/7 RGB/White LED driver with I2C interface
++ *
++ * Copyright 2023 André Apitzsch <git@apitzsch.eu>
++ *
++ * Datasheet: https://www.kinet-ic.com/uploads/KTD2026-7-04h.pdf
++ */
++
++#include <linux/i2c.h>
++#include <linux/led-class-multicolor.h>
++#include <linux/module.h>
++#include <linux/mutex.h>
++#include <linux/of.h>
++#include <linux/of_device.h>
++#include <linux/regmap.h>
++#include <linux/regulator/consumer.h>
++
++#define KTD2026_NUM_LEDS 3
++#define KTD2027_NUM_LEDS 4
++#define KTD202X_MAX_LEDS 4
++
++/* Register bank */
++#define KTD202X_REG_RESET_CONTROL	0x00
++#define KTD202X_REG_FLASH_PERIOD	0x01
++#define KTD202X_REG_PWM1_TIMER		0x02
++#define KTD202X_REG_PWM2_TIMER		0x03
++#define KTD202X_REG_CHANNEL_CTRL	0x04
++#define KTD202X_REG_TRISE_FALL		0x05
++#define KTD202X_REG_LED_IOUT(x)		(0x06 + (x))
++
++/* Register 0 */
++#define KTD202X_TIMER_SLOT_CONTROL_TSLOT1	0x00
++#define KTD202X_TIMER_SLOT_CONTROL_TSLOT2	0x01
++#define KTD202X_TIMER_SLOT_CONTROL_TSLOT3	0x02
++#define KTD202X_TIMER_SLOT_CONTROL_TSLOT4	0x03
++#define KTD202X_RSTR_RESET			0x07
++
++#define KTD202X_ENABLE_CTRL_WAKE	0x00 /* SCL High & SDA High */
++#define KTD202X_ENABLE_CTRL_SLEEP	0x08 /* SCL High & SDA Toggling */
++
++#define KTD202X_TRISE_FALL_SCALE_NORMAL		0x00
++#define KTD202X_TRISE_FALL_SCALE_SLOW_X2	0x20
++#define KTD202X_TRISE_FALL_SCALE_SLOW_X4	0x40
++#define KTD202X_TRISE_FALL_SCALE_FAST_X8	0x60
++
++/* Register 1 */
++#define KTD202X_FLASH_PERIOD_256_MS_LOG_RAMP	0x00
++
++/* Register 2-3 */
++#define KTD202X_FLASH_ON_TIME_0_4_PERCENT	0x01
++
++/* Register 4 */
++#define KTD202X_CHANNEL_CTRL_MASK(x) (BIT(2 * (x)) | BIT(2 * (x) + 1))
++#define KTD202X_CHANNEL_CTRL_OFF 0x00
++#define KTD202X_CHANNEL_CTRL_ON(x) BIT(2 * (x))
++#define KTD202X_CHANNEL_CTRL_PWM1(x) BIT(2 * (x) + 1)
++#define KTD202X_CHANNEL_CTRL_PWM2(x) (BIT(2 * (x)) | BIT(2 * (x) + 1))
++
++/* Register 5 */
++#define KTD202X_RAMP_TIMES_2_MS			0x00
++
++/* Register 6-9 */
++#define KTD202X_LED_CURRENT_10_mA		0x4f
++
++#define KTD202X_FLASH_PERIOD_MIN_MS 256
++#define KTD202X_FLASH_PERIOD_STEP_MS 128
++#define KTD202X_FLASH_PERIOD_MAX_STEPS 126
++#define KTD202X_FLASH_ON_MAX 256
++
++#define KTD202X_MAX_BRIGHTNESS 192
++
++static const struct reg_default ktd202x_reg_defaults[] = {
++	{ KTD202X_REG_RESET_CONTROL, KTD202X_TIMER_SLOT_CONTROL_TSLOT1 |
++		KTD202X_ENABLE_CTRL_WAKE | KTD202X_TRISE_FALL_SCALE_NORMAL },
++	{ KTD202X_REG_FLASH_PERIOD, KTD202X_FLASH_PERIOD_256_MS_LOG_RAMP },
++	{ KTD202X_REG_PWM1_TIMER, KTD202X_FLASH_ON_TIME_0_4_PERCENT },
++	{ KTD202X_REG_PWM2_TIMER, KTD202X_FLASH_ON_TIME_0_4_PERCENT },
++	{ KTD202X_REG_CHANNEL_CTRL, KTD202X_CHANNEL_CTRL_OFF },
++	{ KTD202X_REG_TRISE_FALL, KTD202X_RAMP_TIMES_2_MS },
++	{ KTD202X_REG_LED_IOUT(0), KTD202X_LED_CURRENT_10_mA },
++	{ KTD202X_REG_LED_IOUT(1), KTD202X_LED_CURRENT_10_mA },
++	{ KTD202X_REG_LED_IOUT(2), KTD202X_LED_CURRENT_10_mA },
++	{ KTD202X_REG_LED_IOUT(3), KTD202X_LED_CURRENT_10_mA },
++};
++
++struct ktd202x_led {
++	struct ktd202x *chip;
++	union {
++		struct led_classdev cdev;
++		struct led_classdev_mc mcdev;
++	};
++	u32 index;
++};
++
++struct ktd202x {
++	struct mutex mutex;
++	struct regulator_bulk_data regulators[2];
++	struct device *dev;
++	struct regmap *regmap;
++	bool enabled;
++	int num_leds;
++	struct ktd202x_led leds[] __counted_by(num_leds);
++};
++
++static int ktd202x_chip_disable(struct ktd202x *chip)
++{
++	int ret;
++
++	if (!chip->enabled)
++		return 0;
++
++	regmap_write(chip->regmap, KTD202X_REG_RESET_CONTROL, KTD202X_ENABLE_CTRL_SLEEP);
++
++	ret = regulator_bulk_disable(ARRAY_SIZE(chip->regulators), chip->regulators);
++	if (ret) {
++		dev_err(chip->dev, "Failed to disable regulators: %d\n", ret);
++		return ret;
++	}
++
++	chip->enabled = false;
++	return 0;
++}
++
++static int ktd202x_chip_enable(struct ktd202x *chip)
++{
++	int ret;
++
++	if (chip->enabled)
++		return 0;
++
++	ret = regulator_bulk_enable(ARRAY_SIZE(chip->regulators), chip->regulators);
++	if (ret) {
++		dev_err(chip->dev, "Failed to enable regulators: %d\n", ret);
++		return ret;
++	}
++	chip->enabled = true;
++
++	ret = regmap_write(chip->regmap, KTD202X_REG_RESET_CONTROL, KTD202X_ENABLE_CTRL_WAKE);
++
++	if (ret) {
++		dev_err(chip->dev, "Failed to enable the chip: %d\n", ret);
++		ktd202x_chip_disable(chip);
++	}
++
++	return ret;
++}
++
++static bool ktd202x_chip_in_use(struct ktd202x *chip)
++{
++	int i;
++
++	for (i = 0; i < chip->num_leds; i++) {
++		if (chip->leds[i].cdev.brightness)
++			return true;
++	}
++
++	return false;
++}
++
++static int ktd202x_brightness_set(struct ktd202x_led *led,
++				  struct mc_subled *subleds,
++				  unsigned int num_channels)
++{
++	bool mode_blink = false;
++	int channel;
++	int state;
++	int ret;
++	int i;
++
++	if (ktd202x_chip_in_use(led->chip)) {
++		ret = ktd202x_chip_enable(led->chip);
++		if (ret)
++			return ret;
++	}
++
++	ret = regmap_read(led->chip->regmap, KTD202X_REG_CHANNEL_CTRL, &state);
++	if (ret)
++		return ret;
++
++	/*
++	 * In multicolor case, assume blink mode if PWM is set for at least one
++	 * channel because another channel cannot be in state ON at the same time
++	 */
++	for (i = 0; i < num_channels; i++) {
++		int channel_state;
++
++		channel = subleds[i].channel;
++		channel_state = (state >> 2 * channel) & KTD202X_CHANNEL_CTRL_MASK(0);
++		if (channel_state == KTD202X_CHANNEL_CTRL_OFF)
++			continue;
++		mode_blink = channel_state == KTD202X_CHANNEL_CTRL_PWM1(0);
++		break;
++	}
++
++	for (i = 0; i < num_channels; i++) {
++		enum led_brightness brightness;
++		int mode;
++
++		brightness = subleds[i].brightness;
++		channel = subleds[i].channel;
++
++		if (brightness) {
++			/* Register expects brightness between 0 and MAX_BRIGHTNESS - 1 */
++			ret = regmap_write(led->chip->regmap, KTD202X_REG_LED_IOUT(channel),
++					   brightness - 1);
++			if (ret)
++				return ret;
++
++			if (mode_blink)
++				mode = KTD202X_CHANNEL_CTRL_PWM1(channel);
++			else
++				mode = KTD202X_CHANNEL_CTRL_ON(channel);
++		} else {
++			mode = KTD202X_CHANNEL_CTRL_OFF;
++		}
++		ret = regmap_update_bits(led->chip->regmap, KTD202X_REG_CHANNEL_CTRL,
++					 KTD202X_CHANNEL_CTRL_MASK(channel), mode);
++		if (ret)
++			return ret;
++	}
++
++	if (!ktd202x_chip_in_use(led->chip))
++		return ktd202x_chip_disable(led->chip);
++
++	return 0;
++}
++
++static int ktd202x_brightness_single_set(struct led_classdev *cdev,
++					 enum led_brightness value)
++{
++	struct ktd202x_led *led = container_of(cdev, struct ktd202x_led, cdev);
++	struct mc_subled info;
++	int ret;
++
++	cdev->brightness = value;
++
++	mutex_lock(&led->chip->mutex);
++
++	info.brightness = value;
++	info.channel = led->index;
++	ret = ktd202x_brightness_set(led, &info, 1);
++
++	mutex_unlock(&led->chip->mutex);
++
++	return ret;
++}
++
++static int ktd202x_brightness_mc_set(struct led_classdev *cdev,
++				     enum led_brightness value)
++{
++	struct led_classdev_mc *mc = lcdev_to_mccdev(cdev);
++	struct ktd202x_led *led = container_of(mc, struct ktd202x_led, mcdev);
++	int ret;
++
++	cdev->brightness = value;
++
++	mutex_lock(&led->chip->mutex);
++
++	led_mc_calc_color_components(mc, value);
++	ret = ktd202x_brightness_set(led, mc->subled_info, mc->num_colors);
++
++	mutex_unlock(&led->chip->mutex);
++
++	return ret;
++}
++
++static int ktd202x_blink_set(struct ktd202x_led *led, unsigned long *delay_on,
++			     unsigned long *delay_off, struct mc_subled *subleds,
++			     unsigned int num_channels)
++{
++	unsigned long delay_total_ms;
++	int ret, num_steps, on;
++	u8 ctrl_mask = 0;
++	u8 ctrl_pwm1 = 0;
++	u8 ctrl_on = 0;
++	int i;
++
++	mutex_lock(&led->chip->mutex);
++
++	for (i = 0; i < num_channels; i++) {
++		int channel = subleds[i].channel;
++
++		ctrl_mask |= KTD202X_CHANNEL_CTRL_MASK(channel);
++		ctrl_on |= KTD202X_CHANNEL_CTRL_ON(channel);
++		ctrl_pwm1 |= KTD202X_CHANNEL_CTRL_PWM1(channel);
++	}
++
++	/* Never off - brightness is already set, disable blinking */
++	if (!*delay_off) {
++		ret = regmap_update_bits(led->chip->regmap, KTD202X_REG_CHANNEL_CTRL,
++					 ctrl_mask, ctrl_on);
++		goto out;
++	}
++
++	/* Convert into values the HW will understand. */
++
++	/* Integer representation of time of flash period */
++	num_steps = (*delay_on + *delay_off - KTD202X_FLASH_PERIOD_MIN_MS) /
++		    KTD202X_FLASH_PERIOD_STEP_MS;
++	num_steps = clamp(num_steps, 0, KTD202X_FLASH_PERIOD_MAX_STEPS);
++
++	/* Integer representation of percentage of LED ON time */
++	on = (*delay_on * KTD202X_FLASH_ON_MAX) / (*delay_on + *delay_off);
++
++	/* Actually used delay_{on,off} values */
++	delay_total_ms = num_steps * KTD202X_FLASH_PERIOD_STEP_MS + KTD202X_FLASH_PERIOD_MIN_MS;
++	*delay_on = (delay_total_ms * on) / KTD202X_FLASH_ON_MAX;
++	*delay_off = delay_total_ms - *delay_on;
++
++	/* Set timings */
++	ret = regmap_write(led->chip->regmap, KTD202X_REG_FLASH_PERIOD, num_steps);
++	if (ret)
++		goto out;
++
++	ret = regmap_write(led->chip->regmap, KTD202X_REG_PWM1_TIMER, on);
++	if (ret)
++		goto out;
++
++	ret = regmap_update_bits(led->chip->regmap, KTD202X_REG_CHANNEL_CTRL,
++				 ctrl_mask, ctrl_pwm1);
++out:
++	mutex_unlock(&led->chip->mutex);
++	return ret;
++}
++
++static int ktd202x_blink_single_set(struct led_classdev *cdev,
++				    unsigned long *delay_on,
++				    unsigned long *delay_off)
++{
++	struct ktd202x_led *led = container_of(cdev, struct ktd202x_led, cdev);
++	struct mc_subled info;
++	int ret;
++
++	if (!cdev->brightness) {
++		ret = ktd202x_brightness_single_set(cdev, KTD202X_MAX_BRIGHTNESS);
++		if (ret)
++			return ret;
++	}
++
++	/* If no blink specified, default to 1 Hz. */
++	if (!*delay_off && !*delay_on) {
++		*delay_off = 500;
++		*delay_on = 500;
++	}
++
++	/* Never on - just set to off */
++	if (!*delay_on)
++		return ktd202x_brightness_single_set(cdev, LED_OFF);
++
++	info.channel = led->index;
++
++	return ktd202x_blink_set(led, delay_on, delay_off, &info, 1);
++}
++
++static int ktd202x_blink_mc_set(struct led_classdev *cdev,
++				unsigned long *delay_on,
++				unsigned long *delay_off)
++{
++	struct led_classdev_mc *mc = lcdev_to_mccdev(cdev);
++	struct ktd202x_led *led = container_of(mc, struct ktd202x_led, mcdev);
++	int ret;
++
++	if (!cdev->brightness) {
++		ret = ktd202x_brightness_mc_set(cdev, KTD202X_MAX_BRIGHTNESS);
++		if (ret)
++			return ret;
++	}
++
++	/* If no blink specified, default to 1 Hz. */
++	if (!*delay_off && !*delay_on) {
++		*delay_off = 500;
++		*delay_on = 500;
++	}
++
++	/* Never on - just set to off */
++	if (!*delay_on)
++		return ktd202x_brightness_mc_set(cdev, LED_OFF);
++
++	return ktd202x_blink_set(led, delay_on, delay_off, mc->subled_info,
++				 mc->num_colors);
++}
++
++static int ktd202x_setup_led_rgb(struct ktd202x *chip, struct device_node *np,
++				 struct ktd202x_led *led, struct led_init_data *init_data)
++{
++	struct led_classdev *cdev;
++	struct device_node *child;
++	struct mc_subled *info;
++	int num_channels;
++	int i = 0;
++
++	num_channels = of_get_available_child_count(np);
++	if (!num_channels || num_channels > chip->num_leds)
++		return -EINVAL;
++
++	info = devm_kcalloc(chip->dev, num_channels, sizeof(*info), GFP_KERNEL);
++	if (!info)
++		return -ENOMEM;
++
++	for_each_available_child_of_node(np, child) {
++		u32 mono_color;
++		u32 reg;
++		int ret;
++
++		ret = of_property_read_u32(child, "reg", &reg);
++		if (ret != 0 || reg >= chip->num_leds) {
++			dev_err(chip->dev, "invalid 'reg' of %pOFn\n", child);
++			of_node_put(child);
++			return -EINVAL;
++		}
++
++		ret = of_property_read_u32(child, "color", &mono_color);
++		if (ret < 0 && ret != -EINVAL) {
++			dev_err(chip->dev, "failed to parse 'color' of %pOF\n", child);
++			of_node_put(child);
++			return ret;
++		}
++
++		info[i].color_index = mono_color;
++		info[i].channel = reg;
++		info[i].intensity = KTD202X_MAX_BRIGHTNESS;
++		i++;
++	}
++
++	led->mcdev.subled_info = info;
++	led->mcdev.num_colors = num_channels;
++
++	cdev = &led->mcdev.led_cdev;
++	cdev->brightness_set_blocking = ktd202x_brightness_mc_set;
++	cdev->blink_set = ktd202x_blink_mc_set;
++
++	return devm_led_classdev_multicolor_register_ext(chip->dev, &led->mcdev, init_data);
++}
++
++static int ktd202x_setup_led_single(struct ktd202x *chip, struct device_node *np,
++				    struct ktd202x_led *led, struct led_init_data *init_data)
++{
++	struct led_classdev *cdev;
++	u32 reg;
++	int ret;
++
++	ret = of_property_read_u32(np, "reg", &reg);
++	if (ret != 0 || reg >= chip->num_leds) {
++		dev_err(chip->dev, "invalid 'reg' of %pOFn\n", np);
++		return -EINVAL;
++	}
++	led->index = reg;
++
++	cdev = &led->cdev;
++	cdev->brightness_set_blocking = ktd202x_brightness_single_set;
++	cdev->blink_set = ktd202x_blink_single_set;
++
++	return devm_led_classdev_register_ext(chip->dev, &led->cdev, init_data);
++}
++
++static int ktd202x_add_led(struct ktd202x *chip, struct device_node *np, unsigned int index)
++{
++	struct ktd202x_led *led = &chip->leds[index];
++	struct led_init_data init_data = {};
++	struct led_classdev *cdev;
++	u32 color;
++	int ret;
++
++	/* Color property is optional in single color case */
++	ret = of_property_read_u32(np, "color", &color);
++	if (ret < 0 && ret != -EINVAL) {
++		dev_err(chip->dev, "failed to parse 'color' of %pOF\n", np);
++		return ret;
++	}
++
++	led->chip = chip;
++	init_data.fwnode = of_fwnode_handle(np);
++
++	if (color == LED_COLOR_ID_RGB) {
++		cdev = &led->mcdev.led_cdev;
++		ret = ktd202x_setup_led_rgb(chip, np, led, &init_data);
++	} else {
++		cdev = &led->cdev;
++		ret = ktd202x_setup_led_single(chip, np, led, &init_data);
++	}
++
++	if (ret) {
++		dev_err(chip->dev, "unable to register %s\n", cdev->name);
++		return ret;
++	}
++
++	cdev->max_brightness = KTD202X_MAX_BRIGHTNESS;
++
++	return 0;
++}
++
++static int ktd202x_probe_dt(struct ktd202x *chip)
++{
++	struct device_node *np = dev_of_node(chip->dev), *child;
++	int count;
++	int i = 0;
++
++	chip->num_leds = (int)(unsigned long)of_device_get_match_data(chip->dev);
++
++	count = of_get_available_child_count(np);
++	if (!count || count > chip->num_leds)
++		return -EINVAL;
++
++	regmap_write(chip->regmap, KTD202X_REG_RESET_CONTROL, KTD202X_RSTR_RESET);
++
++	/* Allow the device to execute the complete reset */
++	usleep_range(200, 300);
++
++	for_each_available_child_of_node(np, child) {
++		int ret = ktd202x_add_led(chip, child, i);
++
++		if (ret) {
++			of_node_put(child);
++			return ret;
++		}
++		i++;
++	}
++
++	return 0;
++}
++
++static const struct regmap_config ktd202x_regmap_config = {
++	.reg_bits = 8,
++	.val_bits = 8,
++	.max_register = 0x09,
++	.cache_type = REGCACHE_FLAT,
++	.reg_defaults = ktd202x_reg_defaults,
++	.num_reg_defaults = ARRAY_SIZE(ktd202x_reg_defaults),
++};
++
++static int ktd202x_probe(struct i2c_client *client)
++{
++	struct device *dev = &client->dev;
++	struct ktd202x *chip;
++	int count;
++	int ret;
++
++	count = device_get_child_node_count(dev);
++	if (!count || count > KTD202X_MAX_LEDS)
++		return dev_err_probe(dev, -EINVAL, "Incorrect number of leds (%d)", count);
++
++	chip = devm_kzalloc(dev, struct_size(chip, leds, count), GFP_KERNEL);
++	if (!chip)
++		return -ENOMEM;
++
++	chip->dev = dev;
++	i2c_set_clientdata(client, chip);
++
++	chip->regmap = devm_regmap_init_i2c(client, &ktd202x_regmap_config);
++	if (IS_ERR(chip->regmap)) {
++		ret = dev_err_probe(dev, PTR_ERR(chip->regmap),
++				    "Failed to allocate register map.\n");
++		return ret;
++	}
++
++	chip->regulators[0].supply = "vin";
++	chip->regulators[1].supply = "vio";
++	ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(chip->regulators), chip->regulators);
++	if (ret < 0) {
++		dev_err_probe(dev, ret, "Failed to request regulators.\n");
++		return ret;
++	}
++
++	ret = regulator_bulk_enable(ARRAY_SIZE(chip->regulators), chip->regulators);
++	if (ret) {
++		dev_err_probe(dev, ret, "Failed to enable regulators.\n");
++		return ret;
++	}
++
++	ret = ktd202x_probe_dt(chip);
++	if (ret < 0) {
++		regulator_bulk_disable(ARRAY_SIZE(chip->regulators), chip->regulators);
++		return ret;
++	}
++
++	ret = regulator_bulk_disable(ARRAY_SIZE(chip->regulators), chip->regulators);
++	if (ret) {
++		dev_err_probe(dev, ret, "Failed to disable regulators.\n");
++		return ret;
++	}
++
++	mutex_init(&chip->mutex);
++
++	return 0;
++}
++
++static void ktd202x_remove(struct i2c_client *client)
++{
++	struct ktd202x *chip = i2c_get_clientdata(client);
++
++	ktd202x_chip_disable(chip);
++
++	mutex_destroy(&chip->mutex);
++}
++
++static void ktd202x_shutdown(struct i2c_client *client)
++{
++	struct ktd202x *chip = i2c_get_clientdata(client);
++
++	/* Reset registers to make sure all LEDs are off before shutdown */
++	regmap_write(chip->regmap, KTD202X_REG_RESET_CONTROL, KTD202X_RSTR_RESET);
++}
++
++static const struct of_device_id ktd202x_match_table[] = {
++	{ .compatible = "kinetic,ktd2026", .data = (void *)KTD2026_NUM_LEDS },
++	{ .compatible = "kinetic,ktd2027", .data = (void *)KTD2027_NUM_LEDS },
++	{},
++};
++MODULE_DEVICE_TABLE(of, ktd202x_match_table);
++
++static struct i2c_driver ktd202x_driver = {
++	.driver = {
++		.name = "leds-ktd202x",
++		.of_match_table = ktd202x_match_table,
++	},
++	.probe = ktd202x_probe,
++	.remove = ktd202x_remove,
++	.shutdown = ktd202x_shutdown,
++};
++module_i2c_driver(ktd202x_driver);
++
++MODULE_AUTHOR("André Apitzsch <git@apitzsch.eu>");
++MODULE_DESCRIPTION("Kinetic KTD2026/7 LED driver");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/generic/backport-6.6/861-v6.10-leds-rgb-leds-ktd202x-get-device-properties-through-fwnode.patch b/target/linux/generic/backport-6.6/861-v6.10-leds-rgb-leds-ktd202x-get-device-properties-through-fwnode.patch
new file mode 100644
index 00000000000000..92b20c3b9c2ea2
--- /dev/null
+++ b/target/linux/generic/backport-6.6/861-v6.10-leds-rgb-leds-ktd202x-get-device-properties-through-fwnode.patch
@@ -0,0 +1,221 @@
+From f14aa5ea415b8add245e976bfab96a12986c6843 Mon Sep 17 00:00:00 2001
+From: Kate Hsuan <hpa@redhat.com>
+Date: Fri, 31 May 2024 13:41:19 +0200
+Subject: leds: rgb: leds-ktd202x: Get device properties through fwnode to
+ support ACPI
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This LED controller is installed on a Xiaomi pad2 and it is an x86
+platform. The original driver is based on the device tree and can't be
+used for this ACPI based system. This patch migrated the driver to use
+fwnode to access the properties. Moreover, the fwnode API supports the
+device tree so this work won't affect the original implementations.
+
+Signed-off-by: Kate Hsuan <hpa@redhat.com>
+Tested-by: André Apitzsch <git@apitzsch.eu> # on BQ Aquaris M5
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20240531114124.45346-2-hdegoede@redhat.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+---
+ drivers/leds/rgb/Kconfig        |  1 -
+ drivers/leds/rgb/leds-ktd202x.c | 64 ++++++++++++++++++++++-------------------
+ 2 files changed, 34 insertions(+), 31 deletions(-)
+
+(limited to 'drivers/leds/rgb')
+
+--- a/drivers/leds/rgb/Kconfig
++++ b/drivers/leds/rgb/Kconfig
+@@ -17,7 +17,6 @@ config LEDS_GROUP_MULTICOLOR
+ config LEDS_KTD202X
+ 	tristate "LED support for KTD202x Chips"
+ 	depends on I2C
+-	depends on OF
+ 	select REGMAP_I2C
+ 	help
+ 	  This option enables support for the Kinetic KTD2026/KTD2027
+--- a/drivers/leds/rgb/leds-ktd202x.c
++++ b/drivers/leds/rgb/leds-ktd202x.c
+@@ -99,7 +99,7 @@ struct ktd202x {
+ 	struct device *dev;
+ 	struct regmap *regmap;
+ 	bool enabled;
+-	int num_leds;
++	unsigned long num_leds;
+ 	struct ktd202x_led leds[] __counted_by(num_leds);
+ };
+ 
+@@ -381,16 +381,19 @@ static int ktd202x_blink_mc_set(struct l
+ 				 mc->num_colors);
+ }
+ 
+-static int ktd202x_setup_led_rgb(struct ktd202x *chip, struct device_node *np,
++static int ktd202x_setup_led_rgb(struct ktd202x *chip, struct fwnode_handle *fwnode,
+ 				 struct ktd202x_led *led, struct led_init_data *init_data)
+ {
++	struct fwnode_handle *child;
+ 	struct led_classdev *cdev;
+-	struct device_node *child;
+ 	struct mc_subled *info;
+ 	int num_channels;
+ 	int i = 0;
+ 
+-	num_channels = of_get_available_child_count(np);
++	num_channels = 0;
++	fwnode_for_each_available_child_node(fwnode, child)
++		num_channels++;
++
+ 	if (!num_channels || num_channels > chip->num_leds)
+ 		return -EINVAL;
+ 
+@@ -398,22 +401,22 @@ static int ktd202x_setup_led_rgb(struct
+ 	if (!info)
+ 		return -ENOMEM;
+ 
+-	for_each_available_child_of_node(np, child) {
++	fwnode_for_each_available_child_node(fwnode, child) {
+ 		u32 mono_color;
+ 		u32 reg;
+ 		int ret;
+ 
+-		ret = of_property_read_u32(child, "reg", &reg);
++		ret = fwnode_property_read_u32(child, "reg", &reg);
+ 		if (ret != 0 || reg >= chip->num_leds) {
+-			dev_err(chip->dev, "invalid 'reg' of %pOFn\n", child);
+-			of_node_put(child);
+-			return -EINVAL;
++			dev_err(chip->dev, "invalid 'reg' of %pfw\n", child);
++			fwnode_handle_put(child);
++			return ret;
+ 		}
+ 
+-		ret = of_property_read_u32(child, "color", &mono_color);
++		ret = fwnode_property_read_u32(child, "color", &mono_color);
+ 		if (ret < 0 && ret != -EINVAL) {
+-			dev_err(chip->dev, "failed to parse 'color' of %pOF\n", child);
+-			of_node_put(child);
++			dev_err(chip->dev, "failed to parse 'color' of %pfw\n", child);
++			fwnode_handle_put(child);
+ 			return ret;
+ 		}
+ 
+@@ -433,16 +436,16 @@ static int ktd202x_setup_led_rgb(struct
+ 	return devm_led_classdev_multicolor_register_ext(chip->dev, &led->mcdev, init_data);
+ }
+ 
+-static int ktd202x_setup_led_single(struct ktd202x *chip, struct device_node *np,
++static int ktd202x_setup_led_single(struct ktd202x *chip, struct fwnode_handle *fwnode,
+ 				    struct ktd202x_led *led, struct led_init_data *init_data)
+ {
+ 	struct led_classdev *cdev;
+ 	u32 reg;
+ 	int ret;
+ 
+-	ret = of_property_read_u32(np, "reg", &reg);
++	ret = fwnode_property_read_u32(fwnode, "reg", &reg);
+ 	if (ret != 0 || reg >= chip->num_leds) {
+-		dev_err(chip->dev, "invalid 'reg' of %pOFn\n", np);
++		dev_err(chip->dev, "invalid 'reg' of %pfw\n", fwnode);
+ 		return -EINVAL;
+ 	}
+ 	led->index = reg;
+@@ -454,7 +457,7 @@ static int ktd202x_setup_led_single(stru
+ 	return devm_led_classdev_register_ext(chip->dev, &led->cdev, init_data);
+ }
+ 
+-static int ktd202x_add_led(struct ktd202x *chip, struct device_node *np, unsigned int index)
++static int ktd202x_add_led(struct ktd202x *chip, struct fwnode_handle *fwnode, unsigned int index)
+ {
+ 	struct ktd202x_led *led = &chip->leds[index];
+ 	struct led_init_data init_data = {};
+@@ -463,21 +466,21 @@ static int ktd202x_add_led(struct ktd202
+ 	int ret;
+ 
+ 	/* Color property is optional in single color case */
+-	ret = of_property_read_u32(np, "color", &color);
++	ret = fwnode_property_read_u32(fwnode, "color", &color);
+ 	if (ret < 0 && ret != -EINVAL) {
+-		dev_err(chip->dev, "failed to parse 'color' of %pOF\n", np);
++		dev_err(chip->dev, "failed to parse 'color' of %pfw\n", fwnode);
+ 		return ret;
+ 	}
+ 
+ 	led->chip = chip;
+-	init_data.fwnode = of_fwnode_handle(np);
++	init_data.fwnode = fwnode;
+ 
+ 	if (color == LED_COLOR_ID_RGB) {
+ 		cdev = &led->mcdev.led_cdev;
+-		ret = ktd202x_setup_led_rgb(chip, np, led, &init_data);
++		ret = ktd202x_setup_led_rgb(chip, fwnode, led, &init_data);
+ 	} else {
+ 		cdev = &led->cdev;
+-		ret = ktd202x_setup_led_single(chip, np, led, &init_data);
++		ret = ktd202x_setup_led_single(chip, fwnode, led, &init_data);
+ 	}
+ 
+ 	if (ret) {
+@@ -490,15 +493,14 @@ static int ktd202x_add_led(struct ktd202
+ 	return 0;
+ }
+ 
+-static int ktd202x_probe_dt(struct ktd202x *chip)
++static int ktd202x_probe_fw(struct ktd202x *chip)
+ {
+-	struct device_node *np = dev_of_node(chip->dev), *child;
++	struct fwnode_handle *child;
++	struct device *dev = chip->dev;
+ 	int count;
+ 	int i = 0;
+ 
+-	chip->num_leds = (int)(unsigned long)of_device_get_match_data(chip->dev);
+-
+-	count = of_get_available_child_count(np);
++	count = device_get_child_node_count(dev);
+ 	if (!count || count > chip->num_leds)
+ 		return -EINVAL;
+ 
+@@ -507,11 +509,11 @@ static int ktd202x_probe_dt(struct ktd20
+ 	/* Allow the device to execute the complete reset */
+ 	usleep_range(200, 300);
+ 
+-	for_each_available_child_of_node(np, child) {
++	device_for_each_child_node(dev, child) {
+ 		int ret = ktd202x_add_led(chip, child, i);
+ 
+ 		if (ret) {
+-			of_node_put(child);
++			fwnode_handle_put(child);
+ 			return ret;
+ 		}
+ 		i++;
+@@ -554,6 +556,8 @@ static int ktd202x_probe(struct i2c_clie
+ 		return ret;
+ 	}
+ 
++	chip->num_leds = (unsigned long)i2c_get_match_data(client);
++
+ 	chip->regulators[0].supply = "vin";
+ 	chip->regulators[1].supply = "vio";
+ 	ret = devm_regulator_bulk_get(dev, ARRAY_SIZE(chip->regulators), chip->regulators);
+@@ -568,7 +572,7 @@ static int ktd202x_probe(struct i2c_clie
+ 		return ret;
+ 	}
+ 
+-	ret = ktd202x_probe_dt(chip);
++	ret = ktd202x_probe_fw(chip);
+ 	if (ret < 0) {
+ 		regulator_bulk_disable(ARRAY_SIZE(chip->regulators), chip->regulators);
+ 		return ret;
+@@ -605,7 +609,7 @@ static void ktd202x_shutdown(struct i2c_
+ static const struct of_device_id ktd202x_match_table[] = {
+ 	{ .compatible = "kinetic,ktd2026", .data = (void *)KTD2026_NUM_LEDS },
+ 	{ .compatible = "kinetic,ktd2027", .data = (void *)KTD2027_NUM_LEDS },
+-	{},
++	{}
+ };
+ MODULE_DEVICE_TABLE(of, ktd202x_match_table);
+ 
diff --git a/target/linux/generic/backport-6.6/862-v6.10-leds-rgb-leds-ktd202x-i2c-id-tables-for-ktd2026-and-2027.patch b/target/linux/generic/backport-6.6/862-v6.10-leds-rgb-leds-ktd202x-i2c-id-tables-for-ktd2026-and-2027.patch
new file mode 100644
index 00000000000000..223ccd8f50c764
--- /dev/null
+++ b/target/linux/generic/backport-6.6/862-v6.10-leds-rgb-leds-ktd202x-i2c-id-tables-for-ktd2026-and-2027.patch
@@ -0,0 +1,49 @@
+From 75bd07aef47e1a984229e6ec702e8b9aee0226e4 Mon Sep 17 00:00:00 2001
+From: Kate Hsuan <hpa@redhat.com>
+Date: Fri, 31 May 2024 13:41:20 +0200
+Subject: leds: rgb: leds-ktd202x: I2C ID tables for KTD2026 and 2027
+
+Add an i2c_device_id id_table to match manually instantiated
+(non device-tree / ACPI instantiated) KTD202x controllers as
+found on some x86 boards.
+
+This table shows the maximum support LED channel for KTD2026
+(three LEDs) and KTD-2027 (4 LEDs).
+
+Link: https://www.kinet-ic.com/uploads/KTD2026-7-04h.pdf
+Signed-off-by: Kate Hsuan <hpa@redhat.com>
+Reviewed-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Link: https://lore.kernel.org/r/20240531114124.45346-3-hdegoede@redhat.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+---
+ drivers/leds/rgb/leds-ktd202x.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+(limited to 'drivers/leds/rgb')
+
+--- a/drivers/leds/rgb/leds-ktd202x.c
++++ b/drivers/leds/rgb/leds-ktd202x.c
+@@ -606,6 +606,13 @@ static void ktd202x_shutdown(struct i2c_
+ 	regmap_write(chip->regmap, KTD202X_REG_RESET_CONTROL, KTD202X_RSTR_RESET);
+ }
+ 
++static const struct i2c_device_id ktd202x_id[] = {
++	{"ktd2026", KTD2026_NUM_LEDS},
++	{"ktd2027", KTD2027_NUM_LEDS},
++	{}
++};
++MODULE_DEVICE_TABLE(i2c, ktd202x_id);
++
+ static const struct of_device_id ktd202x_match_table[] = {
+ 	{ .compatible = "kinetic,ktd2026", .data = (void *)KTD2026_NUM_LEDS },
+ 	{ .compatible = "kinetic,ktd2027", .data = (void *)KTD2027_NUM_LEDS },
+@@ -621,6 +628,7 @@ static struct i2c_driver ktd202x_driver
+ 	.probe = ktd202x_probe,
+ 	.remove = ktd202x_remove,
+ 	.shutdown = ktd202x_shutdown,
++	.id_table = ktd202x_id,
+ };
+ module_i2c_driver(ktd202x_driver);
+ 
diff --git a/target/linux/generic/backport-6.6/863-v6.10-leds-rgb-leds-ktd202x-initialize-mutex-earlier.patch b/target/linux/generic/backport-6.6/863-v6.10-leds-rgb-leds-ktd202x-initialize-mutex-earlier.patch
new file mode 100644
index 00000000000000..533b0f0e170749
--- /dev/null
+++ b/target/linux/generic/backport-6.6/863-v6.10-leds-rgb-leds-ktd202x-initialize-mutex-earlier.patch
@@ -0,0 +1,62 @@
+From e1b08c6f5b92d408a9fcc1030a340caeb9852250 Mon Sep 17 00:00:00 2001
+From: Hans de Goede <hdegoede@redhat.com>
+Date: Fri, 31 May 2024 13:41:21 +0200
+Subject: leds: rgb: leds-ktd202x: Initialize mutex earlier
+
+The mutex must be initialized before the LED class device is registered
+otherwise there is a race where it may get used before it is initialized:
+
+ DEBUG_LOCKS_WARN_ON(lock->magic != lock)
+ WARNING: CPU: 2 PID: 2045 at kernel/locking/mutex.c:587 __mutex_lock
+ ...
+ RIP: 0010:__mutex_lock+0x7db/0xc10
+ ...
+ set_brightness_delayed_set_brightness.part.0+0x17/0x60
+ set_brightness_delayed+0xf1/0x100
+ process_one_work+0x222/0x5a0
+
+Move the mutex_init() call earlier to avoid this race condition and
+switch to devm_mutex_init() to avoid the need to add error-exit
+cleanup to probe() if probe() fails later on.
+
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+Reviewed-by: Andy Shevchenko <andy@kernel.org>
+Link: https://lore.kernel.org/r/20240531114124.45346-4-hdegoede@redhat.com
+Signed-off-by: Lee Jones <lee@kernel.org>
+---
+ drivers/leds/rgb/leds-ktd202x.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+(limited to 'drivers/leds/rgb')
+
+--- a/drivers/leds/rgb/leds-ktd202x.c
++++ b/drivers/leds/rgb/leds-ktd202x.c
+@@ -556,6 +556,10 @@ static int ktd202x_probe(struct i2c_clie
+ 		return ret;
+ 	}
+ 
++	ret = devm_mutex_init(dev, &chip->mutex);
++	if (ret)
++		return ret;
++
+ 	chip->num_leds = (unsigned long)i2c_get_match_data(client);
+ 
+ 	chip->regulators[0].supply = "vin";
+@@ -584,8 +588,6 @@ static int ktd202x_probe(struct i2c_clie
+ 		return ret;
+ 	}
+ 
+-	mutex_init(&chip->mutex);
+-
+ 	return 0;
+ }
+ 
+@@ -594,8 +596,6 @@ static void ktd202x_remove(struct i2c_cl
+ 	struct ktd202x *chip = i2c_get_clientdata(client);
+ 
+ 	ktd202x_chip_disable(chip);
+-
+-	mutex_destroy(&chip->mutex);
+ }
+ 
+ static void ktd202x_shutdown(struct i2c_client *client)
diff --git a/target/linux/generic/backport-6.6/870-v6.7-01-PCI-dwc-Add-host_post_init-callback.patch b/target/linux/generic/backport-6.6/870-v6.7-01-PCI-dwc-Add-host_post_init-callback.patch
new file mode 100644
index 00000000000000..d70c65225efbcc
--- /dev/null
+++ b/target/linux/generic/backport-6.6/870-v6.7-01-PCI-dwc-Add-host_post_init-callback.patch
@@ -0,0 +1,42 @@
+From a78794562fcb2659c976388b1285eddda97e9954 Mon Sep 17 00:00:00 2001
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Date: Tue, 10 Oct 2023 21:29:13 +0530
+Subject: [PATCH] PCI: dwc: Add host_post_init() callback
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This callback can be used by the platform drivers to do configuration
+once all the devices are scanned. Like changing LNKCTL of all downstream
+devices to enable ASPM etc...
+
+Link: https://lore.kernel.org/linux-pci/20231010155914.9516-2-manivannan.sadhasivam@linaro.org
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-designware-host.c | 3 +++
+ drivers/pci/controller/dwc/pcie-designware.h      | 1 +
+ 2 files changed, 4 insertions(+)
+
+--- a/drivers/pci/controller/dwc/pcie-designware-host.c
++++ b/drivers/pci/controller/dwc/pcie-designware-host.c
+@@ -502,6 +502,9 @@ int dw_pcie_host_init(struct dw_pcie_rp
+ 	if (ret)
+ 		goto err_stop_link;
+ 
++	if (pp->ops->host_post_init)
++		pp->ops->host_post_init(pp);
++
+ 	return 0;
+ 
+ err_stop_link:
+--- a/drivers/pci/controller/dwc/pcie-designware.h
++++ b/drivers/pci/controller/dwc/pcie-designware.h
+@@ -301,6 +301,7 @@ enum dw_pcie_ltssm {
+ struct dw_pcie_host_ops {
+ 	int (*host_init)(struct dw_pcie_rp *pp);
+ 	void (*host_deinit)(struct dw_pcie_rp *pp);
++	void (*host_post_init)(struct dw_pcie_rp *pp);
+ 	int (*msi_host_init)(struct dw_pcie_rp *pp);
+ 	void (*pme_turn_off)(struct dw_pcie_rp *pp);
+ };
diff --git a/target/linux/generic/backport-6.6/870-v6.7-02-PCI-qcom-Enable-ASPM-for-platforms-supporting-1.9.0-.patch b/target/linux/generic/backport-6.6/870-v6.7-02-PCI-qcom-Enable-ASPM-for-platforms-supporting-1.9.0-.patch
new file mode 100644
index 00000000000000..7fdede52f49661
--- /dev/null
+++ b/target/linux/generic/backport-6.6/870-v6.7-02-PCI-qcom-Enable-ASPM-for-platforms-supporting-1.9.0-.patch
@@ -0,0 +1,102 @@
+From 9f4f3dfad8cf08208fbb78b1b9cbf957c12618b9 Mon Sep 17 00:00:00 2001
+From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Date: Tue, 10 Oct 2023 21:29:14 +0530
+Subject: [PATCH] PCI: qcom: Enable ASPM for platforms supporting 1.9.0 ops
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+ASPM is supported by Qcom host controllers/bridges on most of the recent
+platforms and so the devices tested so far. But for enabling ASPM by
+default (without using Kconfig, kernel command-line or sysfs), BIOS has
+to enable ASPM on both host bridge and downstream devices during boot.
+
+Unfortunately, none of the BIOS available on Qcom platforms enables
+ASPM. Due to this, the platforms making use of Qcom SoCs draw high power
+during runtime.
+
+To fix this power draw issue, users have to enable ASPM using Kconfig,
+kernel command-line, sysfs or the BIOS has to start enabling ASPM.
+
+The latter may happen in the future, but that won't address the issue on
+current platforms. Also, asking users to enable a feature to get the power
+management right would provide an unpleasant out-of-the-box experience.
+
+So the apt solution is to enable ASPM in the controller driver itself. And
+this is being accomplished by calling pci_enable_link_state() in the newly
+introduced host_post_init() callback for all the devices connected to the
+bus. This function enables all supported link low power states for both
+host bridge and the downstream devices.
+
+Due to limited testing, ASPM is only enabled for platforms making use of
+ops_1_9_0 callbacks.
+
+[kwilczynski: commit log]
+Link: https://lore.kernel.org/linux-pci/20231010155914.9516-3-manivannan.sadhasivam@linaro.org
+Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
+Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
+---
+ drivers/pci/controller/dwc/pcie-qcom.c | 28 ++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -222,6 +222,7 @@ struct qcom_pcie_ops {
+ 	int (*get_resources)(struct qcom_pcie *pcie);
+ 	int (*init)(struct qcom_pcie *pcie);
+ 	int (*post_init)(struct qcom_pcie *pcie);
++	void (*host_post_init)(struct qcom_pcie *pcie);
+ 	void (*deinit)(struct qcom_pcie *pcie);
+ 	void (*ltssm_enable)(struct qcom_pcie *pcie);
+ 	int (*config_sid)(struct qcom_pcie *pcie);
+@@ -966,6 +967,22 @@ static int qcom_pcie_post_init_2_7_0(str
+ 	return 0;
+ }
+ 
++static int qcom_pcie_enable_aspm(struct pci_dev *pdev, void *userdata)
++{
++	/* Downstream devices need to be in D0 state before enabling PCI PM substates */
++	pci_set_power_state(pdev, PCI_D0);
++	pci_enable_link_state(pdev, PCIE_LINK_STATE_ALL);
++
++	return 0;
++}
++
++static void qcom_pcie_host_post_init_2_7_0(struct qcom_pcie *pcie)
++{
++	struct dw_pcie_rp *pp = &pcie->pci->pp;
++
++	pci_walk_bus(pp->bridge->bus, qcom_pcie_enable_aspm, NULL);
++}
++
+ static void qcom_pcie_deinit_2_7_0(struct qcom_pcie *pcie)
+ {
+ 	struct qcom_pcie_resources_2_7_0 *res = &pcie->res.v2_7_0;
+@@ -1224,9 +1241,19 @@ static void qcom_pcie_host_deinit(struct
+ 	pcie->cfg->ops->deinit(pcie);
+ }
+ 
++static void qcom_pcie_host_post_init(struct dw_pcie_rp *pp)
++{
++	struct dw_pcie *pci = to_dw_pcie_from_pp(pp);
++	struct qcom_pcie *pcie = to_qcom_pcie(pci);
++
++	if (pcie->cfg->ops->host_post_init)
++		pcie->cfg->ops->host_post_init(pcie);
++}
++
+ static const struct dw_pcie_host_ops qcom_pcie_dw_ops = {
+ 	.host_init	= qcom_pcie_host_init,
+ 	.host_deinit	= qcom_pcie_host_deinit,
++	.host_post_init	= qcom_pcie_host_post_init,
+ };
+ 
+ /* Qcom IP rev.: 2.1.0	Synopsys IP rev.: 4.01a */
+@@ -1288,6 +1315,7 @@ static const struct qcom_pcie_ops ops_1_
+ 	.get_resources = qcom_pcie_get_resources_2_7_0,
+ 	.init = qcom_pcie_init_2_7_0,
+ 	.post_init = qcom_pcie_post_init_2_7_0,
++	.host_post_init = qcom_pcie_host_post_init_2_7_0,
+ 	.deinit = qcom_pcie_deinit_2_7_0,
+ 	.ltssm_enable = qcom_pcie_2_3_2_ltssm_enable,
+ 	.config_sid = qcom_pcie_config_sid_1_9_0,
diff --git a/target/linux/generic/backport-6.6/880-v6.14-gpio-regmap-Use-generic-request-free-ops.patch b/target/linux/generic/backport-6.6/880-v6.14-gpio-regmap-Use-generic-request-free-ops.patch
new file mode 100644
index 00000000000000..f9299f973370aa
--- /dev/null
+++ b/target/linux/generic/backport-6.6/880-v6.14-gpio-regmap-Use-generic-request-free-ops.patch
@@ -0,0 +1,30 @@
+From b0fa00fe38f673c986633c11087274deeb7ce7b0 Mon Sep 17 00:00:00 2001
+From: Sander Vanheule <sander@svanheule.net>
+Date: Tue, 7 Jan 2025 21:16:20 +0100
+Subject: [PATCH] gpio: regmap: Use generic request/free ops
+
+Set the gpiochip request and free ops to the generic implementations.
+This way a user can provide a gpio-ranges property defined for a pinmux,
+easing muxing of gpio functions. Provided that the pin controller
+implementents the pinmux op .gpio_request_enable(), pins will
+automatically be muxed to their GPIO function when requested.
+
+Signed-off-by: Sander Vanheule <sander@svanheule.net>
+Acked-by: Michael Walle <mwalle@kernel.org>
+Link: https://lore.kernel.org/r/20250107201621.12467-1-sander@svanheule.net
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+---
+ drivers/gpio/gpio-regmap.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpio/gpio-regmap.c
++++ b/drivers/gpio/gpio-regmap.c
+@@ -262,6 +262,8 @@ struct gpio_regmap *gpio_regmap_register
+ 	chip->label = config->label ?: dev_name(config->parent);
+ 	chip->can_sleep = regmap_might_sleep(config->regmap);
+ 
++	chip->request = gpiochip_generic_request;
++	chip->free = gpiochip_generic_free;
+ 	chip->get = gpio_regmap_get;
+ 	if (gpio->reg_set_base && gpio->reg_clr_base)
+ 		chip->set = gpio_regmap_set_with_clear;
diff --git a/target/linux/generic/backport-6.6/896-01-v6.9-net-dsa-mv88e6xxx-rename-mv88e6xxx_g2_scratch_gpio_s.patch b/target/linux/generic/backport-6.6/896-01-v6.9-net-dsa-mv88e6xxx-rename-mv88e6xxx_g2_scratch_gpio_s.patch
index 48dd6ffb6755ab..7e71e49dfa33df 100644
--- a/target/linux/generic/backport-6.6/896-01-v6.9-net-dsa-mv88e6xxx-rename-mv88e6xxx_g2_scratch_gpio_s.patch
+++ b/target/linux/generic/backport-6.6/896-01-v6.9-net-dsa-mv88e6xxx-rename-mv88e6xxx_g2_scratch_gpio_s.patch
@@ -19,7 +19,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
-@@ -3669,7 +3669,7 @@ static int mv88e6xxx_mdio_register(struc
+@@ -3725,7 +3725,7 @@ static int mv88e6xxx_mdio_register(struc
  
  	if (external) {
  		mv88e6xxx_reg_lock(chip);
diff --git a/target/linux/generic/backport-6.6/896-02-v6.9-net-dsa-mv88e6xxx-add-Amethyst-specific-SMI-GPIO-fun.patch b/target/linux/generic/backport-6.6/896-02-v6.9-net-dsa-mv88e6xxx-add-Amethyst-specific-SMI-GPIO-fun.patch
index e5931573f78807..4fac0e2a13ae55 100644
--- a/target/linux/generic/backport-6.6/896-02-v6.9-net-dsa-mv88e6xxx-add-Amethyst-specific-SMI-GPIO-fun.patch
+++ b/target/linux/generic/backport-6.6/896-02-v6.9-net-dsa-mv88e6xxx-add-Amethyst-specific-SMI-GPIO-fun.patch
@@ -27,7 +27,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
-@@ -3669,7 +3669,10 @@ static int mv88e6xxx_mdio_register(struc
+@@ -3725,7 +3725,10 @@ static int mv88e6xxx_mdio_register(struc
  
  	if (external) {
  		mv88e6xxx_reg_lock(chip);
diff --git a/target/linux/generic/backport-6.6/900-v6.11-net-free_netdev-exit-earlier-if-dummy.patch b/target/linux/generic/backport-6.6/900-v6.11-net-free_netdev-exit-earlier-if-dummy.patch
index 9e38d88e22bf36..da054ef8ec7abe 100644
--- a/target/linux/generic/backport-6.6/900-v6.11-net-free_netdev-exit-earlier-if-dummy.patch
+++ b/target/linux/generic/backport-6.6/900-v6.11-net-free_netdev-exit-earlier-if-dummy.patch
@@ -23,7 +23,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net>
 
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -10979,7 +10979,8 @@ void free_netdev(struct net_device *dev)
+@@ -11032,7 +11032,8 @@ void free_netdev(struct net_device *dev)
  	dev->xdp_bulkq = NULL;
  
  	/*  Compatibility with error handling in drivers */
diff --git a/target/linux/generic/backport-6.6/901-v6.13-net-dsa-mv88e6xxx-Support-LED-control.patch b/target/linux/generic/backport-6.6/901-v6.13-net-dsa-mv88e6xxx-Support-LED-control.patch
index 8557fe2510b8a2..4bb219ecfcf27b 100644
--- a/target/linux/generic/backport-6.6/901-v6.13-net-dsa-mv88e6xxx-Support-LED-control.patch
+++ b/target/linux/generic/backport-6.6/901-v6.13-net-dsa-mv88e6xxx-Support-LED-control.patch
@@ -127,7 +127,7 @@ Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
  #include <linux/netdevice.h>
  #include <linux/gpio/consumer.h>
  #include <linux/phylink.h>
-@@ -3235,14 +3236,43 @@ static int mv88e6xxx_setup_upstream_port
+@@ -3276,14 +3277,43 @@ static int mv88e6xxx_setup_upstream_port
  static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)
  {
  	struct device_node *phy_handle = NULL;
@@ -173,7 +173,7 @@ Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
  
  	err = mv88e6xxx_port_setup_mac(chip, port, LINK_UNFORCED,
  				       SPEED_UNFORCED, DUPLEX_UNFORCED,
-@@ -4461,6 +4491,7 @@ static const struct mv88e6xxx_ops mv88e6
+@@ -4517,6 +4547,7 @@ static const struct mv88e6xxx_ops mv88e6
  	.port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit,
  	.port_disable_pri_override = mv88e6xxx_port_disable_pri_override,
  	.port_get_cmode = mv88e6352_port_get_cmode,
@@ -181,7 +181,7 @@ Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
  	.port_setup_message_port = mv88e6xxx_setup_message_port,
  	.stats_snapshot = mv88e6320_g1_stats_snapshot,
  	.stats_set_histogram = mv88e6095_g1_stats_set_histogram,
-@@ -4563,6 +4594,7 @@ static const struct mv88e6xxx_ops mv88e6
+@@ -4619,6 +4650,7 @@ static const struct mv88e6xxx_ops mv88e6
  	.port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit,
  	.port_disable_pri_override = mv88e6xxx_port_disable_pri_override,
  	.port_get_cmode = mv88e6352_port_get_cmode,
@@ -189,7 +189,7 @@ Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
  	.port_setup_message_port = mv88e6xxx_setup_message_port,
  	.stats_snapshot = mv88e6320_g1_stats_snapshot,
  	.stats_set_histogram = mv88e6095_g1_stats_set_histogram,
-@@ -4838,6 +4870,7 @@ static const struct mv88e6xxx_ops mv88e6
+@@ -4894,6 +4926,7 @@ static const struct mv88e6xxx_ops mv88e6
  	.port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit,
  	.port_disable_pri_override = mv88e6xxx_port_disable_pri_override,
  	.port_get_cmode = mv88e6352_port_get_cmode,
@@ -197,7 +197,7 @@ Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
  	.port_setup_message_port = mv88e6xxx_setup_message_port,
  	.stats_snapshot = mv88e6320_g1_stats_snapshot,
  	.stats_set_histogram = mv88e6095_g1_stats_set_histogram,
-@@ -5260,6 +5293,7 @@ static const struct mv88e6xxx_ops mv88e6
+@@ -5324,6 +5357,7 @@ static const struct mv88e6xxx_ops mv88e6
  	.port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit,
  	.port_disable_pri_override = mv88e6xxx_port_disable_pri_override,
  	.port_get_cmode = mv88e6352_port_get_cmode,
@@ -217,7 +217,7 @@ Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
  #include <linux/ptp_clock_kernel.h>
  #include <linux/timecounter.h>
  #include <net/dsa.h>
-@@ -275,6 +277,7 @@ struct mv88e6xxx_vlan {
+@@ -276,6 +278,7 @@ struct mv88e6xxx_vlan {
  struct mv88e6xxx_port {
  	struct mv88e6xxx_chip *chip;
  	int port;
@@ -225,7 +225,7 @@ Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
  	struct mv88e6xxx_vlan bridge_pvid;
  	u64 serdes_stats[2];
  	u64 atu_member_violation;
-@@ -289,6 +292,11 @@ struct mv88e6xxx_port {
+@@ -290,6 +293,11 @@ struct mv88e6xxx_port {
  	struct devlink_region *region;
  	void *pcs_private;
  
@@ -237,7 +237,7 @@ Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
  	/* MacAuth Bypass control flag */
  	bool mab;
  };
-@@ -561,6 +569,9 @@ struct mv88e6xxx_ops {
+@@ -563,6 +571,9 @@ struct mv88e6xxx_ops {
  			      phy_interface_t mode);
  	int (*port_get_cmode)(struct mv88e6xxx_chip *chip, int port, u8 *cmode);
  
diff --git a/target/linux/generic/backport-6.6/903-v6.12-Bluetooth-btsdio-Do-not-bind-to-non-removable-CYW437.patch b/target/linux/generic/backport-6.6/903-v6.12-Bluetooth-btsdio-Do-not-bind-to-non-removable-CYW437.patch
new file mode 100644
index 00000000000000..09c3938ff5db5e
--- /dev/null
+++ b/target/linux/generic/backport-6.6/903-v6.12-Bluetooth-btsdio-Do-not-bind-to-non-removable-CYW437.patch
@@ -0,0 +1,25 @@
+From 6a9eb32230f33ae273f6ffbabb0aaf560869816e Mon Sep 17 00:00:00 2001
+From: Scott Ehlert <ehlert@battelle.org>
+Date: Mon, 29 Apr 2024 11:23:09 -0700
+Subject: [PATCH] Bluetooth: btsdio: Do not bind to non-removable CYW4373
+
+CYW4373 devices soldered onto the PCB (non-removable),
+use a UART connection for Bluetooth and the advertised btsdio
+support as an SDIO function should be ignored.
+
+Signed-off-by: Scott Ehlert <ehlert@battelle.org>
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+---
+ drivers/bluetooth/btsdio.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/bluetooth/btsdio.c
++++ b/drivers/bluetooth/btsdio.c
+@@ -295,6 +295,7 @@ static int btsdio_probe(struct sdio_func
+ 		case SDIO_DEVICE_ID_BROADCOM_4345:
+ 		case SDIO_DEVICE_ID_BROADCOM_43455:
+ 		case SDIO_DEVICE_ID_BROADCOM_4356:
++		case SDIO_DEVICE_ID_BROADCOM_CYPRESS_4373:
+ 			return -ENODEV;
+ 		}
+ 	}
diff --git a/target/linux/generic/backport-6.6/906-01-v6.7-crypto-jitter-add-RCTAPT-support-for-different-OSRs.patch b/target/linux/generic/backport-6.6/906-01-v6.7-crypto-jitter-add-RCTAPT-support-for-different-OSRs.patch
new file mode 100644
index 00000000000000..a8e729cb28a754
--- /dev/null
+++ b/target/linux/generic/backport-6.6/906-01-v6.7-crypto-jitter-add-RCTAPT-support-for-different-OSRs.patch
@@ -0,0 +1,445 @@
+From 04597c8dd6c4b55e946fec50dc3b14a5d9d54501 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Stephan=20M=C3=BCller?= <smueller@chronox.de>
+Date: Thu, 21 Sep 2023 13:48:11 +0200
+Subject: [PATCH] crypto: jitter - add RCT/APT support for different OSRs
+
+The oversampling rate (OSR) value specifies the heuristically implied
+entropy in the recorded data - H_submitter = 1/osr. A different entropy
+estimate implies a different APT/RCT cutoff value. This change adds
+support for OSRs 1 through 15. This OSR can be selected by the caller
+of the Jitter RNG.
+
+For this patch, the caller still uses one hard-coded OSR. A subsequent
+patch allows this value to be configured.
+
+In addition, the power-up self test is adjusted as follows:
+
+* It allows the caller to provide an oversampling rate that should be
+tested with - commonly it should be the same as used for the actual
+runtime operation. This makes the power-up testing therefore consistent
+with the runtime operation.
+
+* It calls now jent_measure_jitter (i.e. collects the full entropy
+that can possibly be harvested by the Jitter RNG) instead of only
+jent_condition_data (which only returns the entropy harvested from
+the conditioning component). This should now alleviate reports where
+the Jitter RNG initialization thinks there is too little entropy.
+
+* The power-up test now solely relies on the (enhanced) APT and RCT
+test that is used as a health test at runtime.
+
+The code allowing the different OSRs as well as the power-up test
+changes are present in the user space version of the Jitter RNG 3.4.1
+and thus was already in production use for some time.
+
+Reported-by "Ospan, Abylay" <aospan@amazon.com>
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ crypto/jitterentropy-kcapi.c |   4 +-
+ crypto/jitterentropy.c       | 233 ++++++++++++++++++-----------------
+ crypto/jitterentropy.h       |   3 +-
+ 3 files changed, 123 insertions(+), 117 deletions(-)
+
+--- a/crypto/jitterentropy-kcapi.c
++++ b/crypto/jitterentropy-kcapi.c
+@@ -246,7 +246,7 @@ static int jent_kcapi_init(struct crypto
+ 	crypto_shash_init(sdesc);
+ 	rng->sdesc = sdesc;
+ 
+-	rng->entropy_collector = jent_entropy_collector_alloc(1, 0, sdesc);
++	rng->entropy_collector = jent_entropy_collector_alloc(0, 0, sdesc);
+ 	if (!rng->entropy_collector) {
+ 		ret = -ENOMEM;
+ 		goto err;
+@@ -335,7 +335,7 @@ static int __init jent_mod_init(void)
+ 
+ 	desc->tfm = tfm;
+ 	crypto_shash_init(desc);
+-	ret = jent_entropy_init(desc);
++	ret = jent_entropy_init(0, 0, desc);
+ 	shash_desc_zero(desc);
+ 	crypto_free_shash(tfm);
+ 	if (ret) {
+--- a/crypto/jitterentropy.c
++++ b/crypto/jitterentropy.c
+@@ -72,6 +72,8 @@ struct rand_data {
+ 	__u64 prev_time;		/* SENSITIVE Previous time stamp */
+ 	__u64 last_delta;		/* SENSITIVE stuck test */
+ 	__s64 last_delta2;		/* SENSITIVE stuck test */
++
++	unsigned int flags;		/* Flags used to initialize */
+ 	unsigned int osr;		/* Oversample rate */
+ #define JENT_MEMORY_BLOCKS 64
+ #define JENT_MEMORY_BLOCKSIZE 32
+@@ -88,16 +90,9 @@ struct rand_data {
+ 	/* Repetition Count Test */
+ 	unsigned int rct_count;			/* Number of stuck values */
+ 
+-	/* Intermittent health test failure threshold of 2^-30 */
+-	/* From an SP800-90B perspective, this RCT cutoff value is equal to 31. */
+-	/* However, our RCT implementation starts at 1, so we subtract 1 here. */
+-#define JENT_RCT_CUTOFF		(31 - 1)	/* Taken from SP800-90B sec 4.4.1 */
+-#define JENT_APT_CUTOFF		325			/* Taken from SP800-90B sec 4.4.2 */
+-	/* Permanent health test failure threshold of 2^-60 */
+-	/* From an SP800-90B perspective, this RCT cutoff value is equal to 61. */
+-	/* However, our RCT implementation starts at 1, so we subtract 1 here. */
+-#define JENT_RCT_CUTOFF_PERMANENT	(61 - 1)
+-#define JENT_APT_CUTOFF_PERMANENT	355
++	/* Adaptive Proportion Test cutoff values */
++	unsigned int apt_cutoff; /* Intermittent health test failure */
++	unsigned int apt_cutoff_permanent; /* Permanent health test failure */
+ #define JENT_APT_WINDOW_SIZE	512	/* Data window size */
+ 	/* LSB of time stamp to process */
+ #define JENT_APT_LSB		16
+@@ -122,6 +117,9 @@ struct rand_data {
+ 				   * zero). */
+ #define JENT_ESTUCK		8 /* Too many stuck results during init. */
+ #define JENT_EHEALTH		9 /* Health test failed during initialization */
++#define JENT_ERCT	       10 /* RCT failed during initialization */
++#define JENT_EHASH	       11 /* Hash self test failed */
++#define JENT_EMEM	       12 /* Can't allocate memory for initialization */
+ 
+ /*
+  * The output n bits can receive more than n bits of min entropy, of course,
+@@ -148,6 +146,48 @@ struct rand_data {
+  ***************************************************************************/
+ 
+ /*
++ * See the SP 800-90B comment #10b for the corrected cutoff for the SP 800-90B
++ * APT.
++ * http://www.untruth.org/~josh/sp80090b/UL%20SP800-90B-final%20comments%20v1.9%2020191212.pdf
++ * In in the syntax of R, this is C = 2 + qbinom(1 − 2^(−30), 511, 2^(-1/osr)).
++ * (The original formula wasn't correct because the first symbol must
++ * necessarily have been observed, so there is no chance of observing 0 of these
++ * symbols.)
++ *
++ * For the alpha < 2^-53, R cannot be used as it uses a float data type without
++ * arbitrary precision. A SageMath script is used to calculate those cutoff
++ * values.
++ *
++ * For any value above 14, this yields the maximal allowable value of 512
++ * (by FIPS 140-2 IG 7.19 Resolution # 16, we cannot choose a cutoff value that
++ * renders the test unable to fail).
++ */
++static const unsigned int jent_apt_cutoff_lookup[15] = {
++	325, 422, 459, 477, 488, 494, 499, 502,
++	505, 507, 508, 509, 510, 511, 512 };
++static const unsigned int jent_apt_cutoff_permanent_lookup[15] = {
++	355, 447, 479, 494, 502, 507, 510, 512,
++	512, 512, 512, 512, 512, 512, 512 };
++#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
++
++static void jent_apt_init(struct rand_data *ec, unsigned int osr)
++{
++	/*
++	 * Establish the apt_cutoff based on the presumed entropy rate of
++	 * 1/osr.
++	 */
++	if (osr >= ARRAY_SIZE(jent_apt_cutoff_lookup)) {
++		ec->apt_cutoff = jent_apt_cutoff_lookup[
++			ARRAY_SIZE(jent_apt_cutoff_lookup) - 1];
++		ec->apt_cutoff_permanent = jent_apt_cutoff_permanent_lookup[
++			ARRAY_SIZE(jent_apt_cutoff_permanent_lookup) - 1];
++	} else {
++		ec->apt_cutoff = jent_apt_cutoff_lookup[osr - 1];
++		ec->apt_cutoff_permanent =
++				jent_apt_cutoff_permanent_lookup[osr - 1];
++	}
++}
++/*
+  * Reset the APT counter
+  *
+  * @ec [in] Reference to entropy collector
+@@ -187,12 +227,12 @@ static void jent_apt_insert(struct rand_
+ /* APT health test failure detection */
+ static int jent_apt_permanent_failure(struct rand_data *ec)
+ {
+-	return (ec->apt_count >= JENT_APT_CUTOFF_PERMANENT) ? 1 : 0;
++	return (ec->apt_count >= ec->apt_cutoff_permanent) ? 1 : 0;
+ }
+ 
+ static int jent_apt_failure(struct rand_data *ec)
+ {
+-	return (ec->apt_count >= JENT_APT_CUTOFF) ? 1 : 0;
++	return (ec->apt_count >= ec->apt_cutoff) ? 1 : 0;
+ }
+ 
+ /***************************************************************************
+@@ -275,15 +315,28 @@ static int jent_stuck(struct rand_data *
+ 	return 0;
+ }
+ 
+-/* RCT health test failure detection */
++/*
++ * The cutoff value is based on the following consideration:
++ * alpha = 2^-30 or 2^-60 as recommended in SP800-90B.
++ * In addition, we require an entropy value H of 1/osr as this is the minimum
++ * entropy required to provide full entropy.
++ * Note, we collect (DATA_SIZE_BITS + ENTROPY_SAFETY_FACTOR)*osr deltas for
++ * inserting them into the entropy pool which should then have (close to)
++ * DATA_SIZE_BITS bits of entropy in the conditioned output.
++ *
++ * Note, ec->rct_count (which equals to value B in the pseudo code of SP800-90B
++ * section 4.4.1) starts with zero. Hence we need to subtract one from the
++ * cutoff value as calculated following SP800-90B. Thus
++ * C = ceil(-log_2(alpha)/H) = 30*osr or 60*osr.
++ */
+ static int jent_rct_permanent_failure(struct rand_data *ec)
+ {
+-	return (ec->rct_count >= JENT_RCT_CUTOFF_PERMANENT) ? 1 : 0;
++	return (ec->rct_count >= (60 * ec->osr)) ? 1 : 0;
+ }
+ 
+ static int jent_rct_failure(struct rand_data *ec)
+ {
+-	return (ec->rct_count >= JENT_RCT_CUTOFF) ? 1 : 0;
++	return (ec->rct_count >= (30 * ec->osr)) ? 1 : 0;
+ }
+ 
+ /* Report of health test failures */
+@@ -448,7 +501,7 @@ static void jent_memaccess(struct rand_d
+  *
+  * @return result of stuck test
+  */
+-static int jent_measure_jitter(struct rand_data *ec)
++static int jent_measure_jitter(struct rand_data *ec, __u64 *ret_current_delta)
+ {
+ 	__u64 time = 0;
+ 	__u64 current_delta = 0;
+@@ -472,6 +525,10 @@ static int jent_measure_jitter(struct ra
+ 	if (jent_condition_data(ec, current_delta, stuck))
+ 		stuck = 1;
+ 
++	/* return the raw entropy value */
++	if (ret_current_delta)
++		*ret_current_delta = current_delta;
++
+ 	return stuck;
+ }
+ 
+@@ -489,11 +546,11 @@ static void jent_gen_entropy(struct rand
+ 		safety_factor = JENT_ENTROPY_SAFETY_FACTOR;
+ 
+ 	/* priming of the ->prev_time value */
+-	jent_measure_jitter(ec);
++	jent_measure_jitter(ec, NULL);
+ 
+ 	while (!jent_health_failure(ec)) {
+ 		/* If a stuck measurement is received, repeat measurement */
+-		if (jent_measure_jitter(ec))
++		if (jent_measure_jitter(ec, NULL))
+ 			continue;
+ 
+ 		/*
+@@ -554,7 +611,8 @@ int jent_read_entropy(struct rand_data *
+ 			 * Perform startup health tests and return permanent
+ 			 * error if it fails.
+ 			 */
+-			if (jent_entropy_init(ec->hash_state))
++			if (jent_entropy_init(ec->osr, ec->flags,
++					      ec->hash_state))
+ 				return -3;
+ 
+ 			return -2;
+@@ -604,11 +662,15 @@ struct rand_data *jent_entropy_collector
+ 
+ 	/* verify and set the oversampling rate */
+ 	if (osr == 0)
+-		osr = 1; /* minimum sampling rate is 1 */
++		osr = 1; /* H_submitter = 1 / osr */
+ 	entropy_collector->osr = osr;
++	entropy_collector->flags = flags;
+ 
+ 	entropy_collector->hash_state = hash_state;
+ 
++	/* Initialize the APT */
++	jent_apt_init(entropy_collector, osr);
++
+ 	/* fill the data pad with non-zero values */
+ 	jent_gen_entropy(entropy_collector);
+ 
+@@ -622,20 +684,14 @@ void jent_entropy_collector_free(struct
+ 	jent_zfree(entropy_collector);
+ }
+ 
+-int jent_entropy_init(void *hash_state)
++int jent_entropy_init(unsigned int osr, unsigned int flags, void *hash_state)
+ {
+-	int i;
+-	__u64 delta_sum = 0;
+-	__u64 old_delta = 0;
+-	unsigned int nonstuck = 0;
+-	int time_backwards = 0;
+-	int count_mod = 0;
+-	int count_stuck = 0;
+-	struct rand_data ec = { 0 };
+-
+-	/* Required for RCT */
+-	ec.osr = 1;
+-	ec.hash_state = hash_state;
++	struct rand_data *ec;
++	int i, time_backwards = 0, ret = 0;
++
++	ec = jent_entropy_collector_alloc(osr, flags, hash_state);
++	if (!ec)
++		return JENT_EMEM;
+ 
+ 	/* We could perform statistical tests here, but the problem is
+ 	 * that we only have a few loop counts to do testing. These
+@@ -664,31 +720,28 @@ int jent_entropy_init(void *hash_state)
+ #define TESTLOOPCOUNT 1024
+ #define CLEARCACHE 100
+ 	for (i = 0; (TESTLOOPCOUNT + CLEARCACHE) > i; i++) {
+-		__u64 time = 0;
+-		__u64 time2 = 0;
+-		__u64 delta = 0;
+-		unsigned int lowdelta = 0;
+-		int stuck;
++		__u64 start_time = 0, end_time = 0, delta = 0;
+ 
+ 		/* Invoke core entropy collection logic */
+-		jent_get_nstime(&time);
+-		ec.prev_time = time;
+-		jent_condition_data(&ec, time, 0);
+-		jent_get_nstime(&time2);
++		jent_measure_jitter(ec, &delta);
++		end_time = ec->prev_time;
++		start_time = ec->prev_time - delta;
+ 
+ 		/* test whether timer works */
+-		if (!time || !time2)
+-			return JENT_ENOTIME;
+-		delta = jent_delta(time, time2);
++		if (!start_time || !end_time) {
++			ret = JENT_ENOTIME;
++			goto out;
++		}
++
+ 		/*
+ 		 * test whether timer is fine grained enough to provide
+ 		 * delta even when called shortly after each other -- this
+ 		 * implies that we also have a high resolution timer
+ 		 */
+-		if (!delta)
+-			return JENT_ECOARSETIME;
+-
+-		stuck = jent_stuck(&ec, delta);
++		if (!delta || (end_time == start_time)) {
++			ret = JENT_ECOARSETIME;
++			goto out;
++		}
+ 
+ 		/*
+ 		 * up to here we did not modify any variable that will be
+@@ -700,49 +753,9 @@ int jent_entropy_init(void *hash_state)
+ 		if (i < CLEARCACHE)
+ 			continue;
+ 
+-		if (stuck)
+-			count_stuck++;
+-		else {
+-			nonstuck++;
+-
+-			/*
+-			 * Ensure that the APT succeeded.
+-			 *
+-			 * With the check below that count_stuck must be less
+-			 * than 10% of the overall generated raw entropy values
+-			 * it is guaranteed that the APT is invoked at
+-			 * floor((TESTLOOPCOUNT * 0.9) / 64) == 14 times.
+-			 */
+-			if ((nonstuck % JENT_APT_WINDOW_SIZE) == 0) {
+-				jent_apt_reset(&ec,
+-					       delta & JENT_APT_WORD_MASK);
+-			}
+-		}
+-
+-		/* Validate health test result */
+-		if (jent_health_failure(&ec))
+-			return JENT_EHEALTH;
+-
+ 		/* test whether we have an increasing timer */
+-		if (!(time2 > time))
++		if (!(end_time > start_time))
+ 			time_backwards++;
+-
+-		/* use 32 bit value to ensure compilation on 32 bit arches */
+-		lowdelta = time2 - time;
+-		if (!(lowdelta % 100))
+-			count_mod++;
+-
+-		/*
+-		 * ensure that we have a varying delta timer which is necessary
+-		 * for the calculation of entropy -- perform this check
+-		 * only after the first loop is executed as we need to prime
+-		 * the old_data value
+-		 */
+-		if (delta > old_delta)
+-			delta_sum += (delta - old_delta);
+-		else
+-			delta_sum += (old_delta - delta);
+-		old_delta = delta;
+ 	}
+ 
+ 	/*
+@@ -752,31 +765,23 @@ int jent_entropy_init(void *hash_state)
+ 	 * should not fail. The value of 3 should cover the NTP case being
+ 	 * performed during our test run.
+ 	 */
+-	if (time_backwards > 3)
+-		return JENT_ENOMONOTONIC;
+-
+-	/*
+-	 * Variations of deltas of time must on average be larger
+-	 * than 1 to ensure the entropy estimation
+-	 * implied with 1 is preserved
+-	 */
+-	if ((delta_sum) <= 1)
+-		return JENT_EVARVAR;
++	if (time_backwards > 3) {
++		ret = JENT_ENOMONOTONIC;
++		goto out;
++	}
+ 
+-	/*
+-	 * Ensure that we have variations in the time stamp below 10 for at
+-	 * least 10% of all checks -- on some platforms, the counter increments
+-	 * in multiples of 100, but not always
+-	 */
+-	if ((TESTLOOPCOUNT/10 * 9) < count_mod)
+-		return JENT_ECOARSETIME;
++	/* Did we encounter a health test failure? */
++	if (jent_rct_failure(ec)) {
++		ret = JENT_ERCT;
++		goto out;
++	}
++	if (jent_apt_failure(ec)) {
++		ret = JENT_EHEALTH;
++		goto out;
++	}
+ 
+-	/*
+-	 * If we have more than 90% stuck results, then this Jitter RNG is
+-	 * likely to not work well.
+-	 */
+-	if ((TESTLOOPCOUNT/10 * 9) < count_stuck)
+-		return JENT_ESTUCK;
++out:
++	jent_entropy_collector_free(ec);
+ 
+-	return 0;
++	return ret;
+ }
+--- a/crypto/jitterentropy.h
++++ b/crypto/jitterentropy.h
+@@ -9,7 +9,8 @@ extern int jent_hash_time(void *hash_sta
+ int jent_read_random_block(void *hash_state, char *dst, unsigned int dst_len);
+ 
+ struct rand_data;
+-extern int jent_entropy_init(void *hash_state);
++extern int jent_entropy_init(unsigned int osr, unsigned int flags,
++			     void *hash_state);
+ extern int jent_read_entropy(struct rand_data *ec, unsigned char *data,
+ 			     unsigned int len);
+ 
diff --git a/target/linux/generic/backport-6.6/906-02-v6.7-crypto-jitter-Allow-configuration-of-memory-size.patch b/target/linux/generic/backport-6.6/906-02-v6.7-crypto-jitter-Allow-configuration-of-memory-size.patch
new file mode 100644
index 00000000000000..b13fc867012b5e
--- /dev/null
+++ b/target/linux/generic/backport-6.6/906-02-v6.7-crypto-jitter-Allow-configuration-of-memory-size.patch
@@ -0,0 +1,159 @@
+From 59bcfd788552504606e3eb774ae68052379396b6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Stephan=20M=C3=BCller?= <smueller@chronox.de>
+Date: Thu, 21 Sep 2023 13:48:33 +0200
+Subject: [PATCH] crypto: jitter - Allow configuration of memory size
+
+The memory size consumed by the Jitter RNG is one contributing factor in
+the amount of entropy that is gathered. As the amount of entropy
+directly correlates with the distance of the memory from the CPU, the
+caches that are possibly present on a given system have an impact on the
+collected entropy.
+
+Thus, the kernel compile time should offer a means to configure the
+amount of memory used by the Jitter RNG. Although this option could be
+turned into a runtime option (e.g. a kernel command line option), it
+should remain a compile time option as otherwise adminsitrators who may
+not have performed an entropy assessment may select a value that is
+inappropriate.
+
+The default value selected by the configuration is identical to the
+current Jitter RNG value. Thus, the patch should not lead to any change
+in the Jitter RNG behavior.
+
+To accommodate larger memory buffers, kvzalloc / kvfree is used.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ crypto/Kconfig               | 43 ++++++++++++++++++++++++++++++++++++
+ crypto/jitterentropy-kcapi.c | 11 +++++++++
+ crypto/jitterentropy.c       | 16 ++++++++------
+ crypto/jitterentropy.h       |  2 ++
+ 4 files changed, 65 insertions(+), 7 deletions(-)
+
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -1297,6 +1297,49 @@ config CRYPTO_JITTERENTROPY
+ 
+ 	  See https://www.chronox.de/jent/
+ 
++choice
++	prompt "CPU Jitter RNG Memory Size"
++	default CRYPTO_JITTERENTROPY_MEMSIZE_2
++	depends on CRYPTO_JITTERENTROPY
++	help
++	  The Jitter RNG measures the execution time of memory accesses.
++	  Multiple consecutive memory accesses are performed. If the memory
++	  size fits into a cache (e.g. L1), only the memory access timing
++	  to that cache is measured. The closer the cache is to the CPU
++	  the less variations are measured and thus the less entropy is
++	  obtained. Thus, if the memory size fits into the L1 cache, the
++	  obtained entropy is less than if the memory size fits within
++	  L1 + L2, which in turn is less if the memory fits into
++	  L1 + L2 + L3. Thus, by selecting a different memory size,
++	  the entropy rate produced by the Jitter RNG can be modified.
++
++	config CRYPTO_JITTERENTROPY_MEMSIZE_2
++		bool "2048 Bytes (default)"
++
++	config CRYPTO_JITTERENTROPY_MEMSIZE_128
++		bool "128 kBytes"
++
++	config CRYPTO_JITTERENTROPY_MEMSIZE_1024
++		bool "1024 kBytes"
++
++	config CRYPTO_JITTERENTROPY_MEMSIZE_8192
++		bool "8192 kBytes"
++endchoice
++
++config CRYPTO_JITTERENTROPY_MEMORY_BLOCKS
++	int
++	default 64 if CRYPTO_JITTERENTROPY_MEMSIZE_2
++	default 512 if CRYPTO_JITTERENTROPY_MEMSIZE_128
++	default 1024 if CRYPTO_JITTERENTROPY_MEMSIZE_1024
++	default 4096 if CRYPTO_JITTERENTROPY_MEMSIZE_8192
++
++config CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE
++	int
++	default 32 if CRYPTO_JITTERENTROPY_MEMSIZE_2
++	default 256 if CRYPTO_JITTERENTROPY_MEMSIZE_128
++	default 1024 if CRYPTO_JITTERENTROPY_MEMSIZE_1024
++	default 2048 if CRYPTO_JITTERENTROPY_MEMSIZE_8192
++
+ config CRYPTO_JITTERENTROPY_TESTINTERFACE
+ 	bool "CPU Jitter RNG Test Interface"
+ 	depends on CRYPTO_JITTERENTROPY
+--- a/crypto/jitterentropy-kcapi.c
++++ b/crypto/jitterentropy-kcapi.c
+@@ -54,6 +54,17 @@
+  * Helper function
+  ***************************************************************************/
+ 
++void *jent_kvzalloc(unsigned int len)
++{
++	return kvzalloc(len, GFP_KERNEL);
++}
++
++void jent_kvzfree(void *ptr, unsigned int len)
++{
++	memzero_explicit(ptr, len);
++	kvfree(ptr);
++}
++
+ void *jent_zalloc(unsigned int len)
+ {
+ 	return kzalloc(len, GFP_KERNEL);
+--- a/crypto/jitterentropy.c
++++ b/crypto/jitterentropy.c
+@@ -75,10 +75,10 @@ struct rand_data {
+ 
+ 	unsigned int flags;		/* Flags used to initialize */
+ 	unsigned int osr;		/* Oversample rate */
+-#define JENT_MEMORY_BLOCKS 64
+-#define JENT_MEMORY_BLOCKSIZE 32
+ #define JENT_MEMORY_ACCESSLOOPS 128
+-#define JENT_MEMORY_SIZE (JENT_MEMORY_BLOCKS*JENT_MEMORY_BLOCKSIZE)
++#define JENT_MEMORY_SIZE						\
++	(CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS *			\
++	 CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE)
+ 	unsigned char *mem;	/* Memory access location with size of
+ 				 * memblocks * memblocksize */
+ 	unsigned int memlocation; /* Pointer to byte in *mem */
+@@ -650,13 +650,15 @@ struct rand_data *jent_entropy_collector
+ 		/* Allocate memory for adding variations based on memory
+ 		 * access
+ 		 */
+-		entropy_collector->mem = jent_zalloc(JENT_MEMORY_SIZE);
++		entropy_collector->mem = jent_kvzalloc(JENT_MEMORY_SIZE);
+ 		if (!entropy_collector->mem) {
+ 			jent_zfree(entropy_collector);
+ 			return NULL;
+ 		}
+-		entropy_collector->memblocksize = JENT_MEMORY_BLOCKSIZE;
+-		entropy_collector->memblocks = JENT_MEMORY_BLOCKS;
++		entropy_collector->memblocksize =
++			CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE;
++		entropy_collector->memblocks =
++			CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS;
+ 		entropy_collector->memaccessloops = JENT_MEMORY_ACCESSLOOPS;
+ 	}
+ 
+@@ -679,7 +681,7 @@ struct rand_data *jent_entropy_collector
+ 
+ void jent_entropy_collector_free(struct rand_data *entropy_collector)
+ {
+-	jent_zfree(entropy_collector->mem);
++	jent_kvzfree(entropy_collector->mem, JENT_MEMORY_SIZE);
+ 	entropy_collector->mem = NULL;
+ 	jent_zfree(entropy_collector);
+ }
+--- a/crypto/jitterentropy.h
++++ b/crypto/jitterentropy.h
+@@ -1,5 +1,7 @@
+ // SPDX-License-Identifier: GPL-2.0-or-later
+ 
++extern void *jent_kvzalloc(unsigned int len);
++extern void jent_kvzfree(void *ptr, unsigned int len);
+ extern void *jent_zalloc(unsigned int len);
+ extern void jent_zfree(void *ptr);
+ extern void jent_get_nstime(__u64 *out);
diff --git a/target/linux/generic/backport-6.6/906-03-v6.7-crypto-jitter-Allow-configuration-of-oversampling-rate.patch b/target/linux/generic/backport-6.6/906-03-v6.7-crypto-jitter-Allow-configuration-of-oversampling-rate.patch
new file mode 100644
index 00000000000000..a629b7b770c52d
--- /dev/null
+++ b/target/linux/generic/backport-6.6/906-03-v6.7-crypto-jitter-Allow-configuration-of-oversampling-rate.patch
@@ -0,0 +1,75 @@
+From 0baa8fab334a4d7017235b72fa8a547433572109 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Stephan=20M=C3=BCller?= <smueller@chronox.de>
+Date: Thu, 21 Sep 2023 13:48:59 +0200
+Subject: [PATCH] crypto: jitter - Allow configuration of oversampling rate
+
+The oversampling rate used by the Jitter RNG allows the configuration of
+the heuristically implied entropy in one timing measurement. This
+entropy rate is (1 / OSR) bits of entropy per time stamp.
+
+Considering that the Jitter RNG now support APT/RCT health tests for
+different OSRs, allow this value to be configured at compile time to
+support systems with limited amount of entropy in their timer.
+
+The allowed range of OSR values complies with the APT/RCT cutoff health
+test values which range from 1 through 15.
+
+The default value of the OSR selection support is left at 1 which is the
+current default. Thus, the addition of the configuration support does
+not alter the default Jitter RNG behavior.
+
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ crypto/Kconfig               | 17 +++++++++++++++++
+ crypto/jitterentropy-kcapi.c |  6 ++++--
+ 2 files changed, 21 insertions(+), 2 deletions(-)
+
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -1340,6 +1340,23 @@ config CRYPTO_JITTERENTROPY_MEMORY_BLOCK
+ 	default 1024 if CRYPTO_JITTERENTROPY_MEMSIZE_1024
+ 	default 2048 if CRYPTO_JITTERENTROPY_MEMSIZE_8192
+ 
++config CRYPTO_JITTERENTROPY_OSR
++	int "CPU Jitter RNG Oversampling Rate"
++	range 1 15
++	default 1
++	depends on CRYPTO_JITTERENTROPY
++	help
++	  The Jitter RNG allows the specification of an oversampling rate (OSR).
++	  The Jitter RNG operation requires a fixed amount of timing
++	  measurements to produce one output block of random numbers. The
++	  OSR value is multiplied with the amount of timing measurements to
++	  generate one output block. Thus, the timing measurement is oversampled
++	  by the OSR factor. The oversampling allows the Jitter RNG to operate
++	  on hardware whose timers deliver limited amount of entropy (e.g.
++	  the timer is coarse) by setting the OSR to a higher value. The
++	  trade-off, however, is that the Jitter RNG now requires more time
++	  to generate random numbers.
++
+ config CRYPTO_JITTERENTROPY_TESTINTERFACE
+ 	bool "CPU Jitter RNG Test Interface"
+ 	depends on CRYPTO_JITTERENTROPY
+--- a/crypto/jitterentropy-kcapi.c
++++ b/crypto/jitterentropy-kcapi.c
+@@ -257,7 +257,9 @@ static int jent_kcapi_init(struct crypto
+ 	crypto_shash_init(sdesc);
+ 	rng->sdesc = sdesc;
+ 
+-	rng->entropy_collector = jent_entropy_collector_alloc(0, 0, sdesc);
++	rng->entropy_collector =
++		jent_entropy_collector_alloc(CONFIG_CRYPTO_JITTERENTROPY_OSR, 0,
++					     sdesc);
+ 	if (!rng->entropy_collector) {
+ 		ret = -ENOMEM;
+ 		goto err;
+@@ -346,7 +348,7 @@ static int __init jent_mod_init(void)
+ 
+ 	desc->tfm = tfm;
+ 	crypto_shash_init(desc);
+-	ret = jent_entropy_init(0, 0, desc);
++	ret = jent_entropy_init(CONFIG_CRYPTO_JITTERENTROPY_OSR, 0, desc);
+ 	shash_desc_zero(desc);
+ 	crypto_free_shash(tfm);
+ 	if (ret) {
diff --git a/target/linux/generic/backport-6.6/906-04-v6.7-crypto-jitter-reuse-allocated-entropy-collector.patch b/target/linux/generic/backport-6.6/906-04-v6.7-crypto-jitter-reuse-allocated-entropy-collector.patch
new file mode 100644
index 00000000000000..81f7f2fab5c2a7
--- /dev/null
+++ b/target/linux/generic/backport-6.6/906-04-v6.7-crypto-jitter-reuse-allocated-entropy-collector.patch
@@ -0,0 +1,117 @@
+From 8405ec8e3c02df8b3720874c3e2169fef4553868 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Stephan=20M=C3=BCller?= <smueller@chronox.de>
+Date: Sat, 7 Oct 2023 09:10:43 +0200
+Subject: [PATCH] crypto: jitter - reuse allocated entropy collector
+
+In case a health test error occurs during runtime, the power-up health
+tests are rerun to verify that the noise source is still good and
+that the reported health test error was an outlier. For performing this
+power-up health test, the already existing entropy collector instance
+is used instead of allocating a new one. This change has the following
+implications:
+
+* The noise that is collected as part of the newly run health tests is
+  inserted into the entropy collector and thus stirs the existing
+  data present in there further. Thus, the entropy collected during
+  the health test is not wasted. This is also allowed by SP800-90B.
+
+* The power-on health test is not affected by the state of the entropy
+  collector, because it resets the APT / RCT state. The remainder of
+  the state is unrelated to the health test as it is only applied to
+  newly obtained time stamps.
+
+This change also fixes a bug report about an allocation while in an
+atomic lock (the lock is taken in jent_kcapi_random, jent_read_entropy
+is called and this can call jent_entropy_init).
+
+Fixes: 04597c8dd6c4 ("jitter - add RCT/APT support for different OSRs")
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ crypto/jitterentropy-kcapi.c |  2 +-
+ crypto/jitterentropy.c       | 36 ++++++++++++++++++++++++++----------
+ crypto/jitterentropy.h       |  2 +-
+ 3 files changed, 28 insertions(+), 12 deletions(-)
+
+--- a/crypto/jitterentropy-kcapi.c
++++ b/crypto/jitterentropy-kcapi.c
+@@ -348,7 +348,7 @@ static int __init jent_mod_init(void)
+ 
+ 	desc->tfm = tfm;
+ 	crypto_shash_init(desc);
+-	ret = jent_entropy_init(CONFIG_CRYPTO_JITTERENTROPY_OSR, 0, desc);
++	ret = jent_entropy_init(CONFIG_CRYPTO_JITTERENTROPY_OSR, 0, desc, NULL);
+ 	shash_desc_zero(desc);
+ 	crypto_free_shash(tfm);
+ 	if (ret) {
+--- a/crypto/jitterentropy.c
++++ b/crypto/jitterentropy.c
+@@ -611,8 +611,7 @@ int jent_read_entropy(struct rand_data *
+ 			 * Perform startup health tests and return permanent
+ 			 * error if it fails.
+ 			 */
+-			if (jent_entropy_init(ec->osr, ec->flags,
+-					      ec->hash_state))
++			if (jent_entropy_init(0, 0, NULL, ec))
+ 				return -3;
+ 
+ 			return -2;
+@@ -686,14 +685,30 @@ void jent_entropy_collector_free(struct
+ 	jent_zfree(entropy_collector);
+ }
+ 
+-int jent_entropy_init(unsigned int osr, unsigned int flags, void *hash_state)
++int jent_entropy_init(unsigned int osr, unsigned int flags, void *hash_state,
++		      struct rand_data *p_ec)
+ {
+-	struct rand_data *ec;
+-	int i, time_backwards = 0, ret = 0;
++	/*
++	 * If caller provides an allocated ec, reuse it which implies that the
++	 * health test entropy data is used to further still the available
++	 * entropy pool.
++	 */
++	struct rand_data *ec = p_ec;
++	int i, time_backwards = 0, ret = 0, ec_free = 0;
+ 
+-	ec = jent_entropy_collector_alloc(osr, flags, hash_state);
+-	if (!ec)
+-		return JENT_EMEM;
++	if (!ec) {
++		ec = jent_entropy_collector_alloc(osr, flags, hash_state);
++		if (!ec)
++			return JENT_EMEM;
++		ec_free = 1;
++	} else {
++		/* Reset the APT */
++		jent_apt_reset(ec, 0);
++		/* Ensure that a new APT base is obtained */
++		ec->apt_base_set = 0;
++		/* Reset the RCT */
++		ec->rct_count = 0;
++	}
+ 
+ 	/* We could perform statistical tests here, but the problem is
+ 	 * that we only have a few loop counts to do testing. These
+@@ -783,7 +798,8 @@ int jent_entropy_init(unsigned int osr,
+ 	}
+ 
+ out:
+-	jent_entropy_collector_free(ec);
++	if (ec_free)
++		jent_entropy_collector_free(ec);
+ 
+ 	return ret;
+ }
+--- a/crypto/jitterentropy.h
++++ b/crypto/jitterentropy.h
+@@ -12,7 +12,7 @@ int jent_read_random_block(void *hash_st
+ 
+ struct rand_data;
+ extern int jent_entropy_init(unsigned int osr, unsigned int flags,
+-			     void *hash_state);
++			     void *hash_state, struct rand_data *p_ec);
+ extern int jent_read_entropy(struct rand_data *ec, unsigned char *data,
+ 			     unsigned int len);
+ 
diff --git a/target/linux/generic/backport-6.6/906-05-v6.7-crypto-jitter-use-permanent-health-test-storage.patch b/target/linux/generic/backport-6.6/906-05-v6.7-crypto-jitter-use-permanent-health-test-storage.patch
new file mode 100644
index 00000000000000..7c59169720ca6b
--- /dev/null
+++ b/target/linux/generic/backport-6.6/906-05-v6.7-crypto-jitter-use-permanent-health-test-storage.patch
@@ -0,0 +1,242 @@
+From cf27d9475f37fb69b5bc293e6e6d6c1d03cf7cc6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Stephan=20M=C3=BCller?= <smueller@chronox.de>
+Date: Thu, 19 Oct 2023 09:40:42 +0200
+Subject: [PATCH] crypto: jitter - use permanent health test storage
+
+The health test result in the current code is only given for the currently
+processed raw time stamp. This implies to react on the health test error,
+the result must be checked after each raw time stamp being processed. To
+avoid this constant checking requirement, any health test error is recorded
+and stored to be analyzed at a later time, if needed.
+
+This change ensures that the power-up test catches any health test error.
+Without that patch, the power-up health test result is not enforced.
+
+The introduced changes are already in use with the user space version of
+the Jitter RNG.
+
+Fixes: 04597c8dd6c4 ("jitter - add RCT/APT support for different OSRs")
+Reported-by: Joachim Vandersmissen <git@jvdsn.com>
+Signed-off-by: Stephan Mueller <smueller@chronox.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ crypto/jitterentropy.c | 125 ++++++++++++++++++++++++-----------------
+ 1 file changed, 74 insertions(+), 51 deletions(-)
+
+--- a/crypto/jitterentropy.c
++++ b/crypto/jitterentropy.c
+@@ -100,6 +100,8 @@ struct rand_data {
+ 	unsigned int apt_observations;	/* Number of collected observations */
+ 	unsigned int apt_count;		/* APT counter */
+ 	unsigned int apt_base;		/* APT base reference */
++	unsigned int health_failure;	/* Record health failure */
++
+ 	unsigned int apt_base_set:1;	/* APT base reference set? */
+ };
+ 
+@@ -121,6 +123,13 @@ struct rand_data {
+ #define JENT_EHASH	       11 /* Hash self test failed */
+ #define JENT_EMEM	       12 /* Can't allocate memory for initialization */
+ 
++#define JENT_RCT_FAILURE	1 /* Failure in RCT health test. */
++#define JENT_APT_FAILURE	2 /* Failure in APT health test. */
++#define JENT_PERMANENT_FAILURE_SHIFT	16
++#define JENT_PERMANENT_FAILURE(x)	(x << JENT_PERMANENT_FAILURE_SHIFT)
++#define JENT_RCT_FAILURE_PERMANENT	JENT_PERMANENT_FAILURE(JENT_RCT_FAILURE)
++#define JENT_APT_FAILURE_PERMANENT	JENT_PERMANENT_FAILURE(JENT_APT_FAILURE)
++
+ /*
+  * The output n bits can receive more than n bits of min entropy, of course,
+  * but the fixed output of the conditioning function can only asymptotically
+@@ -215,26 +224,22 @@ static void jent_apt_insert(struct rand_
+ 		return;
+ 	}
+ 
+-	if (delta_masked == ec->apt_base)
++	if (delta_masked == ec->apt_base) {
+ 		ec->apt_count++;
+ 
++		/* Note, ec->apt_count starts with one. */
++		if (ec->apt_count >= ec->apt_cutoff_permanent)
++			ec->health_failure |= JENT_APT_FAILURE_PERMANENT;
++		else if (ec->apt_count >= ec->apt_cutoff)
++			ec->health_failure |= JENT_APT_FAILURE;
++	}
++
+ 	ec->apt_observations++;
+ 
+ 	if (ec->apt_observations >= JENT_APT_WINDOW_SIZE)
+ 		jent_apt_reset(ec, delta_masked);
+ }
+ 
+-/* APT health test failure detection */
+-static int jent_apt_permanent_failure(struct rand_data *ec)
+-{
+-	return (ec->apt_count >= ec->apt_cutoff_permanent) ? 1 : 0;
+-}
+-
+-static int jent_apt_failure(struct rand_data *ec)
+-{
+-	return (ec->apt_count >= ec->apt_cutoff) ? 1 : 0;
+-}
+-
+ /***************************************************************************
+  * Stuck Test and its use as Repetition Count Test
+  *
+@@ -261,6 +266,30 @@ static void jent_rct_insert(struct rand_
+ {
+ 	if (stuck) {
+ 		ec->rct_count++;
++
++		/*
++		 * The cutoff value is based on the following consideration:
++		 * alpha = 2^-30 or 2^-60 as recommended in SP800-90B.
++		 * In addition, we require an entropy value H of 1/osr as this
++		 * is the minimum entropy required to provide full entropy.
++		 * Note, we collect (DATA_SIZE_BITS + ENTROPY_SAFETY_FACTOR)*osr
++		 * deltas for inserting them into the entropy pool which should
++		 * then have (close to) DATA_SIZE_BITS bits of entropy in the
++		 * conditioned output.
++		 *
++		 * Note, ec->rct_count (which equals to value B in the pseudo
++		 * code of SP800-90B section 4.4.1) starts with zero. Hence
++		 * we need to subtract one from the cutoff value as calculated
++		 * following SP800-90B. Thus C = ceil(-log_2(alpha)/H) = 30*osr
++		 * or 60*osr.
++		 */
++		if ((unsigned int)ec->rct_count >= (60 * ec->osr)) {
++			ec->rct_count = -1;
++			ec->health_failure |= JENT_RCT_FAILURE_PERMANENT;
++		} else if ((unsigned int)ec->rct_count >= (30 * ec->osr)) {
++			ec->rct_count = -1;
++			ec->health_failure |= JENT_RCT_FAILURE;
++		}
+ 	} else {
+ 		/* Reset RCT */
+ 		ec->rct_count = 0;
+@@ -316,38 +345,24 @@ static int jent_stuck(struct rand_data *
+ }
+ 
+ /*
+- * The cutoff value is based on the following consideration:
+- * alpha = 2^-30 or 2^-60 as recommended in SP800-90B.
+- * In addition, we require an entropy value H of 1/osr as this is the minimum
+- * entropy required to provide full entropy.
+- * Note, we collect (DATA_SIZE_BITS + ENTROPY_SAFETY_FACTOR)*osr deltas for
+- * inserting them into the entropy pool which should then have (close to)
+- * DATA_SIZE_BITS bits of entropy in the conditioned output.
++ * Report any health test failures
+  *
+- * Note, ec->rct_count (which equals to value B in the pseudo code of SP800-90B
+- * section 4.4.1) starts with zero. Hence we need to subtract one from the
+- * cutoff value as calculated following SP800-90B. Thus
+- * C = ceil(-log_2(alpha)/H) = 30*osr or 60*osr.
+- */
+-static int jent_rct_permanent_failure(struct rand_data *ec)
+-{
+-	return (ec->rct_count >= (60 * ec->osr)) ? 1 : 0;
+-}
+-
+-static int jent_rct_failure(struct rand_data *ec)
+-{
+-	return (ec->rct_count >= (30 * ec->osr)) ? 1 : 0;
+-}
+-
+-/* Report of health test failures */
+-static int jent_health_failure(struct rand_data *ec)
+-{
+-	return jent_rct_failure(ec) | jent_apt_failure(ec);
+-}
++ * @ec [in] Reference to entropy collector
++ *
++ * @return a bitmask indicating which tests failed
++ *	0 No health test failure
++ *	1 RCT failure
++ *	2 APT failure
++ *	1<<JENT_PERMANENT_FAILURE_SHIFT RCT permanent failure
++ *	2<<JENT_PERMANENT_FAILURE_SHIFT APT permanent failure
++ */
++static unsigned int jent_health_failure(struct rand_data *ec)
++{
++	/* Test is only enabled in FIPS mode */
++	if (!fips_enabled)
++		return 0;
+ 
+-static int jent_permanent_health_failure(struct rand_data *ec)
+-{
+-	return jent_rct_permanent_failure(ec) | jent_apt_permanent_failure(ec);
++	return ec->health_failure;
+ }
+ 
+ /***************************************************************************
+@@ -594,11 +609,12 @@ int jent_read_entropy(struct rand_data *
+ 		return -1;
+ 
+ 	while (len > 0) {
+-		unsigned int tocopy;
++		unsigned int tocopy, health_test_result;
+ 
+ 		jent_gen_entropy(ec);
+ 
+-		if (jent_permanent_health_failure(ec)) {
++		health_test_result = jent_health_failure(ec);
++		if (health_test_result > JENT_PERMANENT_FAILURE_SHIFT) {
+ 			/*
+ 			 * At this point, the Jitter RNG instance is considered
+ 			 * as a failed instance. There is no rerun of the
+@@ -606,13 +622,18 @@ int jent_read_entropy(struct rand_data *
+ 			 * is assumed to not further use this instance.
+ 			 */
+ 			return -3;
+-		} else if (jent_health_failure(ec)) {
++		} else if (health_test_result) {
+ 			/*
+ 			 * Perform startup health tests and return permanent
+ 			 * error if it fails.
+ 			 */
+-			if (jent_entropy_init(0, 0, NULL, ec))
++			if (jent_entropy_init(0, 0, NULL, ec)) {
++				/* Mark the permanent error */
++				ec->health_failure &=
++					JENT_RCT_FAILURE_PERMANENT |
++					JENT_APT_FAILURE_PERMANENT;
+ 				return -3;
++			}
+ 
+ 			return -2;
+ 		}
+@@ -695,6 +716,7 @@ int jent_entropy_init(unsigned int osr,
+ 	 */
+ 	struct rand_data *ec = p_ec;
+ 	int i, time_backwards = 0, ret = 0, ec_free = 0;
++	unsigned int health_test_result;
+ 
+ 	if (!ec) {
+ 		ec = jent_entropy_collector_alloc(osr, flags, hash_state);
+@@ -708,6 +730,9 @@ int jent_entropy_init(unsigned int osr,
+ 		ec->apt_base_set = 0;
+ 		/* Reset the RCT */
+ 		ec->rct_count = 0;
++		/* Reset intermittent, leave permanent health test result */
++		ec->health_failure &= (~JENT_RCT_FAILURE);
++		ec->health_failure &= (~JENT_APT_FAILURE);
+ 	}
+ 
+ 	/* We could perform statistical tests here, but the problem is
+@@ -788,12 +813,10 @@ int jent_entropy_init(unsigned int osr,
+ 	}
+ 
+ 	/* Did we encounter a health test failure? */
+-	if (jent_rct_failure(ec)) {
+-		ret = JENT_ERCT;
+-		goto out;
+-	}
+-	if (jent_apt_failure(ec)) {
+-		ret = JENT_EHEALTH;
++	health_test_result = jent_health_failure(ec);
++	if (health_test_result) {
++		ret = (health_test_result & JENT_RCT_FAILURE) ? JENT_ERCT :
++								JENT_EHEALTH;
+ 		goto out;
+ 	}
+ 
diff --git a/target/linux/generic/backport-6.6/906-06-v6.7-crypto-jitterentropy-Hide-esoteric-Kconfig-options-under.patch b/target/linux/generic/backport-6.6/906-06-v6.7-crypto-jitterentropy-Hide-esoteric-Kconfig-options-under.patch
new file mode 100644
index 00000000000000..2dc2a011698321
--- /dev/null
+++ b/target/linux/generic/backport-6.6/906-06-v6.7-crypto-jitterentropy-Hide-esoteric-Kconfig-options-under.patch
@@ -0,0 +1,80 @@
+From e7ed6473c2c8c4e45dd861bfa06e96189b11d8db Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Mon, 6 Nov 2023 18:00:08 +0800
+Subject: [PATCH] crypto: jitterentropy - Hide esoteric Kconfig options under
+ FIPS and EXPERT
+
+As JITTERENTROPY is selected by default if you enable the CRYPTO
+API, any Kconfig options added there will show up for every single
+user.  Hide the esoteric options under EXPERT as well as FIPS so
+that only distro makers will see them.
+
+Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Reviewed-by: Stephan Mueller <smueller@chronox.de>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ crypto/Kconfig | 28 +++++++++++++++++++++++++---
+ 1 file changed, 25 insertions(+), 3 deletions(-)
+
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -1297,10 +1297,12 @@ config CRYPTO_JITTERENTROPY
+ 
+ 	  See https://www.chronox.de/jent/
+ 
++if CRYPTO_JITTERENTROPY
++if CRYPTO_FIPS && EXPERT
++
+ choice
+ 	prompt "CPU Jitter RNG Memory Size"
+ 	default CRYPTO_JITTERENTROPY_MEMSIZE_2
+-	depends on CRYPTO_JITTERENTROPY
+ 	help
+ 	  The Jitter RNG measures the execution time of memory accesses.
+ 	  Multiple consecutive memory accesses are performed. If the memory
+@@ -1344,7 +1346,6 @@ config CRYPTO_JITTERENTROPY_OSR
+ 	int "CPU Jitter RNG Oversampling Rate"
+ 	range 1 15
+ 	default 1
+-	depends on CRYPTO_JITTERENTROPY
+ 	help
+ 	  The Jitter RNG allows the specification of an oversampling rate (OSR).
+ 	  The Jitter RNG operation requires a fixed amount of timing
+@@ -1359,7 +1360,6 @@ config CRYPTO_JITTERENTROPY_OSR
+ 
+ config CRYPTO_JITTERENTROPY_TESTINTERFACE
+ 	bool "CPU Jitter RNG Test Interface"
+-	depends on CRYPTO_JITTERENTROPY
+ 	help
+ 	  The test interface allows a privileged process to capture
+ 	  the raw unconditioned high resolution time stamp noise that
+@@ -1377,6 +1377,28 @@ config CRYPTO_JITTERENTROPY_TESTINTERFAC
+ 
+ 	  If unsure, select N.
+ 
++endif	# if CRYPTO_FIPS && EXPERT
++
++if !(CRYPTO_FIPS && EXPERT)
++
++config CRYPTO_JITTERENTROPY_MEMORY_BLOCKS
++	int
++	default 64
++
++config CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE
++	int
++	default 32
++
++config CRYPTO_JITTERENTROPY_OSR
++	int
++	default 1
++
++config CRYPTO_JITTERENTROPY_TESTINTERFACE
++	bool
++
++endif	# if !(CRYPTO_FIPS && EXPERT)
++endif	# if CRYPTO_JITTERENTROPY
++
+ config CRYPTO_KDF800108_CTR
+ 	tristate
+ 	select CRYPTO_HMAC
diff --git a/target/linux/generic/backport-6.6/906-07-v6.10-crypto-jitter-Use-kvfree_sensitive-to-fix-Coccinelle.patch b/target/linux/generic/backport-6.6/906-07-v6.10-crypto-jitter-Use-kvfree_sensitive-to-fix-Coccinelle.patch
new file mode 100644
index 00000000000000..88a0bd15c06adb
--- /dev/null
+++ b/target/linux/generic/backport-6.6/906-07-v6.10-crypto-jitter-Use-kvfree_sensitive-to-fix-Coccinelle.patch
@@ -0,0 +1,30 @@
+From 6e61ee1ca551292d8714c35c92a019c41db79e4e Mon Sep 17 00:00:00 2001
+From: Thorsten Blum <thorsten.blum@toblux.com>
+Date: Wed, 27 Mar 2024 23:25:09 +0100
+Subject: [PATCH] crypto: jitter - Use kvfree_sensitive() to fix Coccinelle
+ warning
+
+Replace memzero_explicit() and kvfree() with kvfree_sensitive() to fix
+the following Coccinelle/coccicheck warning reported by
+kfree_sensitive.cocci:
+
+	WARNING opportunity for kfree_sensitive/kvfree_sensitive
+
+Signed-off-by: Thorsten Blum <thorsten.blum@toblux.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ crypto/jitterentropy-kcapi.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/crypto/jitterentropy-kcapi.c
++++ b/crypto/jitterentropy-kcapi.c
+@@ -61,8 +61,7 @@ void *jent_kvzalloc(unsigned int len)
+ 
+ void jent_kvzfree(void *ptr, unsigned int len)
+ {
+-	memzero_explicit(ptr, len);
+-	kvfree(ptr);
++	kvfree_sensitive(ptr, len);
+ }
+ 
+ void *jent_zalloc(unsigned int len)
diff --git a/target/linux/generic/backport-6.6/906-08-v6.12-crypto-jitter-set-default-OSR-to-3.patch b/target/linux/generic/backport-6.6/906-08-v6.12-crypto-jitter-set-default-OSR-to-3.patch
new file mode 100644
index 00000000000000..ade8f1005bd7a6
--- /dev/null
+++ b/target/linux/generic/backport-6.6/906-08-v6.12-crypto-jitter-set-default-OSR-to-3.patch
@@ -0,0 +1,36 @@
+From 95a798d20060d2b648dd604321e347c85edfd783 Mon Sep 17 00:00:00 2001
+From: Stephan Mueller <smueller@chronox.de>
+Date: Mon, 12 Aug 2024 08:25:42 +0200
+Subject: [PATCH] crypto: jitter - set default OSR to 3
+
+The user space Jitter RNG library uses the oversampling rate of 3 which
+implies that each time stamp is credited with 1/3 bit of entropy. To
+obtain 256 bits of entropy, 768 time stamps need to be sampled. The
+increase in OSR is applied based on a report where the Jitter RNG is
+used on a system exhibiting a challenging environment to collect
+entropy.
+
+This OSR default value is now applied to the Linux kernel version of
+the Jitter RNG as well.
+
+The increase in the OSR from 1 to 3 also implies that the Jitter RNG is
+now slower by default.
+
+Reported-by: Jeff Barnes <jeffbarnes@microsoft.com>
+Signed-off-by: Stephan Mueller <smueller@chronox.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ crypto/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/crypto/Kconfig
++++ b/crypto/Kconfig
+@@ -1345,7 +1345,7 @@ config CRYPTO_JITTERENTROPY_MEMORY_BLOCK
+ config CRYPTO_JITTERENTROPY_OSR
+ 	int "CPU Jitter RNG Oversampling Rate"
+ 	range 1 15
+-	default 1
++	default 3
+ 	help
+ 	  The Jitter RNG allows the specification of an oversampling rate (OSR).
+ 	  The Jitter RNG operation requires a fixed amount of timing
diff --git a/target/linux/generic/backport-6.6/910-v6.13-pmdomain-core-add-dummy-release-function-to-genpd-de.patch b/target/linux/generic/backport-6.6/910-v6.13-pmdomain-core-add-dummy-release-function-to-genpd-de.patch
new file mode 100644
index 00000000000000..b392bd0d0c6c5b
--- /dev/null
+++ b/target/linux/generic/backport-6.6/910-v6.13-pmdomain-core-add-dummy-release-function-to-genpd-de.patch
@@ -0,0 +1,46 @@
+From f64f610ec6ab59dd0391b03842cea3a4cd8ee34f Mon Sep 17 00:00:00 2001
+From: Lucas Stach <l.stach@pengutronix.de>
+Date: Wed, 18 Dec 2024 19:44:33 +0100
+Subject: [PATCH] pmdomain: core: add dummy release function to genpd device
+
+The genpd device, which is really only used as a handle to lookup
+OPP, but not even registered to the device core otherwise and thus
+lifetime linked to the genpd struct it is contained in, is missing
+a release function. After b8f7bbd1f4ec ("pmdomain: core: Add
+missing put_device()") the device will be cleaned up going through
+the driver core device_release() function, which will warn when no
+release callback is present for the device. Add a dummy release
+function to shut up the warning.
+
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
+Fixes: b8f7bbd1f4ec ("pmdomain: core: Add missing put_device()")
+Cc: stable@vger.kernel.org
+Message-ID: <20241218184433.1930532-1-l.stach@pengutronix.de>
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+---
+ drivers/base/power/domain.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/base/power/domain.c
++++ b/drivers/base/power/domain.c
+@@ -2040,6 +2040,11 @@ static void genpd_lock_init(struct gener
+ 	}
+ }
+ 
++static void genpd_provider_release(struct device *dev)
++{
++	/* nothing to be done here */
++}
++
+ /**
+  * pm_genpd_init - Initialize a generic I/O PM domain object.
+  * @genpd: PM domain object to initialize.
+@@ -2106,6 +2111,7 @@ int pm_genpd_init(struct generic_pm_doma
+ 		return ret;
+ 
+ 	device_initialize(&genpd->dev);
++	genpd->dev.release = genpd_provider_release;
+ 	dev_set_name(&genpd->dev, "%s", genpd->name);
+ 
+ 	mutex_lock(&gpd_list_lock);
diff --git a/target/linux/generic/config-6.6 b/target/linux/generic/config-6.6
index 8b22cc40350841..e31cca45cc4233 100644
--- a/target/linux/generic/config-6.6
+++ b/target/linux/generic/config-6.6
@@ -14,6 +14,7 @@ CONFIG_32BIT=y
 # CONFIG_ACERHDF is not set
 # CONFIG_ACER_WIRELESS is not set
 # CONFIG_ACORN_PARTITION is not set
+# CONFIG_ACPI_AGDI is not set
 # CONFIG_ACPI_ALS is not set
 # CONFIG_ACPI_APEI is not set
 # CONFIG_ACPI_APEI_PCIEAER is not set
@@ -1927,6 +1928,7 @@ CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1"
 # CONFIG_FB_IBM_GXT4500 is not set
 # CONFIG_FB_IMSTT is not set
 # CONFIG_FB_IMX is not set
+# CONFIG_FB_INTEL is not set
 # CONFIG_FB_KYRO is not set
 # CONFIG_FB_LE80578 is not set
 # CONFIG_FB_LITTLE_ENDIAN is not set
@@ -2459,6 +2461,8 @@ CONFIG_HZ_100=y
 # CONFIG_I2C_DEBUG_BUS is not set
 # CONFIG_I2C_DEBUG_CORE is not set
 # CONFIG_I2C_DEMUX_PINCTRL is not set
+# CONFIG_I2C_DESIGNWARE_AMDPSP is not set
+# CONFIG_I2C_DESIGNWARE_BAYTRAIL is not set
 # CONFIG_I2C_DESIGNWARE_PCI is not set
 # CONFIG_I2C_DESIGNWARE_PLATFORM is not set
 # CONFIG_I2C_DESIGNWARE_SLAVE is not set
@@ -2715,7 +2719,10 @@ CONFIG_INPUT_MISC=y
 # CONFIG_INTEL_IOATDMA is not set
 # CONFIG_INTEL_ISH_HID is not set
 # CONFIG_INTEL_MEI is not set
+# CONFIG_INTEL_MEI_GSC_PROXY is not set
+# CONFIG_INTEL_MEI_HDCP is not set
 # CONFIG_INTEL_MEI_ME is not set
+# CONFIG_INTEL_MEI_PXP is not set
 # CONFIG_INTEL_MEI_TXE is not set
 # CONFIG_INTEL_OAKTRAIL is not set
 # CONFIG_INTEL_PMC_CORE is not set
@@ -3048,6 +3055,7 @@ CONFIG_LEDS_CLASS_MULTICOLOR=y
 # CONFIG_LEDS_INTEL_SS4200 is not set
 # CONFIG_LEDS_IS31FL319X is not set
 # CONFIG_LEDS_IS31FL32XX is not set
+# CONFIG_LEDS_KTD202X is not set
 # CONFIG_LEDS_LM3530 is not set
 # CONFIG_LEDS_LM3532 is not set
 # CONFIG_LEDS_LM355x is not set
@@ -4558,7 +4566,7 @@ CONFIG_PCI_SYSCALL=y
 # CONFIG_PCMCIA_XIRC2PS is not set
 # CONFIG_PCMCIA_XIRCOM is not set
 # CONFIG_PCNET32 is not set
-# CONFIG_PCPU_DEV_REFCNT is not set
+CONFIG_PCPU_DEV_REFCNT=y
 CONFIG_PCP_BATCH_SCALE_MAX=5
 # CONFIG_PCSPKR_PLATFORM is not set
 # CONFIG_PCS_MTK_USXGMII is not set
@@ -4754,6 +4762,7 @@ CONFIG_PROC_SYSCTL=y
 # CONFIG_PSB6970_PHY is not set
 # CONFIG_PSE_CONTROLLER is not set
 # CONFIG_PSI is not set
+# CONFIG_PSI_DEFAULT_DISABLED is not set
 # CONFIG_PSTORE is not set
 # CONFIG_PSTORE_BLK is not set
 # CONFIG_PSTORE_COMPRESS is not set
@@ -6212,6 +6221,11 @@ CONFIG_SND_X86=y
 # CONFIG_SPI_CADENCE_XSPI is not set
 # CONFIG_SPI_DEBUG is not set
 # CONFIG_SPI_DESIGNWARE is not set
+# CONFIG_SPI_DW_BT1 is not set
+# CONFIG_SPI_DW_BT1_DIRMAP is not set
+# CONFIG_SPI_DW_DMA is not set
+# CONFIG_SPI_DW_MMIO is not set
+# CONFIG_SPI_DW_PCI is not set
 # CONFIG_SPI_FSL_DSPI is not set
 # CONFIG_SPI_FSL_ESPI is not set
 # CONFIG_SPI_FSL_SPI is not set
@@ -7542,6 +7556,7 @@ CONFIG_ZONE_DMA=y
 # CONFIG_ZRAM_DEF_COMP_ZSTD is not set
 # CONFIG_ZRAM_MEMORY_TRACKING is not set
 # CONFIG_ZRAM_MULTI_COMP is not set
+# CONFIG_ZRAM_TRACK_ENTRY_ACTIME is not set
 # CONFIG_ZSMALLOC is not set
 CONFIG_ZSMALLOC_CHAIN_SIZE=8
 # CONFIG_ZSWAP is not set
diff --git a/target/linux/generic/config-filter b/target/linux/generic/config-filter
index e72c334ee7af03..274c31ecb0786c 100644
--- a/target/linux/generic/config-filter
+++ b/target/linux/generic/config-filter
@@ -3,8 +3,11 @@
 # CONFIG_ARM64_CONT_.*_SHIFT is not set
 # CONFIG_AS_.* is not set
 # CONFIG_CC_(CAN|HAS|IS|VERSION)_.* is not set
+# CONFIG_CC_IMPLICIT_FALLTHROUGH is not set
+# CONFIG_CC_NO_ARRAY_BOUNDS is not set
 CONFIG_CLANG_VERSION=.*
 CONFIG_FRAME_WARN=.*
+# CONFIG_GCC10_NO_ARRAY_BOUNDS is not set
 # CONFIG_GCC_VERSION is not set
 # CONFIG_HAVE_(?!(ARCH_TIMER|TCM|SMP)).* is not set
 # CONFIG_INLINE_.* is not set
diff --git a/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.c b/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.c
index bcff7d6ac82076..063adb50fb6062 100644
--- a/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.c
+++ b/target/linux/generic/files/drivers/mtd/nand/mtk_bmt.c
@@ -407,6 +407,7 @@ int mtk_bmt_attach(struct mtd_info *mtd)
 {
 	struct device_node *np;
 	int ret = 0;
+	u32 overridden_oobsize = 0;
 
 	if (bmtd.mtd)
 		return -ENOSPC;
@@ -431,6 +432,14 @@ int mtk_bmt_attach(struct mtd_info *mtd)
 	bmtd.mtd = mtd;
 	mtk_bmt_replace_ops(mtd);
 
+	if (!of_property_read_u32(np, "mediatek,bmt-mtd-overridden-oobsize",
+				  &overridden_oobsize))
+		if (overridden_oobsize < bmtd.mtd->oobsize) {
+			bmtd.mtd->oobsize = overridden_oobsize;
+			pr_info("NMBM: mtd OOB size has been overridden to %luB\n",
+				(long unsigned int)bmtd.mtd->oobsize);
+		}
+
 	bmtd.blk_size = mtd->erasesize;
 	bmtd.blk_shift = ffs(bmtd.blk_size) - 1;
 	bmtd.pg_size = mtd->writesize;
diff --git a/target/linux/generic/files/drivers/net/phy/rtl8366rb.c b/target/linux/generic/files/drivers/net/phy/rtl8366rb.c
index 0e0116051a8cb3..0878ca9f1400cf 100644
--- a/target/linux/generic/files/drivers/net/phy/rtl8366rb.c
+++ b/target/linux/generic/files/drivers/net/phy/rtl8366rb.c
@@ -1503,7 +1503,6 @@ MODULE_DEVICE_TABLE(of, rtl8366rb_match);
 static struct platform_driver rtl8366rb_driver = {
 	.driver = {
 		.name		= RTL8366RB_DRIVER_NAME,
-		.owner		= THIS_MODULE,
 		.of_match_table = of_match_ptr(rtl8366rb_match),
 	},
 	.probe		= rtl8366rb_probe,
diff --git a/target/linux/generic/files/drivers/net/phy/rtl8366s.c b/target/linux/generic/files/drivers/net/phy/rtl8366s.c
index 8c746778b8f820..d4045fcc062259 100644
--- a/target/linux/generic/files/drivers/net/phy/rtl8366s.c
+++ b/target/linux/generic/files/drivers/net/phy/rtl8366s.c
@@ -1291,7 +1291,6 @@ MODULE_DEVICE_TABLE(of, rtl8366s_match);
 static struct platform_driver rtl8366s_driver = {
 	.driver = {
 		.name		= RTL8366S_DRIVER_NAME,
-		.owner		= THIS_MODULE,
 #ifdef CONFIG_OF
 		.of_match_table = of_match_ptr(rtl8366s_match),
 #endif
diff --git a/target/linux/generic/files/drivers/net/phy/rtl8367.c b/target/linux/generic/files/drivers/net/phy/rtl8367.c
index 0acfeb54bba587..950e9d2767d9ec 100644
--- a/target/linux/generic/files/drivers/net/phy/rtl8367.c
+++ b/target/linux/generic/files/drivers/net/phy/rtl8367.c
@@ -1834,7 +1834,6 @@ MODULE_DEVICE_TABLE(of, rtl8367_match);
 static struct platform_driver rtl8367_driver = {
 	.driver = {
 		.name		= RTL8367_DRIVER_NAME,
-		.owner		= THIS_MODULE,
 #ifdef CONFIG_OF
 		.of_match_table = of_match_ptr(rtl8367_match),
 #endif
diff --git a/target/linux/generic/files/drivers/net/phy/rtl8367b.c b/target/linux/generic/files/drivers/net/phy/rtl8367b.c
index 4236912dd51e47..5f885aa5be8cd5 100644
--- a/target/linux/generic/files/drivers/net/phy/rtl8367b.c
+++ b/target/linux/generic/files/drivers/net/phy/rtl8367b.c
@@ -1633,7 +1633,6 @@ MODULE_DEVICE_TABLE(of, rtl8367b_match);
 static struct platform_driver rtl8367b_driver = {
 	.driver = {
 		.name		= RTL8367B_DRIVER_NAME,
-		.owner		= THIS_MODULE,
 #ifdef CONFIG_OF
 		.of_match_table = of_match_ptr(rtl8367b_match),
 #endif
diff --git a/target/linux/generic/hack-6.6/204-module_strip.patch b/target/linux/generic/hack-6.6/204-module_strip.patch
index 403ee11513cc54..9402ecb147fd3b 100644
--- a/target/linux/generic/hack-6.6/204-module_strip.patch
+++ b/target/linux/generic/hack-6.6/204-module_strip.patch
@@ -14,7 +14,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/include/linux/module.h
 +++ b/include/linux/module.h
-@@ -164,6 +164,7 @@ extern void cleanup_module(void);
+@@ -166,6 +166,7 @@ struct module_kobject *lookup_or_create_
  
  /* Generic info of form tag = "info" */
  #define MODULE_INFO(tag, info) __MODULE_INFO(tag, tag, info)
@@ -22,7 +22,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  /* For userspace: you can also call me... */
  #define MODULE_ALIAS(_alias) MODULE_INFO(alias, _alias)
-@@ -233,12 +234,12 @@ extern void cleanup_module(void);
+@@ -235,12 +236,12 @@ struct module_kobject *lookup_or_create_
   * Author(s), use "Name <email>" or just "Name", for multiple
   * authors use multiple MODULE_AUTHOR() statements/lines.
   */
@@ -38,7 +38,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  /* Creates an alias so file2alias.c can find device table. */
  #define MODULE_DEVICE_TABLE(type, name)					\
  extern typeof(name) __mod_##type##__##name##_device_table		\
-@@ -265,7 +266,9 @@ extern typeof(name) __mod_##type##__##na
+@@ -267,7 +268,9 @@ extern typeof(name) __mod_##type##__##na
   */
  
  #if defined(MODULE) || !defined(CONFIG_SYSFS)
@@ -49,7 +49,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #else
  #define MODULE_VERSION(_version)					\
  	MODULE_INFO(version, _version);					\
-@@ -288,7 +291,7 @@ extern typeof(name) __mod_##type##__##na
+@@ -290,7 +293,7 @@ extern typeof(name) __mod_##type##__##na
  /* Optional firmware file (or files) needed by the module
   * format is simply firmware file name.  Multiple firmware
   * files require multiple MODULE_FIRMWARE() specifiers */
@@ -88,7 +88,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/kernel/module/Kconfig
 +++ b/kernel/module/Kconfig
-@@ -389,4 +389,11 @@ config MODULES_TREE_LOOKUP
+@@ -390,4 +390,11 @@ config MODULES_TREE_LOOKUP
  	def_bool y
  	depends on PERF_EVENTS || TRACING || CFI_CLANG
  
@@ -102,7 +102,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  endif # MODULES
 --- a/kernel/module/main.c
 +++ b/kernel/module/main.c
-@@ -997,6 +997,7 @@ size_t modinfo_attrs_count = ARRAY_SIZE(
+@@ -999,6 +999,7 @@ size_t modinfo_attrs_count = ARRAY_SIZE(
  
  static const char vermagic[] = VERMAGIC_STRING;
  
@@ -110,7 +110,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  int try_to_force_load(struct module *mod, const char *reason)
  {
  #ifdef CONFIG_MODULE_FORCE_LOAD
-@@ -1008,6 +1009,7 @@ int try_to_force_load(struct module *mod
+@@ -1010,6 +1011,7 @@ int try_to_force_load(struct module *mod
  	return -ENOEXEC;
  #endif
  }
@@ -118,7 +118,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  /* Parse tag=value strings from .modinfo section */
  char *module_next_tag_pair(char *string, unsigned long *secsize)
-@@ -2075,9 +2077,11 @@ static void module_augment_kernel_taints
+@@ -2077,9 +2079,11 @@ static void module_augment_kernel_taints
  
  static int check_modinfo(struct module *mod, struct load_info *info, int flags)
  {
@@ -131,7 +131,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (flags & MODULE_INIT_IGNORE_VERMAGIC)
  		modmagic = NULL;
  
-@@ -2091,6 +2095,7 @@ static int check_modinfo(struct module *
+@@ -2093,6 +2097,7 @@ static int check_modinfo(struct module *
  		       info->name, modmagic, vermagic);
  		return -ENOEXEC;
  	}
@@ -141,7 +141,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (err)
 --- a/scripts/mod/modpost.c
 +++ b/scripts/mod/modpost.c
-@@ -1693,7 +1693,9 @@ static void read_symbols(const char *mod
+@@ -1666,7 +1666,9 @@ static void read_symbols(const char *mod
  		symname = remove_dot(info.strtab + sym->st_name);
  
  		handle_symbol(mod, &info, sym, symname);
@@ -151,7 +151,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	}
  
  	check_sec_ref(mod, &info);
-@@ -1866,8 +1868,10 @@ static void add_header(struct buffer *b,
+@@ -1839,8 +1841,10 @@ static void add_header(struct buffer *b,
  	buf_printf(b, "BUILD_SALT;\n");
  	buf_printf(b, "BUILD_LTO_INFO;\n");
  	buf_printf(b, "\n");
@@ -162,7 +162,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	buf_printf(b, "\n");
  	buf_printf(b, "__visible struct module __this_module\n");
  	buf_printf(b, "__section(\".gnu.linkonce.this_module\") = {\n");
-@@ -1881,8 +1885,10 @@ static void add_header(struct buffer *b,
+@@ -1854,8 +1858,10 @@ static void add_header(struct buffer *b,
  	buf_printf(b, "\t.arch = MODULE_ARCH_INIT,\n");
  	buf_printf(b, "};\n");
  
@@ -173,7 +173,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	buf_printf(b,
  		   "\n"
-@@ -1890,8 +1896,10 @@ static void add_header(struct buffer *b,
+@@ -1863,8 +1869,10 @@ static void add_header(struct buffer *b,
  		   "MODULE_INFO(retpoline, \"Y\");\n"
  		   "#endif\n");
  
@@ -184,7 +184,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	if (strstarts(mod->name, "tools/testing"))
  		buf_printf(b, "\nMODULE_INFO(test, \"Y\");\n");
-@@ -2001,11 +2009,13 @@ static void add_depends(struct buffer *b
+@@ -1974,11 +1982,13 @@ static void add_depends(struct buffer *b
  
  static void add_srcversion(struct buffer *b, struct module *mod)
  {
@@ -198,7 +198,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  static void write_buf(struct buffer *b, const char *fname)
-@@ -2088,7 +2098,9 @@ static void write_mod_c_file(struct modu
+@@ -2061,7 +2071,9 @@ static void write_mod_c_file(struct modu
  	add_exported_symbols(&buf, mod);
  	add_versions(&buf, mod);
  	add_depends(&buf, mod);
diff --git a/target/linux/generic/hack-6.6/253-ksmbd-config.patch b/target/linux/generic/hack-6.6/253-ksmbd-config.patch
index 9079c66d420e7f..d54b48895ea369 100644
--- a/target/linux/generic/hack-6.6/253-ksmbd-config.patch
+++ b/target/linux/generic/hack-6.6/253-ksmbd-config.patch
@@ -10,7 +10,7 @@ Subject: [PATCH] Kconfig: add tristate for OID and ASNI string
 
 --- a/init/Kconfig
 +++ b/init/Kconfig
-@@ -1993,7 +1993,7 @@ config PADATA
+@@ -2002,7 +2002,7 @@ config PADATA
  	bool
  
  config ASN1
diff --git a/target/linux/generic/hack-6.6/259-regmap_dynamic.patch b/target/linux/generic/hack-6.6/259-regmap_dynamic.patch
index cb93c96da60da2..c7b7a28ce30e2e 100644
--- a/target/linux/generic/hack-6.6/259-regmap_dynamic.patch
+++ b/target/linux/generic/hack-6.6/259-regmap_dynamic.patch
@@ -137,7 +137,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #include <linux/mutex.h>
  #include <linux/err.h>
  #include <linux/property.h>
-@@ -3470,3 +3471,5 @@ static int __init regmap_initcall(void)
+@@ -3485,3 +3486,5 @@ static int __init regmap_initcall(void)
  	return 0;
  }
  postcore_initcall(regmap_initcall);
diff --git a/target/linux/generic/hack-6.6/610-net-page_pool-try-to-free-deferred-skbs-while-waitin.patch b/target/linux/generic/hack-6.6/610-net-page_pool-try-to-free-deferred-skbs-while-waitin.patch
new file mode 100644
index 00000000000000..cfe35bc51a7ebf
--- /dev/null
+++ b/target/linux/generic/hack-6.6/610-net-page_pool-try-to-free-deferred-skbs-while-waitin.patch
@@ -0,0 +1,50 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 3 Jan 2025 19:29:00 +0100
+Subject: [PATCH] net: page_pool: try to free deferred skbs while waiting for
+ pool release
+
+The NAPI defer list can accumulate no longer used skbs, which can be reused
+during alloc. If this happens on a CPU that otherwise does not do any
+rx softirq processing, skbs can be held indefinitely, causing warnings
+on releasing page pools.
+Deal with this by scheduling rx softirq on all CPUs.
+
+Patch by Lorenzo Bianconi
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/core/page_pool.c
++++ b/net/core/page_pool.c
+@@ -873,7 +873,8 @@ static void page_pool_release_retry(stru
+ {
+ 	struct delayed_work *dwq = to_delayed_work(wq);
+ 	struct page_pool *pool = container_of(dwq, typeof(*pool), release_dw);
+-	int inflight;
++	unsigned long flags;
++	int cpu, inflight;
+ 
+ 	inflight = page_pool_release(pool);
+ 	/* In rare cases, a driver bug may cause inflight to go negative.
+@@ -885,6 +886,21 @@ static void page_pool_release_retry(stru
+ 	if (inflight <= 0)
+ 		return;
+ 
++	/* Run NET_RX_SOFTIRQ in order to free pending skbs in softnet_data
++	 * defer_list that can stay in the list until we have enough queued
++	 * traffic.
++	 */
++	local_irq_save(flags);
++	for_each_online_cpu(cpu) {
++		struct softnet_data *sd = &per_cpu(softnet_data, cpu);
++
++		if (cpu == raw_smp_processor_id())
++			raise_softirq_irqoff(NET_RX_SOFTIRQ);
++		else if (!cmpxchg(&sd->defer_ipi_scheduled, 0, 1))
++			smp_call_function_single_async(cpu, &sd->defer_csd);
++	}
++	local_irq_restore(flags);
++
+ 	/* Periodic warning */
+ 	if (time_after_eq(jiffies, pool->defer_warn)) {
+ 		int sec = (s32)((u32)jiffies - (u32)pool->defer_start) / HZ;
diff --git a/target/linux/generic/hack-6.6/650-netfilter-add-xt_FLOWOFFLOAD-target.patch b/target/linux/generic/hack-6.6/650-netfilter-add-xt_FLOWOFFLOAD-target.patch
index eca611da7e8375..58b37db2fb9ce1 100644
--- a/target/linux/generic/hack-6.6/650-netfilter-add-xt_FLOWOFFLOAD-target.patch
+++ b/target/linux/generic/hack-6.6/650-netfilter-add-xt_FLOWOFFLOAD-target.patch
@@ -758,7 +758,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #include <net/netfilter/nf_flow_table.h>
  #include <net/netfilter/nf_conntrack.h>
  #include <net/netfilter/nf_conntrack_core.h>
-@@ -377,8 +376,7 @@ flow_offload_lookup(struct nf_flowtable
+@@ -373,8 +372,7 @@ flow_offload_lookup(struct nf_flowtable
  }
  EXPORT_SYMBOL_GPL(flow_offload_lookup);
  
@@ -768,7 +768,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		      void (*iter)(struct nf_flowtable *flowtable,
  				   struct flow_offload *flow, void *data),
  		      void *data)
-@@ -439,6 +437,7 @@ static void nf_flow_offload_gc_step(stru
+@@ -435,6 +433,7 @@ static void nf_flow_offload_gc_step(stru
  		nf_flow_offload_stats(flow_table, flow);
  	}
  }
diff --git a/target/linux/generic/hack-6.6/660-fq_codel_defaults.patch b/target/linux/generic/hack-6.6/660-fq_codel_defaults.patch
index b923a2d206da3c..c39ae4c615c0cb 100644
--- a/target/linux/generic/hack-6.6/660-fq_codel_defaults.patch
+++ b/target/linux/generic/hack-6.6/660-fq_codel_defaults.patch
@@ -13,7 +13,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/sched/sch_fq_codel.c
 +++ b/net/sched/sch_fq_codel.c
-@@ -471,7 +471,11 @@ static int fq_codel_init(struct Qdisc *s
+@@ -463,7 +463,11 @@ static int fq_codel_init(struct Qdisc *s
  
  	sch->limit = 10*1024;
  	q->flows_cnt = 1024;
diff --git a/target/linux/generic/hack-6.6/661-kernel-ct-size-the-hashtable-more-adequately.patch b/target/linux/generic/hack-6.6/661-kernel-ct-size-the-hashtable-more-adequately.patch
index 020f3f3a11355d..64ef0736115591 100644
--- a/target/linux/generic/hack-6.6/661-kernel-ct-size-the-hashtable-more-adequately.patch
+++ b/target/linux/generic/hack-6.6/661-kernel-ct-size-the-hashtable-more-adequately.patch
@@ -14,7 +14,7 @@ Signed-off-by: Rui Salvaterra <rsalvaterra@gmail.com>
 
 --- a/net/netfilter/nf_conntrack_core.c
 +++ b/net/netfilter/nf_conntrack_core.c
-@@ -2682,7 +2682,7 @@ int nf_conntrack_init_start(void)
+@@ -2699,7 +2699,7 @@ int nf_conntrack_init_start(void)
  
  	if (!nf_conntrack_htable_size) {
  		nf_conntrack_htable_size
diff --git a/target/linux/generic/hack-6.6/711-net-dsa-mv88e6xxx-disable-ATU-violation.patch b/target/linux/generic/hack-6.6/711-net-dsa-mv88e6xxx-disable-ATU-violation.patch
index bf93a87e02e793..7c62435d6ee7e9 100644
--- a/target/linux/generic/hack-6.6/711-net-dsa-mv88e6xxx-disable-ATU-violation.patch
+++ b/target/linux/generic/hack-6.6/711-net-dsa-mv88e6xxx-disable-ATU-violation.patch
@@ -9,7 +9,7 @@ Subject: [PATCH] net/dsa/mv88e6xxx: disable ATU violation
 
 --- a/drivers/net/dsa/mv88e6xxx/chip.c
 +++ b/drivers/net/dsa/mv88e6xxx/chip.c
-@@ -3405,6 +3405,9 @@ static int mv88e6xxx_setup_port(struct m
+@@ -3446,6 +3446,9 @@ static int mv88e6xxx_setup_port(struct m
  	else
  		reg = 1 << port;
  
diff --git a/target/linux/generic/hack-6.6/721-net-add-packet-mangeling.patch b/target/linux/generic/hack-6.6/721-net-add-packet-mangeling.patch
index e1d4367a8f5493..1b210ee3cc6e1b 100644
--- a/target/linux/generic/hack-6.6/721-net-add-packet-mangeling.patch
+++ b/target/linux/generic/hack-6.6/721-net-add-packet-mangeling.patch
@@ -60,7 +60,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
   */
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -3095,6 +3095,10 @@ static inline int pskb_trim(struct sk_bu
+@@ -3121,6 +3121,10 @@ static inline int pskb_trim(struct sk_bu
  	return (len < skb->len) ? __pskb_trim(skb, len) : 0;
  }
  
@@ -71,7 +71,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  /**
   *	pskb_trim_unique - remove end from a paged unique (not cloned) buffer
   *	@skb: buffer to alter
-@@ -3260,16 +3264,6 @@ static inline struct sk_buff *dev_alloc_
+@@ -3286,16 +3290,6 @@ static inline struct sk_buff *dev_alloc_
  }
  
  
@@ -105,7 +105,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	help
 --- a/net/core/dev.c
 +++ b/net/core/dev.c
-@@ -3597,6 +3597,11 @@ static int xmit_one(struct sk_buff *skb,
+@@ -3640,6 +3640,11 @@ static int xmit_one(struct sk_buff *skb,
  	if (dev_nit_active(dev))
  		dev_queue_xmit_nit(skb, dev);
  
diff --git a/target/linux/generic/hack-6.6/760-net-usb-r8152-add-LED-configuration-from-OF.patch b/target/linux/generic/hack-6.6/760-net-usb-r8152-add-LED-configuration-from-OF.patch
index 069c6823033594..680440b310c037 100644
--- a/target/linux/generic/hack-6.6/760-net-usb-r8152-add-LED-configuration-from-OF.patch
+++ b/target/linux/generic/hack-6.6/760-net-usb-r8152-add-LED-configuration-from-OF.patch
@@ -22,7 +22,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  #include <linux/crc32.h>
  #include <linux/if_vlan.h>
  #include <linux/uaccess.h>
-@@ -7044,6 +7045,22 @@ static void rtl_tally_reset(struct r8152
+@@ -7045,6 +7046,22 @@ static void rtl_tally_reset(struct r8152
  	ocp_write_word(tp, MCU_TYPE_PLA, PLA_RSTTALLY, ocp_data);
  }
  
@@ -45,7 +45,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  static void r8152b_init(struct r8152 *tp)
  {
  	u32 ocp_data;
-@@ -7085,6 +7102,8 @@ static void r8152b_init(struct r8152 *tp
+@@ -7086,6 +7103,8 @@ static void r8152b_init(struct r8152 *tp
  	ocp_data = ocp_read_word(tp, MCU_TYPE_USB, USB_USB_CTRL);
  	ocp_data &= ~(RX_AGG_DISABLE | RX_ZERO_EN);
  	ocp_write_word(tp, MCU_TYPE_USB, USB_USB_CTRL, ocp_data);
@@ -54,7 +54,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  }
  
  static void r8153_init(struct r8152 *tp)
-@@ -7225,6 +7244,8 @@ static void r8153_init(struct r8152 *tp)
+@@ -7226,6 +7245,8 @@ static void r8153_init(struct r8152 *tp)
  		tp->coalesce = COALESCE_SLOW;
  		break;
  	}
@@ -63,7 +63,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  }
  
  static void r8153b_init(struct r8152 *tp)
-@@ -7307,6 +7328,8 @@ static void r8153b_init(struct r8152 *tp
+@@ -7308,6 +7329,8 @@ static void r8153b_init(struct r8152 *tp
  	rtl_tally_reset(tp);
  
  	tp->coalesce = 15000;	/* 15 us */
diff --git a/target/linux/generic/hack-6.6/773-bgmac-add-srab-switch.patch b/target/linux/generic/hack-6.6/773-bgmac-add-srab-switch.patch
index 633cacd1e7c313..40634f9ed0ad2f 100644
--- a/target/linux/generic/hack-6.6/773-bgmac-add-srab-switch.patch
+++ b/target/linux/generic/hack-6.6/773-bgmac-add-srab-switch.patch
@@ -78,7 +78,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  	netif_napi_del(&bgmac->napi);
 --- a/drivers/net/ethernet/broadcom/bgmac.h
 +++ b/drivers/net/ethernet/broadcom/bgmac.h
-@@ -388,6 +388,7 @@
+@@ -387,6 +387,7 @@
  #define BGMAC_FEAT_CC4_IF_SW_TYPE_RGMII	BIT(18)
  #define BGMAC_FEAT_CC7_IF_TYPE_RGMII	BIT(19)
  #define BGMAC_FEAT_IDM_MASK		BIT(20)
@@ -86,7 +86,7 @@ Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
  
  struct bgmac_slot_info {
  	union {
-@@ -495,6 +496,9 @@ struct bgmac {
+@@ -494,6 +495,9 @@ struct bgmac {
  	void (*cmn_maskset32)(struct bgmac *bgmac, u16 offset, u32 mask,
  			      u32 set);
  	int (*phy_connect)(struct bgmac *bgmac);
diff --git a/target/linux/generic/hack-6.6/780-usb-net-MeigLink_modem_support.patch b/target/linux/generic/hack-6.6/780-usb-net-MeigLink_modem_support.patch
index e80dfbeb0f3926..e0d578994716cd 100644
--- a/target/linux/generic/hack-6.6/780-usb-net-MeigLink_modem_support.patch
+++ b/target/linux/generic/hack-6.6/780-usb-net-MeigLink_modem_support.patch
@@ -10,7 +10,7 @@ Subject: [PATCH] net/usb/qmi_wwan: add MeigLink modem support
 
 --- a/drivers/net/usb/qmi_wwan.c
 +++ b/drivers/net/usb/qmi_wwan.c
-@@ -1084,12 +1084,18 @@ static const struct usb_device_id produc
+@@ -1084,6 +1084,11 @@ static const struct usb_device_id produc
  		USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7),
  		.driver_info = (unsigned long)&qmi_wwan_info,
  	},
@@ -19,9 +19,10 @@ Subject: [PATCH] net/usb/qmi_wwan: add MeigLink modem support
 +		.driver_info = (unsigned long)&qmi_wwan_info,
 +	},
 +
+ 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0122)},	/* Quectel RG650V */
  	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0125)},	/* Quectel EC25, EC20 R2.0  Mini PCIe */
  	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0306)},	/* Quectel EP06/EG06/EM06 */
- 	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)},	/* Quectel EG12/EM12 */
+@@ -1091,6 +1096,7 @@ static const struct usb_device_id produc
  	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0620)},	/* Quectel EM160R-GL */
  	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0800)},	/* Quectel RM500Q-GL */
  	{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0801)},	/* Quectel RM520N */
@@ -43,7 +44,7 @@ Subject: [PATCH] net/usb/qmi_wwan: add MeigLink modem support
  
  #define QUECTEL_VENDOR_ID			0x2c7c
  /* These Quectel products use Quectel's vendor ID */
-@@ -1159,6 +1164,11 @@ static const struct usb_device_id option
+@@ -1154,6 +1159,11 @@ static const struct usb_device_id option
  	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
  	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000), /* SIMCom SIM5218 */
  	  .driver_info = NCTRL(0) | NCTRL(1) | NCTRL(2) | NCTRL(3) | RSVD(4) },
@@ -55,7 +56,7 @@ Subject: [PATCH] net/usb/qmi_wwan: add MeigLink modem support
  	/* Quectel products using Qualcomm vendor ID */
  	{ USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)},
  	{ USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20),
-@@ -1200,6 +1210,11 @@ static const struct usb_device_id option
+@@ -1195,6 +1205,11 @@ static const struct usb_device_id option
  	  .driver_info = ZLP },
  	{ USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96),
  	  .driver_info = RSVD(4) },
diff --git a/target/linux/generic/hack-6.6/790-SFP-GE-T-ignore-TX_FAULT.patch b/target/linux/generic/hack-6.6/790-SFP-GE-T-ignore-TX_FAULT.patch
index 7733b45520874c..b1e54a5f1628f9 100644
--- a/target/linux/generic/hack-6.6/790-SFP-GE-T-ignore-TX_FAULT.patch
+++ b/target/linux/generic/hack-6.6/790-SFP-GE-T-ignore-TX_FAULT.patch
@@ -26,9 +26,9 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 
 --- a/drivers/net/phy/sfp.c
 +++ b/drivers/net/phy/sfp.c
-@@ -471,6 +471,9 @@ static const struct sfp_quirk sfp_quirks
- 	// FS 2.5G Base-T
- 	SFP_QUIRK_M("FS", "SFP-2.5G-T", sfp_quirk_oem_2_5g),
+@@ -485,6 +485,9 @@ static const struct sfp_quirk sfp_quirks
+ 	SFP_QUIRK("HUAWEI", "MA5671A", sfp_quirk_2500basex,
+ 		  sfp_fixup_ignore_tx_fault),
  
 +	// OEM SFP-GE-T is 1000Base-T module
 +	SFP_QUIRK_F("OEM", "SFP-GE-T", sfp_fixup_ignore_tx_fault),
@@ -36,7 +36,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	// Lantech 8330-262D-E can operate at 2500base-X, but incorrectly report
  	// 2500MBd NRZ in their EEPROM
  	SFP_QUIRK_M("Lantech", "8330-262D-E", sfp_quirk_2500basex),
-@@ -2589,7 +2592,8 @@ static void sfp_sm_main(struct sfp *sfp,
+@@ -2606,7 +2609,8 @@ static void sfp_sm_main(struct sfp *sfp,
  			 * or t_start_up, so assume there is a fault.
  			 */
  			sfp_sm_fault(sfp, SFP_S_INIT_TX_FAULT,
@@ -46,7 +46,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		} else if (event == SFP_E_TIMEOUT || event == SFP_E_TX_CLEAR) {
  	init_done:
  			/* Create mdiobus and start trying for PHY */
-@@ -2843,10 +2847,12 @@ static void sfp_check_state(struct sfp *
+@@ -2864,10 +2868,12 @@ static void sfp_check_state(struct sfp *
  	mutex_lock(&sfp->st_mutex);
  	state = sfp_get_state(sfp);
  	changed = state ^ sfp->state;
diff --git a/target/linux/generic/hack-6.6/800-GPIO-add-named-gpio-exports.patch b/target/linux/generic/hack-6.6/800-GPIO-add-named-gpio-exports.patch
index a1d787191ccdae..9c3696e76a6f85 100644
--- a/target/linux/generic/hack-6.6/800-GPIO-add-named-gpio-exports.patch
+++ b/target/linux/generic/hack-6.6/800-GPIO-add-named-gpio-exports.patch
@@ -15,7 +15,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  #include "gpiolib.h"
  #include "gpiolib-of.h"
-@@ -1129,3 +1131,74 @@ void of_gpiochip_remove(struct gpio_chip
+@@ -1138,3 +1140,73 @@ void of_gpiochip_remove(struct gpio_chip
  {
  	of_node_put(dev_of_node(&chip->gpiodev->dev));
  }
@@ -81,7 +81,6 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +static struct platform_driver gpio_export_driver = {
 +	.driver		= {
 +		.name		= "gpio-export",
-+		.owner	= THIS_MODULE,
 +		.of_match_table	= of_match_ptr(gpio_export_ids),
 +	},
 +	.probe		= of_gpio_export_probe,
diff --git a/target/linux/generic/hack-6.6/901-debloat_sock_diag.patch b/target/linux/generic/hack-6.6/901-debloat_sock_diag.patch
index acf72f4422579e..157f8f76e3e483 100644
--- a/target/linux/generic/hack-6.6/901-debloat_sock_diag.patch
+++ b/target/linux/generic/hack-6.6/901-debloat_sock_diag.patch
@@ -83,7 +83,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  INDIRECT_CALLABLE_DECLARE(struct dst_entry *ip6_dst_check(struct dst_entry *,
  							  u32));
  INDIRECT_CALLABLE_DECLARE(struct dst_entry *ipv4_dst_check(struct dst_entry *,
-@@ -2239,9 +2256,11 @@ static void __sk_free(struct sock *sk)
+@@ -2258,9 +2275,11 @@ static void __sk_free(struct sock *sk)
  	if (likely(sk->sk_net_refcnt))
  		sock_inuse_add(sock_net(sk), -1);
  
@@ -105,8 +105,8 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #include <linux/inet_diag.h>
  #include <linux/sock_diag.h>
  
-@@ -21,23 +20,6 @@ static int (*inet_rcv_compat)(struct sk_
- static DEFINE_MUTEX(sock_diag_table_mutex);
+@@ -22,23 +21,6 @@ static const struct sock_diag_inet_compa
+ 
  static struct workqueue_struct *broadcast_wq;
  
 -DEFINE_COOKIE(sock_cookie);
@@ -161,7 +161,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	  Support for PF_PACKET sockets monitoring interface used by the ss tool.
 --- a/net/unix/Kconfig
 +++ b/net/unix/Kconfig
-@@ -29,6 +29,7 @@ config	AF_UNIX_OOB
+@@ -24,6 +24,7 @@ config	AF_UNIX_OOB
  config UNIX_DIAG
  	tristate "UNIX: socket monitoring interface"
  	depends on UNIX
diff --git a/target/linux/generic/hack-6.6/902-debloat_proc.patch b/target/linux/generic/hack-6.6/902-debloat_proc.patch
index 691a60bcc03888..6c41d39d401c99 100644
--- a/target/linux/generic/hack-6.6/902-debloat_proc.patch
+++ b/target/linux/generic/hack-6.6/902-debloat_proc.patch
@@ -235,7 +235,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!pe)
 --- a/mm/vmalloc.c
 +++ b/mm/vmalloc.c
-@@ -4448,6 +4448,8 @@ static const struct seq_operations vmall
+@@ -4458,6 +4458,8 @@ static const struct seq_operations vmall
  
  static int __init proc_vmalloc_init(void)
  {
@@ -246,7 +246,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  				&vmalloc_op,
 --- a/mm/vmstat.c
 +++ b/mm/vmstat.c
-@@ -2135,10 +2135,12 @@ void __init init_mm_internals(void)
+@@ -2136,10 +2136,12 @@ void __init init_mm_internals(void)
  	start_shepherd_timer();
  #endif
  #ifdef CONFIG_PROC_FS
@@ -330,7 +330,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/net/core/sock.c
 +++ b/net/core/sock.c
-@@ -4140,6 +4140,8 @@ static __net_initdata struct pernet_oper
+@@ -4160,6 +4160,8 @@ static __net_initdata struct pernet_oper
  
  static int __init proto_init(void)
  {
@@ -341,7 +341,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/net/ipv4/fib_trie.c
 +++ b/net/ipv4/fib_trie.c
-@@ -3037,11 +3037,13 @@ static const struct seq_operations fib_r
+@@ -3015,11 +3015,13 @@ static const struct seq_operations fib_r
  
  int __net_init fib_proc_init(struct net *net)
  {
@@ -357,7 +357,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			fib_triestat_seq_show, NULL))
  		goto out2;
  
-@@ -3052,17 +3054,21 @@ int __net_init fib_proc_init(struct net
+@@ -3030,17 +3032,21 @@ int __net_init fib_proc_init(struct net
  	return 0;
  
  out3:
@@ -396,7 +396,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  }
 --- a/net/ipv4/route.c
 +++ b/net/ipv4/route.c
-@@ -381,6 +381,9 @@ static struct pernet_operations ip_rt_pr
+@@ -385,6 +385,9 @@ static struct pernet_operations ip_rt_pr
  
  static int __init ip_rt_proc_init(void)
  {
diff --git a/target/linux/generic/hack-6.6/904-debloat_dma_buf.patch b/target/linux/generic/hack-6.6/904-debloat_dma_buf.patch
index 355bd0d70cd26d..3ca98788abd4f9 100644
--- a/target/linux/generic/hack-6.6/904-debloat_dma_buf.patch
+++ b/target/linux/generic/hack-6.6/904-debloat_dma_buf.patch
@@ -73,7 +73,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +MODULE_LICENSE("GPL");
 --- a/kernel/sched/core.c
 +++ b/kernel/sched/core.c
-@@ -4483,6 +4483,7 @@ int wake_up_state(struct task_struct *p,
+@@ -4485,6 +4485,7 @@ int wake_up_state(struct task_struct *p,
  {
  	return try_to_wake_up(p, state, 0);
  }
diff --git a/target/linux/generic/hack-6.6/920-device_tree_cmdline.patch b/target/linux/generic/hack-6.6/920-device_tree_cmdline.patch
index 2a43ffb7ad54ef..1d78a9dc4dedc3 100644
--- a/target/linux/generic/hack-6.6/920-device_tree_cmdline.patch
+++ b/target/linux/generic/hack-6.6/920-device_tree_cmdline.patch
@@ -9,7 +9,7 @@ Subject: [PATCH] of/ftd: add device tree cmdline
 
 --- a/drivers/of/fdt.c
 +++ b/drivers/of/fdt.c
-@@ -1185,6 +1185,9 @@ int __init early_init_dt_scan_chosen(cha
+@@ -1186,6 +1186,9 @@ int __init early_init_dt_scan_chosen(cha
  	p = of_get_flat_dt_prop(node, "bootargs", &l);
  	if (p != NULL && l > 0)
  		strscpy(cmdline, p, min(l, COMMAND_LINE_SIZE));
diff --git a/target/linux/generic/pending-6.6/100-compiler.h-only-include-asm-rwonce.h-for-kernel-code.patch b/target/linux/generic/pending-6.6/100-compiler.h-only-include-asm-rwonce.h-for-kernel-code.patch
index 0844fcd6dbd657..09442a9bfc002b 100644
--- a/target/linux/generic/pending-6.6/100-compiler.h-only-include-asm-rwonce.h-for-kernel-code.patch
+++ b/target/linux/generic/pending-6.6/100-compiler.h-only-include-asm-rwonce.h-for-kernel-code.patch
@@ -19,8 +19,8 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 +
  #endif /* __KERNEL__ */
  
- /*
-@@ -243,6 +245,4 @@ static inline void *offset_to_ptr(const
+ /**
+@@ -250,6 +252,4 @@ static inline void *offset_to_ptr(const
   */
  #define prevent_tail_call_optimization()	mb()
  
diff --git a/target/linux/generic/pending-6.6/203-kallsyms_uncompressed.patch b/target/linux/generic/pending-6.6/203-kallsyms_uncompressed.patch
index c23811ed3987e4..94b22603d8c261 100644
--- a/target/linux/generic/pending-6.6/203-kallsyms_uncompressed.patch
+++ b/target/linux/generic/pending-6.6/203-kallsyms_uncompressed.patch
@@ -13,7 +13,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/init/Kconfig
 +++ b/init/Kconfig
-@@ -1451,6 +1451,17 @@ config SYSCTL_ARCH_UNALIGN_ALLOW
+@@ -1460,6 +1460,17 @@ config SYSCTL_ARCH_UNALIGN_ALLOW
  	  the unaligned access emulation.
  	  see arch/parisc/kernel/unaligned.c for reference
  
diff --git a/target/linux/generic/pending-6.6/250-kernel-fork-Increase-minimum-number-of-allowed-threa.patch b/target/linux/generic/pending-6.6/250-kernel-fork-Increase-minimum-number-of-allowed-threa.patch
new file mode 100644
index 00000000000000..17470b7a158daf
--- /dev/null
+++ b/target/linux/generic/pending-6.6/250-kernel-fork-Increase-minimum-number-of-allowed-threa.patch
@@ -0,0 +1,37 @@
+From a22c4c7bbfad3e93e717e16f6faf343259add27a Mon Sep 17 00:00:00 2001
+From: Hauke Mehrtens <hauke@hauke-m.de>
+Date: Fri, 27 Jun 2025 11:09:04 +0100
+Subject: [PATCH v2] kernel/fork: Increase minimum number of allowed threads
+
+A modern Linux system creates much more than 20 threads at bootup.
+When I booted up OpenWrt in qemu the system sometimes failed to boot up
+when it wanted to create the 419th thread. The VM had 128MB RAM and the
+calculation in set_max_threads() calculated that max_threads should be
+set to 419. When the system booted up it tried to notify the user space
+about every device it created because CONFIG_UEVENT_HELPER was set and
+used. I counted 1299 calls to call_usermodehelper_setup(), all of
+them try to create a new thread and call the userspace hotplug script in
+it.
+
+This fixes bootup of Linux on systems with low memory.
+
+I saw the problem with qemu 10.0.2 using these commands:
+qemu-system-aarch64 -machine virt -cpu cortex-a57 -nographic
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
+---
+ kernel/fork.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -115,7 +115,7 @@
+ /*
+  * Minimum number of threads to boot the kernel
+  */
+-#define MIN_THREADS 20
++#define MIN_THREADS 600
+ 
+ /*
+  * Maximum number of threads
diff --git a/target/linux/generic/pending-6.6/410-mtd-spinand-set-bitflip_threshold-to-75-of-ECC-strength.patch b/target/linux/generic/pending-6.6/410-mtd-spinand-set-bitflip_threshold-to-75-of-ECC-strength.patch
index aeac79c02383a3..7f60c21a3ac020 100644
--- a/target/linux/generic/pending-6.6/410-mtd-spinand-set-bitflip_threshold-to-75-of-ECC-strength.patch
+++ b/target/linux/generic/pending-6.6/410-mtd-spinand-set-bitflip_threshold-to-75-of-ECC-strength.patch
@@ -53,7 +53,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 
 --- a/drivers/mtd/nand/spi/core.c
 +++ b/drivers/mtd/nand/spi/core.c
-@@ -1286,6 +1286,7 @@ static int spinand_init(struct spinand_d
+@@ -1291,6 +1291,7 @@ static int spinand_init(struct spinand_d
  	/* Propagate ECC information to mtd_info */
  	mtd->ecc_strength = nanddev_get_ecc_conf(nand)->strength;
  	mtd->ecc_step_size = nanddev_get_ecc_conf(nand)->step_size;
diff --git a/target/linux/generic/pending-6.6/456-mmc-core-set-card-fwnode_handle.patch b/target/linux/generic/pending-6.6/456-mmc-core-set-card-fwnode_handle.patch
index 2ee170d47b855f..323c208e7327b7 100644
--- a/target/linux/generic/pending-6.6/456-mmc-core-set-card-fwnode_handle.patch
+++ b/target/linux/generic/pending-6.6/456-mmc-core-set-card-fwnode_handle.patch
@@ -12,7 +12,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 
 --- a/drivers/mmc/core/bus.c
 +++ b/drivers/mmc/core/bus.c
-@@ -364,6 +364,8 @@ int mmc_add_card(struct mmc_card *card)
+@@ -366,6 +366,8 @@ int mmc_add_card(struct mmc_card *card)
  
  	mmc_add_card_debugfs(card);
  	card->dev.of_node = mmc_of_find_child_device(card->host, 0);
diff --git a/target/linux/generic/pending-6.6/487-mtd-spinand-Add-support-for-Etron-EM73D044VCx.patch b/target/linux/generic/pending-6.6/487-mtd-spinand-Add-support-for-Etron-EM73D044VCx.patch
index 8fd136595262da..65efad224d16f4 100644
--- a/target/linux/generic/pending-6.6/487-mtd-spinand-Add-support-for-Etron-EM73D044VCx.patch
+++ b/target/linux/generic/pending-6.6/487-mtd-spinand-Add-support-for-Etron-EM73D044VCx.patch
@@ -42,21 +42,21 @@ Submitted-by: Daniel Danzberger <daniel@dd-wrt.com>
 +++ b/drivers/mtd/nand/spi/Makefile
 @@ -1,4 +1,4 @@
  # SPDX-License-Identifier: GPL-2.0
--spinand-objs := core.o alliancememory.o ato.o esmt.o gigadevice.o macronix.o
+-spinand-objs := core.o alliancememory.o ato.o esmt.o fmsh.o foresee.o gigadevice.o macronix.o
 -spinand-objs += micron.o paragon.o toshiba.o winbond.o xtx.o
-+spinand-objs := core.o alliancememory.o ato.o esmt.o etron.o gigadevice.o
++spinand-objs := core.o alliancememory.o ato.o esmt.o etron.o fmsh.o foresee.o gigadevice.o
 +spinand-objs += macronix.o micron.o paragon.o toshiba.o winbond.o xtx.o
  obj-$(CONFIG_MTD_SPI_NAND) += spinand.o
 --- a/drivers/mtd/nand/spi/core.c
 +++ b/drivers/mtd/nand/spi/core.c
-@@ -940,6 +940,7 @@ static const struct spinand_manufacturer
+@@ -943,6 +943,7 @@ static const struct spinand_manufacturer
  	&alliancememory_spinand_manufacturer,
  	&ato_spinand_manufacturer,
  	&esmt_c8_spinand_manufacturer,
 +	&etron_spinand_manufacturer,
+ 	&fmsh_spinand_manufacturer,
+ 	&foresee_spinand_manufacturer,
  	&gigadevice_spinand_manufacturer,
- 	&macronix_spinand_manufacturer,
- 	&micron_spinand_manufacturer,
 --- /dev/null
 +++ b/drivers/mtd/nand/spi/etron.c
 @@ -0,0 +1,98 @@
@@ -165,6 +165,6 @@ Submitted-by: Daniel Danzberger <daniel@dd-wrt.com>
  extern const struct spinand_manufacturer ato_spinand_manufacturer;
  extern const struct spinand_manufacturer esmt_c8_spinand_manufacturer;
 +extern const struct spinand_manufacturer etron_spinand_manufacturer;
+ extern const struct spinand_manufacturer fmsh_spinand_manufacturer;
+ extern const struct spinand_manufacturer foresee_spinand_manufacturer;
  extern const struct spinand_manufacturer gigadevice_spinand_manufacturer;
- extern const struct spinand_manufacturer macronix_spinand_manufacturer;
- extern const struct spinand_manufacturer micron_spinand_manufacturer;
diff --git a/target/linux/generic/pending-6.6/510-block-add-uImage.FIT-subimage-block-driver.patch b/target/linux/generic/pending-6.6/510-block-add-uImage.FIT-subimage-block-driver.patch
index ff38964ecee8bf..056b49db3ef9c0 100644
--- a/target/linux/generic/pending-6.6/510-block-add-uImage.FIT-subimage-block-driver.patch
+++ b/target/linux/generic/pending-6.6/510-block-add-uImage.FIT-subimage-block-driver.patch
@@ -36,7 +36,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -22015,6 +22015,12 @@ F:	Documentation/filesystems/ubifs-authe
+@@ -22016,6 +22016,12 @@ F:	Documentation/filesystems/ubifs-authe
  F:	Documentation/filesystems/ubifs.rst
  F:	fs/ubifs/
  
@@ -81,7 +81,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  swim_mod-y	:= swim.o swim_asm.o
 --- /dev/null
 +++ b/drivers/block/fitblk.c
-@@ -0,0 +1,659 @@
+@@ -0,0 +1,658 @@
 +// SPDX-License-Identifier: GPL-2.0-only
 +/*
 + * uImage.FIT virtual block device driver.
@@ -656,7 +656,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 +		add_fit_subimage_device(bdev, slot++, start_sect, nr_sects, true);
 +	}
 +
-+	if (!found || !slot)
++	if (!slot)
 +		goto out_bootconf;
 +
 +	dev_info(dev, "mapped %u uImage.FIT filesystem sub-image%s as /dev/fit%s%u%s\n",
@@ -675,7 +675,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 +	kfree(bootconf);
 +	kfree(fit);
 +out_blkdev:
-+	if (!found || ret)
++	if (!slot)
 +		blkdev_put(bdev, &_fitblk_claim_ptr);
 +
 +	return ret;
@@ -714,7 +714,6 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 +	.probe		= fitblk_probe,
 +	.driver		= {
 +		.name   = "fitblk",
-+		.owner   = THIS_MODULE,
 +	},
 +};
 +
diff --git a/target/linux/generic/pending-6.6/532-jffs2_eofdetect.patch b/target/linux/generic/pending-6.6/532-jffs2_eofdetect.patch
index 744fbd0e21790b..88bb14a02a6afa 100644
--- a/target/linux/generic/pending-6.6/532-jffs2_eofdetect.patch
+++ b/target/linux/generic/pending-6.6/532-jffs2_eofdetect.patch
@@ -45,7 +45,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  		if (ret < 0)
  			goto out;
-@@ -567,6 +573,17 @@ full_scan:
+@@ -569,6 +575,17 @@ full_scan:
  			return err;
  	}
  
diff --git a/target/linux/generic/pending-6.6/620-net_sched-codel-do-not-defer-queue-length-update.patch b/target/linux/generic/pending-6.6/620-net_sched-codel-do-not-defer-queue-length-update.patch
deleted file mode 100644
index 4b4825ae3b9a4a..00000000000000
--- a/target/linux/generic/pending-6.6/620-net_sched-codel-do-not-defer-queue-length-update.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
-Date: Mon, 21 Aug 2017 11:14:14 +0300
-Subject: [PATCH] net_sched/codel: do not defer queue length update
-
-When codel wants to drop last packet in ->dequeue() it cannot call
-qdisc_tree_reduce_backlog() right away - it will notify parent qdisc
-about zero qlen and HTB/HFSC will deactivate class. The same class will
-be deactivated second time by caller of ->dequeue(). Currently codel and
-fq_codel defer update. This triggers warning in HFSC when it's qlen != 0
-but there is no active classes.
-
-This patch update parent queue length immediately: just temporary increase
-qlen around qdisc_tree_reduce_backlog() to prevent first class deactivation
-if we have skb to return.
-
-This might open another problem in HFSC - now operation peek could fail and
-deactivate parent class.
-
-Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
-Link: https://bugzilla.kernel.org/show_bug.cgi?id=109581
----
-
---- a/net/sched/sch_codel.c
-+++ b/net/sched/sch_codel.c
-@@ -95,11 +95,17 @@ static struct sk_buff *codel_qdisc_deque
- 			    &q->stats, qdisc_pkt_len, codel_get_enqueue_time,
- 			    drop_func, dequeue_func);
- 
--	/* We cant call qdisc_tree_reduce_backlog() if our qlen is 0,
--	 * or HTB crashes. Defer it for next round.
-+	/* If our qlen is 0 qdisc_tree_reduce_backlog() will deactivate
-+	 * parent class, dequeue in parent qdisc will do the same if we
-+	 * return skb. Temporary increment qlen if we have skb.
- 	 */
--	if (q->stats.drop_count && sch->q.qlen) {
--		qdisc_tree_reduce_backlog(sch, q->stats.drop_count, q->stats.drop_len);
-+	if (q->stats.drop_count) {
-+		if (skb)
-+			sch->q.qlen++;
-+		qdisc_tree_reduce_backlog(sch, q->stats.drop_count,
-+					  q->stats.drop_len);
-+		if (skb)
-+			sch->q.qlen--;
- 		q->stats.drop_count = 0;
- 		q->stats.drop_len = 0;
- 	}
---- a/net/sched/sch_fq_codel.c
-+++ b/net/sched/sch_fq_codel.c
-@@ -304,6 +304,21 @@ begin:
- 			    &flow->cvars, &q->cstats, qdisc_pkt_len,
- 			    codel_get_enqueue_time, drop_func, dequeue_func);
- 
-+	/* If our qlen is 0 qdisc_tree_reduce_backlog() will deactivate
-+	 * parent class, dequeue in parent qdisc will do the same if we
-+	 * return skb. Temporary increment qlen if we have skb.
-+	 */
-+	if (q->cstats.drop_count) {
-+		if (skb)
-+			sch->q.qlen++;
-+		qdisc_tree_reduce_backlog(sch, q->cstats.drop_count,
-+					  q->cstats.drop_len);
-+		if (skb)
-+			sch->q.qlen--;
-+		q->cstats.drop_count = 0;
-+		q->cstats.drop_len = 0;
-+	}
-+
- 	if (!skb) {
- 		/* force a pass through old_flows to prevent starvation */
- 		if ((head == &q->new_flows) && !list_empty(&q->old_flows))
-@@ -314,15 +329,6 @@ begin:
- 	}
- 	qdisc_bstats_update(sch, skb);
- 	flow->deficit -= qdisc_pkt_len(skb);
--	/* We cant call qdisc_tree_reduce_backlog() if our qlen is 0,
--	 * or HTB crashes. Defer it for next round.
--	 */
--	if (q->cstats.drop_count && sch->q.qlen) {
--		qdisc_tree_reduce_backlog(sch, q->cstats.drop_count,
--					  q->cstats.drop_len);
--		q->cstats.drop_count = 0;
--		q->cstats.drop_len = 0;
--	}
- 	return skb;
- }
- 
diff --git a/target/linux/generic/pending-6.6/630-packet_socket_type.patch b/target/linux/generic/pending-6.6/630-packet_socket_type.patch
index 2b753efa6736cd..4992dd7816a72a 100644
--- a/target/linux/generic/pending-6.6/630-packet_socket_type.patch
+++ b/target/linux/generic/pending-6.6/630-packet_socket_type.patch
@@ -30,7 +30,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  #define PACKET_FANOUT_LB		1
 --- a/net/packet/af_packet.c
 +++ b/net/packet/af_packet.c
-@@ -1925,6 +1925,7 @@ static int packet_rcv_spkt(struct sk_buf
+@@ -1911,6 +1911,7 @@ static int packet_rcv_spkt(struct sk_buf
  {
  	struct sock *sk;
  	struct sockaddr_pkt *spkt;
@@ -38,7 +38,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	/*
  	 *	When we registered the protocol we saved the socket in the data
-@@ -1932,6 +1933,7 @@ static int packet_rcv_spkt(struct sk_buf
+@@ -1918,6 +1919,7 @@ static int packet_rcv_spkt(struct sk_buf
  	 */
  
  	sk = pt->af_packet_priv;
@@ -46,7 +46,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	/*
  	 *	Yank back the headers [hope the device set this
-@@ -1944,7 +1946,7 @@ static int packet_rcv_spkt(struct sk_buf
+@@ -1930,7 +1932,7 @@ static int packet_rcv_spkt(struct sk_buf
  	 *	so that this procedure is noop.
  	 */
  
@@ -55,7 +55,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		goto out;
  
  	if (!net_eq(dev_net(dev), sock_net(sk)))
-@@ -2190,12 +2192,12 @@ static int packet_rcv(struct sk_buff *sk
+@@ -2176,12 +2178,12 @@ static int packet_rcv(struct sk_buff *sk
  	unsigned int snaplen, res;
  	bool is_drop_n_account = false;
  
@@ -71,7 +71,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!net_eq(dev_net(dev), sock_net(sk)))
  		goto drop;
  
-@@ -2322,12 +2324,12 @@ static int tpacket_rcv(struct sk_buff *s
+@@ -2308,12 +2310,12 @@ static int tpacket_rcv(struct sk_buff *s
  	BUILD_BUG_ON(TPACKET_ALIGN(sizeof(*h.h2)) != 32);
  	BUILD_BUG_ON(TPACKET_ALIGN(sizeof(*h.h3)) != 48);
  
@@ -87,7 +87,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (!net_eq(dev_net(dev), sock_net(sk)))
  		goto drop;
  
-@@ -3451,6 +3453,7 @@ static int packet_create(struct net *net
+@@ -3436,6 +3438,7 @@ static int packet_create(struct net *net
  	mutex_init(&po->pg_vec_lock);
  	po->rollover = NULL;
  	po->prot_hook.func = packet_rcv;
@@ -95,7 +95,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  	if (sock->type == SOCK_PACKET)
  		po->prot_hook.func = packet_rcv_spkt;
-@@ -4118,6 +4121,16 @@ packet_setsockopt(struct socket *sock, i
+@@ -4103,6 +4106,16 @@ packet_setsockopt(struct socket *sock, i
  		packet_sock_flag_set(po, PACKET_SOCK_QDISC_BYPASS, val);
  		return 0;
  	}
@@ -112,7 +112,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	default:
  		return -ENOPROTOOPT;
  	}
-@@ -4177,6 +4190,13 @@ static int packet_getsockopt(struct sock
+@@ -4162,6 +4175,13 @@ static int packet_getsockopt(struct sock
  	case PACKET_VNET_HDR_SZ:
  		val = READ_ONCE(po->vnet_hdr_sz);
  		break;
diff --git a/target/linux/generic/pending-6.6/640-net-bridge-fix-switchdev-host-mdb-entry-updates.patch b/target/linux/generic/pending-6.6/640-net-bridge-fix-switchdev-host-mdb-entry-updates.patch
index cf55c6a3fb8b37..8271e062ff0be2 100644
--- a/target/linux/generic/pending-6.6/640-net-bridge-fix-switchdev-host-mdb-entry-updates.patch
+++ b/target/linux/generic/pending-6.6/640-net-bridge-fix-switchdev-host-mdb-entry-updates.patch
@@ -20,7 +20,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/bridge/br_switchdev.c
 +++ b/net/bridge/br_switchdev.c
-@@ -568,10 +568,18 @@ static void br_switchdev_host_mdb(struct
+@@ -571,10 +571,18 @@ static void br_switchdev_host_mdb(struct
  				  struct net_bridge_mdb_entry *mp, int type)
  {
  	struct net_device *lower_dev;
diff --git a/target/linux/generic/pending-6.6/641-net-bridge-switchdev-Don-t-drop-packets-between-port.patch b/target/linux/generic/pending-6.6/641-net-bridge-switchdev-Don-t-drop-packets-between-port.patch
index 1c4ec61b50aee7..531e1c99c65368 100644
--- a/target/linux/generic/pending-6.6/641-net-bridge-switchdev-Don-t-drop-packets-between-port.patch
+++ b/target/linux/generic/pending-6.6/641-net-bridge-switchdev-Don-t-drop-packets-between-port.patch
@@ -27,7 +27,7 @@ Signed-off-by: Leon M. Busch-George <leon@georgemail.eu>
 
 --- a/net/bridge/br_switchdev.c
 +++ b/net/bridge/br_switchdev.c
-@@ -67,7 +67,7 @@ bool nbp_switchdev_allowed_egress(const
+@@ -70,7 +70,7 @@ bool nbp_switchdev_allowed_egress(const
  	struct br_input_skb_cb *cb = BR_INPUT_SKB_CB(skb);
  
  	return !test_bit(p->hwdom, &cb->fwd_hwdoms) &&
diff --git a/target/linux/generic/pending-6.6/642-net-bridge-locally-receive-all-multicast-packets-if-.patch b/target/linux/generic/pending-6.6/642-net-bridge-locally-receive-all-multicast-packets-if-.patch
new file mode 100644
index 00000000000000..98edb315b1aeb4
--- /dev/null
+++ b/target/linux/generic/pending-6.6/642-net-bridge-locally-receive-all-multicast-packets-if-.patch
@@ -0,0 +1,24 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 17 Feb 2025 12:21:08 +0100
+Subject: [PATCH] net: bridge: locally receive all multicast packets if
+ IFF_ALLMULTI is set
+
+If multicast snooping is enabled, multicast packets may not always end up on
+the local bridge interface, if the host is not a member of the multicast
+group. Similar to how IFF_PROMISC allows all packets to be received locally,
+let IFF_ALLMULTI allow all multicast packets to be received.
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -152,6 +152,8 @@ int br_handle_frame_finish(struct net *n
+ 			pkt_type = BR_PKT_MULTICAST;
+ 			if (br_multicast_rcv(&brmctx, &pmctx, vlan, skb, vid))
+ 				goto drop;
++			if (br->dev->flags & IFF_ALLMULTI)
++				local_rcv = true;
+ 		}
+ 	}
+ 
diff --git a/target/linux/generic/pending-6.6/655-increase_skb_pad.patch b/target/linux/generic/pending-6.6/655-increase_skb_pad.patch
index ce7db566e5ac0f..8fbc9158813e4b 100644
--- a/target/linux/generic/pending-6.6/655-increase_skb_pad.patch
+++ b/target/linux/generic/pending-6.6/655-increase_skb_pad.patch
@@ -9,7 +9,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -3062,7 +3062,7 @@ static inline int pskb_network_may_pull(
+@@ -3088,7 +3088,7 @@ static inline int pskb_network_may_pull(
   * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
   */
  #ifndef NET_SKB_PAD
diff --git a/target/linux/generic/pending-6.6/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch b/target/linux/generic/pending-6.6/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
index f754705dc6d140..ef7ca8cf74f617 100644
--- a/target/linux/generic/pending-6.6/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
+++ b/target/linux/generic/pending-6.6/670-ipv6-allow-rejecting-with-source-address-failed-policy.patch
@@ -66,7 +66,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  static void rt_fibinfo_free(struct rtable __rcu **rtp)
 --- a/net/ipv4/fib_trie.c
 +++ b/net/ipv4/fib_trie.c
-@@ -2784,6 +2784,7 @@ static const char *const rtn_type_names[
+@@ -2762,6 +2762,7 @@ static const char *const rtn_type_names[
  	[RTN_THROW] = "THROW",
  	[RTN_NAT] = "NAT",
  	[RTN_XRESOLVE] = "XRESOLVE",
@@ -76,7 +76,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  static inline const char *rtn_type(char *buf, size_t len, unsigned int t)
 --- a/net/ipv4/ipmr.c
 +++ b/net/ipv4/ipmr.c
-@@ -180,6 +180,7 @@ static int ipmr_rule_action(struct fib_r
+@@ -190,6 +190,7 @@ static int ipmr_rule_action(struct fib_r
  	case FR_ACT_UNREACHABLE:
  		return -ENETUNREACH;
  	case FR_ACT_PROHIBIT:
@@ -99,7 +99,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	tb_id = fib_rule_get_table(rule, arg);
 --- a/net/ipv6/ip6mr.c
 +++ b/net/ipv6/ip6mr.c
-@@ -170,6 +170,8 @@ static int ip6mr_rule_action(struct fib_
+@@ -180,6 +180,8 @@ static int ip6mr_rule_action(struct fib_
  		return -ENETUNREACH;
  	case FR_ACT_PROHIBIT:
  		return -EACCES;
@@ -138,7 +138,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  static const struct rt6_info ip6_blk_hole_entry_template = {
  	.dst = {
  		.__rcuref	= RCUREF_INIT(1),
-@@ -1040,6 +1054,7 @@ static const int fib6_prop[RTN_MAX + 1]
+@@ -1077,6 +1091,7 @@ static const int fib6_prop[RTN_MAX + 1]
  	[RTN_BLACKHOLE]	= -EINVAL,
  	[RTN_UNREACHABLE] = -EHOSTUNREACH,
  	[RTN_PROHIBIT]	= -EACCES,
@@ -146,7 +146,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	[RTN_THROW]	= -EAGAIN,
  	[RTN_NAT]	= -EINVAL,
  	[RTN_XRESOLVE]	= -EINVAL,
-@@ -1075,6 +1090,10 @@ static void ip6_rt_init_dst_reject(struc
+@@ -1112,6 +1127,10 @@ static void ip6_rt_init_dst_reject(struc
  		rt->dst.output = ip6_pkt_prohibit_out;
  		rt->dst.input = ip6_pkt_prohibit;
  		break;
@@ -157,7 +157,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	case RTN_THROW:
  	case RTN_UNREACHABLE:
  	default:
-@@ -4546,6 +4565,17 @@ static int ip6_pkt_prohibit_out(struct n
+@@ -4588,6 +4607,17 @@ static int ip6_pkt_prohibit_out(struct n
  	return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
  }
  
@@ -175,7 +175,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  /*
   *	Allocate a dst for local (unicast / anycast) address.
   */
-@@ -5037,7 +5067,8 @@ static int rtm_to_fib6_config(struct sk_
+@@ -5079,7 +5109,8 @@ static int rtm_to_fib6_config(struct sk_
  	if (rtm->rtm_type == RTN_UNREACHABLE ||
  	    rtm->rtm_type == RTN_BLACKHOLE ||
  	    rtm->rtm_type == RTN_PROHIBIT ||
@@ -185,7 +185,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		cfg->fc_flags |= RTF_REJECT;
  
  	if (rtm->rtm_type == RTN_LOCAL)
-@@ -6284,6 +6315,8 @@ static int ip6_route_dev_notify(struct n
+@@ -6349,6 +6380,8 @@ static int ip6_route_dev_notify(struct n
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  		net->ipv6.ip6_prohibit_entry->dst.dev = dev;
  		net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
@@ -194,7 +194,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
  		net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
  #endif
-@@ -6295,6 +6328,7 @@ static int ip6_route_dev_notify(struct n
+@@ -6360,6 +6393,7 @@ static int ip6_route_dev_notify(struct n
  		in6_dev_put_clear(&net->ipv6.ip6_null_entry->rt6i_idev);
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  		in6_dev_put_clear(&net->ipv6.ip6_prohibit_entry->rt6i_idev);
@@ -202,7 +202,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  		in6_dev_put_clear(&net->ipv6.ip6_blk_hole_entry->rt6i_idev);
  #endif
  	}
-@@ -6495,6 +6529,8 @@ static int __net_init ip6_route_net_init
+@@ -6560,6 +6594,8 @@ static int __net_init ip6_route_net_init
  
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  	net->ipv6.fib6_has_custom_rules = false;
@@ -211,7 +211,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	net->ipv6.ip6_prohibit_entry = kmemdup(&ip6_prohibit_entry_template,
  					       sizeof(*net->ipv6.ip6_prohibit_entry),
  					       GFP_KERNEL);
-@@ -6505,11 +6541,21 @@ static int __net_init ip6_route_net_init
+@@ -6570,11 +6606,21 @@ static int __net_init ip6_route_net_init
  			 ip6_template_metrics, true);
  	INIT_LIST_HEAD(&net->ipv6.ip6_prohibit_entry->dst.rt_uncached);
  
@@ -234,7 +234,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
  	dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
  			 ip6_template_metrics, true);
-@@ -6536,6 +6582,8 @@ out:
+@@ -6601,6 +6647,8 @@ out:
  	return ret;
  
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
@@ -243,7 +243,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  out_ip6_prohibit_entry:
  	kfree(net->ipv6.ip6_prohibit_entry);
  out_ip6_null_entry:
-@@ -6555,6 +6603,7 @@ static void __net_exit ip6_route_net_exi
+@@ -6620,6 +6668,7 @@ static void __net_exit ip6_route_net_exi
  	kfree(net->ipv6.ip6_null_entry);
  #ifdef CONFIG_IPV6_MULTIPLE_TABLES
  	kfree(net->ipv6.ip6_prohibit_entry);
@@ -251,7 +251,7 @@ Signed-off-by: Jonas Gorski <jogo@openwrt.org>
  	kfree(net->ipv6.ip6_blk_hole_entry);
  #endif
  	dst_entries_destroy(&net->ipv6.ip6_dst_ops);
-@@ -6638,6 +6687,9 @@ void __init ip6_route_init_special_entri
+@@ -6703,6 +6752,9 @@ void __init ip6_route_init_special_entri
  	init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
  	init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
  	init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
diff --git a/target/linux/generic/pending-6.6/680-net-add-TCP-fraglist-GRO-support.patch b/target/linux/generic/pending-6.6/680-net-add-TCP-fraglist-GRO-support.patch
index b810e7ec91a48d..bb2beff43a1e10 100644
--- a/target/linux/generic/pending-6.6/680-net-add-TCP-fraglist-GRO-support.patch
+++ b/target/linux/generic/pending-6.6/680-net-add-TCP-fraglist-GRO-support.patch
@@ -31,7 +31,7 @@ Signe-off-by: Felix Fietkau <nbd@nbd.name>
  static inline void gro_normal_list(struct napi_struct *napi)
 --- a/include/net/tcp.h
 +++ b/include/net/tcp.h
-@@ -2084,7 +2084,10 @@ void tcp_v4_destroy_sock(struct sock *sk
+@@ -2101,7 +2101,10 @@ void tcp_v4_destroy_sock(struct sock *sk
  
  struct sk_buff *tcp_gso_segment(struct sk_buff *skb,
  				netdev_features_t features);
@@ -81,7 +81,7 @@ Signe-off-by: Felix Fietkau <nbd@nbd.name>
  {
 --- a/net/ipv4/tcp_offload.c
 +++ b/net/ipv4/tcp_offload.c
-@@ -28,6 +28,70 @@ static void tcp_gso_tstamp(struct sk_buf
+@@ -31,6 +31,70 @@ static void tcp_gso_tstamp(struct sk_buf
  	}
  }
  
@@ -152,7 +152,7 @@ Signe-off-by: Felix Fietkau <nbd@nbd.name>
  static struct sk_buff *tcp4_gso_segment(struct sk_buff *skb,
  					netdev_features_t features)
  {
-@@ -37,6 +101,9 @@ static struct sk_buff *tcp4_gso_segment(
+@@ -40,6 +104,9 @@ static struct sk_buff *tcp4_gso_segment(
  	if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
  		return ERR_PTR(-EINVAL);
  
@@ -162,7 +162,7 @@ Signe-off-by: Felix Fietkau <nbd@nbd.name>
  	if (unlikely(skb->ip_summed != CHECKSUM_PARTIAL)) {
  		const struct iphdr *iph = ip_hdr(skb);
  		struct tcphdr *th = tcp_hdr(skb);
-@@ -181,61 +248,76 @@ out:
+@@ -184,61 +251,76 @@ out:
  	return segs;
  }
  
@@ -269,7 +269,7 @@ Signe-off-by: Felix Fietkau <nbd@nbd.name>
  	flush = NAPI_GRO_CB(p)->flush;
  	flush |= (__force int)(flags & TCP_FLAG_CWR);
  	flush |= (__force int)((flags ^ tcp_flag_word(th2)) &
-@@ -272,6 +354,19 @@ found:
+@@ -275,6 +357,19 @@ found:
  	flush |= p->decrypted ^ skb->decrypted;
  #endif
  
@@ -289,7 +289,7 @@ Signe-off-by: Felix Fietkau <nbd@nbd.name>
  	if (flush || skb_gro_receive(p, skb)) {
  		mss = 1;
  		goto out_check_final;
-@@ -293,7 +388,6 @@ out_check_final:
+@@ -296,7 +391,6 @@ out_check_final:
  	if (p && (!NAPI_GRO_CB(skb)->same_flow || flush))
  		pp = p;
  
@@ -297,7 +297,7 @@ Signe-off-by: Felix Fietkau <nbd@nbd.name>
  	NAPI_GRO_CB(skb)->flush |= (flush != 0);
  
  	return pp;
-@@ -317,18 +411,58 @@ void tcp_gro_complete(struct sk_buff *sk
+@@ -320,18 +414,58 @@ void tcp_gro_complete(struct sk_buff *sk
  }
  EXPORT_SYMBOL(tcp_gro_complete);
  
@@ -361,7 +361,7 @@ Signe-off-by: Felix Fietkau <nbd@nbd.name>
  }
  
  INDIRECT_CALLABLE_SCOPE int tcp4_gro_complete(struct sk_buff *skb, int thoff)
-@@ -336,6 +470,15 @@ INDIRECT_CALLABLE_SCOPE int tcp4_gro_com
+@@ -339,6 +473,15 @@ INDIRECT_CALLABLE_SCOPE int tcp4_gro_com
  	const struct iphdr *iph = ip_hdr(skb);
  	struct tcphdr *th = tcp_hdr(skb);
  
@@ -379,7 +379,7 @@ Signe-off-by: Felix Fietkau <nbd@nbd.name>
  	skb_shinfo(skb)->gso_type |= SKB_GSO_TCPV4;
 --- a/net/ipv4/udp_offload.c
 +++ b/net/ipv4/udp_offload.c
-@@ -470,33 +470,6 @@ out:
+@@ -538,33 +538,6 @@ out:
  	return segs;
  }
  
diff --git a/target/linux/generic/pending-6.6/681-net-remove-NETIF_F_GSO_FRAGLIST-from-NETIF_F_GSO_SOF.patch b/target/linux/generic/pending-6.6/681-net-remove-NETIF_F_GSO_FRAGLIST-from-NETIF_F_GSO_SOF.patch
index 97e321bfec13e9..126ee5e520c70d 100644
--- a/target/linux/generic/pending-6.6/681-net-remove-NETIF_F_GSO_FRAGLIST-from-NETIF_F_GSO_SOF.patch
+++ b/target/linux/generic/pending-6.6/681-net-remove-NETIF_F_GSO_FRAGLIST-from-NETIF_F_GSO_SOF.patch
@@ -65,7 +65,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
 --- a/net/8021q/vlan.h
 +++ b/net/8021q/vlan.h
-@@ -108,7 +108,7 @@ static inline netdev_features_t vlan_tnl
+@@ -109,7 +109,7 @@ static inline netdev_features_t vlan_tnl
  	netdev_features_t ret;
  
  	ret = real_dev->hw_enc_features &
@@ -76,7 +76,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if ((ret & NETIF_F_GSO_ENCAP_ALL) && (ret & NETIF_F_CSUM_MASK))
 --- a/net/8021q/vlan_dev.c
 +++ b/net/8021q/vlan_dev.c
-@@ -583,7 +583,7 @@ static int vlan_dev_init(struct net_devi
+@@ -560,7 +560,7 @@ static int vlan_dev_init(struct net_devi
  		dev->state |= (1 << __LINK_STATE_NOCARRIER);
  
  	dev->hw_features = NETIF_F_HW_CSUM | NETIF_F_SG |
@@ -85,7 +85,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			   NETIF_F_GSO_ENCAP_ALL |
  			   NETIF_F_HIGHDMA | NETIF_F_SCTP_CRC |
  			   NETIF_F_ALL_FCOE;
-@@ -676,7 +676,7 @@ static netdev_features_t vlan_dev_fix_fe
+@@ -653,7 +653,7 @@ static netdev_features_t vlan_dev_fix_fe
  	if (lower_features & (NETIF_F_IP_CSUM|NETIF_F_IPV6_CSUM))
  		lower_features |= NETIF_F_HW_CSUM;
  	features = netdev_intersect_features(features, lower_features);
@@ -96,7 +96,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	return features;
 --- a/net/core/sock.c
 +++ b/net/core/sock.c
-@@ -2441,7 +2441,7 @@ void sk_setup_caps(struct sock *sk, stru
+@@ -2461,7 +2461,7 @@ void sk_setup_caps(struct sock *sk, stru
  	if (sk_is_tcp(sk))
  		sk->sk_route_caps |= NETIF_F_GSO;
  	if (sk->sk_route_caps & NETIF_F_GSO)
@@ -107,7 +107,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  	if (sk_can_gso(sk)) {
 --- a/net/mac80211/ieee80211_i.h
 +++ b/net/mac80211/ieee80211_i.h
-@@ -1996,7 +1996,7 @@ void ieee80211_color_collision_detection
+@@ -2005,7 +2005,7 @@ void ieee80211_color_collision_detection
  /* interface handling */
  #define MAC80211_SUPPORTED_FEATURES_TX	(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | \
  					 NETIF_F_HW_CSUM | NETIF_F_SG | \
diff --git a/target/linux/generic/pending-6.6/685-net-gso-fix-tcp-fraglist-segmentation-after-pull-fro.patch b/target/linux/generic/pending-6.6/685-net-gso-fix-tcp-fraglist-segmentation-after-pull-fro.patch
index 235762b5c01d63..ea0fe0c9ab45b7 100644
--- a/target/linux/generic/pending-6.6/685-net-gso-fix-tcp-fraglist-segmentation-after-pull-fro.patch
+++ b/target/linux/generic/pending-6.6/685-net-gso-fix-tcp-fraglist-segmentation-after-pull-fro.patch
@@ -36,7 +36,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/ipv4/tcp_offload.c
 +++ b/net/ipv4/tcp_offload.c
-@@ -101,8 +101,14 @@ static struct sk_buff *tcp4_gso_segment(
+@@ -104,8 +104,14 @@ static struct sk_buff *tcp4_gso_segment(
  	if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
  		return ERR_PTR(-EINVAL);
  
diff --git a/target/linux/generic/pending-6.6/686-net-ipv6-fix-TCP-GSO-segmentation-with-NAT.patch b/target/linux/generic/pending-6.6/686-net-ipv6-fix-TCP-GSO-segmentation-with-NAT.patch
new file mode 100644
index 00000000000000..9591e16ec9107d
--- /dev/null
+++ b/target/linux/generic/pending-6.6/686-net-ipv6-fix-TCP-GSO-segmentation-with-NAT.patch
@@ -0,0 +1,54 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Mon, 24 Feb 2025 12:18:23 +0100
+Subject: [PATCH] net: ipv6: fix TCP GSO segmentation with NAT
+
+When updating the source/destination address, the TCP/UDP checksum needs to
+be updated as well.
+
+Fixes: bee88cd5bd83 ("net: add support for segmenting TCP fraglist GSO packets")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/net/ipv6/tcpv6_offload.c
++++ b/net/ipv6/tcpv6_offload.c
+@@ -112,24 +112,36 @@ static struct sk_buff *__tcpv6_gso_segme
+ 	struct sk_buff *seg;
+ 	struct tcphdr *th2;
+ 	struct ipv6hdr *iph2;
++	bool addr_equal;
+ 
+ 	seg = segs;
+ 	th = tcp_hdr(seg);
+ 	iph = ipv6_hdr(seg);
+ 	th2 = tcp_hdr(seg->next);
+ 	iph2 = ipv6_hdr(seg->next);
++	addr_equal = ipv6_addr_equal(&iph->saddr, &iph2->saddr) &&
++		     ipv6_addr_equal(&iph->daddr, &iph2->daddr);
+ 
+ 	if (!(*(const u32 *)&th->source ^ *(const u32 *)&th2->source) &&
+-	    ipv6_addr_equal(&iph->saddr, &iph2->saddr) &&
+-	    ipv6_addr_equal(&iph->daddr, &iph2->daddr))
++	    addr_equal)
+ 		return segs;
+ 
+ 	while ((seg = seg->next)) {
+ 		th2 = tcp_hdr(seg);
+ 		iph2 = ipv6_hdr(seg);
+ 
+-		iph2->saddr = iph->saddr;
+-		iph2->daddr = iph->daddr;
++		if (!addr_equal) {
++			inet_proto_csum_replace16(&th2->check, seg,
++						  iph2->saddr.s6_addr32,
++						  iph->saddr.s6_addr32,
++						  true);
++			inet_proto_csum_replace16(&th2->check, seg,
++						  iph2->daddr.s6_addr32,
++						  iph->daddr.s6_addr32,
++						  true);
++			iph2->saddr = iph->saddr;
++			iph2->daddr = iph->daddr;
++		}
+ 		__tcpv6_gso_segment_csum(seg, &th2->source, th->source);
+ 		__tcpv6_gso_segment_csum(seg, &th2->dest, th->dest);
+ 	}
diff --git a/target/linux/generic/pending-6.6/700-netfilter-nft_flow_offload-handle-netdevice-events-f.patch b/target/linux/generic/pending-6.6/700-netfilter-nft_flow_offload-handle-netdevice-events-f.patch
index 6b93f47772e13b..c69be593f900cd 100644
--- a/target/linux/generic/pending-6.6/700-netfilter-nft_flow_offload-handle-netdevice-events-f.patch
+++ b/target/linux/generic/pending-6.6/700-netfilter-nft_flow_offload-handle-netdevice-events-f.patch
@@ -10,7 +10,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
 
 --- a/net/netfilter/nf_flow_table_core.c
 +++ b/net/netfilter/nf_flow_table_core.c
-@@ -662,6 +662,23 @@ static struct pernet_operations nf_flow_
+@@ -658,6 +658,23 @@ static struct pernet_operations nf_flow_
  	.exit_batch = nf_flow_table_pernet_exit,
  };
  
@@ -34,7 +34,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  static int __init nf_flow_table_module_init(void)
  {
  	int ret;
-@@ -674,8 +691,14 @@ static int __init nf_flow_table_module_i
+@@ -670,8 +687,14 @@ static int __init nf_flow_table_module_i
  	if (ret)
  		goto out_offload;
  
@@ -49,7 +49,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  out_offload:
  	unregister_pernet_subsys(&nf_flow_table_net_ops);
  	return ret;
-@@ -683,6 +706,7 @@ out_offload:
+@@ -679,6 +702,7 @@ out_offload:
  
  static void __exit nf_flow_table_module_exit(void)
  {
@@ -59,7 +59,7 @@ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
  }
 --- a/net/netfilter/nft_flow_offload.c
 +++ b/net/netfilter/nft_flow_offload.c
-@@ -480,47 +480,14 @@ static struct nft_expr_type nft_flow_off
+@@ -486,47 +486,14 @@ static struct nft_expr_type nft_flow_off
  	.owner		= THIS_MODULE,
  };
  
diff --git a/target/linux/generic/pending-6.6/701-netfilter-nf_tables-ignore-EOPNOTSUPP-on-flowtable-d.patch b/target/linux/generic/pending-6.6/701-netfilter-nf_tables-ignore-EOPNOTSUPP-on-flowtable-d.patch
index f27581d3e922b3..7a5413700a92bc 100644
--- a/target/linux/generic/pending-6.6/701-netfilter-nf_tables-ignore-EOPNOTSUPP-on-flowtable-d.patch
+++ b/target/linux/generic/pending-6.6/701-netfilter-nf_tables-ignore-EOPNOTSUPP-on-flowtable-d.patch
@@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/netfilter/nf_tables_api.c
 +++ b/net/netfilter/nf_tables_api.c
-@@ -8376,7 +8376,7 @@ static int nft_register_flowtable_net_ho
+@@ -8449,7 +8449,7 @@ static int nft_register_flowtable_net_ho
  		err = flowtable->data.type->setup(&flowtable->data,
  						  hook->ops.dev,
  						  FLOW_BLOCK_BIND);
diff --git a/target/linux/generic/pending-6.6/702-net-ethernet-mtk_eth_soc-enable-threaded-NAPI.patch b/target/linux/generic/pending-6.6/702-net-ethernet-mtk_eth_soc-enable-threaded-NAPI.patch
index 5563bf1f93c329..cd3c9df2bbd035 100644
--- a/target/linux/generic/pending-6.6/702-net-ethernet-mtk_eth_soc-enable-threaded-NAPI.patch
+++ b/target/linux/generic/pending-6.6/702-net-ethernet-mtk_eth_soc-enable-threaded-NAPI.patch
@@ -10,7 +10,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -5036,6 +5036,8 @@ static int mtk_probe(struct platform_dev
+@@ -5064,6 +5064,8 @@ static int mtk_probe(struct platform_dev
  	 * for NAPI to work
  	 */
  	init_dummy_netdev(&eth->dummy_dev);
diff --git a/target/linux/generic/pending-6.6/703-phy-add-detach-callback-to-struct-phy_driver.patch b/target/linux/generic/pending-6.6/703-phy-add-detach-callback-to-struct-phy_driver.patch
index a556a9cc407149..453abe65c64014 100644
--- a/target/linux/generic/pending-6.6/703-phy-add-detach-callback-to-struct-phy_driver.patch
+++ b/target/linux/generic/pending-6.6/703-phy-add-detach-callback-to-struct-phy_driver.patch
@@ -11,9 +11,9 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
 
 --- a/drivers/net/phy/phy_device.c
 +++ b/drivers/net/phy/phy_device.c
-@@ -1910,6 +1910,9 @@ void phy_detach(struct phy_device *phyde
- 	if (phydev->devlink)
- 		device_link_del(phydev->devlink);
+@@ -1912,6 +1912,9 @@ void phy_detach(struct phy_device *phyde
+ 		phydev->devlink = NULL;
+ 	}
  
 +	if (phydev->drv && phydev->drv->detach)
 +		phydev->drv->detach(phydev);
@@ -23,7 +23,7 @@ Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
  			sysfs_remove_link(&dev->dev.kobj, "phydev");
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -980,6 +980,12 @@ struct phy_driver {
+@@ -977,6 +977,12 @@ struct phy_driver {
  	/** @handle_interrupt: Override default interrupt handling */
  	irqreturn_t (*handle_interrupt)(struct phy_device *phydev);
  
diff --git a/target/linux/generic/pending-6.6/704-netfilter-nf_tables-fix-bidirectional-offload-regres.patch b/target/linux/generic/pending-6.6/704-netfilter-nf_tables-fix-bidirectional-offload-regres.patch
index d1d6fa3fe1f12c..a538c3333ed1b9 100644
--- a/target/linux/generic/pending-6.6/704-netfilter-nf_tables-fix-bidirectional-offload-regres.patch
+++ b/target/linux/generic/pending-6.6/704-netfilter-nf_tables-fix-bidirectional-offload-regres.patch
@@ -14,9 +14,9 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/net/netfilter/nft_flow_offload.c
 +++ b/net/netfilter/nft_flow_offload.c
-@@ -361,6 +361,7 @@ static void nft_flow_offload_eval(const
- 		ct->proto.tcp.seen[1].flags |= IP_CT_TCP_FLAG_BE_LIBERAL;
- 	}
+@@ -367,6 +367,7 @@ static void nft_flow_offload_eval(const
+ 	if (tcph)
+ 		flow_offload_ct_tcp(ct);
  
 +	__set_bit(NF_FLOW_HW_BIDIRECTIONAL, &flow->flags);
  	ret = flow_offload_add(flowtable, flow);
diff --git a/target/linux/generic/pending-6.6/710-bridge-add-knob-for-filtering-rx-tx-BPDU-pack.patch b/target/linux/generic/pending-6.6/710-bridge-add-knob-for-filtering-rx-tx-BPDU-pack.patch
index 96e1a19db4c7c1..d62ccc571ce898 100644
--- a/target/linux/generic/pending-6.6/710-bridge-add-knob-for-filtering-rx-tx-BPDU-pack.patch
+++ b/target/linux/generic/pending-6.6/710-bridge-add-knob-for-filtering-rx-tx-BPDU-pack.patch
@@ -45,7 +45,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  			if (!(p->flags & BR_BCAST_FLOOD) && skb->dev != br->dev)
 --- a/net/bridge/br_input.c
 +++ b/net/bridge/br_input.c
-@@ -367,6 +367,8 @@ static rx_handler_result_t br_handle_fra
+@@ -369,6 +369,8 @@ static rx_handler_result_t br_handle_fra
  		fwd_mask |= p->group_fwd_mask;
  		switch (dest[5]) {
  		case 0x00:	/* Bridge Group Address */
@@ -161,7 +161,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  
  struct rtnl_link {
  	rtnl_doit_func		doit;
-@@ -4978,7 +4978,9 @@ int ndo_dflt_bridge_getlink(struct sk_bu
+@@ -4981,7 +4981,9 @@ int ndo_dflt_bridge_getlink(struct sk_bu
  	    brport_nla_put_flag(skb, flags, mask,
  				IFLA_BRPORT_MCAST_FLOOD, BR_MCAST_FLOOD) ||
  	    brport_nla_put_flag(skb, flags, mask,
diff --git a/target/linux/generic/pending-6.6/711-01-net-dsa-qca8k-implement-lag_fdb_add-del-ops.patch b/target/linux/generic/pending-6.6/711-01-net-dsa-qca8k-implement-lag_fdb_add-del-ops.patch
index 3197aea0914b36..8d815dd2f2bc32 100644
--- a/target/linux/generic/pending-6.6/711-01-net-dsa-qca8k-implement-lag_fdb_add-del-ops.patch
+++ b/target/linux/generic/pending-6.6/711-01-net-dsa-qca8k-implement-lag_fdb_add-del-ops.patch
@@ -27,7 +27,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
  	.port_mirror_add	= qca8k_port_mirror_add,
 --- a/drivers/net/dsa/qca/qca8k-common.c
 +++ b/drivers/net/dsa/qca/qca8k-common.c
-@@ -1215,6 +1215,42 @@ int qca8k_port_lag_leave(struct dsa_swit
+@@ -1235,6 +1235,42 @@ int qca8k_port_lag_leave(struct dsa_swit
  	return qca8k_lag_refresh_portmap(ds, port, lag, true);
  }
  
@@ -72,7 +72,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
  	u32 val;
 --- a/drivers/net/dsa/qca/qca8k.h
 +++ b/drivers/net/dsa/qca/qca8k.h
-@@ -590,5 +590,11 @@ int qca8k_port_lag_join(struct dsa_switc
+@@ -591,5 +591,11 @@ int qca8k_port_lag_join(struct dsa_switc
  			struct netlink_ext_ack *extack);
  int qca8k_port_lag_leave(struct dsa_switch *ds, int port,
  			 struct dsa_lag lag);
diff --git a/target/linux/generic/pending-6.6/720-01-net-phy-realtek-use-genphy_soft_reset-for-2.5G-PHYs.patch b/target/linux/generic/pending-6.6/720-01-net-phy-realtek-use-genphy_soft_reset-for-2.5G-PHYs.patch
index 2b77b6e02f9881..1becba6da6f73a 100644
--- a/target/linux/generic/pending-6.6/720-01-net-phy-realtek-use-genphy_soft_reset-for-2.5G-PHYs.patch
+++ b/target/linux/generic/pending-6.6/720-01-net-phy-realtek-use-genphy_soft_reset-for-2.5G-PHYs.patch
@@ -10,12 +10,12 @@ the PHY.
 Reported-by: Yevhen Kolomeiko <jarvis2709@gmail.com>
 Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 ---
- drivers/net/phy/realtek.c | 6 ++++++
+ drivers/net/phy/realtek/realtek_main.c | 6 ++++++
  1 file changed, 6 insertions(+)
 
---- a/drivers/net/phy/realtek.c
-+++ b/drivers/net/phy/realtek.c
-@@ -1375,6 +1375,7 @@ static struct phy_driver realtek_drvs[]
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -1638,6 +1638,7 @@ static struct phy_driver realtek_drvs[]
  	}, {
  		.name		= "RTL8226 2.5Gbps PHY",
  		.match_phy_device = rtl8226_match_phy_device,
@@ -23,15 +23,15 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		.get_features	= rtl822x_get_features,
  		.config_aneg	= rtl822x_config_aneg,
  		.read_status	= rtl822x_read_status,
-@@ -1387,6 +1388,7 @@ static struct phy_driver realtek_drvs[]
+@@ -1648,6 +1649,7 @@ static struct phy_driver realtek_drvs[]
  	}, {
- 		PHY_ID_MATCH_EXACT(0x001cc840),
+ 		.match_phy_device = rtl8221b_match_phy_device,
  		.name		= "RTL8226B_RTL8221B 2.5Gbps PHY",
 +		.soft_reset     = genphy_soft_reset,
  		.get_features	= rtl822x_get_features,
  		.config_aneg	= rtl822x_config_aneg,
  		.config_init    = rtl822xb_config_init,
-@@ -1401,6 +1403,7 @@ static struct phy_driver realtek_drvs[]
+@@ -1660,6 +1662,7 @@ static struct phy_driver realtek_drvs[]
  	}, {
  		PHY_ID_MATCH_EXACT(0x001cc838),
  		.name           = "RTL8226-CG 2.5Gbps PHY",
@@ -39,7 +39,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		.get_features   = rtl822x_get_features,
  		.config_aneg    = rtl822x_config_aneg,
  		.read_status    = rtl822x_read_status,
-@@ -1411,6 +1414,7 @@ static struct phy_driver realtek_drvs[]
+@@ -1670,6 +1673,7 @@ static struct phy_driver realtek_drvs[]
  	}, {
  		PHY_ID_MATCH_EXACT(0x001cc848),
  		.name           = "RTL8226B-CG_RTL8221B-CG 2.5Gbps PHY",
@@ -47,35 +47,35 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		.get_features   = rtl822x_get_features,
  		.config_aneg    = rtl822x_config_aneg,
  		.config_init    = rtl822xb_config_init,
-@@ -1423,6 +1427,7 @@ static struct phy_driver realtek_drvs[]
+@@ -1682,6 +1686,7 @@ static struct phy_driver realtek_drvs[]
  	}, {
  		.match_phy_device = rtl8221b_vb_cg_c22_match_phy_device,
  		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C22)",
 +		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
  		.get_features   = rtl822x_get_features,
  		.config_aneg    = rtl822x_config_aneg,
- 		.config_init    = rtl822xb_config_init,
-@@ -1435,6 +1440,7 @@ static struct phy_driver realtek_drvs[]
+@@ -1695,6 +1700,7 @@ static struct phy_driver realtek_drvs[]
  	}, {
  		.match_phy_device = rtl8221b_vb_cg_c45_match_phy_device,
  		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C45)",
 +		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
  		.config_init    = rtl822xb_config_init,
  		.get_rate_matching = rtl822xb_get_rate_matching,
- 		.get_features   = rtl822x_c45_get_features,
-@@ -1445,6 +1451,7 @@ static struct phy_driver realtek_drvs[]
+@@ -1706,6 +1712,7 @@ static struct phy_driver realtek_drvs[]
  	}, {
  		.match_phy_device = rtl8221b_vn_cg_c22_match_phy_device,
  		.name           = "RTL8221B-VM-CG 2.5Gbps PHY (C22)",
 +		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
  		.get_features   = rtl822x_get_features,
  		.config_aneg    = rtl822x_config_aneg,
- 		.config_init    = rtl822xb_config_init,
-@@ -1457,6 +1464,7 @@ static struct phy_driver realtek_drvs[]
+@@ -1719,6 +1726,7 @@ static struct phy_driver realtek_drvs[]
  	}, {
  		.match_phy_device = rtl8221b_vn_cg_c45_match_phy_device,
  		.name           = "RTL8221B-VN-CG 2.5Gbps PHY (C45)",
 +		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
  		.config_init    = rtl822xb_config_init,
  		.get_rate_matching = rtl822xb_get_rate_matching,
- 		.get_features   = rtl822x_c45_get_features,
diff --git a/target/linux/generic/pending-6.6/720-02-net-phy-realtek-disable-SGMII-in-band-AN-for-2-5G-PHYs.patch b/target/linux/generic/pending-6.6/720-02-net-phy-realtek-disable-SGMII-in-band-AN-for-2-5G-PHYs.patch
index cbef74d317b0e5..e11a7984d4541a 100644
--- a/target/linux/generic/pending-6.6/720-02-net-phy-realtek-disable-SGMII-in-band-AN-for-2-5G-PHYs.patch
+++ b/target/linux/generic/pending-6.6/720-02-net-phy-realtek-disable-SGMII-in-band-AN-for-2-5G-PHYs.patch
@@ -15,12 +15,12 @@ Reported-by: Yevhen Kolomeiko <jarvis2709@gmail.com>
 Tested-by: Yevhen Kolomeiko <jarvis2709@gmail.com>
 Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 ---
- drivers/net/phy/realtek.c | 27 +++++++++++++++++++++++++--
+ drivers/net/phy/realtek/realtek_main.c | 27 +++++++++++++++++++++++++--
  1 file changed, 25 insertions(+), 2 deletions(-)
 
---- a/drivers/net/phy/realtek.c
-+++ b/drivers/net/phy/realtek.c
-@@ -814,8 +814,8 @@ static int rtl822x_write_mmd(struct phy_
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -1035,8 +1035,8 @@ static int rtl822x_probe(struct phy_devi
  static int rtl822xb_config_init(struct phy_device *phydev)
  {
  	bool has_2500, has_sgmii;
@@ -30,7 +30,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  	has_2500 = test_bit(PHY_INTERFACE_MODE_2500BASEX,
  			    phydev->host_interfaces) ||
-@@ -865,7 +865,29 @@ static int rtl822xb_config_init(struct p
+@@ -1086,7 +1086,29 @@ static int rtl822xb_config_init(struct p
  	if (ret < 0)
  		return ret;
  
diff --git a/target/linux/generic/pending-6.6/720-03-net-phy-realtek-make-sure-paged-read-is-protected-by.patch b/target/linux/generic/pending-6.6/720-03-net-phy-realtek-make-sure-paged-read-is-protected-by.patch
index 216fa918e1f670..e6656445dbb9a1 100644
--- a/target/linux/generic/pending-6.6/720-03-net-phy-realtek-make-sure-paged-read-is-protected-by.patch
+++ b/target/linux/generic/pending-6.6/720-03-net-phy-realtek-make-sure-paged-read-is-protected-by.patch
@@ -13,12 +13,12 @@ rtl821x_write_page instead of 3 individually locked MDIO bus operations.
 
 Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 ---
- drivers/net/phy/realtek.c | 8 +++++---
+ drivers/net/phy/realtek/realtek_main.c | 8 +++++---
  1 file changed, 5 insertions(+), 3 deletions(-)
 
---- a/drivers/net/phy/realtek.c
-+++ b/drivers/net/phy/realtek.c
-@@ -1092,9 +1092,11 @@ static bool rtlgen_supports_2_5gbps(stru
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -1313,9 +1313,11 @@ static bool rtlgen_supports_2_5gbps(stru
  {
  	int val;
  
diff --git a/target/linux/generic/pending-6.6/720-04-net-phy-realtek-introduce-rtl822x_probe.patch b/target/linux/generic/pending-6.6/720-04-net-phy-realtek-introduce-rtl822x_probe.patch
deleted file mode 100644
index 08c13f34e44097..00000000000000
--- a/target/linux/generic/pending-6.6/720-04-net-phy-realtek-introduce-rtl822x_probe.patch
+++ /dev/null
@@ -1,100 +0,0 @@
-From 9155098547fb1172d4fa536f3f6bc9d42f59d08c Mon Sep 17 00:00:00 2001
-From: Daniel Golle <daniel@makrotopia.org>
-Date: Sat, 22 Apr 2023 03:26:01 +0100
-Subject: [PATCH] net: phy: realtek: setup ALDPS on RTL822x
-
-Setup Link Down Power Saving Mode according the DTS property
-just like for RTL821x 1GE PHYs.
-
-Signed-off-by: Daniel Golle <daniel@makrotopia.org>
----
- drivers/net/phy/realtek.c | 11 +++++++++++
- 1 file changed, 11 insertions(+)
-
---- a/drivers/net/phy/realtek.c
-+++ b/drivers/net/phy/realtek.c
-@@ -80,6 +80,10 @@
- 
- #define RTL822X_VND2_GANLPAR				0xa414
- 
-+#define RTL8221B_PHYCR1				0xa430
-+#define RTL8221B_PHYCR1_ALDPS_EN		BIT(2)
-+#define RTL8221B_PHYCR1_ALDPS_XTAL_OFF_EN	BIT(12)
-+
- #define RTL8366RB_POWER_SAVE			0x15
- #define RTL8366RB_POWER_SAVE_ON			BIT(12)
- 
-@@ -1152,6 +1156,25 @@ static int rtl8251b_c45_match_phy_device
- 	return rtlgen_is_c45_match(phydev, RTL_8251B, true);
- }
- 
-+static int rtl822x_probe(struct phy_device *phydev)
-+{
-+	struct device *dev = &phydev->mdio.dev;
-+	int val;
-+
-+	val = phy_read_mmd(phydev, MDIO_MMD_VEND1, RTL8221B_PHYCR1);
-+	if (val < 0)
-+		return val;
-+
-+	if (of_property_read_bool(dev->of_node, "realtek,aldps-enable"))
-+		val |= RTL8221B_PHYCR1_ALDPS_EN | RTL8221B_PHYCR1_ALDPS_XTAL_OFF_EN;
-+	else
-+		val &= ~(RTL8221B_PHYCR1_ALDPS_EN | RTL8221B_PHYCR1_ALDPS_XTAL_OFF_EN);
-+
-+	phy_write_mmd(phydev, MDIO_MMD_VEND1, RTL8221B_PHYCR1, val);
-+
-+	return 0;
-+}
-+
- static int rtlgen_resume(struct phy_device *phydev)
- {
- 	int ret = genphy_resume(phydev);
-@@ -1427,6 +1450,7 @@ static struct phy_driver realtek_drvs[]
- 	}, {
- 		PHY_ID_MATCH_EXACT(0x001cc838),
- 		.name           = "RTL8226-CG 2.5Gbps PHY",
-+		.probe          = rtl822x_probe,
- 		.soft_reset     = genphy_soft_reset,
- 		.get_features   = rtl822x_get_features,
- 		.config_aneg    = rtl822x_config_aneg,
-@@ -1438,6 +1462,7 @@ static struct phy_driver realtek_drvs[]
- 	}, {
- 		PHY_ID_MATCH_EXACT(0x001cc848),
- 		.name           = "RTL8226B-CG_RTL8221B-CG 2.5Gbps PHY",
-+		.probe          = rtl822x_probe,
- 		.soft_reset     = genphy_soft_reset,
- 		.get_features   = rtl822x_get_features,
- 		.config_aneg    = rtl822x_config_aneg,
-@@ -1451,6 +1476,7 @@ static struct phy_driver realtek_drvs[]
- 	}, {
- 		.match_phy_device = rtl8221b_vb_cg_c22_match_phy_device,
- 		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C22)",
-+		.probe          = rtl822x_probe,
- 		.soft_reset     = genphy_soft_reset,
- 		.get_features   = rtl822x_get_features,
- 		.config_aneg    = rtl822x_config_aneg,
-@@ -1464,6 +1490,7 @@ static struct phy_driver realtek_drvs[]
- 	}, {
- 		.match_phy_device = rtl8221b_vb_cg_c45_match_phy_device,
- 		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C45)",
-+		.probe          = rtl822x_probe,
- 		.soft_reset     = genphy_soft_reset,
- 		.config_init    = rtl822xb_config_init,
- 		.get_rate_matching = rtl822xb_get_rate_matching,
-@@ -1475,6 +1502,7 @@ static struct phy_driver realtek_drvs[]
- 	}, {
- 		.match_phy_device = rtl8221b_vn_cg_c22_match_phy_device,
- 		.name           = "RTL8221B-VM-CG 2.5Gbps PHY (C22)",
-+		.probe          = rtl822x_probe,
- 		.soft_reset     = genphy_soft_reset,
- 		.get_features   = rtl822x_get_features,
- 		.config_aneg    = rtl822x_config_aneg,
-@@ -1488,6 +1516,7 @@ static struct phy_driver realtek_drvs[]
- 	}, {
- 		.match_phy_device = rtl8221b_vn_cg_c45_match_phy_device,
- 		.name           = "RTL8221B-VN-CG 2.5Gbps PHY (C45)",
-+		.probe          = rtl822x_probe,
- 		.soft_reset     = genphy_soft_reset,
- 		.config_init    = rtl822xb_config_init,
- 		.get_rate_matching = rtl822xb_get_rate_matching,
diff --git a/target/linux/generic/pending-6.6/720-04-net-phy-realtek-setup-aldps.patch b/target/linux/generic/pending-6.6/720-04-net-phy-realtek-setup-aldps.patch
new file mode 100644
index 00000000000000..b36e54717d10b7
--- /dev/null
+++ b/target/linux/generic/pending-6.6/720-04-net-phy-realtek-setup-aldps.patch
@@ -0,0 +1,42 @@
+From 9155098547fb1172d4fa536f3f6bc9d42f59d08c Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 22 Apr 2023 03:26:01 +0100
+Subject: [PATCH] net: phy: realtek: setup ALDPS on RTL822x
+
+Setup Link Down Power Saving Mode according the DTS property
+just like for RTL821x 1GE PHYs.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek/realtek_main.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -129,6 +129,10 @@
+  */
+ #define RTL822X_VND2_C22_REG(reg)		(0xa400 + 2 * (reg))
+ 
++#define RTL8221B_PHYCR1				0xa430
++#define RTL8221B_PHYCR1_ALDPS_EN		BIT(2)
++#define RTL8221B_PHYCR1_ALDPS_XTAL_OFF_EN	BIT(12)
++
+ #define RTL8366RB_POWER_SAVE			0x15
+ #define RTL8366RB_POWER_SAVE_ON			BIT(12)
+ 
+@@ -1090,6 +1094,15 @@ static int rtl822xb_config_init(struct p
+ 	if (ret < 0)
+ 		return ret;
+ 
++	if (of_property_read_bool(phydev->mdio.dev.of_node, "realtek,aldps-enable"))
++		ret = phy_set_bits_mmd(phydev, MDIO_MMD_VEND1, RTL8221B_PHYCR1,
++				 RTL8221B_PHYCR1_ALDPS_EN | RTL8221B_PHYCR1_ALDPS_XTAL_OFF_EN);
++	else
++		ret = phy_clear_bits_mmd(phydev, MDIO_MMD_VEND1, RTL8221B_PHYCR1,
++				   RTL8221B_PHYCR1_ALDPS_EN | RTL8221B_PHYCR1_ALDPS_XTAL_OFF_EN);
++	if (ret < 0)
++		return ret;
++
+ 	/* Disable SGMII AN */
+ 	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, 0x7588, 0x2);
+ 	if (ret < 0)
diff --git a/target/linux/generic/pending-6.6/720-05-net-phy-realtek-detect-early-version-of-RTL8221B.patch b/target/linux/generic/pending-6.6/720-05-net-phy-realtek-detect-early-version-of-RTL8221B.patch
index 6938552d14df12..0918794d87e265 100644
--- a/target/linux/generic/pending-6.6/720-05-net-phy-realtek-detect-early-version-of-RTL8221B.patch
+++ b/target/linux/generic/pending-6.6/720-05-net-phy-realtek-detect-early-version-of-RTL8221B.patch
@@ -12,9 +12,9 @@ over the implemented MMDs.
 Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 [forward-port by @namiltd]
 Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
---- a/drivers/net/phy/realtek.c
-+++ b/drivers/net/phy/realtek.c
-@@ -1120,10 +1120,32 @@ static int rtl8226_match_phy_device(stru
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -1368,10 +1368,32 @@ static int rtl8226_match_phy_device(stru
  static int rtlgen_is_c45_match(struct phy_device *phydev, unsigned int id,
  			       bool is_c45)
  {
@@ -49,4 +49,4 @@ Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
 +	}
  }
  
- static int rtl8221b_vb_cg_c22_match_phy_device(struct phy_device *phydev)
+ static int rtl8221b_match_phy_device(struct phy_device *phydev)
diff --git a/target/linux/generic/pending-6.6/720-06-net-phy-realtek-support-interrupt-of-RTL8221B.patch b/target/linux/generic/pending-6.6/720-06-net-phy-realtek-support-interrupt-of-RTL8221B.patch
index a796b8f011d5fb..9afe8baca6614a 100644
--- a/target/linux/generic/pending-6.6/720-06-net-phy-realtek-support-interrupt-of-RTL8221B.patch
+++ b/target/linux/generic/pending-6.6/720-06-net-phy-realtek-support-interrupt-of-RTL8221B.patch
@@ -7,12 +7,12 @@ This commit introduces interrupt support for RTL8221B.
 
 Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
 ---
- drivers/net/phy/realtek.c | 47 +++++++++++++++++++++++++++++++++++++++
+ drivers/net/phy/realtek/realtek_main.c | 47 +++++++++++++++++++++++++++++++++++++++
  1 file changed, 47 insertions(+)
 
---- a/drivers/net/phy/realtek.c
-+++ b/drivers/net/phy/realtek.c
-@@ -1332,6 +1332,51 @@ static irqreturn_t rtl9000a_handle_inter
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -1580,6 +1580,51 @@ static irqreturn_t rtl9000a_handle_inter
  	return IRQ_HANDLED;
  }
  
@@ -64,39 +64,39 @@ Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
  static struct phy_driver realtek_drvs[] = {
  	{
  		PHY_ID_MATCH_EXACT(0x00008201),
-@@ -1498,6 +1543,8 @@ static struct phy_driver realtek_drvs[]
+@@ -1745,6 +1790,8 @@ static struct phy_driver realtek_drvs[]
  	}, {
  		.match_phy_device = rtl8221b_vb_cg_c22_match_phy_device,
  		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C22)",
 +		.config_intr	= rtl8221b_config_intr,
 +		.handle_interrupt = rtl8221b_handle_interrupt,
- 		.probe          = rtl822x_probe,
  		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
  		.get_features   = rtl822x_get_features,
-@@ -1512,6 +1559,8 @@ static struct phy_driver realtek_drvs[]
+@@ -1759,6 +1806,8 @@ static struct phy_driver realtek_drvs[]
  	}, {
  		.match_phy_device = rtl8221b_vb_cg_c45_match_phy_device,
  		.name           = "RTL8221B-VB-CG 2.5Gbps PHY (C45)",
 +		.config_intr	= rtl8221b_config_intr,
 +		.handle_interrupt = rtl8221b_handle_interrupt,
- 		.probe          = rtl822x_probe,
  		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
  		.config_init    = rtl822xb_config_init,
-@@ -1524,6 +1573,8 @@ static struct phy_driver realtek_drvs[]
+@@ -1771,6 +1820,8 @@ static struct phy_driver realtek_drvs[]
  	}, {
  		.match_phy_device = rtl8221b_vn_cg_c22_match_phy_device,
  		.name           = "RTL8221B-VM-CG 2.5Gbps PHY (C22)",
 +		.config_intr	= rtl8221b_config_intr,
 +		.handle_interrupt = rtl8221b_handle_interrupt,
- 		.probe          = rtl822x_probe,
  		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
  		.get_features   = rtl822x_get_features,
-@@ -1538,6 +1589,8 @@ static struct phy_driver realtek_drvs[]
+@@ -1785,6 +1836,8 @@ static struct phy_driver realtek_drvs[]
  	}, {
  		.match_phy_device = rtl8221b_vn_cg_c45_match_phy_device,
  		.name           = "RTL8221B-VN-CG 2.5Gbps PHY (C45)",
 +		.config_intr	= rtl8221b_config_intr,
 +		.handle_interrupt = rtl8221b_handle_interrupt,
- 		.probe          = rtl822x_probe,
  		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
  		.config_init    = rtl822xb_config_init,
diff --git a/target/linux/generic/pending-6.6/720-07-net-phy-realtek-mark-existing-MMDs-as-present.patch b/target/linux/generic/pending-6.6/720-07-net-phy-realtek-mark-existing-MMDs-as-present.patch
new file mode 100644
index 00000000000000..20bd666fd2e1d8
--- /dev/null
+++ b/target/linux/generic/pending-6.6/720-07-net-phy-realtek-mark-existing-MMDs-as-present.patch
@@ -0,0 +1,27 @@
+From 1addfb042a9d27788a0fb2c2935045b56fd8560e Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 23 Jan 2025 03:25:29 +0000
+Subject: [PATCH] net: phy: realtek: mark existing MMDs as present
+
+When using Clause-45 mode to access RealTek RTL8221B 2.5G PHYs some
+versions of the PHY fail to report the MMDs present on the PHY.
+Mark MMDs PMAPMD, PCS and AN which are always existing according to
+the datasheet as present to fix that.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/net/phy/realtek/realtek_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -1244,6 +1244,9 @@ static int rtl822x_c45_get_features(stru
+ 	linkmode_set_bit(ETHTOOL_LINK_MODE_TP_BIT,
+ 			 phydev->supported);
+ 
++	phydev->c45_ids.mmds_present |= MDIO_DEVS_PMAPMD | MDIO_DEVS_PCS |
++				        MDIO_DEVS_AN;
++
+ 	return genphy_c45_pma_read_abilities(phydev);
+ }
+ 
diff --git a/target/linux/generic/pending-6.6/720-08-net-phy-realtek-work-around-broken-serdes.patch b/target/linux/generic/pending-6.6/720-08-net-phy-realtek-work-around-broken-serdes.patch
new file mode 100644
index 00000000000000..1749a74e361443
--- /dev/null
+++ b/target/linux/generic/pending-6.6/720-08-net-phy-realtek-work-around-broken-serdes.patch
@@ -0,0 +1,58 @@
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 30 Jan 2025 05:33:12 +0000
+Subject: [PATCH] net: phy: realtek: work around broken SerDes
+
+For still unknown reasons the SerDes init sequence may sometimes
+time out because a self-clearing bit never clears, indicating the
+PHY has entered an unrecoverable error state.
+
+Work-around the issue by triggering a hardware reset and retry the
+setup sequence while warning the user that this has happened.
+This is really more of a work-around than a fix, and should be
+replaced by a better actual fix in future (hopefully).
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -1124,6 +1124,22 @@ static int rtl822xb_config_init(struct p
+ 	return 0;
+ }
+ 
++static int rtl822xb_config_init_war(struct phy_device *phydev)
++{
++	int ret;
++
++	ret = rtl822xb_config_init(phydev);
++
++	if (ret == -ETIMEDOUT) {
++		phydev_warn(phydev, "SerDes setup timed out, retrying\n");
++		phy_device_reset(phydev, 1);
++		phy_device_reset(phydev, 0);
++		ret = rtl822xb_config_init(phydev);
++	}
++
++	return ret;
++}
++
+ static int rtl822xb_get_rate_matching(struct phy_device *phydev,
+ 				      phy_interface_t iface)
+ {
+@@ -1813,7 +1829,7 @@ static struct phy_driver realtek_drvs[]
+ 		.handle_interrupt = rtl8221b_handle_interrupt,
+ 		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
+-		.config_init    = rtl822xb_config_init,
++		.config_init    = rtl822xb_config_init_war,
+ 		.get_rate_matching = rtl822xb_get_rate_matching,
+ 		.get_features   = rtl822x_c45_get_features,
+ 		.config_aneg    = rtl822x_c45_config_aneg,
+@@ -1843,7 +1859,7 @@ static struct phy_driver realtek_drvs[]
+ 		.handle_interrupt = rtl8221b_handle_interrupt,
+ 		.soft_reset     = genphy_soft_reset,
+ 		.probe		= rtl822x_probe,
+-		.config_init    = rtl822xb_config_init,
++		.config_init    = rtl822xb_config_init_war,
+ 		.get_rate_matching = rtl822xb_get_rate_matching,
+ 		.get_features   = rtl822x_c45_get_features,
+ 		.config_aneg    = rtl822x_c45_config_aneg,
diff --git a/target/linux/generic/pending-6.6/720-09-net-phy-realtek-disable-MDIO-broadcast.patch b/target/linux/generic/pending-6.6/720-09-net-phy-realtek-disable-MDIO-broadcast.patch
new file mode 100644
index 00000000000000..bb207500335f12
--- /dev/null
+++ b/target/linux/generic/pending-6.6/720-09-net-phy-realtek-disable-MDIO-broadcast.patch
@@ -0,0 +1,27 @@
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 30 Jan 2025 05:38:31 +0000
+Subject: [PATCH] net: phy: realtek: disable MDIO broadcast
+
+RealTek's PHYs by default also listen on MDIO address 0 which is defined
+as broadcast address. This can lead to problems if there is an actual PHY
+(such as MT7981 built-in PHY) present at this address, as accessing that
+PHY may then confuse the RealTek PHY.
+
+Disabled listening on the MDIO broadcast address to avoid such problems.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+--- a/drivers/net/phy/realtek/realtek_main.c
++++ b/drivers/net/phy/realtek/realtek_main.c
+@@ -1050,6 +1050,11 @@ static int rtl822xb_config_init(struct p
+ 			     phydev->host_interfaces) ||
+ 		    phydev->interface == PHY_INTERFACE_MODE_SGMII;
+ 
++	/* disable listening on MDIO broadcast address (0) */
++	ret = phy_clear_bits_mmd(phydev, MDIO_MMD_VEND2, 0xa430, BIT(13));
++	if (ret < 0)
++		return ret;
++
+ 	/* fill in possible interfaces */
+ 	__assign_bit(PHY_INTERFACE_MODE_2500BASEX, phydev->possible_interfaces,
+ 		     has_2500);
diff --git a/target/linux/generic/pending-6.6/730-net-ethernet-mtk_eth_soc-reset-all-TX-queues-on-DMA-.patch b/target/linux/generic/pending-6.6/730-net-ethernet-mtk_eth_soc-reset-all-TX-queues-on-DMA-.patch
deleted file mode 100644
index 67d0ab45373c7b..00000000000000
--- a/target/linux/generic/pending-6.6/730-net-ethernet-mtk_eth_soc-reset-all-TX-queues-on-DMA-.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 7d41a5a8e9c91cc6bb011dd953570738583dd091 Mon Sep 17 00:00:00 2001
-From: Daniel Golle <daniel@makrotopia.org>
-Date: Wed, 18 Sep 2024 02:01:01 +0100
-Subject: [PATCH] net: ethernet: mtk_eth_soc: reset all TX queues on DMA free
-
-The purpose of resetting the TX queue is to reset the
-byte and packet count as well as to clear the software
-flow control XOFF bit.
-
-MediaTek developers pointed out that netdev_reset_queue would only
-resets queue 0 of the network device.
-Queues that are not reset may cause unexpected issues.
-
-Packets may stop being sent after reset and "transmit timeout" log may
-be displayed.
-
-Import fix from MediaTek's SDK to resolve this issue.
-
-Signed-off-by: Daniel Golle <daniel@makrotopia.org>
----
- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 18 ++++++++++++++----
- 1 file changed, 14 insertions(+), 4 deletions(-)
-
---- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -3135,11 +3135,19 @@ static int mtk_dma_init(struct mtk_eth *
- static void mtk_dma_free(struct mtk_eth *eth)
- {
- 	const struct mtk_soc_data *soc = eth->soc;
--	int i;
-+	int i, j, txqs = 1;
-+
-+	if (MTK_HAS_CAPS(eth->soc->caps, MTK_QDMA))
-+		txqs = MTK_QDMA_NUM_QUEUES;
-+
-+	for (i = 0; i < MTK_MAX_DEVS; i++) {
-+		if (!eth->netdev[i])
-+			continue;
-+
-+		for (j = 0; j < txqs; j++)
-+			netdev_tx_reset_queue(netdev_get_tx_queue(eth->netdev[i], j));
-+	}
- 
--	for (i = 0; i < MTK_MAX_DEVS; i++)
--		if (eth->netdev[i])
--			netdev_reset_queue(eth->netdev[i]);
- 	if (!MTK_HAS_CAPS(soc->caps, MTK_SRAM) && eth->scratch_ring) {
- 		dma_free_coherent(eth->dma_dev,
- 				  MTK_QDMA_RING_SIZE * soc->tx.desc_size,
diff --git a/target/linux/generic/pending-6.6/731-net-permit-ieee80211_ptr-even-with-no-CFG82111-suppo.patch b/target/linux/generic/pending-6.6/731-net-permit-ieee80211_ptr-even-with-no-CFG82111-suppo.patch
index 1f07c0f62c8c02..8679ffb13f8802 100644
--- a/target/linux/generic/pending-6.6/731-net-permit-ieee80211_ptr-even-with-no-CFG82111-suppo.patch
+++ b/target/linux/generic/pending-6.6/731-net-permit-ieee80211_ptr-even-with-no-CFG82111-suppo.patch
@@ -19,7 +19,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 +++ b/include/linux/netdevice.h
 @@ -2243,7 +2243,7 @@ struct net_device {
  #if IS_ENABLED(CONFIG_AX25)
- 	void			*ax25_ptr;
+ 	struct ax25_dev	__rcu	*ax25_ptr;
  #endif
 -#if IS_ENABLED(CONFIG_CFG80211)
 +#if IS_ENABLED(CONFIG_CFG80211_HEADERS)
diff --git a/target/linux/generic/pending-6.6/732-00-net-ethernet-mtk_eth_soc-compile-out-netsys-v2-code-.patch b/target/linux/generic/pending-6.6/732-00-net-ethernet-mtk_eth_soc-compile-out-netsys-v2-code-.patch
index c3297a1087d003..ec6ed6e035d0ed 100644
--- a/target/linux/generic/pending-6.6/732-00-net-ethernet-mtk_eth_soc-compile-out-netsys-v2-code-.patch
+++ b/target/linux/generic/pending-6.6/732-00-net-ethernet-mtk_eth_soc-compile-out-netsys-v2-code-.patch
@@ -11,7 +11,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -1336,6 +1336,22 @@ struct mtk_mac {
+@@ -1344,6 +1344,22 @@ struct mtk_mac {
  /* the struct describing the SoC. these are declared in the soc_xyz.c files */
  extern const struct of_device_id of_mtk_match[];
  
@@ -34,7 +34,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static inline bool mtk_is_netsys_v1(struct mtk_eth *eth)
  {
  	return eth->soc->version == 1;
-@@ -1350,6 +1366,7 @@ static inline bool mtk_is_netsys_v3_or_g
+@@ -1358,6 +1374,7 @@ static inline bool mtk_is_netsys_v3_or_g
  {
  	return eth->soc->version > 2;
  }
diff --git a/target/linux/generic/pending-6.6/732-01-net-ethernet-mtk_eth_soc-work-around-issue-with-send.patch b/target/linux/generic/pending-6.6/732-01-net-ethernet-mtk_eth_soc-work-around-issue-with-send.patch
index 53187934d02a33..6e3e4092900bcf 100644
--- a/target/linux/generic/pending-6.6/732-01-net-ethernet-mtk_eth_soc-work-around-issue-with-send.patch
+++ b/target/linux/generic/pending-6.6/732-01-net-ethernet-mtk_eth_soc-work-around-issue-with-send.patch
@@ -91,7 +91,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  		netif_tx_stop_all_queues(dev);
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -270,7 +270,7 @@
+@@ -278,7 +278,7 @@
  #define MTK_CHK_DDONE_EN	BIT(28)
  #define MTK_DMAD_WR_WDONE	BIT(26)
  #define MTK_WCOMP_EN		BIT(24)
diff --git a/target/linux/generic/pending-6.6/734-net-ethernet-mediatek-enlarge-DMA-reserve-buffer.patch b/target/linux/generic/pending-6.6/734-net-ethernet-mediatek-enlarge-DMA-reserve-buffer.patch
index d786b462c2579d..c97df557c68fb3 100644
--- a/target/linux/generic/pending-6.6/734-net-ethernet-mediatek-enlarge-DMA-reserve-buffer.patch
+++ b/target/linux/generic/pending-6.6/734-net-ethernet-mediatek-enlarge-DMA-reserve-buffer.patch
@@ -15,7 +15,7 @@ Signed-off-by: Chad Monroe <chad@monroe.io>
 
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.h
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.h
-@@ -271,6 +271,7 @@
+@@ -279,6 +279,7 @@
  #define MTK_WCOMP_EN		BIT(24)
  #define MTK_RESV_BUF		(0x80 << 16)
  #define MTK_MUTLI_CNT		(0x4 << 12)
@@ -25,7 +25,7 @@ Signed-off-by: Chad Monroe <chad@monroe.io>
  /* QDMA Flow Control Register */
 --- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
 +++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
-@@ -3309,12 +3309,14 @@ static int mtk_start_dma(struct mtk_eth
+@@ -3313,12 +3313,14 @@ static int mtk_start_dma(struct mtk_eth
  		       MTK_TX_BT_32DWORDS | MTK_NDP_CO_PRO |
  		       MTK_RX_2B_OFFSET | MTK_TX_WB_DDONE;
  
@@ -34,7 +34,7 @@ Signed-off-by: Chad Monroe <chad@monroe.io>
 +			val &= ~MTK_RESV_BUF_MASK;
  			val |= MTK_MUTLI_CNT | MTK_RESV_BUF |
  			       MTK_WCOMP_EN | MTK_DMAD_WR_WDONE |
- 			       MTK_CHK_DDONE_EN | MTK_LEAKY_BUCKET_EN;
+ 			       MTK_CHK_DDONE_EN;
 -		else
 +		} else {
  			val |= MTK_RX_BT_32DWORDS;
diff --git a/target/linux/generic/pending-6.6/736-05-net-ethernet-mtk_eth_soc-zero-initialize-PPE-flow-ta.patch b/target/linux/generic/pending-6.6/736-05-net-ethernet-mtk_eth_soc-zero-initialize-PPE-flow-ta.patch
new file mode 100644
index 00000000000000..2ca5ace3678922
--- /dev/null
+++ b/target/linux/generic/pending-6.6/736-05-net-ethernet-mtk_eth_soc-zero-initialize-PPE-flow-ta.patch
@@ -0,0 +1,27 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Fri, 12 Sep 2025 14:18:14 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: zero initialize PPE flow table
+
+Avoid picking up flows from last boot or other invalid data
+
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe.c
+@@ -914,6 +914,7 @@ struct mtk_ppe *mtk_ppe_init(struct mtk_
+ 	if (!foe)
+ 		goto err_free_l2_flows;
+ 
++	memset(foe, 0, MTK_PPE_ENTRIES * soc->foe_entry_size);
+ 	ppe->foe_table = foe;
+ 
+ 	foe_flow_size = (MTK_PPE_ENTRIES / soc->hash_offset) *
+@@ -928,6 +929,7 @@ struct mtk_ppe *mtk_ppe_init(struct mtk_
+ 		if (!mib)
+ 			return NULL;
+ 
++		memset(mib, 0, MTK_PPE_ENTRIES * sizeof(*mib));
+ 		ppe->mib_table = mib;
+ 
+ 		acct = devm_kzalloc(dev, MTK_PPE_ENTRIES * sizeof(*acct),
diff --git a/target/linux/generic/pending-6.6/737-net-ethernet-mtk_eth_soc-add-paths-and-SerDes-modes-.patch b/target/linux/generic/pending-6.6/737-net-ethernet-mtk_eth_soc-add-paths-and-SerDes-modes-.patch
index f4e12ca63a9986..4d718f9fa086b5 100644
--- a/target/linux/generic/pending-6.6/737-net-ethernet-mtk_eth_soc-add-paths-and-SerDes-modes-.patch
+++ b/target/linux/generic/pending-6.6/737-net-ethernet-mtk_eth_soc-add-paths-and-SerDes-modes-.patch
@@ -490,7 +490,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	.mac_finish = mtk_mac_finish,
  	.mac_link_down = mtk_mac_link_down,
  	.mac_link_up = mtk_mac_link_up,
-@@ -3417,6 +3558,9 @@ static int mtk_open(struct net_device *d
+@@ -3421,6 +3562,9 @@ static int mtk_open(struct net_device *d
  
  	ppe_num = eth->soc->ppe_num;
  
@@ -500,7 +500,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	err = phylink_of_phy_connect(mac->phylink, mac->of_node, 0);
  	if (err) {
  		netdev_err(dev, "%s: could not attach PHY: %d\n", __func__,
-@@ -3567,6 +3711,9 @@ static int mtk_stop(struct net_device *d
+@@ -3571,6 +3715,9 @@ static int mtk_stop(struct net_device *d
  	for (i = 0; i < ARRAY_SIZE(eth->ppe); i++)
  		mtk_ppe_stop(eth->ppe[i]);
  
@@ -510,7 +510,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	return 0;
  }
  
-@@ -4580,6 +4727,7 @@ static const struct net_device_ops mtk_n
+@@ -4600,6 +4747,7 @@ static const struct net_device_ops mtk_n
  static int mtk_add_mac(struct mtk_eth *eth, struct device_node *np)
  {
  	const __be32 *_id = of_get_property(np, "reg", NULL);
@@ -518,7 +518,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	phy_interface_t phy_mode;
  	struct phylink *phylink;
  	struct mtk_mac *mac;
-@@ -4616,16 +4764,41 @@ static int mtk_add_mac(struct mtk_eth *e
+@@ -4636,16 +4784,41 @@ static int mtk_add_mac(struct mtk_eth *e
  	mac->id = id;
  	mac->hw = eth;
  	mac->of_node = np;
@@ -568,7 +568,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	}
  
  	memset(mac->hwlro_ip, 0, sizeof(mac->hwlro_ip));
-@@ -4708,8 +4881,21 @@ static int mtk_add_mac(struct mtk_eth *e
+@@ -4728,8 +4901,21 @@ static int mtk_add_mac(struct mtk_eth *e
  		phy_interface_zero(mac->phylink_config.supported_interfaces);
  		__set_bit(PHY_INTERFACE_MODE_INTERNAL,
  			  mac->phylink_config.supported_interfaces);
@@ -590,7 +590,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	phylink = phylink_create(&mac->phylink_config,
  				 of_fwnode_handle(mac->of_node),
  				 phy_mode, &mtk_phylink_ops);
-@@ -4760,6 +4946,26 @@ free_netdev:
+@@ -4780,6 +4966,26 @@ free_netdev:
  	return err;
  }
  
@@ -617,7 +617,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  void mtk_eth_set_dma_device(struct mtk_eth *eth, struct device *dma_dev)
  {
  	struct net_device *dev, *tmp;
-@@ -4906,7 +5112,8 @@ static int mtk_probe(struct platform_dev
+@@ -4926,7 +5132,8 @@ static int mtk_probe(struct platform_dev
  			regmap_write(cci, 0, 3);
  	}
  
@@ -627,7 +627,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  		err = mtk_sgmii_init(eth);
  
  		if (err)
-@@ -5017,6 +5224,24 @@ static int mtk_probe(struct platform_dev
+@@ -5037,6 +5244,24 @@ static int mtk_probe(struct platform_dev
  		}
  	}
  
@@ -652,7 +652,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	if (MTK_HAS_CAPS(eth->soc->caps, MTK_SHARED_INT)) {
  		err = devm_request_irq(eth->dev, eth->irq[0],
  				       mtk_handle_irq, 0,
-@@ -5120,6 +5345,11 @@ static int mtk_remove(struct platform_de
+@@ -5140,6 +5365,11 @@ static int mtk_remove(struct platform_de
  		mtk_stop(eth->netdev[i]);
  		mac = netdev_priv(eth->netdev[i]);
  		phylink_disconnect_phy(mac->phylink);
@@ -674,7 +674,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  #include <linux/rhashtable.h>
  #include <linux/dim.h>
  #include <linux/bitfield.h>
-@@ -505,6 +506,21 @@
+@@ -513,6 +514,21 @@
  #define INTF_MODE_RGMII_1000    (TRGMII_MODE | TRGMII_CENTRAL_ALIGNED)
  #define INTF_MODE_RGMII_10_100  0
  
@@ -696,7 +696,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  /* GPIO port control registers for GMAC 2*/
  #define GPIO_OD33_CTRL8		0x4c0
  #define GPIO_BIAS_CTRL		0xed0
-@@ -530,6 +546,7 @@
+@@ -538,6 +554,7 @@
  #define SYSCFG0_SGMII_GMAC2    ((3 << 8) & SYSCFG0_SGMII_MASK)
  #define SYSCFG0_SGMII_GMAC1_V2 BIT(9)
  #define SYSCFG0_SGMII_GMAC2_V2 BIT(8)
@@ -704,7 +704,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  
  /* ethernet subsystem clock register */
-@@ -568,6 +585,11 @@
+@@ -576,6 +593,11 @@
  #define GEPHY_MAC_SEL          BIT(1)
  
  /* Top misc registers */
@@ -716,7 +716,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  #define USB_PHY_SWITCH_REG	0x218
  #define QPHY_SEL_MASK		GENMASK(1, 0)
  #define SGMII_QPHY_SEL		0x2
-@@ -592,6 +614,8 @@
+@@ -600,6 +622,8 @@
  #define MT7628_SDM_RBCNT	(MT7628_SDM_OFFSET + 0x10c)
  #define MT7628_SDM_CS_ERR	(MT7628_SDM_OFFSET + 0x110)
  
@@ -725,7 +725,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  #define MTK_FE_CDM1_FSM		0x220
  #define MTK_FE_CDM2_FSM		0x224
  #define MTK_FE_CDM3_FSM		0x238
-@@ -600,6 +624,11 @@
+@@ -608,6 +632,11 @@
  #define MTK_FE_CDM6_FSM		0x328
  #define MTK_FE_GDM1_FSM		0x228
  #define MTK_FE_GDM2_FSM		0x22C
@@ -737,7 +737,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  #define MTK_MAC_FSM(x)		(0x1010C + ((x) * 0x100))
  
-@@ -724,12 +753,8 @@ enum mtk_clks_map {
+@@ -732,12 +761,8 @@ enum mtk_clks_map {
  	MTK_CLK_ETHWARP_WOCPU2,
  	MTK_CLK_ETHWARP_WOCPU1,
  	MTK_CLK_ETHWARP_WOCPU0,
@@ -750,7 +750,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	MTK_CLK_TOP_ETH_GMII_SEL,
  	MTK_CLK_TOP_ETH_REFCK_50M_SEL,
  	MTK_CLK_TOP_ETH_SYS_200M_SEL,
-@@ -800,19 +825,9 @@ enum mtk_clks_map {
+@@ -808,19 +833,9 @@ enum mtk_clks_map {
  				 BIT_ULL(MTK_CLK_GP3) | BIT_ULL(MTK_CLK_XGP1) | \
  				 BIT_ULL(MTK_CLK_XGP2) | BIT_ULL(MTK_CLK_XGP3) | \
  				 BIT_ULL(MTK_CLK_CRYPTO) | \
@@ -770,7 +770,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  				 BIT_ULL(MTK_CLK_TOP_ETH_GMII_SEL) | \
  				 BIT_ULL(MTK_CLK_TOP_ETH_REFCK_50M_SEL) | \
  				 BIT_ULL(MTK_CLK_TOP_ETH_SYS_200M_SEL) | \
-@@ -946,6 +961,8 @@ enum mkt_eth_capabilities {
+@@ -954,6 +969,8 @@ enum mkt_eth_capabilities {
  	MTK_RGMII_BIT = 0,
  	MTK_TRGMII_BIT,
  	MTK_SGMII_BIT,
@@ -779,7 +779,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	MTK_ESW_BIT,
  	MTK_GEPHY_BIT,
  	MTK_MUX_BIT,
-@@ -966,8 +983,11 @@ enum mkt_eth_capabilities {
+@@ -974,8 +991,11 @@ enum mkt_eth_capabilities {
  	MTK_ETH_MUX_GDM1_TO_GMAC1_ESW_BIT,
  	MTK_ETH_MUX_GMAC2_GMAC0_TO_GEPHY_BIT,
  	MTK_ETH_MUX_U3_GMAC2_TO_QPHY_BIT,
@@ -791,7 +791,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  	/* PATH BITS */
  	MTK_ETH_PATH_GMAC1_RGMII_BIT,
-@@ -975,14 +995,21 @@ enum mkt_eth_capabilities {
+@@ -983,14 +1003,21 @@ enum mkt_eth_capabilities {
  	MTK_ETH_PATH_GMAC1_SGMII_BIT,
  	MTK_ETH_PATH_GMAC2_RGMII_BIT,
  	MTK_ETH_PATH_GMAC2_SGMII_BIT,
@@ -813,7 +813,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  #define MTK_ESW			BIT_ULL(MTK_ESW_BIT)
  #define MTK_GEPHY		BIT_ULL(MTK_GEPHY_BIT)
  #define MTK_MUX			BIT_ULL(MTK_MUX_BIT)
-@@ -1005,10 +1032,16 @@ enum mkt_eth_capabilities {
+@@ -1013,10 +1040,16 @@ enum mkt_eth_capabilities {
  	BIT_ULL(MTK_ETH_MUX_GMAC2_GMAC0_TO_GEPHY_BIT)
  #define MTK_ETH_MUX_U3_GMAC2_TO_QPHY		\
  	BIT_ULL(MTK_ETH_MUX_U3_GMAC2_TO_QPHY_BIT)
@@ -830,7 +830,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  /* Supported path present on SoCs */
  #define MTK_ETH_PATH_GMAC1_RGMII	BIT_ULL(MTK_ETH_PATH_GMAC1_RGMII_BIT)
-@@ -1016,8 +1049,13 @@ enum mkt_eth_capabilities {
+@@ -1024,8 +1057,13 @@ enum mkt_eth_capabilities {
  #define MTK_ETH_PATH_GMAC1_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC1_SGMII_BIT)
  #define MTK_ETH_PATH_GMAC2_RGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_RGMII_BIT)
  #define MTK_ETH_PATH_GMAC2_SGMII	BIT_ULL(MTK_ETH_PATH_GMAC2_SGMII_BIT)
@@ -844,7 +844,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  #define MTK_GMAC1_RGMII		(MTK_ETH_PATH_GMAC1_RGMII | MTK_RGMII)
  #define MTK_GMAC1_TRGMII	(MTK_ETH_PATH_GMAC1_TRGMII | MTK_TRGMII)
-@@ -1025,7 +1063,12 @@ enum mkt_eth_capabilities {
+@@ -1033,7 +1071,12 @@ enum mkt_eth_capabilities {
  #define MTK_GMAC2_RGMII		(MTK_ETH_PATH_GMAC2_RGMII | MTK_RGMII)
  #define MTK_GMAC2_SGMII		(MTK_ETH_PATH_GMAC2_SGMII | MTK_SGMII)
  #define MTK_GMAC2_GEPHY		(MTK_ETH_PATH_GMAC2_GEPHY | MTK_GEPHY)
@@ -857,7 +857,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  /* MUXes present on SoCs */
  /* 0: GDM1 -> GMAC1, 1: GDM1 -> ESW */
-@@ -1044,10 +1087,20 @@ enum mkt_eth_capabilities {
+@@ -1052,10 +1095,20 @@ enum mkt_eth_capabilities {
  	(MTK_ETH_MUX_GMAC1_GMAC2_TO_SGMII_RGMII | MTK_MUX | \
  	MTK_SHARED_SGMII)
  
@@ -878,7 +878,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  #define MTK_HAS_CAPS(caps, _x)		(((caps) & (_x)) == (_x))
  
  #define MT7621_CAPS  (MTK_GMAC1_RGMII | MTK_GMAC1_TRGMII | \
-@@ -1079,8 +1132,12 @@ enum mkt_eth_capabilities {
+@@ -1087,8 +1140,12 @@ enum mkt_eth_capabilities {
  		      MTK_MUX_GMAC12_TO_GEPHY_SGMII | MTK_QDMA | \
  		      MTK_RSTCTRL_PPE1 | MTK_SRAM)
  
@@ -893,7 +893,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  struct mtk_tx_dma_desc_info {
  	dma_addr_t	addr;
-@@ -1325,6 +1382,9 @@ struct mtk_mac {
+@@ -1333,6 +1390,9 @@ struct mtk_mac {
  	struct device_node		*of_node;
  	struct phylink			*phylink;
  	struct phylink_config		phylink_config;
@@ -903,7 +903,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	struct mtk_eth			*hw;
  	struct mtk_hw_stats		*hw_stats;
  	__be32				hwlro_ip[MTK_MAX_LRO_IP_CNT];
-@@ -1448,6 +1508,19 @@ static inline u32 mtk_get_ib2_multicast_
+@@ -1456,6 +1516,19 @@ static inline u32 mtk_get_ib2_multicast_
  	return MTK_FOE_IB2_MULTICAST;
  }
  
@@ -923,7 +923,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  /* read the hardware status register */
  void mtk_stats_update_mac(struct mtk_mac *mac);
  
-@@ -1456,8 +1529,10 @@ u32 mtk_r32(struct mtk_eth *eth, unsigne
+@@ -1464,8 +1537,10 @@ u32 mtk_r32(struct mtk_eth *eth, unsigne
  u32 mtk_m32(struct mtk_eth *eth, u32 mask, u32 set, unsigned int reg);
  
  int mtk_gmac_sgmii_path_setup(struct mtk_eth *eth, int mac_id);
diff --git a/target/linux/generic/pending-6.6/738-01-net-ethernet-mtk_eth_soc-reduce-rx-ring-size-for-older.patch b/target/linux/generic/pending-6.6/738-01-net-ethernet-mtk_eth_soc-reduce-rx-ring-size-for-older.patch
new file mode 100644
index 00000000000000..7b49f0e2b74b17
--- /dev/null
+++ b/target/linux/generic/pending-6.6/738-01-net-ethernet-mtk_eth_soc-reduce-rx-ring-size-for-older.patch
@@ -0,0 +1,104 @@
+From: Felix Fietkau <nbd@nbd.name>
+Subject: [PATCH net-next 3/4] net: ethernet: mtk_eth_soc: reduce rx ring size for older chipsets
+Date: Tue, 15 Oct 2024 13:09:37 +0200
+
+Commit c57e55819443 ("net: ethernet: mtk_eth_soc: handle dma buffer
+size soc specific") resolved some tx timeout issues by bumping FQ and
+tx ring sizes from 512 to 2048 entries (the value used in the MediaTek
+SDK), however it also changed the rx ring size for all chipsets in the
+same way.
+
+Based on a few tests, it seems that a symmetric rx/tx ring size of 2048
+really only makes sense on MT7988, which is capable of 10G ethernet links.
+
+Older chipsets are typically deployed in systems that are more memory
+constrained and don't actually need the larger rings to handle received
+packets.
+
+In order to reduce wasted memory set the ring size based on the SoC to
+the following values:
+- 2048 on MT7988
+- 1024 on MT7986
+- 512 (previous value) on everything else, except:
+- 256 on RT5350 (the oldest supported chipset)
+
+Fixes: c57e55819443 ("net: ethernet: mtk_eth_soc: handle dma buffer size soc specific")
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+ drivers/net/ethernet/mediatek/mtk_eth_soc.c | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -5401,7 +5401,7 @@ static const struct mtk_soc_data mt2701_
+ 		.desc_size = sizeof(struct mtk_rx_dma),
+ 		.irq_done_mask = MTK_RX_DONE_INT,
+ 		.dma_l4_valid = RX_DMA_L4_VALID,
+-		.dma_size = MTK_DMA_SIZE(2K),
++		.dma_size = MTK_DMA_SIZE(512),
+ 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+ 		.dma_len_offset = 16,
+ 	},
+@@ -5429,7 +5429,7 @@ static const struct mtk_soc_data mt7621_
+ 		.desc_size = sizeof(struct mtk_rx_dma),
+ 		.irq_done_mask = MTK_RX_DONE_INT,
+ 		.dma_l4_valid = RX_DMA_L4_VALID,
+-		.dma_size = MTK_DMA_SIZE(2K),
++		.dma_size = MTK_DMA_SIZE(512),
+ 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+ 		.dma_len_offset = 16,
+ 	},
+@@ -5459,7 +5459,7 @@ static const struct mtk_soc_data mt7622_
+ 		.desc_size = sizeof(struct mtk_rx_dma),
+ 		.irq_done_mask = MTK_RX_DONE_INT,
+ 		.dma_l4_valid = RX_DMA_L4_VALID,
+-		.dma_size = MTK_DMA_SIZE(2K),
++		.dma_size = MTK_DMA_SIZE(512),
+ 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+ 		.dma_len_offset = 16,
+ 	},
+@@ -5488,7 +5488,7 @@ static const struct mtk_soc_data mt7623_
+ 		.desc_size = sizeof(struct mtk_rx_dma),
+ 		.irq_done_mask = MTK_RX_DONE_INT,
+ 		.dma_l4_valid = RX_DMA_L4_VALID,
+-		.dma_size = MTK_DMA_SIZE(2K),
++		.dma_size = MTK_DMA_SIZE(512),
+ 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+ 		.dma_len_offset = 16,
+ 	},
+@@ -5514,7 +5514,7 @@ static const struct mtk_soc_data mt7629_
+ 		.desc_size = sizeof(struct mtk_rx_dma),
+ 		.irq_done_mask = MTK_RX_DONE_INT,
+ 		.dma_l4_valid = RX_DMA_L4_VALID,
+-		.dma_size = MTK_DMA_SIZE(2K),
++		.dma_size = MTK_DMA_SIZE(512),
+ 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+ 		.dma_len_offset = 16,
+ 	},
+@@ -5546,7 +5546,7 @@ static const struct mtk_soc_data mt7981_
+ 		.dma_l4_valid = RX_DMA_L4_VALID_V2,
+ 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+ 		.dma_len_offset = 16,
+-		.dma_size = MTK_DMA_SIZE(2K),
++		.dma_size = MTK_DMA_SIZE(512),
+ 	},
+ };
+ 
+@@ -5576,7 +5576,7 @@ static const struct mtk_soc_data mt7986_
+ 		.dma_l4_valid = RX_DMA_L4_VALID_V2,
+ 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+ 		.dma_len_offset = 16,
+-		.dma_size = MTK_DMA_SIZE(2K),
++		.dma_size = MTK_DMA_SIZE(1K),
+ 	},
+ };
+ 
+@@ -5629,7 +5629,7 @@ static const struct mtk_soc_data rt5350_
+ 		.dma_l4_valid = RX_DMA_L4_VALID_PDMA,
+ 		.dma_max_len = MTK_TX_DMA_BUF_LEN,
+ 		.dma_len_offset = 16,
+-		.dma_size = MTK_DMA_SIZE(2K),
++		.dma_size = MTK_DMA_SIZE(256),
+ 	},
+ };
+ 
diff --git a/target/linux/generic/pending-6.6/738-02-net-ethernet-mtk_eth_soc-do-not-enable-page-pool-sta.patch b/target/linux/generic/pending-6.6/738-02-net-ethernet-mtk_eth_soc-do-not-enable-page-pool-sta.patch
new file mode 100644
index 00000000000000..3ca41b2a03e351
--- /dev/null
+++ b/target/linux/generic/pending-6.6/738-02-net-ethernet-mtk_eth_soc-do-not-enable-page-pool-sta.patch
@@ -0,0 +1,43 @@
+From: Danila Romanov <pervokur@gmail.com>
+Date: Wed, 22 Jan 2025 06:48:45 +0100
+Subject: [PATCH] net: ethernet: mtk_eth_soc: do not enable page pool stats by
+ default
+
+There is no reason for it to be enabled by default.
+Align mtk_eth_soc driver to mt76 driver.
+
+This option incurs additional CPU cost in allocation and recycle paths
+and additional memory cost to store the statistics.
+
+Signed-off-by: Danila Romanov <pervokur@gmail.com>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/Kconfig
++++ b/drivers/net/ethernet/mediatek/Kconfig
+@@ -18,7 +18,6 @@ config NET_MEDIATEK_SOC
+ 	select PHYLINK
+ 	select DIMLIB
+ 	select PAGE_POOL
+-	select PAGE_POOL_STATS
+ 	select PCS_MTK_LYNXI
+ 	select REGMAP_MMIO
+ 	help
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -4572,6 +4572,7 @@ static int mtk_get_sset_count(struct net
+ 
+ static void mtk_ethtool_pp_stats(struct mtk_eth *eth, u64 *data)
+ {
++#ifdef CONFIG_PAGE_POOL_STATS
+ 	struct page_pool_stats stats = {};
+ 	int i;
+ 
+@@ -4584,6 +4585,7 @@ static void mtk_ethtool_pp_stats(struct
+ 		page_pool_get_stats(ring->page_pool, &stats);
+ 	}
+ 	page_pool_ethtool_stats_get(data, &stats);
++#endif
+ }
+ 
+ static void mtk_get_ethtool_stats(struct net_device *dev,
diff --git a/target/linux/generic/pending-6.6/739-05-net-pcs-add-driver-for-MediaTek-USXGMII-PCS.patch b/target/linux/generic/pending-6.6/739-05-net-pcs-add-driver-for-MediaTek-USXGMII-PCS.patch
index c7fcac3abfd670..70bd736127b20d 100644
--- a/target/linux/generic/pending-6.6/739-05-net-pcs-add-driver-for-MediaTek-USXGMII-PCS.patch
+++ b/target/linux/generic/pending-6.6/739-05-net-pcs-add-driver-for-MediaTek-USXGMII-PCS.patch
@@ -19,7 +19,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -13356,7 +13356,9 @@ M:	Daniel Golle <daniel@makrotopia.org>
+@@ -13357,7 +13357,9 @@ M:	Daniel Golle <daniel@makrotopia.org>
  L:	netdev@vger.kernel.org
  S:	Maintained
  F:	drivers/net/pcs/pcs-mtk-lynxi.c
diff --git a/target/linux/generic/pending-6.6/741-net-phy-broadcom-update-dependency-condition.patch b/target/linux/generic/pending-6.6/741-net-phy-broadcom-update-dependency-condition.patch
new file mode 100644
index 00000000000000..80b69920e9d46f
--- /dev/null
+++ b/target/linux/generic/pending-6.6/741-net-phy-broadcom-update-dependency-condition.patch
@@ -0,0 +1,35 @@
+From 1be3688b3eaa7ea2d9e19bd29ae6a6a51c121a0b Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Sat, 16 Nov 2024 22:36:15 +0100
+Subject: [PATCH] net: phy: broadcom: update dependency condition
+
+The broadcom PHY driver only has to depend upon PTP_1588_CLOCK_OPTIONAL
+if NETWORK_PHY_TIMESTAMPING is enabled. The PTP functionality is stubbed
+in this case.
+
+Reflect this circumstance in the dependence condition. This allows to
+build the driver as a built-in module even if PTP is built as a module.
+
+This is required to include the broadcom PHY module regardless of the
+built-setting of the PTP subsystem. On ath79 (and probably more)
+targets with Broadcom PHY, Gigabit operation is currently broken as the
+PHY driver is only built as a module in case all kernel-packages are
+built. Due to this circumstance, affected devices fall back to using the
+generic PHY driver.
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ drivers/net/phy/Kconfig | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -113,7 +113,7 @@ config BROADCOM_PHY
+ 	tristate "Broadcom 54XX PHYs"
+ 	select BCM_NET_PHYLIB
+ 	select BCM_NET_PHYPTP if NETWORK_PHY_TIMESTAMPING
+-	depends on PTP_1588_CLOCK_OPTIONAL
++	depends on NETWORK_PHY_TIMESTAMPING=n || PTP_1588_CLOCK_OPTIONAL
+ 	help
+ 	  Currently supports the BCM5411, BCM5421, BCM5461, BCM54616S, BCM5464,
+ 	  BCM5481, BCM54810 and BCM5482 PHYs.
diff --git a/target/linux/generic/pending-6.6/742-net-ethernet-mtk_eth_soc-fix-tx-vlan-tag-for-llc-pac.patch b/target/linux/generic/pending-6.6/742-net-ethernet-mtk_eth_soc-fix-tx-vlan-tag-for-llc-pac.patch
new file mode 100644
index 00000000000000..4876d858fd2cef
--- /dev/null
+++ b/target/linux/generic/pending-6.6/742-net-ethernet-mtk_eth_soc-fix-tx-vlan-tag-for-llc-pac.patch
@@ -0,0 +1,39 @@
+From: Felix Fietkau <nbd@nbd.name>
+Date: Sun, 31 Aug 2025 20:05:13 +0200
+Subject: [PATCH] net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets
+
+When sending llc packets with vlan tx offload, the hardware fails to
+actually add the tag. Deal with this by fixing it up in software.
+
+Fixes: 656e705243fd ("net-next: mediatek: add support for MT7623 ethernet")
+Reported-by: Thibaut VARENE <hacks@slashdirt.org>
+Signed-off-by: Felix Fietkau <nbd@nbd.name>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -1763,6 +1763,13 @@ static netdev_tx_t mtk_start_xmit(struct
+ 	bool gso = false;
+ 	int tx_num;
+ 
++	if (skb_vlan_tag_present(skb) &&
++	    !eth_proto_is_802_3(eth_hdr(skb)->h_proto)) {
++		skb = __vlan_hwaccel_push_inside(skb);
++		if (!skb)
++			goto dropped;
++	}
++
+ 	/* normally we can rely on the stack not calling this more than once,
+ 	 * however we have 2 queues running on the same ring so we need to lock
+ 	 * the ring access
+@@ -1826,8 +1833,9 @@ static netdev_tx_t mtk_start_xmit(struct
+ 
+ drop:
+ 	spin_unlock(&eth->page_lock);
+-	stats->tx_dropped++;
+ 	dev_kfree_skb_any(skb);
++dropped:
++	stats->tx_dropped++;
+ 	return NETDEV_TX_OK;
+ }
+ 
diff --git a/target/linux/generic/pending-6.6/790-bus-mhi-core-add-SBL-state-callback.patch b/target/linux/generic/pending-6.6/790-bus-mhi-core-add-SBL-state-callback.patch
index fe0f260ae36c6f..80d130611583eb 100644
--- a/target/linux/generic/pending-6.6/790-bus-mhi-core-add-SBL-state-callback.patch
+++ b/target/linux/generic/pending-6.6/790-bus-mhi-core-add-SBL-state-callback.patch
@@ -20,7 +20,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 
 --- a/drivers/bus/mhi/host/main.c
 +++ b/drivers/bus/mhi/host/main.c
-@@ -906,6 +906,7 @@ int mhi_process_ctrl_ev_ring(struct mhi_
+@@ -916,6 +916,7 @@ int mhi_process_ctrl_ev_ring(struct mhi_
  			switch (event) {
  			case MHI_EE_SBL:
  				st = DEV_ST_TRANSITION_SBL;
diff --git a/target/linux/generic/pending-6.6/791-tg3-Fix-DMA-allocations-on-57766-devices.patch b/target/linux/generic/pending-6.6/791-tg3-Fix-DMA-allocations-on-57766-devices.patch
new file mode 100644
index 00000000000000..9d219d13e5b54d
--- /dev/null
+++ b/target/linux/generic/pending-6.6/791-tg3-Fix-DMA-allocations-on-57766-devices.patch
@@ -0,0 +1,31 @@
+From f992b15965177e2f280fb6f41f292214f9a6f8d5 Mon Sep 17 00:00:00 2001
+From: Pavan Chebbi <pavan.chebbi@broadcom.com>
+Date: Tue, 10 Dec 2024 03:28:31 -0800
+Subject: [PATCH] tg3: Fix DMA allocations on 57766 devices
+
+The coherent DMA mask of 31b may not be accepted if
+the DMA mask is configured to use higher memories of
+64b. Set the DMA mask also to lower 32b for 57766
+devices.
+
+Fixes: 614f4d166eee ("tg3: Set coherent DMA mask bits to 31 for BCM57766 chipsets")
+Reported-By: Rui Salvaterra <rsalvaterra@gmail.com>
+Signed-off-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -17732,8 +17732,10 @@ static int tg3_init_one(struct pci_dev *
+ 	} else
+ 		persist_dma_mask = dma_mask = DMA_BIT_MASK(64);
+ 
+-	if (tg3_asic_rev(tp) == ASIC_REV_57766)
++	if (tg3_asic_rev(tp) == ASIC_REV_57766) {
++		dma_mask = DMA_BIT_MASK(32);
+ 		persist_dma_mask = DMA_BIT_MASK(31);
++	}
+ 
+ 	/* Configure DMA attributes. */
+ 	if (dma_mask > DMA_BIT_MASK(32)) {
diff --git a/target/linux/generic/pending-6.6/802-OPP-Provide-old-opp-to-config_clks-on-_set_opp.patch b/target/linux/generic/pending-6.6/802-OPP-Provide-old-opp-to-config_clks-on-_set_opp.patch
index 7f670914781837..3da2aed0dfca68 100644
--- a/target/linux/generic/pending-6.6/802-OPP-Provide-old-opp-to-config_clks-on-_set_opp.patch
+++ b/target/linux/generic/pending-6.6/802-OPP-Provide-old-opp-to-config_clks-on-_set_opp.patch
@@ -33,7 +33,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
  	return 0;
 --- a/drivers/opp/core.c
 +++ b/drivers/opp/core.c
-@@ -902,7 +902,8 @@ static int _set_opp_voltage(struct devic
+@@ -925,7 +925,8 @@ static int _set_opp_voltage(struct devic
  
  static int
  _opp_config_clk_single(struct device *dev, struct opp_table *opp_table,
@@ -43,7 +43,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
  {
  	unsigned long *target = data;
  	unsigned long freq;
-@@ -934,8 +935,8 @@ _opp_config_clk_single(struct device *de
+@@ -957,8 +958,8 @@ _opp_config_clk_single(struct device *de
   * the order in which they are present in the array while scaling up.
   */
  int dev_pm_opp_config_clks_simple(struct device *dev,
@@ -54,7 +54,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
  {
  	int ret, i;
  
-@@ -1217,7 +1218,7 @@ static int _set_opp(struct device *dev,
+@@ -1240,7 +1241,7 @@ static int _set_opp(struct device *dev,
  	}
  
  	if (opp_table->config_clks) {
@@ -63,7 +63,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
  		if (ret)
  			return ret;
  	}
-@@ -1292,7 +1293,7 @@ int dev_pm_opp_set_rate(struct device *d
+@@ -1315,7 +1316,7 @@ int dev_pm_opp_set_rate(struct device *d
  		 * equivalent to a clk_set_rate()
  		 */
  		if (!_get_opp_count(opp_table)) {
diff --git a/target/linux/generic/pending-6.6/802-nvmem-u-boot-env-align-endianness-of-crc32-values.patch b/target/linux/generic/pending-6.6/802-nvmem-u-boot-env-align-endianness-of-crc32-values.patch
deleted file mode 100644
index 29fe668f8de98a..00000000000000
--- a/target/linux/generic/pending-6.6/802-nvmem-u-boot-env-align-endianness-of-crc32-values.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 0e71cac033bb7689c4dfa2e6814191337ef770f5 Mon Sep 17 00:00:00 2001
-From: INAGAKI Hiroshi <musashino.open@gmail.com>
-Date: Thu, 13 Oct 2022 00:51:33 +0900
-Subject: [PATCH] nvmem: layouts: u-boot-env: align endianness of crc32 values
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This patch fixes crc32 error on Big-Endianness system by conversion of
-calculated crc32 value.
-
-Little-Endianness system:
-
-  obtained crc32: Little
-calculated crc32: Little
-
-Big-Endianness system:
-
-  obtained crc32: Little
-calculated crc32: Big
-
-log (APRESIA ApresiaLightGS120GT-SS, RTL8382M, Big-Endianness):
-
-[    8.570000] u_boot_env 18001200.spi:flash@0:partitions:partition@c0000: Invalid calculated CRC32: 0x88cd6f09 (expected: 0x096fcd88)
-[    8.580000] u_boot_env: probe of 18001200.spi:flash@0:partitions:partition@c0000 failed with error -22
-
-Fixes: f955dc1445069 ("nvmem: add driver handling U-Boot environment variables")
-
-Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
-Acked-by: Rafał Miłecki <rafal@milecki.pl>
-Tested-by: Christian Lamparter <chunkeey@gmail.com>
-Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
----
-
---- a/drivers/nvmem/layouts/u-boot-env.c
-+++ b/drivers/nvmem/layouts/u-boot-env.c
-@@ -148,7 +148,7 @@ int u_boot_env_parse(struct device *dev,
- 	crc32_data_len = dev_size - crc32_data_offset;
- 	data_len = dev_size - data_offset;
- 
--	calc = crc32(~0, buf + crc32_data_offset, crc32_data_len) ^ ~0L;
-+	calc = le32_to_cpu((__le32)crc32(~0, buf + crc32_data_offset, crc32_data_len) ^ ~0L);
- 	if (calc != crc32) {
- 		dev_err(dev, "Invalid calculated CRC32: 0x%08x (expected: 0x%08x)\n", calc, crc32);
- 		err = -EINVAL;
diff --git a/target/linux/generic/pending-6.6/804-nvmem-core-support-mac-base-fixed-layout-cells.patch b/target/linux/generic/pending-6.6/804-nvmem-core-support-mac-base-fixed-layout-cells.patch
index 241ff77a7b4264..3b7e38d6353844 100644
--- a/target/linux/generic/pending-6.6/804-nvmem-core-support-mac-base-fixed-layout-cells.patch
+++ b/target/linux/generic/pending-6.6/804-nvmem-core-support-mac-base-fixed-layout-cells.patch
@@ -33,7 +33,7 @@ string.
  #include <linux/init.h>
  #include <linux/kref.h>
  #include <linux/module.h>
-@@ -796,6 +799,62 @@ static int nvmem_validate_keepouts(struc
+@@ -810,6 +813,62 @@ static int nvmem_validate_keepouts(struc
  	return 0;
  }
  
@@ -96,7 +96,7 @@ string.
  static int nvmem_add_cells_from_dt(struct nvmem_device *nvmem, struct device_node *np)
  {
  	struct device *dev = &nvmem->dev;
-@@ -835,6 +894,25 @@ static int nvmem_add_cells_from_dt(struc
+@@ -849,6 +908,25 @@ static int nvmem_add_cells_from_dt(struc
  		if (nvmem->fixup_dt_cell_info)
  			nvmem->fixup_dt_cell_info(nvmem, &info);
  
diff --git a/target/linux/generic/pending-6.6/811-pci_disable_usb_common_quirks.patch b/target/linux/generic/pending-6.6/811-pci_disable_usb_common_quirks.patch
index e91d1ef6b29768..7ac5347031fa58 100644
--- a/target/linux/generic/pending-6.6/811-pci_disable_usb_common_quirks.patch
+++ b/target/linux/generic/pending-6.6/811-pci_disable_usb_common_quirks.patch
@@ -48,7 +48,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
  static inline int io_type_enabled(struct pci_dev *pdev, unsigned int mask)
  {
  	u16 cmd;
-@@ -1283,3 +1298,4 @@ static void quirk_usb_early_handoff(stru
+@@ -1292,3 +1307,4 @@ static void quirk_usb_early_handoff(stru
  }
  DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_ANY_ID, PCI_ANY_ID,
  			PCI_CLASS_SERIAL_USB, 8, quirk_usb_early_handoff);
diff --git a/target/linux/generic/pending-6.6/834-ledtrig-libata.patch b/target/linux/generic/pending-6.6/834-ledtrig-libata.patch
index 672d0d54cf30a0..75fe4dca900389 100644
--- a/target/linux/generic/pending-6.6/834-ledtrig-libata.patch
+++ b/target/linux/generic/pending-6.6/834-ledtrig-libata.patch
@@ -73,7 +73,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  
  	/* clear exclusive status */
  	if (unlikely(qc->flags & ATA_QCFLAG_CLEAR_EXCL &&
-@@ -5494,6 +5508,9 @@ struct ata_port *ata_port_alloc(struct a
+@@ -5502,6 +5516,9 @@ struct ata_port *ata_port_alloc(struct a
  	ap->stats.unhandled_irq = 1;
  	ap->stats.idle_irq = 1;
  #endif
@@ -83,7 +83,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	ata_sff_port_init(ap);
  
  	return ap;
-@@ -5507,6 +5524,12 @@ void ata_port_free(struct ata_port *ap)
+@@ -5515,6 +5532,12 @@ void ata_port_free(struct ata_port *ap)
  	kfree(ap->pmp_link);
  	kfree(ap->slave_link);
  	kfree(ap->ncq_sense_buf);
@@ -96,7 +96,7 @@ Signed-off-by: Daniel Golle <daniel@makrotopia.org>
  	kfree(ap);
  }
  EXPORT_SYMBOL_GPL(ata_port_free);
-@@ -5929,7 +5952,23 @@ int ata_host_register(struct ata_host *h
+@@ -5937,7 +5960,23 @@ int ata_host_register(struct ata_host *h
  		host->ports[i]->print_id = atomic_inc_return(&ata_print_id);
  		host->ports[i]->local_port_no = i + 1;
  	}
diff --git a/target/linux/generic/pending-6.6/920-mangle_bootargs.patch b/target/linux/generic/pending-6.6/920-mangle_bootargs.patch
index 1d73cca11e2321..36e7c18324bdfb 100644
--- a/target/linux/generic/pending-6.6/920-mangle_bootargs.patch
+++ b/target/linux/generic/pending-6.6/920-mangle_bootargs.patch
@@ -13,7 +13,7 @@ Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
 
 --- a/init/Kconfig
 +++ b/init/Kconfig
-@@ -1811,6 +1811,15 @@ config DEBUG_RSEQ
+@@ -1820,6 +1820,15 @@ config DEBUG_RSEQ
  
  	  If unsure, say N.
  
diff --git a/target/linux/imx/config-6.6 b/target/linux/imx/config-6.6
index f70e7e150161c2..fb841686ff6b36 100644
--- a/target/linux/imx/config-6.6
+++ b/target/linux/imx/config-6.6
@@ -44,8 +44,6 @@ CONFIG_BLK_DEV_SD=y
 CONFIG_BLK_PM=y
 CONFIG_CACHE_L2X0=y
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_IMX_GPT=y
 CONFIG_CLKSRC_MMIO=y
 # CONFIG_CLK_IMX8MM is not set
@@ -194,7 +192,6 @@ CONFIG_FS_MBCACHE=y
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
 CONFIG_GENERIC_BUG=y
diff --git a/target/linux/imx/cortexa53/base-files/etc/board.d/02_network b/target/linux/imx/cortexa53/base-files/etc/board.d/02_network
index f5dbbb09b97cd5..f16826156ec312 100644
--- a/target/linux/imx/cortexa53/base-files/etc/board.d/02_network
+++ b/target/linux/imx/cortexa53/base-files/etc/board.d/02_network
@@ -5,11 +5,20 @@ board=$(board_name)
 board_config_update
 
 case "$board" in
+gw,imx8mm-gw71xx-0x|\
+gateworks,imx8mp-gw71xx-2x|\
+gateworks,imx8mm-gw75xx-0x|\
+gateworks,imx8mp-gw75xx-2x|\
+gw,imx8mm-gw7903|\
+gateworks,imx8mm-gw7904)
+	ucidef_set_interface_wan 'eth0'
+	;;
 gw,imx8mm-gw72xx-0x|\
 gw,imx8mp-gw72xx-2x|\
 gw,imx8mm-gw73xx-0x|\
 gw,imx8mp-gw73xx-2x|\
-gw,imx8mm-gw7902-0x)
+gw,imx8mm-gw7902-0x|\
+gateworks,imx8mp-gw82xx-2x)
 	ucidef_set_interfaces_lan_wan 'eth1' 'eth0'
 	;;
 gw,imx8mm-gw7901)
diff --git a/target/linux/imx/cortexa53/base-files/lib/upgrade/platform.sh b/target/linux/imx/cortexa53/base-files/lib/upgrade/platform.sh
index c59a69421af877..f97b55f78941c0 100755
--- a/target/linux/imx/cortexa53/base-files/lib/upgrade/platform.sh
+++ b/target/linux/imx/cortexa53/base-files/lib/upgrade/platform.sh
@@ -12,6 +12,7 @@ platform_check_image() {
 	local board=$(board_name)
 
 	case "$board" in
+	gateworks,imx8m*|\
 	gw,imx8m*)
 		return 0
 		;;
@@ -25,6 +26,7 @@ platform_do_upgrade() {
 	local board=$(board_name)
 
 	case "$board" in
+	gateworks,imx8m*|\
 	gw,imx8m*)
 		export_bootdevice && export_partdevice diskdev 0 || {
 			echo "Unable to find root device."
@@ -41,6 +43,7 @@ platform_copy_config() {
 	local partdev
 
 	case "$board" in
+	gateworks,imx8m*|\
 	gw,imx8m*)
 		export_partdevice partdev 1 && {
 			v "Storing $UPGRADE_BACKUP on /dev/$partdev..."
diff --git a/target/linux/imx/cortexa53/target.mk b/target/linux/imx/cortexa53/target.mk
index b9b32d18290550..cf1791b92c18c3 100644
--- a/target/linux/imx/cortexa53/target.mk
+++ b/target/linux/imx/cortexa53/target.mk
@@ -2,6 +2,7 @@ ARCH:=aarch64
 BOARDNAME:=NXP i.MX with Cortex-A53 (ARM64)
 CPU_TYPE:=cortex-a53
 KERNELNAME:=Image dtbs
+FEATURES+=dt-overlay
 
 define Target/Description
 	Build firmware images for NXP i.MX (Cortex-A53) based boards.
diff --git a/target/linux/imx/image/bootscript-gateworks_venice b/target/linux/imx/image/bootscript-gateworks_venice
index 062947f27bed8b..fceed130afea48 100644
--- a/target/linux/imx/image/bootscript-gateworks_venice
+++ b/target/linux/imx/image/bootscript-gateworks_venice
@@ -22,14 +22,14 @@ echo "Gateworks Venice OpenWrt Boot script v1.0"
 #    partition, therefore we add 1 to the current partition
 setexpr rootpart ${distro_bootpart} + 1 # root on 'next' partition
 part uuid ${devtype} ${devnum}:${rootpart} uuid
-setenv bootargs ${bootargs} console=${console} root=PARTUUID=${uuid} rootfstype=squashfs,ext4,f2fs rootwait
+setenv bootargs ${bootargs} console=${console} root=PARTUUID=${uuid} rootfstype=squashfs,ext4,f2fs rootwait pci=noaer
 
 # load dtb (we try fdt_file and then fdt_file{1,2,3,4,5})
 echo "loading DTB..."
 setenv fdt_addr
 setenv fdt_list $fdt_file $fdt_file1 $fdt_file2 $fdt_file3 $fdt_file4 $fdt_file5
 setenv load_fdt 'echo Loading $fdt...; load ${devtype} ${devnum}:${distro_bootpart} ${fdt_addr_r} ${prefix}${fdt} && setenv fdt_addr ${fdt_addr_r}'
-setenv apply_overlays 'fdt addr $fdt_addr_r && fdt resize && for fdt in "$fdt_overlays"; do load ${devtype} ${devnum}:${distro_bootpart} $loadaddr $prefix/$fdt && fdt apply $loadaddr && echo applied $prefix/$fdt; done'
+setenv apply_overlays 'fdt addr $fdt_addr_r && for fdt in "$fdt_overlays"; do load ${devtype} ${devnum}:${distro_bootpart} $loadaddr $prefix/$fdt && fdt resize $filesize && fdt apply $loadaddr && echo applied $prefix/$fdt; done'
 for fdt in ${fdt_list}; do if test -e ${devtype} ${devnum}:${distro_bootpart} ${prefix}${fdt}; then run load_fdt; fi; done
 if test -z "$fdt_addr"; then echo "Warning: Using bootloader DTB"; setenv fdt_addr $fdtcontroladdr; fi
 if test -n "$fdt_overlays"; then echo "Applying overlays"; run apply_overlays; fi
diff --git a/target/linux/imx/image/cortexa53.mk b/target/linux/imx/image/cortexa53.mk
index 7458162da36aa5..e618e3ee0a7f0f 100644
--- a/target/linux/imx/image/cortexa53.mk
+++ b/target/linux/imx/image/cortexa53.mk
@@ -8,6 +8,7 @@ define Build/boot-img-ext4
 	rm -fR $@.boot
 	mkdir -p $@.boot
 	$(foreach dts,$(DEVICE_DTS), $(CP) $(KDIR)/image-$(dts).dtb $@.boot/$(dts).dtb;)
+	$(foreach dtbo,$(DEVICE_DTS_OVERLAY), $(CP) $(KDIR)/image-$(dtbo).dtbo $@.boot/$(dtbo).dtbo;)
 	$(CP) $(IMAGE_KERNEL) $@.boot/$(KERNEL_NAME)
 	-$(CP) $@-boot.scr $@.boot/boot.scr
 	make_ext4fs -J -L kernel -l $(CONFIG_TARGET_KERNEL_PARTSIZE)M \
@@ -46,9 +47,25 @@ define Device/gateworks_venice
   FILESYSTEMS := squashfs ext4
   DEVICE_VENDOR := Gateworks
   DEVICE_MODEL := i.MX8M Venice
+  SUPPORTED_DEVICES := \
+	gw,imx8mm-gw71xx-0x \
+	gw,imx8mm-gw72xx-0x \
+	gw,imx8mp-gw72xx-2x \
+	gw,imx8mm-gw73xx-0x \
+	gw,imx8mp-gw73xx-2x \
+	gw,imx8mm-gw7901 \
+	gw,imx8mm-gw7902 \
+	gw,imx8mn-gw7902 \
+	gw,imx8mm-gw7903 \
+	gateworks,imx8mp-gw71xx-2x \
+	gateworks,imx8mp-gw74xx \
+	gateworks,imx8mm-gw7904 \
+	gateworks,imx8mm-gw7905-0x \
+	gateworks,imx8mp-gw7905-2x
   BOOT_SCRIPT := gateworks_venice
   PARTITION_OFFSET := 16M
   DEVICE_DTS := $(basename $(notdir $(wildcard $(DTS_DIR)/freescale/imx8m*-venice*.dts)))
+  DEVICE_DTS_OVERLAY := $(basename $(notdir $(wildcard $(DTS_DIR)/freescale/imx8m*-venice*.dtso)))
   DEVICE_PACKAGES := \
 	kmod-hwmon-gsc kmod-rtc-ds1672 kmod-eeprom-at24 \
 	kmod-gpio-button-hotplug kmod-leds-gpio kmod-pps-gpio \
diff --git a/target/linux/imx/patches-6.6/500-6.13-arm64-dts-imx8mm-venice-add-RTC-aliases.patch b/target/linux/imx/patches-6.6/500-6.13-arm64-dts-imx8mm-venice-add-RTC-aliases.patch
new file mode 100644
index 00000000000000..2d398defc47f68
--- /dev/null
+++ b/target/linux/imx/patches-6.6/500-6.13-arm64-dts-imx8mm-venice-add-RTC-aliases.patch
@@ -0,0 +1,189 @@
+From 82b521f4bb8cab09aa016acf2c1b55ffc736eb2e Mon Sep 17 00:00:00 2001
+From: Tim Harvey <tharvey@gateworks.com>
+Date: Mon, 9 Sep 2024 15:15:01 -0700
+Subject: [PATCH] arm64: dts: imx8mm-venice-*: add RTC aliases
+
+Add aliases for the RTCs on the Gateworks Venice boards and on the imx8m
+SoC. This ensures that the primary RTC is always the one on-board
+provided by the Gateworks System Controller (GSC) which is battery
+backed as opposed to the one in the IMX8M.
+
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mm-venice-gw700x.dtsi | 7 ++++++-
+ arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts  | 4 +++-
+ arch/arm64/boot/dts/freescale/imx8mm-venice-gw7902.dts  | 4 +++-
+ arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dts  | 4 +++-
+ arch/arm64/boot/dts/freescale/imx8mm-venice-gw7904.dts  | 7 ++++++-
+ arch/arm64/boot/dts/freescale/imx8mn-venice-gw7902.dts  | 4 +++-
+ arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi | 4 +++-
+ arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts  | 4 +++-
+ 8 files changed, 30 insertions(+), 8 deletions(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw700x.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw700x.dtsi
+@@ -8,6 +8,11 @@
+ #include <dt-bindings/net/ti-dp83867.h>
+ 
+ / {
++	aliases {
++		rtc0 = &gsc_rtc;
++		rtc1 = &snvs_rtc;
++	};
++
+ 	memory@40000000 {
+ 		device_type = "memory";
+ 		reg = <0x0 0x40000000 0 0x80000000>;
+@@ -272,7 +277,7 @@
+ 		pagesize = <16>;
+ 	};
+ 
+-	rtc@68 {
++	gsc_rtc: rtc@68 {
+ 		compatible = "dallas,ds1672";
+ 		reg = <0x68>;
+ 	};
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7901.dts
+@@ -22,6 +22,8 @@
+ 		ethernet2 = &lan2;
+ 		ethernet3 = &lan3;
+ 		ethernet4 = &lan4;
++		rtc0 = &gsc_rtc;
++		rtc1 = &snvs_rtc;
+ 		usb0 = &usbotg1;
+ 		usb1 = &usbotg2;
+ 	};
+@@ -495,7 +497,7 @@
+ 		pagesize = <16>;
+ 	};
+ 
+-	rtc@68 {
++	gsc_rtc: rtc@68 {
+ 		compatible = "dallas,ds1672";
+ 		reg = <0x68>;
+ 	};
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7902.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7902.dts
+@@ -19,6 +19,8 @@
+ 
+ 	aliases {
+ 		ethernet1 = &eth1;
++		rtc0 = &gsc_rtc;
++		rtc1 = &snvs_rtc;
+ 		usb0 = &usbotg1;
+ 		usb1 = &usbotg2;
+ 	};
+@@ -562,7 +564,7 @@
+ 		pagesize = <16>;
+ 	};
+ 
+-	rtc@68 {
++	gsc_rtc: rtc@68 {
+ 		compatible = "dallas,ds1672";
+ 		reg = <0x68>;
+ 	};
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7903.dts
+@@ -18,6 +18,8 @@
+ 
+ 	aliases {
+ 		ethernet0 = &fec1;
++		rtc0 = &gsc_rtc;
++		rtc1 = &snvs_rtc;
+ 		usb0 = &usbotg1;
+ 	};
+ 
+@@ -392,7 +394,7 @@
+ 		pagesize = <16>;
+ 	};
+ 
+-	rtc@68 {
++	gsc_rtc: rtc@68 {
+ 		compatible = "dallas,ds1672";
+ 		reg = <0x68>;
+ 	};
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7904.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7904.dts
+@@ -16,6 +16,11 @@
+ 	model = "Gateworks Venice GW7904 i.MX8MM board";
+ 	compatible = "gateworks,imx8mm-gw7904", "fsl,imx8mm";
+ 
++	aliases {
++		rtc0 = &gsc_rtc;
++		rtc1 = &snvs_rtc;
++	};
++
+ 	chosen {
+ 		stdout-path = &uart2;
+ 	};
+@@ -436,7 +441,7 @@
+ 		pagesize = <16>;
+ 	};
+ 
+-	rtc@68 {
++	gsc_rtc: rtc@68 {
+ 		compatible = "dallas,ds1672";
+ 		reg = <0x68>;
+ 	};
+--- a/arch/arm64/boot/dts/freescale/imx8mn-venice-gw7902.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mn-venice-gw7902.dts
+@@ -17,6 +17,8 @@
+ 	compatible = "gw,imx8mn-gw7902", "fsl,imx8mn";
+ 
+ 	aliases {
++		rtc0 = &gsc_rtc;
++		rtc1 = &snvs_rtc;
+ 		usb0 = &usbotg1;
+ 	};
+ 
+@@ -560,7 +562,7 @@
+ 		pagesize = <16>;
+ 	};
+ 
+-	rtc@68 {
++	gsc_rtc: rtc@68 {
+ 		compatible = "dallas,ds1672";
+ 		reg = <0x68>;
+ 	};
+--- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw702x.dtsi
+@@ -10,6 +10,8 @@
+ / {
+ 	aliases {
+ 		ethernet0 = &eqos;
++		rtc0 = &gsc_rtc;
++		rtc1 = &snvs_rtc;
+ 	};
+ 
+ 	memory@40000000 {
+@@ -260,7 +262,7 @@
+ 		pagesize = <16>;
+ 	};
+ 
+-	rtc@68 {
++	gsc_rtc: rtc@68 {
+ 		compatible = "dallas,ds1672";
+ 		reg = <0x68>;
+ 	};
+--- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts
+@@ -24,6 +24,8 @@
+ 		ethernet4 = &lan3;
+ 		ethernet5 = &lan4;
+ 		ethernet6 = &lan5;
++		rtc0 = &gsc_rtc;
++		rtc1 = &snvs_rtc;
+ 	};
+ 
+ 	chosen {
+@@ -444,7 +446,7 @@
+ 		pagesize = <16>;
+ 	};
+ 
+-	rtc@68 {
++	gsc_rtc: rtc@68 {
+ 		compatible = "dallas,ds1672";
+ 		reg = <0x68>;
+ 	};
diff --git a/target/linux/imx/patches-6.6/501-6.13-arm64-dts-imx8mp-venice-gw74xx-add-M2SKT_GPIO10-gpio.patch b/target/linux/imx/patches-6.6/501-6.13-arm64-dts-imx8mp-venice-gw74xx-add-M2SKT_GPIO10-gpio.patch
new file mode 100644
index 00000000000000..14c8f88e319797
--- /dev/null
+++ b/target/linux/imx/patches-6.6/501-6.13-arm64-dts-imx8mp-venice-gw74xx-add-M2SKT_GPIO10-gpio.patch
@@ -0,0 +1,36 @@
+From e6d8fd29bd3d796a00ff9b69f9fae011aec3cb40 Mon Sep 17 00:00:00 2001
+From: Tim Harvey <tharvey@gateworks.com>
+Date: Thu, 5 Sep 2024 11:32:28 -0700
+Subject: [PATCH] arm64: dts: imx8mp-venice-gw74xx: add M2SKT_GPIO10 gpio
+ configuration
+
+The GW74xx D revision has added a M2SKT_GPIO10 GPIO which routes to the
+GPIO10 pin of the M.2 socket for compatibility with certain devices.
+
+Add the iomux and a line name for this.
+
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+---
+ arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts
++++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw74xx.dts
+@@ -264,7 +264,7 @@
+ &gpio3 {
+ 	gpio-line-names =
+ 		"", "", "", "", "", "", "m2_rst", "",
+-		"", "", "", "", "", "", "", "",
++		"", "", "", "", "", "", "m2_gpio10", "",
+ 		"", "", "", "", "", "", "", "",
+ 		"", "", "", "", "", "", "", "";
+ };
+@@ -786,6 +786,7 @@
+ 			MX8MP_IOMUXC_SD2_CMD__GPIO2_IO14	0x40000150 /* PCIE3_WDIS# */
+ 			MX8MP_IOMUXC_SD2_DATA3__GPIO2_IO18	0x40000150 /* PCIE2_WDIS# */
+ 			MX8MP_IOMUXC_NAND_DATA00__GPIO3_IO06	0x40000040 /* M2SKT_RST# */
++			MX8MP_IOMUXC_NAND_DQS__GPIO3_IO14	0x40000040 /* M2SKT_GPIO10 */
+ 			MX8MP_IOMUXC_SAI3_TXD__GPIO5_IO01	0x40000104 /* UART_TERM */
+ 			MX8MP_IOMUXC_SAI3_TXFS__GPIO4_IO31	0x40000104 /* UART_RS485 */
+ 			MX8MP_IOMUXC_SAI3_TXC__GPIO5_IO00	0x40000104 /* UART_HALF */
diff --git a/target/linux/imx/patches-6.6/502-6.13-arm64-dts-freescale-rename-gw7905-to-gw75xx.patch b/target/linux/imx/patches-6.6/502-6.13-arm64-dts-freescale-rename-gw7905-to-gw75xx.patch
new file mode 100644
index 00000000000000..056b85002e4c98
--- /dev/null
+++ b/target/linux/imx/patches-6.6/502-6.13-arm64-dts-freescale-rename-gw7905-to-gw75xx.patch
@@ -0,0 +1,1426 @@
+From 14c3de96e14b30b1b83016abe607034a5a7e1c6b Mon Sep 17 00:00:00 2001
+From: Tim Harvey <tharvey@gateworks.com>
+Date: Wed, 24 Jan 2024 10:16:03 -0800
+Subject: [PATCH] arm64: dts: freescale: rename gw7905 to gw75xx
+
+The GW7905 was renamed to GW7500 before production release.
+
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+---
+ Documentation/devicetree/bindings/arm/fsl.yaml              | 4 ++--
+ arch/arm64/boot/dts/freescale/Makefile                      | 4 ++--
+ ...8mm-venice-gw7905-0x.dts => imx8mm-venice-gw75xx-0x.dts} | 6 +++---
+ ...{imx8mm-venice-gw7905.dtsi => imx8mm-venice-gw75xx.dtsi} | 0
+ ...8mp-venice-gw7905-2x.dts => imx8mp-venice-gw75xx-2x.dts} | 6 +++---
+ ...{imx8mp-venice-gw7905.dtsi => imx8mp-venice-gw75xx.dtsi} | 0
+ 6 files changed, 10 insertions(+), 10 deletions(-)
+ rename arch/arm64/boot/dts/freescale/{imx8mm-venice-gw7905-0x.dts => imx8mm-venice-gw75xx-0x.dts} (67%)
+ rename arch/arm64/boot/dts/freescale/{imx8mm-venice-gw7905.dtsi => imx8mm-venice-gw75xx.dtsi} (100%)
+ rename arch/arm64/boot/dts/freescale/{imx8mp-venice-gw7905-2x.dts => imx8mp-venice-gw75xx-2x.dts} (67%)
+ rename arch/arm64/boot/dts/freescale/{imx8mp-venice-gw7905.dtsi => imx8mp-venice-gw75xx.dtsi} (100%)
+
+--- a/Documentation/devicetree/bindings/arm/fsl.yaml
++++ b/Documentation/devicetree/bindings/arm/fsl.yaml
+@@ -908,8 +908,8 @@ properties:
+               - fsl,imx8mm-ddr4-evk       # i.MX8MM DDR4 EVK Board
+               - fsl,imx8mm-evk            # i.MX8MM EVK Board
+               - fsl,imx8mm-evkb           # i.MX8MM EVKB Board
++              - gateworks,imx8mm-gw75xx-0x # i.MX8MM Gateworks Board
+               - gateworks,imx8mm-gw7904
+-              - gateworks,imx8mm-gw7905-0x # i.MX8MM Gateworks Board
+               - gw,imx8mm-gw71xx-0x       # i.MX8MM Gateworks Development Kit
+               - gw,imx8mm-gw72xx-0x       # i.MX8MM Gateworks Development Kit
+               - gw,imx8mm-gw73xx-0x       # i.MX8MM Gateworks Development Kit
+@@ -1036,7 +1036,7 @@ properties:
+               - gateworks,imx8mp-gw72xx-2x # i.MX8MP Gateworks Board
+               - gateworks,imx8mp-gw73xx-2x # i.MX8MP Gateworks Board
+               - gateworks,imx8mp-gw74xx   # i.MX8MP Gateworks Board
+-              - gateworks,imx8mp-gw7905-2x # i.MX8MP Gateworks Board
++              - gateworks,imx8mp-gw75xx-2x # i.MX8MP Gateworks Board
+               - toradex,verdin-imx8mp     # Verdin iMX8M Plus Modules
+               - toradex,verdin-imx8mp-nonwifi  # Verdin iMX8M Plus Modules without Wi-Fi / BT
+               - toradex,verdin-imx8mp-wifi  # Verdin iMX8M Plus Wi-Fi / BT Modules
+--- a/arch/arm64/boot/dts/freescale/Makefile
++++ b/arch/arm64/boot/dts/freescale/Makefile
+@@ -72,11 +72,11 @@ dtb-$(CONFIG_ARCH_MXC) += imx8mm-var-som
+ dtb-$(CONFIG_ARCH_MXC) += imx8mm-venice-gw71xx-0x.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mm-venice-gw72xx-0x.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mm-venice-gw73xx-0x.dtb
++dtb-$(CONFIG_ARCH_MXC) += imx8mm-venice-gw75xx-0x.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mm-venice-gw7901.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mm-venice-gw7902.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mm-venice-gw7903.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mm-venice-gw7904.dtb
+-dtb-$(CONFIG_ARCH_MXC) += imx8mm-venice-gw7905-0x.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mm-verdin-nonwifi-dahlia.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mm-verdin-nonwifi-dev.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mm-verdin-nonwifi-yavia.dtb
+@@ -107,7 +107,7 @@ dtb-$(CONFIG_ARCH_MXC) += imx8mp-venice-
+ dtb-$(CONFIG_ARCH_MXC) += imx8mp-venice-gw72xx-2x.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mp-venice-gw73xx-2x.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mp-venice-gw74xx.dtb
+-dtb-$(CONFIG_ARCH_MXC) += imx8mp-venice-gw7905-2x.dtb
++dtb-$(CONFIG_ARCH_MXC) += imx8mp-venice-gw75xx-2x.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mp-verdin-nonwifi-dahlia.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mp-verdin-nonwifi-dev.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mp-verdin-nonwifi-yavia.dtb
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7905-0x.dts
++++ /dev/null
+@@ -1,28 +0,0 @@
+-// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+-/*
+- * Copyright 2023 Gateworks Corporation
+- */
+-
+-/dts-v1/;
+-
+-#include "imx8mm.dtsi"
+-#include "imx8mm-venice-gw700x.dtsi"
+-#include "imx8mm-venice-gw7905.dtsi"
+-
+-/ {
+-	model = "Gateworks Venice GW7905-0x i.MX8MM Development Kit";
+-	compatible = "gateworks,imx8mm-gw7905-0x", "fsl,imx8mm";
+-
+-	chosen {
+-		stdout-path = &uart2;
+-	};
+-};
+-
+-/* Disable SOM interfaces not used on baseboard */
+-&fec1 {
+-	status = "disabled";
+-};
+-
+-&usdhc1 {
+-	status = "disabled";
+-};
+--- /dev/null
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw75xx-0x.dts
+@@ -0,0 +1,28 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Copyright 2023 Gateworks Corporation
++ */
++
++/dts-v1/;
++
++#include "imx8mm.dtsi"
++#include "imx8mm-venice-gw700x.dtsi"
++#include "imx8mm-venice-gw75xx.dtsi"
++
++/ {
++	model = "Gateworks Venice GW75xx-0x i.MX8MM Development Kit";
++	compatible = "gateworks,imx8mm-gw75xx-0x", "fsl,imx8mm";
++
++	chosen {
++		stdout-path = &uart2;
++	};
++};
++
++/* Disable SOM interfaces not used on baseboard */
++&fec1 {
++	status = "disabled";
++};
++
++&usdhc1 {
++	status = "disabled";
++};
+--- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw7905-2x.dts
++++ /dev/null
+@@ -1,28 +0,0 @@
+-// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+-/*
+- * Copyright 2023 Gateworks Corporation
+- */
+-
+-/dts-v1/;
+-
+-#include "imx8mp.dtsi"
+-#include "imx8mp-venice-gw702x.dtsi"
+-#include "imx8mp-venice-gw7905.dtsi"
+-
+-/ {
+-	model = "Gateworks Venice GW7905-2x i.MX8MP Development Kit";
+-	compatible = "gateworks,imx8mp-gw7905-2x", "fsl,imx8mp";
+-
+-	chosen {
+-		stdout-path = &uart2;
+-	};
+-};
+-
+-/* Disable SOM interfaces not used on baseboard */
+-&eqos {
+-	status = "disabled";
+-};
+-
+-&usdhc1 {
+-	status = "disabled";
+-};
+--- /dev/null
++++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw75xx-2x.dts
+@@ -0,0 +1,28 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Copyright 2023 Gateworks Corporation
++ */
++
++/dts-v1/;
++
++#include "imx8mp.dtsi"
++#include "imx8mp-venice-gw702x.dtsi"
++#include "imx8mp-venice-gw75xx.dtsi"
++
++/ {
++	model = "Gateworks Venice GW75xx-2x i.MX8MP Development Kit";
++	compatible = "gateworks,imx8mp-gw75xx-2x", "fsl,imx8mp";
++
++	chosen {
++		stdout-path = &uart2;
++	};
++};
++
++/* Disable SOM interfaces not used on baseboard */
++&eqos {
++	status = "disabled";
++};
++
++&usdhc1 {
++	status = "disabled";
++};
+--- /dev/null
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw75xx.dtsi
+@@ -0,0 +1,303 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Copyright 2023 Gateworks Corporation
++ */
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/leds/common.h>
++#include <dt-bindings/phy/phy-imx8-pcie.h>
++
++/ {
++	led-controller {
++		compatible = "gpio-leds";
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_gpio_leds>;
++
++		led-0 {
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio4 0 GPIO_ACTIVE_HIGH>;
++			default-state = "on";
++			linux,default-trigger = "heartbeat";
++		};
++
++		led-1 {
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&gpio4 2 GPIO_ACTIVE_HIGH>;
++			default-state = "off";
++		};
++	};
++
++	pcie0_refclk: clock-pcie0 {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		clock-frequency = <100000000>;
++	};
++
++	pps {
++		compatible = "pps-gpio";
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_pps>;
++		gpios = <&gpio4 5 GPIO_ACTIVE_HIGH>;
++		status = "okay";
++	};
++
++	reg_usb2_vbus: regulator-usb2-vbus {
++		compatible = "regulator-fixed";
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_reg_usb2_en>;
++		regulator-name = "usb2_vbus";
++		gpio = <&gpio1 8 GPIO_ACTIVE_HIGH>;
++		enable-active-high;
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++	};
++
++	reg_usdhc2_vmmc: regulator-usdhc2 {
++		compatible = "regulator-fixed";
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_reg_usdhc2_vmmc>;
++		regulator-name = "SD2_3P3V";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++		gpio = <&gpio2 19 GPIO_ACTIVE_HIGH>;
++		enable-active-high;
++	};
++};
++
++/* off-board header */
++&ecspi2 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_spi2>;
++	cs-gpios = <&gpio5 13 GPIO_ACTIVE_LOW>;
++	status = "okay";
++};
++
++&gpio1 {
++	gpio-line-names =
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "gpioa", "gpiob", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "";
++};
++
++&gpio4 {
++	gpio-line-names =
++		"", "", "", "pci_usb_sel",
++		"", "", "", "pci_wdis#",
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "";
++};
++
++&gpio5 {
++	gpio-line-names =
++		"", "", "", "",
++		"gpioc", "gpiod", "", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "";
++};
++
++&i2c2 {
++	clock-frequency = <400000>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_i2c2>;
++	status = "okay";
++
++	eeprom@52 {
++		compatible = "atmel,24c32";
++		reg = <0x52>;
++		pagesize = <32>;
++	};
++};
++
++/* off-board header */
++&i2c3 {
++	clock-frequency = <400000>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_i2c3>;
++	status = "okay";
++};
++
++&pcie_phy {
++	fsl,refclk-pad-mode = <IMX8_PCIE_REFCLK_PAD_INPUT>;
++	fsl,clkreq-unsupported;
++	clocks = <&pcie0_refclk>;
++	clock-names = "ref";
++	status = "okay";
++};
++
++&pcie0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_pcie0>;
++	reset-gpio = <&gpio4 6 GPIO_ACTIVE_LOW>;
++	status = "okay";
++};
++
++/* GPS */
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_uart1>;
++	status = "okay";
++};
++
++/* USB1 - Type C front panel SINK port J14 */
++&usbotg1 {
++	dr_mode = "peripheral";
++	status = "okay";
++};
++
++/* USB2 4-port USB3.0 HUB:
++ *  P1 - USBC connector (host only)
++ *  P2 - USB2 test connector
++ *  P3 - miniPCIe full card
++ *  P4 - miniPCIe half card
++ */
++&usbotg2 {
++	dr_mode = "host";
++	vbus-supply = <&reg_usb2_vbus>;
++	status = "okay";
++};
++
++/* microSD */
++&usdhc2 {
++	pinctrl-names = "default", "state_100mhz", "state_200mhz";
++	pinctrl-0 = <&pinctrl_usdhc2>, <&pinctrl_usdhc2_gpio>;
++	pinctrl-1 = <&pinctrl_usdhc2_100mhz>, <&pinctrl_usdhc2_gpio>;
++	pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>;
++	cd-gpios = <&gpio2 12 GPIO_ACTIVE_LOW>;
++	vmmc-supply = <&reg_usdhc2_vmmc>;
++	bus-width = <4>;
++	status = "okay";
++};
++
++&iomuxc {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hog>;
++
++	pinctrl_hog: hoggrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_GPIO1_IO13_GPIO1_IO13	0x40000040 /* GPIOA */
++			MX8MM_IOMUXC_GPIO1_IO14_GPIO1_IO14	0x40000040 /* GPIOB */
++			MX8MM_IOMUXC_SAI1_RXD1_GPIO4_IO3	0x40000106 /* PCI_USBSEL */
++			MX8MM_IOMUXC_SAI1_RXD5_GPIO4_IO7	0x40000106 /* PCIE_WDIS# */
++			MX8MM_IOMUXC_SPDIF_EXT_CLK_GPIO5_IO5	0x40000040 /* GPIOD */
++			MX8MM_IOMUXC_SPDIF_RX_GPIO5_IO4		0x40000040 /* GPIOC */
++		>;
++	};
++
++	pinctrl_gpio_leds: gpioledgrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SAI1_RXFS_GPIO4_IO0	0x6	/* LEDG */
++			MX8MM_IOMUXC_SAI1_RXD0_GPIO4_IO2	0x6	/* LEDR */
++		>;
++	};
++
++	pinctrl_i2c2: i2c2grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_I2C2_SCL_I2C2_SCL		0x400001c2
++			MX8MM_IOMUXC_I2C2_SDA_I2C2_SDA		0x400001c2
++		>;
++	};
++
++	pinctrl_i2c3: i2c3grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_I2C3_SCL_I2C3_SCL		0x400001c2
++			MX8MM_IOMUXC_I2C3_SDA_I2C3_SDA		0x400001c2
++		>;
++	};
++
++	pinctrl_pcie0: pciegrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SAI1_RXD4_GPIO4_IO6	0x106
++		>;
++	};
++
++	pinctrl_pps: ppsgrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SAI1_RXD3_GPIO4_IO5	0x106
++		>;
++	};
++
++	pinctrl_reg_usb2_en: regusb2grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_GPIO1_IO08_GPIO1_IO8	0x6	/* USBHUB_RST# (ext p/u) */
++		>;
++	};
++
++	pinctrl_reg_usdhc2_vmmc: regusdhc2vmmcgrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SD2_RESET_B_GPIO2_IO19	0x40
++		>;
++	};
++
++	pinctrl_spi2: spi2grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_ECSPI2_SCLK_ECSPI2_SCLK	0x140
++			MX8MM_IOMUXC_ECSPI2_MOSI_ECSPI2_MOSI	0x140
++			MX8MM_IOMUXC_ECSPI2_MISO_ECSPI2_MISO	0x140
++			MX8MM_IOMUXC_ECSPI2_SS0_GPIO5_IO13	0x140
++		>;
++	};
++
++	pinctrl_uart1: uart1grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_UART1_RXD_UART1_DCE_RX	0x140
++			MX8MM_IOMUXC_UART1_TXD_UART1_DCE_TX	0x140
++		>;
++	};
++
++	pinctrl_usdhc2: usdhc2grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK		0x190
++			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD		0x1d0
++			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0	0x1d0
++			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1	0x1d0
++			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2	0x1d0
++			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3	0x1d0
++			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT	0xc0
++		>;
++	};
++
++	pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK		0x194
++			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD		0x1d4
++			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0	0x1d4
++			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1	0x1d4
++			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2	0x1d4
++			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3	0x1d4
++			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT	0xc0
++		>;
++	};
++
++	pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK		0x196
++			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD		0x1d6
++			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0	0x1d6
++			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1	0x1d6
++			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2	0x1d6
++			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3	0x1d6
++			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT	0xc0
++		>;
++	};
++
++	pinctrl_usdhc2_gpio: usdhc2gpiogrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12	0x1c4
++		>;
++	};
++};
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw7905.dtsi
++++ /dev/null
+@@ -1,303 +0,0 @@
+-// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+-/*
+- * Copyright 2023 Gateworks Corporation
+- */
+-
+-#include <dt-bindings/gpio/gpio.h>
+-#include <dt-bindings/leds/common.h>
+-#include <dt-bindings/phy/phy-imx8-pcie.h>
+-
+-/ {
+-	led-controller {
+-		compatible = "gpio-leds";
+-		pinctrl-names = "default";
+-		pinctrl-0 = <&pinctrl_gpio_leds>;
+-
+-		led-0 {
+-			function = LED_FUNCTION_STATUS;
+-			color = <LED_COLOR_ID_GREEN>;
+-			gpios = <&gpio4 0 GPIO_ACTIVE_HIGH>;
+-			default-state = "on";
+-			linux,default-trigger = "heartbeat";
+-		};
+-
+-		led-1 {
+-			function = LED_FUNCTION_STATUS;
+-			color = <LED_COLOR_ID_RED>;
+-			gpios = <&gpio4 2 GPIO_ACTIVE_HIGH>;
+-			default-state = "off";
+-		};
+-	};
+-
+-	pcie0_refclk: clock-pcie0 {
+-		compatible = "fixed-clock";
+-		#clock-cells = <0>;
+-		clock-frequency = <100000000>;
+-	};
+-
+-	pps {
+-		compatible = "pps-gpio";
+-		pinctrl-names = "default";
+-		pinctrl-0 = <&pinctrl_pps>;
+-		gpios = <&gpio4 5 GPIO_ACTIVE_HIGH>;
+-		status = "okay";
+-	};
+-
+-	reg_usb2_vbus: regulator-usb2-vbus {
+-		compatible = "regulator-fixed";
+-		pinctrl-names = "default";
+-		pinctrl-0 = <&pinctrl_reg_usb2_en>;
+-		regulator-name = "usb2_vbus";
+-		gpio = <&gpio1 8 GPIO_ACTIVE_HIGH>;
+-		enable-active-high;
+-		regulator-min-microvolt = <5000000>;
+-		regulator-max-microvolt = <5000000>;
+-	};
+-
+-	reg_usdhc2_vmmc: regulator-usdhc2 {
+-		compatible = "regulator-fixed";
+-		pinctrl-names = "default";
+-		pinctrl-0 = <&pinctrl_reg_usdhc2_vmmc>;
+-		regulator-name = "SD2_3P3V";
+-		regulator-min-microvolt = <3300000>;
+-		regulator-max-microvolt = <3300000>;
+-		gpio = <&gpio2 19 GPIO_ACTIVE_HIGH>;
+-		enable-active-high;
+-	};
+-};
+-
+-/* off-board header */
+-&ecspi2 {
+-	pinctrl-names = "default";
+-	pinctrl-0 = <&pinctrl_spi2>;
+-	cs-gpios = <&gpio5 13 GPIO_ACTIVE_LOW>;
+-	status = "okay";
+-};
+-
+-&gpio1 {
+-	gpio-line-names =
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "gpioa", "gpiob", "",
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "", "", "";
+-};
+-
+-&gpio4 {
+-	gpio-line-names =
+-		"", "", "", "pci_usb_sel",
+-		"", "", "", "pci_wdis#",
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "", "", "";
+-};
+-
+-&gpio5 {
+-	gpio-line-names =
+-		"", "", "", "",
+-		"gpioc", "gpiod", "", "",
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "", "", "";
+-};
+-
+-&i2c2 {
+-	clock-frequency = <400000>;
+-	pinctrl-names = "default";
+-	pinctrl-0 = <&pinctrl_i2c2>;
+-	status = "okay";
+-
+-	eeprom@52 {
+-		compatible = "atmel,24c32";
+-		reg = <0x52>;
+-		pagesize = <32>;
+-	};
+-};
+-
+-/* off-board header */
+-&i2c3 {
+-	clock-frequency = <400000>;
+-	pinctrl-names = "default";
+-	pinctrl-0 = <&pinctrl_i2c3>;
+-	status = "okay";
+-};
+-
+-&pcie_phy {
+-	fsl,refclk-pad-mode = <IMX8_PCIE_REFCLK_PAD_INPUT>;
+-	fsl,clkreq-unsupported;
+-	clocks = <&pcie0_refclk>;
+-	clock-names = "ref";
+-	status = "okay";
+-};
+-
+-&pcie0 {
+-	pinctrl-names = "default";
+-	pinctrl-0 = <&pinctrl_pcie0>;
+-	reset-gpio = <&gpio4 6 GPIO_ACTIVE_LOW>;
+-	status = "okay";
+-};
+-
+-/* GPS */
+-&uart1 {
+-	pinctrl-names = "default";
+-	pinctrl-0 = <&pinctrl_uart1>;
+-	status = "okay";
+-};
+-
+-/* USB1 - Type C front panel SINK port J14 */
+-&usbotg1 {
+-	dr_mode = "peripheral";
+-	status = "okay";
+-};
+-
+-/* USB2 4-port USB3.0 HUB:
+- *  P1 - USBC connector (host only)
+- *  P2 - USB2 test connector
+- *  P3 - miniPCIe full card
+- *  P4 - miniPCIe half card
+- */
+-&usbotg2 {
+-	dr_mode = "host";
+-	vbus-supply = <&reg_usb2_vbus>;
+-	status = "okay";
+-};
+-
+-/* microSD */
+-&usdhc2 {
+-	pinctrl-names = "default", "state_100mhz", "state_200mhz";
+-	pinctrl-0 = <&pinctrl_usdhc2>, <&pinctrl_usdhc2_gpio>;
+-	pinctrl-1 = <&pinctrl_usdhc2_100mhz>, <&pinctrl_usdhc2_gpio>;
+-	pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>;
+-	cd-gpios = <&gpio2 12 GPIO_ACTIVE_LOW>;
+-	vmmc-supply = <&reg_usdhc2_vmmc>;
+-	bus-width = <4>;
+-	status = "okay";
+-};
+-
+-&iomuxc {
+-	pinctrl-names = "default";
+-	pinctrl-0 = <&pinctrl_hog>;
+-
+-	pinctrl_hog: hoggrp {
+-		fsl,pins = <
+-			MX8MM_IOMUXC_GPIO1_IO13_GPIO1_IO13	0x40000040 /* GPIOA */
+-			MX8MM_IOMUXC_GPIO1_IO14_GPIO1_IO14	0x40000040 /* GPIOB */
+-			MX8MM_IOMUXC_SAI1_RXD1_GPIO4_IO3	0x40000106 /* PCI_USBSEL */
+-			MX8MM_IOMUXC_SAI1_RXD5_GPIO4_IO7	0x40000106 /* PCIE_WDIS# */
+-			MX8MM_IOMUXC_SPDIF_EXT_CLK_GPIO5_IO5	0x40000040 /* GPIOD */
+-			MX8MM_IOMUXC_SPDIF_RX_GPIO5_IO4		0x40000040 /* GPIOC */
+-		>;
+-	};
+-
+-	pinctrl_gpio_leds: gpioledgrp {
+-		fsl,pins = <
+-			MX8MM_IOMUXC_SAI1_RXFS_GPIO4_IO0	0x6	/* LEDG */
+-			MX8MM_IOMUXC_SAI1_RXD0_GPIO4_IO2	0x6	/* LEDR */
+-		>;
+-	};
+-
+-	pinctrl_i2c2: i2c2grp {
+-		fsl,pins = <
+-			MX8MM_IOMUXC_I2C2_SCL_I2C2_SCL		0x400001c2
+-			MX8MM_IOMUXC_I2C2_SDA_I2C2_SDA		0x400001c2
+-		>;
+-	};
+-
+-	pinctrl_i2c3: i2c3grp {
+-		fsl,pins = <
+-			MX8MM_IOMUXC_I2C3_SCL_I2C3_SCL		0x400001c2
+-			MX8MM_IOMUXC_I2C3_SDA_I2C3_SDA		0x400001c2
+-		>;
+-	};
+-
+-	pinctrl_pcie0: pciegrp {
+-		fsl,pins = <
+-			MX8MM_IOMUXC_SAI1_RXD4_GPIO4_IO6	0x106
+-		>;
+-	};
+-
+-	pinctrl_pps: ppsgrp {
+-		fsl,pins = <
+-			MX8MM_IOMUXC_SAI1_RXD3_GPIO4_IO5	0x106
+-		>;
+-	};
+-
+-	pinctrl_reg_usb2_en: regusb2grp {
+-		fsl,pins = <
+-			MX8MM_IOMUXC_GPIO1_IO08_GPIO1_IO8	0x6	/* USBHUB_RST# (ext p/u) */
+-		>;
+-	};
+-
+-	pinctrl_reg_usdhc2_vmmc: regusdhc2vmmcgrp {
+-		fsl,pins = <
+-			MX8MM_IOMUXC_SD2_RESET_B_GPIO2_IO19	0x40
+-		>;
+-	};
+-
+-	pinctrl_spi2: spi2grp {
+-		fsl,pins = <
+-			MX8MM_IOMUXC_ECSPI2_SCLK_ECSPI2_SCLK	0x140
+-			MX8MM_IOMUXC_ECSPI2_MOSI_ECSPI2_MOSI	0x140
+-			MX8MM_IOMUXC_ECSPI2_MISO_ECSPI2_MISO	0x140
+-			MX8MM_IOMUXC_ECSPI2_SS0_GPIO5_IO13	0x140
+-		>;
+-	};
+-
+-	pinctrl_uart1: uart1grp {
+-		fsl,pins = <
+-			MX8MM_IOMUXC_UART1_RXD_UART1_DCE_RX	0x140
+-			MX8MM_IOMUXC_UART1_TXD_UART1_DCE_TX	0x140
+-		>;
+-	};
+-
+-	pinctrl_usdhc2: usdhc2grp {
+-		fsl,pins = <
+-			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK		0x190
+-			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD		0x1d0
+-			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0	0x1d0
+-			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1	0x1d0
+-			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2	0x1d0
+-			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3	0x1d0
+-			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT	0xc0
+-		>;
+-	};
+-
+-	pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp {
+-		fsl,pins = <
+-			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK		0x194
+-			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD		0x1d4
+-			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0	0x1d4
+-			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1	0x1d4
+-			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2	0x1d4
+-			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3	0x1d4
+-			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT	0xc0
+-		>;
+-	};
+-
+-	pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp {
+-		fsl,pins = <
+-			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK		0x196
+-			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD		0x1d6
+-			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0	0x1d6
+-			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1	0x1d6
+-			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2	0x1d6
+-			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3	0x1d6
+-			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT	0xc0
+-		>;
+-	};
+-
+-	pinctrl_usdhc2_gpio: usdhc2gpiogrp {
+-		fsl,pins = <
+-			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12	0x1c4
+-		>;
+-	};
+-};
+--- /dev/null
++++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw75xx.dtsi
+@@ -0,0 +1,309 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Copyright 2023 Gateworks Corporation
++ */
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/leds/common.h>
++#include <dt-bindings/phy/phy-imx8-pcie.h>
++
++/ {
++	led-controller {
++		compatible = "gpio-leds";
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_gpio_leds>;
++
++		led-0 {
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio4 22 GPIO_ACTIVE_HIGH>;
++			default-state = "on";
++			linux,default-trigger = "heartbeat";
++		};
++
++		led-1 {
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&gpio4 27 GPIO_ACTIVE_HIGH>;
++			default-state = "off";
++		};
++	};
++
++	pcie0_refclk: pcie0-refclk {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		clock-frequency = <100000000>;
++	};
++
++	pps {
++		compatible = "pps-gpio";
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_pps>;
++		gpios = <&gpio4 21 GPIO_ACTIVE_HIGH>;
++		status = "okay";
++	};
++
++	reg_usb2_vbus: regulator-usb2-vbus {
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_reg_usb2_en>;
++		compatible = "regulator-fixed";
++		regulator-name = "usb2_vbus";
++		gpio = <&gpio4 12 GPIO_ACTIVE_HIGH>;
++		enable-active-high;
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++	};
++
++	reg_usdhc2_vmmc: regulator-usdhc2 {
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_reg_usdhc2_vmmc>;
++		compatible = "regulator-fixed";
++		regulator-name = "SD2_3P3V";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++		gpio = <&gpio2 19 GPIO_ACTIVE_HIGH>;
++		enable-active-high;
++	};
++};
++
++/* off-board header */
++&ecspi2 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_spi2>;
++	cs-gpios = <&gpio5 13 GPIO_ACTIVE_LOW>;
++	status = "okay";
++};
++
++&gpio4 {
++	gpio-line-names =
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "gpioa", "", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "";
++};
++
++&gpio4 {
++	gpio-line-names =
++		"", "gpiod", "", "",
++		"gpiob", "gpioc", "", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "pci_usb_sel", "",
++		"pci_wdis#", "", "", "";
++};
++
++&i2c2 {
++	clock-frequency = <400000>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_i2c2>;
++	status = "okay";
++
++	eeprom@52 {
++		compatible = "atmel,24c32";
++		reg = <0x52>;
++		pagesize = <32>;
++	};
++};
++
++/* off-board header */
++&i2c3 {
++	clock-frequency = <400000>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_i2c3>;
++	status = "okay";
++};
++
++&pcie_phy {
++	fsl,refclk-pad-mode = <IMX8_PCIE_REFCLK_PAD_INPUT>;
++	fsl,clkreq-unsupported;
++	clocks = <&pcie0_refclk>;
++	clock-names = "ref";
++	status = "okay";
++};
++
++&pcie {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_pcie0>;
++	reset-gpio = <&gpio4 29 GPIO_ACTIVE_LOW>;
++	status = "okay";
++};
++
++/* GPS */
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_uart1>;
++	status = "okay";
++};
++
++/* USB1 - Type C front panel SINK port J14 */
++&usb3_0 {
++	status = "okay";
++};
++
++&usb3_phy0 {
++	status = "okay";
++};
++
++&usb_dwc3_0 {
++	dr_mode = "peripheral";
++	status = "okay";
++};
++
++/* USB2 4-port USB3.0 HUB:
++ *  P1 - USBC connector (host only)
++ *  P2 - USB2 test connector
++ *  P3 - miniPCIe full card
++ *  P4 - miniPCIe half card
++ */
++&usb3_phy1 {
++	vbus-supply = <&reg_usb2_vbus>;
++	status = "okay";
++};
++
++&usb3_1 {
++	fsl,permanently-attached;
++	fsl,disable-port-power-control;
++	status = "okay";
++};
++
++&usb_dwc3_1 {
++	dr_mode = "host";
++	status = "okay";
++};
++
++/* microSD */
++&usdhc2 {
++	pinctrl-names = "default", "state_100mhz", "state_200mhz";
++	pinctrl-0 = <&pinctrl_usdhc2>, <&pinctrl_usdhc2_gpio>;
++	pinctrl-1 = <&pinctrl_usdhc2_100mhz>, <&pinctrl_usdhc2_gpio>;
++	pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>;
++	cd-gpios = <&gpio2 12 GPIO_ACTIVE_LOW>;
++	vmmc-supply = <&reg_usdhc2_vmmc>;
++	bus-width = <4>;
++	status = "okay";
++};
++
++&iomuxc {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hog>;
++
++	pinctrl_hog: hoggrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_GPIO1_IO13__GPIO1_IO13	0x40000040 /* GPIOA */
++			MX8MP_IOMUXC_SAI1_RXC__GPIO4_IO01	0x40000040 /* GPIOD */
++			MX8MP_IOMUXC_SAI1_RXD2__GPIO4_IO04	0x40000040 /* GPIOB */
++			MX8MP_IOMUXC_SAI1_RXD3__GPIO4_IO05	0x40000040 /* GPIOC */
++			MX8MP_IOMUXC_SAI2_TXD0__GPIO4_IO26	0x40000106 /* PCI_USBSEL */
++			MX8MP_IOMUXC_SAI3_RXFS__GPIO4_IO28	0x40000106 /* PCI_WDIS# */
++		>;
++	};
++
++	pinctrl_gpio_leds: gpioledgrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SAI2_RXC__GPIO4_IO22	0x6	/* LEDG */
++			MX8MP_IOMUXC_SAI2_MCLK__GPIO4_IO27	0x6	/* LEDR */
++		>;
++	};
++
++	pinctrl_i2c2: i2c2grp {
++		fsl,pins = <
++			MX8MP_IOMUXC_I2C2_SCL__I2C2_SCL		0x400001c2
++			MX8MP_IOMUXC_I2C2_SDA__I2C2_SDA		0x400001c2
++		>;
++	};
++
++	pinctrl_i2c3: i2c3grp {
++		fsl,pins = <
++			MX8MP_IOMUXC_I2C3_SCL__I2C3_SCL		0x400001c2
++			MX8MP_IOMUXC_I2C3_SDA__I2C3_SDA		0x400001c2
++		>;
++	};
++
++	pinctrl_pcie0: pciegrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SAI3_RXC__GPIO4_IO29	0x106
++		>;
++	};
++
++	pinctrl_pps: ppsgrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SAI2_RXFS__GPIO4_IO21	0x106
++		>;
++	};
++
++	pinctrl_reg_usb2_en: regusb2grp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SAI1_TXD0__GPIO4_IO12	0x6 /* USBHUB_RST# (ext p/u) */
++		>;
++	};
++
++	pinctrl_reg_usdhc2_vmmc: regusdhc2vmmcgrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SD2_RESET_B__GPIO2_IO19	0x40
++		>;
++	};
++
++	pinctrl_spi2: spi2grp {
++		fsl,pins = <
++			MX8MP_IOMUXC_ECSPI2_SCLK__ECSPI2_SCLK	0x140
++			MX8MP_IOMUXC_ECSPI2_MOSI__ECSPI2_MOSI	0x140
++			MX8MP_IOMUXC_ECSPI2_MISO__ECSPI2_MISO	0x140
++			MX8MP_IOMUXC_ECSPI2_SS0__GPIO5_IO13	0x140
++		>;
++	};
++
++	pinctrl_uart1: uart1grp {
++		fsl,pins = <
++			MX8MP_IOMUXC_UART1_RXD__UART1_DCE_RX	0x140
++			MX8MP_IOMUXC_UART1_TXD__UART1_DCE_TX	0x140
++		>;
++	};
++
++	pinctrl_usdhc2: usdhc2grp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SD2_CLK__USDHC2_CLK		0x190
++			MX8MP_IOMUXC_SD2_CMD__USDHC2_CMD		0x1d0
++			MX8MP_IOMUXC_SD2_DATA0__USDHC2_DATA0		0x1d0
++			MX8MP_IOMUXC_SD2_DATA1__USDHC2_DATA1		0x1d0
++			MX8MP_IOMUXC_SD2_DATA2__USDHC2_DATA2		0x1d0
++			MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3		0x1d0
++			MX8MP_IOMUXC_GPIO1_IO04__USDHC2_VSELECT		0xc0
++		>;
++	};
++
++	pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SD2_CLK__USDHC2_CLK		0x194
++			MX8MP_IOMUXC_SD2_CMD__USDHC2_CMD		0x1d4
++			MX8MP_IOMUXC_SD2_DATA0__USDHC2_DATA0		0x1d4
++			MX8MP_IOMUXC_SD2_DATA1__USDHC2_DATA1		0x1d4
++			MX8MP_IOMUXC_SD2_DATA2__USDHC2_DATA2		0x1d4
++			MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3		0x1d4
++			MX8MP_IOMUXC_GPIO1_IO04__USDHC2_VSELECT		0xc0
++		>;
++	};
++
++	pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SD2_CLK__USDHC2_CLK		0x196
++			MX8MP_IOMUXC_SD2_CMD__USDHC2_CMD		0x1d6
++			MX8MP_IOMUXC_SD2_DATA0__USDHC2_DATA0		0x1d6
++			MX8MP_IOMUXC_SD2_DATA1__USDHC2_DATA1		0x1d6
++			MX8MP_IOMUXC_SD2_DATA2__USDHC2_DATA2		0x1d6
++			MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3		0x1d6
++			MX8MP_IOMUXC_GPIO1_IO04__USDHC2_VSELECT		0xc0
++		>;
++	};
++
++	pinctrl_usdhc2_gpio: usdhc2gpiogrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SD2_CD_B__GPIO2_IO12		0x1c4
++		>;
++	};
++};
+--- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw7905.dtsi
++++ /dev/null
+@@ -1,309 +0,0 @@
+-// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+-/*
+- * Copyright 2023 Gateworks Corporation
+- */
+-
+-#include <dt-bindings/gpio/gpio.h>
+-#include <dt-bindings/leds/common.h>
+-#include <dt-bindings/phy/phy-imx8-pcie.h>
+-
+-/ {
+-	led-controller {
+-		compatible = "gpio-leds";
+-		pinctrl-names = "default";
+-		pinctrl-0 = <&pinctrl_gpio_leds>;
+-
+-		led-0 {
+-			function = LED_FUNCTION_STATUS;
+-			color = <LED_COLOR_ID_GREEN>;
+-			gpios = <&gpio4 22 GPIO_ACTIVE_HIGH>;
+-			default-state = "on";
+-			linux,default-trigger = "heartbeat";
+-		};
+-
+-		led-1 {
+-			function = LED_FUNCTION_STATUS;
+-			color = <LED_COLOR_ID_RED>;
+-			gpios = <&gpio4 27 GPIO_ACTIVE_HIGH>;
+-			default-state = "off";
+-		};
+-	};
+-
+-	pcie0_refclk: pcie0-refclk {
+-		compatible = "fixed-clock";
+-		#clock-cells = <0>;
+-		clock-frequency = <100000000>;
+-	};
+-
+-	pps {
+-		compatible = "pps-gpio";
+-		pinctrl-names = "default";
+-		pinctrl-0 = <&pinctrl_pps>;
+-		gpios = <&gpio4 21 GPIO_ACTIVE_HIGH>;
+-		status = "okay";
+-	};
+-
+-	reg_usb2_vbus: regulator-usb2-vbus {
+-		pinctrl-names = "default";
+-		pinctrl-0 = <&pinctrl_reg_usb2_en>;
+-		compatible = "regulator-fixed";
+-		regulator-name = "usb2_vbus";
+-		gpio = <&gpio4 12 GPIO_ACTIVE_HIGH>;
+-		enable-active-high;
+-		regulator-min-microvolt = <5000000>;
+-		regulator-max-microvolt = <5000000>;
+-	};
+-
+-	reg_usdhc2_vmmc: regulator-usdhc2 {
+-		pinctrl-names = "default";
+-		pinctrl-0 = <&pinctrl_reg_usdhc2_vmmc>;
+-		compatible = "regulator-fixed";
+-		regulator-name = "SD2_3P3V";
+-		regulator-min-microvolt = <3300000>;
+-		regulator-max-microvolt = <3300000>;
+-		gpio = <&gpio2 19 GPIO_ACTIVE_HIGH>;
+-		enable-active-high;
+-	};
+-};
+-
+-/* off-board header */
+-&ecspi2 {
+-	pinctrl-names = "default";
+-	pinctrl-0 = <&pinctrl_spi2>;
+-	cs-gpios = <&gpio5 13 GPIO_ACTIVE_LOW>;
+-	status = "okay";
+-};
+-
+-&gpio4 {
+-	gpio-line-names =
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "gpioa", "", "",
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "", "", "";
+-};
+-
+-&gpio4 {
+-	gpio-line-names =
+-		"", "gpiod", "", "",
+-		"gpiob", "gpioc", "", "",
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "", "", "",
+-		"", "", "pci_usb_sel", "",
+-		"pci_wdis#", "", "", "";
+-};
+-
+-&i2c2 {
+-	clock-frequency = <400000>;
+-	pinctrl-names = "default";
+-	pinctrl-0 = <&pinctrl_i2c2>;
+-	status = "okay";
+-
+-	eeprom@52 {
+-		compatible = "atmel,24c32";
+-		reg = <0x52>;
+-		pagesize = <32>;
+-	};
+-};
+-
+-/* off-board header */
+-&i2c3 {
+-	clock-frequency = <400000>;
+-	pinctrl-names = "default";
+-	pinctrl-0 = <&pinctrl_i2c3>;
+-	status = "okay";
+-};
+-
+-&pcie_phy {
+-	fsl,refclk-pad-mode = <IMX8_PCIE_REFCLK_PAD_INPUT>;
+-	fsl,clkreq-unsupported;
+-	clocks = <&pcie0_refclk>;
+-	clock-names = "ref";
+-	status = "okay";
+-};
+-
+-&pcie {
+-	pinctrl-names = "default";
+-	pinctrl-0 = <&pinctrl_pcie0>;
+-	reset-gpio = <&gpio4 29 GPIO_ACTIVE_LOW>;
+-	status = "okay";
+-};
+-
+-/* GPS */
+-&uart1 {
+-	pinctrl-names = "default";
+-	pinctrl-0 = <&pinctrl_uart1>;
+-	status = "okay";
+-};
+-
+-/* USB1 - Type C front panel SINK port J14 */
+-&usb3_0 {
+-	status = "okay";
+-};
+-
+-&usb3_phy0 {
+-	status = "okay";
+-};
+-
+-&usb_dwc3_0 {
+-	dr_mode = "peripheral";
+-	status = "okay";
+-};
+-
+-/* USB2 4-port USB3.0 HUB:
+- *  P1 - USBC connector (host only)
+- *  P2 - USB2 test connector
+- *  P3 - miniPCIe full card
+- *  P4 - miniPCIe half card
+- */
+-&usb3_phy1 {
+-	vbus-supply = <&reg_usb2_vbus>;
+-	status = "okay";
+-};
+-
+-&usb3_1 {
+-	fsl,permanently-attached;
+-	fsl,disable-port-power-control;
+-	status = "okay";
+-};
+-
+-&usb_dwc3_1 {
+-	dr_mode = "host";
+-	status = "okay";
+-};
+-
+-/* microSD */
+-&usdhc2 {
+-	pinctrl-names = "default", "state_100mhz", "state_200mhz";
+-	pinctrl-0 = <&pinctrl_usdhc2>, <&pinctrl_usdhc2_gpio>;
+-	pinctrl-1 = <&pinctrl_usdhc2_100mhz>, <&pinctrl_usdhc2_gpio>;
+-	pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>;
+-	cd-gpios = <&gpio2 12 GPIO_ACTIVE_LOW>;
+-	vmmc-supply = <&reg_usdhc2_vmmc>;
+-	bus-width = <4>;
+-	status = "okay";
+-};
+-
+-&iomuxc {
+-	pinctrl-names = "default";
+-	pinctrl-0 = <&pinctrl_hog>;
+-
+-	pinctrl_hog: hoggrp {
+-		fsl,pins = <
+-			MX8MP_IOMUXC_GPIO1_IO13__GPIO1_IO13	0x40000040 /* GPIOA */
+-			MX8MP_IOMUXC_SAI1_RXC__GPIO4_IO01	0x40000040 /* GPIOD */
+-			MX8MP_IOMUXC_SAI1_RXD2__GPIO4_IO04	0x40000040 /* GPIOB */
+-			MX8MP_IOMUXC_SAI1_RXD3__GPIO4_IO05	0x40000040 /* GPIOC */
+-			MX8MP_IOMUXC_SAI2_TXD0__GPIO4_IO26	0x40000106 /* PCI_USBSEL */
+-			MX8MP_IOMUXC_SAI3_RXFS__GPIO4_IO28	0x40000106 /* PCI_WDIS# */
+-		>;
+-	};
+-
+-	pinctrl_gpio_leds: gpioledgrp {
+-		fsl,pins = <
+-			MX8MP_IOMUXC_SAI2_RXC__GPIO4_IO22	0x6	/* LEDG */
+-			MX8MP_IOMUXC_SAI2_MCLK__GPIO4_IO27	0x6	/* LEDR */
+-		>;
+-	};
+-
+-	pinctrl_i2c2: i2c2grp {
+-		fsl,pins = <
+-			MX8MP_IOMUXC_I2C2_SCL__I2C2_SCL		0x400001c2
+-			MX8MP_IOMUXC_I2C2_SDA__I2C2_SDA		0x400001c2
+-		>;
+-	};
+-
+-	pinctrl_i2c3: i2c3grp {
+-		fsl,pins = <
+-			MX8MP_IOMUXC_I2C3_SCL__I2C3_SCL		0x400001c2
+-			MX8MP_IOMUXC_I2C3_SDA__I2C3_SDA		0x400001c2
+-		>;
+-	};
+-
+-	pinctrl_pcie0: pciegrp {
+-		fsl,pins = <
+-			MX8MP_IOMUXC_SAI3_RXC__GPIO4_IO29	0x106
+-		>;
+-	};
+-
+-	pinctrl_pps: ppsgrp {
+-		fsl,pins = <
+-			MX8MP_IOMUXC_SAI2_RXFS__GPIO4_IO21	0x106
+-		>;
+-	};
+-
+-	pinctrl_reg_usb2_en: regusb2grp {
+-		fsl,pins = <
+-			MX8MP_IOMUXC_SAI1_TXD0__GPIO4_IO12	0x6 /* USBHUB_RST# (ext p/u) */
+-		>;
+-	};
+-
+-	pinctrl_reg_usdhc2_vmmc: regusdhc2vmmcgrp {
+-		fsl,pins = <
+-			MX8MP_IOMUXC_SD2_RESET_B__GPIO2_IO19	0x40
+-		>;
+-	};
+-
+-	pinctrl_spi2: spi2grp {
+-		fsl,pins = <
+-			MX8MP_IOMUXC_ECSPI2_SCLK__ECSPI2_SCLK	0x140
+-			MX8MP_IOMUXC_ECSPI2_MOSI__ECSPI2_MOSI	0x140
+-			MX8MP_IOMUXC_ECSPI2_MISO__ECSPI2_MISO	0x140
+-			MX8MP_IOMUXC_ECSPI2_SS0__GPIO5_IO13	0x140
+-		>;
+-	};
+-
+-	pinctrl_uart1: uart1grp {
+-		fsl,pins = <
+-			MX8MP_IOMUXC_UART1_RXD__UART1_DCE_RX	0x140
+-			MX8MP_IOMUXC_UART1_TXD__UART1_DCE_TX	0x140
+-		>;
+-	};
+-
+-	pinctrl_usdhc2: usdhc2grp {
+-		fsl,pins = <
+-			MX8MP_IOMUXC_SD2_CLK__USDHC2_CLK		0x190
+-			MX8MP_IOMUXC_SD2_CMD__USDHC2_CMD		0x1d0
+-			MX8MP_IOMUXC_SD2_DATA0__USDHC2_DATA0		0x1d0
+-			MX8MP_IOMUXC_SD2_DATA1__USDHC2_DATA1		0x1d0
+-			MX8MP_IOMUXC_SD2_DATA2__USDHC2_DATA2		0x1d0
+-			MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3		0x1d0
+-			MX8MP_IOMUXC_GPIO1_IO04__USDHC2_VSELECT		0xc0
+-		>;
+-	};
+-
+-	pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp {
+-		fsl,pins = <
+-			MX8MP_IOMUXC_SD2_CLK__USDHC2_CLK		0x194
+-			MX8MP_IOMUXC_SD2_CMD__USDHC2_CMD		0x1d4
+-			MX8MP_IOMUXC_SD2_DATA0__USDHC2_DATA0		0x1d4
+-			MX8MP_IOMUXC_SD2_DATA1__USDHC2_DATA1		0x1d4
+-			MX8MP_IOMUXC_SD2_DATA2__USDHC2_DATA2		0x1d4
+-			MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3		0x1d4
+-			MX8MP_IOMUXC_GPIO1_IO04__USDHC2_VSELECT		0xc0
+-		>;
+-	};
+-
+-	pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp {
+-		fsl,pins = <
+-			MX8MP_IOMUXC_SD2_CLK__USDHC2_CLK		0x196
+-			MX8MP_IOMUXC_SD2_CMD__USDHC2_CMD		0x1d6
+-			MX8MP_IOMUXC_SD2_DATA0__USDHC2_DATA0		0x1d6
+-			MX8MP_IOMUXC_SD2_DATA1__USDHC2_DATA1		0x1d6
+-			MX8MP_IOMUXC_SD2_DATA2__USDHC2_DATA2		0x1d6
+-			MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3		0x1d6
+-			MX8MP_IOMUXC_GPIO1_IO04__USDHC2_VSELECT		0xc0
+-		>;
+-	};
+-
+-	pinctrl_usdhc2_gpio: usdhc2gpiogrp {
+-		fsl,pins = <
+-			MX8MP_IOMUXC_SD2_CD_B__GPIO2_IO12		0x1c4
+-		>;
+-	};
+-};
diff --git a/target/linux/imx/patches-6.6/503-6.13-arm64-dts-imx8m-venice-gw75xx-add-Accelerometer-device.patch b/target/linux/imx/patches-6.6/503-6.13-arm64-dts-imx8m-venice-gw75xx-add-Accelerometer-device.patch
new file mode 100644
index 00000000000000..f30b6904235e08
--- /dev/null
+++ b/target/linux/imx/patches-6.6/503-6.13-arm64-dts-imx8m-venice-gw75xx-add-Accelerometer-device.patch
@@ -0,0 +1,79 @@
+From ede044113c0418f11dbee09069ff1dd68f284dfa Mon Sep 17 00:00:00 2001
+From: Tim Harvey <tharvey@gateworks.com>
+Date: Fri, 18 Oct 2024 10:36:08 -0700
+Subject: [PATCH] arm64: dts: imx8m*-venice-gw75xx: add Accelerometer device
+
+The GW75xx has a LIS2DE12TR 3-axis accelerometer on the I2C bus with an
+interrupt pin. Add it to the device-tree.
+
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+---
+ .../boot/dts/freescale/imx8mm-venice-gw75xx.dtsi | 16 ++++++++++++++++
+ .../boot/dts/freescale/imx8mp-venice-gw75xx.dtsi | 16 ++++++++++++++++
+ 2 files changed, 32 insertions(+)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw75xx.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw75xx.dtsi
+@@ -116,6 +116,16 @@
+ 	pinctrl-0 = <&pinctrl_i2c2>;
+ 	status = "okay";
+ 
++	accelerometer@19 {
++		compatible = "st,lis2de12";
++		reg = <0x19>;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_accel>;
++		interrupt-parent = <&gpio5>;
++		interrupts = <8 IRQ_TYPE_LEVEL_LOW>;
++		st,drdy-int-pin = <1>;
++	};
++
+ 	eeprom@52 {
+ 		compatible = "atmel,24c32";
+ 		reg = <0x52>;
+@@ -198,6 +208,12 @@
+ 		>;
+ 	};
+ 
++	pinctrl_accel: accelgrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_ECSPI1_MISO_GPIO5_IO8	0x159
++		>;
++	};
++
+ 	pinctrl_gpio_leds: gpioledgrp {
+ 		fsl,pins = <
+ 			MX8MM_IOMUXC_SAI1_RXFS_GPIO4_IO0	0x6	/* LEDG */
+--- a/arch/arm64/boot/dts/freescale/imx8mp-venice-gw75xx.dtsi
++++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw75xx.dtsi
+@@ -104,6 +104,16 @@
+ 	pinctrl-0 = <&pinctrl_i2c2>;
+ 	status = "okay";
+ 
++	accelerometer@19 {
++		compatible = "st,lis2de12";
++		reg = <0x19>;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_accel>;
++		interrupt-parent = <&gpio5>;
++		interrupts = <8 IRQ_TYPE_LEVEL_LOW>;
++		st,drdy-int-pin = <1>;
++	};
++
+ 	eeprom@52 {
+ 		compatible = "atmel,24c32";
+ 		reg = <0x52>;
+@@ -204,6 +214,12 @@
+ 		>;
+ 	};
+ 
++	pinctrl_accel: accelgrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_ECSPI1_MISO__GPIO5_IO08	0x159
++		>;
++	};
++
+ 	pinctrl_gpio_leds: gpioledgrp {
+ 		fsl,pins = <
+ 			MX8MP_IOMUXC_SAI2_RXC__GPIO4_IO22	0x6	/* LEDG */
diff --git a/target/linux/imx/patches-6.6/504-6.13-arm64-dts-imx-Add-i.MX8M-Plus-Gateworks-GW82XX-2X-support.patch b/target/linux/imx/patches-6.6/504-6.13-arm64-dts-imx-Add-i.MX8M-Plus-Gateworks-GW82XX-2X-support.patch
new file mode 100644
index 00000000000000..8765474a8aca73
--- /dev/null
+++ b/target/linux/imx/patches-6.6/504-6.13-arm64-dts-imx-Add-i.MX8M-Plus-Gateworks-GW82XX-2X-support.patch
@@ -0,0 +1,1107 @@
+From a79d2638a7150d1605fcadebb6baa36d27cdc48e Mon Sep 17 00:00:00 2001
+From: Tim Harvey <tharvey@gateworks.com>
+Date: Thu, 30 May 2024 10:21:45 -0700
+Subject: [PATCH] arm64: dts: imx: Add i.MX8M Plus Gateworks GW82XX-2X support
+
+The Gateworks GW82XX-2X is an ARM based single board computer (SBC)
+comprised of the i.MX8M Plus based gw702x SoM and the gw82xx
+baseboard featuring:
+ - i.MX8M Plus SoC
+ - LPDDR4 DRAM
+ - eMMC FLASH
+ - Gateworks System Controller (GSC)
+ - microSD (1.8V/3.3V Capable)
+ - panel status bi-color LED
+ - pushbutton switch
+ - fan controller with tachometer
+ - USB Type-C connector
+ - PCIe switch
+ - 2x GbE RJ45 connectors
+ - multi-protocol RS232/RS485/RS422 Serial ports
+ - 2x Flexible Socket Adapters with SDIO/UART/USB/PCIe
+   (for M.2 and miniPCIe expansion)
+ - 2x isolated CAN
+ - GPS
+ - accelerometer
+ - magnetometer
+ - off-board connectors for: SPI, GPIO, I2C, ADC
+ - Wide range DC power input
+ - support for 802.3at PoE (via adapter)
+
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+---
+ .../devicetree/bindings/arm/fsl.yaml          |   1 +
+ arch/arm64/boot/dts/freescale/Makefile        |   1 +
+ .../dts/freescale/imx8mm-venice-gw82xx.dtsi   | 460 +++++++++++++++
+ .../boot/dts/freescale/imx8mp-venice-gw82xx-2 |  19 +
+ .../dts/freescale/imx8mp-venice-gw82xx-2x.dts |  19 +
+ .../dts/freescale/imx8mp-venice-gw82xx.dtsi   | 533 ++++++++++++++++++
+ 6 files changed, 1033 insertions(+)
+ create mode 100644 arch/arm64/boot/dts/freescale/imx8mm-venice-gw82xx.dtsi
+ create mode 100644 arch/arm64/boot/dts/freescale/imx8mp-venice-gw82xx-2
+ create mode 100644 arch/arm64/boot/dts/freescale/imx8mp-venice-gw82xx-2x.dts
+ create mode 100644 arch/arm64/boot/dts/freescale/imx8mp-venice-gw82xx.dtsi
+
+--- a/Documentation/devicetree/bindings/arm/fsl.yaml
++++ b/Documentation/devicetree/bindings/arm/fsl.yaml
+@@ -1037,6 +1037,7 @@ properties:
+               - gateworks,imx8mp-gw73xx-2x # i.MX8MP Gateworks Board
+               - gateworks,imx8mp-gw74xx   # i.MX8MP Gateworks Board
+               - gateworks,imx8mp-gw75xx-2x # i.MX8MP Gateworks Board
++              - gateworks,imx8mp-gw82xx-2x # i.MX8MP Gateworks Board
+               - toradex,verdin-imx8mp     # Verdin iMX8M Plus Modules
+               - toradex,verdin-imx8mp-nonwifi  # Verdin iMX8M Plus Modules without Wi-Fi / BT
+               - toradex,verdin-imx8mp-wifi  # Verdin iMX8M Plus Wi-Fi / BT Modules
+--- a/arch/arm64/boot/dts/freescale/Makefile
++++ b/arch/arm64/boot/dts/freescale/Makefile
+@@ -108,6 +108,7 @@ dtb-$(CONFIG_ARCH_MXC) += imx8mp-venice-
+ dtb-$(CONFIG_ARCH_MXC) += imx8mp-venice-gw73xx-2x.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mp-venice-gw74xx.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mp-venice-gw75xx-2x.dtb
++dtb-$(CONFIG_ARCH_MXC) += imx8mp-venice-gw82xx-2x.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mp-verdin-nonwifi-dahlia.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mp-verdin-nonwifi-dev.dtb
+ dtb-$(CONFIG_ARCH_MXC) += imx8mp-verdin-nonwifi-yavia.dtb
+--- /dev/null
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw82xx.dtsi
+@@ -0,0 +1,460 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Copyright 2020 Gateworks Corporation
++ */
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/leds/common.h>
++#include <dt-bindings/phy/phy-imx8-pcie.h>
++
++/ {
++	aliases {
++		ethernet1 = &eth1;
++		usb0 = &usbotg1;
++		usb1 = &usbotg2;
++	};
++
++	led-controller {
++		compatible = "gpio-leds";
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_gpio_leds>;
++
++		led-0 {
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio5 5 GPIO_ACTIVE_HIGH>;
++			default-state = "on";
++			linux,default-trigger = "heartbeat";
++		};
++
++		led-1 {
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&gpio5 4 GPIO_ACTIVE_HIGH>;
++			default-state = "off";
++		};
++	};
++
++	pcie0_refclk: pcie0-refclk {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		clock-frequency = <100000000>;
++	};
++
++	pps {
++		compatible = "pps-gpio";
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_pps>;
++		gpios = <&gpio1 15 GPIO_ACTIVE_HIGH>;
++		status = "okay";
++	};
++
++	reg_1p8v: regulator-1p8v {
++		compatible = "regulator-fixed";
++		regulator-name = "1P8V";
++		regulator-min-microvolt = <1800000>;
++		regulator-max-microvolt = <1800000>;
++		regulator-always-on;
++	};
++
++	reg_3p3v: regulator-3p3v {
++		compatible = "regulator-fixed";
++		regulator-name = "3P3V";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++		regulator-always-on;
++	};
++
++	reg_usb_otg1_vbus: regulator-usb-otg1 {
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_reg_usb1_en>;
++		compatible = "regulator-fixed";
++		regulator-name = "usb_otg1_vbus";
++		gpio = <&gpio1 12 GPIO_ACTIVE_HIGH>;
++		enable-active-high;
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++	};
++
++	reg_usb_otg2_vbus: regulator-usb-otg2 {
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_reg_usb2_en>;
++		compatible = "regulator-fixed";
++		regulator-name = "usb_otg2_vbus";
++		gpio = <&gpio1 8 GPIO_ACTIVE_HIGH>;
++		enable-active-high;
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++	};
++
++	reg_wifi_en: regulator-wifi-en {
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_reg_wl>;
++		compatible = "regulator-fixed";
++		regulator-name = "wl";
++		gpio = <&gpio1 5 GPIO_ACTIVE_HIGH>;
++		startup-delay-us = <100>;
++		enable-active-high;
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++	};
++};
++
++/* off-board header */
++&ecspi2 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_spi2>;
++	cs-gpios = <&gpio5 13 GPIO_ACTIVE_LOW>,
++		   <&gpio1 10 GPIO_ACTIVE_LOW>;
++	status = "okay";
++
++	tpm@1 {
++		compatible = "atmel,attpm20p", "tcg,tpm_tis-spi";
++		reg = <0x1>;
++		spi-max-frequency = <36000000>;
++	};
++};
++
++&gpio1 {
++	gpio-line-names = "rs485_term", "mipi_gpio4", "", "",
++		"", "", "pci_usb_sel", "dio0",
++		"", "dio1", "", "", "", "", "", "",
++		"", "", "", "", "", "", "", "",
++		"", "", "", "", "", "", "", "";
++};
++
++&gpio4 {
++	gpio-line-names = "rs485_en", "mipi_gpio3", "rs485_hd", "mipi_gpio2",
++		"mipi_gpio1", "", "", "pci_wdis#",
++		"", "", "", "", "", "", "", "",
++		"", "", "", "", "", "", "", "",
++		"", "", "", "", "", "", "", "";
++};
++
++&i2c2 {
++	clock-frequency = <400000>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_i2c2>;
++	status = "okay";
++
++	accelerometer@19 {
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_accel>;
++		compatible = "st,lis2de12";
++		reg = <0x19>;
++		st,drdy-int-pin = <1>;
++		interrupt-parent = <&gpio4>;
++		interrupts = <5 IRQ_TYPE_LEVEL_LOW>;
++	};
++
++	// TODO: 0x6f PCIe switch
++};
++
++/* off-board header */
++// TODO: i2c expander
++&i2c3 {
++	clock-frequency = <400000>;
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_i2c3>;
++	status = "okay";
++};
++
++&pcie_phy {
++	fsl,refclk-pad-mode = <IMX8_PCIE_REFCLK_PAD_INPUT>;
++	fsl,clkreq-unsupported;
++	clocks = <&pcie0_refclk>;
++	clock-names = "ref";
++	status = "okay";
++};
++
++&pcie0 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_pcie0>;
++	reset-gpio = <&gpio4 6 GPIO_ACTIVE_LOW>;
++	clocks = <&clk IMX8MM_CLK_PCIE1_ROOT>, <&pcie0_refclk>,
++		 <&clk IMX8MM_CLK_PCIE1_AUX>;
++	assigned-clocks = <&clk IMX8MM_CLK_PCIE1_AUX>,
++			  <&clk IMX8MM_CLK_PCIE1_CTRL>;
++	assigned-clock-rates = <10000000>, <250000000>;
++	assigned-clock-parents = <&clk IMX8MM_SYS_PLL2_50M>,
++				 <&clk IMX8MM_SYS_PLL2_250M>;
++	status = "okay";
++
++	// TODO: this changes - new switch
++	pcie@0,0 {
++		reg = <0x0000 0 0 0 0>;
++		device_type = "pci";
++		#address-cells = <3>;
++		#size-cells = <2>;
++		ranges;
++
++		pcie@0,0 {
++			reg = <0x0000 0 0 0 0>;
++			device_type = "pci";
++			#address-cells = <3>;
++			#size-cells = <2>;
++			ranges;
++
++			pcie@4,0 {
++				reg = <0x2000 0 0 0 0>;
++				device_type = "pci";
++				#address-cells = <3>;
++				#size-cells = <2>;
++				ranges;
++
++				eth1: ethernet@0,0 {
++					reg = <0x0000 0 0 0 0>;
++					#address-cells = <3>;
++					#size-cells = <2>;
++					ranges;
++
++					local-mac-address = [00 00 00 00 00 00];
++				};
++			};
++		};
++	};
++};
++
++/* off-board header */
++&sai3 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_sai3>;
++	assigned-clocks = <&clk IMX8MM_CLK_SAI3>;
++	assigned-clock-parents = <&clk IMX8MM_AUDIO_PLL1_OUT>;
++	assigned-clock-rates = <24576000>;
++	status = "okay";
++};
++
++/* GPS */
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_uart1>;
++	status = "okay";
++};
++
++/* bluetooth HCI */
++&uart3 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_uart3>, <&pinctrl_bten>;
++	cts-gpios = <&gpio5 8 GPIO_ACTIVE_LOW>;
++	rts-gpios = <&gpio5 9 GPIO_ACTIVE_LOW>;
++	status = "okay";
++
++	bluetooth {
++		compatible = "brcm,bcm4330-bt";
++		shutdown-gpios = <&gpio1 3 GPIO_ACTIVE_HIGH>;
++	};
++};
++
++/* RS232 */
++&uart4 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_uart4>;
++	status = "okay";
++};
++
++&usbotg1 {
++	dr_mode = "otg";
++	over-current-active-low;
++	vbus-supply = <&reg_usb_otg1_vbus>;
++	status = "okay";
++};
++
++&usbotg2 {
++	dr_mode = "host";
++	disable-over-current;
++	vbus-supply = <&reg_usb_otg2_vbus>;
++	status = "okay";
++};
++
++/* SDIO WiFi */
++&usdhc1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_usdhc1>;
++	bus-width = <4>;
++	non-removable;
++	vmmc-supply = <&reg_wifi_en>;
++	status = "okay";
++};
++
++/* microSD */
++&usdhc2 {
++	pinctrl-names = "default", "state_100mhz", "state_200mhz";
++	pinctrl-0 = <&pinctrl_usdhc2>, <&pinctrl_usdhc2_gpio>;
++	pinctrl-1 = <&pinctrl_usdhc2_100mhz>, <&pinctrl_usdhc2_gpio>;
++	pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>;
++	cd-gpios = <&gpio2 12 GPIO_ACTIVE_LOW>;
++	bus-width = <4>;
++	vmmc-supply = <&reg_3p3v>;
++	status = "okay";
++};
++
++&iomuxc {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hog>;
++
++	pinctrl_hog: hoggrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SPDIF_TX_GPIO5_IO3		0x40000041 /* PLUG_TEST */
++			MX8MM_IOMUXC_GPIO1_IO06_GPIO1_IO6	0x40000041 /* PCI_USBSEL */
++			MX8MM_IOMUXC_SAI1_RXD5_GPIO4_IO7	0x40000041 /* PCIE_WDIS# */
++			MX8MM_IOMUXC_GPIO1_IO07_GPIO1_IO7	0x40000041 /* DIO0 */
++			MX8MM_IOMUXC_GPIO1_IO09_GPIO1_IO9	0x40000041 /* DIO1 */
++			MX8MM_IOMUXC_GPIO1_IO00_GPIO1_IO0	0x40000104 /* RS485_TERM */
++			MX8MM_IOMUXC_SAI1_RXFS_GPIO4_IO0	0x40000104 /* RS485 */
++			MX8MM_IOMUXC_SAI1_RXD0_GPIO4_IO2	0x40000104 /* RS485_HALF */
++		>;
++	};
++
++	pinctrl_accel: accelgrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SAI1_RXD3_GPIO4_IO5	0x159
++		>;
++	};
++
++	pinctrl_bten: btengrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_GPIO1_IO03_GPIO1_IO3	0x41
++		>;
++	};
++
++	pinctrl_gpio_leds: gpioledgrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SPDIF_EXT_CLK_GPIO5_IO5	0x19
++			MX8MM_IOMUXC_SPDIF_RX_GPIO5_IO4		0x19
++		>;
++	};
++
++	pinctrl_i2c3: i2c3grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_I2C3_SCL_I2C3_SCL		0x400001c3
++			MX8MM_IOMUXC_I2C3_SDA_I2C3_SDA		0x400001c3
++		>;
++	};
++
++	pinctrl_pcie0: pcie0grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SAI1_RXD4_GPIO4_IO6	0x41
++		>;
++	};
++
++	pinctrl_pps: ppsgrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_GPIO1_IO15_GPIO1_IO15	0x41
++		>;
++	};
++
++	pinctrl_reg_wl: regwlgrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_GPIO1_IO05_GPIO1_IO5	0x41
++		>;
++	};
++
++	pinctrl_reg_usb1_en: regusb1grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_GPIO1_IO12_GPIO1_IO12	0x41
++			MX8MM_IOMUXC_GPIO1_IO13_USB1_OTG_OC	0x41
++		>;
++	};
++
++	pinctrl_reg_usb2_en: regusb2grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_GPIO1_IO08_GPIO1_IO8	0x41
++		>;
++	};
++
++	pinctrl_sai3: sai3grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SAI3_TXFS_SAI3_TX_SYNC     0xd6
++			MX8MM_IOMUXC_SAI3_TXC_SAI3_TX_BCLK      0xd6
++			MX8MM_IOMUXC_SAI3_MCLK_SAI3_MCLK        0xd6
++			MX8MM_IOMUXC_SAI3_TXD_SAI3_TX_DATA0     0xd6
++			MX8MM_IOMUXC_SAI3_RXD_SAI3_RX_DATA0	0xd6
++		>;
++	};
++
++	pinctrl_spi2: spi2grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_ECSPI2_SCLK_ECSPI2_SCLK	0xd6
++			MX8MM_IOMUXC_ECSPI2_MOSI_ECSPI2_MOSI	0xd6
++			MX8MM_IOMUXC_ECSPI2_MISO_ECSPI2_MISO	0xd6
++			MX8MM_IOMUXC_ECSPI2_SS0_GPIO5_IO13	0xd6
++			MX8MM_IOMUXC_GPIO1_IO10_GPIO1_IO10	0xd6
++		>;
++	};
++
++	pinctrl_uart1: uart1grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_UART1_RXD_UART1_DCE_RX	0x140
++			MX8MM_IOMUXC_UART1_TXD_UART1_DCE_TX	0x140
++		>;
++	};
++
++	pinctrl_uart3: uart3grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_UART3_RXD_UART3_DCE_RX	0x140
++			MX8MM_IOMUXC_UART3_TXD_UART3_DCE_TX	0x140
++			MX8MM_IOMUXC_ECSPI1_MISO_GPIO5_IO8	0x140
++			MX8MM_IOMUXC_ECSPI1_SS0_GPIO5_IO9	0x140
++		>;
++	};
++
++	pinctrl_uart4: uart4grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_UART4_RXD_UART4_DCE_RX	0x140
++			MX8MM_IOMUXC_UART4_TXD_UART4_DCE_TX	0x140
++		>;
++	};
++
++	pinctrl_usdhc1: usdhc1grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SD1_CLK_USDHC1_CLK		0x190
++			MX8MM_IOMUXC_SD1_CMD_USDHC1_CMD		0x1d0
++			MX8MM_IOMUXC_SD1_DATA0_USDHC1_DATA0	0x1d0
++			MX8MM_IOMUXC_SD1_DATA1_USDHC1_DATA1	0x1d0
++			MX8MM_IOMUXC_SD1_DATA2_USDHC1_DATA2	0x1d0
++			MX8MM_IOMUXC_SD1_DATA3_USDHC1_DATA3	0x1d0
++		>;
++	};
++
++	pinctrl_usdhc2: usdhc2grp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK		0x190
++			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD		0x1d0
++			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0	0x1d0
++			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1	0x1d0
++			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2	0x1d0
++			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3	0x1d0
++		>;
++	};
++
++	pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK		0x194
++			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD		0x1d4
++			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0	0x1d4
++			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1	0x1d4
++			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2	0x1d4
++			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3	0x1d4
++		>;
++	};
++
++	pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SD2_CLK_USDHC2_CLK		0x196
++			MX8MM_IOMUXC_SD2_CMD_USDHC2_CMD		0x1d6
++			MX8MM_IOMUXC_SD2_DATA0_USDHC2_DATA0	0x1d6
++			MX8MM_IOMUXC_SD2_DATA1_USDHC2_DATA1	0x1d6
++			MX8MM_IOMUXC_SD2_DATA2_USDHC2_DATA2	0x1d6
++			MX8MM_IOMUXC_SD2_DATA3_USDHC2_DATA3	0x1d6
++		>;
++	};
++
++	pinctrl_usdhc2_gpio: usdhc2gpiogrp {
++		fsl,pins = <
++			MX8MM_IOMUXC_SD2_CD_B_GPIO2_IO12	0x1c4
++			MX8MM_IOMUXC_SD2_RESET_B_USDHC2_RESET_B	0x1d0
++			MX8MM_IOMUXC_GPIO1_IO04_USDHC2_VSELECT	0x1d0
++		>;
++	};
++};
+--- /dev/null
++++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw82xx-2
+@@ -0,0 +1,19 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Copyright 2024 Gateworks Corporation
++ */
++
++/dts-v1/;
++
++#include "imx8mm.dtsi"
++#include "imx8mm-venice-gw700x.dtsi"
++#include "imx8mm-venice-gw82xx.dtsi"
++
++/ {
++	model = "Gateworks Venice GW82xx-0x i.MX8MM Development Kit";
++	compatible = "gw,imx8mm-gw82xx-0x", "fsl,imx8mm";
++
++	chosen {
++		stdout-path = &uart2;
++	};
++};
+--- /dev/null
++++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw82xx-2x.dts
+@@ -0,0 +1,19 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Copyright 2024 Gateworks Corporation
++ */
++
++/dts-v1/;
++
++#include "imx8mp.dtsi"
++#include "imx8mp-venice-gw702x.dtsi"
++#include "imx8mp-venice-gw82xx.dtsi"
++
++/ {
++	model = "Gateworks Venice GW82xx-2x i.MX8MP Development Kit";
++	compatible = "gateworks,imx8mp-gw82xx-2x", "fsl,imx8mp";
++
++	chosen {
++		stdout-path = &uart2;
++	};
++};
+--- /dev/null
++++ b/arch/arm64/boot/dts/freescale/imx8mp-venice-gw82xx.dtsi
+@@ -0,0 +1,533 @@
++// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
++/*
++ * Copyright 2024 Gateworks Corporation
++ */
++
++#include <dt-bindings/gpio/gpio.h>
++#include <dt-bindings/leds/common.h>
++#include <dt-bindings/phy/phy-imx8-pcie.h>
++
++/ {
++	aliases {
++		ethernet1 = &eth1;
++		fsa1 = &fsa0;
++		fsa2 = &fsa1;
++	};
++
++	led-controller {
++		compatible = "gpio-leds";
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_gpio_leds>;
++
++		led-0 {
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_GREEN>;
++			gpios = <&gpio4 1 GPIO_ACTIVE_HIGH>;
++			default-state = "on";
++			linux,default-trigger = "heartbeat";
++		};
++
++		led-1 {
++			function = LED_FUNCTION_STATUS;
++			color = <LED_COLOR_ID_RED>;
++			gpios = <&gpio4 5 GPIO_ACTIVE_HIGH>;
++			default-state = "off";
++		};
++	};
++
++	pcie0_refclk: clock-pcie0 {
++		compatible = "fixed-clock";
++		#clock-cells = <0>;
++		clock-frequency = <100000000>;
++	};
++
++	pps {
++		compatible = "pps-gpio";
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_pps>;
++		gpios = <&gpio4 3 GPIO_ACTIVE_HIGH>;
++	};
++
++	reg_usb2_vbus: regulator-usb2 {
++		compatible = "regulator-fixed";
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_reg_usb2_en>;
++		regulator-name = "usb2_vbus";
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++		gpio = <&gpio4 12 GPIO_ACTIVE_HIGH>;
++		enable-active-high;
++	};
++
++	reg_usdhc2_vmmc: regulator-usdhc2-vmmc {
++		compatible = "regulator-fixed";
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_usdhc2_vmmc>;
++		regulator-name = "VDD_3V3_SD";
++		regulator-max-microvolt = <3300000>;
++		regulator-min-microvolt = <3300000>;
++		gpio = <&gpio2 19 GPIO_ACTIVE_HIGH>;
++		enable-active-high;
++		off-on-delay-us = <12000>;
++		startup-delay-us = <100>;
++	};
++};
++
++&ecspi2 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_spi2>;
++	cs-gpios = <&gpio1 10 GPIO_ACTIVE_LOW>,	/* CS0 onboard TPM */
++		   <&gpio5 13 GPIO_ACTIVE_LOW>, /* CS1 off-board J32 SPI */
++		   <&gpio1 12 GPIO_ACTIVE_LOW>, /* CS3 off-board J52 FSA1 */
++		   <&gpio4 26 GPIO_ACTIVE_LOW>; /* CS2 off-board J51 FSA2 */
++	status = "okay";
++
++	tpm@0 {
++		compatible = "atmel,attpm20p", "tcg,tpm_tis-spi";
++		reg = <0x0>;
++		spi-max-frequency = <10000000>;
++	};
++};
++
++&flexcan1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_can1>;
++	status = "okay";
++};
++
++&flexcan2 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_can2>;
++	status = "okay";
++};
++
++&gpio1 {
++	gpio-line-names =
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "fsa2_gpio1", "", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "", "";
++};
++
++&gpio4 {
++	gpio-line-names =
++		"", "", "", "",
++		"", "", "", "",
++		"dio1", "fsa1_gpio2", "", "dio0",
++		"", "", "", "",
++		"", "", "", "",
++		"", "", "rs485_en", "rs485_term",
++		"fsa2_gpio2", "fsa1_gpio1", "", "rs485_half",
++		"", "", "", "";
++};
++
++&i2c2 {
++	accelerometer@19 {
++		compatible = "st,lis2de12";
++		reg = <0x19>;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_accel>;
++		interrupt-parent = <&gpio4>;
++		interrupts = <21 IRQ_TYPE_LEVEL_LOW>;
++		st,drdy-int-pin = <1>;
++	};
++
++	magnetometer@1e {
++		compatible = "st,lis2mdl";
++		reg = <0x1e>;
++		pinctrl-names = "default";
++		pinctrl-0 = <&pinctrl_mag>;
++		interrupt-parent = <&gpio4>;
++		interrupts = <28 IRQ_TYPE_LEVEL_LOW>;
++	};
++};
++
++&i2c3 {
++	i2c-mux@70 {
++		compatible = "nxp,pca9548";
++		reg = <0x70>;
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		/* J30 */
++		fsa1: i2c@0 {
++			reg = <0>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&pinctrl_fsa2i2c>;
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			gpio@20 {
++				compatible = "nxp,pca9555";
++				reg = <0x20>;
++				interrupt-parent = <&gpio4>;
++				interrupts = <4 IRQ_TYPE_EDGE_FALLING>;
++				interrupt-controller;
++				#interrupt-cells = <2>;
++				gpio-controller;
++				#gpio-cells = <2>;
++			};
++
++			eeprom@54 {
++				compatible = "atmel,24c02";
++				reg = <0x54>;
++				pagesize = <16>;
++			};
++
++			eeprom@55 {
++				compatible = "atmel,24c02";
++				reg = <0x55>;
++				pagesize = <16>;
++			};
++		};
++
++		/* J29 */
++		fsa0: i2c@1 {
++			reg = <1>;
++			pinctrl-names = "default";
++			pinctrl-0 = <&pinctrl_fsa1i2c>;
++			#address-cells = <1>;
++			#size-cells = <0>;
++
++			gpio@20 {
++				compatible = "nxp,pca9555";
++				reg = <0x20>;
++				interrupt-parent = <&gpio4>;
++				interrupts = <14 IRQ_TYPE_EDGE_FALLING>;
++				interrupt-controller;
++				#interrupt-cells = <2>;
++				gpio-controller;
++				#gpio-cells = <2>;
++			};
++
++			eeprom@54 {
++				compatible = "atmel,24c02";
++				reg = <0x54>;
++				pagesize = <16>;
++			};
++
++			eeprom@55 {
++				compatible = "atmel,24c02";
++				reg = <0x55>;
++				pagesize = <16>;
++			};
++		};
++
++		/* J33 */
++		i2c@2 {
++			reg = <2>;
++			#address-cells = <1>;
++			#size-cells = <0>;
++		};
++	};
++};
++
++&pcie_phy {
++	clocks = <&pcie0_refclk>;
++	clock-names = "ref";
++	fsl,refclk-pad-mode = <IMX8_PCIE_REFCLK_PAD_INPUT>;
++	fsl,clkreq-unsupported;
++	status = "okay";
++};
++
++&pcie {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_pcie0>;
++	reset-gpio = <&gpio4 29 GPIO_ACTIVE_LOW>;
++	status = "okay";
++
++	pcie@0,0 {
++		reg = <0x0000 0 0 0 0>;
++		device_type = "pci";
++		#address-cells = <3>;
++		#size-cells = <2>;
++		ranges;
++
++		pcie@0,0 {
++			reg = <0x0000 0 0 0 0>;
++			device_type = "pci";
++			#address-cells = <3>;
++			#size-cells = <2>;
++			ranges;
++
++			pcie@7,0 {
++				reg = <0x3800 0 0 0 0>;
++				device_type = "pci";
++				#address-cells = <3>;
++				#size-cells = <2>;
++				ranges;
++
++				eth1: ethernet@0,0 {
++					reg = <0x0000 0 0 0 0>;
++					#address-cells = <3>;
++					#size-cells = <2>;
++					ranges;
++					local-mac-address = [00 00 00 00 00 00];
++				};
++			};
++		};
++	};
++};
++
++/* GPS */
++&uart1 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_uart1>;
++	status = "okay";
++};
++
++/* RS232 */
++&uart4 {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_uart4>;
++	status = "okay";
++};
++
++/* USB1 - FSA1 */
++&usb3_0 {
++	fsl,permanently-attached;
++	fsl,disable-port-power-control;
++	status = "okay";
++};
++
++&usb3_phy0 {
++	status = "okay";
++};
++
++&usb_dwc3_0 {
++	dr_mode = "host";
++	status = "okay";
++};
++
++/* USB2 - USB3.0 Hub */
++&usb3_1 {
++	fsl,permanently-attached;
++	fsl,disable-port-power-control;
++	status = "okay";
++};
++
++&usb3_phy1 {
++	vbus-supply = <&reg_usb2_vbus>;
++	status = "okay";
++};
++
++&usb_dwc3_1 {
++	dr_mode = "host";
++	status = "okay";
++};
++
++/* SDIO 1.8V */
++&usdhc1 {
++	pinctrl-names = "default", "state_100mhz", "state_200mhz";
++	pinctrl-0 = <&pinctrl_usdhc1>;
++	pinctrl-1 = <&pinctrl_usdhc1_100mhz>;
++	pinctrl-2 = <&pinctrl_usdhc1_200mhz>;
++	bus-width = <4>;
++	non-removable;
++	status = "okay";
++};
++
++/* microSD */
++&usdhc2 {
++	pinctrl-names = "default", "state_100mhz", "state_200mhz";
++	pinctrl-0 = <&pinctrl_usdhc2>, <&pinctrl_usdhc2_gpio>;
++	pinctrl-1 = <&pinctrl_usdhc2_100mhz>, <&pinctrl_usdhc2_gpio>;
++	pinctrl-2 = <&pinctrl_usdhc2_200mhz>, <&pinctrl_usdhc2_gpio>;
++	cd-gpios = <&gpio2 12 GPIO_ACTIVE_HIGH>; /* CD is active high */
++	bus-width = <4>;
++	vmmc-supply = <&reg_usdhc2_vmmc>;
++	status = "okay";
++};
++
++&iomuxc {
++	pinctrl-names = "default";
++	pinctrl-0 = <&pinctrl_hog>;
++
++	pinctrl_hog: hoggrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SAI1_RXD6__GPIO4_IO08	0x40000146 /* DIO1 */
++			MX8MP_IOMUXC_SAI1_TXC__GPIO4_IO11	0x40000146 /* DIO0 */
++			MX8MP_IOMUXC_SAI2_MCLK__GPIO4_IO27	0x40000106 /* RS485_HALF */
++			MX8MP_IOMUXC_SAI2_RXC__GPIO4_IO22	0x40000106 /* RS485_EN */
++			MX8MP_IOMUXC_SAI2_RXD0__GPIO4_IO23	0x40000106 /* RS485_TERM */
++		>;
++	};
++
++	pinctrl_accel: accelgrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SAI2_RXFS__GPIO4_IO21	0x150	/* IRQ# */
++		>;
++	};
++
++	pinctrl_can1: can1grp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SPDIF_TX__CAN1_TX		0x154
++			MX8MP_IOMUXC_SPDIF_RX__CAN1_RX		0x154
++		>;
++	};
++
++	pinctrl_can2: can2grp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SAI5_RXD3__CAN2_TX		0x154
++			MX8MP_IOMUXC_SAI5_MCLK__CAN2_RX		0x154
++		>;
++	};
++
++	pinctrl_gpio_leds: gpioledgrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SAI1_RXC__GPIO4_IO01	0x6	/* LEDG */
++			MX8MP_IOMUXC_SAI1_RXD3__GPIO4_IO05	0x6	/* LEDR */
++		>;
++	};
++
++	pinctrl_fsa1i2c: fsa1i2cgrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SAI1_TXD2__GPIO4_IO14	0x1d0		/* FSA1_ALERT# */
++			MX8MP_IOMUXC_SAI2_TXC__GPIO4_IO25	0x400001d0	/* FSA1_GPIO1 */
++			MX8MP_IOMUXC_SAI1_RXD7__GPIO4_IO09	0x400001d0	/* FSA1_GPIO2 */
++		>;
++	};
++
++	pinctrl_fsa2i2c: fsa2i2cgrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SAI1_RXD2__GPIO4_IO04	0x1d0		/* FSA2_ALERT# */
++			MX8MP_IOMUXC_GPIO1_IO13__GPIO1_IO13	0x400001d0	/* FSA2_GPIO1 */
++			MX8MP_IOMUXC_SAI2_TXFS__GPIO4_IO24	0x400001d0	/* FSA2_GPIO2 */
++		>;
++	};
++
++	pinctrl_mag: maggrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SAI3_RXFS__GPIO4_IO28	0x140	/* IRQ# */
++		>;
++	};
++
++	pinctrl_pcie0: pcie0grp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SAI3_RXC__GPIO4_IO29	0x106	/* PERST# */
++		>;
++	};
++
++	pinctrl_pps: ppsgrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SAI1_RXD1__GPIO4_IO03	0x146
++		>;
++	};
++
++	pinctrl_reg_usb2_en: regusb2grp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SAI1_TXD0__GPIO4_IO12	0x146	/* USBHUB_RST# */
++		>;
++	};
++
++	pinctrl_spi2: spi2grp {
++		fsl,pins = <
++			MX8MP_IOMUXC_ECSPI2_SCLK__ECSPI2_SCLK	0xd0
++			MX8MP_IOMUXC_ECSPI2_MOSI__ECSPI2_MOSI	0xd0
++			MX8MP_IOMUXC_ECSPI2_MISO__ECSPI2_MISO	0xd0
++			MX8MP_IOMUXC_ECSPI2_SS0__GPIO5_IO13	0x140	/* J32_CS */
++			MX8MP_IOMUXC_GPIO1_IO10__GPIO1_IO10	0x140	/* TPM_CS */
++			MX8MP_IOMUXC_GPIO1_IO12__GPIO1_IO12	0x140	/* FSA1_CS */
++			MX8MP_IOMUXC_SAI2_TXD0__GPIO4_IO26	0x140	/* FSA2_CS */
++		>;
++	};
++
++	pinctrl_uart1: uart1grp {
++		fsl,pins = <
++			MX8MP_IOMUXC_UART1_RXD__UART1_DCE_RX	0x140
++			MX8MP_IOMUXC_UART1_TXD__UART1_DCE_TX	0x140
++		>;
++	};
++
++	pinctrl_uart4: uart4grp {
++		fsl,pins = <
++			MX8MP_IOMUXC_UART4_RXD__UART4_DCE_RX	0x140
++			MX8MP_IOMUXC_UART4_TXD__UART4_DCE_TX	0x140
++		>;
++	};
++
++	pinctrl_usdhc1: usdhc1grp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SD1_CLK__USDHC1_CLK	0x190
++			MX8MP_IOMUXC_SD1_CMD__USDHC1_CMD	0x1d0
++			MX8MP_IOMUXC_SD1_DATA0__USDHC1_DATA0	0x1d0
++			MX8MP_IOMUXC_SD1_DATA1__USDHC1_DATA1	0x1d0
++			MX8MP_IOMUXC_SD1_DATA2__USDHC1_DATA2	0x1d0
++			MX8MP_IOMUXC_SD1_DATA3__USDHC1_DATA3	0x1d0
++		>;
++	};
++
++	pinctrl_usdhc1_100mhz: usdhc1-100mhzgrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SD1_CLK__USDHC1_CLK	0x194
++			MX8MP_IOMUXC_SD1_CMD__USDHC1_CMD	0x1d4
++			MX8MP_IOMUXC_SD1_DATA0__USDHC1_DATA0	0x1d4
++			MX8MP_IOMUXC_SD1_DATA1__USDHC1_DATA1	0x1d4
++			MX8MP_IOMUXC_SD1_DATA2__USDHC1_DATA2	0x1d4
++			MX8MP_IOMUXC_SD1_DATA3__USDHC1_DATA3	0x1d4
++		>;
++	};
++
++	pinctrl_usdhc1_200mhz: usdhc1-200mhzgrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SD1_CLK__USDHC1_CLK	0x196
++			MX8MP_IOMUXC_SD1_CMD__USDHC1_CMD	0x1d6
++			MX8MP_IOMUXC_SD1_DATA0__USDHC1_DATA0	0x1d6
++			MX8MP_IOMUXC_SD1_DATA1__USDHC1_DATA1	0x1d6
++			MX8MP_IOMUXC_SD1_DATA2__USDHC1_DATA2	0x1d6
++			MX8MP_IOMUXC_SD1_DATA3__USDHC1_DATA3	0x1d6
++		>;
++	};
++
++	pinctrl_usdhc2: usdhc2grp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SD2_CLK__USDHC2_CLK	0x190
++			MX8MP_IOMUXC_SD2_CMD__USDHC2_CMD	0x1d0
++			MX8MP_IOMUXC_SD2_DATA0__USDHC2_DATA0	0x1d0
++			MX8MP_IOMUXC_SD2_DATA1__USDHC2_DATA1	0x1d0
++			MX8MP_IOMUXC_SD2_DATA2__USDHC2_DATA2	0x1d0
++			MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3	0x1d0
++			MX8MP_IOMUXC_GPIO1_IO04__USDHC2_VSELECT	0xc1
++		>;
++	};
++
++	pinctrl_usdhc2_100mhz: usdhc2-100mhzgrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SD2_CLK__USDHC2_CLK	0x194
++			MX8MP_IOMUXC_SD2_CMD__USDHC2_CMD	0x1d4
++			MX8MP_IOMUXC_SD2_DATA0__USDHC2_DATA0	0x1d4
++			MX8MP_IOMUXC_SD2_DATA1__USDHC2_DATA1	0x1d4
++			MX8MP_IOMUXC_SD2_DATA2__USDHC2_DATA2	0x1d4
++			MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3	0x1d4
++			MX8MP_IOMUXC_GPIO1_IO04__USDHC2_VSELECT	0xc1
++		>;
++	};
++
++	pinctrl_usdhc2_200mhz: usdhc2-200mhzgrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SD2_CLK__USDHC2_CLK	0x196
++			MX8MP_IOMUXC_SD2_CMD__USDHC2_CMD	0x1d6
++			MX8MP_IOMUXC_SD2_DATA0__USDHC2_DATA0	0x1d6
++			MX8MP_IOMUXC_SD2_DATA1__USDHC2_DATA1	0x1d6
++			MX8MP_IOMUXC_SD2_DATA2__USDHC2_DATA2	0x1d6
++			MX8MP_IOMUXC_SD2_DATA3__USDHC2_DATA3	0x1d6
++			MX8MP_IOMUXC_GPIO1_IO04__USDHC2_VSELECT	0xc1
++		>;
++	};
++
++	pinctrl_usdhc2_vmmc: usdhc2-vmmc-grp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SD2_RESET_B__GPIO2_IO19	0x1d0
++		>;
++	};
++
++	pinctrl_usdhc2_gpio: usdhc2gpiogrp {
++		fsl,pins = <
++			MX8MP_IOMUXC_SD2_CD_B__GPIO2_IO12	0x1c4
++		>;
++	};
++};
diff --git a/target/linux/imx/patches-6.6/505-6.13-arm64-dts-imx8mm-venice-gw73xx-remove-compatible-in-overlay-files.patch b/target/linux/imx/patches-6.6/505-6.13-arm64-dts-imx8mm-venice-gw73xx-remove-compatible-in-overlay-files.patch
new file mode 100644
index 00000000000000..52b673e9b55385
--- /dev/null
+++ b/target/linux/imx/patches-6.6/505-6.13-arm64-dts-imx8mm-venice-gw73xx-remove-compatible-in-overlay-files.patch
@@ -0,0 +1,56 @@
+From d3fdc7ae2ca9cb93d634e84a2b90ebf340d6e622 Mon Sep 17 00:00:00 2001
+From: Frank Li <Frank.Li@nxp.com>
+Date: Fri, 18 Oct 2024 14:28:23 -0400
+Subject: [PATCH] arm64: dts: imx8mm-venice-gw73xx: remove compatible in
+ overlay file
+
+Remove compatible string in overlay file to fix below warning:
+'gw,imx8mm-gw73xx-0x' is not one of ['fsl,ls1043a-rdb', 'fsl,ls1043a-qds']
+
+Signed-off-by: Frank Li <Frank.Li@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+---
+ .../boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs232-rts.dtso | 4 ----
+ .../boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs422.dtso     | 4 ----
+ .../boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs485.dtso     | 4 ----
+ 3 files changed, 12 deletions(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs232-rts.dtso
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs232-rts.dtso
+@@ -15,10 +15,6 @@
+ /dts-v1/;
+ /plugin/;
+ 
+-&{/} {
+-	compatible = "gw,imx8mm-gw73xx-0x";
+-};
+-
+ &gpio4 {
+ 	rs485_en {
+ 		gpio-hog;
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs422.dtso
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs422.dtso
+@@ -18,10 +18,6 @@
+ /dts-v1/;
+ /plugin/;
+ 
+-&{/} {
+-	compatible = "gw,imx8mm-gw73xx-0x";
+-};
+-
+ &gpio4 {
+ 	rs485_en {
+ 		gpio-hog;
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs485.dtso
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw73xx-0x-rs485.dtso
+@@ -18,10 +18,6 @@
+ /dts-v1/;
+ /plugin/;
+ 
+-&{/} {
+-	compatible = "gw,imx8mm-gw73xx-0x";
+-};
+-
+ &gpio4 {
+ 	rs485_en {
+ 		gpio-hog;
diff --git a/target/linux/imx/patches-6.6/506-6.12-arm64-dts-imx8mm-venice-gw72xx-remove-compatible-in-overlay-files.patch b/target/linux/imx/patches-6.6/506-6.12-arm64-dts-imx8mm-venice-gw72xx-remove-compatible-in-overlay-files.patch
new file mode 100644
index 00000000000000..bd88e35260510b
--- /dev/null
+++ b/target/linux/imx/patches-6.6/506-6.12-arm64-dts-imx8mm-venice-gw72xx-remove-compatible-in-overlay-files.patch
@@ -0,0 +1,60 @@
+From f384d2828f0d5be67fcd69a7c4756f82465a7f2a Mon Sep 17 00:00:00 2001
+From: Fabio Estevam <festevam@denx.de>
+Date: Mon, 1 Jul 2024 20:12:29 -0300
+Subject: [PATCH] arm64: dts: imx8mm-venice-gw72xx-0x: Remove compatible from
+ dtso
+
+There is no need to describe the compatible string inside
+a dtso file.
+
+dt-schema produces super verbose warnings about that.
+
+Signed-off-by: Fabio Estevam <festevam@denx.de>
+Acked-by: Parthiban Nallathambi <parthiban@linumiz.com>
+Acked-by: Tim Harvey <tharvey@gateworks.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+---
+ .../boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs232-rts.dtso | 4 ----
+ .../boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs422.dtso     | 4 ----
+ .../boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs485.dtso     | 4 ----
+ 3 files changed, 12 deletions(-)
+
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs232-rts.dtso
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs232-rts.dtso
+@@ -15,10 +15,6 @@
+ /dts-v1/;
+ /plugin/;
+ 
+-&{/} {
+-	compatible = "gw,imx8mm-gw72xx-0x";
+-};
+-
+ &gpio4 {
+ 	rs485_en {
+ 		gpio-hog;
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs422.dtso
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs422.dtso
+@@ -18,10 +18,6 @@
+ /dts-v1/;
+ /plugin/;
+ 
+-&{/} {
+-	compatible = "gw,imx8mm-gw72xx-0x";
+-};
+-
+ &gpio4 {
+ 	rs485_en {
+ 		gpio-hog;
+--- a/arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs485.dtso
++++ b/arch/arm64/boot/dts/freescale/imx8mm-venice-gw72xx-0x-rs485.dtso
+@@ -18,10 +18,6 @@
+ /dts-v1/;
+ /plugin/;
+ 
+-&{/} {
+-	compatible = "gw,imx8mm-gw72xx-0x";
+-};
+-
+ &gpio4 {
+ 	rs485_en {
+ 		gpio-hog;
diff --git a/target/linux/imx/patches-6.6/600-PCI-imx6-Start-link-at-max-gen-first-for-IMX8MM-and-IMX8MP.patch b/target/linux/imx/patches-6.6/600-PCI-imx6-Start-link-at-max-gen-first-for-IMX8MM-and-IMX8MP.patch
new file mode 100644
index 00000000000000..c9878e55ad25fd
--- /dev/null
+++ b/target/linux/imx/patches-6.6/600-PCI-imx6-Start-link-at-max-gen-first-for-IMX8MM-and-IMX8MP.patch
@@ -0,0 +1,121 @@
+From cf983e4a04eecb5be93af7b53cb10805ee448998 Mon Sep 17 00:00:00 2001
+From: Tim Harvey <tharvey@gateworks.com>
+Date: Mon, 21 Aug 2023 09:20:17 -0700
+Subject: [PATCH] PCI: imx6: Start link at max gen first for IMX8MM and IMX8MP
+
+commit fa33a6d87eac ("PCI: imx6: Start link in Gen1 before negotiating
+for Gen2 mode") started link negotiation at Gen1 before attempting
+faster speeds in order to work around an issue with a particular switch
+on an IMX6Q SoC.
+
+This behavior is not the norm for PCI link negotiation and it has been
+found to cause issues in other cases:
+- IMX8MM with PI7C9X2G608GP switch: various endpoints (such as qca988x)
+  will fail to link more than 50% of the time
+- IMX8MP with PI7C9X2G608GP switch: occasionally will fail to link with
+  switch and cause a CPU hang about 30% of the time
+
+Disable this behavior for IMX8MM and IMX8MP.
+
+Signed-off-by: Tim Harvey <tharvey@gateworks.com>
+---
+ drivers/pci/controller/dwc/pci-imx6.c | 53 ++++++++++++++-------------
+ 1 file changed, 27 insertions(+), 26 deletions(-)
+
+--- a/drivers/pci/controller/dwc/pci-imx6.c
++++ b/drivers/pci/controller/dwc/pci-imx6.c
+@@ -60,6 +60,7 @@ enum imx6_pcie_variants {
+ #define IMX6_PCIE_FLAG_IMX6_PHY			BIT(0)
+ #define IMX6_PCIE_FLAG_IMX6_SPEED_CHANGE	BIT(1)
+ #define IMX6_PCIE_FLAG_SUPPORTS_SUSPEND		BIT(2)
++#define IMX6_PCIE_FLAG_GEN1_LAST		BIT(3)
+ 
+ #define IMX6_PCIE_MAX_CLKS       6
+ 
+@@ -836,26 +837,28 @@ static int imx6_pcie_start_link(struct d
+ 	u32 tmp;
+ 	int ret;
+ 
+-	/*
+-	 * Force Gen1 operation when starting the link.  In case the link is
+-	 * started in Gen2 mode, there is a possibility the devices on the
+-	 * bus will not be detected at all.  This happens with PCIe switches.
+-	 */
+-	dw_pcie_dbi_ro_wr_en(pci);
+-	tmp = dw_pcie_readl_dbi(pci, offset + PCI_EXP_LNKCAP);
+-	tmp &= ~PCI_EXP_LNKCAP_SLS;
+-	tmp |= PCI_EXP_LNKCAP_SLS_2_5GB;
+-	dw_pcie_writel_dbi(pci, offset + PCI_EXP_LNKCAP, tmp);
+-	dw_pcie_dbi_ro_wr_dis(pci);
++	if (!(imx6_pcie->drvdata->flags & IMX6_PCIE_FLAG_GEN1_LAST)) {
++		/*
++		 * Force Gen1 operation when starting the link.  In case the link is
++		 * started in Gen2 mode, there is a possibility the devices on the
++		 * bus will not be detected at all.  This happens with PCIe switches.
++		 */
++		dw_pcie_dbi_ro_wr_en(pci);
++		tmp = dw_pcie_readl_dbi(pci, offset + PCI_EXP_LNKCAP);
++		tmp &= ~PCI_EXP_LNKCAP_SLS;
++		tmp |= PCI_EXP_LNKCAP_SLS_2_5GB;
++		dw_pcie_writel_dbi(pci, offset + PCI_EXP_LNKCAP, tmp);
++		dw_pcie_dbi_ro_wr_dis(pci);
++	}
+ 
+ 	/* Start LTSSM. */
+ 	imx6_pcie_ltssm_enable(dev);
+ 
+-	ret = dw_pcie_wait_for_link(pci);
+-	if (ret)
+-		goto err_reset_phy;
++	if ((pci->link_gen > 1) && !(imx6_pcie->drvdata->flags & IMX6_PCIE_FLAG_GEN1_LAST)) {
++		ret = dw_pcie_wait_for_link(pci);
++		if (ret)
++			goto err_reset_phy;
+ 
+-	if (pci->link_gen > 1) {
+ 		/* Allow faster modes after the link is up */
+ 		dw_pcie_dbi_ro_wr_en(pci);
+ 		tmp = dw_pcie_readl_dbi(pci, offset + PCI_EXP_LNKCAP);
+@@ -889,18 +892,14 @@ static int imx6_pcie_start_link(struct d
+ 				goto err_reset_phy;
+ 			}
+ 		}
+-
+-		/* Make sure link training is finished as well! */
+-		ret = dw_pcie_wait_for_link(pci);
+-		if (ret)
+-			goto err_reset_phy;
+-	} else {
+-		dev_info(dev, "Link: Only Gen1 is enabled\n");
+ 	}
+ 
++	ret = dw_pcie_wait_for_link(pci);
++	if (ret)
++		goto err_reset_phy;
++
+ 	imx6_pcie->link_is_up = true;
+-	tmp = dw_pcie_readw_dbi(pci, offset + PCI_EXP_LNKSTA);
+-	dev_info(dev, "Link up, Gen%i\n", tmp & PCI_EXP_LNKSTA_CLS);
++
+ 	return 0;
+ 
+ err_reset_phy:
+@@ -1458,14 +1457,16 @@ static const struct imx6_pcie_drvdata dr
+ 	},
+ 	[IMX8MM] = {
+ 		.variant = IMX8MM,
+-		.flags = IMX6_PCIE_FLAG_SUPPORTS_SUSPEND,
++		.flags = IMX6_PCIE_FLAG_SUPPORTS_SUSPEND |
++			IMX6_PCIE_FLAG_GEN1_LAST,
+ 		.gpr = "fsl,imx8mm-iomuxc-gpr",
+ 		.clk_names = imx8mm_clks,
+ 		.clks_cnt = ARRAY_SIZE(imx8mm_clks),
+ 	},
+ 	[IMX8MP] = {
+ 		.variant = IMX8MP,
+-		.flags = IMX6_PCIE_FLAG_SUPPORTS_SUSPEND,
++		.flags = IMX6_PCIE_FLAG_SUPPORTS_SUSPEND |
++			IMX6_PCIE_FLAG_GEN1_LAST,
+ 		.gpr = "fsl,imx8mp-iomuxc-gpr",
+ 		.clk_names = imx8mm_clks,
+ 		.clks_cnt = ARRAY_SIZE(imx8mm_clks),
diff --git a/target/linux/ipq40xx/base-files/etc/board.d/02_network b/target/linux/ipq40xx/base-files/etc/board.d/02_network
index e3a6e242284012..549e1ac0c96a3e 100644
--- a/target/linux/ipq40xx/base-files/etc/board.d/02_network
+++ b/target/linux/ipq40xx/base-files/etc/board.d/02_network
@@ -202,6 +202,9 @@ ipq40xx_setup_macs()
 		wan_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
 		lan_mac=$(macaddr_add "$wan_mac" 1)
 		;;
+	extreme-networks,ws-ap3915i)
+		label_mac="$(mtd_get_mac_ascii CFG1 ethaddr)"
+		;;
 	ezviz,cs-w3-wd1200g-eup)
 		label_mac=$(mtd_get_mac_binary "ART" 0x6)
 		;;
diff --git a/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh b/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh
index 1ede544aacc3b0..092f9da4407b21 100644
--- a/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh
+++ b/target/linux/ipq40xx/base-files/lib/preinit/05_set_iface_mac_ipq40xx.sh
@@ -43,6 +43,17 @@ preinit_set_mac_address() {
 		ip link set dev sw-eth1 address "$base_mac"
 		ip link set dev sw-eth2 address $(macaddr_add "$base_mac" 1)
 		;;
+	teltonika,rutx50)
+		# Vendor Bootloader removes nvmem-cells from partition,
+		# so this needs to be done here.
+		base_mac="$(mtd_get_mac_binary 0:CONFIG 0x0)"
+		ip link set dev eth0 address "$base_mac"
+		ip link set dev lan1 address "$base_mac"
+		ip link set dev lan2 address "$base_mac"
+		ip link set dev lan3 address "$base_mac"
+		ip link set dev lan4 address "$base_mac"
+		ip link set dev wan address "$(macaddr_add "$base_mac" 1)"
+		;;
 	zyxel,nbg6617)
 		base_mac=$(cat /sys/class/net/eth0/address)
 		ip link set dev eth0 address $(macaddr_add "$base_mac" 2)
diff --git a/target/linux/ipq40xx/config-6.6 b/target/linux/ipq40xx/config-6.6
index 0ee2f433b1e0da..cdd4d36700e98a 100644
--- a/target/linux/ipq40xx/config-6.6
+++ b/target/linux/ipq40xx/config-6.6
@@ -52,8 +52,6 @@ CONFIG_BLK_MQ_PCI=y
 CONFIG_BOUNCE=y
 # CONFIG_CACHE_L2X0 is not set
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_QCOM=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CMDLINE_PARTITION=y
@@ -165,7 +163,6 @@ CONFIG_FIX_EARLYCON_MEM=y
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_BUG=y
 CONFIG_GENERIC_CLOCKEVENTS=y
@@ -227,6 +224,7 @@ CONFIG_INITRAMFS_SOURCE=""
 CONFIG_IOMMU_SUPPORT=y
 # CONFIG_IPQ_APSS_PLL is not set
 CONFIG_IPQ_GCC_4019=y
+# CONFIG_IPQ_GCC_5018 is not set
 # CONFIG_IPQ_GCC_6018 is not set
 # CONFIG_IPQ_GCC_806X is not set
 # CONFIG_IPQ_GCC_8074 is not set
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-a42.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-a42.dts
index c117a905388a6e..6d1babf00e96c8 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-a42.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-a42.dts
@@ -52,6 +52,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_status_green;
 		led-failsafe = &led_status_green;
 		led-running = &led_status_green;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-ap120c-ac.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-ap120c-ac.dts
index f2e2ed3f7f6c7d..83b4addb796617 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-ap120c-ac.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-ap120c-ac.dts
@@ -15,6 +15,8 @@
 		led-failsafe = &status;
 		led-running = &status;
 		led-upgrade = &status;
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		ethernet1 = &swport5;
 	};
 
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-cap-ac.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-cap-ac.dts
index b061428bb34f58..627ccd5b70adcd 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-cap-ac.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-cap-ac.dts
@@ -21,6 +21,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_user;
 		led-failsafe = &led_user;
 		led-running = &led_user;
@@ -158,7 +160,7 @@
 	flash@0 {
 		reg = <0>;
 		compatible = "jedec,spi-nor";
-		spi-max-frequency = <40000000>;
+		spi-max-frequency = <24000000>;
 
 		partitions {
 			compatible = "fixed-partitions";
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-cs-w3-wd1200g-eup.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-cs-w3-wd1200g-eup.dts
index 8d09bfd0b7acf0..469a6ca7576db3 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-cs-w3-wd1200g-eup.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-cs-w3-wd1200g-eup.dts
@@ -11,6 +11,8 @@
 	compatible = "ezviz,cs-w3-wd1200g-eup";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_status_green;
 		led-failsafe = &led_status_red;
 		led-running = &led_status_blue;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-dap-2610.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-dap-2610.dts
index df5d9331a1e856..69164540cd4eef 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-dap-2610.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-dap-2610.dts
@@ -11,6 +11,8 @@
 	compatible = "dlink,dap-2610";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_red;
 		led-failsafe = &led_red;
 		led-running = &led_green;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-ea6350v3.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-ea6350v3.dts
index e80a54024450c1..6cace3b88f05cb 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-ea6350v3.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-ea6350v3.dts
@@ -11,6 +11,8 @@
 	compatible = "linksys,ea6350v3";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &power;
 		led-failsafe = &power;
 		led-running = &power;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-eap1300.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-eap1300.dts
index 52a96eae980184..5bd5180efd2ec6 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-eap1300.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-eap1300.dts
@@ -41,6 +41,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &power;
 		led-failsafe = &power;
 		led-running = &power;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-ens620ext.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-ens620ext.dts
index 8b75a570744a54..50cac400d77f04 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-ens620ext.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-ens620ext.dts
@@ -150,7 +150,7 @@
 		#size-cells = <0>;
 		compatible = "jedec,spi-nor";
 		reg = <0>;
-		spi-max-frequency = <50000000>;
+		spi-max-frequency = <24000000>;
 		m25p,fast-read;
 
 		partitions {
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-ex61x0v2.dtsi b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-ex61x0v2.dtsi
index ca064837c86e18..367dd20a7a2561 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-ex61x0v2.dtsi
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-ex61x0v2.dtsi
@@ -46,6 +46,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &power_amber;
 		led-failsafe = &power_amber;
 		led-running = &power_green;
@@ -188,7 +190,7 @@
 	mx25l12805d@0 {
 		compatible = "jedec,spi-nor";
 		reg = <0>;
-		spi-max-frequency = <45000000>;
+		spi-max-frequency = <24000000>;
 
 		partitions {
 			compatible = "fixed-partitions";
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-fritzbox-4040.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-fritzbox-4040.dts
index b3617eb45eeed0..6aef86ad26f46b 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-fritzbox-4040.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-fritzbox-4040.dts
@@ -11,6 +11,7 @@
 	compatible = "avm,fritzbox-4040";
 
 	aliases {
+		ethernet0 = &gmac;
 		led-boot = &power;
 		led-failsafe = &flash;
 		led-running = &power;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-gl-a1300.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-gl-a1300.dts
index d8b4300a5205bf..4293191b075852 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-gl-a1300.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-gl-a1300.dts
@@ -11,6 +11,8 @@
 	compatible = "glinet,gl-a1300", "qcom,ipq4019";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_run;
 		led-failsafe = &led_run;
 		led-running = &led_run;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-gl-ap1300.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-gl-ap1300.dts
index bb197c27427773..4ed8a82af6fe3b 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-gl-ap1300.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-gl-ap1300.dts
@@ -11,6 +11,8 @@
 	compatible = "glinet,gl-ap1300";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_power;
 		led-failsafe = &led_power;
 		led-running = &led_power;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-hap-ac2.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-hap-ac2.dts
index 07ad4d3d5209ba..ae244a6696d430 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-hap-ac2.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-hap-ac2.dts
@@ -21,6 +21,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_user;
 		led-failsafe = &led_user;
 		led-running = &led_user;
@@ -153,7 +155,7 @@
 	flash@0 {
 		reg = <0>;
 		compatible = "jedec,spi-nor";
-		spi-max-frequency = <40000000>;
+		spi-max-frequency = <24000000>;
 
 		partitions {
 			compatible = "fixed-partitions";
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-jalapeno.dtsi b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-jalapeno.dtsi
index 9828b4b34efdbc..fcacb98cb9b55e 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-jalapeno.dtsi
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-jalapeno.dtsi
@@ -8,6 +8,8 @@
 
 / {
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		ethernet1 = &swport5;
 	};
 
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-magic-2-wifi-next.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-magic-2-wifi-next.dts
index 293bf3d20a0f1a..5deb9ba3de2522 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-magic-2-wifi-next.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-magic-2-wifi-next.dts
@@ -9,6 +9,11 @@
 	model = "devolo Magic 2 WiFi next";
 	compatible = "devolo,magic-2-wifi-next";
 
+	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
+	};
+
 	memory {
 		device_type = "memory";
 		reg = <0x80000000 0x10000000>;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-mf287_common.dtsi b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-mf287_common.dtsi
index bf2fc0e37e2e59..c19262497d7674 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-mf287_common.dtsi
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-mf287_common.dtsi
@@ -11,6 +11,8 @@
 
 / {
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_status;
 		led-failsafe = &led_status;
 		led-running = &led_status;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-nbg6617.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-nbg6617.dts
index 957ccb306c705f..d33afc7d388e7c 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-nbg6617.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-nbg6617.dts
@@ -21,6 +21,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &power;
 		led-failsafe = &power;
 		led-running = &power;
@@ -168,7 +170,7 @@
 	flash@0 {
 		compatible = "jedec,spi-nor";
 		reg = <0>;
-		spi-max-frequency = <50000000>;
+		spi-max-frequency = <24000000>;
 		status = "okay";
 		m25p,fast-read;
 
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-pa1200.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-pa1200.dts
index a353c7f9f3d0d4..8040bb494b1934 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-pa1200.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-pa1200.dts
@@ -52,6 +52,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_status_purple;
 		led-failsafe = &led_status_yellow;
 		led-running = &led_status_cyan;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-rt-ac58u.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-rt-ac58u.dts
index e58b3378d5743b..7477d5ddc44ce4 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-rt-ac58u.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-rt-ac58u.dts
@@ -16,6 +16,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_power;
 		led-failsafe = &led_power;
 		led-running = &led_power;
@@ -180,7 +182,7 @@
 		compatible = "jedec,spi-nor";
 		reg = <0>;
 		linux,modalias = "m25p80", "mx25l1606e", "n25q128a11";
-		spi-max-frequency = <30000000>;
+		spi-max-frequency = <24000000>;
 
 		partitions {
 			compatible = "fixed-partitions";
@@ -234,7 +236,7 @@
 	spi-nand@1 {
 		compatible = "spi-nand";
 		reg = <1>;
-		spi-max-frequency = <30000000>;
+		spi-max-frequency = <24000000>;
 
 		/*
 		 * U-boot looks for "spinand,mt29f" node,
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-rutx50.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-rutx50.dts
index ea2102f7d6a7ef..ae244bd126ab20 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-rutx50.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-rutx50.dts
@@ -7,6 +7,8 @@
 	compatible = "teltonika,rutx50";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_rssi0;
 		led-failsafe = &led_rssi0;
 		led-running = &led_rssi0;
@@ -27,7 +29,7 @@
 
 			gpio_modem_power {
 				gpio-export,name = "modem_power";
-				gpio-export,output = <0>;
+				gpio-export,output = <1>;
 				gpios = <&shift_io 9 GPIO_ACTIVE_HIGH>;
 			};
 
@@ -101,11 +103,13 @@
 			led-10 {
 				label = "green:wifi2g";
 				gpios = <&shift_io 12 GPIO_ACTIVE_HIGH>;
+				linux,default-trigger = "phy0tpt";
 			};
 
 			led-11 {
 				label = "green:wifi5g";
 				gpios = <&shift_io 13 GPIO_ACTIVE_HIGH>;
+				linux,default-trigger = "phy1tpt";
 			};
 		};
 
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-sxtsq-5-ac.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-sxtsq-5-ac.dts
index 23e9457f029d0c..f588d94142dc71 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-sxtsq-5-ac.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-sxtsq-5-ac.dts
@@ -21,6 +21,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_user;
 		led-failsafe = &led_user;
 		led-running = &led_user;
@@ -157,7 +159,7 @@
 	flash@0 {
 		reg = <0>;
 		compatible = "jedec,spi-nor";
-		spi-max-frequency = <40000000>;
+		spi-max-frequency = <24000000>;
 
 		partitions {
 			compatible = "fixed-partitions";
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-wac510.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-wac510.dts
index 8515f3c0347877..fc862a25b1ed7b 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-wac510.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-wac510.dts
@@ -16,6 +16,8 @@
 		led-failsafe = &led_power_amber;
 		led-running = &led_power_green;
 		led-upgrade = &led_power_amber;
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		ethernet1 = &swport5;
 	};
 
@@ -204,7 +206,7 @@
 
 	flash@0 {
 		compatible = "jedec,spi-nor";
-		spi-max-frequency = <50000000>;
+		spi-max-frequency = <24000000>;
 		reg = <0>;
 
 		partitions {
@@ -296,7 +298,7 @@
 	nand@1 {
 		compatible = "spi-nand";
 		reg = <1>;
-		spi-max-frequency = <48000000>;
+		spi-max-frequency = <24000000>;
 
 		partitions {
 			compatible = "fixed-partitions";
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-wap-ac.dtsi b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-wap-ac.dtsi
index 2b357a1f03335f..83dd4b925bd569 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-wap-ac.dtsi
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-wap-ac.dtsi
@@ -18,6 +18,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_user;
 		led-failsafe = &led_user;
 		led-running = &led_user;
@@ -121,7 +123,7 @@
 	flash@0 {
 		reg = <0>;
 		compatible = "jedec,spi-nor";
-		spi-max-frequency = <40000000>;
+		spi-max-frequency = <24000000>;
 
 		partitions {
 			compatible = "fixed-partitions";
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-whw01.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-whw01.dts
index 1f26db586905ef..fe6e8626ea8989 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-whw01.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-whw01.dts
@@ -10,6 +10,8 @@
 	compatible = "linksys,whw01";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		serial0 = &blsp1_uart1;
 		led-boot = &led_system_blue;
 		led-running = &led_system_blue;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-wr-1.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-wr-1.dts
index dd56cb215e8e0e..990eb70daae853 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-wr-1.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-wr-1.dts
@@ -11,6 +11,8 @@
 	compatible = "pakedge,wr-1";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		label-mac-device = &gmac;
 		led-boot = &led_power;
 		led-failsafe = &led_power;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-wrtq-329acn.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-wrtq-329acn.dts
index fc5a7a94aa3cd3..7c8e81de330399 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-wrtq-329acn.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4018-wrtq-329acn.dts
@@ -9,6 +9,11 @@
 	model = "Luma Home WRTQ-329ACN";
 	compatible = "luma,wrtq-329acn";
 
+	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
+	};
+
 	i2c-gpio {
 		compatible = "i2c-gpio";
 		sda-gpios = <&tlmm 1 (GPIO_ACTIVE_HIGH|GPIO_OPEN_DRAIN)>;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-a62.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-a62.dts
index d8249236f04009..79242a42e43c50 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-a62.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-a62.dts
@@ -52,6 +52,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_status_green;
 		led-failsafe = &led_status_green;
 		led-running = &led_status_green;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-cm520-79f.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-cm520-79f.dts
index 3569d6e53ab712..3346fc8098f6d6 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-cm520-79f.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-cm520-79f.dts
@@ -11,6 +11,8 @@
 	compatible = "mobipromo,cm520-79f";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_sys;
 		led-failsafe = &led_sys;
 		led-running = &led_sys;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-e2600ac-c1.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-e2600ac-c1.dts
index 243d19fb033da8..00fc918ccfc2d8 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-e2600ac-c1.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-e2600ac-c1.dts
@@ -11,6 +11,11 @@
 / {
 	model = "Qxwlan E2600AC c1";
 	compatible = "qxwlan,e2600ac-c1";
+
+	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
+	};
 };
 
 &blsp1_spi1 {
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-e2600ac-c2.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-e2600ac-c2.dts
index e065ef0168016d..c2c602114f8983 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-e2600ac-c2.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-e2600ac-c2.dts
@@ -11,6 +11,11 @@
 / {
 	model = "Qxwlan E2600AC c2";
 	compatible = "qxwlan,e2600ac-c2";
+
+	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
+	};
 };
 
 &blsp1_spi1 {
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-fritzbox-7530.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-fritzbox-7530.dts
index 2344ae7bf89583..8566c7c337eba1 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-fritzbox-7530.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-fritzbox-7530.dts
@@ -15,10 +15,12 @@
 	};
 
 	aliases {
+		ethernet0 = &gmac;
 		led-boot = &power_green;
 		led-failsafe = &info_red;
 		led-running = &power_green;
 		led-upgrade = &info_red;
+		label-mac-device = &gmac;
 	};
 
 	soc {
@@ -305,6 +307,7 @@
 };
 
 &pcie0 {
+	compatible = "qcom,pcie-ipq4019-lantiq-hack";
 	status = "okay";
 
 	perst-gpio = <&tlmm 38 GPIO_ACTIVE_LOW>;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-fritzrepeater-1200.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-fritzrepeater-1200.dts
index 106c8031e31d52..e60cd42778d496 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-fritzrepeater-1200.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-fritzrepeater-1200.dts
@@ -11,6 +11,8 @@
 	compatible = "avm,fritzrepeater-1200";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &power_green;
 		led-failsafe = &power_red;
 		led-running = &power_green;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-fritzrepeater-3000.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-fritzrepeater-3000.dts
index e8daef63f1456e..f720be6d03bcf9 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-fritzrepeater-3000.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-fritzrepeater-3000.dts
@@ -11,6 +11,8 @@
 	compatible = "avm,fritzrepeater-3000";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &power_led;
 		led-failsafe = &power_led;
 		led-running = &power_led;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-gl-b2200.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-gl-b2200.dts
index 89ba523e57dc41..33400170c85427 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-gl-b2200.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-gl-b2200.dts
@@ -20,6 +20,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		ethernet1 = &swport4;
 	};
 
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-habanero-dvk.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-habanero-dvk.dts
index 94be4d976e26a7..d792599f1a2ae1 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-habanero-dvk.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-habanero-dvk.dts
@@ -12,6 +12,8 @@
 	compatible = "8dev,habanero-dvk";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_status;
 		led-failsafe = &led_status;
 		led-running = &led_status;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-hap-ac3-lte6-kit.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-hap-ac3-lte6-kit.dts
index b1a04012fb2a80..881abc23dbe3ec 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-hap-ac3-lte6-kit.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-hap-ac3-lte6-kit.dts
@@ -21,6 +21,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_status_blue;
 		led-failsafe = &led_status_red;
 		led-running = &led_status_blue;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-hap-ac3.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-hap-ac3.dts
index 4a3a323b5ffc5b..bbc93c083d0060 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-hap-ac3.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-hap-ac3.dts
@@ -21,6 +21,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_status_blue;
 		led-failsafe = &led_status_red;
 		led-running = &led_status_blue;
@@ -224,7 +226,7 @@
 	flash@0 {
 		reg = <0>;
 		compatible = "jedec,spi-nor";
-		spi-max-frequency = <40000000>;
+		spi-max-frequency = <24000000>;
 
 		partitions {
 			compatible = "fixed-partitions";
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-lbr20.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-lbr20.dts
index 4e5497cbc30c20..09d9a8f3ddf675 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-lbr20.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-lbr20.dts
@@ -15,6 +15,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_backlight_white;
 		led-failsafe = &led_status_green;
 		led-running = &led_status_green;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-lhgg-60ad.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-lhgg-60ad.dts
index a5b55ff421f4dc..b042329bc7b135 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-lhgg-60ad.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-lhgg-60ad.dts
@@ -35,6 +35,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &user;
 		led-failsafe = &user;
 		led-running = &user;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-map-ac2200.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-map-ac2200.dts
index 7ec3c6a9ae7c8c..e3a5ad7be5c095 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-map-ac2200.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-map-ac2200.dts
@@ -15,6 +15,8 @@
 		led-failsafe = &led_red0;
 		led-running = &led_blue0;
 		led-upgrade = &led_red0;
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		ethernet1 = &swport4;
 	};
 
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-mf18a.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-mf18a.dts
index 7c0260ec3c531d..3eaa75b520b747 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-mf18a.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-mf18a.dts
@@ -14,6 +14,8 @@
 	compatible = "zte,mf18a";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_power;
 		led-failsafe = &led_power;
 		led-running = &led_power;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-mf282plus.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-mf282plus.dts
index a4606dd21cbde9..80a729e96328cc 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-mf282plus.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-mf282plus.dts
@@ -13,6 +13,8 @@
 	compatible = "zte,mf282plus";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_internal;
 		led-failsafe = &led_internal;
 		led-running = &led_internal;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-mf286d.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-mf286d.dts
index 06d65b8944160e..91cf49b1b0065e 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-mf286d.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-mf286d.dts
@@ -12,6 +12,8 @@
 	compatible = "zte,mf286d";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_internal;
 		led-failsafe = &led_internal;
 		led-running = &led_internal;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-mf289f.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-mf289f.dts
index f5a985b6d1692f..f03717be33093d 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-mf289f.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-mf289f.dts
@@ -13,6 +13,8 @@
 	compatible = "zte,mf289f";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_status;
 		led-failsafe = &led_status;
 		led-running = &led_status;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-ncp-hg100-cellular.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-ncp-hg100-cellular.dts
index e115c211aab0e2..4bef4994990ba3 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-ncp-hg100-cellular.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-ncp-hg100-cellular.dts
@@ -12,6 +12,8 @@
 	compatible = "sony,ncp-hg100-cellular";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_cloud_green;
 		led-failsafe = &led_cloud_red;
 		led-running = &led_cloud_green;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-orbi.dtsi b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-orbi.dtsi
index 0418176066dc7e..e3024ed663d254 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-orbi.dtsi
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-orbi.dtsi
@@ -12,6 +12,7 @@
 		led-failsafe = &led_status_red;
 		led-running = &led_status_green;
 		led-upgrade = &led_status_blue;
+		ethernet0 = &gmac;
 		label-mac-device = &gmac;
 	};
 
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-pa2200.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-pa2200.dts
index f87ab074162b48..f4c64d6b0615c6 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-pa2200.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-pa2200.dts
@@ -44,6 +44,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_power_orange;
 		led-failsafe = &led_status_blue;
 		led-running = &led_power_orange;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-r619ac.dtsi b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-r619ac.dtsi
index 0463c61236e80f..5ebbaa90ade009 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-r619ac.dtsi
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-r619ac.dtsi
@@ -12,6 +12,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_sys;
 		led-failsafe = &led_sys;
 		led-running = &led_sys;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-rt-ac42u.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-rt-ac42u.dts
index 3cd8997a92597e..48b2e43d18ee3a 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-rt-ac42u.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-rt-ac42u.dts
@@ -16,6 +16,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_power;
 		led-failsafe = &led_power;
 		led-running = &led_power;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-rtl30vw.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-rtl30vw.dts
index 7a13241b661f9e..593b3959fc14d8 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-rtl30vw.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-rtl30vw.dts
@@ -14,6 +14,8 @@
 	compatible = "cellc,rtl30vw";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_power_blue;
 		led-failsafe = &led_power_red;
 		led-running = &led_power_blue;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-whw03.dtsi b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-whw03.dtsi
index 54e3cc7818c183..9da7e44547d270 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-whw03.dtsi
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-whw03.dtsi
@@ -8,10 +8,12 @@
 
 / {
 	aliases {
+		ethernet0 = &gmac;
 		led-boot = &led_blue;
 		led-failsafe = &led_red;
 		led-running = &led_blue;
 		led-upgrade = &led_red;
+		label-mac-device = &gmac;
 	};
 
 	soc {
@@ -272,7 +274,7 @@
 	pinctrl-0 = <&wifi_0_pins>;
 	pinctrl-names = "default";
 
-	qcom,coexist-support = <1>;
+	qcom,coexist-support = /bits/ 8 <1>;
 	qcom,coexist-gpio-pin = <52>;
 };
 
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-wia3300-20.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-wia3300-20.dts
index 644329419d97a9..887762bd232ab3 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-wia3300-20.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-wia3300-20.dts
@@ -11,6 +11,8 @@
 	model = "SKSpruce WIA3300-20";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		label-mac-device = &gmac;
 		led-boot = &led_status_red;
 		led-failsafe = &led_status_lime;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-wifi.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-wifi.dts
index f2e39c87aef43e..c6113e7aab0fab 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-wifi.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-wifi.dts
@@ -14,6 +14,8 @@
 	compatible = "google,wifi", "google,gale-v2", "qcom,ipq4019";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		label-mac-device = &gmac0;
 		led-boot = &led0_blue;
 		led-failsafe = &led0_red;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-wtr-m2133hp.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-wtr-m2133hp.dts
index ab985dfce160e0..c892bf0c5bef4c 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-wtr-m2133hp.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-wtr-m2133hp.dts
@@ -29,6 +29,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_power_blue;
 		led-failsafe = &led_power_orange;
 		led-running = &led_power_white;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-xx8300.dtsi b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-xx8300.dtsi
index 0673dc0241657f..3bcc5c3cec269f 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-xx8300.dtsi
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4019-xx8300.dtsi
@@ -26,6 +26,11 @@
 	};
 
 
+	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
+	};
+
 	soc {
 		tcsr@1949000 {
 			compatible = "qcom,tcsr";
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4028-wpj428.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4028-wpj428.dts
index 517d691d10552b..fd7878b47a0905 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4028-wpj428.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4028-wpj428.dts
@@ -73,6 +73,8 @@
 	};
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &status;
 		led-failsafe = &status;
 		led-upgrade = &status;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-ap-303h.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-ap-303h.dts
index 62270272662934..1cb1b9d5dd9991 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-ap-303h.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-ap-303h.dts
@@ -10,6 +10,8 @@
 	compatible = "aruba,ap-303h";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_system_green;
 		led-failsafe = &led_system_red;
 		led-running = &led_system_green;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-aruba-glenmorangie.dtsi b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-aruba-glenmorangie.dtsi
index 7f8f9be7956790..520ccdfd1cc3ae 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-aruba-glenmorangie.dtsi
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-aruba-glenmorangie.dtsi
@@ -6,6 +6,11 @@
 #include <dt-bindings/soc/qcom,tcsr.h>
 
 / {
+	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
+	};
+
 	memory {
 		device_type = "memory";
 		reg = <0x80000000 0x10000000>;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-gl-b1300.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-gl-b1300.dts
index dfb639e2bbb2ea..2aea68d5205a1b 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-gl-b1300.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-gl-b1300.dts
@@ -25,6 +25,8 @@
 	compatible = "glinet,gl-b1300";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &power;
 		led-failsafe = &power;
 		led-running = &power;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-insect-common.dtsi b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-insect-common.dtsi
index 8286e1899f8c75..9d2f7ce1bc205a 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-insect-common.dtsi
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-insect-common.dtsi
@@ -20,6 +20,8 @@
 
 / {
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &status_green;
 		led-failsafe = &status_red;
 		led-running = &status_green;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-ws-ap3915i.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-ws-ap3915i.dts
index 48e0bb903e5450..533ff388a9fbf0 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-ws-ap3915i.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-ws-ap3915i.dts
@@ -10,6 +10,8 @@
 	compatible = "extreme-networks,ws-ap3915i";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_system_green;
 		led-failsafe = &led_system_amber;
 		led-running = &led_system_green;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-ws-ap391x.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-ws-ap391x.dts
index 1eb6ea2eb895b0..1fe8f8536a53bc 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-ws-ap391x.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq4029-ws-ap391x.dts
@@ -10,6 +10,8 @@
 	compatible = "extreme-networks,ws-ap391x";
 
 	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
 		led-boot = &led_system_green;
 		led-failsafe = &led_system_red;
 		led-running = &led_system_green;
diff --git a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq40x9-dr40x9.dts b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq40x9-dr40x9.dts
index 271a97209255a4..177e38ad833bf8 100644
--- a/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq40x9-dr40x9.dts
+++ b/target/linux/ipq40xx/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq40x9-dr40x9.dts
@@ -9,6 +9,11 @@
 	model = "Wallystech DR40X9";
 	compatible = "wallys,dr40x9";
 
+	aliases {
+		// TODO: Verify if the ethernet0 alias is needed
+		ethernet0 = &gmac;
+	};
+
 	chosen {
 		bootargs-append = " ubi.mtd=ubi root=/dev/ubiblock0_1";
 	};
diff --git a/target/linux/ipq40xx/image/generic.mk b/target/linux/ipq40xx/image/generic.mk
index d92d0824f9a331..21841f4bf1776c 100644
--- a/target/linux/ipq40xx/image/generic.mk
+++ b/target/linux/ipq40xx/image/generic.mk
@@ -542,7 +542,6 @@ define Device/extreme-networks_ws-ap3915i
 	DEVICE_MODEL := WS-AP3915i
 	IMAGE_SIZE := 30080k
 	SOC := qcom-ipq4029
-	BLOCKSIZE := 128k
 	IMAGE/sysupgrade.bin := append-kernel | append-rootfs | pad-rootfs | check-size | append-metadata
 endef
 TARGET_DEVICES += extreme-networks_ws-ap3915i
diff --git a/target/linux/ipq40xx/patches-6.6/004-v6.7-firmware-qcom_scm-disable-SDI-if-required.patch b/target/linux/ipq40xx/patches-6.6/004-v6.7-firmware-qcom_scm-disable-SDI-if-required.patch
index 9df758ae1b35a8..747ba7f285005f 100644
--- a/target/linux/ipq40xx/patches-6.6/004-v6.7-firmware-qcom_scm-disable-SDI-if-required.patch
+++ b/target/linux/ipq40xx/patches-6.6/004-v6.7-firmware-qcom_scm-disable-SDI-if-required.patch
@@ -57,7 +57,7 @@ Signed-off-by: Bjorn Andersson <andersson@kernel.org>
  static int __qcom_scm_set_dload_mode(struct device *dev, bool enable)
  {
  	struct qcom_scm_desc desc = {
-@@ -1473,6 +1496,13 @@ static int qcom_scm_probe(struct platfor
+@@ -1474,6 +1497,13 @@ static int qcom_scm_probe(struct platfor
  
  	__get_convention();
  
diff --git a/target/linux/ipq40xx/patches-6.6/400-mmc-sdhci-sdhci-msm-use-sdhci_set_clock-instead-of-s.patch b/target/linux/ipq40xx/patches-6.6/400-mmc-sdhci-sdhci-msm-use-sdhci_set_clock-instead-of-s.patch
index 1c156d4398a41f..737da1e2fe7a29 100644
--- a/target/linux/ipq40xx/patches-6.6/400-mmc-sdhci-sdhci-msm-use-sdhci_set_clock-instead-of-s.patch
+++ b/target/linux/ipq40xx/patches-6.6/400-mmc-sdhci-sdhci-msm-use-sdhci_set_clock-instead-of-s.patch
@@ -13,7 +13,7 @@ Signed-off-by: Robert Marko <robert.marko@sartura.hr>
 
 --- a/drivers/mmc/host/sdhci-msm.c
 +++ b/drivers/mmc/host/sdhci-msm.c
-@@ -2320,7 +2320,7 @@ MODULE_DEVICE_TABLE(of, sdhci_msm_dt_mat
+@@ -2383,7 +2383,7 @@ MODULE_DEVICE_TABLE(of, sdhci_msm_dt_mat
  
  static const struct sdhci_ops sdhci_msm_ops = {
  	.reset = sdhci_and_cqhci_reset,
diff --git a/target/linux/ipq40xx/patches-6.6/401-mmc-sdhci-msm-comment-unused-sdhci_msm_set_clock.patch b/target/linux/ipq40xx/patches-6.6/401-mmc-sdhci-msm-comment-unused-sdhci_msm_set_clock.patch
index cfbb6439748b6d..6e0f35b6fc0c85 100644
--- a/target/linux/ipq40xx/patches-6.6/401-mmc-sdhci-msm-comment-unused-sdhci_msm_set_clock.patch
+++ b/target/linux/ipq40xx/patches-6.6/401-mmc-sdhci-msm-comment-unused-sdhci_msm_set_clock.patch
@@ -13,7 +13,7 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 
 --- a/drivers/mmc/host/sdhci-msm.c
 +++ b/drivers/mmc/host/sdhci-msm.c
-@@ -1755,49 +1755,49 @@ static unsigned int sdhci_msm_get_min_cl
+@@ -1818,49 +1818,49 @@ static unsigned int sdhci_msm_get_min_cl
  	return SDHCI_MSM_MIN_CLOCK;
  }
  
diff --git a/target/linux/ipq40xx/patches-6.6/700-net-ipqess-introduce-the-Qualcomm-IPQESS-driver.patch b/target/linux/ipq40xx/patches-6.6/700-net-ipqess-introduce-the-Qualcomm-IPQESS-driver.patch
index d9ecf4b640077b..b8557bacc75865 100644
--- a/target/linux/ipq40xx/patches-6.6/700-net-ipqess-introduce-the-Qualcomm-IPQESS-driver.patch
+++ b/target/linux/ipq40xx/patches-6.6/700-net-ipqess-introduce-the-Qualcomm-IPQESS-driver.patch
@@ -32,7 +32,7 @@ Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
 
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -17716,6 +17716,13 @@ L:	netdev@vger.kernel.org
+@@ -17717,6 +17717,13 @@ L:	netdev@vger.kernel.org
  S:	Maintained
  F:	drivers/net/ethernet/qualcomm/emac/
  
diff --git a/target/linux/ipq40xx/patches-6.6/701-net-dsa-add-out-of-band-tagging-protocol.patch b/target/linux/ipq40xx/patches-6.6/701-net-dsa-add-out-of-band-tagging-protocol.patch
index 9c4b520fcda0a1..292f6e6f100566 100644
--- a/target/linux/ipq40xx/patches-6.6/701-net-dsa-add-out-of-band-tagging-protocol.patch
+++ b/target/linux/ipq40xx/patches-6.6/701-net-dsa-add-out-of-band-tagging-protocol.patch
@@ -64,7 +64,7 @@ Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
  
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -17722,6 +17722,7 @@ L:	netdev@vger.kernel.org
+@@ -17723,6 +17723,7 @@ L:	netdev@vger.kernel.org
  S:	Maintained
  F:	Documentation/devicetree/bindings/net/qcom,ipq4019-ess-edma.yaml
  F:	drivers/net/ethernet/qualcomm/ipqess/
@@ -93,7 +93,7 @@ Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
 +#endif
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
-@@ -4657,6 +4657,9 @@ enum skb_ext_id {
+@@ -4712,6 +4712,9 @@ enum skb_ext_id {
  #if IS_ENABLED(CONFIG_MCTP_FLOWS)
  	SKB_EXT_MCTP,
  #endif
diff --git a/target/linux/ipq40xx/patches-6.6/706-net-dsa-qca8k-add-IPQ4019-built-in-switch-support.patch b/target/linux/ipq40xx/patches-6.6/706-net-dsa-qca8k-add-IPQ4019-built-in-switch-support.patch
index 20dd345c6997a4..73e99f2bdc28c2 100644
--- a/target/linux/ipq40xx/patches-6.6/706-net-dsa-qca8k-add-IPQ4019-built-in-switch-support.patch
+++ b/target/linux/ipq40xx/patches-6.6/706-net-dsa-qca8k-add-IPQ4019-built-in-switch-support.patch
@@ -67,27 +67,18 @@ Signed-off-by: Robert Marko <robert.marko@sartura.hr>
  		mask = QCA8K_VTU_FUNC0_EG_MODE_PORT_NOT(i);
  
  		if ((reg & mask) != mask) {
-@@ -653,7 +653,7 @@ int qca8k_port_bridge_join(struct dsa_sw
- 	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
- 	port_mask = BIT(cpu_port);
+@@ -624,7 +624,7 @@ static int qca8k_update_port_member(stru
+ 	u32 port_mask = BIT(dp->cpu_dp->index);
+ 	int i, ret;
  
 -	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
-+	for (i = 0; i < ds->num_ports; i++) {
- 		if (dsa_is_cpu_port(ds, i))
- 			continue;
- 		if (!dsa_port_offloads_bridge(dsa_to_port(ds, i), &bridge))
-@@ -685,7 +685,7 @@ void qca8k_port_bridge_leave(struct dsa_
- 
- 	cpu_port = dsa_to_port(ds, port)->cpu_dp->index;
- 
--	for (i = 0; i < QCA8K_NUM_PORTS; i++) {
-+	for (i = 0; i < ds->num_ports; i++) {
- 		if (dsa_is_cpu_port(ds, i))
++	for (i = 0; i < priv->ds->num_ports; i++) {
+ 		if (i == port)
  			continue;
- 		if (!dsa_port_offloads_bridge(dsa_to_port(ds, i), &bridge))
+ 		if (dsa_is_cpu_port(priv->ds, i))
 --- /dev/null
 +++ b/drivers/net/dsa/qca/qca8k-ipq4019.c
-@@ -0,0 +1,946 @@
+@@ -0,0 +1,950 @@
 +// SPDX-License-Identifier: GPL-2.0
 +/*
 + * Copyright (C) 2009 Felix Fietkau <nbd@nbd.name>
@@ -879,6 +870,8 @@ Signed-off-by: Robert Marko <robert.marko@sartura.hr>
 +	.port_change_mtu	= qca8k_port_change_mtu,
 +	.port_max_mtu		= qca8k_port_max_mtu,
 +	.port_stp_state_set	= qca8k_port_stp_state_set,
++	.port_pre_bridge_flags	= qca8k_port_pre_bridge_flags,
++	.port_bridge_flags	= qca8k_port_bridge_flags,
 +	.port_bridge_join	= qca8k_port_bridge_join,
 +	.port_bridge_leave	= qca8k_port_bridge_leave,
 +	.port_fast_age		= qca8k_port_fast_age,
@@ -989,7 +982,9 @@ Signed-off-by: Robert Marko <robert.marko@sartura.hr>
 +	priv->ds->num_ports = QCA8K_IPQ4019_NUM_PORTS;
 +	priv->ds->priv = priv;
 +	priv->ds->ops = &qca8k_ipq4019_switch_ops;
-+	mutex_init(&priv->reg_mutex);
++	ret = devm_mutex_init(dev, &priv->reg_mutex);
++	if (ret)
++		return ret;
 +	platform_set_drvdata(pdev, priv);
 +
 +	return dsa_register_switch(priv->ds);
@@ -1117,7 +1112,7 @@ Signed-off-by: Robert Marko <robert.marko@sartura.hr>
  enum {
  	QCA8K_PORT_SPEED_10M = 0,
  	QCA8K_PORT_SPEED_100M = 1,
-@@ -466,6 +518,10 @@ struct qca8k_priv {
+@@ -467,6 +519,10 @@ struct qca8k_priv {
  	struct qca8k_pcs pcs_port_6;
  	const struct qca8k_match_data *info;
  	struct qca8k_led ports_led[QCA8K_LED_COUNT];
diff --git a/target/linux/ipq40xx/patches-6.6/850-soc-add-qualcomm-syscon.patch b/target/linux/ipq40xx/patches-6.6/850-soc-add-qualcomm-syscon.patch
index 0e93ebb646b510..7cd473b24eb299 100644
--- a/target/linux/ipq40xx/patches-6.6/850-soc-add-qualcomm-syscon.patch
+++ b/target/linux/ipq40xx/patches-6.6/850-soc-add-qualcomm-syscon.patch
@@ -23,7 +23,7 @@ Subject: SoC: add qualcomm syscon
 +obj-$(CONFIG_QCOM_TCSR)		+= qcom_tcsr.o
 --- /dev/null
 +++ b/drivers/soc/qcom/qcom_tcsr.c
-@@ -0,0 +1,96 @@
+@@ -0,0 +1,95 @@
 +/*
 + * Copyright (c) 2014, The Linux foundation. All rights reserved.
 + *
@@ -109,7 +109,6 @@ Subject: SoC: add qualcomm syscon
 +static struct platform_driver tcsr_driver = {
 +	.driver = {
 +		.name		= "tcsr",
-+		.owner		= THIS_MODULE,
 +		.of_match_table	= tcsr_dt_match,
 +	},
 +	.probe = tcsr_probe,
diff --git a/target/linux/ipq40xx/patches-6.6/900-PCI-qcom-add-hack-compatible-for-ipq4019-Lantiq-DSL.patch b/target/linux/ipq40xx/patches-6.6/900-PCI-qcom-add-hack-compatible-for-ipq4019-Lantiq-DSL.patch
new file mode 100644
index 00000000000000..af10fd57049d22
--- /dev/null
+++ b/target/linux/ipq40xx/patches-6.6/900-PCI-qcom-add-hack-compatible-for-ipq4019-Lantiq-DSL.patch
@@ -0,0 +1,166 @@
+From f4f03dca92b45616ef0325051fdc7627c16fdd62 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Tue, 7 May 2024 20:21:17 +0200
+Subject: [PATCH] PCI: qcom: add hack compatible for ipq4019 Lantiq DSL
+
+Add hack compatible for ipq4019 Lantiq DSL
+
+This change the PCIe vendor/device ID to the values from Lantiq
+GRX500 SoCs. We also program the ATU to fake the CPU ID as a Lantiq CPU
+by providing to the Lantiq firmware custom crafted value in the address
+the firmware would expect the CPU ID to be readable.
+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Signed-off-by: Florian Maurer <f.maurer@outlook.com>
+---
+ drivers/pci/controller/dwc/pcie-qcom.c | 94 +++++++++++++++++++++++++-
+ 1 file changed, 93 insertions(+), 1 deletion(-)
+
+--- a/drivers/pci/controller/dwc/pcie-qcom.c
++++ b/drivers/pci/controller/dwc/pcie-qcom.c
+@@ -184,11 +184,24 @@ struct qcom_pcie_resources_2_3_3 {
+ 
+ #define QCOM_PCIE_2_4_0_MAX_CLOCKS		4
+ #define QCOM_PCIE_2_4_0_MAX_RESETS		12
++/*
++ * This value is the manufacturer ID of Lantiq. The address where
++ * it will be visible for the PCIe device matches the location of
++ * CPU ID registers on Lantiq SocS (MPS base address is 0x1f107000).
++ */
++#define QCOM_PCIE_2_4_0_CPU_ID_BASE_REG		0x1f107000
++#define QCOM_PCIE_2_4_0_CPU_ID_REG		0x340
++#define QCOM_PCIE_2_4_0_CPU_ID_REG_OFFSET	(QCOM_PCIE_2_4_0_CPU_ID_REG / sizeof(u32))
++#define QCOM_PCIE_2_4_0_CPU_ID_REG_VAL		(0x389 << 5)
++#define QCOM_PCIE_2_4_0_GRX500_VENDOR_ID	0x1bef
++#define QCOM_PCIE_2_4_0_GRX500_DEVICE_ID	0x0030
+ struct qcom_pcie_resources_2_4_0 {
+ 	struct clk_bulk_data clks[QCOM_PCIE_2_4_0_MAX_CLOCKS];
+ 	int num_clks;
+ 	struct reset_control_bulk_data resets[QCOM_PCIE_2_4_0_MAX_RESETS];
+ 	int num_resets;
++	void *lantiq_hack_virt;
++	dma_addr_t lantiq_hack_phys;
+ };
+ 
+ #define QCOM_PCIE_2_7_0_MAX_CLOCKS		15
+@@ -629,12 +642,65 @@ static int qcom_pcie_post_init_2_3_2(str
+ 	return 0;
+ }
+ 
++static void qcom_pcie_host_post_init_2_3_2_lantiq_hack(struct qcom_pcie *pcie)
++{
++	struct qcom_pcie_resources_2_4_0 *res = &pcie->res.v2_4_0;
++	struct dw_pcie *pci = pcie->pci;
++	struct dw_pcie_rp *pp = &pci->pp;
++	struct device *dev = pci->dev;
++	struct resource_entry *entry;
++	int ret, index = 0;
++	u64 addr, phys;
++	u32 *val;
++
++	res->lantiq_hack_virt = dma_alloc_coherent(dev, SZ_4K,
++						   &res->lantiq_hack_phys,
++						   GFP_ATOMIC);
++	if (!res->lantiq_hack_virt) {
++		dev_err(dev, "failed to allocate DMA for lantiq hack\n");
++		return;
++	}
++
++	/* Fake Lantiq CPU ID register */
++	val = (u32 *)res->lantiq_hack_virt;
++	val[QCOM_PCIE_2_4_0_CPU_ID_REG_OFFSET] = QCOM_PCIE_2_4_0_CPU_ID_REG_VAL;
++
++	/* Increment index based on used iATU */
++	resource_list_for_each_entry(entry, &pp->bridge->dma_ranges)
++		if (resource_type(entry->res) == IORESOURCE_MEM)
++			index++;
++
++	/* Check if there is space for an additional iATU */
++	if (index >= pci->num_ib_windows) {
++		dev_err(dev, "No inbound iATU window available for magic\n");
++		return;
++	}
++
++	addr = QCOM_PCIE_2_4_0_CPU_ID_BASE_REG;
++	phys = res->lantiq_hack_phys;
++
++	/* Make it visible to PCIe devices using address translation unit */
++	ret = dw_pcie_prog_inbound_atu(pci, index, PCIE_ATU_TYPE_MEM,
++				       phys, addr, SZ_4K);
++	if (ret) {
++		dev_err(dev, "timeout waiting for IATU for lantiq hack: %d\n", ret);
++		return;
++	}
++
++	/* Set vendor/device ID of GRX500 PCIe host */
++	dw_pcie_dbi_ro_wr_en(pci);
++	dw_pcie_writew_dbi(pci, PCI_VENDOR_ID, QCOM_PCIE_2_4_0_GRX500_VENDOR_ID);
++	dw_pcie_writew_dbi(pci, PCI_DEVICE_ID, QCOM_PCIE_2_4_0_GRX500_DEVICE_ID);
++	dw_pcie_dbi_ro_wr_dis(pci);
++}
++
+ static int qcom_pcie_get_resources_2_4_0(struct qcom_pcie *pcie)
+ {
+ 	struct qcom_pcie_resources_2_4_0 *res = &pcie->res.v2_4_0;
+ 	struct dw_pcie *pci = pcie->pci;
+ 	struct device *dev = pci->dev;
+-	bool is_ipq = of_device_is_compatible(dev->of_node, "qcom,pcie-ipq4019");
++	bool is_ipq = of_device_is_compatible(dev->of_node, "qcom,pcie-ipq4019") || 
++		      of_device_is_compatible(dev->of_node, "qcom,pcie-ipq4019-lantiq-hack");
+ 	int ret;
+ 
+ 	res->clks[0].id = "aux";
+@@ -679,6 +745,17 @@ static void qcom_pcie_deinit_2_4_0(struc
+ 	clk_bulk_disable_unprepare(res->num_clks, res->clks);
+ }
+ 
++static void qcom_pcie_deinit_2_4_0_lantiq_hack(struct qcom_pcie *pcie)
++{
++	struct qcom_pcie_resources_2_4_0 *res = &pcie->res.v2_4_0;
++	struct dw_pcie *pci = pcie->pci;
++	struct device *dev = pci->dev;
++
++	dma_free_coherent(dev, SZ_4K, res->lantiq_hack_virt, res->lantiq_hack_phys);
++
++	qcom_pcie_deinit_2_4_0(pcie);
++}
++
+ static int qcom_pcie_init_2_4_0(struct qcom_pcie *pcie)
+ {
+ 	struct qcom_pcie_resources_2_4_0 *res = &pcie->res.v2_4_0;
+@@ -1292,6 +1369,16 @@ static const struct qcom_pcie_ops ops_2_
+ 	.ltssm_enable = qcom_pcie_2_3_2_ltssm_enable,
+ };
+ 
++/* Qcom IP rev.: 2.4.0	Synopsys IP rev.: 4.20a Lantiq DSL Hack */
++static const struct qcom_pcie_ops ops_2_4_0_lantiq_hack = {
++	.get_resources = qcom_pcie_get_resources_2_4_0,
++	.init = qcom_pcie_init_2_4_0,
++	.post_init = qcom_pcie_post_init_2_3_2,
++	.host_post_init = qcom_pcie_host_post_init_2_3_2_lantiq_hack,
++	.deinit = qcom_pcie_deinit_2_4_0_lantiq_hack,
++	.ltssm_enable = qcom_pcie_2_3_2_ltssm_enable,
++};
++
+ /* Qcom IP rev.: 2.3.3	Synopsys IP rev.: 4.30a */
+ static const struct qcom_pcie_ops ops_2_3_3 = {
+ 	.get_resources = qcom_pcie_get_resources_2_3_3,
+@@ -1354,6 +1441,10 @@ static const struct qcom_pcie_cfg cfg_2_
+ 	.ops = &ops_2_4_0,
+ };
+ 
++static const struct qcom_pcie_cfg cfg_2_4_0_lantiq_hack = {
++	.ops = &ops_2_4_0_lantiq_hack,
++};
++
+ static const struct qcom_pcie_cfg cfg_2_7_0 = {
+ 	.ops = &ops_2_7_0,
+ };
+@@ -1641,6 +1732,7 @@ static const struct of_device_id qcom_pc
+ 	{ .compatible = "qcom,pcie-apq8064", .data = &cfg_2_1_0 },
+ 	{ .compatible = "qcom,pcie-apq8084", .data = &cfg_1_0_0 },
+ 	{ .compatible = "qcom,pcie-ipq4019", .data = &cfg_2_4_0 },
++	{ .compatible = "qcom,pcie-ipq4019-lantiq-hack", .data = &cfg_2_4_0_lantiq_hack },
+ 	{ .compatible = "qcom,pcie-ipq6018", .data = &cfg_2_9_0 },
+ 	{ .compatible = "qcom,pcie-ipq8064", .data = &cfg_2_1_0 },
+ 	{ .compatible = "qcom,pcie-ipq8064-v2", .data = &cfg_2_1_0 },
diff --git a/target/linux/ipq40xx/patches-6.6/910-Revert-firmware-qcom_scm-Clear-download-bit-during-r.patch b/target/linux/ipq40xx/patches-6.6/910-Revert-firmware-qcom_scm-Clear-download-bit-during-r.patch
index 26cd0e0309b316..ab56c24a4d1c30 100644
--- a/target/linux/ipq40xx/patches-6.6/910-Revert-firmware-qcom_scm-Clear-download-bit-during-r.patch
+++ b/target/linux/ipq40xx/patches-6.6/910-Revert-firmware-qcom_scm-Clear-download-bit-during-r.patch
@@ -15,7 +15,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 
 --- a/drivers/firmware/qcom_scm.c
 +++ b/drivers/firmware/qcom_scm.c
-@@ -1528,7 +1528,8 @@ static int qcom_scm_probe(struct platfor
+@@ -1529,7 +1529,8 @@ static int qcom_scm_probe(struct platfor
  static void qcom_scm_shutdown(struct platform_device *pdev)
  {
  	/* Clean shutdown, disable download mode to allow normal restart */
diff --git a/target/linux/ipq40xx/patches-6.6/998-lantiq-atm-hacks.patch b/target/linux/ipq40xx/patches-6.6/998-lantiq-atm-hacks.patch
deleted file mode 100644
index c15a4b3ae3e0b7..00000000000000
--- a/target/linux/ipq40xx/patches-6.6/998-lantiq-atm-hacks.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-From: John Crispin <blogic@openwrt.org>
-Date: Fri, 3 Aug 2012 10:27:25 +0200
-Subject: [PATCH 04/36] MIPS: lantiq: add atm hack
-
-Signed-off-by: John Crispin <blogic@openwrt.org>
---- a/include/uapi/linux/atm.h
-+++ b/include/uapi/linux/atm.h
-@@ -131,8 +131,14 @@
- #define ATM_ABR		4
- #define ATM_ANYCLASS	5		/* compatible with everything */
- 
-+#define ATM_VBR_NRT     ATM_VBR
-+#define ATM_VBR_RT      6
-+#define ATM_UBR_PLUS    7
-+#define ATM_GFR         8
-+
- #define ATM_MAX_PCR	-1		/* maximum available PCR */
- 
-+
- struct atm_trafprm {
- 	unsigned char	traffic_class;	/* traffic class (ATM_UBR, ...) */
- 	int		max_pcr;	/* maximum PCR in cells per second */
-@@ -155,6 +161,9 @@ struct atm_trafprm {
- 	unsigned int adtf      :10;     /* ACR Decrease Time Factor (10-bit) */
- 	unsigned int cdf       :3;      /* Cutoff Decrease Factor (3-bit) */
-         unsigned int spare     :9;      /* spare bits */ 
-+	int		scr;		/* sustained rate in cells per second */
-+	int		mbs;		/* maximum burst size (MBS) in cells */
-+	int		cdv;		/* Cell delay variation */
- };
- 
- struct atm_qos {
---- a/net/atm/proc.c
-+++ b/net/atm/proc.c
-@@ -141,7 +141,7 @@ static void *vcc_seq_next(struct seq_fil
- static void pvc_info(struct seq_file *seq, struct atm_vcc *vcc)
- {
- 	static const char *const class_name[] = {
--		"off", "UBR", "CBR", "VBR", "ABR"};
-+		"off","UBR","CBR","NTR-VBR","ABR","ANY","RT-VBR","UBR+","GFR"};
- 	static const char *const aal_name[] = {
- 		"---",	"1",	"2",	"3/4",	/*  0- 3 */
- 		"???",	"5",	"???",	"???",	/*  4- 7 */
diff --git a/target/linux/ipq40xx/patches-6.6/999-atm-mpoa-intel-dsl-phy-support.patch b/target/linux/ipq40xx/patches-6.6/999-atm-mpoa-intel-dsl-phy-support.patch
index eab26ccb11d5f7..b05e49d974d1ec 100644
--- a/target/linux/ipq40xx/patches-6.6/999-atm-mpoa-intel-dsl-phy-support.patch
+++ b/target/linux/ipq40xx/patches-6.6/999-atm-mpoa-intel-dsl-phy-support.patch
@@ -4,7 +4,7 @@ Subject: [PATCH] UGW_SW-29163: ATM oam support
 
 --- a/drivers/net/ppp/ppp_generic.c
 +++ b/drivers/net/ppp/ppp_generic.c
-@@ -2968,6 +2968,22 @@ char *ppp_dev_name(struct ppp_channel *c
+@@ -2982,6 +2982,22 @@ char *ppp_dev_name(struct ppp_channel *c
  	return name;
  }
  
@@ -27,7 +27,7 @@ Subject: [PATCH] UGW_SW-29163: ATM oam support
  
  /*
   * Disconnect a channel from the generic layer.
-@@ -3614,6 +3630,7 @@ EXPORT_SYMBOL(ppp_unregister_channel);
+@@ -3629,6 +3645,7 @@ EXPORT_SYMBOL(ppp_unregister_channel);
  EXPORT_SYMBOL(ppp_channel_index);
  EXPORT_SYMBOL(ppp_unit_number);
  EXPORT_SYMBOL(ppp_dev_name);
diff --git a/target/linux/ipq806x/base-files/etc/board.d/01_leds b/target/linux/ipq806x/base-files/etc/board.d/01_leds
index c96d5e69c471d6..60988dec6b5d82 100644
--- a/target/linux/ipq806x/base-files/etc/board.d/01_leds
+++ b/target/linux/ipq806x/base-files/etc/board.d/01_leds
@@ -34,8 +34,8 @@ edgecore,ecw5410)
 	ucidef_set_led_wlan "wlan5g" "WLAN5G" "green:wlan5g" "phy0tpt"
 	;;
 extreme,ap3935)
-	ucidef_set_led_netdev "wan" "wan" "orange:lan1" "eth1"
-	ucidef_set_led_netdev "lan" "lan" "orange:lan2" "eth0"
+	ucidef_set_led_netdev "wan" "wan" "orange:lan1" "eth0"
+	ucidef_set_led_netdev "lan" "lan" "orange:lan2" "eth1"
 	;;
 fortinet,fap-421e)
 	ucidef_set_led_netdev "eth1-100" "ETH1-100" "amber:eth1" "eth0" "link_100"
diff --git a/target/linux/ipq806x/base-files/etc/board.d/02_network b/target/linux/ipq806x/base-files/etc/board.d/02_network
index 77d47b8cd0d1cc..93ccc961f38130 100644
--- a/target/linux/ipq806x/base-files/etc/board.d/02_network
+++ b/target/linux/ipq806x/base-files/etc/board.d/02_network
@@ -47,7 +47,8 @@ ipq806x_setup_interfaces()
 		ucidef_set_network_device_conduit "lan1" "eth1"
 		ucidef_set_network_device_conduit "wan" "eth0"
 		;;
-	edgecore,ecw5410)
+	edgecore,ecw5410 |\
+	extreme,ap3935)
 		ucidef_set_interfaces_lan_wan "eth1" "eth0"
 		;;
 	qcom,ipq8064-ap161)
@@ -63,7 +64,6 @@ ipq806x_setup_interfaces()
 	meraki,mr42)
 		ucidef_set_interface_lan "eth0"
 		;;
-	extreme,ap3935 |\
 	meraki,mr52)
 		ucidef_set_interfaces_lan_wan "eth0" "eth1"
 		;;
@@ -81,12 +81,12 @@ ipq806x_setup_macs()
 		linksys,ea7500-v1)
 			hw_mac_addr=$(mtd_get_mac_ascii devinfo hw_mac_addr)
 			ucidef_set_interface_macaddr "lan" "$hw_mac_addr"
-			ucidef_set_interface_macaddr "wan" "$hw_mac_addr"
+			ucidef_set_interface_macaddr "wan" "$(macaddr_add $hw_mac_addr 1)"
 		;;
 		linksys,ea8500)
 			hw_mac_addr=$(mtd_get_mac_ascii devinfo hw_mac_addr)
 			ucidef_set_interface_macaddr "lan" "$hw_mac_addr"
-			ucidef_set_interface_macaddr "wan" "$hw_mac_addr"
+			ucidef_set_interface_macaddr "wan" "$(macaddr_add $hw_mac_addr 1)"
 		;;
 		linksys,e8350-v1 |\
 		zyxel,nbg6817)
@@ -98,7 +98,7 @@ ipq806x_setup_macs()
 			hw_mac_addr=$(mtd_get_mac_ascii hwconfig HW.LAN.MAC.Address)
 			ucidef_set_interface_macaddr "lan" "$hw_mac_addr"
 			hw_mac_addr=$(mtd_get_mac_ascii hwconfig HW.WAN.MAC.Address)
-			ucidef_set_interface_macaddr "wan" "$hw_mac_addr"
+			ucidef_set_interface_macaddr "wan" "$(macaddr_add $hw_mac_addr 1)"
 		;;
 	esac
 }
diff --git a/target/linux/ipq806x/config-6.6 b/target/linux/ipq806x/config-6.6
index 88ec58e2c959bf..7e9558ad75206c 100644
--- a/target/linux/ipq806x/config-6.6
+++ b/target/linux/ipq806x/config-6.6
@@ -57,8 +57,6 @@ CONFIG_BLK_MQ_PCI=y
 CONFIG_BOUNCE=y
 # CONFIG_CACHE_L2X0 is not set
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_QCOM=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CMDLINE_OVERRIDE=y
@@ -155,7 +153,6 @@ CONFIG_FIX_EARLYCON_MEM=y
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_BUG=y
 CONFIG_GENERIC_CLOCKEVENTS=y
@@ -216,6 +213,7 @@ CONFIG_INITRAMFS_SOURCE=""
 CONFIG_IOMMU_SUPPORT=y
 # CONFIG_IPQ_APSS_PLL is not set
 # CONFIG_IPQ_GCC_4019 is not set
+# CONFIG_IPQ_GCC_5018 is not set
 # CONFIG_IPQ_GCC_6018 is not set
 CONFIG_IPQ_GCC_806X=y
 # CONFIG_IPQ_GCC_8074 is not set
diff --git a/target/linux/ipq806x/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq8065-tr4400-v2.dts b/target/linux/ipq806x/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq8065-tr4400-v2.dts
index 8818e95e8d1b3b..5d86d80047f4cd 100644
--- a/target/linux/ipq806x/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq8065-tr4400-v2.dts
+++ b/target/linux/ipq806x/files-6.6/arch/arm/boot/dts/qcom/qcom-ipq8065-tr4400-v2.dts
@@ -204,18 +204,9 @@
 					};
 				};
 			};
-			stock_partition@1340000 {
-				label = "stock_rootfs";
+			partition@1340000 {
+				label = "extra";
 				reg = <0x1340000 0x4000000>;
-
-				compatible = "fixed-partitions";
-				#address-cells = <1>;
-				#size-cells = <1>;
-
-				partition@0 {
-					label = "extra";
-					reg = <0x0 0x4000000>;
-				};
 			};
 			partition@5340000 {
 				label = "0:BOOTCONFIG";
@@ -262,61 +253,36 @@
 				reg = <0x5f00000 0x0500000>;
 				read-only;
 			};
-			stock_partition@6400000 {
-				label = "stock_rootfs_1";
-				reg = <0x6400000 0x4000000>;
-
-				compatible = "fixed-partitions";
-				#address-cells = <1>;
-				#size-cells = <1>;
-
-				partition@0 {
-					label = "fw_env";
-					reg = <0x0 0x100000>;
-
-					nvmem-layout {
-						compatible = "fixed-layout";
-						#address-cells = <1>;
-						#size-cells = <1>;
-
-						macaddr_fw_env_0: macaddr@0 {
-							reg = <0x00 0x6>;
-						};
-						macaddr_fw_env_6: macaddr@6 {
-							reg = <0x06 0x6>;
-						};
-						macaddr_fw_env_c: macaddr@c {
-							reg = <0x0c 0x6>;
-						};
-						macaddr_fw_env_12: macaddr@12 {
-							reg = <0x12 0x6>;
-						};
-						macaddr_fw_env_18: macaddr@18 {
-							reg = <0x18 0x6>;
-						};
-					};
-				};
+			partition@6400000 {
+				label = "fw_env";
+				reg = <0x6400000 0x0100000>;
+				read-only;
 
-				partition@100000 {
-					label = "ubi";
-					reg = <0x100000 0x9b00000>;
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_fw_env_0: macaddr@0 {
+						reg = <0x00 0x6>;
+					};
+					macaddr_fw_env_6: macaddr@6 {
+						reg = <0x06 0x6>;
+					};
+					macaddr_fw_env_c: macaddr@c {
+						reg = <0x0c 0x6>;
+					};
+					macaddr_fw_env_12: macaddr@12 {
+						reg = <0x12 0x6>;
+					};
+					macaddr_fw_env_18: macaddr@18 {
+						reg = <0x18 0x6>;
+					};
 				};
 			};
-			stock_partition@a400000 {
-				label = "stock_fw_env";
-				reg = <0xa400000 0x0100000>;
-			};
-			stock_partition@a500000 {
-				label = "stock_config";
-				reg = <0xa500000 0x0800000>;
-			};
-			stock_partition@ad00000 {
-				label = "stock_PKI";
-				reg = <0xad00000 0x0200000>;
-			};
-			stock_partition@af00000 {
-				label = "stock_scfgmgr";
-				reg = <0xaf00000 0x0100000>;
+			partition@6500000 {
+				label = "ubi";
+				reg = <0x6500000 0x9b00000>;
 			};
 		};
 	};
diff --git a/target/linux/ipq806x/patches-6.6/850-soc-add-qualcomm-syscon.patch b/target/linux/ipq806x/patches-6.6/850-soc-add-qualcomm-syscon.patch
index 8b49af8e84f5a3..2d639bbfd386fd 100644
--- a/target/linux/ipq806x/patches-6.6/850-soc-add-qualcomm-syscon.patch
+++ b/target/linux/ipq806x/patches-6.6/850-soc-add-qualcomm-syscon.patch
@@ -28,7 +28,7 @@ Subject: SoC: add qualcomm syscon
  	depends on ARCH_QCOM || COMPILE_TEST
 --- /dev/null
 +++ b/drivers/soc/qcom/qcom_tcsr.c
-@@ -0,0 +1,62 @@
+@@ -0,0 +1,61 @@
 +/*
 + * Copyright (c) 2014, The Linux foundation. All rights reserved.
 + *
@@ -80,7 +80,6 @@ Subject: SoC: add qualcomm syscon
 +static struct platform_driver tcsr_driver = {
 +	.driver = {
 +		.name		= "tcsr",
-+		.owner		= THIS_MODULE,
 +		.of_match_table	= tcsr_dt_match,
 +	},
 +	.probe = tcsr_probe,
diff --git a/target/linux/ipq806x/patches-6.6/900-arm-add-cmdline-override.patch b/target/linux/ipq806x/patches-6.6/900-arm-add-cmdline-override.patch
index f8bd1674b80ab4..7ea3c82ffd4c8a 100644
--- a/target/linux/ipq806x/patches-6.6/900-arm-add-cmdline-override.patch
+++ b/target/linux/ipq806x/patches-6.6/900-arm-add-cmdline-override.patch
@@ -17,7 +17,7 @@
  	default ""
 --- a/drivers/of/fdt.c
 +++ b/drivers/of/fdt.c
-@@ -1189,6 +1189,17 @@ int __init early_init_dt_scan_chosen(cha
+@@ -1190,6 +1190,17 @@ int __init early_init_dt_scan_chosen(cha
  	if (p != NULL && l > 0)
  		strlcat(cmdline, p, min_t(int, strlen(cmdline) + (int)l, COMMAND_LINE_SIZE));
  
diff --git a/target/linux/ixp4xx/config-6.6 b/target/linux/ixp4xx/config-6.6
index 960012ada45a24..c0211c940b29cd 100644
--- a/target/linux/ixp4xx/config-6.6
+++ b/target/linux/ixp4xx/config-6.6
@@ -32,8 +32,6 @@ CONFIG_BLK_DEV_SD=y
 CONFIG_BLK_MQ_PCI=y
 CONFIG_BUFFER_HEAD=y
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_COMMON_CLK=y
@@ -88,7 +86,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ATOMIC64=y
@@ -171,9 +168,6 @@ CONFIG_NEED_DMA_MAP_STATE=y
 CONFIG_NEED_KUSER_HELPERS=y
 CONFIG_NEED_PER_CPU_KM=y
 CONFIG_NET_DEVLINK=y
-CONFIG_NET_DSA=y
-CONFIG_NET_DSA_MV88E6060=y
-CONFIG_NET_DSA_TAG_TRAILER=y
 CONFIG_NET_EGRESS=y
 CONFIG_NET_INGRESS=y
 CONFIG_NET_PTP_CLASSIFY=y
diff --git a/target/linux/ixp4xx/image/Makefile b/target/linux/ixp4xx/image/Makefile
index ace533e50f0605..c33eddee8aa8fe 100644
--- a/target/linux/ixp4xx/image/Makefile
+++ b/target/linux/ixp4xx/image/Makefile
@@ -128,7 +128,7 @@ define Device/usrobotics_usr8200
 	DEVICE_VENDOR := USRobotics
 	DEVICE_MODEL := USR8200
 	# USB2 is compiled in and needs no package
-	DEVICE_PACKAGES := ixp4xx-microcode-ethernet kmod-rtc-r7301 kmod-firewire kmod-firewire-ohci
+	DEVICE_PACKAGES := ixp4xx-microcode-ethernet kmod-rtc-r7301 kmod-firewire kmod-firewire-ohci kmod-dsa-mv88e6060
 	DEVICE_DTS := intel-ixp42x-usrobotics-usr8200
 	KERNEL := kernel-bin | append-dtb
 	IMAGES := kernel.bin rootfs.bin
diff --git a/target/linux/kirkwood/config-6.6 b/target/linux/kirkwood/config-6.6
index b3320dac1f32b2..751d3e6a1b4608 100644
--- a/target/linux/kirkwood/config-6.6
+++ b/target/linux/kirkwood/config-6.6
@@ -38,8 +38,6 @@ CONFIG_BLK_MQ_PCI=y
 CONFIG_CACHE_FEROCEON_L2=y
 # CONFIG_CACHE_FEROCEON_L2_WRITETHROUGH is not set
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_COMMON_CLK=y
@@ -103,7 +101,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ATOMIC64=y
diff --git a/target/linux/lantiq/Makefile b/target/linux/lantiq/Makefile
index 69fa8276e754c2..e7a251a505cc02 100644
--- a/target/linux/lantiq/Makefile
+++ b/target/linux/lantiq/Makefile
@@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk
 BOARD:=lantiq
 BOARDNAME:=Lantiq
 FEATURES:=squashfs
-SUBTARGETS:=xrx200 xway xway_legacy falcon ase
+SUBTARGETS:=xrx200 xrx200_legacy xway xway_legacy falcon ase
 
 KERNEL_PATCHVER:=6.6
 
diff --git a/target/linux/lantiq/config-6.6 b/target/linux/lantiq/config-6.6
index 1890d82ff8bb92..2bc5b92ce8ffa4 100644
--- a/target/linux/lantiq/config-6.6
+++ b/target/linux/lantiq/config-6.6
@@ -4,8 +4,6 @@ CONFIG_ARCH_KEEP_MEMBLOCK=y
 CONFIG_ARCH_MMAP_RND_BITS_MAX=15
 CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
 CONFIG_ARCH_SUSPEND_POSSIBLE=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
@@ -44,7 +42,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CMOS_UPDATE=y
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/amazonse.dtsi b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/amazonse.dtsi
index 6ae7ab6188b6dc..86831554fe19d7 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/amazonse.dtsi
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/amazonse.dtsi
@@ -229,7 +229,7 @@
 			interrupts = <85>;
 		};
 
-		gsw: etop@e180000 {
+		gsw: ethernet@e180000 {
 			compatible = "lantiq,etop-xway";
 			reg = <0xe180000 0x40000>;
 			interrupt-parent = <&icu0>;
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9.dtsi b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9.dtsi
index 789ca67002aaac..a96783f1f8a26b 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9.dtsi
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9.dtsi
@@ -379,7 +379,7 @@
 			interrupts = <63 61 68>;
 		};
 
-		gsw: etop@e180000 {
+		gsw: ethernet@e180000 {
 			compatible = "lantiq,etop-xway";
 			reg = <0xe180000 0x40000
 				0xe108000 0x200>;
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9_avm_fritz7312.dts b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9_avm_fritz7312.dts
index 9ea6c3929cb7c7..ba6c48704893bd 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9_avm_fritz7312.dts
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9_avm_fritz7312.dts
@@ -136,6 +136,10 @@
 					#address-cells = <1>;
 					#size-cells = <1>;
 
+					cal_ath9k_cal_985: calibration@985 {
+						reg = <0x985 0x3d8>;
+					};
+
 					macaddr_ath9k_cal_a91: macaddr@a91 {
 						compatible = "mac-base";
 						reg = <0xa91 0x6>;
@@ -180,8 +184,9 @@
 	reset-gpios = <&gpio 21 GPIO_ACTIVE_LOW>;
 
 	wifi@0,0 {
-		compatible = "pci0,0";
+		compatible = "pci168c,002d";
 		reg = <0x7000 0 0 0 0>;
-		qca,no-eeprom; /* load from ath9k-eeprom-pci-0000:00:0e.0.bin */
+		nvmem-cells = <&cal_ath9k_cal_985>;
+		nvmem-cell-names = "calibration";
 	};
 };
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9_avm_fritz7320.dts b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9_avm_fritz7320.dts
index 953a8ccbf740ac..c09d3879b4209b 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9_avm_fritz7320.dts
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9_avm_fritz7320.dts
@@ -163,6 +163,10 @@
 					#address-cells = <1>;
 					#size-cells = <1>;
 
+					cal_ath9k_cal_985: calibration@985 {
+						reg = <0x985 0x3d8>;
+					};
+
 					macaddr_ath9k_cal_a91: macaddr@a91 {
 						compatible = "mac-base";
 						reg = <0xa91 0x6>;
@@ -206,9 +210,10 @@
 	reset-gpios = <&gpio 21 GPIO_ACTIVE_LOW>;
 
 	wifi@0,0 {
-		compatible = "pci0,0";
+		compatible = "pci168c,002d";
 		reg = <0x7000 0 0 0 0>;
-		qca,no-eeprom; /* load from ath9k-eeprom-pci-0000:00:0e.0.bin */
+		nvmem-cells = <&cal_ath9k_cal_985>;
+		nvmem-cell-names = "calibration";
 	};
 };
 
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9_zte_h201l.dts b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9_zte_h201l.dts
index a0e3664b6dbcd2..3e8cbcf84bc91c 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9_zte_h201l.dts
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/ar9_zte_h201l.dts
@@ -96,11 +96,6 @@
 			gpio-export,output = <1>;
 			gpios = <&gpio 38 GPIO_ACTIVE_HIGH>;
 		};
-		usb {
-			gpio-export,name = "usb";
-			gpio-export,output = <1>;
-			gpios = <&gpio 28 GPIO_ACTIVE_HIGH>;
-		};
 		wifi {
 			gpio-export,name = "wifi";
 			gpio-export,output = <1>;
@@ -108,6 +103,18 @@
 		};
 	};
 
+	usb_phy: regulator-usb-phy {
+		compatible = "regulator-fixed";
+
+		regulator-name = "USB_PHY";
+
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+
+		gpios = <&gpio 28 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+	};
+
 	usb_vbus: regulator-usb-vbus {
 		compatible = "regulator-fixed";
 
@@ -166,6 +173,7 @@
 
 &usb_phy0 {
 	status = "okay";
+	phy-supply = <&usb_phy>;
 };
 
 
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/danube.dtsi b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/danube.dtsi
index 5fe6699ac2b601..ff67a2e2feec21 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/danube.dtsi
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/danube.dtsi
@@ -294,7 +294,7 @@
 			interrupts = <63 61 159>;
 		};
 
-		gsw: etop@e180000 {
+		gsw: ethernet@e180000 {
 			compatible = "lantiq,etop-xway";
 			reg = <0xe180000 0x40000>;
 			interrupt-parent = <&icu0>;
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz5490.dtsi b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz5490.dtsi
index b38ac9f8b84a7d..2ba8e680b486f5 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz5490.dtsi
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz5490.dtsi
@@ -46,6 +46,61 @@
 	phy9: ethernet-phy@9 {
 		reg = <0x09>;
 	};
+
+	switch@0 {
+		compatible = "qca,qca8334";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		reset-gpios = <&gpio 44 GPIO_ACTIVE_LOW>;
+		reg = <0>;
+
+		dsa,member = <1 0>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				ethernet = <&rgmii0>;
+				phy-mode = "rgmii-txid";
+				tx-internal-delay-ps = <3000>;
+
+				fixed-link {
+					speed = <1000>;
+					full-duplex;
+				};
+			};
+
+			port@2 {
+				reg = <2>;
+				label = "lan3";
+				phy-mode = "internal";
+				phy-handle = <&phy_port2>;
+			};
+
+			port@3 {
+				reg = <3>;
+				label = "lan4";
+				phy-mode = "internal";
+				phy-handle = <&phy_port3>;
+			};
+		};
+
+		mdio {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			phy_port2: phy@1 {
+				reg = <1>;
+			};
+
+			phy_port3: phy@2 {
+				reg = <2>;
+			};
+		};
+	};
 };
 
 &gswip_ports {
@@ -56,6 +111,17 @@
 		phy-handle = <&phy6>;
 	};
 
+	rgmii0: port@1 {
+		reg = <1>;
+		label = "sw0";
+		phy-mode = "rgmii";
+
+		fixed-link {
+			speed = <1000>;
+			full-duplex;
+		};
+	};
+
 	port@2 {
 		reg = <2>;
 		label = "lan2";
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7360-v2.dts b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7360-v2.dts
index cc15324b56e08b..1b4140506291e9 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7360-v2.dts
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7360-v2.dts
@@ -49,7 +49,7 @@
 					#size-cells = <1>;
 
 					cal_urlader_985: cal@985 {
-						reg = <0x985 0x440>;
+						reg = <0x985 0x3d8>;
 					};
 
 					macaddr_urlader_a91: macaddr@a91 {
@@ -94,7 +94,7 @@
 };
 
 &wifi {
-	/delete-property/ qca,no-eeprom;
+	compatible = "pci168c,002e";
 	nvmem-cells = <&cal_urlader_985>;
 	nvmem-cell-names = "calibration";
 };
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7360sl.dts b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7360sl.dts
index cbe6c14c991fdc..9301b049cae9b6 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7360sl.dts
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7360sl.dts
@@ -49,6 +49,10 @@
 					#address-cells = <1>;
 					#size-cells = <1>;
 
+					cal_urlader_985: cal@985 {
+						reg = <0x985 0x3d8>;
+					};
+
 					macaddr_urlader_a91: macaddr@a91 {
 						compatible = "mac-base";
 						reg = <0xa91 0x6>;
@@ -89,3 +93,9 @@
 &phy1 {
 	reset-gpios = <&gpio 44 GPIO_ACTIVE_LOW>;
 };
+
+&wifi {
+	compatible = "pci168c,002e";
+	nvmem-cells = <&cal_urlader_985>;
+	nvmem-cell-names = "calibration";
+};
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7362sl.dts b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7362sl.dts
index 7929bde6cfe68b..e1334fa3064bc9 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7362sl.dts
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7362sl.dts
@@ -127,3 +127,8 @@
 &phy1 {
 	reset-gpios = <&gpio 44 GPIO_ACTIVE_LOW>;
 };
+
+&wifi {
+	compatible = "pci168c,0030";
+	qca,no-eeprom; /* load from ath9k-eeprom-pci-0000:01:00.0.bin */
+};
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz736x.dtsi b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz736x.dtsi
index e7fc9a4f55b7b4..cc0c97da89c01f 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz736x.dtsi
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz736x.dtsi
@@ -155,10 +155,8 @@
 		#address-cells = <2>;
 		device_type = "pci";
 
-		wifi: wifi@168c,002e {
-			compatible = "pci168c,002e";
+		wifi: wifi@0,0 {
 			reg = <0 0 0 0 0>;
-			qca,no-eeprom; /* load from ath9k-eeprom-pci-0000:01:00.0.bin */
 		};
 	};
 };
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7430.dts b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7430.dts
index a0af4dff328eb9..7604248cb7929f 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7430.dts
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_avm_fritz7430.dts
@@ -173,8 +173,8 @@
 		#address-cells = <3>;
 		device_type = "pci";
 
-		wifi@168c,abcd {
-			compatible = "pci168c,abcd";
+		wifi@0,0 {
+			compatible = "pci168c,0030";
 			reg = <0 0 0 0 0>;
 			qca,no-eeprom; /* load from ath9k-eeprom-pci-0000:01:00.0.bin */
 		};
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_tplink_tdw8970.dts b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_tplink_tdw8970.dts
index 1ac6440744306f..4bd70b528ca3bf 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_tplink_tdw8970.dts
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_tplink_tdw8970.dts
@@ -4,3 +4,15 @@
 	compatible = "tplink,tdw8970", "tplink,tdw89x0", "lantiq,xway", "lantiq,vr9";
 	model = "TP-LINK TD-W8970";
 };
+
+&boardconfig {
+	cal_boardconfig_21000: calibration@21000 {
+		reg = <0x21000 0x440>;
+	};
+};
+
+&ath9k {
+	compatible = "pci168c,0030";
+	nvmem-cells = <&macaddr_ath9k_cal_f100 2>, <&cal_boardconfig_21000>;
+	nvmem-cell-names = "mac-address", "calibration";
+};
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_tplink_tdw8980.dts b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_tplink_tdw8980.dts
index 8221e0d5c5200f..a3fd6423364be5 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_tplink_tdw8980.dts
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_tplink_tdw8980.dts
@@ -27,3 +27,15 @@
 
 	reset-gpios = <&gpio 21 GPIO_ACTIVE_LOW>;
 };
+
+&boardconfig {
+	cal_boardconfig_21000: calibration@21000 {
+		reg = <0x21000 0x3d8>;
+	};
+};
+
+&ath9k {
+	compatible = "pci168c,002e";
+	nvmem-cells = <&macaddr_ath9k_cal_f100 2>, <&cal_boardconfig_21000>;
+	nvmem-cell-names = "mac-address", "calibration";
+};
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_tplink_tdw89x0.dtsi b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_tplink_tdw89x0.dtsi
index c3e69f18fa209d..be9c8063b452d8 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_tplink_tdw89x0.dtsi
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_tplink_tdw89x0.dtsi
@@ -200,15 +200,11 @@
 		#address-cells = <3>;
 		device_type = "pci";
 
-		ath9k: wifi@168c,002e {
-			compatible = "pci168c,002e";
+		ath9k: wifi@0,0 {
 			reg = <0 0 0 0 0>;
 			#gpio-cells = <2>;
 			gpio-controller;
-			qca,no-eeprom;
 			ieee80211-freq-limit = <2402000 2482000>;
-			nvmem-cells = <&macaddr_ath9k_cal_f100 2>;
-			nvmem-cell-names = "mac-address";
 		};
 	};
 };
@@ -244,12 +240,12 @@
 				read-only;
 			};
 
-			ath9k_cal: partition@7d0000 {
+			partition@7d0000 {
 				reg = <0x7d0000 0x30000>;
 				label = "boardconfig";
 				read-only;
 
-				nvmem-layout {
+				boardconfig: nvmem-layout {
 					compatible = "fixed-layout";
 					#address-cells = <1>;
 					#size-cells = <1>;
diff --git a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_zyxel_p-2812hnu-f1.dts b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_zyxel_p-2812hnu-f1.dts
index 247b811b4f9427..58a34d6e27c7e2 100644
--- a/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_zyxel_p-2812hnu-f1.dts
+++ b/target/linux/lantiq/files/arch/mips/boot/dts/lantiq/vr9_zyxel_p-2812hnu-f1.dts
@@ -47,11 +47,11 @@
 			};
 			partition@60000 {
 				label = "kernel";
-				reg = <0x60000 0x300000>;
+				reg = <0x60000 0x500000>;
 			};
-			partition@360000 {
+			partition@560000 {
 				label = "ubi";
-				reg = <0x360000 0x7ca0000>;
+				reg = <0x560000 0x7aa0000>;
 			};
 		};
 	};
diff --git a/target/linux/lantiq/image/Makefile b/target/linux/lantiq/image/Makefile
index 9fdb949392a156..307d47a979e55d 100644
--- a/target/linux/lantiq/image/Makefile
+++ b/target/linux/lantiq/image/Makefile
@@ -162,6 +162,12 @@ include danube.mk
 include ar9.mk
 endif
 
+ifeq ($(SUBTARGET),xrx200_legacy)
+DEFAULT_SOC := vr9
+include tp-link_legacy.mk
+include vr9_legacy.mk
+endif
+
 ifeq ($(SUBTARGET),xrx200)
 DEFAULT_SOC := vr9
 include tp-link.mk
diff --git a/target/linux/lantiq/image/tp-link.mk b/target/linux/lantiq/image/tp-link.mk
index 751f61589de8cf..c2f5b95dd6a015 100644
--- a/target/linux/lantiq/image/tp-link.mk
+++ b/target/linux/lantiq/image/tp-link.mk
@@ -17,34 +17,6 @@ define Device/lantiqTpLink
 	check-size | append-metadata
 endef
 
-define Device/tplink_tdw8970
-  $(Device/dsa-migration)
-  $(Device/lantiqTpLink)
-  DEVICE_MODEL := TD-W8970
-  DEVICE_VARIANT := v1
-  TPLINK_FLASHLAYOUT := 8Mltq
-  TPLINK_HWID := 0x89700001
-  TPLINK_HWREV := 1
-  IMAGE_SIZE := 7680k
-  DEVICE_PACKAGES:= kmod-ath9k wpad-basic-mbedtls kmod-usb-dwc2 kmod-usb-ledtrig-usbport
-  SUPPORTED_DEVICES += TDW8970
-endef
-TARGET_DEVICES += tplink_tdw8970
-
-define Device/tplink_tdw8980
-  $(Device/dsa-migration)
-  $(Device/lantiqTpLink)
-  DEVICE_MODEL := TD-W8980
-  DEVICE_VARIANT := v1
-  TPLINK_FLASHLAYOUT := 8Mltq
-  TPLINK_HWID := 0x89800001
-  TPLINK_HWREV := 14
-  IMAGE_SIZE := 7680k
-  DEVICE_PACKAGES:= kmod-ath9k kmod-owl-loader wpad-basic-mbedtls kmod-usb-dwc2 kmod-usb-ledtrig-usbport
-  SUPPORTED_DEVICES += TDW8980
-endef
-TARGET_DEVICES += tplink_tdw8980
-
 define Device/tplink_vr200
   $(Device/dsa-migration)
   $(Device/lantiqTpLink)
diff --git a/target/linux/lantiq/image/tp-link_legacy.mk b/target/linux/lantiq/image/tp-link_legacy.mk
new file mode 100644
index 00000000000000..19a81bd8274a1b
--- /dev/null
+++ b/target/linux/lantiq/image/tp-link_legacy.mk
@@ -0,0 +1,52 @@
+DEVICE_VARS += TPLINK_FLASHLAYOUT TPLINK_HWID TPLINK_HWREV TPLINK_HWREVADD TPLINK_HVERSION
+
+define Device/dsa-migration
+  DEVICE_COMPAT_VERSION := 1.1
+  DEVICE_COMPAT_MESSAGE := Config cannot be migrated from swconfig to DSA
+endef
+
+define Device/lantiqTpLink
+  DEVICE_VENDOR := TP-Link
+  TPLINK_HWREVADD := 0
+  TPLINK_HVERSION := 2
+  KERNEL := kernel-bin | append-dtb | lzma
+  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | \
+	tplink-v2-header -s -V "ver. 1.0"
+  IMAGES := sysupgrade.bin
+  IMAGE/sysupgrade.bin := tplink-v2-image -s -V "ver. 1.0" | \
+	check-size | append-metadata
+endef
+
+define Device/tplink_tdw8970
+  $(Device/dsa-migration)
+  $(Device/lantiqTpLink)
+  DEVICE_MODEL := TD-W8970
+  DEVICE_VARIANT := v1
+  TPLINK_FLASHLAYOUT := 8Mltq
+  TPLINK_HWID := 0x89700001
+  TPLINK_HWREV := 1
+  IMAGE_SIZE := 7680k
+  DEVICE_PACKAGES:= kmod-ath9k wpad-basic-mbedtls kmod-usb-dwc2 kmod-usb-ledtrig-usbport
+  SUPPORTED_DEVICES += TDW8970
+endef
+TARGET_DEVICES += tplink_tdw8970
+
+define Device/tplink_tdw8980
+  $(Device/dsa-migration)
+  $(Device/lantiqTpLink)
+  DEVICE_MODEL := TD-W8980
+  DEVICE_VARIANT := v1
+  DEVICE_ALT0_VENDOR := TP-LINK
+  DEVICE_ALT0_MODEL := TD-W9980
+  DEVICE_ALT0_VARIANT := v1
+  DEVICE_ALT1_VENDOR := TP-LINK
+  DEVICE_ALT1_MODEL := TD-W9980B
+  DEVICE_ALT1_VARIANT := v1
+  TPLINK_FLASHLAYOUT := 8Mltq
+  TPLINK_HWID := 0x89800001
+  TPLINK_HWREV := 14
+  IMAGE_SIZE := 7680k
+  DEVICE_PACKAGES:= kmod-ath9k kmod-owl-loader wpad-basic-mbedtls kmod-usb-dwc2 kmod-usb-ledtrig-usbport
+  SUPPORTED_DEVICES += TDW8980
+endef
+TARGET_DEVICES += tplink_tdw8980
diff --git a/target/linux/lantiq/image/vr9.mk b/target/linux/lantiq/image/vr9.mk
index d4bded9cae7a96..05999e408dea8a 100644
--- a/target/linux/lantiq/image/vr9.mk
+++ b/target/linux/lantiq/image/vr9.mk
@@ -5,17 +5,6 @@ define Device/dsa-migration
   DEVICE_COMPAT_MESSAGE := Config cannot be migrated from swconfig to DSA
 endef
 
-define Device/alphanetworks_asl56026
-  $(Device/dsa-migration)
-  DEVICE_VENDOR := Alpha
-  DEVICE_MODEL := ASL56026
-  DEVICE_ALT0_VENDOR := BT Openreach
-  DEVICE_ALT0_MODEL := ECI VDSL Modem V-2FUb/I
-  IMAGE_SIZE := 7488k
-  DEFAULT := n
-endef
-TARGET_DEVICES += alphanetworks_asl56026
-
 define Device/arcadyan_arv7519rw22
   $(Device/dsa-migration)
   DEVICE_VENDOR := Arcadyan
@@ -33,16 +22,6 @@ define Device/arcadyan_arv7519rw22
 endef
 TARGET_DEVICES += arcadyan_arv7519rw22
 
-define Device/arcadyan_vg3503j
-  $(Device/dsa-migration)
-  DEVICE_VENDOR := BT Openreach
-  DEVICE_MODEL := ECI VDSL Modem V-2FUb/R
-  IMAGE_SIZE := 8000k
-  SUPPORTED_DEVICES += VG3503J
-  DEFAULT := n
-endef
-TARGET_DEVICES += arcadyan_vg3503j
-
 define Device/arcadyan_vgv7510kw22-brn
   $(Device/dsa-migration)
   $(Device/lantiqBrnImage)
@@ -198,7 +177,7 @@ define Device/avm_fritz5490
   DEVICE_VARIANT := Other NAND
   KERNEL_SIZE := 4096k
   IMAGE_SIZE := 49152k
-  DEVICE_PACKAGES := kmod-usb3 fritz-tffs \
+  DEVICE_PACKAGES := kmod-dsa-qca8k kmod-phy-qca83xx kmod-usb3 fritz-tffs \
 	-ltq-vdsl-vr9-vectoring-fw-installer -kmod-ltq-vdsl-vr9-mei \
 	-kmod-ltq-vdsl-vr9 -kmod-ltq-atm-vr9 -kmod-ltq-ptm-vr9 \
 	-ltq-vdsl-vr9-app -kmod-owl-loader \
@@ -216,7 +195,7 @@ define Device/avm_fritz5490-micron
   DEVICE_VARIANT := Micron NAND
   KERNEL_SIZE := 4096k
   IMAGE_SIZE := 49152k
-  DEVICE_PACKAGES := kmod-usb3 fritz-tffs \
+  DEVICE_PACKAGES := kmod-dsa-qca8k kmod-phy-qca83xx kmod-usb3 fritz-tffs \
 	-ltq-vdsl-vr9-vectoring-fw-installer -kmod-ltq-vdsl-vr9-mei \
 	-kmod-ltq-vdsl-vr9 -kmod-ltq-atm-vr9 -kmod-ltq-ptm-vr9 \
 	-ltq-vdsl-vr9-app -kmod-owl-loader \
@@ -313,6 +292,11 @@ define Device/bt_homehub-v5a
   DEVICE_VENDOR := British Telecom (BT)
   DEVICE_MODEL := Home Hub 5
   DEVICE_VARIANT := Type A
+  DEVICE_ALT0_VENDOR := British Telecom (BT)
+  DEVICE_ALT0_MODEL := Business Hub 5
+  DEVICE_ALT0_VARIANT := Type A
+  DEVICE_ALT1_VENDOR := Plusnet
+  DEVICE_ALT1_MODEL := Hub One
   BOARD_NAME := BTHOMEHUBV5A
   DEVICE_PACKAGES := kmod-ath9k kmod-owl-loader \
 	kmod-ath10k-ct ath10k-firmware-qca988x-ct wpad-basic-mbedtls kmod-usb-dwc2
@@ -351,33 +335,18 @@ define Device/lantiq_easy80920-nor
 endef
 TARGET_DEVICES += lantiq_easy80920-nor
 
-define Device/netgear_dm200
-  $(Device/dsa-migration)
-  DEVICE_VENDOR := NETGEAR
-  DEVICE_MODEL := DM200
-  IMAGES := sysupgrade.bin factory.img
-  IMAGE/sysupgrade.bin := append-kernel | \
-	pad-offset 64k 64 | append-uImage-fakehdr filesystem | \
-	pad-offset 64k 64 | append-uImage-fakehdr filesystem | \
-	append-rootfs | pad-rootfs | check-size | append-metadata
-  IMAGE/factory.img := $$(IMAGE/sysupgrade.bin) | netgear-dni
-  IMAGE_SIZE := 7872k
-  NETGEAR_BOARD_ID := DM200
-  NETGEAR_HW_ID := 29765233+8+0+64+0+0
-endef
-TARGET_DEVICES += netgear_dm200
-
 define Device/zyxel_p-2812hnu-f1
-  $(Device/dsa-migration)
   $(Device/NAND)
+  DEVICE_COMPAT_VERSION := 2.0
+  DEVICE_COMPAT_MESSAGE := kernel and ubi partitions had to be resized. \
+  Upgrade manually using initramfs, and change u-boot environment to load 5MiB for uImage.
   DEVICE_VENDOR := Zyxel
   DEVICE_MODEL := P-2812HNU
   DEVICE_VARIANT := F1
   BOARD_NAME := P2812HNUF1
   DEVICE_PACKAGES := kmod-rt2800-pci wpad-basic-mbedtls kmod-usb-dwc2 kmod-usb-ledtrig-usbport
-  KERNEL_SIZE := 3072k
+  KERNEL_SIZE := 5120k
   SUPPORTED_DEVICES += P2812HNUF1
-  DEFAULT := n
 endef
 TARGET_DEVICES += zyxel_p-2812hnu-f1
 
diff --git a/target/linux/lantiq/image/vr9_legacy.mk b/target/linux/lantiq/image/vr9_legacy.mk
new file mode 100644
index 00000000000000..814fb515780312
--- /dev/null
+++ b/target/linux/lantiq/image/vr9_legacy.mk
@@ -0,0 +1,43 @@
+DEVICE_VARS += NETGEAR_BOARD_ID NETGEAR_HW_ID
+
+define Device/dsa-migration
+  DEVICE_COMPAT_VERSION := 1.1
+  DEVICE_COMPAT_MESSAGE := Config cannot be migrated from swconfig to DSA
+endef
+
+define Device/alphanetworks_asl56026
+  $(Device/dsa-migration)
+  DEVICE_VENDOR := Alpha
+  DEVICE_MODEL := ASL56026
+  DEVICE_ALT0_VENDOR := BT Openreach
+  DEVICE_ALT0_MODEL := ECI VDSL Modem V-2FUb/I
+  IMAGE_SIZE := 7488k
+  DEFAULT := n
+endef
+TARGET_DEVICES += alphanetworks_asl56026
+
+define Device/arcadyan_vg3503j
+  $(Device/dsa-migration)
+  DEVICE_VENDOR := BT Openreach
+  DEVICE_MODEL := ECI VDSL Modem V-2FUb/R
+  IMAGE_SIZE := 8000k
+  SUPPORTED_DEVICES += VG3503J
+  DEFAULT := n
+endef
+TARGET_DEVICES += arcadyan_vg3503j
+
+define Device/netgear_dm200
+  $(Device/dsa-migration)
+  DEVICE_VENDOR := NETGEAR
+  DEVICE_MODEL := DM200
+  IMAGES := sysupgrade.bin factory.img
+  IMAGE/sysupgrade.bin := append-kernel | \
+	pad-offset 64k 64 | append-uImage-fakehdr filesystem | \
+	pad-offset 64k 64 | append-uImage-fakehdr filesystem | \
+	append-rootfs | pad-rootfs | check-size | append-metadata
+  IMAGE/factory.img := $$(IMAGE/sysupgrade.bin) | netgear-dni
+  IMAGE_SIZE := 7872k
+  NETGEAR_BOARD_ID := DM200
+  NETGEAR_HW_ID := 29765233+8+0+64+0+0
+endef
+TARGET_DEVICES += netgear_dm200
diff --git a/target/linux/lantiq/patches-6.6/0001-MIPS-lantiq-add-pcie-driver.patch b/target/linux/lantiq/patches-6.6/0001-MIPS-lantiq-add-pcie-driver.patch
index 3dd996bccc8ef2..ab6d2a14868354 100644
--- a/target/linux/lantiq/patches-6.6/0001-MIPS-lantiq-add-pcie-driver.patch
+++ b/target/linux/lantiq/patches-6.6/0001-MIPS-lantiq-add-pcie-driver.patch
@@ -5524,7 +5524,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	  (transaction layer end-to-end CRC checking).
 --- a/include/linux/pci.h
 +++ b/include/linux/pci.h
-@@ -1602,6 +1602,8 @@ void pci_walk_bus_locked(struct pci_bus
+@@ -1610,6 +1610,8 @@ void pci_walk_bus_locked(struct pci_bus
  			 void *userdata);
  int pci_cfg_space_size(struct pci_dev *dev);
  unsigned char pci_bus_max_busnr(struct pci_bus *bus);
diff --git a/target/linux/lantiq/patches-6.6/0008-MIPS-lantiq-backport-old-timer-code.patch b/target/linux/lantiq/patches-6.6/0008-MIPS-lantiq-backport-old-timer-code.patch
index 3e6c2676855e5e..a396efd99078f6 100644
--- a/target/linux/lantiq/patches-6.6/0008-MIPS-lantiq-backport-old-timer-code.patch
+++ b/target/linux/lantiq/patches-6.6/0008-MIPS-lantiq-backport-old-timer-code.patch
@@ -186,7 +186,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  obj-y += vmmc.o
 --- /dev/null
 +++ b/arch/mips/lantiq/xway/timer.c
-@@ -0,0 +1,887 @@
+@@ -0,0 +1,888 @@
 +#ifndef CONFIG_SOC_AMAZON_SE
 +
 +#include <linux/kernel.h>
@@ -989,7 +989,9 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +	ltq_w32(0xfff, LQ_GPTU_IRNCR);
 +
 +	memset(&timer_dev, 0, sizeof(timer_dev));
-+	mutex_init(&timer_dev.gptu_mutex);
++	ret = devm_mutex_init(&pdev->dev, &timer_dev.gptu_mutex);
++	if (ret)
++		return ret;
 +
 +	lq_enable_gptu();
 +	timer_dev.number_of_timers = GPTU_ID_CFG * 2;
@@ -1043,7 +1045,6 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +	.probe = gptu_probe,
 +	.driver = {
 +		.name = "gptu-xway",
-+		.owner = THIS_MODULE,
 +		.of_match_table = gptu_match,
 +	},
 +};
diff --git a/target/linux/lantiq/patches-6.6/0031-I2C-MIPS-lantiq-add-FALC-ON-i2c-bus-master.patch b/target/linux/lantiq/patches-6.6/0031-I2C-MIPS-lantiq-add-FALC-ON-i2c-bus-master.patch
index 1992b536f4c11a..73eb59f1664d21 100644
--- a/target/linux/lantiq/patches-6.6/0031-I2C-MIPS-lantiq-add-FALC-ON-i2c-bus-master.patch
+++ b/target/linux/lantiq/patches-6.6/0031-I2C-MIPS-lantiq-add-FALC-ON-i2c-bus-master.patch
@@ -18,7 +18,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 
 --- a/drivers/i2c/busses/Kconfig
 +++ b/drivers/i2c/busses/Kconfig
-@@ -817,6 +817,16 @@ config I2C_MICROCHIP_CORE
+@@ -819,6 +819,16 @@ config I2C_MICROCHIP_CORE
  	  This driver can also be built as a module. If so, the module will be
  	  called i2c-microchip-core.
  
@@ -47,7 +47,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  obj-$(CONFIG_I2C_MESON)		+= i2c-meson.o
 --- /dev/null
 +++ b/drivers/i2c/busses/i2c-lantiq.c
-@@ -0,0 +1,746 @@
+@@ -0,0 +1,742 @@
 +
 +/*
 + * Lantiq I2C bus adapter
@@ -658,7 +658,9 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +	}
 +
 +	init_completion(&priv->cmd_complete);
-+	mutex_init(&priv->mutex);
++	ret = devm_mutex_init(&pdev->dev, &priv->mutex);
++	if (ret)
++		return ret;
 +
 +	priv->membase = devm_platform_ioremap_resource(pdev, 0);
 +	if (IS_ERR(priv->membase))
@@ -719,7 +721,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +	clk_activate(priv->clk_gate);
 +
 +	/* add our adapter to the i2c stack */
-+	ret = i2c_add_numbered_adapter(adap);
++	ret = devm_i2c_add_adapter(&pdev->dev, adap);
 +	if (ret) {
 +		dev_err(&pdev->dev, "can't register I2C adapter\n");
 +		goto out;
@@ -737,7 +739,6 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +	ret = ltq_i2c_hw_init(adap);
 +	if (ret) {
 +		dev_err(&pdev->dev, "can't configure adapter\n");
-+		i2c_del_adapter(adap);
 +		platform_set_drvdata(pdev, NULL);
 +		goto out;
 +	} else {
@@ -762,10 +763,6 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +	/* power down the core */
 +	clk_deactivate(priv->clk_gate);
 +
-+	/* remove driver */
-+	i2c_del_adapter(&priv->adap);
-+	kfree(priv);
-+
 +	dev_dbg(&pdev->dev, "removed\n");
 +	platform_set_drvdata(pdev, NULL);
 +
@@ -782,7 +779,6 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +	.remove	= ltq_i2c_remove,
 +	.driver	= {
 +		.name	= DRV_NAME,
-+		.owner	= THIS_MODULE,
 +		.of_match_table = ltq_i2c_match,
 +	},
 +};
diff --git a/target/linux/lantiq/patches-6.6/0035-owrt-lantiq-wifi-and-ethernet-eeprom-handling.patch b/target/linux/lantiq/patches-6.6/0035-owrt-lantiq-wifi-and-ethernet-eeprom-handling.patch
index 8bb6e5a0da25b4..3ece97052b4e4a 100644
--- a/target/linux/lantiq/patches-6.6/0035-owrt-lantiq-wifi-and-ethernet-eeprom-handling.patch
+++ b/target/linux/lantiq/patches-6.6/0035-owrt-lantiq-wifi-and-ethernet-eeprom-handling.patch
@@ -36,7 +36,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +obj-$(CONFIG_PCI) += ath5k_eep.o
 --- /dev/null
 +++ b/arch/mips/lantiq/xway/ath5k_eep.c
-@@ -0,0 +1,136 @@
+@@ -0,0 +1,135 @@
 +/*
 + *  Copyright (C) 2011 Luca Olivetti <luca@ventoso.org>
 + *  Copyright (C) 2011 John Crispin <blogic@openwrt.org>
@@ -149,7 +149,6 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +static struct platform_driver ath5k_eeprom_driver = {
 +	.driver		= {
 +		.name		= "ath5k,eeprom",
-+		.owner	= THIS_MODULE,
 +		.of_match_table	= of_match_ptr(ath5k_eeprom_ids),
 +	},
 +};
diff --git a/target/linux/lantiq/patches-6.6/0151-lantiq-ifxmips_pcie-use-of.patch b/target/linux/lantiq/patches-6.6/0151-lantiq-ifxmips_pcie-use-of.patch
index b83bf992a6ef50..65253bc7e440a6 100644
--- a/target/linux/lantiq/patches-6.6/0151-lantiq-ifxmips_pcie-use-of.patch
+++ b/target/linux/lantiq/patches-6.6/0151-lantiq-ifxmips_pcie-use-of.patch
@@ -293,7 +293,7 @@ Signed-off-by: Eddi De Pieri <eddi@depieri.net>
  
              register_pci_controller(&ifx_pcie_controller[pcie_port].pcic);
              /* XXX, clear error status */
-@@ -1083,6 +1185,30 @@ static int __init ifx_pcie_bios_init(voi
+@@ -1083,6 +1185,29 @@ static int __init ifx_pcie_bios_init(voi
  
      return 0;
  }
@@ -308,7 +308,6 @@ Signed-off-by: Eddi De Pieri <eddi@depieri.net>
 +        .probe = ifx_pcie_bios_probe,
 +        .driver = {
 +                .name = "pcie-xrx200",
-+                .owner = THIS_MODULE,
 +                .of_match_table = ifxmips_pcie_match,
 +        },
 +};
diff --git a/target/linux/lantiq/patches-6.6/0152-lantiq-VPE.patch b/target/linux/lantiq/patches-6.6/0152-lantiq-VPE.patch
index e83094f28c18cd..eeb9d9fc23e8d9 100644
--- a/target/linux/lantiq/patches-6.6/0152-lantiq-VPE.patch
+++ b/target/linux/lantiq/patches-6.6/0152-lantiq-VPE.patch
@@ -51,11 +51,10 @@ Signed-off-by: Stefan Koch <stefan.koch10@gmail.com>
  #define read_vpe_c0_status()		mftc0(12, 0)
 --- a/arch/mips/include/asm/vpe.h
 +++ b/arch/mips/include/asm/vpe.h
-@@ -119,4 +119,13 @@ void cleanup_tc(struct tc *tc);
+@@ -127,4 +127,12 @@ int vpe_stop(void *vpe);
+ int vpe_free(void *vpe);
+ #endif /* CONFIG_MIPS_VPE_LOADER_MT */
  
- int __init vpe_module_init(void);
- void __exit vpe_module_exit(void);
-+
 +/* For the explanation of the APIs please refer the section "MT APRP Kernel
 + * Programming" in AR9 SW Architecture Specification
 + */
diff --git a/target/linux/lantiq/patches-6.6/0731-v6.11-dt-bindings-net-dsa-lantiq-gswip-convert-to-YAML-schema.patch b/target/linux/lantiq/patches-6.6/0731-v6.11-dt-bindings-net-dsa-lantiq-gswip-convert-to-YAML-schema.patch
index 40e52f2812bb36..34a730c36fead3 100644
--- a/target/linux/lantiq/patches-6.6/0731-v6.11-dt-bindings-net-dsa-lantiq-gswip-convert-to-YAML-schema.patch
+++ b/target/linux/lantiq/patches-6.6/0731-v6.11-dt-bindings-net-dsa-lantiq-gswip-convert-to-YAML-schema.patch
@@ -382,7 +382,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -};
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -11863,6 +11863,7 @@ LANTIQ / INTEL Ethernet drivers
+@@ -11864,6 +11864,7 @@ LANTIQ / INTEL Ethernet drivers
  M:	Hauke Mehrtens <hauke@hauke-m.de>
  L:	netdev@vger.kernel.org
  S:	Maintained
diff --git a/target/linux/lantiq/xrx200/base-files/etc/board.d/01_leds b/target/linux/lantiq/xrx200/base-files/etc/board.d/01_leds
index dfc647a43e4b67..815f312dac069e 100644
--- a/target/linux/lantiq/xrx200/base-files/etc/board.d/01_leds
+++ b/target/linux/lantiq/xrx200/base-files/etc/board.d/01_leds
@@ -64,9 +64,6 @@ buffalo,wbmr-300hpd)
 	ucidef_set_led_switch "lan3" "LAN3" "green:lan3" "switch0" "0x20"
 	ucidef_set_led_default "router" "router" "green:router" "1"
 	;;
-netgear,dm200)
-	ucidef_set_led_netdev "lan" "lan" "green:lan" "eth0"
-	;;
 esac
 
 board_config_flush
diff --git a/target/linux/lantiq/xrx200/base-files/etc/board.d/02_network b/target/linux/lantiq/xrx200/base-files/etc/board.d/02_network
index 27a3c75edc44c7..bf907578970cdb 100644
--- a/target/linux/lantiq/xrx200/base-files/etc/board.d/02_network
+++ b/target/linux/lantiq/xrx200/base-files/etc/board.d/02_network
@@ -11,22 +11,16 @@ lantiq_setup_interfaces()
 	local board="$1"
 
 	case "$board" in
-	alphanetworks,asl56026|\
-	arcadyan,vg3503j)
-		ucidef_set_interface_lan "lan1 lan2"
-		;;
 	arcadyan,arv7519rw22)
 		ucidef_set_interface_lan "lan1 lan2 lan3 lan4 lan5"
 		;;
-	avm,fritz5490|\
-	avm,fritz5490-micron)
-		ucidef_set_interfaces_lan_wan "lan1 lan2" "wan"
-		;;
 	arcadyan,vgv7510kw22-brn|\
 	arcadyan,vgv7510kw22-nor|\
 	arcadyan,vgv7519-brn|\
 	arcadyan,vgv7519-nor|\
 	arcadyan,vrv9510kwac23|\
+	avm,fritz5490|\
+	avm,fritz5490-micron|\
 	bt,homehub-v5a|\
 	lantiq,easy80920-nand|\
 	lantiq,easy80920-nor|\
@@ -46,14 +40,11 @@ lantiq_setup_interfaces()
 	avm,fritz7490|\
 	avm,fritz7490-micron|\
 	buffalo,wbmr-300hpd|\
-	tplink,tdw8970|\
-	tplink,tdw8980|\
 	tplink,vr200|\
 	tplink,vr200v)
 		ucidef_set_interface_lan "lan1 lan2 lan3 lan4"
 		;;
-	avm,fritz7412|\
-	netgear,dm200)
+	avm,fritz7412)
 		ucidef_set_interface_lan "lan"
 		;;
 	*)
@@ -95,14 +86,9 @@ lantiq_setup_macs()
 	local wan_mac=""
 
 	case "$board" in
-	alphanetworks,asl56026)
-		lan_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
-		wan_mac=$(mtd_get_mac_ascii u-boot-env wanmac)
-		;;
 	arcadyan,arv7519rw22)
 		wan_mac=$(macaddr_add "$(mtd_get_mac_binary boardconfig 0x16)" 1)
 		;;
-	arcadyan,vg3503j|\
 	lantiq,easy80920-nand|\
 	lantiq,easy80920-nor|\
 	zyxel,p-2812hnu-f1|\
@@ -139,6 +125,7 @@ lantiq_setup_macs()
 		tffsdev=$(find_mtd_chardev "nand-tffs")
 		lan_mac=$(/usr/bin/fritz_tffs_nand -d $tffsdev -n maca -o)
 		wan_mac=$(/usr/bin/fritz_tffs_nand -d $tffsdev -n macdsl -o)
+		label_mac=$lan_mac
 		;;
 	bt,homehub-v5a)
 		lan_mac=$(mtd_get_mac_binary_ubi caldata 0x110c)
@@ -148,14 +135,6 @@ lantiq_setup_macs()
 		lan_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
 		wan_mac="$lan_mac"
 		;;
-	netgear,dm200)
-		lan_mac=$(mtd_get_mac_binary ART 0x0)
-		wan_mac=$(macaddr_add "$lan_mac" 1)
-		;;
-	tplink,tdw8970|\
-	tplink,tdw8980)
-		wan_mac=$(macaddr_add "$(mtd_get_mac_binary boardconfig 0xf100)" 1)
-		;;
 	tplink,vr200|\
 	tplink,vr200v)
 		wan_mac=$(macaddr_add "$(mtd_get_mac_binary romfile 0xf100)" 1)
@@ -164,6 +143,7 @@ lantiq_setup_macs()
 
 	[ -n "$lan_mac" ] && ucidef_set_interface_macaddr "lan" "$lan_mac"
 	[ -n "$wan_mac" ] && ucidef_set_interface_macaddr "wan" "$wan_mac"
+	[ -n "$label_mac" ] && ucidef_set_label_macaddr "$label_mac"
 }
 
 board_config_update
diff --git a/target/linux/lantiq/xrx200/base-files/etc/board.d/05_compat-version b/target/linux/lantiq/xrx200/base-files/etc/board.d/05_compat-version
index 45bef9385bdd6d..5690d848744e17 100644
--- a/target/linux/lantiq/xrx200/base-files/etc/board.d/05_compat-version
+++ b/target/linux/lantiq/xrx200/base-files/etc/board.d/05_compat-version
@@ -8,6 +8,10 @@
 board_config_update
 
 case "$(board_name)" in
+	zyxel,p-2812hnu-f1)
+		ucidef_set_compat_version "2.0"
+		;;
+
 	*)
 		ucidef_set_compat_version "1.1"
 		;;
diff --git a/target/linux/lantiq/xrx200/base-files/etc/hotplug.d/firmware/12-ath9k-eeprom b/target/linux/lantiq/xrx200/base-files/etc/hotplug.d/firmware/12-ath9k-eeprom
index eefc39b30b463e..cb3fef91687534 100644
--- a/target/linux/lantiq/xrx200/base-files/etc/hotplug.d/firmware/12-ath9k-eeprom
+++ b/target/linux/lantiq/xrx200/base-files/etc/hotplug.d/firmware/12-ath9k-eeprom
@@ -19,22 +19,18 @@ case "$FIRMWARE" in
 			avm,fritz3390)
 				caldata_extract_reverse "urlader" 0x2546 0x440
 				;;
-			avm,fritz7360sl)
-				caldata_extract "urlader" 0x985 0x1000
-				;;
-			avm,fritz7412|\
-			avm,fritz7430)
+			avm,fritz7412)
 				/usr/bin/fritz_cal_extract -i 1 -s 0x1e000 -e 0x207 -l 5120 -o /lib/firmware/$FIRMWARE $(find_mtd_chardev "urlader") || \
 				/usr/bin/fritz_cal_extract -i 1 -s 0x1e800 -e 0x207 -l 5120 -o /lib/firmware/$FIRMWARE $(find_mtd_chardev "urlader")
 				;;
+			avm,fritz7430)
+				/usr/bin/fritz_cal_extract -r -i 4 -s 0x1e000 -e 0x207 -l 5120 -o /lib/firmware/$FIRMWARE $(find_mtd_chardev "urlader") || \
+				/usr/bin/fritz_cal_extract -r -i 4 -s 0x1e800 -e 0x207 -l 5120 -o /lib/firmware/$FIRMWARE $(find_mtd_chardev "urlader")
+				;;
 			bt,homehub-v5a)
 				caldata_extract_ubi "caldata" 0x1000 0x1000
 				ath9k_patch_mac_crc $(macaddr_add $(mtd_get_mac_binary_ubi caldata 0x110c) 2) 0x10c
 				;;
-			tplink,tdw8970|\
-			tplink,tdw8980)
-				caldata_extract "boardconfig" 0x21000 0x1000
-				;;
 			*)
 				caldata_die "board $board is not supported yet"
 				;;
diff --git a/target/linux/lantiq/xrx200/base-files/etc/uci-defaults/01_led_migration b/target/linux/lantiq/xrx200/base-files/etc/uci-defaults/01_led_migration
deleted file mode 100644
index 94f9df78bd559c..00000000000000
--- a/target/linux/lantiq/xrx200/base-files/etc/uci-defaults/01_led_migration
+++ /dev/null
@@ -1,34 +0,0 @@
-#
-# Copyright (C) 2013 OpenWrt.org
-#
-
-. /lib/functions/migrations.sh
-
-do_internet_led_rename()
-{
-	config_load system
-
-	[ -n $(config_get led_internet name) ] || return
-	[ -z $(config_get led_dsl name) ] || return
-
-	uci rename system.led_internet=led_dsl
-	uci set system.led_dsl.name=dsl
-
-	logger -t led-migration "internet led renamed to dsl"
-}
-
-case "$(board_name)" in
-alphanetworks,asl56026|\
-arcadyan,arv7519rw22|\
-arcadyan,vg3503j|\
-avm,fritz7360sl|\
-bt,homehub-v5a)
-	do_internet_led_rename
-	;;
-esac
-
-remove_devicename_leds
-
-migrations_apply system
-
-exit 0
diff --git a/target/linux/lantiq/xrx200_legacy/base-files/etc/board.d/01_leds b/target/linux/lantiq/xrx200_legacy/base-files/etc/board.d/01_leds
new file mode 100644
index 00000000000000..dec22b51b55572
--- /dev/null
+++ b/target/linux/lantiq/xrx200_legacy/base-files/etc/board.d/01_leds
@@ -0,0 +1,34 @@
+#
+# Copyright (C) 2011-2015 OpenWrt.org
+#
+
+. /lib/functions/leds.sh
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+led_wifi="$(get_dt_led wifi)"
+[ -n "$led_wifi" ] && ucidef_set_led_wlan "wifi" "wifi" "$led_wifi" "phy0tpt"
+
+led_dsl="$(get_dt_led dsl)"
+[ -n "$led_dsl" ] && {
+	led_internet="$(get_dt_led internet)"
+	if [ -n "$led_internet" ]; then
+		ucidef_set_led_default "dsl" "dsl" "$led_dsl" "0"
+		ucidef_set_led_netdev "internet" "internet" "$led_internet" "pppoe-wan"
+	else
+		ucidef_set_led_netdev "dsl" "dsl" "$led_dsl" "dsl0"
+	fi
+}
+
+board=$(board_name)
+
+case "$board" in
+netgear,dm200)
+	ucidef_set_led_netdev "lan" "lan" "green:lan" "eth0"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/lantiq/xrx200_legacy/base-files/etc/board.d/02_network b/target/linux/lantiq/xrx200_legacy/base-files/etc/board.d/02_network
new file mode 100644
index 00000000000000..9088de86b10cbf
--- /dev/null
+++ b/target/linux/lantiq/xrx200_legacy/base-files/etc/board.d/02_network
@@ -0,0 +1,75 @@
+#
+# Copyright (C) 2011-2015 OpenWrt.org
+#
+
+. /lib/functions/uci-defaults.sh
+. /lib/functions/system.sh
+. /lib/functions/lantiq.sh
+
+lantiq_setup_interfaces()
+{
+	local board="$1"
+
+	case "$board" in
+	alphanetworks,asl56026|\
+	arcadyan,vg3503j)
+		ucidef_set_interface_lan "lan1 lan2"
+		;;
+	tplink,tdw8970|\
+	tplink,tdw8980)
+		ucidef_set_interface_lan "lan1 lan2 lan3 lan4"
+		;;
+	netgear,dm200)
+		ucidef_set_interface_lan "lan"
+		;;
+	*)
+		ucidef_set_interface_lan 'eth0'
+		;;
+	esac
+}
+
+lantiq_setup_dsl()
+{
+	local board="$1"
+	local annex="a"
+
+	lantiq_setup_dsl_helper "$annex"
+}
+
+lantiq_setup_macs()
+{
+	local board="$1"
+	local lan_mac=""
+	local wan_mac=""
+
+	case "$board" in
+	alphanetworks,asl56026)
+		lan_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
+		wan_mac=$(mtd_get_mac_ascii u-boot-env wanmac)
+		;;
+	arcadyan,vg3503j)
+		lan_mac=$(mtd_get_mac_ascii u-boot-env ethaddr)
+		wan_mac=$(macaddr_add "$lan_mac" 1)
+		;;
+	netgear,dm200)
+		lan_mac=$(mtd_get_mac_binary ART 0x0)
+		wan_mac=$(macaddr_add "$lan_mac" 1)
+		;;
+	tplink,tdw8970|\
+	tplink,tdw8980)
+		wan_mac=$(macaddr_add "$(mtd_get_mac_binary boardconfig 0xf100)" 1)
+		;;
+	esac
+
+	[ -n "$lan_mac" ] && ucidef_set_interface_macaddr "lan" "$lan_mac"
+	[ -n "$wan_mac" ] && ucidef_set_interface_macaddr "wan" "$wan_mac"
+}
+
+board_config_update
+board=$(board_name)
+lantiq_setup_interfaces $board
+lantiq_setup_dsl $board
+lantiq_setup_macs $board
+board_config_flush
+
+exit 0
diff --git a/target/linux/lantiq/xrx200_legacy/base-files/etc/board.d/05_compat-version b/target/linux/lantiq/xrx200_legacy/base-files/etc/board.d/05_compat-version
new file mode 100644
index 00000000000000..45bef9385bdd6d
--- /dev/null
+++ b/target/linux/lantiq/xrx200_legacy/base-files/etc/board.d/05_compat-version
@@ -0,0 +1,18 @@
+#
+# Copyright (C) 2020 OpenWrt.org
+#
+
+. /lib/functions.sh
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+	*)
+		ucidef_set_compat_version "1.1"
+		;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/lantiq/xrx200_legacy/base-files/lib/upgrade/platform.sh b/target/linux/lantiq/xrx200_legacy/base-files/lib/upgrade/platform.sh
new file mode 100755
index 00000000000000..9a613c43b1a2a3
--- /dev/null
+++ b/target/linux/lantiq/xrx200_legacy/base-files/lib/upgrade/platform.sh
@@ -0,0 +1,16 @@
+PART_NAME=firmware
+REQUIRE_IMAGE_METADATA=1
+
+platform_check_image() {
+	return 0
+}
+
+platform_do_upgrade() {
+	local board=$(board_name)
+
+	case "$board" in
+	*)
+		default_do_upgrade "$1"
+		;;
+	esac
+}
diff --git a/target/linux/lantiq/xrx200_legacy/config-6.6 b/target/linux/lantiq/xrx200_legacy/config-6.6
new file mode 100644
index 00000000000000..9bb65cff07de51
--- /dev/null
+++ b/target/linux/lantiq/xrx200_legacy/config-6.6
@@ -0,0 +1,83 @@
+CONFIG_BLK_MQ_PCI=y
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
+CONFIG_CPU_MIPSR2_IRQ_EI=y
+CONFIG_CPU_MIPSR2_IRQ_VI=y
+CONFIG_CPU_RMAP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_EXTRA_FIRMWARE="lantiq/xrx200_phy11g_a14.bin lantiq/xrx200_phy11g_a22.bin lantiq/xrx200_phy22f_a14.bin lantiq/xrx200_phy22f_a22.bin"
+CONFIG_EXTRA_FIRMWARE_DIR="firmware"
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GRO_CELLS=y
+CONFIG_HWMON=y
+CONFIG_HW_RANDOM=y
+CONFIG_IFX_VPE_EXT=y
+CONFIG_INPUT=y
+CONFIG_INPUT_EVDEV=y
+CONFIG_INTEL_XWAY_PHY=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+# CONFIG_ISDN is not set
+CONFIG_LANTIQ_XRX200=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MIPS_MT=y
+# CONFIG_MIPS_MT_FPAFF is not set
+CONFIG_MIPS_MT_SMP=y
+CONFIG_MIPS_NR_CPU_NR_MAP=2
+CONFIG_MIPS_PERF_SHARED_TC_COUNTERS=y
+CONFIG_MIPS_VPE_APSP_API=y
+CONFIG_MIPS_VPE_APSP_API_MT=y
+CONFIG_MIPS_VPE_LOADER=y
+CONFIG_MIPS_VPE_LOADER_MT=y
+CONFIG_MIPS_VPE_LOADER_TOM=y
+CONFIG_NEED_SRCU_NMI_SAFE=y
+CONFIG_NET_DEVLINK=y
+CONFIG_NET_DSA=y
+CONFIG_NET_DSA_LANTIQ_GSWIP=y
+CONFIG_NET_DSA_TAG_GSWIP=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_SWITCHDEV=y
+CONFIG_NLS=y
+CONFIG_NR_CPUS=2
+CONFIG_PADATA=y
+CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCIE_LANTIQ=y
+CONFIG_PCI_DOMAINS=y
+CONFIG_PCI_LANTIQ=y
+CONFIG_PHYLINK=y
+CONFIG_PHY_LANTIQ_VRX200_PCIE=y
+CONFIG_POWER_RESET_GPIO=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_POWER_SUPPLY_HWMON=y
+CONFIG_QUEUED_RWLOCKS=y
+CONFIG_QUEUED_SPINLOCKS=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+CONFIG_SENSORS_LTQ_CPUTEMP=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SMP=y
+CONFIG_SMP_UP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SYNC_R4K=y
+CONFIG_SYS_SUPPORTS_SCHED_SMT=y
+CONFIG_SYS_SUPPORTS_SMP=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_USB=y
+CONFIG_USB_COMMON=y
+CONFIG_USB_SUPPORT=y
+CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMMON=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/lantiq/xrx200_legacy/profiles/00-default.mk b/target/linux/lantiq/xrx200_legacy/profiles/00-default.mk
new file mode 100644
index 00000000000000..26bc8b502b0fea
--- /dev/null
+++ b/target/linux/lantiq/xrx200_legacy/profiles/00-default.mk
@@ -0,0 +1,9 @@
+define Profile/Default
+	NAME:=Default Profile
+	PRIORITY:=1
+endef
+
+define Profile/Default/Description
+	Default package set compatible with most boards.
+endef
+$(eval $(call Profile,Default))
diff --git a/target/linux/lantiq/xrx200_legacy/target.mk b/target/linux/lantiq/xrx200_legacy/target.mk
new file mode 100644
index 00000000000000..d9a6fff651b4f7
--- /dev/null
+++ b/target/linux/lantiq/xrx200_legacy/target.mk
@@ -0,0 +1,22 @@
+ARCH:=mips
+SUBTARGET:=xrx200_legacy
+BOARDNAME:=XRX200 Legacy
+FEATURES+=atm ramdisk small_flash
+CPU_TYPE:=24kc
+
+DEFAULT_PACKAGES+=kmod-leds-gpio \
+	kmod-gpio-button-hotplug \
+	ltq-vdsl-vr9-vectoring-fw-installer \
+	kmod-ltq-vdsl-vr9-mei \
+	kmod-ltq-vdsl-vr9 \
+	kmod-ltq-atm-vr9 \
+	kmod-ltq-deu-vr9 \
+	kmod-ltq-ptm-vr9 \
+	ltq-vdsl-vr9-app \
+	dsl-vrx200-firmware-xdsl-a \
+	dsl-vrx200-firmware-xdsl-b-patch \
+	ppp-mod-pppoa
+
+define Target/Description
+	Lantiq XRX200 Legacy for boards with small flash
+endef
diff --git a/target/linux/lantiq/xway/base-files/etc/hotplug.d/firmware/12-ath9k-eeprom b/target/linux/lantiq/xway/base-files/etc/hotplug.d/firmware/12-ath9k-eeprom
index 98bb9af6947a29..91eb3f16806ce3 100644
--- a/target/linux/lantiq/xway/base-files/etc/hotplug.d/firmware/12-ath9k-eeprom
+++ b/target/linux/lantiq/xway/base-files/etc/hotplug.d/firmware/12-ath9k-eeprom
@@ -45,9 +45,6 @@ case "$FIRMWARE" in
 				caldata_extract "calibration" 0xf000 0x1000
 				ath9k_patch_mac_crc $(macaddr_add $(mtd_get_mac_ascii u-boot-env ethaddr) 2) 0x20c
 				;;
-			avm,fritz7312|avm,fritz7320)
-				caldata_extract "urlader" 0x985 0x1000
-				;;
 			*)
 				caldata_die "board $board is not supported yet"
 				;;
diff --git a/target/linux/layerscape/armv7/config-6.6 b/target/linux/layerscape/armv7/config-6.6
index ee397fc7c6fb24..be8eca1bf71fa4 100644
--- a/target/linux/layerscape/armv7/config-6.6
+++ b/target/linux/layerscape/armv7/config-6.6
@@ -77,8 +77,6 @@ CONFIG_BROADCOM_PHY=y
 CONFIG_BUFFER_HEAD=y
 CONFIG_CACHE_L2X0=y
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CDROM=y
 CONFIG_CHECKPOINT_RESTORE=y
 CONFIG_CHR_DEV_SG=y
@@ -232,7 +230,6 @@ CONFIG_FW_CACHE=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
 # CONFIG_FW_LOADER_USER_HELPER_FALLBACK is not set
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
diff --git a/target/linux/layerscape/armv8_64b/config-6.6 b/target/linux/layerscape/armv8_64b/config-6.6
index 3c052edb7d010e..55b9d9b934a640 100644
--- a/target/linux/layerscape/armv8_64b/config-6.6
+++ b/target/linux/layerscape/armv8_64b/config-6.6
@@ -110,8 +110,6 @@ CONFIG_CAVIUM_ERRATUM_23154=y
 CONFIG_CAVIUM_ERRATUM_27456=y
 CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CHECKPOINT_RESTORE=y
 CONFIG_CHROME_PLATFORMS=y
 CONFIG_CLK_LS1028A_PLLDIG=y
@@ -330,7 +328,6 @@ CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
 # CONFIG_FW_LOADER_USER_HELPER_FALLBACK is not set
 CONFIG_GARP=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS=y
 CONFIG_GENERIC_ALLOCATOR=y
diff --git a/target/linux/layerscape/patches-6.6/400-LF-20-3-mtd-spi-nor-Use-1-bit-mode-of-spansion-s25fs.patch b/target/linux/layerscape/patches-6.6/400-LF-20-3-mtd-spi-nor-Use-1-bit-mode-of-spansion-s25fs.patch
index b85053eba9ea0e..008a146cc97e8b 100644
--- a/target/linux/layerscape/patches-6.6/400-LF-20-3-mtd-spi-nor-Use-1-bit-mode-of-spansion-s25fs.patch
+++ b/target/linux/layerscape/patches-6.6/400-LF-20-3-mtd-spi-nor-Use-1-bit-mode-of-spansion-s25fs.patch
@@ -15,7 +15,7 @@ Signed-off-by: Kuldeep Singh <kuldeep.singh@nxp.com>
 
 --- a/drivers/mtd/spi-nor/spansion.c
 +++ b/drivers/mtd/spi-nor/spansion.c
-@@ -798,8 +798,8 @@ static const struct flash_info spansion_
+@@ -799,8 +799,8 @@ static const struct flash_info spansion_
  		MFR_FLAGS(USE_CLSR)
  	},
  	{ "s25fs512s",  INFO6(0x010220, 0x4d0081, 256 * 1024, 256)
diff --git a/target/linux/layerscape/patches-6.6/701-staging-add-fsl_ppfe-driver.patch b/target/linux/layerscape/patches-6.6/701-staging-add-fsl_ppfe-driver.patch
index 764d29f10d9e17..59bbb964c5187f 100644
--- a/target/linux/layerscape/patches-6.6/701-staging-add-fsl_ppfe-driver.patch
+++ b/target/linux/layerscape/patches-6.6/701-staging-add-fsl_ppfe-driver.patch
@@ -891,7 +891,7 @@ Signed-off-by: Dong Aisheng <aisheng.dong@nxp.com>
 +};
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -8359,6 +8359,14 @@ F:	drivers/ptp/ptp_qoriq.c
+@@ -8360,6 +8360,14 @@ F:	drivers/ptp/ptp_qoriq.c
  F:	drivers/ptp/ptp_qoriq_debugfs.c
  F:	include/linux/fsl/ptp_qoriq.h
  
diff --git a/target/linux/loongarch64/config-6.6 b/target/linux/loongarch64/config-6.6
index 46a90c1284955f..3badd8e94e2c9c 100644
--- a/target/linux/loongarch64/config-6.6
+++ b/target/linux/loongarch64/config-6.6
@@ -93,8 +93,6 @@ CONFIG_BSD_PROCESS_ACCT_V3=y
 CONFIG_BUFFER_HEAD=y
 CONFIG_BUG_ON_DATA_CORRUPTION=y
 CONFIG_CACHESTAT_SYSCALL=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CDROM=y
 CONFIG_CFS_BANDWIDTH=y
 CONFIG_CGROUPS=y
@@ -285,7 +283,6 @@ CONFIG_FW_CACHE=y
 # CONFIG_FW_DEVLINK_SYNC_STATE_TIMEOUT is not set
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_BUG=y
 CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
@@ -529,7 +526,6 @@ CONFIG_PCI_LOONGSON=y
 CONFIG_PCI_MSI=y
 CONFIG_PCI_MSI_ARCH_FALLBACKS=y
 CONFIG_PCI_REALLOC_ENABLE_AUTO=y
-CONFIG_PCPU_DEV_REFCNT=y
 # CONFIG_PDS_CORE is not set
 CONFIG_PERF_USE_VMALLOC=y
 CONFIG_PGTABLE_3LEVEL=y
diff --git a/target/linux/malta/config-6.6 b/target/linux/malta/config-6.6
index 73db6cea21d3c7..a635e2c39e9815 100644
--- a/target/linux/malta/config-6.6
+++ b/target/linux/malta/config-6.6
@@ -21,8 +21,6 @@ CONFIG_BOARD_SCACHE=y
 CONFIG_BOOT_ELF32=y
 CONFIG_BUFFER_HEAD=y
 CONFIG_BUILTIN_DTB=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
 CONFIG_CLKBLD_I8253=y
 CONFIG_CLKEVT_I8253=y
@@ -84,7 +82,6 @@ CONFIG_FS_MBCACHE=y
 CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_CLOCKEVENTS=y
diff --git a/target/linux/mediatek/base-files/etc/hotplug.d/iface/99-mtk-lro b/target/linux/mediatek/base-files/etc/hotplug.d/iface/99-mtk-lro
deleted file mode 100755
index 9a2ffaeed870eb..00000000000000
--- a/target/linux/mediatek/base-files/etc/hotplug.d/iface/99-mtk-lro
+++ /dev/null
@@ -1,14 +0,0 @@
-[ ifup = "$ACTION" ] && {
-	[ -n "$DEVICE" ] && {
-		if [ "$INTERFACE" == "lan" ]; then
-			if [ -f /usr/sbin/ethtool ]; then
-				ifname=eth0
-				lan_ip=`uci -q get network.lan.ipaddr`
-				ethdrv=`ethtool -i $ifname | grep mtk_soc_eth`
-				[ -n "$ethdrv" ] && {
-					ethtool -N $ifname flow-type tcp4 dst-ip $lan_ip loc 0
-				}
-			fi
-		fi
-	}
-}
diff --git a/target/linux/mediatek/base-files/lib/preinit/05_set_preinit_iface b/target/linux/mediatek/base-files/lib/preinit/05_set_preinit_iface
index 0deab4248136ec..5d8151741d5c69 100644
--- a/target/linux/mediatek/base-files/lib/preinit/05_set_preinit_iface
+++ b/target/linux/mediatek/base-files/lib/preinit/05_set_preinit_iface
@@ -1,8 +1,12 @@
 set_preinit_iface() {
 	case $(board_name) in
 	cudy,m3000-v1|\
+	cudy,tr3000-256mb-v1|\
 	cudy,tr3000-v1|\
-	glinet,gl-mt3000)
+	cudy,tr3000-v1-ubootmod|\
+	glinet,gl-mt3000|\
+	openembed,som7981|\
+	wavlink,wl-wn573hx3)
 		ip link set eth1 up
 		ifname=eth1
 		;;
diff --git a/target/linux/mediatek/base-files/lib/preinit/06_set_rps_sock_flow b/target/linux/mediatek/base-files/lib/preinit/06_set_rps_sock_flow
deleted file mode 100644
index 49b1dd1ca6fb9d..00000000000000
--- a/target/linux/mediatek/base-files/lib/preinit/06_set_rps_sock_flow
+++ /dev/null
@@ -1,6 +0,0 @@
-set_rps_sock_flow() {
-	echo 1024 > /proc/sys/net/core/rps_sock_flow_entries
-}
-
-boot_hook_add preinit_main set_rps_sock_flow
-
diff --git a/target/linux/mediatek/dts/mt7622-netgear-wax206.dts b/target/linux/mediatek/dts/mt7622-netgear-wax206.dts
index 524a49874089fb..4881004ac3b750 100644
--- a/target/linux/mediatek/dts/mt7622-netgear-wax206.dts
+++ b/target/linux/mediatek/dts/mt7622-netgear-wax206.dts
@@ -13,6 +13,7 @@
 
 	aliases {
 		ethernet0 = &gmac0;
+		label-mac-device = &gmac0;
 		led-boot = &led_power_r;
 		led-failsafe = &led_power_r;
 		led-running = &led_power_g;
@@ -84,6 +85,7 @@
 			default-state = "off";
 			gpios = <&pio 85 GPIO_ACTIVE_LOW>;
 			label = "wifin:green";
+			linux,default-trigger = "phy0tpt";
 		};
 
 		wifin_blue {
@@ -96,6 +98,7 @@
 			default-state = "off";
 			gpios = <&pio 2 GPIO_ACTIVE_HIGH>;
 			label = "wifia:green";
+			linux,default-trigger = "phy1tpt";
 		};
 
 		wifia_blue {
diff --git a/target/linux/mediatek/dts/mt7623a-unielec-u7623-02.dtsi b/target/linux/mediatek/dts/mt7623a-unielec-u7623-02.dtsi
index fedf8b859661f8..eaa2e74112e3cf 100644
--- a/target/linux/mediatek/dts/mt7623a-unielec-u7623-02.dtsi
+++ b/target/linux/mediatek/dts/mt7623a-unielec-u7623-02.dtsi
@@ -4,7 +4,7 @@
  */
 
 #include <dt-bindings/input/input.h>
-#include "mt7623.dtsi"
+#include "mt7623a.dtsi"
 #include "mt6323.dtsi"
 
 / {
@@ -102,92 +102,6 @@
 	status = "okay";
 };
 
-&eth {
-	status = "okay";
-
-	gmac0: mac@0 {
-		compatible = "mediatek,eth-mac";
-		reg = <0>;
-		phy-mode = "trgmii";
-
-		fixed-link {
-			speed = <1000>;
-			full-duplex;
-			pause;
-		};
-	};
-
-	mdio: mdio-bus {
-		#address-cells = <1>;
-		#size-cells = <0>;
-
-		mt7530: switch@1f {
-		};
-	};
-};
-
-&mt7530 {
-	compatible = "mediatek,mt7530";
-	reg = <31>;
-	#address-cells = <1>;
-	#size-cells = <0>;
-	pinctrl-names = "default";
-	mediatek,mcm;
-	resets = <&ethsys 2>;
-	reset-names = "mcm";
-	core-supply = <&mt6323_vpa_reg>;
-	io-supply = <&mt6323_vemc3v3_reg>;
-
-	dsa,mii-bus = <&mdio>;
-
-	ports {
-		#address-cells = <1>;
-		#size-cells = <0>;
-		reg = <0>;
-
-		port@0 {
-			reg = <0>;
-			label = "lan0";
-			cpu = <&cpu_port0>;
-		};
-
-		port@1 {
-			reg = <1>;
-			label = "lan1";
-			cpu = <&cpu_port0>;
-		};
-
-		port@2 {
-			reg = <2>;
-			label = "lan2";
-			cpu = <&cpu_port0>;
-		};
-
-		port@3 {
-			reg = <3>;
-			label = "lan3";
-			cpu = <&cpu_port0>;
-		};
-
-		port@4 {
-			reg = <4>;
-			label = "wan";
-			cpu = <&cpu_port0>;
-		};
-
-		cpu_port0: port@6 {
-			reg = <6>;
-			ethernet = <&gmac0>;
-			phy-mode = "trgmii";
-
-			fixed-link {
-				speed = <1000>;
-				full-duplex;
-			};
-		};
-	};
-};
-
 &mmc0 {
 	pinctrl-names = "default", "state_uhs";
 	pinctrl-0 = <&mmc0_pins_default>;
@@ -305,6 +219,35 @@
 	mediatek,long-press-mode = <0>;
 };
 
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan0";
+		};
+
+		port@1 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@3 {
+			status = "okay";
+			label = "lan3";
+		};
+
+		port@4 {
+			status = "okay";
+			label = "wan";
+		};
+	};
+};
+
 &uart2 {
 	pinctrl-names = "default";
 	pinctrl-0 = <&uart2_pins_b>;
diff --git a/target/linux/mediatek/dts/mt7981b-asus-rt-ax52.dts b/target/linux/mediatek/dts/mt7981b-asus-rt-ax52.dts
new file mode 100644
index 00000000000000..7f4926b4936a4c
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-asus-rt-ax52.dts
@@ -0,0 +1,301 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/dts-v1/;
+#include "mt7981.dtsi"
+/ {
+	model = "ASUS RT-AX52";
+	compatible = "asus,rt-ax52", "mediatek,mt7981";
+
+	aliases {
+		serial0 = &uart0;
+		label-mac-device = &gmac0;
+		led-boot = &led_system;
+		led-failsafe = &led_system;
+		led-running = &led_system;
+		led-upgrade = &led_system;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-override = "";
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x10000000>;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		wlan24 {
+			function = LED_FUNCTION_WLAN_2GHZ;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 34 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		wlan5 {
+			function = LED_FUNCTION_WLAN_5GHZ;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 35 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		wan {
+			function = LED_FUNCTION_WAN;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&pio 8 GPIO_ACTIVE_LOW>;
+		};
+
+		led_system: system {
+			label = "blue:system";
+			gpios = <&pio 12 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	timer {
+		clock-frequency = <12996791>;
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		/* LAN */
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		nvmem-cells = <&macaddr_factory_4>;
+		nvmem-cell-names = "mac-address";
+		phy-mode = "2500base-x";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		/* WAN */
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		nvmem-cells = <&macaddr_factory_4>;
+		nvmem-cell-names = "mac-address";
+		phy-mode = "gmii";
+		phy-handle = <&phy0>;
+		label = "wan";
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		phy0: ethernet-phy@0 {
+			compatible = "ethernet-phy-id03a2.9461";
+			reg = <0>;
+			phy-mode = "gmii";
+			#nvmem-cells = <&phy_calibration>;
+			#nvmem-cell-names = "phy-cal-data";
+		};
+
+		switch@1f {
+			compatible = "mediatek,mt7531";
+			reg = <31>;
+			reset-gpios = <&pio 39 0>;
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					label = "lan3";
+				};
+
+				port@1 {
+					reg = <1>;
+					label = "lan2";
+				};
+
+				port@2 {
+					reg = <2>;
+					label = "lan1";
+				};
+
+				port@6 {
+					reg = <6>;
+					label = "cpu";
+					ethernet = <&gmac0>;
+					phy-mode = "2500base-x";
+
+					fixed-link {
+						speed = <2500>;
+						full-duplex;
+						pause;
+					};
+				};
+			};
+		};
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand_flash: flash@0 {
+		compatible = "u-boot-dont-touch-spi-nand";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+
+		/*
+		 * ASUS bootloader tries to replace the partitions defined in
+		 * Device Tree and by that also deletes all additional properties
+		 * needed for UBI and NVMEM-on-UBI.
+		 * Prevent this from happening by tricking the loader to delete and
+		 * replace a bait node instead (works with older bootloaders).
+		 */
+		partitions: dummy {
+			compatible = "u-boot-dummy-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				reg = <0x0 0x0>;
+				label = "remove_me";
+			};
+		};
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				reg = <0x0 0x400000>;
+				label = "bootloader";
+				read-only;
+			};
+
+			partition@400000 {
+				compatible = "linux,ubi";
+				reg = <0x400000 0xfc00000>;
+				label = "UBI_DEV";
+
+				volumes {
+					ubi_factory: ubi-volume-factory {
+						volname = "Factory";
+					};
+				};
+			};
+		};
+	};
+};
+
+&ubi_factory {
+	nvmem-layout {
+		compatible = "fixed-layout";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		eeprom_factory_0: eeprom@0 {
+			reg = <0x0 0x1000>;
+		};
+
+		macaddr_factory_4: macaddr@4 {
+			reg = <0x4 0x6>;
+		};
+	};
+};
+
+&spi1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spic_pins>;
+	status = "disabled";
+};
+
+&pio {
+	i2c_pins: i2c-pins-g0 {
+		mux {
+			function = "i2c";
+			groups = "i2c0_0";
+		};
+	};
+
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+
+	spic_pins: spi1-pins {
+		mux {
+			function = "spi";
+			groups = "spi1_1";
+		};
+	};
+
+	uart1_pins: uart1-pins-g1 {
+		mux {
+			function = "uart";
+			groups = "uart1_1";
+		};
+	};
+
+	uart2_pins: uart2-pins-g1 {
+		mux {
+			function = "uart";
+			groups = "uart2_1";
+		};
+	};
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+
+	status = "okay";
+};
diff --git a/target/linux/mediatek/dts/mt7981b-cmcc-a10-stock.dts b/target/linux/mediatek/dts/mt7981b-cmcc-a10-stock.dts
new file mode 100644
index 00000000000000..96627f8bfb26d1
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-cmcc-a10-stock.dts
@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include "mt7981b-cmcc-a10.dtsi"
+
+/ {
+	model = "CMCC A10 (stock layout)";
+	compatible = "cmcc,a10-stock", "mediatek,mt7981";
+};
+
+&partitions {
+	partition@580000 {
+		label = "ubi";
+		reg = <0x580000 0x4000000>;
+	};
+
+	partition@4580000 {
+		label = "firmware_backup";
+		reg = <0x4580000 0x2000000>;
+		read-only;
+	};
+
+	partition@6580000 {
+		label = "zrsave";
+		reg = <0x6580000 0x100000>;
+		read-only;
+	};
+
+	partition@6680000 {
+		label = "config2";
+		reg = <0x6680000 0x100000>;
+		read-only;
+	};
+};
+
+&spi_nand {
+	mediatek,nmbm;
+	mediatek,bmt-max-ratio = <1>;
+	mediatek,bmt-max-reserved-blocks = <64>;
+};
diff --git a/target/linux/mediatek/dts/mt7981b-cmcc-a10-ubootmod.dts b/target/linux/mediatek/dts/mt7981b-cmcc-a10-ubootmod.dts
new file mode 100644
index 00000000000000..f8a1c7f665e84a
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-cmcc-a10-ubootmod.dts
@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include "mt7981b-cmcc-a10.dtsi"
+
+/ {
+	model = "CMCC A10 (OpenWrt U-Boot layout)";
+	compatible = "cmcc,a10-ubootmod", "mediatek,mt7981";
+};
+
+&chosen {
+	bootargs = "root=/dev/fit0 rootwait";
+	rootdisk = <&ubi_rootdisk>;
+};
+
+&partitions {
+	partition@580000 {
+		compatible = "linux,ubi";
+		label = "ubi";
+		reg = <0x580000 0x7a80000>;
+
+		volumes {
+			ubi_rootdisk: ubi-volume-fit {
+				volname = "fit";
+			};
+		};
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7981b-cmcc-a10.dtsi b/target/linux/mediatek/dts/mt7981b-cmcc-a10.dtsi
new file mode 100644
index 00000000000000..fe132aa66a1d62
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-cmcc-a10.dtsi
@@ -0,0 +1,254 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/*
+ * Copyright (C) 2023 Tianling Shen <cnsztl@immortalwrt.org>
+ */
+
+/dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+#include "mt7981.dtsi"
+
+/ {
+	aliases {
+		led-boot = &boot_led;
+		led-failsafe = &boot_led;
+		led-running = &running_led;
+		led-upgrade = &running_led;
+		serial0 = &uart0;
+	};
+
+	chosen: chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	memory@40000000 {
+		reg = <0 0x40000000 0 0x10000000>;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		button-wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			function = LED_FUNCTION_STATUS;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		running_led: led-1 {
+			function = LED_FUNCTION_STATUS;
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+
+		boot_led: led-2 {
+			function = LED_FUNCTION_STATUS;
+			color = <LED_COLOR_ID_RED>;
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cells = <&macaddr_factory_2a 0>;
+		nvmem-cell-names = "mac-address";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+};
+
+&mdio_bus {
+	switch: switch@1f {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>; /* bias-disable */
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>; /* bias-disable */
+		};
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand: flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+
+		partitions: partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x0 0x100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x100000 0x80000>;
+			};
+
+			partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x200000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+
+					macaddr_factory_a: macaddr@a {
+						compatible = "mac-base";
+						reg = <0xa 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+
+					macaddr_factory_24: macaddr@24 {
+						compatible = "mac-base";
+						reg = <0x24 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+
+					macaddr_factory_2a: macaddr@2a {
+						compatible = "mac-base";
+						reg = <0x2a 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x380000 0x200000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan2";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan3";
+		};
+
+		port@4 {
+			reg = <4>;
+			label = "wan";
+
+			nvmem-cells = <&macaddr_factory_24 0>;
+			nvmem-cell-names = "mac-address";
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+	status = "okay";
+
+	band@1 {
+		reg = <1>;
+		nvmem-cells = <&macaddr_factory_a 0>;
+		nvmem-cell-names = "mac-address";
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7981b-cudy-ap3000-v1.dts b/target/linux/mediatek/dts/mt7981b-cudy-ap3000-v1.dts
new file mode 100644
index 00000000000000..7101c4bab0a9b8
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-cudy-ap3000-v1.dts
@@ -0,0 +1,218 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+/dts-v1/;
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "Cudy AP3000 v1";
+	compatible = "cudy,ap3000-v1", "mediatek,mt7981";
+
+	aliases {
+		label-mac-device = &gmac0;
+		led-boot = &status_led;
+		led-failsafe = &status_led;
+		led-running = &status_led;
+		led-upgrade = &status_led;
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WLAN_2GHZ;
+			gpios = <&pio 4 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led-1 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WLAN_5GHZ;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		status_led: led-2 {
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	watchdog {
+		compatible = "linux,wdt-gpio";
+		gpios = <&pio 6 GPIO_ACTIVE_HIGH>;
+		hw_algo = "level";
+		hw_margin_ms = <10000>;
+		always-running;
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&eth {
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio_pins>;
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-handle = <&phy1>;
+		phy-mode = "2500base-x";
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_bdinfo_de00 0>;
+	};
+};
+
+&mdio_bus {
+	phy1: phy@1 {
+		reg = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_LEVEL_LOW>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_LOW>;
+		reset-assert-us = <100000>;
+		reset-deassert-us = <100000>;
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	/* ESMT F50L2G41XA (256M) */
+	spi_nand@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+
+		spi-cal-enable;
+		spi-cal-mode = "read-data";
+		spi-cal-datalen = <7>;
+		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4e 0x41 0x4e 0x44>;
+		spi-cal-addrlen = <5>;
+		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
+
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bl2";
+				reg = <0x0 0x100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x100000 0x80000>;
+			};
+
+			partition@180000 {
+				label = "factory";
+				reg = <0x180000 0x200000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+				};
+			};
+
+			partition@380000 {
+				label = "bdinfo";
+				reg = <0x380000 0x40000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_bdinfo_de00: macaddr@de00 {
+						compatible = "mac-base";
+						reg = <0xde00 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+
+			partition@3C0000 {
+				label = "fip";
+				reg = <0x3C0000 0x200000>;
+				read-only;
+			};
+
+			partition@5C0000 {
+				label = "ubi";
+				reg = <0x5C0000 0x4000000>;
+			};
+		};
+	};
+};
+
+&wifi {
+	nvmem-cell-names = "eeprom";
+	nvmem-cells = <&eeprom_factory_0>;
+	status = "okay";
+};
diff --git a/target/linux/mediatek/dts/mt7981b-cudy-ap3000outdoor-v1.dts b/target/linux/mediatek/dts/mt7981b-cudy-ap3000outdoor-v1.dts
index 62e406394755ac..735cecfe4296aa 100644
--- a/target/linux/mediatek/dts/mt7981b-cudy-ap3000outdoor-v1.dts
+++ b/target/linux/mediatek/dts/mt7981b-cudy-ap3000outdoor-v1.dts
@@ -8,10 +8,10 @@
 
 / {
 	model = "Cudy AP3000 Outdoor v1";
-	compatible = "cudy,ap3000outdoor-v1", "mediatek,mt7981-spim-snand-rfb";
+	compatible = "cudy,ap3000outdoor-v1", "mediatek,mt7981";
 
 	aliases {
-		label-mac-device = &gmac1;
+		label-mac-device = &wifi;
 		led-boot = &led_status_green;
 		led-failsafe = &led_status_red;
 		led-running = &led_status_green;
@@ -42,18 +42,19 @@
 	leds {
 		compatible = "gpio-leds";
 
-		led_status_green: led@0 {
+		led_status_green: led-0 {
 			function = LED_FUNCTION_STATUS;
 			color = <LED_COLOR_ID_GREEN>;
 			gpios = <&pio 10 GPIO_ACTIVE_HIGH>;
 		};
 
-		led_status_red: led_1 {
+		led_status_red: led-1 {
 			function = LED_FUNCTION_POWER;
 			color = <LED_COLOR_ID_RED>;
 			gpios = <&pio 11 GPIO_ACTIVE_HIGH>;
 		};
 	};
+
 	gpio_export {
 		compatible = "gpio-export";
 		#size-cells = <0>;
@@ -89,7 +90,6 @@
 &eth {
 	pinctrl-names = "default";
 	pinctrl-0 = <&mdio_pins>;
-
 	status = "okay";
 
 	gmac1: mac@1 {
@@ -148,6 +148,7 @@
 				label = "Factory";
 				reg = <0x180000 0x0200000>;
 				read-only;
+
 				nvmem-layout {
 					compatible = "fixed-layout";
 					#address-cells = <1>;
@@ -163,6 +164,7 @@
 				label = "bdinfo";
 				reg = <0x380000 0x0040000>;
 				read-only;
+
 				nvmem-layout {
 					compatible = "fixed-layout";
 					#address-cells = <1>;
@@ -174,25 +176,23 @@
 						#nvmem-cell-cells = <1>;
 					};
 				};
-
 			};
 
-			partition@3C0000 {
+			partition@3c0000 {
 				label = "FIP";
-				reg = <0x3C0000 0x0200000>;
+				reg = <0x3c0000 0x0200000>;
 				read-only;
 			};
 
-			partition@580000 {
+			partition@5c0000 {
 				label = "ubi";
-				reg = <0x5C0000 0x4000000>;
+				reg = <0x5c0000 0x4000000>;
 				compatible = "linux,ubi";
 			};
 		};
 	};
 };
 
-
 &pio {
 	spi0_flash_pins: spi0-pins {
 		mux {
diff --git a/target/linux/mediatek/dts/mt7981b-cudy-m3000-v1.dts b/target/linux/mediatek/dts/mt7981b-cudy-m3000-v1.dts
index 85bdabe47488e4..cfe9d45630d6b8 100644
--- a/target/linux/mediatek/dts/mt7981b-cudy-m3000-v1.dts
+++ b/target/linux/mediatek/dts/mt7981b-cudy-m3000-v1.dts
@@ -6,7 +6,7 @@
 
 / {
 	model = "Cudy M3000 v1";
-	compatible = "cudy,m3000-v1", "mediatek,mt7981-spim-snand-rfb";
+	compatible = "cudy,m3000-v1", "mediatek,mt7981";
 
 	aliases {
 		label-mac-device = &gmac0;
@@ -77,7 +77,6 @@
 &eth {
 	pinctrl-names = "default";
 	pinctrl-0 = <&mdio_pins>;
-
 	status = "okay";
 
 	gmac0: mac@0 {
@@ -105,19 +104,17 @@
 	rtl8221b_phy: ethernet-phy@1 {
 		compatible = "ethernet-phy-ieee802.3-c45";
 		reg = <1>;
-
-		reset-gpios = <&pio 39 GPIO_ACTIVE_LOW>;
-
-		interrupts = <38 IRQ_TYPE_LEVEL_LOW>;
 		reset-assert-us = <100000>;
 		reset-deassert-us = <100000>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_LOW>;
+		interrupts = <38 IRQ_TYPE_LEVEL_LOW>;
+		interrupt-parent = <&pio>;
 	};
 };
 
 &spi0 {
 	pinctrl-names = "default";
 	pinctrl-0 = <&spi0_flash_pins>;
-
 	status = "okay";
 
 	spi_nand: spi_nand@0 {
@@ -127,18 +124,18 @@
 		reg = <0>;
 
 		spi-max-frequency = <52000000>;
-		spi-tx-buswidth = <4>;
-		spi-rx-buswidth = <4>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
 
 		partitions {
 			compatible = "fixed-partitions";
 			#address-cells = <1>;
 			#size-cells = <1>;
 
-			mediatek,nmbm;
-			mediatek,bmt-max-ratio = <1>;
-			mediatek,bmt-max-reserved-blocks = <64>;
-
 			partition@0 {
 				label = "BL2";
 				reg = <0x0000000 0x0100000>;
@@ -177,6 +174,7 @@
 			partition@3c0000 {
 				label = "FIP";
 				reg = <0x03c0000 0x0200000>;
+				read-only;
 			};
 
 			partition@5c0000 {
diff --git a/target/linux/mediatek/dts/mt7981b-cudy-tr3000-256mb-v1.dts b/target/linux/mediatek/dts/mt7981b-cudy-tr3000-256mb-v1.dts
new file mode 100644
index 00000000000000..823f0aef93a0e9
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-cudy-tr3000-256mb-v1.dts
@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+#include "mt7981b-cudy-tr3000-v1.dtsi"
+
+/ {
+	model = "Cudy TR3000 256MB v1";
+	compatible = "cudy,tr3000-256mb-v1", "mediatek,mt7981";
+};
+
+&spi_nand {
+	spi-cal-enable;
+	spi-cal-mode = "read-data";
+	spi-cal-datalen = <7>;
+	spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4E 0x41 0x4E 0x44>;
+	spi-cal-addrlen = <5>;
+	spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
+
+	mediatek,nmbm;
+	mediatek,bmt-max-ratio = <1>;
+	mediatek,bmt-max-reserved-blocks = <64>;
+};
+
+&ubi {
+	reg = <0x5c0000 0xe600000>;
+};
+
diff --git a/target/linux/mediatek/dts/mt7981b-cudy-tr3000-v1-ubootmod.dts b/target/linux/mediatek/dts/mt7981b-cudy-tr3000-v1-ubootmod.dts
new file mode 100644
index 00000000000000..07e706dc3a45af
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-cudy-tr3000-v1-ubootmod.dts
@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+/dts-v1/;
+#include "mt7981b-cudy-tr3000-v1.dtsi"
+
+/ {
+	model = "Cudy TR3000 v1 (OpenWrt U-Boot layout)";
+	compatible = "cudy,tr3000-v1-ubootmod", "mediatek,mt7981";
+};
+
+&chosen {
+	bootargs = "root=/dev/fit0 rootwait";
+	rootdisk = <&ubi_rootdisk>;
+};
+
+&ubi {
+	reg = <0x5c0000 0x7a40000>;
+
+	volumes {
+		ubi_rootdisk: ubi-volume-fit {
+			volname = "fit";
+		};
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7981b-cudy-tr3000-v1.dts b/target/linux/mediatek/dts/mt7981b-cudy-tr3000-v1.dts
index 1f03b42b1b0456..d65e2352b74ae8 100644
--- a/target/linux/mediatek/dts/mt7981b-cudy-tr3000-v1.dts
+++ b/target/linux/mediatek/dts/mt7981b-cudy-tr3000-v1.dts
@@ -1,232 +1,26 @@
 // SPDX-License-Identifier: (GPL-2.0 OR MIT)
 
 /dts-v1/;
-
-#include <dt-bindings/leds/common.h>
-
-#include "mt7981.dtsi"
+#include "mt7981b-cudy-tr3000-v1.dtsi"
 
 / {
 	model = "Cudy TR3000 v1";
-	compatible = "cudy,tr3000-v1", "mediatek,mt7981-spim-snand-rfb";
-
-	aliases {
-		label-mac-device = &gmac1;
-		led-boot = &led_status;
-		led-failsafe = &led_status;
-		led-running = &led_status;
-		led-upgrade = &led_status;
-		serial0 = &uart0;
-	};
-
-	chosen {
-		stdout-path = "serial0:115200n8";
-	};
-
-	gpio-keys {
-		compatible = "gpio-keys";
-
-		reset {
-			label = "reset";
-			linux,code = <KEY_RESTART>;
-			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
-		};
-
-		mode {
-			label = "mode";
-			linux,input-type = <EV_SW>;
-			linux,code = <BTN_0>;
-			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
-		};
-	};
-
-	leds {
-		compatible = "gpio-leds";
-
-		led_status: led_0 {
-			function = LED_FUNCTION_POWER;
-			color = <LED_COLOR_ID_RED>;
-			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
-		};
-
-		led_1 {
-			function = LED_FUNCTION_STATUS;
-			color = <LED_COLOR_ID_WHITE>;
-			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
-		};
-
-	};
-
-	usb_vbus: regulator-usb {
-		compatible = "regulator-fixed";
-
-		regulator-name = "usb-vbus";
-		regulator-min-microvolt = <5000000>;
-		regulator-max-microvolt = <5000000>;
-
-		gpios = <&pio 9 GPIO_ACTIVE_LOW>;
-		regulator-boot-on;
-	};
-};
-
-&uart0 {
-	status = "okay";
-};
-
-&watchdog {
-	status = "okay";
-};
-
-&eth {
-	pinctrl-names = "default";
-	pinctrl-0 = <&mdio_pins>;
-
-	status = "okay";
-
-	gmac0: mac@0 {
-		compatible = "mediatek,eth-mac";
-		reg = <0>;
-		phy-mode = "2500base-x";
-		phy-handle = <&phy1>;
-		nvmem-cell-names = "mac-address";
-		nvmem-cells = <&macaddr_bdinfo_de00 1>;
-	};
-
-	gmac1: mac@1 {
-		compatible = "mediatek,eth-mac";
-		reg = <1>;
-		phy-mode = "gmii";
-		phy-handle = <&int_gbe_phy>;
-		nvmem-cell-names = "mac-address";
-		nvmem-cells = <&macaddr_bdinfo_de00 0>;
-	};
-};
-
-&mdio_bus {
-	phy1: phy@1 {
-		reg = <1>;
-		compatible = "ethernet-phy-ieee802.3-c45";
-		phy-mode = "2500base-x";
-		reset-gpios = <&pio 39 GPIO_ACTIVE_LOW>;
-		interrupts = <38 IRQ_TYPE_LEVEL_LOW>;
-		reset-assert-us = <100000>;
-		reset-deassert-us = <100000>;
-		realtek,aldps-enable;
-	};
-};
-
-&spi0 {
-	pinctrl-names = "default";
-	pinctrl-0 = <&spi0_flash_pins>;
-	status = "okay";
-
-	spi_nand: flash@0 {
-		#address-cells = <1>;
-		#size-cells = <1>;
-		compatible = "spi-nand";
-		reg = <0>;
-		spi-max-frequency = <52000000>;
-
-		spi-cal-enable;
-		spi-cal-mode = "read-data";
-		spi-cal-datalen = <7>;
-		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4E 0x41 0x4E 0x44>;
-		spi-cal-addrlen = <5>;
-		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
-
-		spi-tx-bus-width = <4>;
-		spi-rx-bus-width = <4>;
-		mediatek,nmbm;
-		mediatek,bmt-max-ratio = <1>;
-		mediatek,bmt-max-reserved-blocks = <64>;
-
-		partitions {
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			partition@0 {
-				label = "BL2";
-				reg = <0x00000 0x0100000>;
-				read-only;
-			};
-
-			partition@100000 {
-				label = "u-boot-env";
-				reg = <0x0100000 0x0080000>;
-				read-only;
-			};
-
-			factory: partition@180000 {
-				label = "Factory";
-				reg = <0x180000 0x0200000>;
-				read-only;
-				nvmem-layout {
-					compatible = "fixed-layout";
-					#address-cells = <1>;
-					#size-cells = <1>;
-
-					eeprom_factory_0: eeprom@0 {
-						reg = <0x0 0x1000>;
-					};
-				};
-			};
-
-			partition@380000 {
-				label = "bdinfo";
-				reg = <0x380000 0x0040000>;
-				read-only;
-				nvmem-layout {
-					compatible = "fixed-layout";
-					#address-cells = <1>;
-					#size-cells = <1>;
-
-					macaddr_bdinfo_de00: macaddr@de00 {
-						compatible = "mac-base";
-						reg = <0xde00 0x6>;
-						#nvmem-cell-cells = <1>;
-					};
-				};
-
-			};
-
-			partition@3C0000 {
-				label = "FIP";
-				reg = <0x3C0000 0x0200000>;
-				read-only;
-			};
-
-			partition@580000 {
-				label = "ubi";
-				reg = <0x5C0000 0x4000000>;
-				compatible = "linux,ubi";
-			};
-		};
-	};
+	compatible = "cudy,tr3000-v1", "mediatek,mt7981";
 };
 
+&spi_nand {
+	spi-cal-enable;
+	spi-cal-mode = "read-data";
+	spi-cal-datalen = <7>;
+	spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4E 0x41 0x4E 0x44>;
+	spi-cal-addrlen = <5>;
+	spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
 
-&pio {
-	spi0_flash_pins: spi0-pins {
-		mux {
-			function = "spi";
-			groups = "spi0", "spi0_wp_hold";
-		};
-	};
-};
-
-&usb_phy {
-	status = "okay";
-};
-
-&xhci {
-	status = "okay";
-	vbus-supply = <&usb_vbus>;
+	mediatek,nmbm;
+	mediatek,bmt-max-ratio = <1>;
+	mediatek,bmt-max-reserved-blocks = <64>;
 };
 
-&wifi {
-	status = "okay";
-	nvmem-cells = <&eeprom_factory_0>;
-	nvmem-cell-names = "eeprom";
+&ubi {
+	reg = <0x5c0000 0x4000000>;
 };
diff --git a/target/linux/mediatek/dts/mt7981b-cudy-tr3000-v1.dtsi b/target/linux/mediatek/dts/mt7981b-cudy-tr3000-v1.dtsi
new file mode 100644
index 00000000000000..91cf1d01a0cb13
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-cudy-tr3000-v1.dtsi
@@ -0,0 +1,212 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+/dts-v1/;
+#include <dt-bindings/leds/common.h>
+#include "mt7981.dtsi"
+
+/ {
+	aliases {
+		label-mac-device = &gmac1;
+		led-boot = &led_sys_red;
+		led-failsafe = &led_sys_red;
+		led-running = &led_sys_white;
+		led-upgrade = &led_sys_white;
+		serial0 = &uart0;
+	};
+
+	chosen: chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		mode {
+			label = "mode";
+			linux,code = <BTN_0>;
+			linux,input-type = <EV_SW>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_sys_red: led-0 {
+			function = LED_FUNCTION_POWER;
+			color = <LED_COLOR_ID_RED>;
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led_sys_white: led-1 {
+			function = LED_FUNCTION_STATUS;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	usb_vbus: regulator-usb {
+		compatible = "regulator-fixed";
+		regulator-name = "usb-vbus";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		regulator-boot-on;
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&eth {
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio_pins>;
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+		phy-handle = <&phy1>;
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_bdinfo_de00 1>;
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "gmii";
+		phy-handle = <&int_gbe_phy>;
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_bdinfo_de00 0>;
+	};
+};
+
+&mdio_bus {
+	phy1: phy@1 {
+		compatible = "ethernet-phy-ieee802.3-c45";
+		reg = <1>;
+		reset-assert-us = <100000>;
+		reset-deassert-us = <100000>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_LOW>;
+		interrupts = <38 IRQ_TYPE_LEVEL_LOW>;
+		interrupt-parent = <&pio>;
+		realtek,aldps-enable;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand: flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x00000 0x0100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x0100000 0x0080000>;
+				read-only;
+			};
+
+			factory: partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x0200000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+				};
+			};
+
+			partition@380000 {
+				label = "bdinfo";
+				reg = <0x380000 0x0040000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_bdinfo_de00: macaddr@de00 {
+						compatible = "mac-base";
+						reg = <0xde00 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+
+			partition@3c0000 {
+				label = "FIP";
+				reg = <0x3c0000 0x0200000>;
+				read-only;
+			};
+
+			ubi: partition@5c0000 {
+				label = "ubi";
+				compatible = "linux,ubi";
+			};
+		};
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+	};
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&xhci {
+	status = "okay";
+	vbus-supply = <&usb_vbus>;
+};
+
+&wifi {
+	status = "okay";
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+};
diff --git a/target/linux/mediatek/dts/mt7981b-cudy-wr3000-nand.dtsi b/target/linux/mediatek/dts/mt7981b-cudy-wr3000-nand.dtsi
new file mode 100644
index 00000000000000..90cad07f591759
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-cudy-wr3000-nand.dtsi
@@ -0,0 +1,184 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+#include <dt-bindings/leds/common.h>
+#include "mt7981.dtsi"
+
+/ {
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&eth {
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio_pins>;
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_bdinfo_de00 0>;
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+};
+
+&mdio_bus {
+	switch: switch@1f {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand: flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+
+		spi-cal-enable;
+		spi-cal-mode = "read-data";
+		spi-cal-datalen = <7>;
+		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4E 0x41 0x4E 0x44>;
+		spi-cal-addrlen = <5>;
+		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
+
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x00000 0x0100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x0100000 0x0080000>;
+				read-only;
+			};
+
+			partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x0200000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+				};
+			};
+
+			partition@380000 {
+				label = "bdinfo";
+				reg = <0x380000 0x0040000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_bdinfo_de00: macaddr@de00 {
+						compatible = "mac-base";
+						reg = <0xde00 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+
+			partition@3c0000 {
+				label = "FIP";
+				reg = <0x3c0000 0x0200000>;
+				read-only;
+			};
+
+			partition@5c0000 {
+				label = "ubi";
+				reg = <0x5c0000 0x4000000>;
+				compatible = "linux,ubi";
+			};
+		};
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&wifi {
+	status = "okay";
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+};
diff --git a/target/linux/mediatek/dts/mt7981b-cudy-wr3000-v1.dts b/target/linux/mediatek/dts/mt7981b-cudy-wr3000-v1.dts
index 1ded8b5a687d83..8af8ef401f43ba 100644
--- a/target/linux/mediatek/dts/mt7981b-cudy-wr3000-v1.dts
+++ b/target/linux/mediatek/dts/mt7981b-cudy-wr3000-v1.dts
@@ -11,7 +11,6 @@
 	compatible = "cudy,wr3000-v1", "mediatek,mt7981";
 
 	aliases {
-		ethernet0 = &gmac0;
 		label-mac-device = &gmac0;
 		led-boot = &led_status;
 		led-failsafe = &led_status;
diff --git a/target/linux/mediatek/dts/mt7981b-cudy-wr3000e-v1.dts b/target/linux/mediatek/dts/mt7981b-cudy-wr3000e-v1.dts
new file mode 100644
index 00000000000000..7632e6d1a90f1a
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-cudy-wr3000e-v1.dts
@@ -0,0 +1,120 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+/dts-v1/;
+
+#include "mt7981b-cudy-wr3000-nand.dtsi"
+
+/ {
+	model = "Cudy WR3000E v1";
+	compatible = "cudy,wr3000e-v1", "mediatek,mt7981";
+
+	aliases {
+		label-mac-device = &gmac0;
+		led-boot = &led_power;
+		led-failsafe = &led_power;
+		led-running = &led_power;
+		led-upgrade = &led_power;
+		serial0 = &uart0;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power: led-power {
+			function = LED_FUNCTION_POWER;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&pio 8 GPIO_ACTIVE_LOW>;
+		};
+
+		led-lan-1 {
+			function = LED_FUNCTION_LAN;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		led-lan-2 {
+			function = LED_FUNCTION_LAN;
+			color = <LED_COLOR_ID_RED>;
+			gpios = <&pio 5 GPIO_ACTIVE_LOW>;
+		};
+
+		led-wan {
+			function = LED_FUNCTION_WAN_ONLINE;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led-wps-1 {
+			function = LED_FUNCTION_WPS;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+
+		led-wps-2 {
+			function = LED_FUNCTION_WPS;
+			color = <LED_COLOR_ID_RED>;
+			gpios = <&pio 4 GPIO_ACTIVE_LOW>;
+		};
+
+		led-wlan2g {
+			function = LED_FUNCTION_WLAN_2GHZ;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led-wlan5g {
+			function = LED_FUNCTION_WLAN_5GHZ;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+	};
+};
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "wan";
+
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_bdinfo_de00 1>;
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan1";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan2";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan3";
+		};
+
+		port@4 {
+			reg = <4>;
+			label = "lan4";
+		};
+
+		port@6 {
+			reg = <6>;
+			label = "cpu";
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7981b-cudy-wr3000h-v1.dts b/target/linux/mediatek/dts/mt7981b-cudy-wr3000h-v1.dts
new file mode 100644
index 00000000000000..e34d2a9ad2ac22
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-cudy-wr3000h-v1.dts
@@ -0,0 +1,153 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+/dts-v1/;
+
+#include "mt7981b-cudy-wr3000-nand.dtsi"
+
+/ {
+	model = "Cudy WR3000H v1";
+	compatible = "cudy,wr3000h-v1", "mediatek,mt7981";
+
+	aliases {
+		label-mac-device = &gmac0;
+		led-boot = &led_status;
+		led-failsafe = &led_status;
+		led-running = &led_status;
+		led-upgrade = &led_status;
+		serial0 = &uart0;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status: led-status {
+			function = LED_FUNCTION_STATUS;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 5 GPIO_ACTIVE_LOW>;
+		};
+
+		led-internet {
+			function = LED_FUNCTION_WAN_ONLINE;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led-wps {
+			function = LED_FUNCTION_WPS;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		led-wlan2g {
+			function = LED_FUNCTION_WLAN_2GHZ;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led-wlan5g {
+			function = LED_FUNCTION_WLAN_5GHZ;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		led-lan1 {
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <1>;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 8 GPIO_ACTIVE_LOW>;
+		};
+
+		led-lan2 {
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <2>;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+
+		led-lan3 {
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <3>;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 12 GPIO_ACTIVE_LOW>;
+		};
+
+		led-lan4 {
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <4>;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 13 GPIO_ACTIVE_LOW>;
+		};
+
+		led-wan {
+			function = LED_FUNCTION_WAN;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 35 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&eth {
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "2500base-x";
+		phy-handle = <&phy6>;
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_bdinfo_de00 1>;
+		label = "wan";
+	};
+};
+
+&mdio_bus {
+
+	phy6: ethernet-phy@6 {
+		compatible = "ethernet-phy-ieee802.3-c45";
+		reg = <6>;
+		reset-assert-us = <100000>;
+		reset-deassert-us = <100000>;
+		reset-gpios = <&pio 3 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan2";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan3";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan4";
+		};
+
+		port@6 {
+			reg = <6>;
+			label = "cpu";
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
diff --git a/target/linux/mediatek/dts/mt7981b-cudy-wr3000s-v1.dts b/target/linux/mediatek/dts/mt7981b-cudy-wr3000s-v1.dts
new file mode 100644
index 00000000000000..ccf1821509bd7f
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-cudy-wr3000s-v1.dts
@@ -0,0 +1,103 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+/dts-v1/;
+
+#include "mt7981b-cudy-wr3000-nand.dtsi"
+
+/ {
+	model = "Cudy WR3000S v1";
+	compatible = "cudy,wr3000s-v1", "mediatek,mt7981";
+
+	aliases {
+		label-mac-device = &gmac0;
+		led-boot = &led_status;
+		led-failsafe = &led_status;
+		led-running = &led_status;
+		led-upgrade = &led_status;
+		serial0 = &uart0;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status: led-status {
+			function = LED_FUNCTION_STATUS;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+
+		led-internet {
+			function = LED_FUNCTION_WAN_ONLINE;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led-wps {
+			function = LED_FUNCTION_WPS;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		led-wlan2g {
+			function = LED_FUNCTION_WLAN_2GHZ;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led-wlan5g {
+			function = LED_FUNCTION_WLAN_5GHZ;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "wan";
+
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_bdinfo_de00 1>;
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan1";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan2";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan3";
+		};
+
+		port@4 {
+			reg = <4>;
+			label = "lan4";
+		};
+
+		port@6 {
+			reg = <6>;
+			label = "cpu";
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7981b-gatonetworks-gdsp.dts b/target/linux/mediatek/dts/mt7981b-gatonetworks-gdsp.dts
new file mode 100644
index 00000000000000..fd9fdca12404d5
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-gatonetworks-gdsp.dts
@@ -0,0 +1,389 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include "mt7981.dtsi"
+
+/ {
+	model = "GatoNetworks GDSP";
+	compatible = "gatonetworks,gdsp", "mediatek,mt7981";
+
+	aliases {
+		serial0 = &uart0;
+		label-mac-device = &wifi_band_0;
+		led-boot = &sg1;
+		led-failsafe = &sg1;
+		led-running = &sg1;
+		led-upgrade = &sg1;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs = "console=ttyS0,115200n1 earlycon=uart8250,mmio32,0x11002000";
+		rootdisk = <&firmware>;
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x10000000>;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_5v: regulator-5v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-5V";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-export {
+		compatible = "gpio-export";
+
+		modem1 {
+			gpio-export,name = "modem1";
+			gpio-export,output = <0>;
+			gpios = <&pio 2 GPIO_ACTIVE_LOW>;
+		};
+
+		modem2 {
+			gpio-export,name = "modem2";
+			gpio-export,output = <0>;
+			gpios = <&pio 14 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		sim1 {
+			label = "green:sim1";
+			gpios = <&pio 13 GPIO_ACTIVE_LOW>;
+		};
+
+		sim2 {
+			label = "green:sim2";
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+		};
+
+		sg1: sg1 {
+			label = "green:sg1";
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+
+		sg2 {
+			label = "green:sg2";
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		sg3 {
+			label = "green:sg3";
+			gpios = <&pio 12 GPIO_ACTIVE_LOW>;
+		};
+
+		sg4 {
+			label = "green:sg4";
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+		};
+
+		sg5 {
+			label = "green:sg5";
+			gpios = <&pio 8 GPIO_ACTIVE_LOW>;
+		};
+
+		sg6 {
+			label = "green:sg6";
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-watchdog {
+		compatible = "linux,wdt-gpio";
+		gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+		hw_algo = "toggle";
+		hw_margin_ms = <25000>;
+		always-running;
+	};
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cells = <&macaddr_lan>;
+		nvmem-cell-names = "mac-address";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		switch@1f {
+			compatible = "mediatek,mt7531";
+			reg = <31>;
+			reset-gpios = <&pio 39 0>;
+			interrupt-controller;
+			#interrupt-cells = <1>;
+			interrupt-parent = <&pio>;
+			interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+
+			mdio {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				swphy0: phy@0 {
+					reg = <0>;
+				};
+
+				swphy1: phy@1 {
+					reg = <1>;
+				};
+
+				swphy2: phy@2 {
+					reg = <2>;
+				};
+
+				swphy3: phy@3 {
+					reg = <3>;
+				};
+
+				swphy4: phy@4 {
+					reg = <4>;
+				};
+			};
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					label = "lan1";
+					phy-handle = <&swphy0>;
+				};
+
+				port@1 {
+					reg = <1>;
+					label = "lan2";
+					phy-handle = <&swphy1>;
+				};
+
+				port@2 {
+					reg = <2>;
+					label = "lan3";
+					phy-handle = <&swphy2>;
+				};
+
+				port@3 {
+					reg = <3>;
+					label = "lan4";
+					phy-handle = <&swphy3>;
+				};
+
+				port@4 {
+					reg = <4>;
+					label = "wan";
+					nvmem-cells = <&macaddr_wan>;
+					nvmem-cell-names = "mac-address";
+					phy-handle = <&swphy4>;
+				};
+
+				port@6 {
+					reg = <6>;
+					ethernet = <&gmac0>;
+					phy-mode = "2500base-x";
+
+					fixed-link {
+						speed = <2500>;
+						full-duplex;
+						pause;
+					};
+				};
+			};
+		};
+	};
+};
+
+&crypto {
+	status = "okay";
+};
+
+&wifi {
+	mediatek,mtd-eeprom = <&factory 0x0>;
+	status = "okay";
+
+	wifi_band_0: band@0 {
+		reg = <0>;
+		nvmem-cells = <&macaddr_wifi 0>;
+		nvmem-cell-names = "mac-address";
+	};
+
+	band@1 {
+		reg = <1>;
+		nvmem-cells = <&macaddr_wifi 1>;
+		nvmem-cell-names = "mac-address";
+	};
+};
+
+&spi2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi2_flash_pins>;
+	status = "okay";
+
+	flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@00000 {
+				label = "BL2";
+				reg = <0x00000 0x0040000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "u-boot-env";
+				reg = <0x40000 0x0010000>;
+			};
+
+			factory: partition@50000 {
+				label = "Factory";
+				reg = <0x50000 0x00B0000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_wifi: macaddr@4 {
+						reg = <0x4 0x6>;
+						compatible = "mac-base";
+						#nvmem-cell-cells = <1>;
+					};
+
+					macaddr_wan: macaddr@24 {
+						reg = <0x24 0x6>;
+					};
+
+					macaddr_lan: macaddr@2a {
+						reg = <0x2a 0x6>;
+					};
+				};
+			};
+
+			partition@100000 {
+				label = "FIP";
+				reg = <0x100000 0x0080000>;
+				read-only;
+			};
+
+			firmware: partition@180000 {
+				label = "firmware";
+				reg = <0x180000 0x1E80000>;
+			};
+		};
+	};
+};
+
+&pio {
+	uart1_pins: uart1-pins {
+		mux {
+			function = "uart";
+			groups = "uart1_0";
+		};
+	};
+
+	uart2_pins: uart2-pins {
+		mux {
+			function = "uart";
+			groups = "uart2_0_tx_rx";
+		};
+	};
+
+	spi2_flash_pins: spi2-pins {
+		mux {
+			function = "spi";
+			groups = "spi2", "spi2_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&uart1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart1_pins>;
+	status = "okay";
+};
+
+&uart2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart2_pins>;
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&xhci {
+	mediatek,u3p-dis-msk = <0x0>;
+	phys = <&u2port0 PHY_TYPE_USB2>,
+	       <&u3port0 PHY_TYPE_USB3>;
+	status = "okay";
+	vusb33-supply = <&reg_3p3v>;
+	vbus-supply = <&reg_5v>;
+};
diff --git a/target/linux/mediatek/dts/mt7981b-huasifei-wh3000-pro.dts b/target/linux/mediatek/dts/mt7981b-huasifei-wh3000-pro.dts
new file mode 100644
index 00000000000000..3d45453d3d9c69
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-huasifei-wh3000-pro.dts
@@ -0,0 +1,213 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "Huasifei WH3000 Pro";
+	compatible = "huasifei,wh3000-pro", "mediatek,mt7981";
+
+	aliases {
+		serial0 = &uart0;
+		led-boot = &led_sys_red;
+		led-failsafe = &led_sys_red;
+		led-running = &led_sys_blue;
+		led-upgrade = &led_sys_blue;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs-append = " root=PARTLABEL=rootfs rootwait";
+	};
+
+	gpio-export {
+		compatible = "gpio-export";
+
+		modem-power {
+			gpio-export,name = "modem_power";
+			gpio-export,output = <0>;
+			gpios = <&pio 4 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		mode {
+			label = "mode";
+			linux,code = <BTN_0>;
+			linux,input-type = <EV_SW>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		led_sys_red: led-0 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led_sys_blue: led-1 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&eth {
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio_pins>;
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+		phy-handle = <&phy1>;
+
+		nvmem-cells = <&macaddr_factory_4 2>;
+		nvmem-cell-names = "mac-address";
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "gmii";
+		phy-handle = <&int_gbe_phy>;
+
+		nvmem-cells = <&macaddr_factory_4 3>;
+		nvmem-cell-names = "mac-address";
+	};
+};
+
+&mdio_bus {
+	phy1: ethernet-phy@1 {
+		compatible = "ethernet-phy-ieee802.3-c45";
+		reg = <1>;
+		reset-assert-us = <100000>;
+		reset-deassert-us = <100000>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_LOW>;
+		interrupts = <38 IRQ_TYPE_LEVEL_LOW>;
+		interrupt-parent = <&pio>;
+		realtek,aldps-enable;
+	};
+};
+
+&fan {
+	interrupt-parent = <&pio>;
+	interrupts = <13 IRQ_TYPE_EDGE_FALLING>;
+	pwms = <&pwm 1 40000 0>;
+	status = "okay";
+};
+
+&mmc0 {
+	bus-width = <8>;
+	cap-mmc-highspeed;
+	max-frequency = <52000000>;
+	non-removable;
+	#address-cells = <1>;
+	#size-cells = <0>;
+	pinctrl-names = "default", "state_uhs";
+	pinctrl-0 = <&mmc0_pins_default>;
+	pinctrl-1 = <&mmc0_pins_uhs>;
+	vmmc-supply = <&reg_3p3v>;
+	status = "okay";
+
+	card@0 {
+		compatible = "mmc-card";
+		reg = <0>;
+
+		block {
+			compatible = "block-device";
+
+			partitions {
+				block-partition-factory {
+					partname = "factory";
+
+					nvmem-layout {
+						compatible = "fixed-layout";
+						#address-cells = <1>;
+						#size-cells = <1>;
+
+						eeprom_factory_0: eeprom@0 {
+							reg = <0x0 0x1000>;
+						};
+
+						macaddr_factory_4: macaddr@4 {
+							compatible = "mac-base";
+							reg = <0x4 0x6>;
+							#nvmem-cell-cells = <1>;
+						};
+					};
+				};
+			};
+		};
+	};
+};
+
+&pio {
+	mmc0_pins_default: mmc0-pins-default {
+		mux {
+			function = "flash";
+			groups = "emmc_45";
+		};
+	};
+
+	mmc0_pins_uhs: mmc0-pins-uhs {
+		mux {
+			function = "flash";
+			groups = "emmc_45";
+		};
+	};
+
+	pwm1_pins: pwm1-pins {
+		mux {
+			function = "pwm";
+			groups = "pwm1_0";
+		};
+	};
+};
+
+&pwm {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pwm1_pins>;
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+	status = "okay";
+};
+
+&xhci {
+	status = "okay";
+};
diff --git a/target/linux/mediatek/dts/mt7981b-huasifei-wh3000.dts b/target/linux/mediatek/dts/mt7981b-huasifei-wh3000.dts
new file mode 100644
index 00000000000000..c12367b84afbda
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-huasifei-wh3000.dts
@@ -0,0 +1,190 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "Huasifei WH3000";
+	compatible = "huasifei,wh3000", "mediatek,mt7981";
+
+	aliases {
+		serial0 = &uart0;
+		led-boot = &wlan_led;
+		led-failsafe = &wlan_led;
+		led-upgrade = &wlan_led;
+	};
+
+	chosen {
+		bootargs = "root=PARTLABEL=rootfs rootwait";
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-mode {
+			label = "mode";
+			linux,code = <BTN_0>;
+			linux,input-type = <EV_SW>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		button-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		wan_led: led-0 {
+			function = LED_FUNCTION_WAN;
+			color = <LED_COLOR_ID_RED>;
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		wlan_led: led-1 {
+			function = LED_FUNCTION_WLAN;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+	};
+
+	memory@40000000 {
+		reg = <0 0x40000000 0 0x40000000>;
+	};
+};
+
+&eth {
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio_pins>;
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		nvmem-cells = <&macaddr_factory_4 2>;
+		nvmem-cell-names = "mac-address";
+		phy-mode = "2500base-x";
+		phy-handle = <&phy1>;
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		nvmem-cells = <&macaddr_factory_4 3>;
+		nvmem-cell-names = "mac-address";
+		phy-mode = "gmii";
+		phy-handle = <&int_gbe_phy>;
+	};
+};
+
+&mdio_bus {
+	phy1: ethernet-phy@1 {
+		compatible = "ethernet-phy-ieee802.3-c45";
+		reg = <1>;
+		interrupts = <38 IRQ_TYPE_LEVEL_LOW>;
+		interrupt-parent = <&pio>;
+		reset-assert-us = <100000>;
+		reset-deassert-us = <100000>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_LOW>;
+		realtek,aldps-enable;
+	};
+};
+
+&mmc0 {
+	bus-width = <8>;
+	cap-mmc-highspeed;
+	max-frequency = <52000000>;
+	no-sd;
+	no-sdio;
+	non-removable;
+	pinctrl-names = "default", "state_uhs";
+	pinctrl-0 = <&mmc0_pins_default>;
+	pinctrl-1 = <&mmc0_pins_uhs>;
+	vmmc-supply = <&reg_3p3v>;
+	status = "okay";
+
+	card@0 {
+		compatible = "mmc-card";
+		reg = <0>;
+
+		block {
+			compatible = "block-device";
+
+			partitions {
+				block-partition-factory {
+					partname = "factory";
+
+					nvmem-layout {
+						compatible = "fixed-layout";
+						#address-cells = <1>;
+						#size-cells = <1>;
+
+						eeprom_factory_0: eeprom@0 {
+							reg = <0x0 0x1000>;
+						};
+
+						macaddr_factory_4: macaddr@4 {
+							compatible = "mac-base";
+							reg = <0x4 0x6>;
+							#nvmem-cell-cells = <1>;
+						};
+					};
+				};
+			};
+		};
+	};
+};
+
+&pio {
+	mmc0_pins_default: mmc0-pins-default {
+		mux {
+			function = "flash";
+			groups = "emmc_45";
+		};
+	};
+
+	mmc0_pins_uhs: mmc0-pins-uhs {
+		mux {
+			function = "flash";
+			groups = "emmc_45";
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+	status = "okay";
+
+	band@1 {
+		reg = <1>;
+		nvmem-cells = <&macaddr_factory_4 1>;
+		nvmem-cell-names = "mac-address";
+	};
+};
+
+&xhci {
+	status = "okay";
+};
diff --git a/target/linux/mediatek/dts/mt7981b-iptime-ax3000q.dts b/target/linux/mediatek/dts/mt7981b-iptime-ax3000q.dts
new file mode 100644
index 00000000000000..20fcf88d4e933c
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-iptime-ax3000q.dts
@@ -0,0 +1,277 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+/dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "ipTIME AX3000Q";
+	compatible = "iptime,ax3000q", "mediatek,mt7981";
+
+	aliases {
+		serial0 = &uart0;
+		label-mac-device = &wan;
+
+		led-boot = &led_cpu;
+		led-failsafe = &led_cpu;
+		led-running = &led_cpu;
+		led-upgrade = &led_cpu;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-0 {
+			label = "wps";
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+		};
+
+		button-1 {
+			label = "reset";
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&pio 8 GPIO_ACTIVE_LOW>;
+		};
+
+		led-1 {
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_WLAN_2GHZ;
+			gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led-2 {
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_WLAN_5GHZ;
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		led_cpu: led-3 {
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_CPU;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_4 (3)>;
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+};
+
+&mdio_bus {
+	switch: switch@1f {
+		compatible = "mediatek,mt7531";
+		reg = <0x1f>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+
+		spi-cal-enable;
+		spi-cal-mode = "read-data";
+		spi-cal-datalen = <7>;
+		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4e 0x41 0x4e 0x44>;
+		spi-cal-addrlen = <5>;
+		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
+
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x0 0x100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x100000 0x80000>;
+			};
+
+			partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x200000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+
+					macaddr_factory_4: macaddr@4 {
+						compatible = "mac-base";
+						reg = <0x4 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x380000 0x200000>;
+				read-only;
+			};
+
+			partition@580000 {
+				label = "ubi";
+				reg = <0x580000 0x6E00000>;
+			};
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		wan: port@0 {
+			reg = <0>;
+			label = "wan";
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_4 (1)>;
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan4";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan3";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan2";
+		};
+
+		port@4 {
+			reg = <4>;
+			label = "lan1";
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+	nvmem-cell-names = "eeprom";
+	nvmem-cells = <&eeprom_factory_0>;
+
+	band@0 {
+		reg = <0>;
+		nvmem-cells = <&macaddr_factory_4 (0)>;
+		nvmem-cell-names = "mac-address";
+	};
+
+	band@1 {
+		reg = <1>;
+		nvmem-cells = <&macaddr_factory_4 (0)>;
+		nvmem-cell-names = "mac-address";
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7981b-iptime-ax3000sm.dts b/target/linux/mediatek/dts/mt7981b-iptime-ax3000sm.dts
new file mode 100644
index 00000000000000..ea385a08a2a394
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-iptime-ax3000sm.dts
@@ -0,0 +1,279 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+/dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "ipTIME AX3000SM";
+	compatible = "iptime,ax3000sm", "mediatek,mt7981";
+
+	aliases {
+		serial0 = &uart0;
+		label-mac-device = &gmac1;
+		led-boot = &led_cpu;
+		led-failsafe = &led_cpu;
+		led-running = &led_cpu;
+		led-upgrade = &led_cpu;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-0 {
+			label = "wps";
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+			debounce-interval = <60>;
+		};
+
+		button-1 {
+			label = "reset";
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&pio 8 GPIO_ACTIVE_LOW>;
+		};
+
+		led-1 {
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_WLAN_2GHZ;
+			gpios = <&pio 34 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led-2 {
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_WLAN_5GHZ;
+			gpios = <&pio 35 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		led_cpu: led-3 {
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_CPU;
+			gpios = <&pio 15 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_4 (3)>;
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "gmii";
+		phy-handle = <&int_gbe_phy>;
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_4 (1)>;
+	};
+};
+
+&mdio_bus {
+	switch: switch@1f {
+		compatible = "mediatek,mt7531";
+		reg = <0x1f>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+
+		spi-cal-enable;
+		spi-cal-mode = "read-data";
+		spi-cal-datalen = <7>;
+		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4e 0x41 0x4e 0x44>;
+		spi-cal-addrlen = <5>;
+		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
+
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x0 0x100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x100000 0x80000>;
+			};
+
+			partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x200000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+
+					macaddr_factory_4: macaddr@4 {
+						compatible = "mac-base";
+						reg = <0x4 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x380000 0x200000>;
+				read-only;
+			};
+
+			partition@580000 {
+				label = "ubi";
+				reg = <0x580000 0x6E00000>;
+			};
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan4";
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan3";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan2";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan1";
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_4mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+	nvmem-cell-names = "eeprom";
+	nvmem-cells = <&eeprom_factory_0>;
+
+	band@0 {
+		reg = <0>;
+		nvmem-cells = <&macaddr_factory_4 (0)>;
+		nvmem-cell-names = "mac-address";
+	};
+
+	band@1 {
+		reg = <1>;
+		nvmem-cells = <&macaddr_factory_4 (0)>;
+		nvmem-cell-names = "mac-address";
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7981b-keenetic-kn-3811.dts b/target/linux/mediatek/dts/mt7981b-keenetic-kn-3811.dts
new file mode 100644
index 00000000000000..87043ec907a46f
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-keenetic-kn-3811.dts
@@ -0,0 +1,368 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+/dts-v1/;
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "Keenetic KN-3811";
+	compatible = "keenetic,kn-3811", "mediatek,mt7981";
+
+	aliases {
+		label-mac-device = &gmac0;
+		led-boot = &power_led;
+		led-failsafe = &power_led;
+		led-running = &power_led;
+		led-upgrade = &power_led;
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-fn {
+			label = "fn";
+			linux,code = <BTN_0>;
+			gpios = <&pio 5 GPIO_ACTIVE_LOW>;
+		};
+
+		button-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 24 GPIO_ACTIVE_LOW>;
+		};
+
+		button-wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 29 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		/* fn led reassigned to wlan 2.4 */
+		led-0 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN_2GHZ;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		power_led: led-1 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&pio 11 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-2 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&pio 12 GPIO_ACTIVE_LOW>;
+		};
+
+		led-3 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN_5GHZ;
+			gpios = <&pio 34 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+	};
+
+	usb_vbus: regulator-usb-vbus {
+		compatible = "regulator-fixed";
+		regulator-name = "usb_vbus";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpios = <&pio 6 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+		regulator-boot-on;
+	};
+
+	virtual_flash {
+		compatible = "mtd-concat";
+		devices = <&firmware1 &storage1 &firmware2 &storage2>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "kernel";
+				reg = <0x0 0x600000>;
+			};
+
+			partition@400000 {
+				label = "ubi";
+				reg = <0x600000 0x0>;
+			};
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_4 0>;
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "gmii";
+		phy-handle = <&int_gbe_phy>;
+		label = "wan";
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_a 0>;
+	};
+};
+
+&mdio_bus {
+	switch: switch@1f {
+		compatible = "mediatek,mt7531";
+		reg = <0x1f>;
+		reset-gpios = <&pio 22 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan2";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan3";
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	/* Winbond W25N02KV (256M) */
+	spi_nand@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+
+		spi-cal-enable;
+		spi-cal-mode = "read-data";
+		spi-cal-datalen = <7>;
+		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4e 0x41 0x4e 0x44>;
+		spi-cal-addrlen = <5>;
+		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
+
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			/* bl2 */
+			partition@0 {
+				label = "preloader";
+				reg = <0x0 0x80000>;
+				read-only;
+			};
+
+			/* fip */
+			partition@80000 {
+				label = "u-boot";
+				reg = <0x80000 0x200000>;
+				read-only;
+			};
+
+			partition@280000 {
+				label = "u-config";
+				reg = <0x280000 0x80000>;
+				read-only;
+			};
+
+			partition@300000 {
+				label = "rf-eeprom";
+				reg = <0x300000 0x200000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+
+					/* lan mac */
+					macaddr_factory_4: macaddr@4 {
+						compatible = "mac-base";
+						reg = <0x4 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+
+					/* wan mac */
+					macaddr_factory_a: macaddr@a {
+						compatible = "mac-base";
+						reg = <0xa 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+
+			firmware1: partition@500000 {
+				label = "firmware_1";
+				reg = <0x500000 0x3a00000>;
+			};
+
+			partition@3f00000 {
+				label = "config_1";
+				reg = <0x3f00000 0x80000>;
+				read-only;
+			};
+
+			partition@3f80000 {
+				label = "dump";
+				reg = <0x3f80000 0x80000>;
+				read-only;
+			};
+
+			storage1: partition@4000000 {
+				label = "storage_a";
+				reg = <0x4000000 0x3800000>;
+			};
+
+			partition@7800000 {
+				label = "u-state";
+				reg = <0x7800000 0x20000>;
+				read-only;
+			};
+
+			partition@7a80000 {
+				label = "u-config_res";
+				reg = <0x7a80000 0x80000>;
+				read-only;
+			};
+
+			partition@7b00000 {
+				label = "rf-eeprom_res";
+				reg = <0x7b00000 0x200000>;
+				read-only;
+			};
+
+			firmware2: partition@7d00000 {
+				label = "firmware_2";
+				reg = <0x7d00000 0x3a00000>;
+			};
+
+			partition@b700000 {
+				label = "config_2";
+				reg = <0xb700000 0x80000>;
+				read-only;
+			};
+
+			storage2: partition@b780000 {
+				label = "storage_b";
+				reg = <0xb780000 0x3880000>;
+			};
+		};
+	};
+};
+
+&wifi {
+	nvmem-cell-names = "eeprom";
+	nvmem-cells = <&eeprom_factory_0>;
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&xhci {
+	status = "okay";
+	vbus-supply = <&usb_vbus>;
+};
diff --git a/target/linux/mediatek/dts/mt7981b-keenetic-kn-3911.dts b/target/linux/mediatek/dts/mt7981b-keenetic-kn-3911.dts
new file mode 100644
index 00000000000000..8a9bf0f1a9bf45
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-keenetic-kn-3911.dts
@@ -0,0 +1,300 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+/dts-v1/;
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "Keenetic KN-3911";
+	compatible = "keenetic,kn-3911", "mediatek,mt7981";
+
+	aliases {
+		label-mac-device = &gmac0;
+		led-boot = &status_led;
+		led-failsafe = &status_led;
+		led-running = &status_led;
+		led-upgrade = &status_led;
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-fn {
+			label = "fn";
+			linux,code = <BTN_0>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+		};
+
+		button-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 24 GPIO_ACTIVE_LOW>;
+		};
+
+		button-wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 29 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		status_led: led-0 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&pio 11 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-1 {
+			color = <LED_COLOR_ID_ORANGE>;
+			function = LED_FUNCTION_WPS;
+			gpios = <&pio 12 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	virtual_flash {
+		compatible = "mtd-concat";
+		devices = <&firmware1 &firmware2>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "kernel";
+				reg = <0x0 0x600000>;
+			};
+
+			partition@400000 {
+				label = "ubi";
+				reg = <0x600000 0x0>;
+			};
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&eth {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio_pins>;
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+		phy-handle = <&phy10>;
+		label = "lan";
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_4 0>;
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "2500base-x";
+		phy-handle = <&phy11>;
+		label = "wan";
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_a 0>;
+	};
+};
+
+&mdio_bus {
+	phy10: ethernet-phy@a {
+		reg = <0xa>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_EDGE_FALLING>;
+		reset-gpios = <&pio 22 GPIO_ACTIVE_LOW>;
+		reset-assert-us = <10000>;
+		reset-deassert-us = <20000>;
+	};
+
+	phy11: ethernet-phy@b {
+		reg = <0xb>;
+		interrupt-parent = <&pio>;
+		interrupts = <23 IRQ_TYPE_EDGE_FALLING>;
+		reset-gpios = <&pio 27 GPIO_ACTIVE_LOW>;
+		reset-assert-us = <10000>;
+		reset-deassert-us = <20000>;
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	/* Winbond W25N01GVZEIG (128M) */
+	spi_nand@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+
+		spi-cal-enable;
+		spi-cal-mode = "read-data";
+		spi-cal-datalen = <7>;
+		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4e 0x41 0x4e 0x44>;
+		spi-cal-addrlen = <5>;
+		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
+
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			/* bl2 */
+			partition@0 {
+				label = "preloader";
+				reg = <0x0 0x80000>;
+				read-only;
+			};
+
+			/* fip */
+			partition@80000 {
+				label = "u-boot";
+				reg = <0x80000 0x200000>;
+				read-only;
+			};
+
+			partition@280000 {
+				label = "u-config";
+				reg = <0x280000 0x80000>;
+				read-only;
+			};
+
+			partition@300000 {
+				label = "rf-eeprom";
+				reg = <0x300000 0x200000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+
+					/* lan mac */
+					macaddr_factory_4: macaddr@4 {
+						compatible = "mac-base";
+						reg = <0x4 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+
+					/* wan mac */
+					macaddr_factory_a: macaddr@a {
+						compatible = "mac-base";
+						reg = <0xa 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+
+			firmware1: partition@500000 {
+				label = "firmware_1";
+				reg = <0x500000 0x3500000>;
+			};
+
+			partition@3a00000 {
+				label = "config_1";
+				reg = <0x3a00000 0x80000>;
+				read-only;
+			};
+
+			partition@3a80000 {
+				label = "dump";
+				reg = <0x3a80000 0x80000>;
+				read-only;
+			};
+
+			partition@3c00000 {
+				label = "u-state";
+				reg = <0x3c00000 0x20000>;
+				read-only;
+			};
+
+			partition@3e80000 {
+				label = "u-config_res";
+				reg = <0x3e80000 0x80000>;
+				read-only;
+			};
+
+			partition@3f00000 {
+				label = "rf-eeprom_res";
+				reg = <0x3f00000 0x200000>;
+				read-only;
+			};
+
+			firmware2: partition@4100000 {
+				label = "firmware_2";
+				reg = <0x4140000 0x3500000>;
+			};
+
+			partition@7600000 {
+				label = "config_2";
+				reg = <0x7600000 0x80000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&wifi {
+	nvmem-cell-names = "eeprom";
+	nvmem-cells = <&eeprom_factory_0>;
+	status = "okay";
+};
+
+&sgmiisys0 {
+	/delete-node/ mediatek,pnswap;
+};
diff --git a/target/linux/mediatek/dts/mt7981b-mercusys-mr80x-v3.dts b/target/linux/mediatek/dts/mt7981b-mercusys-mr80x-v3.dts
new file mode 100644
index 00000000000000..3bd59f75a62250
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-mercusys-mr80x-v3.dts
@@ -0,0 +1,237 @@
+// SPDX-License-Identifier: GPL-2.0
+
+/dts-v1/;
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+
+#include "mt7981.dtsi"
+/ {
+	model = "MERCUSYS MR80X v3";
+	compatible = "mercusys,mr80x-v3", "mediatek,mt7981";
+
+	aliases {
+		led-boot = &led_status_green;
+		led-failsafe = &led_status_amber;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_green;
+
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x20000000>;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_amber: led-0 {
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&pio 4 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_green: led-1 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&pio 5 GPIO_ACTIVE_LOW>;
+		};
+
+		led-2 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <1>;
+			gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+		};
+
+		led-3 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <2>;
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+		};
+
+		led-4 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		led-5 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <3>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "gmii";
+		phy-handle = <&int_gbe_phy>;
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		switch@1f {
+			compatible = "mediatek,mt7531";
+			reg = <31>;
+			reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@1 {
+					reg = <1>;
+					label = "lan1";
+				};
+
+				port@2 {
+					reg = <2>;
+					label = "lan2";
+				};
+
+				port@3 {
+					reg = <3>;
+					label = "lan3";
+				};
+
+				port@6 {
+					reg = <6>;
+					label = "cpu";
+					ethernet = <&gmac0>;
+					phy-mode = "2500base-x";
+
+					fixed-link {
+						speed = <2500>;
+						full-duplex;
+						pause;
+					};
+				};
+			};
+		};
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand: spi_nand@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "boot";
+				reg = <0x00000 0x0200000>;
+				read-only;
+			};
+
+			partition@200000 {
+				label = "u-boot-env";
+				reg = <0x0200000 0x0100000>;
+			};
+
+			partition@300000 {
+				label = "ubi0";
+				reg = <0x300000 0x3200000>;
+			};
+
+			partition@3500000 {
+				label = "ubi1";
+				reg = <0x3500000 0x3200000>;
+				read-only;
+			};
+
+			partition@6700000 {
+				label = "userconfig";
+				reg = <0x6700000 0x800000>;
+				read-only;
+			};
+
+			partition@6f00000 {
+				label = "tp_data";
+				reg = <0x6f00000 0x800000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&wifi {
+	status = "okay";
+};
diff --git a/target/linux/mediatek/dts/mt7981b-netis-nx31.dts b/target/linux/mediatek/dts/mt7981b-netis-nx31.dts
new file mode 100644
index 00000000000000..82f666df7944ea
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-netis-nx31.dts
@@ -0,0 +1,301 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+/dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "netis NX31";
+	compatible = "netis,nx31", "mediatek,mt7981";
+
+	aliases {
+		label-mac-device = &gmac0;
+
+		led-boot = &led_status_blue;
+		led-failsafe = &led_status_blue;
+		led-running = &led_status_blue;
+		led-upgrade = &led_status_blue;
+
+		serial0 = &uart0;
+	};
+
+	chosen {
+		rootdisk = <&ubi_fit_volume>;
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-0 {
+			label = "mesh";
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RFKILL>;
+			debounce-interval = <60>;
+		};
+
+		button-1 {
+			label = "reset";
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WLAN_2GHZ;
+			gpios = <&pio 5 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led_status_blue: led-1 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+		};
+
+		led-2 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&pio 8 GPIO_ACTIVE_LOW>;
+		};
+
+		led-3 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WLAN_5GHZ;
+			gpios = <&pio 34 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_1fef20 0>;
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "gmii";
+		phy-handle = <&int_gbe_phy>;
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_1fef26 0>;
+	};
+};
+
+&mdio_bus {
+	switch: switch@1f {
+		compatible = "mediatek,mt7531";
+		reg = <0x1f>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+
+		spi-cal-enable;
+		spi-cal-mode = "read-data";
+		spi-cal-datalen = <7>;
+		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4e 0x41 0x4e 0x44>;
+		spi-cal-addrlen = <5>;
+		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x0 0x100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env (unused)";
+				reg = <0x100000 0x80000>;
+				read-only;
+			};
+
+			partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x200000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+
+					macaddr_factory_4: macaddr@4 {
+						compatible = "mac-base";
+						reg = <0x4 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+
+					macaddr_factory_1fef20: macaddr@1fef20 {
+						compatible = "mac-base";
+						reg = <0x1fef20 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+
+					macaddr_factory_1fef26: macaddr@1fef26 {
+						compatible = "mac-base";
+						reg = <0x1fef26 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x380000 0x200000>;
+				read-only;
+			};
+			
+			partition@580000 {
+				label = "ubi";
+				reg = <0x580000 0x7a80000>;
+				compatible = "linux,ubi";
+
+				volumes {
+					ubi_fit_volume: ubi-volume-fit {
+						volname = "fit";
+					};
+
+					ubi_ubootenv: ubi-volume-ubootenv {
+						volname = "ubootenv";
+					};
+
+					ubi_ubootenv2: ubi-volume-ubootenv2 {
+						volname = "ubootenv2";
+					};
+				};
+			};
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@1 {
+			reg = <1>;
+			label = "lan3";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan2";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan1";
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&ubi_ubootenv {
+	nvmem-layout {
+		compatible = "u-boot,env-redundant-bool";
+	};
+};
+
+&ubi_ubootenv2 {
+	nvmem-layout {
+		compatible = "u-boot,env-redundant-bool";
+	};
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+	nvmem-cell-names = "eeprom";
+	nvmem-cells = <&eeprom_factory_0>;
+};
diff --git a/target/linux/mediatek/dts/mt7981b-openembed-som7981.dts b/target/linux/mediatek/dts/mt7981b-openembed-som7981.dts
index 0e9dea1ddb0ec1..d5c868567bddfa 100644
--- a/target/linux/mediatek/dts/mt7981b-openembed-som7981.dts
+++ b/target/linux/mediatek/dts/mt7981b-openembed-som7981.dts
@@ -12,9 +12,10 @@
 	compatible = "openembed,som7981", "mediatek,mt7981";
 
 	aliases {
-		led-boot = &wlan2g_led;
-		led-failsafe = &wlan2g_led;
-		led-upgrade = &wlan2g_led;
+		led-boot = &act_led;
+		led-failsafe = &act_led;
+		led-running = &act_led;
+		led-upgrade = &act_led;
 		serial0 = &uart0;
 	};
 
@@ -26,6 +27,11 @@
 		reg = <0 0x40000000 0 0x40000000>;
 	};
 
+	beeper {
+		compatible = "gpio-beeper";
+		gpios = <&pio 2 GPIO_ACTIVE_HIGH>;
+	};
+
 	gpio-keys {
 		compatible = "gpio-keys";
 
@@ -34,12 +40,6 @@
 			linux,code = <KEY_RESTART>;
 			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
 		};
-
-		button-wps {
-			label = "wps";
-			linux,code = <KEY_WPS_BUTTON>;
-			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
-		};
 	};
 
 	gpio-leds {
@@ -47,28 +47,27 @@
 
 		led-0 {
 			function = LED_FUNCTION_LAN;
-			color = <LED_COLOR_ID_AMBER>;
+			color = <LED_COLOR_ID_GREEN>;
 			gpios = <&pio 8 GPIO_ACTIVE_LOW>;
 		};
 
 		led-1 {
 			function = LED_FUNCTION_LAN;
-			color = <LED_COLOR_ID_GREEN>;
+			color = <LED_COLOR_ID_AMBER>;
 			gpios = <&pio 13 GPIO_ACTIVE_LOW>;
 		};
 
-		wlan2g_led: led-2 {
-			function = LED_FUNCTION_WLAN_2GHZ;
-			color = <LED_COLOR_ID_RED>;
+		led-2 {
+			function = LED_FUNCTION_PANIC;
+			color = <LED_COLOR_ID_GREEN>;
 			gpios = <&pio 34 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "phy0tpt";
+			panic-indicator;
 		};
 
-		led-3 {
-			function = LED_FUNCTION_WLAN_5GHZ;
+		act_led: led-3 {
+			function = LED_FUNCTION_ACTIVITY;
 			color = <LED_COLOR_ID_RED>;
 			gpios = <&pio 35 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "phy1tpt";
 		};
 	};
 };
@@ -97,14 +96,38 @@
 	};
 };
 
+&i2c0 {
+	clock-frequency = <400000>;
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c0_pins>;
+	status = "okay";
+
+	eeprom@50 {
+		compatible = "atmel,24c64";
+		reg = <0x50>;
+		page-size = <32>;
+	};
+
+	rtc@51 {
+		compatible = "nxp,pcf8563";
+		reg = <0x51>;
+		#clock-cells = <0>;
+	};
+
+	crypto@60 {
+		compatible = "atmel,atecc508a";
+		reg = <0x60>;
+	};
+};
+
 &mdio_bus {
 	phy0: ethernet-phy@5 {
 		reg = <5>;
 		compatible = "ethernet-phy-ieee802.3-c45";
 		phy-mode = "2500base-x";
 		reset-gpios = <&pio 14 GPIO_ACTIVE_LOW>;
-		reset-assert-us = <10000>;
-		reset-deassert-us = <50000>;
+		reset-assert-us = <15000>;
+		reset-deassert-us = <68000>;
 		realtek,aldps-enable;
 	};
 };
@@ -184,6 +207,13 @@
 };
 
 &pio {
+	i2c0_pins: i2c0-pins {
+		mux {
+			function = "i2c";
+			groups = "i2c0_1";
+		};
+	};
+
 	spi0_flash_pins: spi0-pins {
 		mux {
 			function = "spi";
@@ -202,12 +232,45 @@
 			mediatek,pull-down-adv = <0>;
 		};
 	};
+
+	uart1_pins: uart1-pins {
+		mux {
+			function = "uart";
+			groups = "uart1_3";
+		};
+	};
+
+	uart2_pins: uart2-pins {
+		mux {
+			function = "uart";
+			groups = "uart2_0_tx_rx";
+		};
+	};
+
+	wwan_rst_h: wwan-rst-h {
+		pins = "GPIO_WPS";
+		drive-strength = <8>;
+		mediatek,pull-down-adv = <0>;
+		output-low;
+	};
 };
 
 &uart0 {
 	status = "okay";
 };
 
+&uart1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart1_pins>;
+	status = "okay";
+};
+
+&uart2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&uart2_pins>;
+	status = "okay";
+};
+
 &usb_phy {
 	status = "okay";
 };
@@ -220,8 +283,16 @@
 	nvmem-cells = <&eeprom_factory_0>;
 	nvmem-cell-names = "eeprom";
 	status = "okay";
+
+	band@1 {
+		reg = <1>;
+		nvmem-cells = <&macaddr_factory_a 0>;
+		nvmem-cell-names = "mac-address";
+	};
 };
 
 &xhci {
+	pinctrl-names = "default";
+	pinctrl-0 = <&wwan_rst_h>;
 	status = "okay";
 };
diff --git a/target/linux/mediatek/dts/mt7981b-openfi-6c.dts b/target/linux/mediatek/dts/mt7981b-openfi-6c.dts
new file mode 100644
index 00000000000000..24de3545760ba3
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-openfi-6c.dts
@@ -0,0 +1,272 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+/dts-v1/;
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "OpenFi 6C";
+	compatible = "openfi,6c", "mediatek,mt7981";
+
+	aliases {
+		led-boot = &led_sys_green;
+		led-failsafe = &led_sys_green;
+		led-running = &led_sys_green;
+		led-upgrade = &led_sys_green;
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		mode {
+			label = "mode";
+			linux,input-type = <EV_SW>;
+			linux,code = <BTN_0>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		led_sys_green: led-0 {
+			function = LED_FUNCTION_STATUS;
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&pio 2 GPIO_ACTIVE_LOW>;
+		};
+
+		led-1 {
+			function = LED_FUNCTION_LAN;
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&pio 34 GPIO_ACTIVE_LOW>;
+		};
+
+		led-2 {
+			function = LED_FUNCTION_WLAN_5GHZ;
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&pio 35 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		led-3 {
+			function = LED_FUNCTION_MOBILE;
+			color = <LED_COLOR_ID_GREEN>;
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	gpio-export {
+		compatible = "gpio-export";
+
+		modem_power {
+			gpio-export,name = "modem_power";
+			gpio-export,output = <1>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		modem_reset {
+			gpio-export,name = "modem_reset";
+			gpio-export,output = <1>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+
+		modem_reset_2 {
+			gpio-export,name = "modem_reset_2";
+			gpio-export,output = <0>;
+			gpios = <&pio 12 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	usb_vbus: regulator-usb-vbus {
+		compatible = "regulator-fixed";
+		regulator-name = "usb_vbus";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpio = <&pio 8 GPIO_ACTIVE_LOW>;
+		regulator-boot-on;
+	};
+};
+
+&fan {
+	pwms = <&pwm 0 40000 0>;
+	status = "okay";
+};
+
+&eth {
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio_pins>;
+	status = "okay";
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "gmii";
+		phy-handle = <&int_gbe_phy>;
+		nvmem-cells = <&macaddr_factory_4 0>;
+		nvmem-cell-names = "mac-address";
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand: flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <0>;
+		spi-max-frequency = <52000000>;
+
+		spi-cal-enable;
+		spi-cal-mode = "read-data";
+		spi-cal-datalen = <7>;
+		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4E 0x41 0x4E 0x44>;
+		spi-cal-addrlen = <5>;
+		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
+
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x00000 0x0100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x0100000 0x0080000>;
+			};
+
+			factory: partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x0200000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+
+					macaddr_factory_4: macaddr@4 {
+						compatible = "mac-base";
+						reg = <0x4 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x380000 0x0200000>;
+				read-only;
+			};
+
+			partition@580000 {
+				label = "hw";
+				reg = <0x0580000 0x0080000>;
+				read-only;
+			};
+
+			partition@600000 {
+				label = "cfg";
+				reg = <0x0600000 0x0080000>;
+				read-only;
+			};
+
+			partition@680000 {
+				label = "ubi";
+				reg = <0x680000 0xe980000>;
+			};
+		};
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+	};
+
+	pwm_pins: pwm-pins {
+		mux {
+			function = "pwm";
+			groups = "pwm0_0", "pwm1_0";
+		};
+	};
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&xhci {
+	status = "okay";
+	vbus-supply = <&usb_vbus>;
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+	status = "okay";
+
+	band@0 {
+		reg = <0>;
+		nvmem-cells = <&macaddr_factory_4 2>;
+		nvmem-cell-names = "mac-address";
+	};
+
+	band@1 {
+		reg = <1>;
+		nvmem-cells = <&macaddr_factory_4 3>;
+		nvmem-cell-names = "mac-address";
+	};
+};
+
+&pwm {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pwm_pins>;
+	status = "okay";
+};
diff --git a/target/linux/mediatek/dts/mt7981b-openwrt-one.dts b/target/linux/mediatek/dts/mt7981b-openwrt-one.dts
index 46d351f76d09df..584b48217928ce 100644
--- a/target/linux/mediatek/dts/mt7981b-openwrt-one.dts
+++ b/target/linux/mediatek/dts/mt7981b-openwrt-one.dts
@@ -450,7 +450,7 @@
 
 	band@1 {
 		reg = <1>;
-		nvmem-cells = <&macaddr_factory_4 1>;
+		nvmem-cells = <&macaddr_factory_4 7>;
 		nvmem-cell-names = "mac-address";
 	};
 };
diff --git a/target/linux/mediatek/dts/mt7981b-routerich-ax3000-common.dtsi b/target/linux/mediatek/dts/mt7981b-routerich-ax3000-common.dtsi
new file mode 100644
index 00000000000000..f0b0b9365b68e3
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-routerich-ax3000-common.dtsi
@@ -0,0 +1,302 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+/dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+#include "mt7981.dtsi"
+
+/ {
+	aliases {
+		label-mac-device = &wan;
+
+		led-boot = &led_power_blue;
+		led-failsafe = &led_power_blue;
+		led-running = &led_power_blue;
+		led-upgrade = &led_power_blue;
+
+		serial0 = &uart0;
+	};
+
+	chosen: chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-0 {
+			label = "mesh";
+			linux,input-type = <EV_SW>;
+			linux,code = <BTN_0>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		button-1 {
+			label = "reset";
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <50>;
+			gpios = <&pio 5 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		led-1 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&pio 6 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_power_blue: led-2 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+		};
+
+		led-3 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <1>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		led-4 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <2>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+
+		led-5 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <3>;
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led-6 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&pio 12 GPIO_ACTIVE_LOW>;
+		};
+
+		led-7 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WLAN;
+			function-enumerator = <24>;
+			gpios = <&pio 34 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led-8 {
+			color = <LED_COLOR_ID_BLUE>;
+			/* LED_FUNCTION_MESH isn't implemented yet */
+			function = "mesh";
+			gpios = <&pio 35 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x10000000>;
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_4 (-1)>;
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+};
+
+&mdio_bus {
+	switch: switch@1f {
+		compatible = "mediatek,mt7531";
+		reg = <0x1f>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	/* ESMT F50L1G41LB (128M) */
+	spi: spi_nand@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+
+		spi-cal-enable;
+		spi-cal-mode = "read-data";
+		spi-cal-datalen = <7>;
+		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4e 0x41 0x4e 0x44>;
+		spi-cal-addrlen = <5>;
+		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
+
+		partitions: partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0_all {
+				label = "spi0.0";
+				reg = <0x0 0x8000000>;
+				read-only;
+			};
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x0 0x100000>;
+				read-only;
+			};
+
+			partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x200000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+
+					macaddr_factory_4: macaddr@4 {
+						compatible = "mac-base";
+						reg = <0x4 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x380000 0x200000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan2";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan3";
+		};
+
+		wan: port@4 {
+			reg = <4>;
+			label = "wan";
+
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_4 (-2)>;
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+	nvmem-cell-names = "eeprom";
+	nvmem-cells = <&eeprom_factory_0>;
+};
+
+&xhci {
+	status = "okay";
+	mediatek,u3p-dis-msk = <0x1>;
+};
diff --git a/target/linux/mediatek/dts/mt7981b-routerich-ax3000-ubootmod.dts b/target/linux/mediatek/dts/mt7981b-routerich-ax3000-ubootmod.dts
new file mode 100644
index 00000000000000..dfdb78936d8c46
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-routerich-ax3000-ubootmod.dts
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+#include "mt7981b-routerich-ax3000-common.dtsi"
+
+/ {
+	model = "Routerich AX3000 (OpenWrt U-Boot layout)";
+	compatible = "routerich,ax3000-ubootmod", "mediatek,mt7981";
+};
+
+&chosen {
+	rootdisk = <&ubi_fit_volume>;
+};
+
+&partitions {
+	partition@100000 {
+		label = "u-boot-env-orig";
+		reg = <0x100000 0x80000>;
+		read-only;
+	};
+
+	partition@580000 {
+		label = "ubi";
+		reg = <0x580000 0x7a80000>;
+		compatible = "linux,ubi";
+
+		volumes {
+			ubi_fit_volume: ubi-volume-fit {
+				volname = "fit";
+			};
+
+			ubi_ubootenv: ubi-volume-ubootenv {
+				volname = "ubootenv";
+			};
+
+			ubi_ubootenv2: ubi-volume-ubootenv2 {
+				volname = "ubootenv2";
+			};
+		};
+	};
+};
+
+&ubi_ubootenv {
+	nvmem-layout {
+		compatible = "u-boot,env-redundant-bool";
+	};
+};
+
+&ubi_ubootenv2 {
+	nvmem-layout {
+		compatible = "u-boot,env-redundant-bool";
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7981b-routerich-ax3000-v1.dts b/target/linux/mediatek/dts/mt7981b-routerich-ax3000-v1.dts
new file mode 100644
index 00000000000000..09c555b73c0502
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-routerich-ax3000-v1.dts
@@ -0,0 +1,337 @@
+// SPDX-License-Identifier: GPL-2.0-only OR MIT
+
+/dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "Routerich AX3000 v1";
+	compatible = "routerich,ax3000-v1", "mediatek,mt7981";
+
+	aliases {
+		label-mac-device = &gmac1;
+
+		led-boot = &led_power_blue;
+		led-failsafe = &led_power_blue;
+		led-running = &led_power_blue;
+		led-upgrade = &led_power_blue;
+
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-export {
+		compatible = "gpio-export";
+
+		gpio-0 {
+			gpio-export,name = "usb-enable";
+			gpio-export,output = <1>;
+			gpios = <&pio 14 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-0 {
+			label = "mesh";
+			/* Reassigned to RF_KILL */
+			linux,code = <KEY_RFKILL>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+		};
+
+		button-1 {
+			label = "reset";
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+			debounce-interval = <60>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WLAN_5GHZ;
+			gpios = <&pio 5 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		led-1 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&pio 6 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_power_blue: led-2 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+		};
+
+		led-3 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <1>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		led-4 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <2>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+
+		led-5 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <3>;
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led-6 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&pio 12 GPIO_ACTIVE_LOW>;
+		};
+
+		led-7 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_WLAN_2GHZ;
+			gpios = <&pio 34 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led-8 {
+			color = <LED_COLOR_ID_BLUE>;
+			/* LED_FUNCTION_MESH isn't implemented yet */
+			function = "mesh";
+			gpios = <&pio 35 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_4 (-1)>;
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "gmii";
+		phy-handle = <&int_gbe_phy>;
+
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_4 (-2)>;
+	};
+};
+
+&mdio_bus {
+	switch: switch@1f {
+		compatible = "mediatek,mt7531";
+		reg = <0x1f>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		compatible = "spi-nand";
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+
+		spi-cal-enable;
+		spi-cal-mode = "read-data";
+		spi-cal-datalen = <7>;
+		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4e 0x41 0x4e 0x44>;
+		spi-cal-addrlen = <5>;
+		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
+
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0_all {
+				label = "spi0.0";
+				reg = <0x0 0x8000000>;
+				read-only;
+			};
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x0 0x100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x100000 0x80000>;
+			};
+
+			partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x200000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+
+					macaddr_factory_4: macaddr@4 {
+						compatible = "mac-base";
+						reg = <0x4 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x380000 0x200000>;
+				read-only;
+			};
+
+			partition@580000 {
+				label = "ubi";
+				reg = <0x580000 0x7000000>;
+			};
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@1 {
+			reg = <1>;
+			label = "lan1";
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan2";
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan3";
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&pio {
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-up = <MTK_PUPD_SET_R1R0_11>;
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <MTK_DRIVE_8mA>;
+			bias-pull-down = <MTK_PUPD_SET_R1R0_11>;
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+	nvmem-cell-names = "eeprom";
+	nvmem-cells = <&eeprom_factory_0>;
+
+	ieee80211-freq-limit = <2400000 2500000>, <5170000 5835000>;
+
+	band@0 {
+		reg = <0>;
+		nvmem-cells = <&macaddr_factory_4 (0)>;
+		nvmem-cell-names = "mac-address";
+	};
+
+	band@1 {
+		reg = <1>;
+		nvmem-cells = <&macaddr_factory_4 (1)>;
+		nvmem-cell-names = "mac-address";
+	};
+};
+
+&xhci {
+	status = "okay";
+};
diff --git a/target/linux/mediatek/dts/mt7981b-routerich-ax3000.dts b/target/linux/mediatek/dts/mt7981b-routerich-ax3000.dts
index dfe44843b9df79..c0a10b3fc86bb0 100644
--- a/target/linux/mediatek/dts/mt7981b-routerich-ax3000.dts
+++ b/target/linux/mediatek/dts/mt7981b-routerich-ax3000.dts
@@ -1,118 +1,27 @@
 // SPDX-License-Identifier: GPL-2.0-only OR MIT
 
-/dts-v1/;
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
-#include <dt-bindings/leds/common.h>
-
-#include "mt7981.dtsi"
+#include "mt7981b-routerich-ax3000-common.dtsi"
 
 / {
 	model = "Routerich AX3000";
 	compatible = "routerich,ax3000", "mediatek,mt7981";
+};
 
-	aliases {
-		label-mac-device = &wan;
-
-		led-boot = &led_power_blue;
-		led-failsafe = &led_power_blue;
-		led-running = &led_power_blue;
-		led-upgrade = &led_power_blue;
-
-		serial0 = &uart0;
-	};
-
-	chosen {
-		stdout-path = "serial0:115200n8";
-	};
-
-	gpio-keys {
-		compatible = "gpio-keys";
-
-		button-0 {
-			label = "mesh";
-			linux,input-type = <EV_SW>;
-			linux,code = <BTN_0>;
-			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
-			debounce-interval = <60>;
-		};
-
-		button-1 {
-			label = "reset";
-			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
-			linux,code = <KEY_RESTART>;
-			debounce-interval = <60>;
-		};
-	};
-
-	leds {
-		compatible = "gpio-leds";
-
-		led-0 {
-			color = <LED_COLOR_ID_RED>;
-			function = LED_FUNCTION_WLAN;
-			function-enumerator = <50>;
-			gpios = <&pio 5 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "phy1tpt";
-		};
-
-		led-1 {
-			color = <LED_COLOR_ID_RED>;
-			function = LED_FUNCTION_WAN;
-			gpios = <&pio 6 GPIO_ACTIVE_HIGH>;
-		};
-
-		led_power_blue: led-2 {
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_POWER;
-			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
-		};
-
-		led-3 {
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_LAN;
-			function-enumerator = <1>;
-			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
-		};
-
-		led-4 {
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_LAN;
-			function-enumerator = <2>;
-			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
-		};
-
-		led-5 {
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_LAN;
-			function-enumerator = <3>;
-			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
-		};
-
-		led-6 {
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_WAN;
-			gpios = <&pio 12 GPIO_ACTIVE_LOW>;
-		};
-
-		led-7 {
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_WLAN;
-			function-enumerator = <24>;
-			gpios = <&pio 34 GPIO_ACTIVE_LOW>;
-			linux,default-trigger = "phy0tpt";
-		};
+&spi {
+	mediatek,nmbm;
+	mediatek,bmt-max-ratio = <1>;
+	mediatek,bmt-max-reserved-blocks = <64>;
+};
 
-		led-8 {
-			color = <LED_COLOR_ID_BLUE>;
-			/* LED_FUNCTION_MESH isn't implemented yet */
-			function = "mesh";
-			gpios = <&pio 35 GPIO_ACTIVE_LOW>;
-		};
+&partitions {
+	partition@100000 {
+		label = "u-boot-env";
+		reg = <0x100000 0x80000>;
 	};
 
-	memory {
-		reg = <0 0x40000000 0 0x10000000>;
+	partition@580000 {
+		label = "ubi";
+		reg = <0x580000 0x7000000>;
 	};
 };
 
@@ -226,25 +135,7 @@
 
 			partition@580000 {
 				label = "ubi";
-				reg = <0x580000 0x4000000>;
-			};
-
-			partition@4580000 {
-				label = "firmware_backup";
-				reg = <0x4580000 0x2000000>;
-				read-only;
-			};
-
-			partition@6580000 {
-				label = "zrsave";
-				reg = <0x6580000 0x100000>;
-				read-only;
-			};
-
-			partition@6680000 {
-				label = "config2";
-				reg = <0x6680000 0x100000>;
-				read-only;
+				reg = <0x580000 0x7000000>;
 			};
 		};
 	};
diff --git a/target/linux/mediatek/dts/mt7981b-wavlink-wl-wn573hx3.dts b/target/linux/mediatek/dts/mt7981b-wavlink-wl-wn573hx3.dts
new file mode 100644
index 00000000000000..ff222247a6aa26
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-wavlink-wl-wn573hx3.dts
@@ -0,0 +1,188 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+/dts-v1/;
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "WAVLINK WL-WN573HX3";
+	compatible = "wavlink,wl-wn573hx3", "mediatek,mt7981";
+
+	aliases {
+		label-mac-device = &wifi;
+
+		led-boot = &led_status_blue;
+		led-failsafe = &led_status_blue;
+		led-running = &led_status_blue;
+		led-upgrade = &led_status_blue;
+
+		serial0 = &uart0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			gpios = <&pio 9 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_blue: led-1 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&pio 13 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&eth {
+	pinctrl-names = "default";
+	pinctrl-0 = <&mdio_pins>;
+
+	status = "okay";
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "gmii";
+		phy-handle = <&int_gbe_phy>;
+		nvmem-cells = <&macaddr_hw_44e 0>;
+		nvmem-cell-names = "mac-address";
+	};
+};
+
+&spi0 {
+	status = "disabled";
+};
+
+&spi2 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi2_flash_pins>;
+	status = "okay";
+
+	flash@0 {
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@00000 {
+				label = "bl2";
+				reg = <0x00000 0x40000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "u-boot-env";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@50000 {
+				label = "factory";
+				reg = <0x50000 0xb0000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+				};
+			};
+
+			partition@100000 {
+				label = "fip";
+				reg = <0x100000 0x80000>;
+				read-only;
+			};
+
+			partition@f0000 {
+				compatible = "denx,fit";
+				label = "firmware";
+				reg = <0x180000 0xe00000>;
+			};
+
+			partition@f80000 {
+				label = "hw";
+				reg = <0xf80000 0x80000>;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_hw_44e: macaddr@44e {
+						compatible = "mac-base";
+						reg = <0x44e 0x11>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+		};
+	};
+};
+
+&pio {
+	spi2_flash_pins: spi2-pins {
+		mux {
+			function = "spi";
+			groups = "spi2", "spi2_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
+			drive-strength = <8>;
+			bias-pull-up = <103>;
+		};
+
+		conf-pd {
+			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
+			drive-strength = <8>;
+			bias-pull-down = <103>;
+		};
+	};
+};
+
+&wifi {
+	status = "okay";
+
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+};
diff --git a/target/linux/mediatek/dts/mt7981b-xiaomi-mi-router-ax3000t.dts b/target/linux/mediatek/dts/mt7981b-xiaomi-mi-router-ax3000t.dts
index cc0d44fdf5d48d..d4b11cbe048004 100644
--- a/target/linux/mediatek/dts/mt7981b-xiaomi-mi-router-ax3000t.dts
+++ b/target/linux/mediatek/dts/mt7981b-xiaomi-mi-router-ax3000t.dts
@@ -12,6 +12,7 @@
 	mediatek,nmbm;
 	mediatek,bmt-max-ratio = <1>;
 	mediatek,bmt-max-reserved-blocks = <64>;
+	mediatek,bmt-mtd-overridden-oobsize = <64>;
 };
 
 &partitions {
diff --git a/target/linux/mediatek/dts/mt7981b-xiaomi-mi-router-common.dtsi b/target/linux/mediatek/dts/mt7981b-xiaomi-mi-router-common.dtsi
index d6872395a9017a..511184d771b424 100644
--- a/target/linux/mediatek/dts/mt7981b-xiaomi-mi-router-common.dtsi
+++ b/target/linux/mediatek/dts/mt7981b-xiaomi-mi-router-common.dtsi
@@ -83,6 +83,11 @@
 		interrupt-parent = <&pio>;
 		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
 	};
+
+	mfd: mfd@1 {
+		compatible = "airoha,an8855-mfd";
+		reg = <1>;
+	};
 };
 
 &switch {
@@ -124,6 +129,181 @@
 	};
 };
 
+&mfd {
+	efuse {
+		compatible = "airoha,an8855-efuse";
+		#nvmem-cell-cells = <0>;
+
+		nvmem-layout {
+			compatible = "fixed-layout";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			shift_sel_port0_tx_a: shift-sel-port0-tx-a@c {
+				reg = <0xc 0x4>;
+			};
+
+			shift_sel_port0_tx_b: shift-sel-port0-tx-b@10 {
+				reg = <0x10 0x4>;
+			};
+
+			shift_sel_port0_tx_c: shift-sel-port0-tx-c@14 {
+				reg = <0x14 0x4>;
+			};
+
+			shift_sel_port0_tx_d: shift-sel-port0-tx-d@18 {
+				reg = <0x18 0x4>;
+			};
+
+			shift_sel_port1_tx_a: shift-sel-port1-tx-a@1c {
+				reg = <0x1c 0x4>;
+			};
+
+			shift_sel_port1_tx_b: shift-sel-port1-tx-b@20 {
+				reg = <0x20 0x4>;
+			};
+
+			shift_sel_port1_tx_c: shift-sel-port1-tx-c@24 {
+				reg = <0x24 0x4>;
+			};
+
+			shift_sel_port1_tx_d: shift-sel-port1-tx-d@28 {
+				reg = <0x28 0x4>;
+			};
+
+			shift_sel_port2_tx_a: shift-sel-port2-tx-a@2c {
+				reg = <0x2c 0x4>;
+			};
+
+			shift_sel_port2_tx_b: shift-sel-port2-tx-b@30 {
+				reg = <0x30 0x4>;
+			};
+
+			shift_sel_port2_tx_c: shift-sel-port2-tx-c@34 {
+				reg = <0x34 0x4>;
+			};
+
+			shift_sel_port2_tx_d: shift-sel-port2-tx-d@38 {
+				reg = <0x38 0x4>;
+			};
+
+			shift_sel_port3_tx_a: shift-sel-port3-tx-a@4c {
+				reg = <0x4c 0x4>;
+			};
+
+			shift_sel_port3_tx_b: shift-sel-port3-tx-b@50 {
+				reg = <0x50 0x4>;
+			};
+
+			shift_sel_port3_tx_c: shift-sel-port3-tx-c@54 {
+				reg = <0x54 0x4>;
+			};
+
+			shift_sel_port3_tx_d: shift-sel-port3-tx-d@58 {
+				reg = <0x58 0x4>;
+			};
+		};
+	};
+
+	ethernet-switch {
+		compatible = "airoha,an8855-switch";
+		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+		airoha,ext-surge;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@0 {
+				reg = <0>;
+				label = "wan";
+				phy-mode = "internal";
+				phy-handle = <&internal_phy1>;
+			};
+
+			port@1 {
+				reg = <1>;
+				label = "lan2";
+				phy-mode = "internal";
+				phy-handle = <&internal_phy2>;
+			};
+
+			port@2 {
+				reg = <2>;
+				label = "lan3";
+				phy-mode = "internal";
+				phy-handle = <&internal_phy3>;
+			};
+
+			port@3 {
+				reg = <3>;
+				label = "lan4";
+				phy-mode = "internal";
+				phy-handle = <&internal_phy4>;
+			};
+
+			port@5 {
+				reg = <5>;
+				label = "cpu";
+				ethernet = <&gmac0>;
+				phy-mode = "2500base-x";
+
+				fixed-link {
+					speed = <2500>;
+					full-duplex;
+					pause;
+				};
+			};
+		};
+	};
+
+	mdio {
+		compatible = "airoha,an8855-mdio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		internal_phy1: phy@1 {
+			reg = <1>;
+
+			nvmem-cells = <&shift_sel_port0_tx_a>,
+					<&shift_sel_port0_tx_b>,
+					<&shift_sel_port0_tx_c>,
+					<&shift_sel_port0_tx_d>;
+			nvmem-cell-names = "tx_a", "tx_b", "tx_c", "tx_d";
+		};
+
+		internal_phy2: phy@2 {
+			reg = <2>;
+
+			nvmem-cells = <&shift_sel_port1_tx_a>,
+					<&shift_sel_port1_tx_b>,
+					<&shift_sel_port1_tx_c>,
+					<&shift_sel_port1_tx_d>;
+			nvmem-cell-names = "tx_a", "tx_b", "tx_c", "tx_d";
+		};
+
+		internal_phy3: phy@3 {
+			reg = <3>;
+
+			nvmem-cells = <&shift_sel_port2_tx_a>,
+					<&shift_sel_port2_tx_b>,
+					<&shift_sel_port2_tx_c>,
+					<&shift_sel_port2_tx_d>;
+			nvmem-cell-names = "tx_a", "tx_b", "tx_c", "tx_d";
+		};
+
+		internal_phy4: phy@4 {
+			reg = <4>;
+
+			nvmem-cells = <&shift_sel_port3_tx_a>,
+					<&shift_sel_port3_tx_b>,
+					<&shift_sel_port3_tx_c>,
+					<&shift_sel_port3_tx_d>;
+			nvmem-cell-names = "tx_a", "tx_b", "tx_c", "tx_d";
+		};
+	};
+};
+
 &spi0 {
 	pinctrl-names = "default";
 	pinctrl-0 = <&spi0_flash_pins>;
@@ -135,6 +315,13 @@
 		compatible = "spi-nand";
 		reg = <0>;
 
+		spi-cal-enable;
+		spi-cal-mode = "read-data";
+		spi-cal-datalen = <7>;
+		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4e 0x41 0x4e 0x44>;
+		spi-cal-addrlen = <5>;
+		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
+
 		spi-max-frequency = <52000000>;
 		spi-tx-bus-width = <4>;
 		spi-rx-bus-width = <4>;
diff --git a/target/linux/mediatek/dts/mt7981b-yuncore-ax835.dts b/target/linux/mediatek/dts/mt7981b-yuncore-ax835.dts
index 5f98e6178aedff..b5de1c34b4457e 100644
--- a/target/linux/mediatek/dts/mt7981b-yuncore-ax835.dts
+++ b/target/linux/mediatek/dts/mt7981b-yuncore-ax835.dts
@@ -35,6 +35,7 @@
 		regulator-name = "led_vbus";
 		regulator-min-microvolt = <3300000>;
 		regulator-max-microvolt = <3300000>;
+		enable-active-high;
 		regulator-always-on;
 		gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
 	};
diff --git a/target/linux/mediatek/dts/mt7981b-zbtlink-zbt-z8102ax-v2.dts b/target/linux/mediatek/dts/mt7981b-zbtlink-zbt-z8102ax-v2.dts
new file mode 100644
index 00000000000000..08fc4b977a18f0
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7981b-zbtlink-zbt-z8102ax-v2.dts
@@ -0,0 +1,337 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT 
+
+/dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+
+#include "mt7981.dtsi"
+
+/ {
+	model = "ZBT Z8102AX V2";
+	compatible = "zbtlink,zbt-z8102ax-v2", "mediatek,mt7981";
+
+	aliases {
+		serial0 = &uart0;
+		led-boot = &led_status_red;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_green;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs = "earlycon=uart8250,mmio32,0x11002000 console=ttyS0,115200n8";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 0 GPIO_ACTIVE_LOW>;
+		};
+		
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_red: red {
+			gpios = <&pio 9 GPIO_ACTIVE_HIGH>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+		};
+
+		led_status_green: green {
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+		};
+		
+		led_status_blue: blue {
+			gpios = <&pio 11 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+		};
+		
+		led_status_5g1: 5g1 {
+			gpios = <&pio 8 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_USB;
+			function-enumerator = <0>;
+		};
+		
+		led_status_5g2: 5g2 {
+			gpios = <&pio 13 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_USB;
+			function-enumerator = <1>;
+		};
+	};
+
+	watchdog {
+		compatible = "linux,wdt-gpio";
+		gpios = <&pio 2 GPIO_ACTIVE_HIGH>;
+		hw_algo = "toggle";
+		hw_margin_ms = <1000>;
+	};
+
+	gpio-export {
+		compatible = "gpio-export";
+		#size-cells = <0>;
+
+		pcie {
+			gpio-export,name = "pcie_power";
+			gpio-export,output = <1>;
+			gpios = <&pio 3 GPIO_ACTIVE_HIGH>;
+		};
+
+		5g1 {
+			gpio-export,name = "5g1";
+			gpio-export,output = <1>;
+			gpios = <&pio 4 GPIO_ACTIVE_HIGH>;
+		};
+
+		5g2 {
+			gpio-export,name = "5g2";
+			gpio-export,output = <1>;
+			gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+		};
+
+		sim1 {
+			gpio-export,name = "sim1";
+			gpio-export,output = <0>;
+			gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+		};
+
+		sim2 {
+			gpio-export,name = "sim2";
+			gpio-export,output = <0>;
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+		nvmem-cell-names = "mac-address";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+	
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "gmii";
+		phy-handle = <&int_gbe_phy>;
+		nvmem-cell-names = "mac-address";
+		nvmem-cells = <&macaddr_factory_02a>;
+	};
+};
+
+&mdio_bus {
+	switch: switch@1f {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+		reset-gpios = <&pio 39 GPIO_ACTIVE_HIGH>;
+		interrupt-controller;
+		#interrupt-cells = <1>;
+		interrupt-parent = <&pio>;
+		interrupts = <38 IRQ_TYPE_LEVEL_HIGH>;
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi0_flash_pins>;
+	status = "okay";
+
+	spi_nand@0 {
+		compatible = "spi-nand";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-buswidth = <4>;
+		spi-rx-buswidth = <4>;
+
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "bl2";
+				reg = <0x0000000 0x0100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x0100000 0x0080000>;
+			};
+
+			factory: partition@180000 {
+				label = "Factory";
+				reg = <0x0180000 0x0200000>;
+				read-only;
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x0380000 0x0200000>;
+				read-only;
+			};
+
+			nand_rootfs: partition@580000 {
+				label = "ubi";
+				reg = <0x0580000 0x7220000>;
+			};
+		};
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		port@0 {
+			reg = <0>;
+			label = "lan1";
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_004>;
+		};
+
+		port@1 {
+			reg = <1>;
+			label = "lan2";
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_004>;
+		};
+
+		port@2 {
+			reg = <2>;
+			label = "lan3";
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_004>;
+		};
+
+		port@3 {
+			reg = <3>;
+			label = "lan4";
+			nvmem-cell-names = "mac-address";
+			nvmem-cells = <&macaddr_factory_004>;
+		};
+
+		port@6 {
+			reg = <6>;
+			label = "cpu";
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&pio {
+	gpio-line-names = 
+			"wps",
+			"reset",
+			"watchdog",
+			"pcie",
+			"5g1",
+			"5g2",
+			"sim1",
+			"sim2",
+			"5g1_status",
+			"red_status",
+			"green_status",
+			"blue_status",
+			"",
+			"5g2_status";
+
+	spi0_flash_pins: spi0-pins {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+
+		conf-pu {
+			pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>; /* bias-disable */
+		};
+
+		conf-pd {
+			pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>; /* bias-disable */
+		};
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&xhci {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+        nvmem-cells = <&eeprom_factory>;
+        nvmem-cell-names = "eeprom";
+};
+
+&factory {
+	compatible = "nvmem-cells";
+	#address-cells = <1>;
+	#size-cells = <1>;
+
+	macaddr_factory_004: macaddr@004 {
+		reg = <0x004 0x6>;
+	};
+	macaddr_factory_02a: macaddr@02a {
+		reg = <0x02a 0x6>;
+	};
+        eeprom_factory: eeprom@0 {
+		reg = <0x0 0x1000>;
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7986a-acer-predator-w6.dts b/target/linux/mediatek/dts/mt7986a-acer-predator-w6.dts
index c27264a8d2e84c..5002326d70fbce 100644
--- a/target/linux/mediatek/dts/mt7986a-acer-predator-w6.dts
+++ b/target/linux/mediatek/dts/mt7986a-acer-predator-w6.dts
@@ -1,549 +1,196 @@
-// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
 /dts-v1/;
-#include <dt-bindings/input/input.h>
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/leds/common.h>
-
-#include "mt7986a.dtsi"
+#include "mt7986a-acer-w6-common.dtsi"
 
 / {
-	model = "Acer Predator W6";
+	model = "Acer Predator Connect W6";
 	compatible = "acer,predator-w6", "mediatek,mt7986a";
 
 	aliases {
 		serial0 = &uart0;
-		led-boot = &led_status;
-		led-failsafe = &led_status;
-		led-running = &led_status;
-		led-upgrade = &led_status;
-	};
-
-	chosen {
-		stdout-path = "serial0:115200n8";
-		bootargs = "dm-mod.create=\"dm-verity,,,ro,0 31544 verity 1 PARTLABEL=rootfs PARTLABEL=rootfs 4096 4096 3943 3944 sha256 2f969fa9e9e4e20b37746f22633e85b178f5db7c143e11f92733a704299cc933 2dd56e34b15c6c84573cf26c4392028421061d2c808975217b45e9a5b49d2087\" rootfstype=squashfs,ext4 rootwait root=/dev/mmcblk0p6 fstools_ignore_partname=1";
-	};
-
-	memory {
-		reg = <0 0x40000000 0 0x20000000>;
+		led-boot = &led_status_blue;
+		led-failsafe = &led_status_blue;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_red;
 	};
 
-	reg_1p8v: regulator-1p8v {
-		compatible = "regulator-fixed";
-		regulator-name = "fixed-1.8V";
-		regulator-min-microvolt = <1800000>;
-		regulator-max-microvolt = <1800000>;
-		regulator-boot-on;
-		regulator-always-on;
-	};
-
-	reg_3p3v: regulator-3p3v {
-		compatible = "regulator-fixed";
-		regulator-name = "fixed-3.3V";
-		regulator-min-microvolt = <3300000>;
-		regulator-max-microvolt = <3300000>;
-		regulator-boot-on;
-		regulator-always-on;
-	};
-
-	reg_5v: regulator-5v {
-		compatible = "regulator-fixed";
-		regulator-name = "fixed-5V";
-		regulator-min-microvolt = <5000000>;
-		regulator-max-microvolt = <5000000>;
-		regulator-boot-on;
-		regulator-always-on;
-	};
-
-	gpio-keys {
-		compatible = "gpio-keys";
-
-		factory {
-			label = "factory";
-			linux,code = <KEY_RESTART>;
-			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
-		};
-
-		wps {
-			label = "wps";
-			linux,code = <KEY_WPS_BUTTON>;
-			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
-		};
-	};
-
-
 	leds {
 		compatible = "gpio-leds";
 
-		led_status: led@0 {
-			label = "ant0:red";
+		led_status_red: led-0 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <0>;
 			gpios = <&pio 1 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@1 {
-			label = "ant0:green";
+		led_status_green: led-1 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <0>;
 			gpios = <&pio 2 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@2 {
-			label = "ant0:blue";
+		led_status_blue: led-2 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <0>;
 			gpios = <&pio 36 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@3 {
-			label = "ant1:red";
+		led-3 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <1>;
 			gpios = <&pio 35 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@4 {
-			label = "ant1:green";
+		led-4 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <1>;
 			gpios = <&pio 34 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@5 {
-			label = "ant1:blue";
+		led-5 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <1>;
 			gpios = <&pio 33 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@6 {
-			label = "ant2:red";
+		led-6 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <2>;
 			gpios = <&pio 38 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@7 {
-			label = "ant2:green";
+		led-7 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <2>;
 			gpios = <&pio 37 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@8 {
-			label = "ant2:blue";
+		led-8 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <2>;
 			gpios = <&pio 26 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@9 {
-			label = "ant3:red";
+		led-9 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <3>;
 			gpios = <&pio 25 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@10 {
-			label = "ant3:green";
+		led-10 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <3>;
 			gpios = <&pio 24 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@11 {
-			label = "ant3:blue";
+		led-11 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <3>;
 			gpios = <&pio 23 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@12 {
-			label = "ant4:red";
+		led-12 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <4>;
 			gpios = <&pio 28 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@13 {
-			label = "ant4:green";
+		led-13 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <4>;
 			gpios = <&pio 27 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@14 {
-			label = "ant4:blue";
+		led-14 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <4>;
 			gpios = <&pio 32 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@15 {
-			label = "ant5:red";
+		led-15 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <5>;
 			gpios = <&pio 45 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@16 {
-			label = "ant5:green";
+		led-16 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <5>;
 			gpios = <&pio 44 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 
-		led@17 {
-			label = "ant5:blue";
+		led-17 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <5>;
 			gpios = <&pio 43 GPIO_ACTIVE_HIGH>;
-			default-state = "off";
 		};
 	};
-
 };
 
-&eth {
+&ssusb {
+	vusb33-supply = <&reg_3p3v>;
+	vbus-supply = <&reg_5v>;
 	status = "okay";
+};
 
-	gmac0: mac@0 {
-		/* LAN */
-		compatible = "mediatek,eth-mac";
-		reg = <0>;
-		phy-mode = "2500base-x";
+&nvmem {
+	eeprom_factory_a0000: eeprom@a0000 {
+		reg = <0xa0000 0x1000>;
+	};
+};
 
-		fixed-link {
-			speed = <2500>;
-			full-duplex;
-			pause;
-		};
+&slot0 {
+	radio0: mt7915@0,0 {
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&eeprom_factory_a0000>;
+		nvmem-cell-names = "eeprom";
 	};
+};
 
+&usb_phy {
+	status = "okay";
+};
+
+&eth {
 	gmac1: mac@1 {
-		/* WAN */
 		compatible = "mediatek,eth-mac";
 		reg = <1>;
 		phy-mode = "2500base-x";
 		phy-handle = <&phy6>;
 	};
-
-	mdio: mdio-bus {
-		#address-cells = <1>;
-		#size-cells = <0>;
-	};
 };
 
 &mdio {
 	phy6: phy@6 {
 		compatible = "ethernet-phy-ieee802.3-c45";
 		reg = <6>;
-
 		reset-gpios = <&pio 6 GPIO_ACTIVE_LOW>;
 		reset-assert-us = <10000>;
 		reset-deassert-us = <10000>;
-
-		/* LED0: nc ; LED1: nc ; LED2: Amber ; LED3: Green */
-		mxl,led-config = <0x0 0x0 0x370 0x80>;
-	};
-
-	switch: switch@1f {
-		compatible = "mediatek,mt7531";
-		reg = <31>;
-
-		reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
-		reset-assert-us = <10000>;
-		reset-deassert-us = <10000>;
-	};
-};
-
-&pio {
-	mmc0_pins_default: mmc0-pins {
-		mux {
-			function = "emmc";
-			groups = "emmc_51";
-		};
-		conf-cmd-dat {
-			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
-			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
-			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
-			input-enable;
-			drive-strength = <4>;
-			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
-		};
-		conf-clk {
-			pins = "EMMC_CK";
-			drive-strength = <6>;
-			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
-		};
-		conf-ds {
-			pins = "EMMC_DSL";
-			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
-		};
-		conf-rst {
-			pins = "EMMC_RSTB";
-			drive-strength = <4>;
-			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
-		};
-	};
-
-	mmc0_pins_uhs: mmc0-uhs-pins {
-		mux {
-			function = "emmc";
-			groups = "emmc_51";
-		};
-		conf-cmd-dat {
-			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
-			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
-			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
-			input-enable;
-			drive-strength = <4>;
-			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
-		};
-		conf-clk {
-			pins = "EMMC_CK";
-			drive-strength = <6>;
-			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
-		};
-		conf-ds {
-			pins = "EMMC_DSL";
-			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
-		};
-		conf-rst {
-			pins = "EMMC_RSTB";
-			drive-strength = <4>;
-			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
-		};
-	};
-
-	pcie_pins: pcie-pins {
-		mux {
-			function = "pcie";
-			groups = "pcie_pereset";
-		};
-	};
-
-	wf_2g_5g_pins: wf_2g_5g-pins {
-		mux {
-			function = "wifi";
-			groups = "wf_2g", "wf_5g";
-		};
-		conf {
-			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
-			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
-			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
-			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
-			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
-			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
-			       "WF1_TOP_CLK", "WF1_TOP_DATA";
-			drive-strength = <4>;
-		};
-	};
-
-	wf_dbdc_pins: wf-dbdc-pins {
-		mux {
-			function = "wifi";
-			groups = "wf_dbdc";
-		};
-		conf {
-			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
-				"WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
-				"WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
-				"WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
-				"WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
-				"WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
-				"WF1_TOP_CLK", "WF1_TOP_DATA";
-			drive-strength = <4>;
-		};
+		/* LED0: nc ; LED1: nc ; LED2: amber ; LED3: green */
+		mxl,led-config = <0x0 0x0 0x370 0x380>;
 	};
 };
 
-&switch {
-	ports {
-		#address-cells = <1>;
-		#size-cells = <0>;
-
-		port@0 {
-			reg = <0>;
-			label = "game";
-			phy-handle = <&swphy0>;
-		};
-
-		port@1 {
-			reg = <1>;
-			label = "lan1";
-			phy-handle = <&swphy1>;
-		};
-
-		port@2 {
-			reg = <2>;
-			label = "lan2";
-			phy-handle = <&swphy2>;
-		};
-
-		port@3 {
-			reg = <3>;
-			label = "lan3";
-			phy-handle = <&swphy3>;
-		};
-
-		port@6 {
-			reg = <6>;
-			label = "cpu";
-			ethernet = <&gmac0>;
-			phy-mode = "2500base-x";
-
-			fixed-link {
-				speed = <2500>;
-				full-duplex;
-				pause;
-			};
-		};
-	};
-
-	mdio {
-		#address-cells = <1>;
-		#size-cells = <0>;
-
-		swphy0: phy@0 {
-			reg = <0>;
-
-			mediatek,led-config = <
-				0x21 0x8009 /* BASIC_CTRL */
-				0x22 0x0c00 /* ON_DURATION */
-				0x23 0x1400 /* BLINK_DURATION */
-				0x24 0xc001 /* LED0_ON_CTRL */
-				0x25 0x0000 /* LED0_BLINK_CTRL */
-				0x26 0xc007 /* LED1_ON_CTRL */
-				0x27 0x003f /* LED1_BLINK_CTRL */
-			>;
-		};
-
-		swphy1: phy@1 {
-			reg = <1>;
-
-			mediatek,led-config = <
-				0x21 0x8009 /* BASIC_CTRL */
-				0x22 0x0c00 /* ON_DURATION */
-				0x23 0x1400 /* BLINK_DURATION */
-				0x24 0xc001 /* LED0_ON_CTRL */
-				0x25 0x0000 /* LED0_BLINK_CTRL */
-				0x26 0xc007 /* LED1_ON_CTRL */
-				0x27 0x003f /* LED1_BLINK_CTRL */
-			>;
-		};
-
-		swphy2: phy@2 {
-			reg = <2>;
-
-			mediatek,led-config = <
-				0x21 0x8009 /* BASIC_CTRL */
-				0x22 0x0c00 /* ON_DURATION */
-				0x23 0x1400 /* BLINK_DURATION */
-				0x24 0xc001 /* LED0_ON_CTRL */
-				0x25 0x0000 /* LED0_BLINK_CTRL */
-				0x26 0xc007 /* LED1_ON_CTRL */
-				0x27 0x003f /* LED1_BLINK_CTRL */
-			>;
-		};
-
-		swphy3: phy@3 {
-			reg = <3>;
-
-			mediatek,led-config = <
-				0x21 0x8009 /* BASIC_CTRL */
-				0x22 0x0c00 /* ON_DURATION */
-				0x23 0x1400 /* BLINK_DURATION */
-				0x24 0xc001 /* LED0_ON_CTRL */
-				0x25 0x0000 /* LED0_BLINK_CTRL */
-				0x26 0xc007 /* LED1_ON_CTRL */
-				0x27 0x003f /* LED1_BLINK_CTRL */
-			>;
-		};
-	};
-};
-
-&wifi {
-	nvmem-cells = <&eeprom_factory_0>;
-	nvmem-cell-names = "eeprom";
-	pinctrl-names = "default", "dbdc";
-	pinctrl-0 = <&wf_2g_5g_pins>;
-	pinctrl-1 = <&wf_dbdc_pins>;
-	status = "okay";
-};
-
-&trng {
-	status = "okay";
-};
-
-&watchdog {
-	status = "okay";
-};
-
-&crypto {
-	status = "okay";
-};
-
-&uart0 {
-	status = "okay";
-};
-
-&ssusb {
-	vusb33-supply = <&reg_3p3v>;
-	vbus-supply = <&reg_5v>;
-	status = "okay";
-};
-
-&usb_phy {
-	status = "okay";
-};
-
-&mmc0 {
-	status = "okay";
-	pinctrl-names = "default", "state_uhs";
-	pinctrl-0 = <&mmc0_pins_default>;
-	pinctrl-1 = <&mmc0_pins_uhs>;
-	bus-width = <0x08>;
-	max-frequency = <200000000>;
-	cap-mmc-highspeed;
-	mmc-hs200-1_8v;
-	mmc-hs400-1_8v;
-	hs400-ds-delay = <0x14014>;
-	vmmc-supply = <&reg_3p3v>;
-	vqmmc-supply = <&reg_1p8v>;
-	non-removable;
-	no-sd;
-	no-sdio;
-
-	card@0 {
-		compatible = "mmc-card";
-		reg = <0>;
-
-		block {
-			compatible = "block-device";
-
-			partitions {
-				block-partition-factory {
-					partname = "factory";
-
-					nvmem-layout {
-						compatible = "fixed-layout";
-						#address-cells = <1>;
-						#size-cells = <1>;
-
-						eeprom_factory_0: eeprom@0 {
-							reg = <0x0 0x1000>;
-						};
-
-						eeprom_factory_a0000: eeprom@a0000 {
-							reg = <0xa0000 0x1000>;
-						};
-					};
-				};
-			};
-		};
-	};
-};
-
-&pcie {
-	pinctrl-names = "default";
-	pinctrl-0 = <&pcie_pins>;
-	status = "okay";
-
-	slot0: pcie@0,0 {
-		reg = <0x0000 0 0 0 0>;
-
-		radio0: mt7915@0,0 {
-			reg = <0x0000 0 0 0 0>;
-
-			nvmem-cells = <&eeprom_factory_a0000>;
-			nvmem-cell-names = "eeprom";
-		};
-	};
-};
-
-&pcie_phy {
-	status = "okay";
+&swport0 {
+	label = "game";
 };
diff --git a/target/linux/mediatek/dts/mt7986a-acer-predator-w6d.dts b/target/linux/mediatek/dts/mt7986a-acer-predator-w6d.dts
new file mode 100644
index 00000000000000..b2c35a61974921
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-acer-predator-w6d.dts
@@ -0,0 +1,182 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include "mt7986a-acer-w6-common.dtsi"
+
+/ {
+	model = "Acer Predator Connect W6d";
+	compatible = "acer,predator-w6d", "mediatek,mt7986a";
+
+	aliases {
+		serial0 = &uart0;
+		led-boot = &led_status_blue;
+		led-failsafe = &led_status_blue;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_red;
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_red: led-0 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <0>;
+			gpios = <&pio 1 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_green: led-1 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <0>;
+			gpios = <&pio 2 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_blue: led-2 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <0>;
+			gpios = <&pio 36 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-3 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <1>;
+			gpios = <&pio 35 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-4 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <1>;
+			gpios = <&pio 34 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-5 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <1>;
+			gpios = <&pio 33 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-6 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <2>;
+			gpios = <&pio 38 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-7 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <2>;
+			gpios = <&pio 37 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-8 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <2>;
+			gpios = <&pio 26 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-9 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <3>;
+			gpios = <&pio 25 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-10 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <3>;
+			gpios = <&pio 24 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-11 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <3>;
+			gpios = <&pio 23 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-12 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <4>;
+			gpios = <&pio 28 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-13 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <4>;
+			gpios = <&pio 27 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-14 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <4>;
+			gpios = <&pio 32 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-15 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <5>;
+			gpios = <&pio 45 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-16 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <5>;
+			gpios = <&pio 44 GPIO_ACTIVE_HIGH>;
+		};
+
+		led-17 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			function-enumerator = <5>;
+			gpios = <&pio 43 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&ssusb {
+	vusb33-supply = <&reg_3p3v>;
+	vbus-supply = <&reg_5v>;
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&eth {
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "2500base-x";
+		phy-handle = <&phy6>;
+	};
+};
+
+&mdio {
+	phy6: phy@6 {
+		compatible = "ethernet-phy-ieee802.3-c45";
+		reg = <6>;
+		reset-gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+		reset-assert-us = <10000>;
+		reset-deassert-us = <10000>;
+		/* LED0: nc ; LED1: nc ; LED2: amber ; LED3: green */
+		mxl,led-config = <0x0 0x0 0x370 0x380>;
+	};
+};
+
+&swport0 {
+	label = "game";
+};
diff --git a/target/linux/mediatek/dts/mt7986a-acer-vero-w6m.dts b/target/linux/mediatek/dts/mt7986a-acer-vero-w6m.dts
new file mode 100644
index 00000000000000..7927efcb003cae
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-acer-vero-w6m.dts
@@ -0,0 +1,66 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include "mt7986a-acer-w6-common.dtsi"
+
+/ {
+	model = "Acer Connect Vero W6m";
+	compatible = "acer,vero-w6m", "mediatek,mt7986a";
+
+	aliases {
+		serial0 = &uart0;
+		led-boot = &led_status;
+		led-failsafe = &led_status;
+		led-running = &led_status;
+		led-upgrade = &led_status;
+	};
+};
+
+&i2c0 {
+	led-controller@30 {
+		compatible = "kinetic,ktd2026";
+		reg = <0x30>;
+		vin-supply = <&reg_5v>;
+		vio-supply = <&reg_3p3v>;
+
+		led_status: multi-led {
+			color = <LED_COLOR_ID_RGB>;
+			function = LED_FUNCTION_STATUS;
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			led@0 {
+				reg = <0>;
+				color = <LED_COLOR_ID_RED>;
+			};
+
+			led@1 {
+				reg = <1>;
+				color = <LED_COLOR_ID_GREEN>;
+			};
+
+			led@2 {
+				reg = <2>;
+				color = <LED_COLOR_ID_BLUE>;
+			};
+		};
+	};
+};
+
+&nvmem {
+	eeprom_factory_a0000: eeprom@a0000 {
+		reg = <0xa0000 0x1000>;
+	};
+};
+
+&slot0 {
+	radio0: mt7915@0,0 {
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&eeprom_factory_a0000>;
+		nvmem-cell-names = "eeprom";
+	};
+};
+
+&swport0 {
+       label = "internet";
+};
diff --git a/target/linux/mediatek/dts/mt7986a-acer-w6-common.dtsi b/target/linux/mediatek/dts/mt7986a-acer-w6-common.dtsi
new file mode 100644
index 00000000000000..03913f04e101cd
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-acer-w6-common.dtsi
@@ -0,0 +1,400 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+#include "mt7986a.dtsi"
+
+/ {
+	chosen {
+		stdout-path = "serial0:115200n8";
+		bootargs = "dm-mod.create=\"acer,,,ro,0 1 zero 1 0 0 0\" rootfstype=squashfs,ext4 rootwait root=/dev/mmcblk0p6 fstools_ignore_partname=1";
+	};
+
+	memory@0 {
+		reg = <0 0x40000000 0 0x20000000>;
+	};
+
+	reg_1p8v: regulator-1p8v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-1.8V";
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_5v: regulator-5v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-5V";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		factory {
+			label = "factory";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&pio {
+	mmc0_pins_default: mmc0-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <6>;
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+
+		conf-ds {
+			pins = "EMMC_DSL";
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+	};
+
+	mmc0_pins_uhs: mmc0-uhs-pins {
+		mux {
+			function = "emmc";
+			groups = "emmc_51";
+		};
+
+		conf-cmd-dat {
+			pins = "EMMC_DATA_0", "EMMC_DATA_1", "EMMC_DATA_2",
+			       "EMMC_DATA_3", "EMMC_DATA_4", "EMMC_DATA_5",
+			       "EMMC_DATA_6", "EMMC_DATA_7", "EMMC_CMD";
+			input-enable;
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+
+		conf-clk {
+			pins = "EMMC_CK";
+			drive-strength = <6>;
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+
+		conf-ds {
+			pins = "EMMC_DSL";
+			mediatek,pull-down-adv = <2>;	/* pull-down 50K */
+		};
+
+		conf-rst {
+			pins = "EMMC_RSTB";
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <1>;	/* pull-up 10K */
+		};
+	};
+
+	pcie_pins: pcie-pins {
+		mux {
+			function = "pcie";
+			groups = "pcie_pereset";
+		};
+	};
+
+	wf_2g_5g_pins: wf_2g_5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+
+	wf_dbdc_pins: wf-dbdc-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_dbdc";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+				"WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+				"WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+				"WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+				"WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+				"WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+				"WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+
+	i2c_pins: i2c-pins {
+		mux {
+			function = "i2c";
+			groups = "i2c";
+		};
+	};
+};
+
+&trng {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&i2c0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c_pins>;
+	status = "okay";
+};
+
+&mmc0 {
+	status = "okay";
+	pinctrl-names = "default", "state_uhs";
+	pinctrl-0 = <&mmc0_pins_default>;
+	pinctrl-1 = <&mmc0_pins_uhs>;
+	bus-width = <0x08>;
+	max-frequency = <200000000>;
+	cap-mmc-highspeed;
+	mmc-hs200-1_8v;
+	mmc-hs400-1_8v;
+	hs400-ds-delay = <0x14014>;
+	vmmc-supply = <&reg_3p3v>;
+	vqmmc-supply = <&reg_1p8v>;
+	non-removable;
+	no-sd;
+	no-sdio;
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	card@0 {
+		compatible = "mmc-card";
+		reg = <0>;
+
+		block {
+			compatible = "block-device";
+
+			partitions {
+				block-partition-factory {
+					partname = "factory";
+
+					nvmem: nvmem-layout {
+						compatible = "fixed-layout";
+						#address-cells = <1>;
+						#size-cells = <1>;
+
+						eeprom_factory_0: eeprom@0 {
+							reg = <0x0 0x1000>;
+						};
+					};
+				};
+			};
+		};
+	};
+};
+
+&pcie {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pcie_pins>;
+	status = "okay";
+
+	slot0: pcie@0,0 {
+		reg = <0x0000 0 0 0 0>;
+		#address-cells = <0x03>; 
+		#size-cells = <0x02>;
+	};
+};
+
+&pcie_phy {
+	status = "okay";
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		switch: switch@1f {
+			compatible = "mediatek,mt7531";
+			reg = <31>;
+			reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+			reset-assert-us = <10000>;
+			reset-deassert-us = <10000>;
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				swport0: port@0 {
+					reg = <0>;
+					phy-handle = <&swphy0>;
+				};
+
+				port@1 {
+					reg = <1>;
+					label = "lan1";
+					phy-handle = <&swphy1>;
+				};
+
+				port@2 {
+					reg = <2>;
+					label = "lan2";
+					phy-handle = <&swphy2>;
+				};
+
+				port@3 {
+					reg = <3>;
+					label = "lan3";
+					phy-handle = <&swphy3>;
+				};
+
+				port@6 {
+					reg = <6>;
+					label = "cpu";
+					ethernet = <&gmac0>;
+					phy-mode = "2500base-x";
+
+					fixed-link {
+						speed = <2500>;
+						full-duplex;
+						pause;
+					};
+				};
+			};
+
+			mdio {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				swphy0: phy@0 {
+					reg = <0>;
+
+					mediatek,led-config = <
+						0x21 0x8008 /* BASIC_CTRL */
+						0x22 0x0c00 /* ON_DURATION */
+						0x23 0x1400 /* BLINK_DURATION */
+						0x24 0xc001 /* LED0_ON_CTRL */
+						0x25 0x0003 /* LED0_BLINK_CTRL */
+						0x26 0xc006 /* LED1_ON_CTRL */
+						0x27 0x003c /* LED1_BLINK_CTRL */
+					>;
+				};
+
+				swphy1: phy@1 {
+					reg = <1>;
+
+					mediatek,led-config = <
+						0x21 0x8008 /* BASIC_CTRL */
+						0x22 0x0c00 /* ON_DURATION */
+						0x23 0x1400 /* BLINK_DURATION */
+						0x24 0xc001 /* LED0_ON_CTRL */
+						0x25 0x0003 /* LED0_BLINK_CTRL */
+						0x26 0xc006 /* LED1_ON_CTRL */
+						0x27 0x003c /* LED1_BLINK_CTRL */
+					>;
+				};
+
+				swphy2: phy@2 {
+					reg = <2>;
+
+					mediatek,led-config = <
+						0x21 0x8008 /* BASIC_CTRL */
+						0x22 0x0c00 /* ON_DURATION */
+						0x23 0x1400 /* BLINK_DURATION */
+						0x24 0xc001 /* LED0_ON_CTRL */
+						0x25 0x0003 /* LED0_BLINK_CTRL */
+						0x26 0xc006 /* LED1_ON_CTRL */
+						0x27 0x003c /* LED1_BLINK_CTRL */
+					>;
+				};
+
+				swphy3: phy@3 {
+					reg = <3>;
+
+					mediatek,led-config = <
+						0x21 0x8008 /* BASIC_CTRL */
+						0x22 0x0c00 /* ON_DURATION */
+						0x23 0x1400 /* BLINK_DURATION */
+						0x24 0xc001 /* LED0_ON_CTRL */
+						0x25 0x0003 /* LED0_BLINK_CTRL */
+						0x26 0xc006 /* LED1_ON_CTRL */
+						0x27 0x003c /* LED1_BLINK_CTRL */
+					>;
+				};
+			};
+		};
+	};
+};
+
+&wifi {
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+	pinctrl-names = "default", "dbdc";
+	pinctrl-0 = <&wf_2g_5g_pins>;
+	pinctrl-1 = <&wf_dbdc_pins>;
+	status = "okay";
+};
diff --git a/target/linux/mediatek/dts/mt7986a-asus-rt-ax59u.dts b/target/linux/mediatek/dts/mt7986a-asus-rt-ax59u.dts
index 0034ad8284b1bd..7e0c05618f5e25 100644
--- a/target/linux/mediatek/dts/mt7986a-asus-rt-ax59u.dts
+++ b/target/linux/mediatek/dts/mt7986a-asus-rt-ax59u.dts
@@ -210,7 +210,7 @@
 	status = "okay";
 
 	spi_nand: flash@0 {
-		compatible = "spi-nand";
+		compatible = "u-boot-dont-touch-spi-nand";
 		reg = <0>;
 		#address-cells = <1>;
 		#size-cells = <1>;
@@ -224,7 +224,7 @@
 		 * Device Tree and by that also deletes all additional properties
 		 * needed for UBI and NVMEM-on-UBI.
 		 * Prevent this from happening by tricking the loader to delete and
-		 * replace a bait node instead.
+		 * replace a bait node instead (works with older bootloaders).
 		 */
 		partitions: dummy {
 			compatible = "u-boot-dummy-partitions";
diff --git a/target/linux/mediatek/dts/mt7986a-asus-tuf-ax4200.dts b/target/linux/mediatek/dts/mt7986a-asus-tuf-ax4200.dts
index e40602fa215e1a..4ed65a8ee708a7 100644
--- a/target/linux/mediatek/dts/mt7986a-asus-tuf-ax4200.dts
+++ b/target/linux/mediatek/dts/mt7986a-asus-tuf-ax4200.dts
@@ -209,7 +209,7 @@
 	status = "okay";
 
 	spi_nand_flash: flash@0 {
-		compatible = "spi-nand";
+		compatible = "u-boot-dont-touch-spi-nand";
 		#address-cells = <1>;
 		#size-cells = <1>;
 		reg = <0>;
@@ -223,7 +223,7 @@
 		 * Device Tree and by that also deletes all additional properties
 		 * needed for UBI and NVMEM-on-UBI.
 		 * Prevent this from happening by tricking the loader to delete and
-		 * replace a bait node instead.
+		 * replace a bait node instead (works with older bootloaders).
 		 */
 		partitions: dummy {
 			compatible = "u-boot-dummy-partitions";
diff --git a/target/linux/mediatek/dts/mt7986a-asus-tuf-ax6000.dts b/target/linux/mediatek/dts/mt7986a-asus-tuf-ax6000.dts
index 957d8deebb192a..9a0f7594c92c24 100644
--- a/target/linux/mediatek/dts/mt7986a-asus-tuf-ax6000.dts
+++ b/target/linux/mediatek/dts/mt7986a-asus-tuf-ax6000.dts
@@ -231,7 +231,7 @@
 	status = "okay";
 
 	spi_nand_flash: flash@0 {
-		compatible = "spi-nand";
+		compatible = "u-boot-dont-touch-spi-nand";
 		reg = <0>;
 		#address-cells = <1>;
 		#size-cells = <1>;
@@ -245,7 +245,7 @@
 		 * Device Tree and by that also deletes all additional properties
 		 * needed for UBI and NVMEM-on-UBI.
 		 * Prevent this from happening by tricking the loader to delete and
-		 * replace a bait node instead.
+		 * replace a bait node instead (works with older bootloaders).
 		 */
 		partitions: dummy {
 			compatible = "u-boot-dummy-partitions";
diff --git a/target/linux/mediatek/dts/mt7986a-dlink-aquila-pro-ai-m60-a1.dts b/target/linux/mediatek/dts/mt7986a-dlink-aquila-pro-ai-m60-a1.dts
new file mode 100644
index 00000000000000..e805554a134b7a
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-dlink-aquila-pro-ai-m60-a1.dts
@@ -0,0 +1,378 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+/dts-v1/;
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+#include "mt7986a.dtsi"
+
+/ {
+	model = "D-Link AQUILA PRO AI M60 A1";
+	compatible = "dlink,aquila-pro-ai-m60-a1", "mediatek,mt7986a";
+
+	aliases {
+		serial0 = &uart0;
+		led-boot = &led_status_white;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_white;
+		led-upgrade = &led_status_blue;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	memory@40000000 {
+		reg = <0 0x40000000 0 0x20000000>;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		button-wps {
+			label = "wps";
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		button-leds-on-off {
+			label = "leds-on-off";
+			linux,code = <KEY_LIGHTS_TOGGLE>;
+			gpios = <&pio 47 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		nvmem-cells = <&macaddr_odm 1>;
+		nvmem-cell-names = "mac-address";
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "2500base-x";
+		phy-handle = <&phy6>;
+		nvmem-cells = <&macaddr_odm 0>;
+		nvmem-cell-names = "mac-address";
+		label = "internet";
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		reset-gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+		reset-delay-us = <1500000>;
+		reset-post-delay-us = <1000000>;
+
+		phy6: phy@6 {
+			compatible = "maxlinear,gpy211", "ethernet-phy-ieee802.3-c45";
+			reg = <6>;
+			phy-mode = "2500base-x";
+		};
+
+		switch@1f {
+			compatible = "mediatek,mt7531";
+			reg = <31>;
+			reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+			interrupt-controller;
+			#interrupt-cells = <1>;
+			interrupt-parent = <&pio>;
+			interrupts = <66 IRQ_TYPE_LEVEL_HIGH>;
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+
+				port@0 {
+					reg = <0>;
+					label = "lan1";
+				};
+
+				port@1 {
+					reg = <1>;
+					label = "lan2";
+				};
+
+				port@2 {
+					reg = <2>;
+					label = "lan3";
+				};
+
+				port@3 {
+					reg = <3>;
+					label = "lan4";
+				};
+
+				port@6 {
+					reg = <6>;
+					label = "cpu";
+					ethernet = <&gmac0>;
+					phy-mode = "2500base-x";
+
+					fixed-link {
+						speed = <2500>;
+						full-duplex;
+						pause;
+					};
+				};
+			};
+		};
+	};
+};
+
+&pio {
+	spi_flash_pins: spi-flash-pins-33-to-38 {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+		conf-pu {
+			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>; /* bias-disable */
+		};
+		conf-pd {
+			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
+			drive-strength = <8>;
+			mediatek,pull-down-adv = <0>; /* bias-disable */
+		};
+	};
+
+	wf_2g_5g_pins: wf_2g_5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+		conf {
+			pins =
+				"WF0_HB2",
+				"WF0_HB3",
+				"WF0_HB4",
+				"WF0_HB0",
+				"WF0_HB0_B",
+				"WF0_HB5",
+				"WF0_HB6",
+				"WF0_HB7",
+				"WF0_HB8",
+				"WF0_HB9",
+				"WF0_HB10",
+				"WF0_TOP_CLK",
+				"WF0_TOP_DATA",
+				"WF1_HB1",
+				"WF1_HB2",
+				"WF1_HB3",
+				"WF1_HB4",
+				"WF1_HB0",
+				"WF1_HB5",
+				"WF1_HB6",
+				"WF1_HB7",
+				"WF1_HB8",
+				"WF1_TOP_CLK",
+				"WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+
+	i2c_pins_3_4: i2c-pins-3-4 {
+		mux {
+			function = "i2c";
+			groups = "i2c";
+		};
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	status = "okay";
+
+	flash@0 {
+		compatible = "spi-nand";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+
+		spi-max-frequency = <20000000>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+
+		mediatek,nmbm;
+		mediatek,bmt-max-ratio = <1>;
+		mediatek,bmt-max-reserved-blocks = <64>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "BL2";
+				reg = <0x000000 0x100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "u-boot-env";
+				reg = <0x100000 0x80000>;
+			};
+
+			partition@180000 {
+				label = "Factory";
+				reg = <0x180000 0x200000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x1000>;
+					};
+				};
+			};
+
+			partition@380000 {
+				label = "FIP";
+				reg = <0x380000 0x200000>;
+				read-only;
+			};
+
+			partition@580000 {
+				label = "ubi";
+				reg = <0x580000 0x3200000>;
+			};
+
+			partition@3780000 {
+				label = "ubi1";
+				reg = <0x3780000 0x3200000>;
+				read-only;
+			};
+
+			partition@6980000 {
+				label = "Odm";
+				reg = <0x6980000 0x40000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_odm: macaddr@81 {
+						compatible = "mac-base";
+						reg = <0x81 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+
+			};
+
+			partition@69c0000 {
+				label = "Config1";
+				reg = <0x69c0000 0x80000>;
+				read-only;
+			};
+
+			partition@6a40000 {
+				label = "Config2";
+				reg = <0x6a40000 0x80000>;
+				read-only;
+			};
+
+			partition@6ac0000 {
+				label = "Storage";
+				reg = <0x6ac0000 0xA00000>;
+				read-only;
+			};
+
+		};
+	};
+};
+
+&wifi {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&wf_2g_5g_pins>;
+
+
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+
+	band@0 {
+		/* 2.4 GHz */
+		reg = <0>;
+		nvmem-cells = <&macaddr_odm 2>;
+		nvmem-cell-names = "mac-address";
+	};
+	band@1 {
+		/* 5 GHz */
+		reg = <1>;
+		nvmem-cells = <&macaddr_odm 5>;
+		nvmem-cell-names = "mac-address";
+	};
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&i2c0 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c_pins_3_4>;
+
+	gca230718@40 {
+		compatible = "unknown,gca230718";
+		reg = <0x40>;
+
+		led_status_red: led@0 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			reg = <0>;
+		};
+
+		led@1 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			reg = <1>;
+		};
+
+		led_status_blue: led@2 {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			reg = <2>;
+		};
+
+		led_status_white: led@3 {
+			color = <LED_COLOR_ID_WHITE>;
+			function = LED_FUNCTION_STATUS;
+			reg = <3>;
+		};
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7986a-ruijie-rg-x60-pro.dts b/target/linux/mediatek/dts/mt7986a-ruijie-rg-x60-pro.dts
index 80b614ac2282d5..9f40fec043e7e2 100644
--- a/target/linux/mediatek/dts/mt7986a-ruijie-rg-x60-pro.dts
+++ b/target/linux/mediatek/dts/mt7986a-ruijie-rg-x60-pro.dts
@@ -230,21 +230,25 @@
 		port@0 {
 			reg = <0>;
 			label = "lan1";
+			phy-handle = <&swphy0>;
 		};
 
 		port@1 {
 			reg = <1>;
 			label = "lan2";
+			phy-handle = <&swphy1>;
 		};
 
 		port@2 {
 			reg = <2>;
 			label = "lan3";
+			phy-handle = <&swphy2>;
 		};
 
 		port@3 {
 			reg = <3>;
 			label = "lan4";
+			phy-handle = <&swphy3>;
 		};
 
 		port@6 {
@@ -260,6 +264,67 @@
 			};
 		};
 	};
+
+	mdio {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		swphy0: phy@0 {
+			reg = <0>;
+
+			mediatek,led-config = <
+				0x21 0x8009 /* BASIC_CTRL */
+				0x22 0x0c00 /* ON_DURATION */
+				0x23 0x1400 /* BLINK_DURATION */
+				0x24 0x8000 /* LED0_ON_CTRL */
+				0x25 0x0000 /* LED0_BLINK_CTRL */
+				0x26 0xc007 /* LED1_ON_CTRL */
+				0x27 0x003f /* LED1_BLINK_CTRL */
+			>;
+		};
+
+		swphy1: phy@1 {
+			reg = <1>;
+
+			mediatek,led-config = <
+				0x21 0x8009 /* BASIC_CTRL */
+				0x22 0x0c00 /* ON_DURATION */
+				0x23 0x1400 /* BLINK_DURATION */
+				0x24 0x8000 /* LED0_ON_CTRL */
+				0x25 0x0000 /* LED0_BLINK_CTRL */
+				0x26 0xc007 /* LED1_ON_CTRL */
+				0x27 0x003f /* LED1_BLINK_CTRL */
+			>;
+		};
+
+		swphy2: phy@2 {
+			reg = <2>;
+
+			mediatek,led-config = <
+				0x21 0x8009 /* BASIC_CTRL */
+				0x22 0x0c00 /* ON_DURATION */
+				0x23 0x1400 /* BLINK_DURATION */
+				0x24 0x8000 /* LED0_ON_CTRL */
+				0x25 0x0000 /* LED0_BLINK_CTRL */
+				0x26 0xc007 /* LED1_ON_CTRL */
+				0x27 0x003f /* LED1_BLINK_CTRL */
+			>;
+		};
+
+		swphy3: phy@3 {
+			reg = <3>;
+
+			mediatek,led-config = <
+				0x21 0x8009 /* BASIC_CTRL */
+				0x22 0x0c00 /* ON_DURATION */
+				0x23 0x1400 /* BLINK_DURATION */
+				0x24 0x8000 /* LED0_ON_CTRL */
+				0x25 0x0000 /* LED0_BLINK_CTRL */
+				0x26 0xc007 /* LED1_ON_CTRL */
+				0x27 0x003f /* LED1_BLINK_CTRL */
+			>;
+		};
+	};
 };
 
 &wifi {
diff --git a/target/linux/mediatek/dts/mt7986a-tplink-archer-ax80-v1.dts b/target/linux/mediatek/dts/mt7986a-tplink-archer-ax80-v1.dts
new file mode 100644
index 00000000000000..e1765b08f4fe30
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986a-tplink-archer-ax80-v1.dts
@@ -0,0 +1,332 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+#include "mt7986a.dtsi"
+
+/ {
+	compatible = "tplink,archer-ax80-v1", "mediatek,mt7986a";
+	model = "TP-Link Archer AX80V1";
+
+	aliases {
+		serial0 = &uart0;
+		led-boot = &led_B;
+		led-failsafe = &led_R;
+		led-running = &led_B;
+		led-upgrade = &led_G;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	memory@40000000 {
+		reg = <0 0x40000000 0 0x20000000>;
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+		};
+
+		button-ledswitch {
+			label = "ledswitch";
+			linux,code = <KEY_BRIGHTNESS_ZERO>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		button-wps {
+			label = "wps";
+			linux,code = <KEY_WPS_BUTTON>;
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+		};
+
+		button-wifi {
+			label = "wlan";
+			linux,code = <KEY_WLAN>;
+			gpios = <&pio 16 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	reg_1p8v: regulator-1p8v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-1.8V";
+		regulator-min-microvolt = <1800000>;
+		regulator-max-microvolt = <1800000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_3p3v: regulator-3p3v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-3.3V";
+		regulator-min-microvolt = <3300000>;
+		regulator-max-microvolt = <3300000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+
+	reg_5v: regulator-5v {
+		compatible = "regulator-fixed";
+		regulator-name = "fixed-5V";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		regulator-boot-on;
+		regulator-always-on;
+	};
+};
+
+&auxadc {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-mode = "2500base-x";
+		phy-handle = <&phy6>;
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		reset-gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+		reset-delay-us = <1500000>;
+		reset-post-delay-us = <1000000>;
+
+		phy6: phy@6 {
+			compatible = "ethernet-phy-ieee802.3-c45";
+			reg = <6>;
+		};
+
+		switch@1f {
+			compatible = "mediatek,mt7531";
+			reg = <31>;
+			reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+			interrupt-controller;
+			#interrupt-cells = <1>;
+			interrupt-parent = <&pio>;
+			interrupts = <66 IRQ_TYPE_LEVEL_HIGH>;
+
+			ports {
+				#address-cells = <1>;
+				#size-cells = <0>;
+				port@0 {
+					reg = <0>;
+					label = "lan0";
+				};
+				port@1 {
+					reg = <1>;
+					label = "lan1";
+				};
+				port@2 {
+					reg = <2>;
+					label = "lan2";
+				};
+				port@3 {
+					reg = <3>;
+					label = "lan3";
+				};
+				port@6 {
+					reg = <6>;
+					label = "cpu";
+					ethernet = <&gmac0>;
+					phy-mode = "2500base-x";
+					fixed-link {
+						speed = <2500>;
+						full-duplex;
+					};
+				};
+			};
+		};
+	};
+};
+
+&i2c0 {
+	status = "okay";
+
+	lp55231: led-controller@32 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		compatible = "ti,lp55231";
+		reg = <0x32>;
+		status = "okay";
+		clock-mode = /bits/ 8 <1>;
+
+		led_B: led@0 {
+			chan-name = "B";
+			led-cur = /bits/ 8 <0x14>;
+			max-cur = /bits/ 8 <0x20>;
+			reg = <0>;
+			color = <LED_COLOR_ID_BLUE>;
+		};
+
+		led_G: led@3 {
+			chan-name = "G";
+			led-cur = /bits/ 8 <0x14>;
+			max-cur = /bits/ 8 <0x20>;
+			reg = <3>;
+			color = <LED_COLOR_ID_GREEN>;
+		};
+
+		led_R: led@6 {
+			chan-name = "R";
+			led-cur = /bits/ 8 <0x14>;
+			max-cur = /bits/ 8 <0x20>;
+			reg = <6>;
+			color = <LED_COLOR_ID_RED>;
+		};
+
+	};
+};
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	status = "okay";
+
+	spi_nand_flash: flash@0 {
+		compatible = "spi-nand";
+		reg = <0>;
+
+		spi-max-frequency = <52000000>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+
+		spi-cal-enable;
+		spi-cal-mode = "read-data";
+		spi-cal-datalen = <7>;
+		spi-cal-data = /bits/ 8 <0x53 0x50 0x49 0x4e 0x41 0x4e 0x44>;
+		spi-cal-addrlen = <5>;
+		spi-cal-addr = /bits/ 32 <0x0 0x0 0x0 0x0 0x0>;
+
+		partitions: partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "boot";
+				reg = <0x0 0x200000>;
+				read-only;
+			};
+
+			partition@200000 {
+				label = "u-boot-env";
+				reg = <0x200000 0x100000>;
+			};
+
+			partition@300000 {
+				label = "ubi0";
+				reg = <0x300000 0x3200000>;
+			};
+
+			partition@3500000 {
+				label = "ubi1";
+				reg = <0x3500000 0x3200000>;
+			};
+
+			partition@6700000 {
+				label = "userconfig";
+				reg = <0x6700000 0x800000>;
+			};
+
+			factory:partition@6f00000 {
+				label = "tp_data";
+				reg = <0x6f00000 0x400000>;
+			};
+
+			partition@7300000 {
+				label = "mali_data";
+				reg = <0x7300000 0x800000>;
+			};
+		};
+	};
+};
+
+&pio {
+	spi_flash_pins: spi-flash-pins-33-to-38 {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+		conf-pu {
+			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
+			drive-strength = <4>;
+			mediatek,pull-up-adv = <0>;
+		};
+		conf-pd {
+			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
+			drive-strength = <4>;
+			mediatek,pull-down-adv = <0>;
+		};
+	};
+	wf_2g_5g_pins: wf_2g_5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			"WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			"WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			"WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			"WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			"WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			"WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+};
+
+&trng {
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&ssusb {
+	vusb33-supply = <&reg_3p3v>;
+	vbus-supply = <&reg_5v>;
+	status = "okay";
+};
+
+&usb_phy {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&wf_2g_5g_pins>;
+};
diff --git a/target/linux/mediatek/dts/mt7986a-zyxel-ex5601-t0-stock.dts b/target/linux/mediatek/dts/mt7986a-zyxel-ex5601-t0-stock.dts
index 4dbbd1367794e0..b5553a8359832d 100644
--- a/target/linux/mediatek/dts/mt7986a-zyxel-ex5601-t0-stock.dts
+++ b/target/linux/mediatek/dts/mt7986a-zyxel-ex5601-t0-stock.dts
@@ -11,8 +11,8 @@
 #include <dt-bindings/input/input.h>
 
 / {
-	model = "Zyxel EX5601-T0";
-	compatible = "zyxel,ex5601-t0", "mediatek,mt7986a-rfb-snand";
+	model = "Zyxel EX5601-T0 (stock layout)";
+	compatible = "zyxel,ex5601-t0-stock", "mediatek,mt7986a";
 
 	memory@40000000 {
 		device_type = "memory";
diff --git a/target/linux/mediatek/dts/mt7986b-mercusys-mr90x-v1-common.dtsi b/target/linux/mediatek/dts/mt7986b-mercusys-mr90x-v1-common.dtsi
new file mode 100644
index 00000000000000..5522c58af21ed4
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986b-mercusys-mr90x-v1-common.dtsi
@@ -0,0 +1,252 @@
+// SPDX-License-Identifier: (GL-2.0 OR MIT)
+
+/dts-v1/;
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+#include "mt7986b.dtsi"
+
+/ {
+	aliases: aliases {
+		led-boot = &led_status_green;
+		led-failsafe = &led_status_green;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_green;
+
+		serial0 = &uart0;
+	};
+
+	chosen: chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	memory {
+		reg = <0 0x40000000 0 0x20000000>;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-0 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <2>;
+			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
+		};
+
+		led-1 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <1>;
+			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
+		};
+
+		led-2 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <0>;
+			gpios = <&pio 12 GPIO_ACTIVE_LOW>;
+		};
+
+		led-3 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&pio 13 GPIO_ACTIVE_LOW>;
+		};
+
+		led-4 {
+			color = <LED_COLOR_ID_AMBER>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&pio 16 GPIO_ACTIVE_HIGH>;
+			panic-indicator;
+		};
+
+		led_status_green: led-5 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&pio 17 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&crypto {
+	status = "okay";
+};
+
+&eth {
+	status = "okay";
+
+	gmac0: mac@0 {
+		compatible = "mediatek,eth-mac";
+		reg = <0>;
+		phy-mode = "2500base-x";
+
+		fixed-link {
+			speed = <2500>;
+			full-duplex;
+			pause;
+		};
+	};
+
+	gmac1: mac@1 {
+		compatible = "mediatek,eth-mac";
+		reg = <1>;
+		phy-handle = <&phy6>;
+		phy-mode = "2500base-x";
+	};
+
+	mdio: mdio-bus {
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+};
+
+&mdio {
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	reset-gpios = <&pio 6 GPIO_ACTIVE_LOW>;
+	reset-delay-us = <1500000>;
+	reset-post-delay-us = <1000000>;
+
+	/* WAN/LAN 2.5Gbps phy
+	   MaxLinear GPY211C0VC (SLNW8) */
+	phy6: phy@6 {
+		compatible = "ethernet-phy-ieee802.3-c45";
+		reg = <6>;
+	};
+
+	switch: switch@1f {
+		compatible = "mediatek,mt7531";
+		reg = <31>;
+		reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+	};
+};
+
+&switch {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		/* WAN/LAN 1Gbps port */
+		port@0 {
+			reg = <0>;
+			label = "lan0";
+		};
+
+		/* LAN1 port */
+		port@1 {
+			reg = <1>;
+			label = "lan1";
+		};
+
+		/* LAN2 port */
+		port@2 {
+			reg = <2>;
+			label = "lan2";
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "2500base-x";
+
+			fixed-link {
+				speed = <2500>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&pio {
+	spi_flash_pins: spi-flash-pins-33-to-38 {
+		mux {
+			function = "spi";
+			groups = "spi0", "spi0_wp_hold";
+		};
+		conf-pu {
+			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
+			drive-strength = <8>;
+			mediatek,pull-up-adv = <0>; /* bias-disable */
+		};
+		conf-pd {
+			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
+			drive-strength = <8>;
+			mediatek,pull-down-adv = <0>; /* bias-disable */
+		};
+	};
+
+	wf_2g_5g_pins: wf_2g_5g-pins {
+		mux {
+			function = "wifi";
+			groups = "wf_2g", "wf_5g";
+		};
+		conf {
+			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
+			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
+			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
+			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
+			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
+			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
+			       "WF1_TOP_CLK", "WF1_TOP_DATA";
+			drive-strength = <4>;
+		};
+	};
+};
+
+&spi0 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&spi_flash_pins>;
+	status = "okay";
+
+	spi_nand_flash: flash@0 {
+		compatible = "spi-nand";
+		#address-cells = <1>;
+		#size-cells = <1>;
+		reg = <0>;
+
+		spi-max-frequency = <20000000>;
+		spi-tx-bus-width = <4>;
+		spi-rx-bus-width = <4>;
+
+		partitions: partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+		};
+	};
+};
+
+&trng {
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&watchdog {
+	status = "okay";
+};
+
+&wifi {
+	status = "okay";
+
+	pinctrl-names = "default";
+	pinctrl-0 = <&wf_2g_5g_pins>;
+
+	ieee80211-freq-limit = <2400000 2500000>, <5170000 5835000>;
+};
diff --git a/target/linux/mediatek/dts/mt7986b-mercusys-mr90x-v1-ubi.dts b/target/linux/mediatek/dts/mt7986b-mercusys-mr90x-v1-ubi.dts
new file mode 100644
index 00000000000000..cfa195034d6d32
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7986b-mercusys-mr90x-v1-ubi.dts
@@ -0,0 +1,124 @@
+// SPDX-License-Identifier: (GL-2.0 OR MIT)
+
+#include "mt7986b-mercusys-mr90x-v1-common.dtsi"
+
+/ {
+	compatible = "mercusys,mr90x-v1-ubi", "mediatek,mt7986b";
+	model = "MERCUSYS MR90X v1 (UBI)";
+};
+
+&aliases {
+	label-mac-device = &gmac0;
+};
+
+&chosen {
+	bootargs-append = " root=/dev/fit0 rootwait";
+	rootdisk = <&ubi_fit>;
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_8000 0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	nvmem-cells = <&macaddr_factory_8000 1>;
+	nvmem-cell-names = "mac-address";
+};
+
+&partitions {
+	partition@0 {
+		label = "boot";
+		reg = <0x0 0x200000>;
+		read-only;
+
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			label = "bl2";
+			reg = <0x0 0x100000>;
+			read-only;
+		};
+
+		partition@100000 {
+			label = "factory";
+			reg = <0x100000 0x100000>;
+			read-only;
+
+			nvmem-layout {
+				compatible = "fixed-layout";
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				eeprom_factory_0: eeprom@0 {
+					reg = <0x0 0x1000>;
+				};
+
+				macaddr_factory_8000: macaddr@8000 {
+					compatible = "mac-base";
+					reg = <0x8000 0x6>;
+					#nvmem-cell-cells = <1>;
+				};
+			};
+		};
+	};
+
+	partition@200000 {
+		compatible = "linux,ubi";
+		reg = <0x200000 0x7e00000>;
+		label = "ubi";
+
+		volumes {
+			ubi_fit: ubi-volume-fit {
+				volname = "fit";
+			};
+
+			ubi_ubootenv: ubi-volume-ubootenv {
+				volname = "ubootenv";
+			};
+
+			ubi_ubootenv2: ubi-volume-ubootenv2 {
+				volname = "ubootenv2";
+			};
+		};
+	};
+};
+
+&trng {
+	status = "okay";
+};
+
+&uart0 {
+	status = "okay";
+};
+
+&ubi_ubootenv {
+	nvmem-layout {
+		compatible = "u-boot,env-redundant-bool";
+	};
+};
+
+&ubi_ubootenv2 {
+	nvmem-layout {
+		compatible = "u-boot,env-redundant-bool";
+	};
+};
+
+&wifi {
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+
+	band@0 {
+		reg = <0>;
+		nvmem-cells = <&macaddr_factory_8000 0>;
+		nvmem-cell-names = "mac-address";
+	};
+
+	band@1 {
+		reg = <1>;
+		nvmem-cells = <&macaddr_factory_8000 (-1)>;
+		nvmem-cell-names = "mac-address";
+	};
+};
diff --git a/target/linux/mediatek/dts/mt7986b-mercusys-mr90x-v1.dts b/target/linux/mediatek/dts/mt7986b-mercusys-mr90x-v1.dts
index f0a995820ec1a4..16d890a3933531 100644
--- a/target/linux/mediatek/dts/mt7986b-mercusys-mr90x-v1.dts
+++ b/target/linux/mediatek/dts/mt7986b-mercusys-mr90x-v1.dts
@@ -1,286 +1,44 @@
 // SPDX-License-Identifier: (GL-2.0 OR MIT)
 
-/dts-v1/;
-#include <dt-bindings/input/input.h>
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/leds/common.h>
-
-#include "mt7986b.dtsi"
+#include "mt7986b-mercusys-mr90x-v1-common.dtsi"
 
 / {
 	compatible = "mercusys,mr90x-v1", "mediatek,mt7986b";
 	model = "MERCUSYS MR90X v1";
-
-	aliases {
-		serial0 = &uart0;
-
-		led-boot = &led_status_green;
-		led-failsafe = &led_status_green;
-		led-running = &led_status_green;
-		led-upgrade = &led_status_green;
-	};
-
-	chosen {
-		stdout-path = "serial0:115200n8";
-	};
-
-	memory {
-		reg = <0 0x40000000 0 0x20000000>;
-	};
-
-	keys {
-		compatible = "gpio-keys";
-
-		reset {
-			label = "reset";
-			gpios = <&pio 10 GPIO_ACTIVE_LOW>;
-			linux,code = <KEY_RESTART>;
-		};
-	};
-
-	leds {
-		compatible = "gpio-leds";
-
-	 	led-0 {
-			color = <LED_COLOR_ID_GREEN>;
-			function = LED_FUNCTION_LAN;
-			function-enumerator = <2>;
-			gpios = <&pio 7 GPIO_ACTIVE_LOW>;
-		};
-
-		led-1 {
-			color = <LED_COLOR_ID_GREEN>;
-			function = LED_FUNCTION_LAN;
-			function-enumerator = <1>;
-			gpios = <&pio 9 GPIO_ACTIVE_LOW>;
-		};
-
-		led-2 {
-			color = <LED_COLOR_ID_GREEN>;
-			function = LED_FUNCTION_LAN;
-			function-enumerator = <0>;
-			gpios = <&pio 12 GPIO_ACTIVE_LOW>;
-		};
-
-		led-3 {
-			color = <LED_COLOR_ID_GREEN>;
-			function = LED_FUNCTION_WAN;
-			gpios = <&pio 13 GPIO_ACTIVE_LOW>;
-		};
-
-		led-4 {
-			color = <LED_COLOR_ID_AMBER>;
-			function = LED_FUNCTION_STATUS;
-			gpios = <&pio 16 GPIO_ACTIVE_HIGH>;
-			panic-indicator;
-		};
-
-		led_status_green: led-5 {
-			color = <LED_COLOR_ID_GREEN>;
-			function = LED_FUNCTION_STATUS;
-			gpios = <&pio 17 GPIO_ACTIVE_HIGH>;
-		};
-	};
 };
 
-&crypto {
-	status = "okay";
-};
-
-&eth {
-	status = "okay";
-
-	gmac0: mac@0 {
-		compatible = "mediatek,eth-mac";
-		reg = <0>;
-		phy-mode = "2500base-x";
-
-		fixed-link {
-			speed = <2500>;
-			full-duplex;
-			pause;
-		};
+&partitions {
+	partition@0 {
+		label = "boot";
+		reg = <0x0 0x200000>;
+		read-only;
 	};
 
-	gmac1: mac@1 {
-		compatible = "mediatek,eth-mac";
-		reg = <1>;
-		phy-handle = <&phy6>;
-		phy-mode = "2500base-x";
+	partition@200000 {
+		label = "u-boot-env";
+		reg = <0x200000 0x100000>;
 	};
 
-	mdio: mdio-bus {
-		#address-cells = <1>;
-		#size-cells = <0>;
+	partition@300000 {
+		label = "ubi0";
+		reg = <0x300000 0x3200000>;
 	};
-};
-
-&mdio {
-	#address-cells = <1>;
-	#size-cells = <0>;
-
-	reset-gpios = <&pio 6 GPIO_ACTIVE_LOW>;
-	reset-delay-us = <1500000>;
-	reset-post-delay-us = <1000000>;
 
-	/* WAN/LAN 2.5Gbps phy
-	   MaxLinear GPY211C0VC (SLNW8) */
-	phy6: phy@6 {
-		compatible = "ethernet-phy-ieee802.3-c45";
-		reg = <6>;
+	partition@3500000 {
+		label = "ubi1";
+		reg = <0x3500000 0x3200000>;
+		read-only;
 	};
 
-	switch: switch@1f {
-		compatible = "mediatek,mt7531";
-		reg = <31>;
-		reset-gpios = <&pio 5 GPIO_ACTIVE_HIGH>;
+	partition@6700000 {
+		label = "userconfig";
+		reg = <0x6700000 0x800000>;
+		read-only;
 	};
-};
-
-&switch {
-	ports {
-		#address-cells = <1>;
-		#size-cells = <0>;
-
-		/* WAN/LAN 1Gbps port */
-		port@0 {
-			reg = <0>;
-			label = "lan0";
-		};
 
-		/* LAN1 port */
-		port@1 {
-			reg = <1>;
-			label = "lan1";
-		};
-
-		/* LAN2 port */
-		port@2 {
-			reg = <2>;
-			label = "lan2";
-		};
-
-		port@6 {
-			reg = <6>;
-			ethernet = <&gmac0>;
-			phy-mode = "2500base-x";
-
-			fixed-link {
-				speed = <2500>;
-				full-duplex;
-				pause;
-			};
-		};
-	};
-};
-
-&pio {
-	spi_flash_pins: spi-flash-pins-33-to-38 {
-		mux {
-			function = "spi";
-			groups = "spi0", "spi0_wp_hold";
-		};
-		conf-pu {
-			pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP";
-			drive-strength = <8>;
-			mediatek,pull-up-adv = <0>; /* bias-disable */
-		};
-		conf-pd {
-			pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO";
-			drive-strength = <8>;
-			mediatek,pull-down-adv = <0>; /* bias-disable */
-		};
-	};
-
-	wf_2g_5g_pins: wf_2g_5g-pins {
-		mux {
-			function = "wifi";
-			groups = "wf_2g", "wf_5g";
-		};
-		conf {
-			pins = "WF0_HB1", "WF0_HB2", "WF0_HB3", "WF0_HB4",
-			       "WF0_HB0", "WF0_HB0_B", "WF0_HB5", "WF0_HB6",
-			       "WF0_HB7", "WF0_HB8", "WF0_HB9", "WF0_HB10",
-			       "WF0_TOP_CLK", "WF0_TOP_DATA", "WF1_HB1",
-			       "WF1_HB2", "WF1_HB3", "WF1_HB4", "WF1_HB0",
-			       "WF1_HB5", "WF1_HB6", "WF1_HB7", "WF1_HB8",
-			       "WF1_TOP_CLK", "WF1_TOP_DATA";
-			drive-strength = <4>;
-		};
-	};
-};
-
-&spi0 {
-	pinctrl-names = "default";
-	pinctrl-0 = <&spi_flash_pins>;
-	status = "okay";
-
-	spi_nand_flash: flash@0 {
-		compatible = "spi-nand";
-		#address-cells = <1>;
-		#size-cells = <1>;
-		reg = <0>;
-
-		spi-max-frequency = <20000000>;
-		spi-tx-bus-width = <4>;
-		spi-rx-bus-width = <4>;
-
-		partitions: partitions {
-			compatible = "fixed-partitions";
-			#address-cells = <1>;
-			#size-cells = <1>;
-
-			partition@0 {
-				label = "boot";
-				reg = <0x0 0x200000>;
-				read-only;
-			};
-
-			partition@200000 {
-				label = "u-boot-env";
-				reg = <0x200000 0x100000>;
-			};
-
-			partition@300000 {
-				label = "ubi0";
-				reg = <0x300000 0x3200000>;
-			};
-
-			partition@3500000 {
-				label = "ubi1";
-				reg = <0x3500000 0x3200000>;
-				read-only;
-			};
-
-			partition@6700000 {
-				label = "userconfig";
-				reg = <0x6700000 0x800000>;
-				read-only;
-			};
-
-			partition@6f00000 {
-				label = "tp_data";
-				reg = <0x6f00000 0x400000>;
-				read-only;
-			};
-		};
+	partition@6f00000 {
+		label = "tp_data";
+		reg = <0x6f00000 0x400000>;
+		read-only;
 	};
 };
-
-&trng {
-	status = "okay";
-};
-
-&uart0 {
-	status = "okay";
-};
-
-&watchdog {
-	status = "okay";
-};
-
-&wifi {
-	status = "okay";
-	pinctrl-names = "default";
-	pinctrl-0 = <&wf_2g_5g_pins>;
-};
diff --git a/target/linux/mediatek/dts/mt7986b-netgear-wax220.dts b/target/linux/mediatek/dts/mt7986b-netgear-wax220.dts
index 6e51d884702358..9537afba898aed 100644
--- a/target/linux/mediatek/dts/mt7986b-netgear-wax220.dts
+++ b/target/linux/mediatek/dts/mt7986b-netgear-wax220.dts
@@ -67,6 +67,7 @@
 		wlan2g_blue {
 			gpios = <&pio 1 GPIO_ACTIVE_LOW>;
 			label = "blue:wlan2g";
+			linux,default-trigger = "phy0tpt";
 		};
 
 		lan_green {
@@ -84,6 +85,7 @@
 		wlan5g_blue {
 			gpios = <&pio 2 GPIO_ACTIVE_LOW>;
 			label = "blue:wlan5g";
+			linux,default-trigger = "phy1tpt";
 		};
 	};
 };
diff --git a/target/linux/mediatek/dts/mt7988a-arcadyan-mozart.dts b/target/linux/mediatek/dts/mt7988a-arcadyan-mozart.dts
new file mode 100644
index 00000000000000..8b5f0526b2098f
--- /dev/null
+++ b/target/linux/mediatek/dts/mt7988a-arcadyan-mozart.dts
@@ -0,0 +1,336 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+
+/dts-v1/;
+#include "mt7988a-rfb.dts"
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "arcadyan,mozart", "mediatek,mt7988a";
+	model = "MediaTek / Arcadyan - Mozart";
+
+	aliases {
+		serial0 = &uart0;
+		led-boot = &led_status_blue;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_green;
+	};
+
+	chosen {
+		rootdisk = <&emmc_rootfs>;
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+
+		wifi_white {
+			color = <LED_COLOR_ID_WHITE>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&pio 68 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_red: wifi_red {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&pio 29 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_green: wifi_green {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&pio 30 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_blue: wifi_blue {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&pio 31 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		button-reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&pio 13 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&pio {
+	mdio0_pins: mdio0-pins {
+		mux {
+			function = "eth";
+			groups = "mdc_mdio0";
+		};
+
+		conf {
+			groups = "mdc_mdio0";
+			drive-strength = <MTK_DRIVE_10mA>;
+		};
+	};
+
+	spic_pins: spi1-pins {
+		mux {
+			function = "spi";
+			groups = "spi1";
+		};
+	};
+};
+
+&usxgmiisys0 {
+	mediatek,pnswap-rx;
+};
+
+&usxgmiisys1 {
+	mediatek,pnswap-rx;
+};
+
+&mdio_bus {
+	#address-cells = <1>;
+	#size-cells = <0>;
+	reset-gpios = <&pio 72 GPIO_ACTIVE_LOW>;
+	reset-assert-us = <100000>;
+	reset-deassert-us = <100000>;
+
+	phy0: ethernet-phy@0 {
+		reg = <0>;
+		compatible = "ethernet-phy-ieee802.3-c45";
+	};
+
+	phy8: ethernet-phy@8 {
+		reg = <8>;
+		compatible = "ethernet-phy-ieee802.3-c45";
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_factory_4 3>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	phy-mode = "usxgmii";
+	phy-connection-type = "usxgmii";
+	phy = <&phy0>;
+	nvmem-cells = <&macaddr_factory_4 4>;
+	nvmem-cell-names = "mac-address";
+	status = "okay";
+};
+
+&gmac2 {
+	phy-mode = "usxgmii";
+	phy-connection-type = "usxgmii";
+	phy = <&phy8>;
+	nvmem-cells = <&macaddr_factory_4 5>;
+	nvmem-cell-names = "mac-address";
+	status = "okay";
+};
+
+&switch {
+	/delete-node/ports;
+
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		gsw_port0: port@0 {
+			reg = <0>;
+			label = "lan0";
+			phy-mode = "internal";
+			phy-handle = <&gsw_phy0>;
+		};
+
+		port@6 {
+			reg = <6>;
+			ethernet = <&gmac0>;
+			phy-mode = "internal";
+
+			fixed-link {
+				speed = <10000>;
+				full-duplex;
+				pause;
+			};
+		};
+	};
+};
+
+&i2c1 {
+	pinctrl-names = "default";
+	pinctrl-0 = <&i2c1_pins>;
+	clock-frequency = <100000>;
+	status = "okay";
+
+	icp201xx@63{
+		compatible = "invensense,icp201xx";
+		reg = <0x63>;
+		#address-cells = <1>;
+		#size-cells = <0>;
+	};
+};
+
+&uart1 {
+	status = "okay";
+};
+
+&fan {
+	pwms = <&pwm 1 40000 0>;
+	status = "okay";
+};
+
+&pwm {
+	status = "okay";
+};
+
+&spi1 {
+	pinctrl-names = "default";
+	/* pin shared with snfi */
+	pinctrl-0 = <&spic_pins>;
+	status = "disabled";
+};
+
+&mmc0 {
+	pinctrl-names = "default", "state_uhs";
+	pinctrl-0 = <&mmc0_pins_emmc_51>;
+	pinctrl-1 = <&mmc0_pins_emmc_51>;
+	bus-width = <8>;
+	max-frequency = <200000000>;
+	cap-mmc-highspeed;
+	mmc-hs200-1_8v;
+	mmc-hs400-1_8v;
+	hs400-ds-delay = <0x12814>;
+	vqmmc-supply = <&reg_1p8v>;
+	vmmc-supply = <&reg_3p3v>;
+	non-removable;
+	no-sd;
+	no-sdio;
+	status = "okay";
+
+	card@0 {
+		compatible = "mmc-card";
+		reg = <0>;
+
+		block {
+			compatible = "block-device";
+			partitions {
+				block-partition-env {
+					partname = "u-boot-env";
+					nvmem-layout {
+						compatible = "u-boot,env-layout";
+					};
+				};
+
+				emmc_rootfs: block-partition-production {
+					partname = "production";
+				};
+
+				block-partition-factory {
+					partname = "factory";
+
+					nvmem-layout {
+						compatible = "fixed-layout";
+						#address-cells = <1>;
+						#size-cells = <1>;
+
+						eeprom_factory_0: eeprom@0 {
+							reg = <0x0 0x1e00>;
+						};
+
+						macaddr_factory_4: macaddr@a {
+							compatible = "mac-base";
+							reg = <0x4 0x6>;
+							#nvmem-cell-cells = <1>;
+						};
+					};
+				};
+			};
+		};
+	};
+};
+
+&cpu_thermal {
+	/delete-node/cooling-maps;
+	/delete-node/trips;
+
+	trips {
+		cpu_trip_crit: crit {
+			temperature = <125000>;
+			hysteresis = <2000>;
+			type = "critical";
+		};
+
+		cpu_trip_hot: hot {
+			temperature = <120000>;
+			hysteresis = <2000>;
+			type = "hot";
+		};
+
+		cpu_trip_active_high: active-high {
+			temperature = <110000>;
+			hysteresis = <2000>;
+			type = "active";
+		};
+
+		cpu_trip_active_med: active-med {
+			temperature = <80000>;
+			hysteresis = <2000>;
+			type = "active";
+		};
+
+		cpu_trip_active_low: active-low {
+			temperature = <60000>;
+			hysteresis = <2000>;
+			type = "active";
+		};
+
+		cpu_trip_active_silent: active-silent {
+			temperature = <40000>;
+			hysteresis = <2000>;
+			type = "active";
+		};
+	};
+
+	cooling-maps {
+		cpu-active-high {
+			/* active: set fan to cooling level 3 */
+			cooling-device = <&fan 3 3>;
+			trip = <&cpu_trip_active_high>;
+		};
+
+		cpu-active-med {
+			/* active: set fan to cooling level 2 */
+			cooling-device = <&fan 2 2>;
+			trip = <&cpu_trip_active_med>;
+		};
+
+		cpu-active-low {
+			/* active: set fan to cooling level 1 */
+			cooling-device = <&fan 1 1>;
+			trip = <&cpu_trip_active_low>;
+		};
+
+		cpu-active-silent {
+			/* active: set fan to cooling level 0 */
+			cooling-device = <&fan 0 0>;
+			trip = <&cpu_trip_active_silent>;
+		};
+	};
+};
+
+&pcie0 {
+	status = "okay";
+
+	pcie@0,0 {
+		reg = <0x0000 0 0 0 0>;
+
+		mt7996@1,0 {
+			reg = <0x0000 0 0 0 0>;
+			nvmem-cells = <&eeprom_factory_0>;
+			nvmem-cell-names = "eeprom";
+		};
+	};
+};
diff --git a/target/linux/mediatek/files-6.6/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4.dtsi b/target/linux/mediatek/files-6.6/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4.dtsi
index fae5d0ebfa8aa3..c4455fbc7471ed 100644
--- a/target/linux/mediatek/files-6.6/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4.dtsi
+++ b/target/linux/mediatek/files-6.6/arch/arm64/boot/dts/mediatek/mt7988a-bananapi-bpi-r4.dtsi
@@ -297,11 +297,22 @@
 	status = "okay";
 };
 
+&pio {
+	pwm0_pins: pwm0-pins {
+		mux {
+			groups = "pwm0";
+			function = "pwm";
+		};
+	};
+};
+
 &pwm {
 	status = "okay";
 };
 
 &fan {
+	pinctrl-names = "default";
+	pinctrl-0 = <&pwm0_pins>;
 	pwms = <&pwm 0 50000>;
 	status = "okay";
 };
diff --git a/target/linux/mediatek/files-6.6/arch/arm64/boot/dts/mediatek/mt7988a.dtsi b/target/linux/mediatek/files-6.6/arch/arm64/boot/dts/mediatek/mt7988a.dtsi
index c894253feddc07..39f8fd2ab14fcf 100644
--- a/target/linux/mediatek/files-6.6/arch/arm64/boot/dts/mediatek/mt7988a.dtsi
+++ b/target/linux/mediatek/files-6.6/arch/arm64/boot/dts/mediatek/mt7988a.dtsi
@@ -806,7 +806,7 @@
 				 <&infracfg CLK_INFRA_104M_SPI0>,
 				 <&infracfg CLK_INFRA_66M_SPI0_HCK>;
 			clock-names = "parent-clk", "sel-clk", "spi-clk",
-				      "spi-hclk";
+				      "hclk";
 			#address-cells = <1>;
 			#size-cells = <0>;
 			status = "disabled";
@@ -817,11 +817,11 @@
 			reg = <0 0x11008000 0 0x100>;
 			interrupts = <GIC_SPI 141 IRQ_TYPE_LEVEL_HIGH>;
 			clocks = <&topckgen CLK_TOP_MPLL_D2>,
-				 <&topckgen CLK_TOP_SPI_SEL>,
+				 <&topckgen CLK_TOP_SPIM_MST_SEL>,
 				 <&infracfg CLK_INFRA_104M_SPI1>,
 				 <&infracfg CLK_INFRA_66M_SPI1_HCK>;
 			clock-names = "parent-clk", "sel-clk", "spi-clk",
-				      "spi-hclk";
+				      "hclk";
 			#address-cells = <1>;
 			#size-cells = <0>;
 			pinctrl-names = "default";
@@ -838,7 +838,7 @@
 				 <&infracfg CLK_INFRA_104M_SPI2_BCK>,
 				 <&infracfg CLK_INFRA_66M_SPI2_HCK>;
 			clock-names = "parent-clk", "sel-clk", "spi-clk",
-				      "spi-hclk";
+				      "hclk";
 			#address-cells = <1>;
 			#size-cells = <0>;
 			status = "disabled";
diff --git a/target/linux/mediatek/files-6.6/drivers/mfd/airoha-an8855.c b/target/linux/mediatek/files-6.6/drivers/mfd/airoha-an8855.c
new file mode 100644
index 00000000000000..eeaea348aa412c
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/mfd/airoha-an8855.c
@@ -0,0 +1,278 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * MFD driver for Airoha AN8855 Switch
+ */
+
+#include <linux/mfd/airoha-an8855-mfd.h>
+#include <linux/mfd/core.h>
+#include <linux/mdio.h>
+#include <linux/module.h>
+#include <linux/phy.h>
+#include <linux/regmap.h>
+
+static const struct mfd_cell an8855_mfd_devs[] = {
+	{
+		.name = "an8855-efuse",
+		.of_compatible = "airoha,an8855-efuse",
+	}, {
+		.name = "an8855-switch",
+		.of_compatible = "airoha,an8855-switch",
+	}, {
+		.name = "an8855-mdio",
+		.of_compatible = "airoha,an8855-mdio",
+	}
+};
+
+int an8855_mii_set_page(struct an8855_mfd_priv *priv, u8 phy_id,
+			u8 page) __must_hold(&priv->bus->mdio_lock)
+{
+	struct mii_bus *bus = priv->bus;
+	int ret;
+
+	ret = __mdiobus_write(bus, phy_id, AN8855_PHY_SELECT_PAGE, page);
+	if (ret < 0)
+		dev_err_ratelimited(&bus->dev,
+				    "failed to set an8855 mii page\n");
+
+	/* Cache current page if next mii read/write is for switch */
+	priv->current_page = page;
+	return ret < 0 ? ret : 0;
+}
+EXPORT_SYMBOL_GPL(an8855_mii_set_page);
+
+static int an8855_mii_read32(struct mii_bus *bus, u8 phy_id, u32 reg,
+			     u32 *val) __must_hold(&bus->mdio_lock)
+{
+	int lo, hi, ret;
+
+	ret = __mdiobus_write(bus, phy_id, AN8855_PBUS_MODE,
+			      AN8855_PBUS_MODE_ADDR_FIXED);
+	if (ret < 0)
+		goto err;
+
+	ret = __mdiobus_write(bus, phy_id, AN8855_PBUS_RD_ADDR_HIGH,
+			      upper_16_bits(reg));
+	if (ret < 0)
+		goto err;
+	ret = __mdiobus_write(bus, phy_id, AN8855_PBUS_RD_ADDR_LOW,
+			      lower_16_bits(reg));
+	if (ret < 0)
+		goto err;
+
+	hi = __mdiobus_read(bus, phy_id, AN8855_PBUS_RD_DATA_HIGH);
+	if (hi < 0) {
+		ret = hi;
+		goto err;
+	}
+	lo = __mdiobus_read(bus, phy_id, AN8855_PBUS_RD_DATA_LOW);
+	if (lo < 0) {
+		ret = lo;
+		goto err;
+	}
+
+	*val = ((u16)hi << 16) | ((u16)lo & 0xffff);
+
+	return 0;
+err:
+	dev_err_ratelimited(&bus->dev,
+			    "failed to read an8855 register\n");
+	return ret;
+}
+
+static int an8855_regmap_read(void *ctx, uint32_t reg, uint32_t *val)
+{
+	struct an8855_mfd_priv *priv = ctx;
+	struct mii_bus *bus = priv->bus;
+	u16 addr = priv->switch_addr;
+	int ret;
+
+	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+	ret = an8855_mii_set_page(priv, addr, AN8855_PHY_PAGE_EXTENDED_4);
+	if (ret < 0)
+		goto exit;
+
+	ret = an8855_mii_read32(bus, addr, reg, val);
+
+exit:
+	mutex_unlock(&bus->mdio_lock);
+
+	return ret < 0 ? ret : 0;
+}
+
+static int an8855_mii_write32(struct mii_bus *bus, u8 phy_id, u32 reg,
+			      u32 val) __must_hold(&bus->mdio_lock)
+{
+	int ret;
+
+	ret = __mdiobus_write(bus, phy_id, AN8855_PBUS_MODE,
+			      AN8855_PBUS_MODE_ADDR_FIXED);
+	if (ret < 0)
+		goto err;
+
+	ret = __mdiobus_write(bus, phy_id, AN8855_PBUS_WR_ADDR_HIGH,
+			      upper_16_bits(reg));
+	if (ret < 0)
+		goto err;
+	ret = __mdiobus_write(bus, phy_id, AN8855_PBUS_WR_ADDR_LOW,
+			      lower_16_bits(reg));
+	if (ret < 0)
+		goto err;
+
+	ret = __mdiobus_write(bus, phy_id, AN8855_PBUS_WR_DATA_HIGH,
+			      upper_16_bits(val));
+	if (ret < 0)
+		goto err;
+	ret = __mdiobus_write(bus, phy_id, AN8855_PBUS_WR_DATA_LOW,
+			      lower_16_bits(val));
+	if (ret < 0)
+		goto err;
+
+	return 0;
+err:
+	dev_err_ratelimited(&bus->dev,
+			    "failed to write an8855 register\n");
+	return ret;
+}
+
+static int
+an8855_regmap_write(void *ctx, uint32_t reg, uint32_t val)
+{
+	struct an8855_mfd_priv *priv = ctx;
+	struct mii_bus *bus = priv->bus;
+	u16 addr = priv->switch_addr;
+	int ret;
+
+	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+	ret = an8855_mii_set_page(priv, addr, AN8855_PHY_PAGE_EXTENDED_4);
+	if (ret < 0)
+		goto exit;
+
+	ret = an8855_mii_write32(bus, addr, reg, val);
+
+exit:
+	mutex_unlock(&bus->mdio_lock);
+
+	return ret < 0 ? ret : 0;
+}
+
+static int an8855_regmap_update_bits(void *ctx, uint32_t reg, uint32_t mask,
+				     uint32_t write_val)
+{
+	struct an8855_mfd_priv *priv = ctx;
+	struct mii_bus *bus = priv->bus;
+	u16 addr = priv->switch_addr;
+	u32 val;
+	int ret;
+
+	mutex_lock_nested(&bus->mdio_lock, MDIO_MUTEX_NESTED);
+	ret = an8855_mii_set_page(priv, addr, AN8855_PHY_PAGE_EXTENDED_4);
+	if (ret < 0)
+		goto exit;
+
+	ret = an8855_mii_read32(bus, addr, reg, &val);
+	if (ret < 0)
+		goto exit;
+
+	val &= ~mask;
+	val |= write_val;
+	ret = an8855_mii_write32(bus, addr, reg, val);
+
+exit:
+	mutex_unlock(&bus->mdio_lock);
+
+	return ret < 0 ? ret : 0;
+}
+
+static const struct regmap_range an8855_readable_ranges[] = {
+	regmap_reg_range(0x10000000, 0x10000fff), /* SCU */
+	regmap_reg_range(0x10001000, 0x10001fff), /* RBUS */
+	regmap_reg_range(0x10002000, 0x10002fff), /* MCU */
+	regmap_reg_range(0x10005000, 0x10005fff), /* SYS SCU */
+	regmap_reg_range(0x10007000, 0x10007fff), /* I2C Slave */
+	regmap_reg_range(0x10008000, 0x10008fff), /* I2C Master */
+	regmap_reg_range(0x10009000, 0x10009fff), /* PDMA */
+	regmap_reg_range(0x1000a100, 0x1000a2ff), /* General Purpose Timer */
+	regmap_reg_range(0x1000a200, 0x1000a2ff), /* GPU timer */
+	regmap_reg_range(0x1000a300, 0x1000a3ff), /* GPIO */
+	regmap_reg_range(0x1000a400, 0x1000a5ff), /* EFUSE */
+	regmap_reg_range(0x1000c000, 0x1000cfff), /* GDMP CSR */
+	regmap_reg_range(0x10010000, 0x1001ffff), /* GDMP SRAM */
+	regmap_reg_range(0x10200000, 0x10203fff), /* Switch - ARL Global */
+	regmap_reg_range(0x10204000, 0x10207fff), /* Switch - BMU */
+	regmap_reg_range(0x10208000, 0x1020bfff), /* Switch - ARL Port */
+	regmap_reg_range(0x1020c000, 0x1020cfff), /* Switch - SCH */
+	regmap_reg_range(0x10210000, 0x10213fff), /* Switch - MAC */
+	regmap_reg_range(0x10214000, 0x10217fff), /* Switch - MIB */
+	regmap_reg_range(0x10218000, 0x1021bfff), /* Switch - Port Control */
+	regmap_reg_range(0x1021c000, 0x1021ffff), /* Switch - TOP */
+	regmap_reg_range(0x10220000, 0x1022ffff), /* SerDes */
+	regmap_reg_range(0x10286000, 0x10286fff), /* RG Batcher */
+	regmap_reg_range(0x1028c000, 0x1028ffff), /* ETHER_SYS */
+	regmap_reg_range(0x30000000, 0x37ffffff), /* I2C EEPROM */
+	regmap_reg_range(0x38000000, 0x3fffffff), /* BOOT_ROM */
+	regmap_reg_range(0xa0000000, 0xbfffffff), /* GPHY */
+};
+
+static const struct regmap_access_table an8855_readable_table = {
+	.yes_ranges = an8855_readable_ranges,
+	.n_yes_ranges = ARRAY_SIZE(an8855_readable_ranges),
+};
+
+static const struct regmap_config an8855_regmap_config = {
+	.reg_bits = 32,
+	.val_bits = 32,
+	.reg_stride = 4,
+	.max_register = 0xbfffffff,
+	.reg_read = an8855_regmap_read,
+	.reg_write = an8855_regmap_write,
+	.reg_update_bits = an8855_regmap_update_bits,
+	.disable_locking = true,
+	.rd_table = &an8855_readable_table,
+};
+
+static int an8855_mfd_probe(struct mdio_device *mdiodev)
+{
+	struct an8855_mfd_priv *priv;
+	struct regmap *regmap;
+
+	priv = devm_kzalloc(&mdiodev->dev, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->bus = mdiodev->bus;
+	priv->dev = &mdiodev->dev;
+	priv->switch_addr = mdiodev->addr;
+	/* no DMA for mdiobus, mute warning for DMA mask not set */
+	priv->dev->dma_mask = &priv->dev->coherent_dma_mask;
+
+	regmap = devm_regmap_init(priv->dev, NULL, priv,
+				  &an8855_regmap_config);
+	if (IS_ERR(regmap))
+		dev_err_probe(priv->dev, PTR_ERR(priv->dev),
+			      "regmap initialization failed\n");
+
+	dev_set_drvdata(&mdiodev->dev, priv);
+
+	return devm_mfd_add_devices(priv->dev, PLATFORM_DEVID_AUTO, an8855_mfd_devs,
+				    ARRAY_SIZE(an8855_mfd_devs), NULL, 0,
+				    NULL);
+}
+
+static const struct of_device_id an8855_mfd_of_match[] = {
+	{ .compatible = "airoha,an8855-mfd" },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, an8855_mfd_of_match);
+
+static struct mdio_driver an8855_mfd_driver = {
+	.probe = an8855_mfd_probe,
+	.mdiodrv.driver = {
+		.name = "an8855",
+		.of_match_table = an8855_mfd_of_match,
+	},
+};
+mdio_module_driver(an8855_mfd_driver);
+
+MODULE_AUTHOR("Christian Marangi <ansuelsmth@gmail.com>");
+MODULE_DESCRIPTION("Driver for Airoha AN8855 MFD");
+MODULE_LICENSE("GPL");
diff --git a/target/linux/mediatek/files-6.6/drivers/net/dsa/an8855.c b/target/linux/mediatek/files-6.6/drivers/net/dsa/an8855.c
new file mode 100644
index 00000000000000..7dd62e1a86f105
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/dsa/an8855.c
@@ -0,0 +1,2311 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Airoha AN8855 DSA Switch driver
+ * Copyright (C) 2023 Min Yao <min.yao@airoha.com>
+ * Copyright (C) 2024 Christian Marangi <ansuelsmth@gmail.com>
+ */
+#include <linux/bitfield.h>
+#include <linux/ethtool.h>
+#include <linux/etherdevice.h>
+#include <linux/gpio/consumer.h>
+#include <linux/if_bridge.h>
+#include <linux/iopoll.h>
+#include <linux/netdevice.h>
+#include <linux/of_net.h>
+#include <linux/of_platform.h>
+#include <linux/phylink.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+#include <net/dsa.h>
+
+#include "an8855.h"
+
+static const struct an8855_mib_desc an8855_mib[] = {
+	MIB_DESC(1, AN8855_PORT_MIB_TX_DROP, "TxDrop"),
+	MIB_DESC(1, AN8855_PORT_MIB_TX_CRC_ERR, "TxCrcErr"),
+	MIB_DESC(1, AN8855_PORT_MIB_TX_COLLISION, "TxCollision"),
+	MIB_DESC(1, AN8855_PORT_MIB_TX_OVERSIZE_DROP, "TxOversizeDrop"),
+	MIB_DESC(2, AN8855_PORT_MIB_TX_BAD_PKT_BYTES, "TxBadPktBytes"),
+	MIB_DESC(1, AN8855_PORT_MIB_RX_DROP, "RxDrop"),
+	MIB_DESC(1, AN8855_PORT_MIB_RX_FILTERING, "RxFiltering"),
+	MIB_DESC(1, AN8855_PORT_MIB_RX_CRC_ERR, "RxCrcErr"),
+	MIB_DESC(1, AN8855_PORT_MIB_RX_CTRL_DROP, "RxCtrlDrop"),
+	MIB_DESC(1, AN8855_PORT_MIB_RX_INGRESS_DROP, "RxIngressDrop"),
+	MIB_DESC(1, AN8855_PORT_MIB_RX_ARL_DROP, "RxArlDrop"),
+	MIB_DESC(1, AN8855_PORT_MIB_FLOW_CONTROL_DROP, "FlowControlDrop"),
+	MIB_DESC(1, AN8855_PORT_MIB_WRED_DROP, "WredDrop"),
+	MIB_DESC(1, AN8855_PORT_MIB_MIRROR_DROP, "MirrorDrop"),
+	MIB_DESC(2, AN8855_PORT_MIB_RX_BAD_PKT_BYTES, "RxBadPktBytes"),
+	MIB_DESC(1, AN8855_PORT_MIB_RXS_FLOW_SAMPLING_PKT_DROP, "RxsFlowSamplingPktDrop"),
+	MIB_DESC(1, AN8855_PORT_MIB_RXS_FLOW_TOTAL_PKT_DROP, "RxsFlowTotalPktDrop"),
+	MIB_DESC(1, AN8855_PORT_MIB_PORT_CONTROL_DROP, "PortControlDrop"),
+};
+
+static int
+an8855_mib_init(struct an8855_priv *priv)
+{
+	int ret;
+
+	ret = regmap_write(priv->regmap, AN8855_MIB_CCR,
+			   AN8855_CCR_MIB_ENABLE);
+	if (ret)
+		return ret;
+
+	return regmap_write(priv->regmap, AN8855_MIB_CCR,
+			    AN8855_CCR_MIB_ACTIVATE);
+}
+
+static void an8855_fdb_write(struct an8855_priv *priv, u16 vid,
+			     u8 port_mask, const u8 *mac,
+			     bool add) __must_hold(&priv->reg_mutex)
+{
+	u32 mac_reg[2] = { };
+	u32 reg;
+
+	mac_reg[0] |= FIELD_PREP(AN8855_ATA1_MAC0, mac[0]);
+	mac_reg[0] |= FIELD_PREP(AN8855_ATA1_MAC1, mac[1]);
+	mac_reg[0] |= FIELD_PREP(AN8855_ATA1_MAC2, mac[2]);
+	mac_reg[0] |= FIELD_PREP(AN8855_ATA1_MAC3, mac[3]);
+	mac_reg[1] |= FIELD_PREP(AN8855_ATA2_MAC4, mac[4]);
+	mac_reg[1] |= FIELD_PREP(AN8855_ATA2_MAC5, mac[5]);
+
+	regmap_bulk_write(priv->regmap, AN8855_ATA1, mac_reg,
+			  ARRAY_SIZE(mac_reg));
+
+	reg = AN8855_ATWD_IVL;
+	if (add)
+		reg |= AN8855_ATWD_VLD;
+	reg |= FIELD_PREP(AN8855_ATWD_VID, vid);
+	reg |= FIELD_PREP(AN8855_ATWD_FID, AN8855_FID_BRIDGED);
+	regmap_write(priv->regmap, AN8855_ATWD, reg);
+	regmap_write(priv->regmap, AN8855_ATWD2,
+		     FIELD_PREP(AN8855_ATWD2_PORT, port_mask));
+}
+
+static void an8855_fdb_read(struct an8855_priv *priv, struct an8855_fdb *fdb)
+{
+	u32 reg[4];
+
+	regmap_bulk_read(priv->regmap, AN8855_ATRD0, reg,
+			 ARRAY_SIZE(reg));
+
+	fdb->live = FIELD_GET(AN8855_ATRD0_LIVE, reg[0]);
+	fdb->type = FIELD_GET(AN8855_ATRD0_TYPE, reg[0]);
+	fdb->ivl = FIELD_GET(AN8855_ATRD0_IVL, reg[0]);
+	fdb->vid = FIELD_GET(AN8855_ATRD0_VID, reg[0]);
+	fdb->fid = FIELD_GET(AN8855_ATRD0_FID, reg[0]);
+	fdb->aging = FIELD_GET(AN8855_ATRD1_AGING, reg[1]);
+	fdb->port_mask = FIELD_GET(AN8855_ATRD3_PORTMASK, reg[3]);
+	fdb->mac[0] = FIELD_GET(AN8855_ATRD2_MAC0, reg[2]);
+	fdb->mac[1] = FIELD_GET(AN8855_ATRD2_MAC1, reg[2]);
+	fdb->mac[2] = FIELD_GET(AN8855_ATRD2_MAC2, reg[2]);
+	fdb->mac[3] = FIELD_GET(AN8855_ATRD2_MAC3, reg[2]);
+	fdb->mac[4] = FIELD_GET(AN8855_ATRD1_MAC4, reg[1]);
+	fdb->mac[5] = FIELD_GET(AN8855_ATRD1_MAC5, reg[1]);
+	fdb->noarp = !!FIELD_GET(AN8855_ATRD0_ARP, reg[0]);
+}
+
+static int an8855_fdb_cmd(struct an8855_priv *priv, u32 cmd,
+			  u32 *rsp) __must_hold(&priv->reg_mutex)
+{
+	u32 val;
+	int ret;
+
+	/* Set the command operating upon the MAC address entries */
+	val = AN8855_ATC_BUSY | cmd;
+	ret = regmap_write(priv->regmap, AN8855_ATC, val);
+	if (ret)
+		return ret;
+
+	ret = regmap_read_poll_timeout(priv->regmap, AN8855_ATC, val,
+				       !(val & AN8855_ATC_BUSY), 20, 200000);
+	if (ret)
+		return ret;
+
+	if (rsp)
+		*rsp = val;
+
+	return 0;
+}
+
+static void
+an8855_port_stp_state_set(struct dsa_switch *ds, int port, u8 state)
+{
+	struct dsa_port *dp = dsa_to_port(ds, port);
+	struct an8855_priv *priv = ds->priv;
+	bool learning = false;
+	u32 stp_state;
+
+	switch (state) {
+	case BR_STATE_DISABLED:
+		stp_state = AN8855_STP_DISABLED;
+		break;
+	case BR_STATE_BLOCKING:
+		stp_state = AN8855_STP_BLOCKING;
+		break;
+	case BR_STATE_LISTENING:
+		stp_state = AN8855_STP_LISTENING;
+		break;
+	case BR_STATE_LEARNING:
+		stp_state = AN8855_STP_LEARNING;
+		learning = dp->learning;
+		break;
+	case BR_STATE_FORWARDING:
+		learning = dp->learning;
+		fallthrough;
+	default:
+		stp_state = AN8855_STP_FORWARDING;
+		break;
+	}
+
+	regmap_update_bits(priv->regmap, AN8855_SSP_P(port),
+			   AN8855_FID_PST_MASK(AN8855_FID_BRIDGED),
+			   AN8855_FID_PST_VAL(AN8855_FID_BRIDGED, stp_state));
+
+	regmap_update_bits(priv->regmap, AN8855_PSC_P(port), AN8855_SA_DIS,
+			   learning ? 0 : AN8855_SA_DIS);
+}
+
+static void an8855_port_fast_age(struct dsa_switch *ds, int port)
+{
+	struct an8855_priv *priv = ds->priv;
+	int ret;
+
+	/* Set to clean Dynamic entry */
+	ret = regmap_write(priv->regmap, AN8855_ATA2, AN8855_ATA2_TYPE);
+	if (ret)
+		return;
+
+	/* Set Port */
+	ret = regmap_write(priv->regmap, AN8855_ATWD2,
+			   FIELD_PREP(AN8855_ATWD2_PORT, BIT(port)));
+	if (ret)
+		return;
+
+	/* Flush Dynamic entry at port */
+	an8855_fdb_cmd(priv, AN8855_ATC_MAT(AND8855_FDB_MAT_MAC_TYPE_PORT) |
+		       AN8855_FDB_FLUSH, NULL);
+}
+
+static int an8855_update_port_member(struct dsa_switch *ds, int port,
+				     const struct net_device *bridge_dev,
+				     bool join)
+{
+	struct an8855_priv *priv = ds->priv;
+	bool isolated, other_isolated;
+	struct dsa_port *dp;
+	u32 port_mask = 0;
+	int ret;
+
+	isolated = !!(priv->port_isolated_map & BIT(port));
+
+	dsa_switch_for_each_user_port(dp, ds) {
+		if (dp->index == port)
+			continue;
+
+		if (!dsa_port_offloads_bridge_dev(dp, bridge_dev))
+			continue;
+
+		other_isolated = !!(priv->port_isolated_map & BIT(dp->index));
+		port_mask |= BIT(dp->index);
+		/* Add/remove this port to the portvlan mask of the other
+		 * ports in the bridge
+		 */
+		if (join && !(isolated && other_isolated))
+			ret = regmap_set_bits(priv->regmap,
+					      AN8855_PORTMATRIX_P(dp->index),
+					      FIELD_PREP(AN8855_USER_PORTMATRIX,
+							 BIT(port)));
+		else
+			ret = regmap_clear_bits(priv->regmap,
+						AN8855_PORTMATRIX_P(dp->index),
+						FIELD_PREP(AN8855_USER_PORTMATRIX,
+							   BIT(port)));
+		if (ret)
+			return ret;
+	}
+
+	/* Add/remove all other ports to this port's portvlan mask */
+	return regmap_update_bits(priv->regmap, AN8855_PORTMATRIX_P(port),
+				  AN8855_USER_PORTMATRIX,
+				  join ? port_mask : ~port_mask);
+}
+
+static int an8855_port_pre_bridge_flags(struct dsa_switch *ds, int port,
+					struct switchdev_brport_flags flags,
+					struct netlink_ext_ack *extack)
+{
+	if (flags.mask & ~(BR_LEARNING | BR_FLOOD | BR_MCAST_FLOOD |
+			   BR_BCAST_FLOOD | BR_ISOLATED))
+		return -EINVAL;
+
+	return 0;
+}
+
+static int an8855_port_bridge_flags(struct dsa_switch *ds, int port,
+				    struct switchdev_brport_flags flags,
+				    struct netlink_ext_ack *extack)
+{
+	struct an8855_priv *priv = ds->priv;
+	int ret;
+
+	if (flags.mask & BR_LEARNING) {
+		ret = regmap_update_bits(priv->regmap, AN8855_PSC_P(port), AN8855_SA_DIS,
+					 flags.val & BR_LEARNING ? 0 : AN8855_SA_DIS);
+		if (ret)
+			return ret;
+	}
+
+	if (flags.mask & BR_FLOOD) {
+		ret = regmap_update_bits(priv->regmap, AN8855_UNUF, BIT(port),
+					 flags.val & BR_FLOOD ? BIT(port) : 0);
+		if (ret)
+			return ret;
+	}
+
+	if (flags.mask & BR_MCAST_FLOOD) {
+		ret = regmap_update_bits(priv->regmap, AN8855_UNMF, BIT(port),
+					 flags.val & BR_MCAST_FLOOD ? BIT(port) : 0);
+		if (ret)
+			return ret;
+
+		ret = regmap_update_bits(priv->regmap, AN8855_UNIPMF, BIT(port),
+					 flags.val & BR_MCAST_FLOOD ? BIT(port) : 0);
+		if (ret)
+			return ret;
+	}
+
+	if (flags.mask & BR_BCAST_FLOOD) {
+		ret = regmap_update_bits(priv->regmap, AN8855_BCF, BIT(port),
+					 flags.val & BR_BCAST_FLOOD ? BIT(port) : 0);
+		if (ret)
+			return ret;
+	}
+
+	if (flags.mask & BR_ISOLATED) {
+		struct dsa_port *dp = dsa_to_port(ds, port);
+		struct net_device *bridge_dev = dsa_port_bridge_dev_get(dp);
+
+		if (flags.val & BR_ISOLATED)
+			priv->port_isolated_map |= BIT(port);
+		else
+			priv->port_isolated_map &= ~BIT(port);
+
+		ret = an8855_update_port_member(ds, port, bridge_dev, true);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+static int an8855_set_ageing_time(struct dsa_switch *ds, unsigned int msecs)
+{
+	struct an8855_priv *priv = ds->priv;
+	u32 age_count, age_unit, val;
+
+	/* Convert msec in AN8855_L2_AGING_MS_CONSTANT counter */
+	val = msecs / AN8855_L2_AGING_MS_CONSTANT;
+	/* Derive the count unit */
+	age_unit = val / FIELD_MAX(AN8855_AGE_UNIT);
+	/* Get the count in unit, age_unit is always incremented by 1 internally */
+	age_count = val / (age_unit + 1);
+
+	return regmap_update_bits(priv->regmap, AN8855_AAC,
+				  AN8855_AGE_CNT | AN8855_AGE_UNIT,
+				  FIELD_PREP(AN8855_AGE_CNT, age_count) |
+				  FIELD_PREP(AN8855_AGE_UNIT, age_unit));
+}
+
+static int an8855_port_bridge_join(struct dsa_switch *ds, int port,
+				   struct dsa_bridge bridge,
+				   bool *tx_fwd_offload,
+				   struct netlink_ext_ack *extack)
+{
+	struct an8855_priv *priv = ds->priv;
+	int ret;
+
+	ret = an8855_update_port_member(ds, port, bridge.dev, true);
+	if (ret)
+		return ret;
+
+	/* Set to fallback mode for independent VLAN learning if in a bridge */
+	return regmap_update_bits(priv->regmap, AN8855_PCR_P(port),
+				  AN8855_PORT_VLAN,
+				  FIELD_PREP(AN8855_PORT_VLAN,
+					     AN8855_PORT_FALLBACK_MODE));
+}
+
+static void an8855_port_bridge_leave(struct dsa_switch *ds, int port,
+				     struct dsa_bridge bridge)
+{
+	struct an8855_priv *priv = ds->priv;
+
+	an8855_update_port_member(ds, port, bridge.dev, false);
+
+	/* When a port is removed from the bridge, the port would be set up
+	 * back to the default as is at initial boot which is a VLAN-unaware
+	 * port.
+	 */
+	regmap_update_bits(priv->regmap, AN8855_PCR_P(port),
+			   AN8855_PORT_VLAN,
+			   FIELD_PREP(AN8855_PORT_VLAN,
+				      AN8855_PORT_MATRIX_MODE));
+}
+
+static int an8855_port_fdb_add(struct dsa_switch *ds, int port,
+			       const unsigned char *addr, u16 vid,
+			       struct dsa_db db)
+{
+	struct an8855_priv *priv = ds->priv;
+	u8 port_mask = BIT(port);
+	int ret;
+
+	/* Set the vid to the port vlan id if no vid is set */
+	if (!vid)
+		vid = AN8855_PORT_VID_DEFAULT;
+
+	mutex_lock(&priv->reg_mutex);
+	an8855_fdb_write(priv, vid, port_mask, addr, true);
+	ret = an8855_fdb_cmd(priv, AN8855_FDB_WRITE, NULL);
+	mutex_unlock(&priv->reg_mutex);
+
+	return ret;
+}
+
+static int an8855_port_fdb_del(struct dsa_switch *ds, int port,
+			       const unsigned char *addr, u16 vid,
+			       struct dsa_db db)
+{
+	struct an8855_priv *priv = ds->priv;
+	u8 port_mask = BIT(port);
+	int ret;
+
+	/* Set the vid to the port vlan id if no vid is set */
+	if (!vid)
+		vid = AN8855_PORT_VID_DEFAULT;
+
+	mutex_lock(&priv->reg_mutex);
+	an8855_fdb_write(priv, vid, port_mask, addr, false);
+	ret = an8855_fdb_cmd(priv, AN8855_FDB_WRITE, NULL);
+	mutex_unlock(&priv->reg_mutex);
+
+	return ret;
+}
+
+static int an8855_port_fdb_dump(struct dsa_switch *ds, int port,
+				dsa_fdb_dump_cb_t *cb, void *data)
+{
+	struct an8855_priv *priv = ds->priv;
+	int banks, count = 0;
+	u32 rsp;
+	int ret;
+	int i;
+
+	mutex_lock(&priv->reg_mutex);
+
+	/* Load search port */
+	ret = regmap_write(priv->regmap, AN8855_ATWD2,
+			   FIELD_PREP(AN8855_ATWD2_PORT, BIT(port)));
+	if (ret)
+		goto exit;
+	ret = an8855_fdb_cmd(priv, AN8855_ATC_MAT(AND8855_FDB_MAT_MAC_PORT) |
+			     AN8855_FDB_START, &rsp);
+	if (ret < 0)
+		goto exit;
+
+	do {
+		/* From response get the number of banks to read, exit if 0 */
+		banks = FIELD_GET(AN8855_ATC_HIT, rsp);
+		if (!banks)
+			break;
+
+		/* Each banks have 4 entry */
+		for (i = 0; i < 4; i++) {
+			struct an8855_fdb _fdb = {  };
+
+			count++;
+
+			/* Check if bank is present */
+			if (!(banks & BIT(i)))
+				continue;
+
+			/* Select bank entry index */
+			ret = regmap_write(priv->regmap, AN8855_ATRDS,
+					   FIELD_PREP(AN8855_ATRD_SEL, i));
+			if (ret)
+				break;
+			/* wait 1ms for the bank entry to be filled */
+			usleep_range(1000, 1500);
+			an8855_fdb_read(priv, &_fdb);
+
+			if (!_fdb.live)
+				continue;
+			ret = cb(_fdb.mac, _fdb.vid, _fdb.noarp, data);
+			if (ret < 0)
+				break;
+		}
+
+		/* Stop if reached max FDB number */
+		if (count >= AN8855_NUM_FDB_RECORDS)
+			break;
+
+		/* Read next bank */
+		ret = an8855_fdb_cmd(priv, AN8855_ATC_MAT(AND8855_FDB_MAT_MAC_PORT) |
+				     AN8855_FDB_NEXT, &rsp);
+		if (ret < 0)
+			break;
+	} while (true);
+
+exit:
+	mutex_unlock(&priv->reg_mutex);
+	return ret;
+}
+
+static int an8855_vlan_cmd(struct an8855_priv *priv, enum an8855_vlan_cmd cmd,
+			   u16 vid) __must_hold(&priv->reg_mutex)
+{
+	u32 val;
+	int ret;
+
+	val = AN8855_VTCR_BUSY | FIELD_PREP(AN8855_VTCR_FUNC, cmd) |
+	      FIELD_PREP(AN8855_VTCR_VID, vid);
+	ret = regmap_write(priv->regmap, AN8855_VTCR, val);
+	if (ret)
+		return ret;
+
+	return regmap_read_poll_timeout(priv->regmap, AN8855_VTCR, val,
+					!(val & AN8855_VTCR_BUSY), 20, 200000);
+}
+
+static int an8855_vlan_add(struct an8855_priv *priv, u8 port, u16 vid,
+			   bool untagged) __must_hold(&priv->reg_mutex)
+{
+	u32 port_mask;
+	u32 val;
+	int ret;
+
+	/* Fetch entry */
+	ret = an8855_vlan_cmd(priv, AN8855_VTCR_RD_VID, vid);
+	if (ret)
+		return ret;
+
+	ret = regmap_read(priv->regmap, AN8855_VARD0, &val);
+	if (ret)
+		return ret;
+	port_mask = FIELD_GET(AN8855_VA0_PORT, val) | BIT(port);
+
+	/* Validate the entry with independent learning, create egress tag per
+	 * VLAN and joining the port as one of the port members.
+	 */
+	val = (val & AN8855_VA0_ETAG) | AN8855_VA0_IVL_MAC |
+	      AN8855_VA0_VTAG_EN | AN8855_VA0_VLAN_VALID |
+	      FIELD_PREP(AN8855_VA0_PORT, port_mask) |
+	      FIELD_PREP(AN8855_VA0_FID, AN8855_FID_BRIDGED);
+	ret = regmap_write(priv->regmap, AN8855_VAWD0, val);
+	if (ret)
+		return ret;
+	ret = regmap_write(priv->regmap, AN8855_VAWD1, 0);
+	if (ret)
+		return ret;
+
+	/* CPU port is always taken as a tagged port for serving more than one
+	 * VLANs across and also being applied with egress type stack mode for
+	 * that VLAN tags would be appended after hardware special tag used as
+	 * DSA tag.
+	 */
+	if (port == AN8855_CPU_PORT)
+		val = AN8855_VLAN_EGRESS_STACK;
+	/* Decide whether adding tag or not for those outgoing packets from the
+	 * port inside the VLAN.
+	 */
+	else
+		val = untagged ? AN8855_VLAN_EGRESS_UNTAG : AN8855_VLAN_EGRESS_TAG;
+	ret = regmap_update_bits(priv->regmap, AN8855_VAWD0,
+				 AN8855_VA0_ETAG_PORT_MASK(port),
+				 AN8855_VA0_ETAG_PORT_VAL(port, val));
+	if (ret)
+		return ret;
+
+	/* Flush result to hardware */
+	return an8855_vlan_cmd(priv, AN8855_VTCR_WR_VID, vid);
+}
+
+static int an8855_vlan_del(struct an8855_priv *priv, u8 port,
+			   u16 vid) __must_hold(&priv->reg_mutex)
+{
+	u32 port_mask;
+	u32 val;
+	int ret;
+
+	/* Fetch entry */
+	ret = an8855_vlan_cmd(priv, AN8855_VTCR_RD_VID, vid);
+	if (ret)
+		return ret;
+
+	ret = regmap_read(priv->regmap, AN8855_VARD0, &val);
+	if (ret)
+		return ret;
+	port_mask = FIELD_GET(AN8855_VA0_PORT, val) & ~BIT(port);
+
+	if (!(val & AN8855_VA0_VLAN_VALID)) {
+		dev_err(priv->dev, "Cannot be deleted due to invalid entry\n");
+		return -EINVAL;
+	}
+
+	if (port_mask) {
+		val = (val & AN8855_VA0_ETAG) | AN8855_VA0_IVL_MAC |
+		       AN8855_VA0_VTAG_EN | AN8855_VA0_VLAN_VALID |
+		       FIELD_PREP(AN8855_VA0_PORT, port_mask);
+		ret = regmap_write(priv->regmap, AN8855_VAWD0, val);
+		if (ret)
+			return ret;
+	} else {
+		ret = regmap_write(priv->regmap, AN8855_VAWD0, 0);
+		if (ret)
+			return ret;
+	}
+	ret = regmap_write(priv->regmap, AN8855_VAWD1, 0);
+	if (ret)
+		return ret;
+
+	/* Flush result to hardware */
+	return an8855_vlan_cmd(priv, AN8855_VTCR_WR_VID, vid);
+}
+
+static int an8855_port_set_vlan_mode(struct an8855_priv *priv, int port,
+				     enum an8855_port_mode port_mode,
+				     enum an8855_vlan_port_eg_tag eg_tag,
+				     enum an8855_vlan_port_attr vlan_attr,
+				     enum an8855_vlan_port_acc_frm acc_frm)
+{
+	int ret;
+
+	ret = regmap_update_bits(priv->regmap, AN8855_PCR_P(port),
+				 AN8855_PORT_VLAN,
+				 FIELD_PREP(AN8855_PORT_VLAN, port_mode));
+	if (ret)
+		return ret;
+
+	return regmap_update_bits(priv->regmap, AN8855_PVC_P(port),
+				  AN8855_PVC_EG_TAG | AN8855_VLAN_ATTR | AN8855_ACC_FRM,
+				  FIELD_PREP(AN8855_PVC_EG_TAG, eg_tag) |
+				  FIELD_PREP(AN8855_VLAN_ATTR, vlan_attr) |
+				  FIELD_PREP(AN8855_ACC_FRM, acc_frm));
+}
+
+static int an8855_port_set_pid(struct an8855_priv *priv, int port,
+			       u16 pid)
+{
+	int ret;
+
+	ret = regmap_update_bits(priv->regmap, AN8855_PPBV1_P(port),
+				 AN8855_PPBV_G0_PORT_VID,
+				 FIELD_PREP(AN8855_PPBV_G0_PORT_VID, pid));
+	if (ret)
+		return ret;
+
+	return regmap_update_bits(priv->regmap, AN8855_PVID_P(port),
+				  AN8855_G0_PORT_VID,
+				  FIELD_PREP(AN8855_G0_PORT_VID, pid));
+}
+
+static int an8855_port_vlan_filtering(struct dsa_switch *ds, int port,
+				      bool vlan_filtering,
+				      struct netlink_ext_ack *extack)
+{
+	struct an8855_priv *priv = ds->priv;
+	u32 val;
+	int ret;
+
+	/* The port is being kept as VLAN-unaware port when bridge is
+	 * set up with vlan_filtering not being set, Otherwise, the
+	 * port and the corresponding CPU port is required the setup
+	 * for becoming a VLAN-aware port.
+	 */
+	if (vlan_filtering) {
+		u32 acc_frm;
+		/* CPU port is set to fallback mode to let untagged
+		 * frames pass through.
+		 */
+		ret = an8855_port_set_vlan_mode(priv, AN8855_CPU_PORT,
+						AN8855_PORT_FALLBACK_MODE,
+						AN8855_VLAN_EG_CONSISTENT,
+						AN8855_VLAN_USER,
+						AN8855_VLAN_ACC_ALL);
+		if (ret)
+			return ret;
+
+		ret = regmap_read(priv->regmap, AN8855_PVID_P(port), &val);
+		if (ret)
+			return ret;
+
+		/* Only accept tagged frames if PVID is not set */
+		if (FIELD_GET(AN8855_G0_PORT_VID, val) != AN8855_PORT_VID_DEFAULT)
+			acc_frm = AN8855_VLAN_ACC_TAGGED;
+		else
+			acc_frm = AN8855_VLAN_ACC_ALL;
+
+		/* Trapped into security mode allows packet forwarding through VLAN
+		 * table lookup.
+		 * Set the port as a user port which is to be able to recognize VID
+		 * from incoming packets before fetching entry within the VLAN table.
+		 */
+		ret = an8855_port_set_vlan_mode(priv, port,
+						AN8855_PORT_SECURITY_MODE,
+						AN8855_VLAN_EG_DISABLED,
+						AN8855_VLAN_USER,
+						acc_frm);
+		if (ret)
+			return ret;
+	} else {
+		bool disable_cpu_vlan = true;
+		struct dsa_port *dp;
+		u32 port_mode;
+
+		/* This is called after .port_bridge_leave when leaving a VLAN-aware
+		 * bridge. Don't set standalone ports to fallback mode.
+		 */
+		if (dsa_port_bridge_dev_get(dsa_to_port(ds, port)))
+			port_mode = AN8855_PORT_FALLBACK_MODE;
+		else
+			port_mode = AN8855_PORT_MATRIX_MODE;
+
+		/* When a port is removed from the bridge, the port would be set up
+		 * back to the default as is at initial boot which is a VLAN-unaware
+		 * port.
+		 */
+		ret = an8855_port_set_vlan_mode(priv, port, port_mode,
+						AN8855_VLAN_EG_CONSISTENT,
+						AN8855_VLAN_TRANSPARENT,
+						AN8855_VLAN_ACC_ALL);
+		if (ret)
+			return ret;
+
+		/* Restore default PVID */
+		ret = an8855_port_set_pid(priv, port, AN8855_PORT_VID_DEFAULT);
+		if (ret)
+			return ret;
+
+		dsa_switch_for_each_user_port(dp, ds) {
+			if (dsa_port_is_vlan_filtering(dp)) {
+				disable_cpu_vlan = false;
+				break;
+			}
+		}
+
+		if (disable_cpu_vlan) {
+			ret = an8855_port_set_vlan_mode(priv, AN8855_CPU_PORT,
+							AN8855_PORT_MATRIX_MODE,
+							AN8855_VLAN_EG_CONSISTENT,
+							AN8855_VLAN_USER,
+							AN8855_VLAN_ACC_ALL);
+			if (ret)
+				return ret;
+		}
+	}
+
+	return 0;
+}
+
+static int an8855_port_vlan_add(struct dsa_switch *ds, int port,
+				const struct switchdev_obj_port_vlan *vlan,
+				struct netlink_ext_ack *extack)
+{
+	bool untagged = vlan->flags & BRIDGE_VLAN_INFO_UNTAGGED;
+	bool pvid = vlan->flags & BRIDGE_VLAN_INFO_PVID;
+	struct an8855_priv *priv = ds->priv;
+	u32 val;
+	int ret;
+
+	mutex_lock(&priv->reg_mutex);
+	ret = an8855_vlan_add(priv, port, vlan->vid, untagged);
+	mutex_unlock(&priv->reg_mutex);
+	if (ret)
+		return ret;
+
+	if (pvid) {
+		/* Accept all frames if PVID is set */
+		regmap_update_bits(priv->regmap, AN8855_PVC_P(port), AN8855_ACC_FRM,
+				   FIELD_PREP(AN8855_ACC_FRM, AN8855_VLAN_ACC_ALL));
+
+		/* Only configure PVID if VLAN filtering is enabled */
+		if (dsa_port_is_vlan_filtering(dsa_to_port(ds, port))) {
+			ret = an8855_port_set_pid(priv, port, vlan->vid);
+			if (ret)
+				return ret;
+		}
+	} else if (vlan->vid) {
+		ret = regmap_read(priv->regmap, AN8855_PVID_P(port), &val);
+		if (ret)
+			return ret;
+
+		if (FIELD_GET(AN8855_G0_PORT_VID, val) != vlan->vid)
+			return 0;
+
+		/* This VLAN is overwritten without PVID, so unset it */
+		if (dsa_port_is_vlan_filtering(dsa_to_port(ds, port))) {
+			ret = regmap_update_bits(priv->regmap, AN8855_PVC_P(port),
+						 AN8855_ACC_FRM,
+						 FIELD_PREP(AN8855_ACC_FRM,
+							    AN8855_VLAN_ACC_TAGGED));
+			if (ret)
+				return ret;
+		}
+
+		ret = an8855_port_set_pid(priv, port, AN8855_PORT_VID_DEFAULT);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+static int an8855_port_vlan_del(struct dsa_switch *ds, int port,
+				const struct switchdev_obj_port_vlan *vlan)
+{
+	struct an8855_priv *priv = ds->priv;
+	u32 val;
+	int ret;
+
+	mutex_lock(&priv->reg_mutex);
+	ret = an8855_vlan_del(priv, port, vlan->vid);
+	mutex_unlock(&priv->reg_mutex);
+	if (ret)
+		return ret;
+
+	ret = regmap_read(priv->regmap, AN8855_PVID_P(port), &val);
+	if (ret)
+		return ret;
+
+	/* PVID is being restored to the default whenever the PVID port
+	 * is being removed from the VLAN.
+	 */
+	if (FIELD_GET(AN8855_G0_PORT_VID, val) == vlan->vid) {
+		/* Only accept tagged frames if the port is VLAN-aware */
+		if (dsa_port_is_vlan_filtering(dsa_to_port(ds, port))) {
+			ret = regmap_update_bits(priv->regmap, AN8855_PVC_P(port),
+						 AN8855_ACC_FRM,
+						 FIELD_PREP(AN8855_ACC_FRM,
+							    AN8855_VLAN_ACC_TAGGED));
+			if (ret)
+				return ret;
+		}
+
+		ret = an8855_port_set_pid(priv, port, AN8855_PORT_VID_DEFAULT);
+		if (ret)
+			return ret;
+	}
+
+	return 0;
+}
+
+static int
+an8855_port_mdb_add(struct dsa_switch *ds, int port,
+		    const struct switchdev_obj_port_mdb *mdb,
+		    struct dsa_db db)
+{
+	struct an8855_priv *priv = ds->priv;
+	const u8 *addr = mdb->addr;
+	u16 vid = mdb->vid;
+	u8 port_mask = 0;
+	u32 val;
+	int ret;
+
+	/* Set the vid to the port vlan id if no vid is set */
+	if (!vid)
+		vid = AN8855_PORT_VID_DEFAULT;
+
+	mutex_lock(&priv->reg_mutex);
+
+	an8855_fdb_write(priv, vid, 0, addr, false);
+	if (!an8855_fdb_cmd(priv, AN8855_FDB_READ, NULL)) {
+		ret = regmap_read(priv->regmap, AN8855_ATRD3, &val);
+		if (ret)
+			goto exit;
+
+		port_mask = FIELD_GET(AN8855_ATRD3_PORTMASK, val);
+	}
+
+	port_mask |= BIT(port);
+	an8855_fdb_write(priv, vid, port_mask, addr, true);
+	ret = an8855_fdb_cmd(priv, AN8855_FDB_WRITE, NULL);
+
+exit:
+	mutex_unlock(&priv->reg_mutex);
+
+	return ret;
+}
+
+static int
+an8855_port_mdb_del(struct dsa_switch *ds, int port,
+		    const struct switchdev_obj_port_mdb *mdb,
+		    struct dsa_db db)
+{
+	struct an8855_priv *priv = ds->priv;
+	const u8 *addr = mdb->addr;
+	u16 vid = mdb->vid;
+	u8 port_mask = 0;
+	u32 val;
+	int ret;
+
+	/* Set the vid to the port vlan id if no vid is set */
+	if (!vid)
+		vid = AN8855_PORT_VID_DEFAULT;
+
+	mutex_lock(&priv->reg_mutex);
+
+	an8855_fdb_write(priv, vid, 0, addr, 0);
+	if (!an8855_fdb_cmd(priv, AN8855_FDB_READ, NULL)) {
+		ret = regmap_read(priv->regmap, AN8855_ATRD3, &val);
+		if (ret)
+			goto exit;
+
+		port_mask = FIELD_GET(AN8855_ATRD3_PORTMASK, val);
+	}
+
+	port_mask &= ~BIT(port);
+	an8855_fdb_write(priv, vid, port_mask, addr, port_mask ? true : false);
+	ret = an8855_fdb_cmd(priv, AN8855_FDB_WRITE, NULL);
+
+exit:
+	mutex_unlock(&priv->reg_mutex);
+
+	return ret;
+}
+
+static int
+an8855_port_change_mtu(struct dsa_switch *ds, int port, int new_mtu)
+{
+	struct an8855_priv *priv = ds->priv;
+	int length;
+	u32 val;
+
+	/* When a new MTU is set, DSA always set the CPU port's MTU to the
+	 * largest MTU of the slave ports. Because the switch only has a global
+	 * RX length register, only allowing CPU port here is enough.
+	 */
+	if (!dsa_is_cpu_port(ds, port))
+		return 0;
+
+	/* RX length also includes Ethernet header, MTK tag, and FCS length */
+	length = new_mtu + ETH_HLEN + MTK_TAG_LEN + ETH_FCS_LEN;
+	if (length <= 1522)
+		val = AN8855_MAX_RX_PKT_1518_1522;
+	else if (length <= 1536)
+		val = AN8855_MAX_RX_PKT_1536;
+	else if (length <= 1552)
+		val = AN8855_MAX_RX_PKT_1552;
+	else if (length <= 3072)
+		val = AN8855_MAX_RX_JUMBO_3K;
+	else if (length <= 4096)
+		val = AN8855_MAX_RX_JUMBO_4K;
+	else if (length <= 5120)
+		val = AN8855_MAX_RX_JUMBO_5K;
+	else if (length <= 6144)
+		val = AN8855_MAX_RX_JUMBO_6K;
+	else if (length <= 7168)
+		val = AN8855_MAX_RX_JUMBO_7K;
+	else if (length <= 8192)
+		val = AN8855_MAX_RX_JUMBO_8K;
+	else if (length <= 9216)
+		val = AN8855_MAX_RX_JUMBO_9K;
+	else if (length <= 12288)
+		val = AN8855_MAX_RX_JUMBO_12K;
+	else if (length <= 15360)
+		val = AN8855_MAX_RX_JUMBO_15K;
+	else
+		val = AN8855_MAX_RX_JUMBO_16K;
+
+	/* Enable JUMBO packet */
+	if (length > 1552)
+		val |= AN8855_MAX_RX_PKT_JUMBO;
+
+	return regmap_update_bits(priv->regmap, AN8855_GMACCR,
+				  AN8855_MAX_RX_JUMBO | AN8855_MAX_RX_PKT_LEN,
+				  val);
+}
+
+static int
+an8855_port_max_mtu(struct dsa_switch *ds, int port)
+{
+	return AN8855_MAX_MTU;
+}
+
+static void
+an8855_get_strings(struct dsa_switch *ds, int port, u32 stringset,
+		   uint8_t *data)
+{
+	int i;
+
+	if (stringset != ETH_SS_STATS)
+		return;
+
+	for (i = 0; i < ARRAY_SIZE(an8855_mib); i++)
+		ethtool_puts(&data, an8855_mib[i].name);
+}
+
+static void
+an8855_read_port_stats(struct an8855_priv *priv, int port, u32 offset, u8 size,
+		       uint64_t *data)
+{
+	u32 val, reg = AN8855_PORT_MIB_COUNTER(port) + offset;
+
+	regmap_read(priv->regmap, reg, &val);
+	*data = val;
+
+	if (size == 2) {
+		regmap_read(priv->regmap, reg + 4, &val);
+		*data |= (u64)val << 32;
+	}
+}
+
+static void
+an8855_get_ethtool_stats(struct dsa_switch *ds, int port, uint64_t *data)
+{
+	struct an8855_priv *priv = ds->priv;
+	const struct an8855_mib_desc *mib;
+	int i;
+
+	for (i = 0; i < ARRAY_SIZE(an8855_mib); i++) {
+		mib = &an8855_mib[i];
+
+		an8855_read_port_stats(priv, port, mib->offset, mib->size,
+				       data + i);
+	}
+}
+
+static int
+an8855_get_sset_count(struct dsa_switch *ds, int port, int sset)
+{
+	if (sset != ETH_SS_STATS)
+		return 0;
+
+	return ARRAY_SIZE(an8855_mib);
+}
+
+static void
+an8855_get_eth_mac_stats(struct dsa_switch *ds, int port,
+			 struct ethtool_eth_mac_stats *mac_stats)
+{
+	struct an8855_priv *priv = ds->priv;
+
+	/* MIB counter doesn't provide a FramesTransmittedOK but instead
+	 * provide stats for Unicast, Broadcast and Multicast frames separately.
+	 * To simulate a global frame counter, read Unicast and addition Multicast
+	 * and Broadcast later
+	 */
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_TX_UNICAST, 1,
+			       &mac_stats->FramesTransmittedOK);
+
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_TX_SINGLE_COLLISION, 1,
+			       &mac_stats->SingleCollisionFrames);
+
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_TX_MULTIPLE_COLLISION, 1,
+			       &mac_stats->MultipleCollisionFrames);
+
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_RX_UNICAST, 1,
+			       &mac_stats->FramesReceivedOK);
+
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_TX_BYTES, 2,
+			       &mac_stats->OctetsTransmittedOK);
+
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_RX_ALIGN_ERR, 1,
+			       &mac_stats->AlignmentErrors);
+
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_TX_DEFERRED, 1,
+			       &mac_stats->FramesWithDeferredXmissions);
+
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_TX_LATE_COLLISION, 1,
+			       &mac_stats->LateCollisions);
+
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_TX_EXCESSIVE_COLLISION, 1,
+			       &mac_stats->FramesAbortedDueToXSColls);
+
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_RX_BYTES, 2,
+			       &mac_stats->OctetsReceivedOK);
+
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_TX_MULTICAST, 1,
+			       &mac_stats->MulticastFramesXmittedOK);
+	mac_stats->FramesTransmittedOK += mac_stats->MulticastFramesXmittedOK;
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_TX_BROADCAST, 1,
+			       &mac_stats->BroadcastFramesXmittedOK);
+	mac_stats->FramesTransmittedOK += mac_stats->BroadcastFramesXmittedOK;
+
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_RX_MULTICAST, 1,
+			       &mac_stats->MulticastFramesReceivedOK);
+	mac_stats->FramesReceivedOK += mac_stats->MulticastFramesReceivedOK;
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_RX_BROADCAST, 1,
+			       &mac_stats->BroadcastFramesReceivedOK);
+	mac_stats->FramesReceivedOK += mac_stats->BroadcastFramesReceivedOK;
+}
+
+static const struct ethtool_rmon_hist_range an8855_rmon_ranges[] = {
+	{ 0, 64 },
+	{ 65, 127 },
+	{ 128, 255 },
+	{ 256, 511 },
+	{ 512, 1023 },
+	{ 1024, 1518 },
+	{ 1519, AN8855_MAX_MTU },
+	{}
+};
+
+static void an8855_get_rmon_stats(struct dsa_switch *ds, int port,
+				  struct ethtool_rmon_stats *rmon_stats,
+				  const struct ethtool_rmon_hist_range **ranges)
+{
+	struct an8855_priv *priv = ds->priv;
+
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_RX_UNDER_SIZE_ERR, 1,
+			       &rmon_stats->undersize_pkts);
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_RX_OVER_SZ_ERR, 1,
+			       &rmon_stats->oversize_pkts);
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_RX_FRAG_ERR, 1,
+			       &rmon_stats->fragments);
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_RX_JABBER_ERR, 1,
+			       &rmon_stats->jabbers);
+
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_RX_PKT_SZ_64, 1,
+			       &rmon_stats->hist[0]);
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_RX_PKT_SZ_65_TO_127, 1,
+			       &rmon_stats->hist[1]);
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_RX_PKT_SZ_128_TO_255, 1,
+			       &rmon_stats->hist[2]);
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_RX_PKT_SZ_256_TO_511, 1,
+			       &rmon_stats->hist[3]);
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_RX_PKT_SZ_512_TO_1023, 1,
+			       &rmon_stats->hist[4]);
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_RX_PKT_SZ_1024_TO_1518, 1,
+			       &rmon_stats->hist[5]);
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_RX_PKT_SZ_1519_TO_MAX, 1,
+			       &rmon_stats->hist[6]);
+
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_TX_PKT_SZ_64, 1,
+			       &rmon_stats->hist_tx[0]);
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_TX_PKT_SZ_65_TO_127, 1,
+			       &rmon_stats->hist_tx[1]);
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_TX_PKT_SZ_128_TO_255, 1,
+			       &rmon_stats->hist_tx[2]);
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_TX_PKT_SZ_256_TO_511, 1,
+			       &rmon_stats->hist_tx[3]);
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_TX_PKT_SZ_512_TO_1023, 1,
+			       &rmon_stats->hist_tx[4]);
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_TX_PKT_SZ_1024_TO_1518, 1,
+			       &rmon_stats->hist_tx[5]);
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_TX_PKT_SZ_1519_TO_MAX, 1,
+			       &rmon_stats->hist_tx[6]);
+
+	*ranges = an8855_rmon_ranges;
+}
+
+static void an8855_get_eth_ctrl_stats(struct dsa_switch *ds, int port,
+				      struct ethtool_eth_ctrl_stats *ctrl_stats)
+{
+	struct an8855_priv *priv = ds->priv;
+
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_TX_PAUSE, 1,
+			       &ctrl_stats->MACControlFramesTransmitted);
+
+	an8855_read_port_stats(priv, port, AN8855_PORT_MIB_RX_PAUSE, 1,
+			       &ctrl_stats->MACControlFramesReceived);
+}
+
+static int an8855_port_mirror_add(struct dsa_switch *ds, int port,
+				  struct dsa_mall_mirror_tc_entry *mirror,
+				  bool ingress,
+				  struct netlink_ext_ack *extack)
+{
+	struct an8855_priv *priv = ds->priv;
+	int monitor_port;
+	u32 val;
+	int ret;
+
+	/* Check for existent entry */
+	if ((ingress ? priv->mirror_rx : priv->mirror_tx) & BIT(port))
+		return -EEXIST;
+
+	ret = regmap_read(priv->regmap, AN8855_MIR, &val);
+	if (ret)
+		return ret;
+
+	/* AN8855 supports 4 monitor port, but only use first group */
+	monitor_port = FIELD_GET(AN8855_MIRROR_PORT, val);
+	if (val & AN8855_MIRROR_EN && monitor_port != mirror->to_local_port)
+		return -EEXIST;
+
+	val = AN8855_MIRROR_EN;
+	val |= FIELD_PREP(AN8855_MIRROR_PORT, mirror->to_local_port);
+	ret = regmap_update_bits(priv->regmap, AN8855_MIR,
+				 AN8855_MIRROR_EN | AN8855_MIRROR_PORT,
+				 val);
+	if (ret)
+		return ret;
+
+	ret = regmap_set_bits(priv->regmap, AN8855_PCR_P(port),
+			      ingress ? AN8855_PORT_RX_MIR : AN8855_PORT_TX_MIR);
+	if (ret)
+		return ret;
+
+	if (ingress)
+		priv->mirror_rx |= BIT(port);
+	else
+		priv->mirror_tx |= BIT(port);
+
+	return 0;
+}
+
+static void an8855_port_mirror_del(struct dsa_switch *ds, int port,
+				   struct dsa_mall_mirror_tc_entry *mirror)
+{
+	struct an8855_priv *priv = ds->priv;
+
+	if (mirror->ingress)
+		priv->mirror_rx &= ~BIT(port);
+	else
+		priv->mirror_tx &= ~BIT(port);
+
+	regmap_clear_bits(priv->regmap, AN8855_PCR_P(port),
+			  mirror->ingress ? AN8855_PORT_RX_MIR :
+					    AN8855_PORT_TX_MIR);
+
+	if (!priv->mirror_rx && !priv->mirror_tx)
+		regmap_clear_bits(priv->regmap, AN8855_MIR, AN8855_MIRROR_EN);
+}
+
+static int an8855_port_set_status(struct an8855_priv *priv, int port,
+				  bool enable)
+{
+	if (enable)
+		return regmap_set_bits(priv->regmap, AN8855_PMCR_P(port),
+				       AN8855_PMCR_TX_EN | AN8855_PMCR_RX_EN);
+	else
+		return regmap_clear_bits(priv->regmap, AN8855_PMCR_P(port),
+					 AN8855_PMCR_TX_EN | AN8855_PMCR_RX_EN);
+}
+
+static int an8855_port_enable(struct dsa_switch *ds, int port,
+			      struct phy_device *phy)
+{
+	return an8855_port_set_status(ds->priv, port, true);
+}
+
+static void an8855_port_disable(struct dsa_switch *ds, int port)
+{
+	an8855_port_set_status(ds->priv, port, false);
+}
+
+static u32 en8855_get_phy_flags(struct dsa_switch *ds, int port)
+{
+	struct an8855_priv *priv = ds->priv;
+
+	/* PHY doesn't need calibration */
+	if (!priv->phy_require_calib)
+		return 0;
+
+	/* Use AN8855_PHY_FLAGS_EN_CALIBRATION to signal
+	 * calibration needed.
+	 */
+	return AN8855_PHY_FLAGS_EN_CALIBRATION;
+}
+
+static enum dsa_tag_protocol
+an8855_get_tag_protocol(struct dsa_switch *ds, int port,
+			enum dsa_tag_protocol mp)
+{
+	return DSA_TAG_PROTO_MTK;
+}
+
+/* Similar to MT7530 also trap link local frame and special frame to CPU */
+static int an8855_trap_special_frames(struct an8855_priv *priv)
+{
+	int ret;
+
+	/* Trap BPDUs to the CPU port(s) and egress them
+	 * VLAN-untagged.
+	 */
+	ret = regmap_update_bits(priv->regmap, AN8855_BPC,
+				 AN8855_BPDU_BPDU_FR | AN8855_BPDU_EG_TAG |
+				 AN8855_BPDU_PORT_FW,
+				 AN8855_BPDU_BPDU_FR |
+				 FIELD_PREP(AN8855_BPDU_EG_TAG, AN8855_VLAN_EG_UNTAGGED) |
+				 FIELD_PREP(AN8855_BPDU_PORT_FW, AN8855_BPDU_CPU_ONLY));
+	if (ret)
+		return ret;
+
+	/* Trap 802.1X PAE frames to the CPU port(s) and egress them
+	 * VLAN-untagged.
+	 */
+	ret = regmap_update_bits(priv->regmap, AN8855_PAC,
+				 AN8855_PAE_BPDU_FR | AN8855_PAE_EG_TAG |
+				 AN8855_PAE_PORT_FW,
+				 AN8855_PAE_BPDU_FR |
+				 FIELD_PREP(AN8855_PAE_EG_TAG, AN8855_VLAN_EG_UNTAGGED) |
+				 FIELD_PREP(AN8855_PAE_PORT_FW, AN8855_BPDU_CPU_ONLY));
+	if (ret)
+		return ret;
+
+	/* Trap frames with :01 MAC DAs to the CPU port(s) and egress
+	 * them VLAN-untagged.
+	 */
+	ret = regmap_update_bits(priv->regmap, AN8855_RGAC1,
+				 AN8855_R01_BPDU_FR | AN8855_R01_EG_TAG |
+				 AN8855_R01_PORT_FW,
+				 AN8855_R01_BPDU_FR |
+				 FIELD_PREP(AN8855_R01_EG_TAG, AN8855_VLAN_EG_UNTAGGED) |
+				 FIELD_PREP(AN8855_R01_PORT_FW, AN8855_BPDU_CPU_ONLY));
+	if (ret)
+		return ret;
+
+	/* Trap frames with :02 MAC DAs to the CPU port(s) and egress
+	 * them VLAN-untagged.
+	 */
+	ret = regmap_update_bits(priv->regmap, AN8855_RGAC1,
+				 AN8855_R02_BPDU_FR | AN8855_R02_EG_TAG |
+				 AN8855_R02_PORT_FW,
+				 AN8855_R02_BPDU_FR |
+				 FIELD_PREP(AN8855_R02_EG_TAG, AN8855_VLAN_EG_UNTAGGED) |
+				 FIELD_PREP(AN8855_R02_PORT_FW, AN8855_BPDU_CPU_ONLY));
+	if (ret)
+		return ret;
+
+	/* Trap frames with :03 MAC DAs to the CPU port(s) and egress
+	 * them VLAN-untagged.
+	 */
+	ret = regmap_update_bits(priv->regmap, AN8855_RGAC1,
+				 AN8855_R03_BPDU_FR | AN8855_R03_EG_TAG |
+				 AN8855_R03_PORT_FW,
+				 AN8855_R03_BPDU_FR |
+				 FIELD_PREP(AN8855_R03_EG_TAG, AN8855_VLAN_EG_UNTAGGED) |
+				 FIELD_PREP(AN8855_R03_PORT_FW, AN8855_BPDU_CPU_ONLY));
+	if (ret)
+		return ret;
+
+	/* Trap frames with :0E MAC DAs to the CPU port(s) and egress
+	 * them VLAN-untagged.
+	 */
+	return regmap_update_bits(priv->regmap, AN8855_RGAC1,
+				  AN8855_R0E_BPDU_FR | AN8855_R0E_EG_TAG |
+				  AN8855_R0E_PORT_FW,
+				  AN8855_R0E_BPDU_FR |
+				  FIELD_PREP(AN8855_R0E_EG_TAG, AN8855_VLAN_EG_UNTAGGED) |
+				  FIELD_PREP(AN8855_R0E_PORT_FW, AN8855_BPDU_CPU_ONLY));
+}
+
+static int
+an8855_setup_pvid_vlan(struct an8855_priv *priv)
+{
+	u32 val;
+	int ret;
+
+	/* Validate the entry with independent learning, keep the original
+	 * ingress tag attribute.
+	 */
+	val = AN8855_VA0_IVL_MAC | AN8855_VA0_EG_CON |
+	      FIELD_PREP(AN8855_VA0_FID, AN8855_FID_BRIDGED) |
+	      AN8855_VA0_PORT | AN8855_VA0_VLAN_VALID;
+	ret = regmap_write(priv->regmap, AN8855_VAWD0, val);
+	if (ret)
+		return ret;
+
+	return an8855_vlan_cmd(priv, AN8855_VTCR_WR_VID,
+			       AN8855_PORT_VID_DEFAULT);
+}
+
+static int an8855_setup(struct dsa_switch *ds)
+{
+	struct an8855_priv *priv = ds->priv;
+	struct dsa_port *dp;
+	int ret;
+
+	/* Enable and reset MIB counters */
+	ret = an8855_mib_init(priv);
+	if (ret)
+		return ret;
+
+	dsa_switch_for_each_user_port(dp, ds) {
+		/* Disable MAC by default on all user ports */
+		ret = an8855_port_set_status(priv, dp->index, false);
+		if (ret)
+			return ret;
+
+		/* Individual user ports get connected to CPU port only */
+		ret = regmap_write(priv->regmap, AN8855_PORTMATRIX_P(dp->index),
+				   FIELD_PREP(AN8855_PORTMATRIX, BIT(AN8855_CPU_PORT)));
+		if (ret)
+			return ret;
+
+		/* Disable Broadcast Forward on user ports */
+		ret = regmap_clear_bits(priv->regmap, AN8855_BCF, BIT(dp->index));
+		if (ret)
+			return ret;
+
+		/* Disable Unknown Unicast Forward on user ports */
+		ret = regmap_clear_bits(priv->regmap, AN8855_UNUF, BIT(dp->index));
+		if (ret)
+			return ret;
+
+		/* Disable Unknown Multicast Forward on user ports */
+		ret = regmap_clear_bits(priv->regmap, AN8855_UNMF, BIT(dp->index));
+		if (ret)
+			return ret;
+
+		ret = regmap_clear_bits(priv->regmap, AN8855_UNIPMF, BIT(dp->index));
+		if (ret)
+			return ret;
+
+		/* Set default PVID to on all user ports */
+		ret = an8855_port_set_pid(priv, dp->index, AN8855_PORT_VID_DEFAULT);
+		if (ret)
+			return ret;
+	}
+
+	/* Enable Airoha header mode on the cpu port */
+	ret = regmap_write(priv->regmap, AN8855_PVC_P(AN8855_CPU_PORT),
+			   AN8855_PORT_SPEC_REPLACE_MODE | AN8855_PORT_SPEC_TAG);
+	if (ret)
+		return ret;
+
+	/* Unknown multicast frame forwarding to the cpu port */
+	ret = regmap_write(priv->regmap, AN8855_UNMF, BIT(AN8855_CPU_PORT));
+	if (ret)
+		return ret;
+
+	/* Set CPU port number */
+	ret = regmap_update_bits(priv->regmap, AN8855_MFC,
+				 AN8855_CPU_EN | AN8855_CPU_PORT_IDX,
+				 AN8855_CPU_EN |
+				 FIELD_PREP(AN8855_CPU_PORT_IDX, AN8855_CPU_PORT));
+	if (ret)
+		return ret;
+
+	/* CPU port gets connected to all user ports of
+	 * the switch.
+	 */
+	ret = regmap_write(priv->regmap, AN8855_PORTMATRIX_P(AN8855_CPU_PORT),
+			   FIELD_PREP(AN8855_PORTMATRIX, dsa_user_ports(ds)));
+	if (ret)
+		return ret;
+
+	/* CPU port is set to fallback mode to let untagged
+	 * frames pass through.
+	 */
+	ret = regmap_update_bits(priv->regmap, AN8855_PCR_P(AN8855_CPU_PORT),
+				 AN8855_PORT_VLAN,
+				 FIELD_PREP(AN8855_PORT_VLAN, AN8855_PORT_FALLBACK_MODE));
+	if (ret)
+		return ret;
+
+	/* Enable Broadcast Forward on CPU port */
+	ret = regmap_set_bits(priv->regmap, AN8855_BCF, BIT(AN8855_CPU_PORT));
+	if (ret)
+		return ret;
+
+	/* Enable Unknown Unicast Forward on CPU port */
+	ret = regmap_set_bits(priv->regmap, AN8855_UNUF, BIT(AN8855_CPU_PORT));
+	if (ret)
+		return ret;
+
+	/* Enable Unknown Multicast Forward on CPU port */
+	ret = regmap_set_bits(priv->regmap, AN8855_UNMF, BIT(AN8855_CPU_PORT));
+	if (ret)
+		return ret;
+
+	ret = regmap_set_bits(priv->regmap, AN8855_UNIPMF, BIT(AN8855_CPU_PORT));
+	if (ret)
+		return ret;
+
+	/* Setup Trap special frame to CPU rules */
+	ret = an8855_trap_special_frames(priv);
+	if (ret)
+		return ret;
+
+	dsa_switch_for_each_port(dp, ds) {
+		/* Disable Learning on all ports.
+		 * Learning on CPU is disabled for fdb isolation and handled by
+		 * assisted_learning_on_cpu_port.
+		 */
+		ret = regmap_set_bits(priv->regmap, AN8855_PSC_P(dp->index),
+				      AN8855_SA_DIS);
+		if (ret)
+			return ret;
+
+		/* Enable consistent egress tag (for VLAN unware VLAN-passtrough) */
+		ret = regmap_update_bits(priv->regmap, AN8855_PVC_P(dp->index),
+					 AN8855_PVC_EG_TAG,
+					 FIELD_PREP(AN8855_PVC_EG_TAG, AN8855_VLAN_EG_CONSISTENT));
+		if (ret)
+			return ret;
+	}
+
+	/* Setup VLAN for Default PVID */
+	ret = an8855_setup_pvid_vlan(priv);
+	if (ret)
+		return ret;
+
+	ret = regmap_clear_bits(priv->regmap, AN8855_CKGCR,
+				AN8855_CKG_LNKDN_GLB_STOP | AN8855_CKG_LNKDN_PORT_STOP);
+	if (ret)
+		return ret;
+
+	/* Release global PHY power down */
+	ret = regmap_write(priv->regmap, AN8855_RG_GPHY_AFE_PWD, 0x0);
+	if (ret)
+		return ret;
+
+	ds->configure_vlan_while_not_filtering = true;
+
+	/* Flush the FDB table */
+	ret = an8855_fdb_cmd(priv, AN8855_FDB_FLUSH, NULL);
+	if (ret < 0)
+		return ret;
+
+	/* Set min a max ageing value supported */
+	ds->ageing_time_min = AN8855_L2_AGING_MS_CONSTANT;
+	ds->ageing_time_max = FIELD_MAX(AN8855_AGE_CNT) *
+			      FIELD_MAX(AN8855_AGE_UNIT) *
+			      AN8855_L2_AGING_MS_CONSTANT;
+
+	/* Enable assisted learning for fdb isolation */
+	ds->assisted_learning_on_cpu_port = true;
+
+	return 0;
+}
+
+static struct phylink_pcs *an8855_phylink_mac_select_pcs(struct phylink_config *config,
+							 phy_interface_t interface)
+{
+	struct dsa_port *dp = dsa_phylink_to_port(config);
+	struct an8855_priv *priv = dp->ds->priv;
+
+	switch (interface) {
+	case PHY_INTERFACE_MODE_SGMII:
+	case PHY_INTERFACE_MODE_2500BASEX:
+		return &priv->pcs;
+	default:
+		return NULL;
+	}
+}
+
+static void an8855_phylink_mac_config(struct phylink_config *config,
+				      unsigned int mode,
+				      const struct phylink_link_state *state)
+{
+	struct dsa_port *dp = dsa_phylink_to_port(config);
+	struct dsa_switch *ds = dp->ds;
+	struct an8855_priv *priv;
+	int port = dp->index;
+
+	priv = ds->priv;
+
+	/* Nothing to configure for internal ports */
+	if (port != 5)
+		return;
+
+	regmap_update_bits(priv->regmap, AN8855_PMCR_P(port),
+			   AN8855_PMCR_IFG_XMIT | AN8855_PMCR_MAC_MODE |
+			   AN8855_PMCR_BACKOFF_EN | AN8855_PMCR_BACKPR_EN,
+			   FIELD_PREP(AN8855_PMCR_IFG_XMIT, 0x1) |
+			   AN8855_PMCR_MAC_MODE | AN8855_PMCR_BACKOFF_EN |
+			   AN8855_PMCR_BACKPR_EN);
+}
+
+static void an8855_phylink_get_caps(struct dsa_switch *ds, int port,
+				    struct phylink_config *config)
+{
+	switch (port) {
+	case 0:
+	case 1:
+	case 2:
+	case 3:
+	case 4:
+		__set_bit(PHY_INTERFACE_MODE_GMII,
+			  config->supported_interfaces);
+		__set_bit(PHY_INTERFACE_MODE_INTERNAL,
+			  config->supported_interfaces);
+		break;
+	case 5:
+		phy_interface_set_rgmii(config->supported_interfaces);
+		__set_bit(PHY_INTERFACE_MODE_SGMII,
+			  config->supported_interfaces);
+		__set_bit(PHY_INTERFACE_MODE_2500BASEX,
+			  config->supported_interfaces);
+		break;
+	}
+
+	config->mac_capabilities = MAC_ASYM_PAUSE | MAC_SYM_PAUSE |
+				   MAC_10 | MAC_100 | MAC_1000FD | MAC_2500FD;
+}
+
+static void an8855_phylink_mac_link_down(struct phylink_config *config,
+					 unsigned int mode,
+					 phy_interface_t interface)
+{
+	struct dsa_port *dp = dsa_phylink_to_port(config);
+	struct an8855_priv *priv = dp->ds->priv;
+
+	/* With autoneg just disable TX/RX else also force link down */
+	if (phylink_autoneg_inband(mode)) {
+		regmap_clear_bits(priv->regmap, AN8855_PMCR_P(dp->index),
+				  AN8855_PMCR_TX_EN | AN8855_PMCR_RX_EN);
+	} else {
+		regmap_update_bits(priv->regmap, AN8855_PMCR_P(dp->index),
+				   AN8855_PMCR_TX_EN | AN8855_PMCR_RX_EN |
+				   AN8855_PMCR_FORCE_MODE | AN8855_PMCR_FORCE_LNK,
+				   AN8855_PMCR_FORCE_MODE);
+	}
+}
+
+static void an8855_phylink_mac_link_up(struct phylink_config *config,
+				       struct phy_device *phydev, unsigned int mode,
+				       phy_interface_t interface, int speed,
+				       int duplex, bool tx_pause, bool rx_pause)
+{
+	struct dsa_port *dp = dsa_phylink_to_port(config);
+	struct an8855_priv *priv = dp->ds->priv;
+	int port = dp->index;
+	u32 reg;
+
+	reg = regmap_read(priv->regmap, AN8855_PMCR_P(port), &reg);
+	if (phylink_autoneg_inband(mode)) {
+		reg &= ~AN8855_PMCR_FORCE_MODE;
+	} else {
+		reg |= AN8855_PMCR_FORCE_MODE | AN8855_PMCR_FORCE_LNK;
+
+		reg &= ~AN8855_PMCR_FORCE_SPEED;
+		switch (speed) {
+		case SPEED_10:
+			reg |= AN8855_PMCR_FORCE_SPEED_10;
+			break;
+		case SPEED_100:
+			reg |= AN8855_PMCR_FORCE_SPEED_100;
+			break;
+		case SPEED_1000:
+			reg |= AN8855_PMCR_FORCE_SPEED_1000;
+			break;
+		case SPEED_2500:
+			reg |= AN8855_PMCR_FORCE_SPEED_2500;
+			break;
+		case SPEED_5000:
+			dev_err(priv->dev, "Missing support for 5G speed. Aborting...\n");
+			return;
+		}
+
+		reg &= ~AN8855_PMCR_FORCE_FDX;
+		if (duplex == DUPLEX_FULL)
+			reg |= AN8855_PMCR_FORCE_FDX;
+
+		reg &= ~AN8855_PMCR_RX_FC_EN;
+		if (rx_pause || dsa_port_is_cpu(dp))
+			reg |= AN8855_PMCR_RX_FC_EN;
+
+		reg &= ~AN8855_PMCR_TX_FC_EN;
+		if (rx_pause || dsa_port_is_cpu(dp))
+			reg |= AN8855_PMCR_TX_FC_EN;
+
+		/* Disable any EEE options */
+		reg &= ~(AN8855_PMCR_FORCE_EEE5G | AN8855_PMCR_FORCE_EEE2P5G |
+			 AN8855_PMCR_FORCE_EEE1G | AN8855_PMCR_FORCE_EEE100);
+	}
+
+	reg |= AN8855_PMCR_TX_EN | AN8855_PMCR_RX_EN;
+
+	regmap_write(priv->regmap, AN8855_PMCR_P(port), reg);
+}
+
+static unsigned int an8855_pcs_inband_caps(struct phylink_pcs *pcs,
+					   phy_interface_t interface)
+{
+	/* SGMII can be configured to use inband with AN result */
+	if (interface == PHY_INTERFACE_MODE_SGMII)
+		return LINK_INBAND_DISABLE | LINK_INBAND_ENABLE;
+
+	/* inband is not supported in 2500-baseX and must be disabled */
+	return  LINK_INBAND_DISABLE;
+}
+
+static void an8855_pcs_get_state(struct phylink_pcs *pcs,
+				 struct phylink_link_state *state)
+{
+	struct an8855_priv *priv = container_of(pcs, struct an8855_priv, pcs);
+	u32 val;
+	int ret;
+
+	ret = regmap_read(priv->regmap, AN8855_PMSR_P(AN8855_CPU_PORT), &val);
+	if (ret < 0) {
+		state->link = false;
+		return;
+	}
+
+	state->link = !!(val & AN8855_PMSR_LNK);
+	state->an_complete = state->link;
+	state->duplex = (val & AN8855_PMSR_DPX) ? DUPLEX_FULL :
+						  DUPLEX_HALF;
+
+	switch (val & AN8855_PMSR_SPEED) {
+	case AN8855_PMSR_SPEED_10:
+		state->speed = SPEED_10;
+		break;
+	case AN8855_PMSR_SPEED_100:
+		state->speed = SPEED_100;
+		break;
+	case AN8855_PMSR_SPEED_1000:
+		state->speed = SPEED_1000;
+		break;
+	case AN8855_PMSR_SPEED_2500:
+		state->speed = SPEED_2500;
+		break;
+	case AN8855_PMSR_SPEED_5000:
+		dev_err(priv->dev, "Missing support for 5G speed. Setting Unknown.\n");
+		fallthrough;
+	default:
+		state->speed = SPEED_UNKNOWN;
+		break;
+	}
+
+	if (val & AN8855_PMSR_RX_FC)
+		state->pause |= MLO_PAUSE_RX;
+	if (val & AN8855_PMSR_TX_FC)
+		state->pause |= MLO_PAUSE_TX;
+}
+
+static int an8855_pcs_config(struct phylink_pcs *pcs, unsigned int neg_mode,
+			     phy_interface_t interface,
+			     const unsigned long *advertising,
+			     bool permit_pause_to_mac)
+{
+	struct an8855_priv *priv = container_of(pcs, struct an8855_priv, pcs);
+	u32 val;
+	int ret;
+
+	/*                   !!! WELCOME TO HELL !!!                   */
+
+	/* TX FIR - improve TX EYE */
+	ret = regmap_update_bits(priv->regmap, AN8855_INTF_CTRL_10,
+				 AN8855_RG_DA_QP_TX_FIR_C2_SEL |
+				 AN8855_RG_DA_QP_TX_FIR_C2_FORCE |
+				 AN8855_RG_DA_QP_TX_FIR_C1_SEL |
+				 AN8855_RG_DA_QP_TX_FIR_C1_FORCE,
+				 AN8855_RG_DA_QP_TX_FIR_C2_SEL |
+				 FIELD_PREP(AN8855_RG_DA_QP_TX_FIR_C2_FORCE, 0x4) |
+				 AN8855_RG_DA_QP_TX_FIR_C1_SEL |
+				 FIELD_PREP(AN8855_RG_DA_QP_TX_FIR_C1_FORCE, 0x0));
+	if (ret)
+		return ret;
+
+	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+		val = 0x0;
+	else
+		val = 0xd;
+	ret = regmap_update_bits(priv->regmap, AN8855_INTF_CTRL_11,
+				 AN8855_RG_DA_QP_TX_FIR_C0B_SEL |
+				 AN8855_RG_DA_QP_TX_FIR_C0B_FORCE,
+				 AN8855_RG_DA_QP_TX_FIR_C0B_SEL |
+				 FIELD_PREP(AN8855_RG_DA_QP_TX_FIR_C0B_FORCE, val));
+	if (ret)
+		return ret;
+
+	/* RX CDR - improve RX Jitter Tolerance */
+	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+		val = 0x5;
+	else
+		val = 0x6;
+	ret = regmap_update_bits(priv->regmap, AN8855_RG_QP_CDR_LPF_BOT_LIM,
+				 AN8855_RG_QP_CDR_LPF_KP_GAIN |
+				 AN8855_RG_QP_CDR_LPF_KI_GAIN,
+				 FIELD_PREP(AN8855_RG_QP_CDR_LPF_KP_GAIN, val) |
+				 FIELD_PREP(AN8855_RG_QP_CDR_LPF_KI_GAIN, val));
+	if (ret)
+		return ret;
+
+	/* PLL */
+	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+		val = 0x1;
+	else
+		val = 0x0;
+	ret = regmap_update_bits(priv->regmap, AN8855_QP_DIG_MODE_CTRL_1,
+				 AN8855_RG_TPHY_SPEED,
+				 FIELD_PREP(AN8855_RG_TPHY_SPEED, val));
+	if (ret)
+		return ret;
+
+	/* PLL - LPF */
+	ret = regmap_update_bits(priv->regmap, AN8855_PLL_CTRL_2,
+				 AN8855_RG_DA_QP_PLL_RICO_SEL_INTF |
+				 AN8855_RG_DA_QP_PLL_FBKSEL_INTF |
+				 AN8855_RG_DA_QP_PLL_BR_INTF |
+				 AN8855_RG_DA_QP_PLL_BPD_INTF |
+				 AN8855_RG_DA_QP_PLL_BPA_INTF |
+				 AN8855_RG_DA_QP_PLL_BC_INTF,
+				 AN8855_RG_DA_QP_PLL_RICO_SEL_INTF |
+				 FIELD_PREP(AN8855_RG_DA_QP_PLL_FBKSEL_INTF, 0x0) |
+				 FIELD_PREP(AN8855_RG_DA_QP_PLL_BR_INTF, 0x3) |
+				 FIELD_PREP(AN8855_RG_DA_QP_PLL_BPD_INTF, 0x0) |
+				 FIELD_PREP(AN8855_RG_DA_QP_PLL_BPA_INTF, 0x5) |
+				 FIELD_PREP(AN8855_RG_DA_QP_PLL_BC_INTF, 0x1));
+	if (ret)
+		return ret;
+
+	/* PLL - ICO */
+	ret = regmap_set_bits(priv->regmap, AN8855_PLL_CTRL_4,
+			      AN8855_RG_DA_QP_PLL_ICOLP_EN_INTF);
+	if (ret)
+		return ret;
+	ret = regmap_clear_bits(priv->regmap, AN8855_PLL_CTRL_2,
+				AN8855_RG_DA_QP_PLL_ICOIQ_EN_INTF);
+	if (ret)
+		return ret;
+
+	/* PLL - CHP */
+	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+		val = 0x6;
+	else
+		val = 0x4;
+	ret = regmap_update_bits(priv->regmap, AN8855_PLL_CTRL_2,
+				 AN8855_RG_DA_QP_PLL_IR_INTF,
+				 FIELD_PREP(AN8855_RG_DA_QP_PLL_IR_INTF, val));
+	if (ret)
+		return ret;
+
+	/* PLL - PFD */
+	ret = regmap_update_bits(priv->regmap, AN8855_PLL_CTRL_2,
+				 AN8855_RG_DA_QP_PLL_PFD_OFFSET_EN_INTRF |
+				 AN8855_RG_DA_QP_PLL_PFD_OFFSET_INTF |
+				 AN8855_RG_DA_QP_PLL_KBAND_PREDIV_INTF,
+				 FIELD_PREP(AN8855_RG_DA_QP_PLL_PFD_OFFSET_INTF, 0x1) |
+				 FIELD_PREP(AN8855_RG_DA_QP_PLL_KBAND_PREDIV_INTF, 0x1));
+	if (ret)
+		return ret;
+
+	/* PLL - POSTDIV */
+	ret = regmap_update_bits(priv->regmap, AN8855_PLL_CTRL_2,
+				 AN8855_RG_DA_QP_PLL_POSTDIV_EN_INTF |
+				 AN8855_RG_DA_QP_PLL_PHY_CK_EN_INTF |
+				 AN8855_RG_DA_QP_PLL_PCK_SEL_INTF,
+				 AN8855_RG_DA_QP_PLL_PCK_SEL_INTF);
+	if (ret)
+		return ret;
+
+	/* PLL - SDM */
+	ret = regmap_update_bits(priv->regmap, AN8855_PLL_CTRL_2,
+				 AN8855_RG_DA_QP_PLL_SDM_HREN_INTF,
+				 FIELD_PREP(AN8855_RG_DA_QP_PLL_SDM_HREN_INTF, 0x0));
+	if (ret)
+		return ret;
+	ret = regmap_clear_bits(priv->regmap, AN8855_PLL_CTRL_2,
+				AN8855_RG_DA_QP_PLL_SDM_IFM_INTF);
+	if (ret)
+		return ret;
+
+	ret = regmap_update_bits(priv->regmap, AN8855_SS_LCPLL_PWCTL_SETTING_2,
+				 AN8855_RG_NCPO_ANA_MSB,
+				 FIELD_PREP(AN8855_RG_NCPO_ANA_MSB, 0x1));
+	if (ret)
+		return ret;
+
+	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+		val = 0x7a000000;
+	else
+		val = 0x48000000;
+	ret = regmap_write(priv->regmap, AN8855_SS_LCPLL_TDC_FLT_2,
+			   FIELD_PREP(AN8855_RG_LCPLL_NCPO_VALUE, val));
+	if (ret)
+		return ret;
+	ret = regmap_write(priv->regmap, AN8855_SS_LCPLL_TDC_PCW_1,
+			   FIELD_PREP(AN8855_RG_LCPLL_PON_HRDDS_PCW_NCPO_GPON, val));
+	if (ret)
+		return ret;
+
+	ret = regmap_clear_bits(priv->regmap, AN8855_SS_LCPLL_TDC_FLT_5,
+				AN8855_RG_LCPLL_NCPO_CHG);
+	if (ret)
+		return ret;
+	ret = regmap_clear_bits(priv->regmap, AN8855_PLL_CK_CTRL_0,
+				AN8855_RG_DA_QP_PLL_SDM_DI_EN_INTF);
+	if (ret)
+		return ret;
+
+	/* PLL - SS */
+	ret = regmap_update_bits(priv->regmap, AN8855_PLL_CTRL_3,
+				 AN8855_RG_DA_QP_PLL_SSC_DELTA_INTF,
+				 FIELD_PREP(AN8855_RG_DA_QP_PLL_SSC_DELTA_INTF, 0x0));
+	if (ret)
+		return ret;
+	ret = regmap_update_bits(priv->regmap, AN8855_PLL_CTRL_4,
+				 AN8855_RG_DA_QP_PLL_SSC_DIR_DLY_INTF,
+				 FIELD_PREP(AN8855_RG_DA_QP_PLL_SSC_DIR_DLY_INTF, 0x0));
+	if (ret)
+		return ret;
+	ret = regmap_update_bits(priv->regmap, AN8855_PLL_CTRL_3,
+				 AN8855_RG_DA_QP_PLL_SSC_PERIOD_INTF,
+				 FIELD_PREP(AN8855_RG_DA_QP_PLL_SSC_PERIOD_INTF, 0x0));
+	if (ret)
+		return ret;
+
+	/* PLL - TDC */
+	ret = regmap_clear_bits(priv->regmap, AN8855_PLL_CK_CTRL_0,
+				AN8855_RG_DA_QP_PLL_TDC_TXCK_SEL_INTF);
+	if (ret)
+		return ret;
+
+	ret = regmap_set_bits(priv->regmap, AN8855_RG_QP_PLL_SDM_ORD,
+			      AN8855_RG_QP_PLL_SSC_TRI_EN);
+	if (ret)
+		return ret;
+	ret = regmap_set_bits(priv->regmap, AN8855_RG_QP_PLL_SDM_ORD,
+			      AN8855_RG_QP_PLL_SSC_PHASE_INI);
+	if (ret)
+		return ret;
+
+	ret = regmap_update_bits(priv->regmap, AN8855_RG_QP_RX_DAC_EN,
+				 AN8855_RG_QP_SIGDET_HF,
+				 FIELD_PREP(AN8855_RG_QP_SIGDET_HF, 0x2));
+	if (ret)
+		return ret;
+
+	/* TCL Disable (only for Co-SIM) */
+	ret = regmap_clear_bits(priv->regmap, AN8855_PON_RXFEDIG_CTRL_0,
+				AN8855_RG_QP_EQ_RX500M_CK_SEL);
+	if (ret)
+		return ret;
+
+	/* TX Init */
+	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+		val = 0x4;
+	else
+		val = 0x0;
+	ret = regmap_update_bits(priv->regmap, AN8855_RG_QP_TX_MODE,
+				 AN8855_RG_QP_TX_RESERVE |
+				 AN8855_RG_QP_TX_MODE_16B_EN,
+				 FIELD_PREP(AN8855_RG_QP_TX_RESERVE, val));
+	if (ret)
+		return ret;
+
+	/* RX Control/Init */
+	ret = regmap_set_bits(priv->regmap, AN8855_RG_QP_RXAFE_RESERVE,
+			      AN8855_RG_QP_CDR_PD_10B_EN);
+	if (ret)
+		return ret;
+
+	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+		val = 0x1;
+	else
+		val = 0x2;
+	ret = regmap_update_bits(priv->regmap, AN8855_RG_QP_CDR_LPF_MJV_LIM,
+				 AN8855_RG_QP_CDR_LPF_RATIO,
+				 FIELD_PREP(AN8855_RG_QP_CDR_LPF_RATIO, val));
+	if (ret)
+		return ret;
+
+	ret = regmap_update_bits(priv->regmap, AN8855_RG_QP_CDR_LPF_SETVALUE,
+				 AN8855_RG_QP_CDR_PR_BUF_IN_SR |
+				 AN8855_RG_QP_CDR_PR_BETA_SEL,
+				 FIELD_PREP(AN8855_RG_QP_CDR_PR_BUF_IN_SR, 0x6) |
+				 FIELD_PREP(AN8855_RG_QP_CDR_PR_BETA_SEL, 0x1));
+	if (ret)
+		return ret;
+
+	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+		val = 0xf;
+	else
+		val = 0xc;
+	ret = regmap_update_bits(priv->regmap, AN8855_RG_QP_CDR_PR_CKREF_DIV1,
+				 AN8855_RG_QP_CDR_PR_DAC_BAND,
+				 FIELD_PREP(AN8855_RG_QP_CDR_PR_DAC_BAND, val));
+	if (ret)
+		return ret;
+
+	ret = regmap_update_bits(priv->regmap, AN8855_RG_QP_CDR_PR_KBAND_DIV_PCIE,
+				 AN8855_RG_QP_CDR_PR_KBAND_PCIE_MODE |
+				 AN8855_RG_QP_CDR_PR_KBAND_DIV_PCIE_MASK,
+				 FIELD_PREP(AN8855_RG_QP_CDR_PR_KBAND_DIV_PCIE_MASK, 0x19));
+	if (ret)
+		return ret;
+
+	ret = regmap_update_bits(priv->regmap, AN8855_RG_QP_CDR_FORCE_IBANDLPF_R_OFF,
+				 AN8855_RG_QP_CDR_PHYCK_SEL |
+				 AN8855_RG_QP_CDR_PHYCK_RSTB |
+				 AN8855_RG_QP_CDR_PHYCK_DIV,
+				 FIELD_PREP(AN8855_RG_QP_CDR_PHYCK_SEL, 0x2) |
+				 FIELD_PREP(AN8855_RG_QP_CDR_PHYCK_DIV, 0x21));
+	if (ret)
+		return ret;
+
+	ret = regmap_clear_bits(priv->regmap, AN8855_RG_QP_CDR_PR_KBAND_DIV_PCIE,
+				AN8855_RG_QP_CDR_PR_XFICK_EN);
+	if (ret)
+		return ret;
+
+	ret = regmap_update_bits(priv->regmap, AN8855_RG_QP_CDR_PR_CKREF_DIV1,
+				 AN8855_RG_QP_CDR_PR_KBAND_DIV,
+				 FIELD_PREP(AN8855_RG_QP_CDR_PR_KBAND_DIV, 0x4));
+	if (ret)
+		return ret;
+
+	ret = regmap_update_bits(priv->regmap, AN8855_RX_CTRL_26,
+				 AN8855_RG_QP_EQ_RETRAIN_ONLY_EN |
+				 AN8855_RG_LINK_NE_EN |
+				 AN8855_RG_LINK_ERRO_EN,
+				 AN8855_RG_QP_EQ_RETRAIN_ONLY_EN |
+				 AN8855_RG_LINK_ERRO_EN);
+	if (ret)
+		return ret;
+
+	ret = regmap_update_bits(priv->regmap, AN8855_RX_DLY_0,
+				 AN8855_RG_QP_RX_SAOSC_EN_H_DLY |
+				 AN8855_RG_QP_RX_PI_CAL_EN_H_DLY,
+				 FIELD_PREP(AN8855_RG_QP_RX_SAOSC_EN_H_DLY, 0x3f) |
+				 FIELD_PREP(AN8855_RG_QP_RX_PI_CAL_EN_H_DLY, 0x6f));
+	if (ret)
+		return ret;
+
+	ret = regmap_update_bits(priv->regmap, AN8855_RX_CTRL_42,
+				 AN8855_RG_QP_EQ_EN_DLY,
+				 FIELD_PREP(AN8855_RG_QP_EQ_EN_DLY, 0x150));
+	if (ret)
+		return ret;
+
+	ret = regmap_update_bits(priv->regmap, AN8855_RX_CTRL_2,
+				 AN8855_RG_QP_RX_EQ_EN_H_DLY,
+				 FIELD_PREP(AN8855_RG_QP_RX_EQ_EN_H_DLY, 0x150));
+	if (ret)
+		return ret;
+
+	ret = regmap_update_bits(priv->regmap, AN8855_PON_RXFEDIG_CTRL_9,
+				 AN8855_RG_QP_EQ_LEQOSC_DLYCNT,
+				 FIELD_PREP(AN8855_RG_QP_EQ_LEQOSC_DLYCNT, 0x1));
+	if (ret)
+		return ret;
+
+	ret = regmap_update_bits(priv->regmap, AN8855_RX_CTRL_8,
+				 AN8855_RG_DA_QP_SAOSC_DONE_TIME |
+				 AN8855_RG_DA_QP_LEQOS_EN_TIME,
+				 FIELD_PREP(AN8855_RG_DA_QP_SAOSC_DONE_TIME, 0x200) |
+				 FIELD_PREP(AN8855_RG_DA_QP_LEQOS_EN_TIME, 0xfff));
+	if (ret)
+		return ret;
+
+	/* Frequency meter */
+	if (interface == PHY_INTERFACE_MODE_2500BASEX)
+		val = 0x10;
+	else
+		val = 0x28;
+	ret = regmap_update_bits(priv->regmap, AN8855_RX_CTRL_5,
+				 AN8855_RG_FREDET_CHK_CYCLE,
+				 FIELD_PREP(AN8855_RG_FREDET_CHK_CYCLE, val));
+	if (ret)
+		return ret;
+
+	ret = regmap_update_bits(priv->regmap, AN8855_RX_CTRL_6,
+				 AN8855_RG_FREDET_GOLDEN_CYCLE,
+				 FIELD_PREP(AN8855_RG_FREDET_GOLDEN_CYCLE, 0x64));
+	if (ret)
+		return ret;
+
+	ret = regmap_update_bits(priv->regmap, AN8855_RX_CTRL_7,
+				 AN8855_RG_FREDET_TOLERATE_CYCLE,
+				 FIELD_PREP(AN8855_RG_FREDET_TOLERATE_CYCLE, 0x2710));
+	if (ret)
+		return ret;
+
+	ret = regmap_set_bits(priv->regmap, AN8855_PLL_CTRL_0,
+			      AN8855_RG_PHYA_AUTO_INIT);
+	if (ret)
+		return ret;
+
+	/* PCS Init */
+	if (interface == PHY_INTERFACE_MODE_SGMII &&
+	    neg_mode == PHYLINK_PCS_NEG_INBAND_DISABLED) {
+		ret = regmap_clear_bits(priv->regmap, AN8855_QP_DIG_MODE_CTRL_0,
+					AN8855_RG_SGMII_MODE | AN8855_RG_SGMII_AN_EN);
+		if (ret)
+			return ret;
+	}
+
+	ret = regmap_clear_bits(priv->regmap, AN8855_RG_HSGMII_PCS_CTROL_1,
+				AN8855_RG_TBI_10B_MODE);
+	if (ret)
+		return ret;
+
+	if (neg_mode == PHYLINK_PCS_NEG_INBAND_ENABLED) {
+		/* Set AN Ability - Interrupt */
+		ret = regmap_set_bits(priv->regmap, AN8855_SGMII_REG_AN_FORCE_CL37,
+				      AN8855_RG_FORCE_AN_DONE);
+		if (ret)
+			return ret;
+
+		ret = regmap_update_bits(priv->regmap, AN8855_SGMII_REG_AN_13,
+					 AN8855_SGMII_REMOTE_FAULT_DIS |
+					 AN8855_SGMII_IF_MODE,
+					 AN8855_SGMII_REMOTE_FAULT_DIS |
+					 FIELD_PREP(AN8855_SGMII_IF_MODE, 0xb));
+		if (ret)
+			return ret;
+	}
+
+	/* Rate Adaption - GMII path config. */
+	if (interface == PHY_INTERFACE_MODE_2500BASEX) {
+		ret = regmap_clear_bits(priv->regmap, AN8855_RATE_ADP_P0_CTRL_0,
+					AN8855_RG_P0_DIS_MII_MODE);
+		if (ret)
+			return ret;
+	} else {
+		if (neg_mode == PHYLINK_PCS_NEG_INBAND_ENABLED) {
+			ret = regmap_set_bits(priv->regmap, AN8855_MII_RA_AN_ENABLE,
+					      AN8855_RG_P0_RA_AN_EN);
+			if (ret)
+				return ret;
+		} else {
+			ret = regmap_update_bits(priv->regmap, AN8855_RG_AN_SGMII_MODE_FORCE,
+						 AN8855_RG_FORCE_CUR_SGMII_MODE |
+						 AN8855_RG_FORCE_CUR_SGMII_SEL,
+						 AN8855_RG_FORCE_CUR_SGMII_SEL);
+			if (ret)
+				return ret;
+
+			ret = regmap_clear_bits(priv->regmap, AN8855_RATE_ADP_P0_CTRL_0,
+						AN8855_RG_P0_MII_RA_RX_EN |
+						AN8855_RG_P0_MII_RA_TX_EN |
+						AN8855_RG_P0_MII_RA_RX_MODE |
+						AN8855_RG_P0_MII_RA_TX_MODE);
+			if (ret)
+				return ret;
+		}
+
+		ret = regmap_set_bits(priv->regmap, AN8855_RATE_ADP_P0_CTRL_0,
+				      AN8855_RG_P0_MII_MODE);
+		if (ret)
+			return ret;
+	}
+
+	ret = regmap_set_bits(priv->regmap, AN8855_RG_RATE_ADAPT_CTRL_0,
+			      AN8855_RG_RATE_ADAPT_RX_BYPASS |
+			      AN8855_RG_RATE_ADAPT_TX_BYPASS |
+			      AN8855_RG_RATE_ADAPT_RX_EN |
+			      AN8855_RG_RATE_ADAPT_TX_EN);
+	if (ret)
+		return ret;
+
+	/* Disable AN if not in autoneg */
+	ret = regmap_update_bits(priv->regmap, AN8855_SGMII_REG_AN0, BMCR_ANENABLE,
+				 neg_mode == PHYLINK_PCS_NEG_INBAND_ENABLED ? BMCR_ANENABLE :
+									      0);
+	if (ret)
+		return ret;
+
+	if (interface == PHY_INTERFACE_MODE_SGMII) {
+		/* Follow SDK init flow with restarting AN after AN enable */
+		if (neg_mode == PHYLINK_PCS_NEG_INBAND_ENABLED) {
+			ret = regmap_set_bits(priv->regmap, AN8855_SGMII_REG_AN0,
+					      BMCR_ANRESTART);
+			if (ret)
+				return ret;
+		} else {
+			ret = regmap_set_bits(priv->regmap, AN8855_PHY_RX_FORCE_CTRL_0,
+					      AN8855_RG_FORCE_TXC_SEL);
+			if (ret)
+				return ret;
+		}
+	}
+
+	/* Force Speed with fixed-link or 2500base-x as doesn't support aneg */
+	if (interface == PHY_INTERFACE_MODE_2500BASEX ||
+	    neg_mode != PHYLINK_PCS_NEG_INBAND_ENABLED) {
+		if (interface == PHY_INTERFACE_MODE_2500BASEX)
+			val = AN8855_RG_LINK_MODE_P0_SPEED_2500;
+		else
+			val = AN8855_RG_LINK_MODE_P0_SPEED_1000;
+		ret = regmap_update_bits(priv->regmap, AN8855_SGMII_STS_CTRL_0,
+					 AN8855_RG_LINK_MODE_P0 |
+					 AN8855_RG_FORCE_SPD_MODE_P0,
+					 val | AN8855_RG_FORCE_SPD_MODE_P0);
+		if (ret)
+			return ret;
+	}
+
+	/* bypass flow control to MAC */
+	ret = regmap_write(priv->regmap, AN8855_MSG_RX_LIK_STS_0,
+			   AN8855_RG_DPX_STS_P3 | AN8855_RG_DPX_STS_P2 |
+			   AN8855_RG_DPX_STS_P1 | AN8855_RG_TXFC_STS_P0 |
+			   AN8855_RG_RXFC_STS_P0 | AN8855_RG_DPX_STS_P0);
+	if (ret)
+		return ret;
+	ret = regmap_write(priv->regmap, AN8855_MSG_RX_LIK_STS_2,
+			   AN8855_RG_RXFC_AN_BYPASS_P3 |
+			   AN8855_RG_RXFC_AN_BYPASS_P2 |
+			   AN8855_RG_RXFC_AN_BYPASS_P1 |
+			   AN8855_RG_TXFC_AN_BYPASS_P3 |
+			   AN8855_RG_TXFC_AN_BYPASS_P2 |
+			   AN8855_RG_TXFC_AN_BYPASS_P1 |
+			   AN8855_RG_DPX_AN_BYPASS_P3 |
+			   AN8855_RG_DPX_AN_BYPASS_P2 |
+			   AN8855_RG_DPX_AN_BYPASS_P1 |
+			   AN8855_RG_DPX_AN_BYPASS_P0);
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+static void an8855_pcs_an_restart(struct phylink_pcs *pcs)
+{
+	return;
+}
+
+static const struct phylink_pcs_ops an8855_pcs_ops = {
+	.pcs_inband_caps = an8855_pcs_inband_caps,
+	.pcs_get_state = an8855_pcs_get_state,
+	.pcs_config = an8855_pcs_config,
+	.pcs_an_restart = an8855_pcs_an_restart,
+};
+
+static const struct phylink_mac_ops an8855_phylink_mac_ops = {
+	.mac_select_pcs	= an8855_phylink_mac_select_pcs,
+	.mac_config	= an8855_phylink_mac_config,
+	.mac_link_down	= an8855_phylink_mac_link_down,
+	.mac_link_up	= an8855_phylink_mac_link_up,
+};
+
+static const struct dsa_switch_ops an8855_switch_ops = {
+	.get_tag_protocol = an8855_get_tag_protocol,
+	.setup = an8855_setup,
+	.get_phy_flags = en8855_get_phy_flags,
+	.phylink_get_caps = an8855_phylink_get_caps,
+	.get_strings = an8855_get_strings,
+	.get_ethtool_stats = an8855_get_ethtool_stats,
+	.get_sset_count = an8855_get_sset_count,
+	.get_eth_mac_stats = an8855_get_eth_mac_stats,
+	.get_eth_ctrl_stats = an8855_get_eth_ctrl_stats,
+	.get_rmon_stats = an8855_get_rmon_stats,
+	.port_enable = an8855_port_enable,
+	.port_disable = an8855_port_disable,
+	.set_ageing_time = an8855_set_ageing_time,
+	.port_bridge_join = an8855_port_bridge_join,
+	.port_bridge_leave = an8855_port_bridge_leave,
+	.port_fast_age = an8855_port_fast_age,
+	.port_stp_state_set = an8855_port_stp_state_set,
+	.port_pre_bridge_flags = an8855_port_pre_bridge_flags,
+	.port_bridge_flags = an8855_port_bridge_flags,
+	.port_vlan_filtering = an8855_port_vlan_filtering,
+	.port_vlan_add = an8855_port_vlan_add,
+	.port_vlan_del = an8855_port_vlan_del,
+	.port_fdb_add = an8855_port_fdb_add,
+	.port_fdb_del = an8855_port_fdb_del,
+	.port_fdb_dump = an8855_port_fdb_dump,
+	.port_mdb_add = an8855_port_mdb_add,
+	.port_mdb_del = an8855_port_mdb_del,
+	.port_change_mtu = an8855_port_change_mtu,
+	.port_max_mtu = an8855_port_max_mtu,
+	.port_mirror_add = an8855_port_mirror_add,
+	.port_mirror_del = an8855_port_mirror_del,
+};
+
+static int an8855_read_switch_id(struct an8855_priv *priv)
+{
+	u32 id;
+	int ret;
+
+	ret = regmap_read(priv->regmap, AN8855_CREV, &id);
+	if (ret)
+		return ret;
+
+	if (id != AN8855_ID) {
+		dev_err(priv->dev,
+			"Switch id detected %x but expected %x\n",
+			id, AN8855_ID);
+		return -ENODEV;
+	}
+
+	return 0;
+}
+
+static int an8855_switch_probe(struct platform_device *pdev)
+{
+	struct an8855_priv *priv;
+	u32 val;
+	int ret;
+
+	priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	priv->dev = &pdev->dev;
+	priv->phy_require_calib = of_property_read_bool(priv->dev->of_node,
+							"airoha,ext-surge");
+
+	priv->reset_gpio = devm_gpiod_get_optional(priv->dev, "reset",
+						   GPIOD_OUT_LOW);
+	if (IS_ERR(priv->reset_gpio))
+		return PTR_ERR(priv->reset_gpio);
+
+	/* Get regmap from MFD */
+	priv->regmap = dev_get_regmap(priv->dev->parent, NULL);
+
+	if (priv->reset_gpio) {
+		usleep_range(100000, 150000);
+		gpiod_set_value_cansleep(priv->reset_gpio, 0);
+		usleep_range(100000, 150000);
+		gpiod_set_value_cansleep(priv->reset_gpio, 1);
+
+		/* Poll HWTRAP reg to wait for Switch to fully Init */
+		ret = regmap_read_poll_timeout(priv->regmap, AN8855_HWTRAP, val,
+					       val, 20, 200000);
+		if (ret)
+			return ret;
+	}
+
+	ret = an8855_read_switch_id(priv);
+	if (ret)
+		return ret;
+
+	priv->ds = devm_kzalloc(priv->dev, sizeof(*priv->ds), GFP_KERNEL);
+	if (!priv->ds)
+		return -ENOMEM;
+
+	priv->ds->dev = priv->dev;
+	priv->ds->num_ports = AN8855_NUM_PORTS;
+	priv->ds->priv = priv;
+	priv->ds->ops = &an8855_switch_ops;
+	devm_mutex_init(priv->dev, &priv->reg_mutex);
+	priv->ds->phylink_mac_ops = &an8855_phylink_mac_ops;
+
+	priv->pcs.ops = &an8855_pcs_ops;
+	priv->pcs.neg_mode = true;
+	priv->pcs.poll = true;
+
+	dev_set_drvdata(priv->dev, priv);
+
+	return dsa_register_switch(priv->ds);
+}
+
+static int an8855_switch_remove(struct platform_device *pdev)
+{
+	struct an8855_priv *priv = dev_get_drvdata(&pdev->dev);
+
+	if (!priv)
+		return 0;
+
+	dsa_unregister_switch(priv->ds);
+	return 0;
+}
+
+static const struct of_device_id an8855_switch_of_match[] = {
+	{ .compatible = "airoha,an8855-switch" },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, an8855_switch_of_match);
+
+static struct platform_driver an8855_switch_driver = {
+	.probe = an8855_switch_probe,
+	.remove = an8855_switch_remove,
+	.driver = {
+		.name = "an8855-switch",
+		.of_match_table = an8855_switch_of_match,
+	},
+};
+module_platform_driver(an8855_switch_driver);
+
+MODULE_AUTHOR("Min Yao <min.yao@airoha.com>");
+MODULE_AUTHOR("Christian Marangi <ansuelsmth@gmail.com>");
+MODULE_DESCRIPTION("Driver for Airoha AN8855 Switch");
+MODULE_LICENSE("GPL");
diff --git a/target/linux/mediatek/files-6.6/drivers/net/dsa/an8855.h b/target/linux/mediatek/files-6.6/drivers/net/dsa/an8855.h
new file mode 100644
index 00000000000000..2462b9d33752bc
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/dsa/an8855.h
@@ -0,0 +1,783 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2023 Min Yao <min.yao@airoha.com>
+ * Copyright (C) 2024 Christian Marangi <ansuelsmth@gmail.com>
+ */
+
+#ifndef __AN8855_H
+#define __AN8855_H
+
+#include <linux/bitfield.h>
+
+#define AN8855_NUM_PORTS		6
+#define AN8855_CPU_PORT			5
+#define AN8855_NUM_FDB_RECORDS		2048
+#define AN8855_GPHY_SMI_ADDR_DEFAULT	1
+#define AN8855_PORT_VID_DEFAULT		0
+
+#define MTK_TAG_LEN			4
+#define AN8855_MAX_MTU			(15360 - ETH_HLEN - ETH_FCS_LEN - MTK_TAG_LEN)
+
+#define AN8855_L2_AGING_MS_CONSTANT	1024
+
+#define AN8855_PHY_FLAGS_EN_CALIBRATION	BIT(0)
+
+/*	AN8855_SCU			0x10000000 */
+#define AN8855_RG_GPIO_LED_MODE		0x10000054
+#define AN8855_RG_GPIO_LED_SEL(i)	(0x10000000 + (0x0058 + ((i) * 4)))
+#define AN8855_RG_INTB_MODE		0x10000080
+#define AN8855_RG_RGMII_TXCK_C		0x100001d0
+
+#define AN8855_PKG_SEL			0x10000094
+#define   AN8855_PAG_SEL_AN8855H	0x2
+
+/* Register for hw trap status */
+#define AN8855_HWTRAP			0x1000009c
+
+#define AN8855_RG_GPIO_L_INV		0x10000010
+#define AN8855_RG_GPIO_CTRL		0x1000a300
+#define AN8855_RG_GPIO_DATA		0x1000a304
+#define AN8855_RG_GPIO_OE		0x1000a314
+
+#define AN8855_CREV			0x10005000
+#define   AN8855_ID			0x8855
+
+/* Register for system reset */
+#define AN8855_RST_CTRL			0x100050c0
+#define   AN8855_SYS_CTRL_SYS_RST	BIT(31)
+
+#define AN8855_INT_MASK			0x100050f0
+#define   AN8855_INT_SYS		BIT(15)
+
+#define AN8855_RG_CLK_CPU_ICG		0x10005034
+#define   AN8855_MCU_ENABLE		BIT(3)
+
+#define AN8855_RG_TIMER_CTL		0x1000a100
+#define   AN8855_WDOG_ENABLE		BIT(25)
+
+#define AN8855_RG_GDMP_RAM		0x10010000
+
+/* Registers to mac forward control for unknown frames */
+#define AN8855_MFC			0x10200010
+#define   AN8855_CPU_EN			BIT(15)
+#define   AN8855_CPU_PORT_IDX		GENMASK(12, 8)
+
+#define AN8855_PAC			0x10200024
+#define   AN8855_TAG_PAE_MANG_FR	BIT(30)
+#define   AN8855_TAG_PAE_BPDU_FR	BIT(28)
+#define   AN8855_TAG_PAE_EG_TAG		GENMASK(27, 25)
+#define   AN8855_TAG_PAE_LKY_VLAN	BIT(24)
+#define   AN8855_TAG_PAE_PRI_HIGH	BIT(23)
+#define   AN8855_TAG_PAE_MIR		GENMASK(20, 19)
+#define   AN8855_TAG_PAE_PORT_FW	GENMASK(18, 16)
+#define   AN8855_PAE_MANG_FR		BIT(14)
+#define   AN8855_PAE_BPDU_FR		BIT(12)
+#define   AN8855_PAE_EG_TAG		GENMASK(11, 9)
+#define   AN8855_PAE_LKY_VLAN		BIT(8)
+#define   AN8855_PAE_PRI_HIGH		BIT(7)
+#define   AN8855_PAE_MIR		GENMASK(4, 3)
+#define   AN8855_PAE_PORT_FW		GENMASK(2, 0)
+
+#define AN8855_RGAC1			0x10200028
+#define   AN8855_R02_MANG_FR		BIT(30)
+#define   AN8855_R02_BPDU_FR		BIT(28)
+#define   AN8855_R02_EG_TAG		GENMASK(27, 25)
+#define   AN8855_R02_LKY_VLAN		BIT(24)
+#define   AN8855_R02_PRI_HIGH		BIT(23)
+#define   AN8855_R02_MIR		GENMASK(20, 19)
+#define   AN8855_R02_PORT_FW		GENMASK(18, 16)
+#define   AN8855_R01_MANG_FR		BIT(14)
+#define   AN8855_R01_BPDU_FR		BIT(12)
+#define   AN8855_R01_EG_TAG		GENMASK(11, 9)
+#define   AN8855_R01_LKY_VLAN		BIT(8)
+#define   AN8855_R01_PRI_HIGH		BIT(7)
+#define   AN8855_R01_MIR		GENMASK(4, 3)
+#define   AN8855_R01_PORT_FW		GENMASK(2, 0)
+
+#define AN8855_RGAC2			0x1020002c
+#define   AN8855_R0E_MANG_FR		BIT(30)
+#define   AN8855_R0E_BPDU_FR		BIT(28)
+#define   AN8855_R0E_EG_TAG		GENMASK(27, 25)
+#define   AN8855_R0E_LKY_VLAN		BIT(24)
+#define   AN8855_R0E_PRI_HIGH		BIT(23)
+#define   AN8855_R0E_MIR		GENMASK(20, 19)
+#define   AN8855_R0E_PORT_FW		GENMASK(18, 16)
+#define   AN8855_R03_MANG_FR		BIT(14)
+#define   AN8855_R03_BPDU_FR		BIT(12)
+#define   AN8855_R03_EG_TAG		GENMASK(11, 9)
+#define   AN8855_R03_LKY_VLAN		BIT(8)
+#define   AN8855_R03_PRI_HIGH		BIT(7)
+#define   AN8855_R03_MIR		GENMASK(4, 3)
+#define   AN8855_R03_PORT_FW		GENMASK(2, 0)
+
+#define AN8855_AAC			0x102000a0
+#define   AN8855_MAC_AUTO_FLUSH		BIT(28)
+/* Control Address Table Age time.
+ * (AN8855_AGE_CNT + 1) * ( AN8855_AGE_UNIT + 1 ) * AN8855_L2_AGING_MS_CONSTANT
+ */
+#define   AN8855_AGE_CNT		GENMASK(20, 12)
+/* Value in seconds. Value is always incremented of 1 */
+#define   AN8855_AGE_UNIT		GENMASK(10, 0)
+
+/* Registers for ARL Unknown Unicast Forward control */
+#define AN8855_UNUF			0x102000b4
+
+/* Registers for ARL Unknown Multicast Forward control */
+#define AN8855_UNMF			0x102000b8
+
+/* Registers for ARL Broadcast forward control */
+#define AN8855_BCF			0x102000bc
+
+/* Registers for port address age disable */
+#define AN8855_AGDIS			0x102000c0
+
+/* Registers for mirror port control */
+#define AN8855_MIR			0x102000cc
+#define   AN8855_MIRROR_EN		BIT(7)
+#define   AN8855_MIRROR_PORT		GENMASK(4, 0)
+
+/* Registers for BPDU and PAE frame control*/
+#define AN8855_BPC			0x102000d0
+#define   AN8855_BPDU_MANG_FR		BIT(14)
+#define   AN8855_BPDU_BPDU_FR		BIT(12)
+#define   AN8855_BPDU_EG_TAG		GENMASK(11, 9)
+#define   AN8855_BPDU_LKY_VLAN		BIT(8)
+#define   AN8855_BPDU_PRI_HIGH		BIT(7)
+#define   AN8855_BPDU_MIR		GENMASK(4, 3)
+#define   AN8855_BPDU_PORT_FW		GENMASK(2, 0)
+
+/* Registers for IP Unknown Multicast Forward control */
+#define AN8855_UNIPMF			0x102000dc
+
+enum an8855_bpdu_port_fw {
+	AN8855_BPDU_FOLLOW_MFC = 0,
+	AN8855_BPDU_CPU_EXCLUDE = 4,
+	AN8855_BPDU_CPU_INCLUDE = 5,
+	AN8855_BPDU_CPU_ONLY = 6,
+	AN8855_BPDU_DROP = 7,
+};
+
+/* Register for address table control */
+#define AN8855_ATC			0x10200300
+#define   AN8855_ATC_BUSY		BIT(31)
+#define   AN8855_ATC_HASH		GENMASK(24, 16)
+#define   AN8855_ATC_HIT		GENMASK(15, 12)
+#define   AN8855_ATC_MAT_MASK		GENMASK(11, 7)
+#define   AN8855_ATC_MAT(x)		FIELD_PREP(AN8855_ATC_MAT_MASK, x)
+#define   AN8855_ATC_SAT		GENMASK(5, 4)
+#define   AN8855_ATC_CMD		GENMASK(2, 0)
+
+enum an8855_fdb_mat_cmds {
+	AND8855_FDB_MAT_ALL = 0,
+	AND8855_FDB_MAT_MAC, /* All MAC address */
+	AND8855_FDB_MAT_DYNAMIC_MAC, /* All Dynamic MAC address */
+	AND8855_FDB_MAT_STATIC_MAC, /* All Static Mac Address */
+	AND8855_FDB_MAT_DIP, /* All DIP/GA address */
+	AND8855_FDB_MAT_DIP_IPV4, /* All DIP/GA IPv4 address */
+	AND8855_FDB_MAT_DIP_IPV6, /* All DIP/GA IPv6 address */
+	AND8855_FDB_MAT_DIP_SIP, /* All DIP_SIP address */
+	AND8855_FDB_MAT_DIP_SIP_IPV4, /* All DIP_SIP IPv4 address */
+	AND8855_FDB_MAT_DIP_SIP_IPV6, /* All DIP_SIP IPv6 address */
+	AND8855_FDB_MAT_MAC_CVID, /* All MAC address with CVID */
+	AND8855_FDB_MAT_MAC_FID, /* All MAC address with Filter ID */
+	AND8855_FDB_MAT_MAC_PORT, /* All MAC address with port */
+	AND8855_FDB_MAT_DIP_SIP_DIP_IPV4, /* All DIP_SIP address with DIP_IPV4 */
+	AND8855_FDB_MAT_DIP_SIP_SIP_IPV4, /* All DIP_SIP address with SIP_IPV4 */
+	AND8855_FDB_MAT_DIP_SIP_DIP_IPV6, /* All DIP_SIP address with DIP_IPV6 */
+	AND8855_FDB_MAT_DIP_SIP_SIP_IPV6, /* All DIP_SIP address with SIP_IPV6 */
+	/* All MAC address with MAC type (dynamic or static) with CVID */
+	AND8855_FDB_MAT_MAC_TYPE_CVID,
+	/* All MAC address with MAC type (dynamic or static) with Filter ID */
+	AND8855_FDB_MAT_MAC_TYPE_FID,
+	/* All MAC address with MAC type (dynamic or static) with port */
+	AND8855_FDB_MAT_MAC_TYPE_PORT,
+};
+
+enum an8855_fdb_cmds {
+	AN8855_FDB_READ = 0,
+	AN8855_FDB_WRITE = 1,
+	AN8855_FDB_FLUSH = 2,
+	AN8855_FDB_START = 4,
+	AN8855_FDB_NEXT = 5,
+};
+
+/* Registers for address table access */
+#define AN8855_ATA1			0x10200304
+#define   AN8855_ATA1_MAC0		GENMASK(31, 24)
+#define   AN8855_ATA1_MAC1		GENMASK(23, 16)
+#define   AN8855_ATA1_MAC2		GENMASK(15, 8)
+#define   AN8855_ATA1_MAC3		GENMASK(7, 0)
+#define AN8855_ATA2			0x10200308
+#define   AN8855_ATA2_MAC4		GENMASK(31, 24)
+#define   AN8855_ATA2_MAC5		GENMASK(23, 16)
+#define   AN8855_ATA2_UNAUTH		BIT(10)
+#define   AN8855_ATA2_TYPE		BIT(9) /* 1: dynamic, 0: static */
+#define   AN8855_ATA2_AGE		GENMASK(8, 0)
+
+/* Register for address table write data */
+#define AN8855_ATWD			0x10200324
+#define   AN8855_ATWD_FID		GENMASK(31, 28)
+#define   AN8855_ATWD_VID		GENMASK(27, 16)
+#define   AN8855_ATWD_IVL		BIT(15)
+#define   AN8855_ATWD_EG_TAG		GENMASK(14, 12)
+#define   AN8855_ATWD_SA_MIR		GENMASK(9, 8)
+#define   AN8855_ATWD_SA_FWD		GENMASK(7, 5)
+#define   AN8855_ATWD_UPRI		GENMASK(4, 2)
+#define   AN8855_ATWD_LEAKY		BIT(1)
+#define   AN8855_ATWD_VLD		BIT(0) /* vid LOAD */
+#define AN8855_ATWD2			0x10200328
+#define   AN8855_ATWD2_PORT		GENMASK(7, 0)
+
+/* Registers for table search read address */
+#define AN8855_ATRDS			0x10200330
+#define   AN8855_ATRD_SEL		GENMASK(1, 0)
+#define AN8855_ATRD0			0x10200334
+#define   AN8855_ATRD0_FID		GENMASK(28, 25)
+#define   AN8855_ATRD0_VID		GENMASK(21, 10)
+#define   AN8855_ATRD0_IVL		BIT(9)
+#define   AN8855_ATRD0_TYPE		GENMASK(4, 3)
+#define   AN8855_ATRD0_ARP		GENMASK(2, 1)
+#define   AN8855_ATRD0_LIVE		BIT(0)
+#define AN8855_ATRD1			0x10200338
+#define   AN8855_ATRD1_MAC4		GENMASK(31, 24)
+#define   AN8855_ATRD1_MAC5		GENMASK(23, 16)
+#define   AN8855_ATRD1_AGING		GENMASK(11, 3)
+#define AN8855_ATRD2			0x1020033c
+#define   AN8855_ATRD2_MAC0		GENMASK(31, 24)
+#define   AN8855_ATRD2_MAC1		GENMASK(23, 16)
+#define   AN8855_ATRD2_MAC2		GENMASK(15, 8)
+#define   AN8855_ATRD2_MAC3		GENMASK(7, 0)
+#define AN8855_ATRD3			0x10200340
+#define   AN8855_ATRD3_PORTMASK		GENMASK(7, 0)
+
+enum an8855_fdb_type {
+	AN8855_MAC_TB_TY_MAC = 0,
+	AN8855_MAC_TB_TY_DIP = 1,
+	AN8855_MAC_TB_TY_DIP_SIP = 2,
+};
+
+/* Register for vlan table control */
+#define AN8855_VTCR			0x10200600
+#define   AN8855_VTCR_BUSY		BIT(31)
+#define   AN8855_VTCR_FUNC		GENMASK(15, 12)
+#define   AN8855_VTCR_VID		GENMASK(11, 0)
+
+enum an8855_vlan_cmd {
+	/* Read/Write the specified VID entry from VAWD register based
+	 * on VID.
+	 */
+	AN8855_VTCR_RD_VID = 0,
+	AN8855_VTCR_WR_VID = 1,
+};
+
+/* Register for setup vlan write data */
+#define AN8855_VAWD0			0x10200604
+/* VLAN Member Control */
+#define   AN8855_VA0_PORT		GENMASK(31, 26)
+/* Egress Tag Control */
+#define   AN8855_VA0_ETAG		GENMASK(23, 12)
+#define   AN8855_VA0_ETAG_PORT		GENMASK(13, 12)
+#define   AN8855_VA0_ETAG_PORT_SHIFT(port) ((port) * 2)
+#define   AN8855_VA0_ETAG_PORT_MASK(port) (AN8855_VA0_ETAG_PORT << \
+						AN8855_VA0_ETAG_PORT_SHIFT(port))
+#define   AN8855_VA0_ETAG_PORT_VAL(port, val) (FIELD_PREP(AN8855_VA0_ETAG_PORT, (val)) << \
+						AN8855_VA0_ETAG_PORT_SHIFT(port))
+#define   AN8855_VA0_EG_CON		BIT(11)
+#define   AN8855_VA0_VTAG_EN		BIT(10) /* Per VLAN Egress Tag Control */
+#define   AN8855_VA0_IVL_MAC		BIT(5) /* Independent VLAN Learning */
+#define	  AN8855_VA0_FID		GENMASK(4, 1)
+#define   AN8855_VA0_VLAN_VALID		BIT(0) /* VLAN Entry Valid */
+#define AN8855_VAWD1			0x10200608
+#define   AN8855_VA1_PORT_STAG		BIT(1)
+
+enum an8855_fid {
+	AN8855_FID_STANDALONE = 0,
+	AN8855_FID_BRIDGED = 1,
+};
+
+/* Same register field of VAWD0 */
+#define AN8855_VARD0			0x10200618
+
+enum an8855_vlan_egress_attr {
+	AN8855_VLAN_EGRESS_UNTAG = 0,
+	AN8855_VLAN_EGRESS_TAG = 2,
+	AN8855_VLAN_EGRESS_STACK = 3,
+};
+
+/* Register for port STP state control */
+#define AN8855_SSP_P(x)			(0x10208000 + ((x) * 0x200))
+/* Up to 16 FID supported, each with the same mask */
+#define	  AN8855_FID_PST		GENMASK(1, 0)
+#define   AN8855_FID_PST_SHIFT(fid)	(2 * (fid))
+#define   AN8855_FID_PST_MASK(fid)	(AN8855_FID_PST << \
+						AN8855_FID_PST_SHIFT(fid))
+#define   AN8855_FID_PST_VAL(fid, val)	(FIELD_PREP(AN8855_FID_PST, (val)) << \
+						AN8855_FID_PST_SHIFT(fid))
+
+enum an8855_stp_state {
+	AN8855_STP_DISABLED = 0,
+	AN8855_STP_BLOCKING = 1,
+	AN8855_STP_LISTENING = AN8855_STP_BLOCKING,
+	AN8855_STP_LEARNING = 2,
+	AN8855_STP_FORWARDING = 3
+};
+
+/* Register for port control */
+#define AN8855_PCR_P(x)			(0x10208004 + ((x) * 0x200))
+#define   AN8855_EG_TAG			GENMASK(29, 28)
+#define   AN8855_PORT_PRI		GENMASK(26, 24)
+#define   AN8855_PORT_TX_MIR		BIT(20)
+#define   AN8855_PORT_RX_MIR		BIT(16)
+#define   AN8855_PORT_VLAN		GENMASK(1, 0)
+
+enum an8855_port_mode {
+	/* Port Matrix Mode: Frames are forwarded by the PCR_MATRIX members. */
+	AN8855_PORT_MATRIX_MODE = 0,
+
+	/* Fallback Mode: Forward received frames with ingress ports that do
+	 * not belong to the VLAN member. Frames whose VID is not listed on
+	 * the VLAN table are forwarded by the PCR_MATRIX members.
+	 */
+	AN8855_PORT_FALLBACK_MODE = 1,
+
+	/* Check Mode: Forward received frames whose ingress do not
+	 * belong to the VLAN member. Discard frames if VID ismiddes on the
+	 * VLAN table.
+	 */
+	AN8855_PORT_CHECK_MODE = 2,
+
+	/* Security Mode: Discard any frame due to ingress membership
+	 * violation or VID missed on the VLAN table.
+	 */
+	AN8855_PORT_SECURITY_MODE = 3,
+};
+
+/* Register for port security control */
+#define AN8855_PSC_P(x)			(0x1020800c + ((x) * 0x200))
+#define   AN8855_SA_DIS			BIT(4)
+
+/* Register for port vlan control */
+#define AN8855_PVC_P(x)			(0x10208010 + ((x) * 0x200))
+#define   AN8855_PORT_SPEC_REPLACE_MODE	BIT(11)
+#define   AN8855_PVC_EG_TAG		GENMASK(10, 8)
+#define   AN8855_VLAN_ATTR		GENMASK(7, 6)
+#define   AN8855_PORT_SPEC_TAG		BIT(5)
+#define   AN8855_ACC_FRM		GENMASK(1, 0)
+
+enum an8855_vlan_port_eg_tag {
+	AN8855_VLAN_EG_DISABLED = 0,
+	AN8855_VLAN_EG_CONSISTENT = 1,
+	AN8855_VLAN_EG_UNTAGGED = 4,
+	AN8855_VLAN_EG_SWAP = 5,
+	AN8855_VLAN_EG_TAGGED = 6,
+	AN8855_VLAN_EG_STACK = 7,
+};
+
+enum an8855_vlan_port_attr {
+	AN8855_VLAN_USER = 0,
+	AN8855_VLAN_STACK = 1,
+	AN8855_VLAN_TRANSPARENT = 3,
+};
+
+enum an8855_vlan_port_acc_frm {
+	AN8855_VLAN_ACC_ALL = 0,
+	AN8855_VLAN_ACC_TAGGED = 1,
+	AN8855_VLAN_ACC_UNTAGGED = 2,
+};
+
+#define AN8855_PPBV1_P(x)		(0x10208014 + ((x) * 0x200))
+#define   AN8855_PPBV_G0_PORT_VID	GENMASK(11, 0)
+
+#define AN8855_PORTMATRIX_P(x)		(0x10208044 + ((x) * 0x200))
+#define   AN8855_PORTMATRIX		GENMASK(5, 0)
+/* Port matrix without the CPU port that should never be removed */
+#define   AN8855_USER_PORTMATRIX	GENMASK(4, 0)
+
+/* Register for port PVID */
+#define AN8855_PVID_P(x)		(0x10208048 + ((x) * 0x200))
+#define   AN8855_G0_PORT_VID		GENMASK(11, 0)
+
+/* Register for port MAC control register */
+#define AN8855_PMCR_P(x)		(0x10210000 + ((x) * 0x200))
+#define   AN8855_PMCR_FORCE_MODE	BIT(31)
+#define   AN8855_PMCR_FORCE_SPEED	GENMASK(30, 28)
+#define   AN8855_PMCR_FORCE_SPEED_5000	FIELD_PREP_CONST(AN8855_PMCR_FORCE_SPEED, 0x4)
+#define   AN8855_PMCR_FORCE_SPEED_2500	FIELD_PREP_CONST(AN8855_PMCR_FORCE_SPEED, 0x3)
+#define   AN8855_PMCR_FORCE_SPEED_1000	FIELD_PREP_CONST(AN8855_PMCR_FORCE_SPEED, 0x2)
+#define   AN8855_PMCR_FORCE_SPEED_100	FIELD_PREP_CONST(AN8855_PMCR_FORCE_SPEED, 0x1)
+#define   AN8855_PMCR_FORCE_SPEED_10	FIELD_PREP_CONST(AN8855_PMCR_FORCE_SPEED, 0x1)
+#define   AN8855_PMCR_FORCE_FDX		BIT(25)
+#define   AN8855_PMCR_FORCE_LNK		BIT(24)
+#define   AN8855_PMCR_IFG_XMIT		GENMASK(21, 20)
+#define   AN8855_PMCR_EXT_PHY		BIT(19)
+#define   AN8855_PMCR_MAC_MODE		BIT(18)
+#define   AN8855_PMCR_TX_EN		BIT(16)
+#define   AN8855_PMCR_RX_EN		BIT(15)
+#define   AN8855_PMCR_BACKOFF_EN	BIT(12)
+#define   AN8855_PMCR_BACKPR_EN		BIT(11)
+#define   AN8855_PMCR_FORCE_EEE5G	BIT(9)
+#define   AN8855_PMCR_FORCE_EEE2P5G	BIT(8)
+#define   AN8855_PMCR_FORCE_EEE1G	BIT(7)
+#define   AN8855_PMCR_FORCE_EEE100	BIT(6)
+#define   AN8855_PMCR_TX_FC_EN		BIT(5)
+#define   AN8855_PMCR_RX_FC_EN		BIT(4)
+
+#define AN8855_PMSR_P(x)		(0x10210010 + (x) * 0x200)
+#define   AN8855_PMSR_SPEED		GENMASK(30, 28)
+#define   AN8855_PMSR_SPEED_5000	FIELD_PREP_CONST(AN8855_PMSR_SPEED, 0x4)
+#define   AN8855_PMSR_SPEED_2500	FIELD_PREP_CONST(AN8855_PMSR_SPEED, 0x3)
+#define   AN8855_PMSR_SPEED_1000	FIELD_PREP_CONST(AN8855_PMSR_SPEED, 0x2)
+#define   AN8855_PMSR_SPEED_100		FIELD_PREP_CONST(AN8855_PMSR_SPEED, 0x1)
+#define   AN8855_PMSR_SPEED_10		FIELD_PREP_CONST(AN8855_PMSR_SPEED, 0x0)
+#define   AN8855_PMSR_DPX		BIT(25)
+#define   AN8855_PMSR_LNK		BIT(24)
+#define   AN8855_PMSR_EEE1G		BIT(7)
+#define   AN8855_PMSR_EEE100M		BIT(6)
+#define   AN8855_PMSR_RX_FC		BIT(5)
+#define   AN8855_PMSR_TX_FC		BIT(4)
+
+#define AN8855_PMEEECR_P(x)		(0x10210004 + (x) * 0x200)
+#define   AN8855_LPI_MODE_EN		BIT(31)
+#define   AN8855_WAKEUP_TIME_2500	GENMASK(23, 16)
+#define   AN8855_WAKEUP_TIME_1000	GENMASK(15, 8)
+#define   AN8855_WAKEUP_TIME_100	GENMASK(7, 0)
+#define AN8855_PMEEECR2_P(x)		(0x10210008 + (x) * 0x200)
+#define   AN8855_WAKEUP_TIME_5000	GENMASK(7, 0)
+
+#define AN8855_GMACCR			0x10213e00
+#define   AN8855_MAX_RX_JUMBO		GENMASK(7, 4)
+/* 2K for 0x0, 0x1, 0x2 */
+#define   AN8855_MAX_RX_JUMBO_2K	FIELD_PREP_CONST(AN8855_MAX_RX_JUMBO, 0x0)
+#define   AN8855_MAX_RX_JUMBO_3K	FIELD_PREP_CONST(AN8855_MAX_RX_JUMBO, 0x3)
+#define   AN8855_MAX_RX_JUMBO_4K	FIELD_PREP_CONST(AN8855_MAX_RX_JUMBO, 0x4)
+#define   AN8855_MAX_RX_JUMBO_5K	FIELD_PREP_CONST(AN8855_MAX_RX_JUMBO, 0x5)
+#define   AN8855_MAX_RX_JUMBO_6K	FIELD_PREP_CONST(AN8855_MAX_RX_JUMBO, 0x6)
+#define   AN8855_MAX_RX_JUMBO_7K	FIELD_PREP_CONST(AN8855_MAX_RX_JUMBO, 0x7)
+#define   AN8855_MAX_RX_JUMBO_8K	FIELD_PREP_CONST(AN8855_MAX_RX_JUMBO, 0x8)
+#define   AN8855_MAX_RX_JUMBO_9K	FIELD_PREP_CONST(AN8855_MAX_RX_JUMBO, 0x9)
+#define   AN8855_MAX_RX_JUMBO_12K	FIELD_PREP_CONST(AN8855_MAX_RX_JUMBO, 0xa)
+#define   AN8855_MAX_RX_JUMBO_15K	FIELD_PREP_CONST(AN8855_MAX_RX_JUMBO, 0xb)
+#define   AN8855_MAX_RX_JUMBO_16K	FIELD_PREP_CONST(AN8855_MAX_RX_JUMBO, 0xc)
+#define   AN8855_MAX_RX_PKT_LEN		GENMASK(1, 0)
+#define   AN8855_MAX_RX_PKT_1518_1522	FIELD_PREP_CONST(AN8855_MAX_RX_PKT_LEN, 0x0)
+#define   AN8855_MAX_RX_PKT_1536	FIELD_PREP_CONST(AN8855_MAX_RX_PKT_LEN, 0x1)
+#define   AN8855_MAX_RX_PKT_1552	FIELD_PREP_CONST(AN8855_MAX_RX_PKT_LEN, 0x2)
+#define   AN8855_MAX_RX_PKT_JUMBO	FIELD_PREP_CONST(AN8855_MAX_RX_PKT_LEN, 0x3)
+
+#define AN8855_CKGCR			0x10213e1c
+#define   AN8855_LPI_TXIDLE_THD_MASK	GENMASK(31, 14)
+#define   AN8855_CKG_LNKDN_PORT_STOP	BIT(1)
+#define   AN8855_CKG_LNKDN_GLB_STOP	BIT(0)
+
+/* Register for MIB */
+#define AN8855_PORT_MIB_COUNTER(x)	(0x10214000 + (x) * 0x200)
+/* Each define is an offset of AN8855_PORT_MIB_COUNTER */
+#define   AN8855_PORT_MIB_TX_DROP	0x00
+#define   AN8855_PORT_MIB_TX_CRC_ERR	0x04
+#define   AN8855_PORT_MIB_TX_UNICAST	0x08
+#define   AN8855_PORT_MIB_TX_MULTICAST	0x0c
+#define   AN8855_PORT_MIB_TX_BROADCAST	0x10
+#define   AN8855_PORT_MIB_TX_COLLISION	0x14
+#define   AN8855_PORT_MIB_TX_SINGLE_COLLISION 0x18
+#define   AN8855_PORT_MIB_TX_MULTIPLE_COLLISION 0x1c
+#define   AN8855_PORT_MIB_TX_DEFERRED	0x20
+#define   AN8855_PORT_MIB_TX_LATE_COLLISION 0x24
+#define   AN8855_PORT_MIB_TX_EXCESSIVE_COLLISION 0x28
+#define   AN8855_PORT_MIB_TX_PAUSE	0x2c
+#define   AN8855_PORT_MIB_TX_PKT_SZ_64	0x30
+#define   AN8855_PORT_MIB_TX_PKT_SZ_65_TO_127 0x34
+#define   AN8855_PORT_MIB_TX_PKT_SZ_128_TO_255 0x38
+#define   AN8855_PORT_MIB_TX_PKT_SZ_256_TO_511 0x3
+#define   AN8855_PORT_MIB_TX_PKT_SZ_512_TO_1023 0x40
+#define   AN8855_PORT_MIB_TX_PKT_SZ_1024_TO_1518 0x44
+#define   AN8855_PORT_MIB_TX_PKT_SZ_1519_TO_MAX 0x48
+#define   AN8855_PORT_MIB_TX_BYTES	0x4c /* 64 bytes */
+#define   AN8855_PORT_MIB_TX_OVERSIZE_DROP 0x54
+#define   AN8855_PORT_MIB_TX_BAD_PKT_BYTES 0x58 /* 64 bytes */
+#define   AN8855_PORT_MIB_RX_DROP	0x80
+#define   AN8855_PORT_MIB_RX_FILTERING	0x84
+#define   AN8855_PORT_MIB_RX_UNICAST	0x88
+#define   AN8855_PORT_MIB_RX_MULTICAST	0x8c
+#define   AN8855_PORT_MIB_RX_BROADCAST	0x90
+#define   AN8855_PORT_MIB_RX_ALIGN_ERR	0x94
+#define   AN8855_PORT_MIB_RX_CRC_ERR	0x98
+#define   AN8855_PORT_MIB_RX_UNDER_SIZE_ERR 0x9c
+#define   AN8855_PORT_MIB_RX_FRAG_ERR	0xa0
+#define   AN8855_PORT_MIB_RX_OVER_SZ_ERR 0xa4
+#define   AN8855_PORT_MIB_RX_JABBER_ERR	0xa8
+#define   AN8855_PORT_MIB_RX_PAUSE	0xac
+#define   AN8855_PORT_MIB_RX_PKT_SZ_64	0xb0
+#define   AN8855_PORT_MIB_RX_PKT_SZ_65_TO_127 0xb4
+#define   AN8855_PORT_MIB_RX_PKT_SZ_128_TO_255 0xb8
+#define   AN8855_PORT_MIB_RX_PKT_SZ_256_TO_511 0xbc
+#define   AN8855_PORT_MIB_RX_PKT_SZ_512_TO_1023 0xc0
+#define   AN8855_PORT_MIB_RX_PKT_SZ_1024_TO_1518 0xc4
+#define   AN8855_PORT_MIB_RX_PKT_SZ_1519_TO_MAX 0xc8
+#define   AN8855_PORT_MIB_RX_BYTES	0xcc /* 64 bytes */
+#define   AN8855_PORT_MIB_RX_CTRL_DROP	0xd4
+#define   AN8855_PORT_MIB_RX_INGRESS_DROP 0xd8
+#define   AN8855_PORT_MIB_RX_ARL_DROP	0xdc
+#define   AN8855_PORT_MIB_FLOW_CONTROL_DROP 0xe0
+#define   AN8855_PORT_MIB_WRED_DROP	0xe4
+#define   AN8855_PORT_MIB_MIRROR_DROP	0xe8
+#define   AN8855_PORT_MIB_RX_BAD_PKT_BYTES 0xec /* 64 bytes */
+#define   AN8855_PORT_MIB_RXS_FLOW_SAMPLING_PKT_DROP 0xf4
+#define   AN8855_PORT_MIB_RXS_FLOW_TOTAL_PKT_DROP 0xf8
+#define   AN8855_PORT_MIB_PORT_CONTROL_DROP 0xfc
+#define AN8855_MIB_CCR			0x10213e30
+#define   AN8855_CCR_MIB_ENABLE		BIT(31)
+#define   AN8855_CCR_RX_OCT_CNT_GOOD	BIT(7)
+#define   AN8855_CCR_RX_OCT_CNT_BAD	BIT(6)
+#define   AN8855_CCR_TX_OCT_CNT_GOOD	BIT(5)
+#define   AN8855_CCR_TX_OCT_CNT_BAD	BIT(4)
+#define   AN8855_CCR_RX_OCT_CNT_GOOD_2	BIT(3)
+#define   AN8855_CCR_RX_OCT_CNT_BAD_2	BIT(2)
+#define   AN8855_CCR_TX_OCT_CNT_GOOD_2	BIT(1)
+#define   AN8855_CCR_TX_OCT_CNT_BAD_2	BIT(0)
+#define   AN8855_CCR_MIB_ACTIVATE	(AN8855_CCR_MIB_ENABLE | \
+					 AN8855_CCR_RX_OCT_CNT_GOOD | \
+					 AN8855_CCR_RX_OCT_CNT_BAD | \
+					 AN8855_CCR_TX_OCT_CNT_GOOD | \
+					 AN8855_CCR_TX_OCT_CNT_BAD | \
+					 AN8855_CCR_RX_OCT_CNT_BAD_2 | \
+					 AN8855_CCR_TX_OCT_CNT_BAD_2)
+#define AN8855_MIB_CLR			0x10213e34
+#define   AN8855_MIB_PORT6_CLR		BIT(6)
+#define   AN8855_MIB_PORT5_CLR		BIT(5)
+#define   AN8855_MIB_PORT4_CLR		BIT(4)
+#define   AN8855_MIB_PORT3_CLR		BIT(3)
+#define   AN8855_MIB_PORT2_CLR		BIT(2)
+#define   AN8855_MIB_PORT1_CLR		BIT(1)
+#define   AN8855_MIB_PORT0_CLR		BIT(0)
+
+/* HSGMII/SGMII Configuration register */
+/*	AN8855_HSGMII_AN_CSR_BASE	0x10220000 */
+#define AN8855_SGMII_REG_AN0		0x10220000
+/*        AN8855_SGMII_AN_ENABLE	BMCR_ANENABLE */
+/*        AN8855_SGMII_AN_RESTART	BMCR_ANRESTART */
+#define AN8855_SGMII_REG_AN_13		0x10220034
+#define   AN8855_SGMII_REMOTE_FAULT_DIS	BIT(8)
+#define   AN8855_SGMII_IF_MODE		GENMASK(5, 0)
+#define AN8855_SGMII_REG_AN_FORCE_CL37	0x10220060
+#define   AN8855_RG_FORCE_AN_DONE	BIT(0)
+
+/*	AN8855_HSGMII_CSR_PCS_BASE	0x10220000 */
+#define AN8855_RG_HSGMII_PCS_CTROL_1	0x10220a00
+#define   AN8855_RG_TBI_10B_MODE	BIT(30)
+#define AN8855_RG_AN_SGMII_MODE_FORCE	0x10220a24
+#define   AN8855_RG_FORCE_CUR_SGMII_MODE GENMASK(5, 4)
+#define   AN8855_RG_FORCE_CUR_SGMII_SEL	BIT(0)
+
+/*	AN8855_MULTI_SGMII_CSR_BASE	0x10224000 */
+#define AN8855_SGMII_STS_CTRL_0		0x10224018
+#define   AN8855_RG_LINK_MODE_P0	GENMASK(5, 4)
+#define   AN8855_RG_LINK_MODE_P0_SPEED_2500 FIELD_PREP_CONST(AN8855_RG_LINK_MODE_P0, 0x3)
+#define   AN8855_RG_LINK_MODE_P0_SPEED_1000 FIELD_PREP_CONST(AN8855_RG_LINK_MODE_P0, 0x2)
+#define   AN8855_RG_LINK_MODE_P0_SPEED_100 FIELD_PREP_CONST(AN8855_RG_LINK_MODE_P0, 0x1)
+#define   AN8855_RG_LINK_MODE_P0_SPEED_10 FIELD_PREP_CONST(AN8855_RG_LINK_MODE_P0, 0x0)
+#define   AN8855_RG_FORCE_SPD_MODE_P0	BIT(2)
+#define AN8855_MSG_RX_CTRL_0		0x10224100
+#define AN8855_MSG_RX_LIK_STS_0		0x10224514
+#define   AN8855_RG_DPX_STS_P3		BIT(24)
+#define   AN8855_RG_DPX_STS_P2		BIT(16)
+#define   AN8855_RG_EEE1G_STS_P1	BIT(12)
+#define   AN8855_RG_DPX_STS_P1		BIT(8)
+#define   AN8855_RG_TXFC_STS_P0		BIT(2)
+#define   AN8855_RG_RXFC_STS_P0		BIT(1)
+#define   AN8855_RG_DPX_STS_P0		BIT(0)
+#define AN8855_MSG_RX_LIK_STS_2		0x1022451c
+#define   AN8855_RG_RXFC_AN_BYPASS_P3	BIT(11)
+#define   AN8855_RG_RXFC_AN_BYPASS_P2	BIT(10)
+#define   AN8855_RG_RXFC_AN_BYPASS_P1	BIT(9)
+#define   AN8855_RG_TXFC_AN_BYPASS_P3	BIT(7)
+#define   AN8855_RG_TXFC_AN_BYPASS_P2	BIT(6)
+#define   AN8855_RG_TXFC_AN_BYPASS_P1	BIT(5)
+#define   AN8855_RG_DPX_AN_BYPASS_P3	BIT(3)
+#define   AN8855_RG_DPX_AN_BYPASS_P2	BIT(2)
+#define   AN8855_RG_DPX_AN_BYPASS_P1	BIT(1)
+#define   AN8855_RG_DPX_AN_BYPASS_P0	BIT(0)
+#define AN8855_PHY_RX_FORCE_CTRL_0	0x10224520
+#define   AN8855_RG_FORCE_TXC_SEL	BIT(4)
+
+/*	AN8855_XFI_CSR_PCS_BASE		0x10225000 */
+#define AN8855_RG_USXGMII_AN_CONTROL_0	0x10225bf8
+
+/*	AN8855_MULTI_PHY_RA_CSR_BASE	0x10226000 */
+#define AN8855_RG_RATE_ADAPT_CTRL_0	0x10226000
+#define   AN8855_RG_RATE_ADAPT_RX_BYPASS BIT(27)
+#define   AN8855_RG_RATE_ADAPT_TX_BYPASS BIT(26)
+#define   AN8855_RG_RATE_ADAPT_RX_EN	BIT(4)
+#define   AN8855_RG_RATE_ADAPT_TX_EN	BIT(0)
+#define AN8855_RATE_ADP_P0_CTRL_0	0x10226100
+#define   AN8855_RG_P0_DIS_MII_MODE	BIT(31)
+#define   AN8855_RG_P0_MII_MODE		BIT(28)
+#define   AN8855_RG_P0_MII_RA_RX_EN	BIT(3)
+#define   AN8855_RG_P0_MII_RA_TX_EN	BIT(2)
+#define   AN8855_RG_P0_MII_RA_RX_MODE	BIT(1)
+#define   AN8855_RG_P0_MII_RA_TX_MODE	BIT(0)
+#define AN8855_MII_RA_AN_ENABLE		0x10226300
+#define   AN8855_RG_P0_RA_AN_EN		BIT(0)
+
+/*	AN8855_QP_DIG_CSR_BASE		0x1022a000 */
+#define AN8855_QP_CK_RST_CTRL_4		0x1022a310
+#define AN8855_QP_DIG_MODE_CTRL_0	0x1022a324
+#define   AN8855_RG_SGMII_MODE		GENMASK(5, 4)
+#define   AN8855_RG_SGMII_AN_EN		BIT(0)
+#define AN8855_QP_DIG_MODE_CTRL_1	0x1022a330
+#define   AN8855_RG_TPHY_SPEED		GENMASK(3, 2)
+
+/*	AN8855_SERDES_WRAPPER_BASE	0x1022c000 */
+#define AN8855_USGMII_CTRL_0		0x1022c000
+
+/*	AN8855_QP_PMA_TOP_BASE		0x1022e000 */
+#define AN8855_PON_RXFEDIG_CTRL_0	0x1022e100
+#define   AN8855_RG_QP_EQ_RX500M_CK_SEL	BIT(12)
+#define AN8855_PON_RXFEDIG_CTRL_9	0x1022e124
+#define   AN8855_RG_QP_EQ_LEQOSC_DLYCNT	GENMASK(2, 0)
+
+#define AN8855_SS_LCPLL_PWCTL_SETTING_2	0x1022e208
+#define   AN8855_RG_NCPO_ANA_MSB	GENMASK(17, 16)
+#define AN8855_SS_LCPLL_TDC_FLT_2	0x1022e230
+#define   AN8855_RG_LCPLL_NCPO_VALUE	GENMASK(30, 0)
+#define AN8855_SS_LCPLL_TDC_FLT_5	0x1022e23c
+#define   AN8855_RG_LCPLL_NCPO_CHG	BIT(24)
+#define AN8855_SS_LCPLL_TDC_PCW_1	0x1022e248
+#define  AN8855_RG_LCPLL_PON_HRDDS_PCW_NCPO_GPON GENMASK(30, 0)
+#define AN8855_INTF_CTRL_8		0x1022e320
+#define AN8855_INTF_CTRL_9		0x1022e324
+#define AN8855_INTF_CTRL_10		0x1022e328
+#define   AN8855_RG_DA_QP_TX_FIR_C2_SEL	BIT(29)
+#define   AN8855_RG_DA_QP_TX_FIR_C2_FORCE GENMASK(28, 24)
+#define   AN8855_RG_DA_QP_TX_FIR_C1_SEL	BIT(21)
+#define   AN8855_RG_DA_QP_TX_FIR_C1_FORCE GENMASK(20, 16)
+#define AN8855_INTF_CTRL_11		0x1022e32c
+#define   AN8855_RG_DA_QP_TX_FIR_C0B_SEL BIT(6)
+#define   AN8855_RG_DA_QP_TX_FIR_C0B_FORCE GENMASK(5, 0)
+#define AN8855_PLL_CTRL_0		0x1022e400
+#define   AN8855_RG_PHYA_AUTO_INIT	BIT(0)
+#define AN8855_PLL_CTRL_2		0x1022e408
+#define   AN8855_RG_DA_QP_PLL_SDM_IFM_INTF BIT(30)
+#define   AN8855_RG_DA_QP_PLL_RICO_SEL_INTF BIT(29)
+#define   AN8855_RG_DA_QP_PLL_POSTDIV_EN_INTF BIT(28)
+#define   AN8855_RG_DA_QP_PLL_PHY_CK_EN_INTF BIT(27)
+#define   AN8855_RG_DA_QP_PLL_PFD_OFFSET_EN_INTRF BIT(26)
+#define   AN8855_RG_DA_QP_PLL_PFD_OFFSET_INTF GENMASK(25, 24)
+#define   AN8855_RG_DA_QP_PLL_PCK_SEL_INTF BIT(22)
+#define   AN8855_RG_DA_QP_PLL_KBAND_PREDIV_INTF GENMASK(21, 20)
+#define   AN8855_RG_DA_QP_PLL_IR_INTF	GENMASK(19, 16)
+#define   AN8855_RG_DA_QP_PLL_ICOIQ_EN_INTF BIT(14)
+#define   AN8855_RG_DA_QP_PLL_FBKSEL_INTF GENMASK(13, 12)
+#define   AN8855_RG_DA_QP_PLL_BR_INTF	GENMASK(10, 8)
+#define   AN8855_RG_DA_QP_PLL_BPD_INTF	GENMASK(7, 6)
+#define   AN8855_RG_DA_QP_PLL_BPA_INTF	GENMASK(4, 2)
+#define   AN8855_RG_DA_QP_PLL_BC_INTF	GENMASK(1, 0)
+#define AN8855_PLL_CTRL_3		0x1022e40c
+#define   AN8855_RG_DA_QP_PLL_SSC_PERIOD_INTF GENMASK(31, 16)
+#define   AN8855_RG_DA_QP_PLL_SSC_DELTA_INTF GENMASK(15, 0)
+#define AN8855_PLL_CTRL_4		0x1022e410
+#define   AN8855_RG_DA_QP_PLL_SDM_HREN_INTF GENMASK(4, 3)
+#define   AN8855_RG_DA_QP_PLL_ICOLP_EN_INTF BIT(2)
+#define   AN8855_RG_DA_QP_PLL_SSC_DIR_DLY_INTF GENMASK(1, 0)
+#define AN8855_PLL_CK_CTRL_0		0x1022e414
+#define   AN8855_RG_DA_QP_PLL_TDC_TXCK_SEL_INTF BIT(9)
+#define   AN8855_RG_DA_QP_PLL_SDM_DI_EN_INTF BIT(8)
+#define AN8855_RX_DLY_0			0x1022e614
+#define   AN8855_RG_QP_RX_SAOSC_EN_H_DLY GENMASK(13, 8)
+#define   AN8855_RG_QP_RX_PI_CAL_EN_H_DLY GENMASK(7, 0)
+#define AN8855_RX_CTRL_2		0x1022e630
+#define   AN8855_RG_QP_RX_EQ_EN_H_DLY	GENMASK(28, 16)
+#define AN8855_RX_CTRL_5		0x1022e63c
+#define   AN8855_RG_FREDET_CHK_CYCLE	GENMASK(29, 10)
+#define AN8855_RX_CTRL_6		0x1022e640
+#define   AN8855_RG_FREDET_GOLDEN_CYCLE	GENMASK(19, 0)
+#define AN8855_RX_CTRL_7		0x1022e644
+#define   AN8855_RG_FREDET_TOLERATE_CYCLE GENMASK(19, 0)
+#define AN8855_RX_CTRL_8		0x1022e648
+#define   AN8855_RG_DA_QP_SAOSC_DONE_TIME GENMASK(27, 16)
+#define   AN8855_RG_DA_QP_LEQOS_EN_TIME	GENMASK(14, 0)
+#define AN8855_RX_CTRL_26		0x1022e690
+#define   AN8855_RG_QP_EQ_RETRAIN_ONLY_EN BIT(26)
+#define   AN8855_RG_LINK_NE_EN		BIT(24)
+#define   AN8855_RG_LINK_ERRO_EN	BIT(23)
+#define AN8855_RX_CTRL_42		0x1022e6d0
+#define   AN8855_RG_QP_EQ_EN_DLY	GENMASK(12, 0)
+
+/*	AN8855_QP_ANA_CSR_BASE		0x1022f000 */
+#define AN8855_RG_QP_RX_DAC_EN		0x1022f000
+#define   AN8855_RG_QP_SIGDET_HF	GENMASK(17, 16)
+#define AN8855_RG_QP_RXAFE_RESERVE	0x1022f004
+#define   AN8855_RG_QP_CDR_PD_10B_EN	BIT(11)
+#define AN8855_RG_QP_CDR_LPF_BOT_LIM	0x1022f008
+#define   AN8855_RG_QP_CDR_LPF_KP_GAIN	GENMASK(26, 24)
+#define   AN8855_RG_QP_CDR_LPF_KI_GAIN	GENMASK(22, 20)
+#define AN8855_RG_QP_CDR_LPF_MJV_LIM	0x1022f00c
+#define   AN8855_RG_QP_CDR_LPF_RATIO	GENMASK(5, 4)
+#define AN8855_RG_QP_CDR_LPF_SETVALUE	0x1022f014
+#define   AN8855_RG_QP_CDR_PR_BUF_IN_SR	GENMASK(31, 29)
+#define   AN8855_RG_QP_CDR_PR_BETA_SEL	GENMASK(28, 25)
+#define AN8855_RG_QP_CDR_PR_CKREF_DIV1	0x1022f018
+#define   AN8855_RG_QP_CDR_PR_KBAND_DIV	GENMASK(26, 24)
+#define   AN8855_RG_QP_CDR_PR_DAC_BAND	GENMASK(12, 8)
+#define AN8855_RG_QP_CDR_PR_KBAND_DIV_PCIE 0x1022f01c
+#define   AN8855_RG_QP_CDR_PR_XFICK_EN	BIT(30)
+#define   AN8855_RG_QP_CDR_PR_KBAND_PCIE_MODE BIT(6)
+#define   AN8855_RG_QP_CDR_PR_KBAND_DIV_PCIE_MASK GENMASK(5, 0)
+#define AN8855_RG_QP_CDR_FORCE_IBANDLPF_R_OFF 0x1022f020
+#define   AN8855_RG_QP_CDR_PHYCK_SEL	GENMASK(17, 16)
+#define   AN8855_RG_QP_CDR_PHYCK_RSTB	BIT(13)
+#define   AN8855_RG_QP_CDR_PHYCK_DIV	GENMASK(12, 6)
+#define AN8855_RG_QP_TX_MODE		0x1022f028
+#define   AN8855_RG_QP_TX_RESERVE	GENMASK(31, 16)
+#define   AN8855_RG_QP_TX_MODE_16B_EN	BIT(0)
+#define AN8855_RG_QP_PLL_IPLL_DIG_PWR_SEL 0x1022f03c
+#define AN8855_RG_QP_PLL_SDM_ORD	0x1022f040
+#define   AN8855_RG_QP_PLL_SSC_PHASE_INI BIT(4)
+#define   AN8855_RG_QP_PLL_SSC_TRI_EN	BIT(3)
+
+/*	AN8855_ETHER_SYS_BASE		0x1028c800 */
+#define AN8855_RG_GPHY_AFE_PWD		0x1028c840
+#define AN8855_RG_GPHY_SMI_ADDR		0x1028c848
+
+#define MIB_DESC(_s, _o, _n)	\
+	{			\
+		.size = (_s),	\
+		.offset = (_o),	\
+		.name = (_n),	\
+	}
+
+struct an8855_mib_desc {
+	unsigned int size;
+	unsigned int offset;
+	const char *name;
+};
+
+struct an8855_fdb {
+	u16 vid;
+	u8 port_mask;
+	u16 aging;
+	u8 mac[6];
+	bool noarp;
+	u8 live;
+	u8 type;
+	u8 fid;
+	u8 ivl;
+};
+
+struct an8855_priv {
+	struct device *dev;
+	struct dsa_switch *ds;
+	struct regmap *regmap;
+	struct gpio_desc *reset_gpio;
+	/* Protect ATU or VLAN table access */
+	struct mutex reg_mutex;
+
+	struct phylink_pcs pcs;
+
+	u8 mirror_rx;
+	u8 mirror_tx;
+	u8 port_isolated_map;
+
+	bool phy_require_calib;
+};
+
+#endif /* __AN8855_H */
diff --git a/target/linux/mediatek/files-6.6/drivers/net/mdio/mdio-an8855.c b/target/linux/mediatek/files-6.6/drivers/net/mdio/mdio-an8855.c
new file mode 100644
index 00000000000000..5feba72c021b49
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/mdio/mdio-an8855.c
@@ -0,0 +1,113 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * MDIO passthrough driver for Airoha AN8855 Switch
+ */
+
+#include <linux/mfd/airoha-an8855-mfd.h>
+#include <linux/module.h>
+#include <linux/of_mdio.h>
+#include <linux/platform_device.h>
+
+static int an855_phy_restore_page(struct an8855_mfd_priv *priv,
+				  int phy) __must_hold(&priv->bus->mdio_lock)
+{
+	/* Check PHY page only for addr shared with switch */
+	if (phy != priv->switch_addr)
+		return 0;
+
+	/* Don't restore page if it's not set to switch page */
+	if (priv->current_page != FIELD_GET(AN8855_PHY_PAGE,
+					    AN8855_PHY_PAGE_EXTENDED_4))
+		return 0;
+
+	/* Restore page to 0, PHY might change page right after but that
+	 * will be ignored as it won't be a switch page.
+	 */
+	return an8855_mii_set_page(priv, phy, AN8855_PHY_PAGE_STANDARD);
+}
+
+static int an8855_phy_read(struct mii_bus *bus, int phy, int regnum)
+{
+	struct an8855_mfd_priv *priv = bus->priv;
+	struct mii_bus *real_bus = priv->bus;
+	int ret;
+
+	mutex_lock_nested(&real_bus->mdio_lock, MDIO_MUTEX_NESTED);
+
+	ret = an855_phy_restore_page(priv, phy);
+	if (ret)
+		goto exit;
+
+	ret = __mdiobus_read(real_bus, phy, regnum);
+exit:
+	mutex_unlock(&real_bus->mdio_lock);
+
+	return ret;
+}
+
+static int an8855_phy_write(struct mii_bus *bus, int phy, int regnum, u16 val)
+{
+	struct an8855_mfd_priv *priv = bus->priv;
+	struct mii_bus *real_bus = priv->bus;
+	int ret;
+
+	mutex_lock_nested(&real_bus->mdio_lock, MDIO_MUTEX_NESTED);
+
+	ret = an855_phy_restore_page(priv, phy);
+	if (ret)
+		goto exit;
+
+	ret = __mdiobus_write(real_bus, phy, regnum, val);
+exit:
+	mutex_unlock(&real_bus->mdio_lock);
+
+	return ret;
+}
+
+static int an8855_mdio_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	struct an8855_mfd_priv *priv;
+	struct mii_bus *bus;
+	int ret;
+
+	/* Get priv of MFD */
+	priv = dev_get_drvdata(dev->parent);
+
+	bus = devm_mdiobus_alloc(dev);
+	if (!bus)
+		return -ENOMEM;
+
+	bus->priv = priv;
+	bus->name = KBUILD_MODNAME "-mii";
+	snprintf(bus->id, MII_BUS_ID_SIZE, KBUILD_MODNAME "-%d",
+		 priv->switch_addr);
+	bus->parent = dev;
+	bus->read = an8855_phy_read;
+	bus->write = an8855_phy_write;
+
+	ret = devm_of_mdiobus_register(dev, bus, dev->of_node);
+	if (ret)
+		return dev_err_probe(dev, ret, "failed to register MDIO bus\n");
+
+	return ret;
+}
+
+static const struct of_device_id an8855_mdio_of_match[] = {
+	{ .compatible = "airoha,an8855-mdio", },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, an8855_mdio_of_match);
+
+static struct platform_driver an8855_mdio_driver = {
+	.probe	= an8855_mdio_probe,
+	.driver = {
+		.name = "an8855-mdio",
+		.of_match_table = an8855_mdio_of_match,
+	},
+};
+module_platform_driver(an8855_mdio_driver);
+
+MODULE_AUTHOR("Christian Marangi <ansuelsmth@gmail.com>");
+MODULE_DESCRIPTION("Driver for AN8855 MDIO passthrough");
+MODULE_LICENSE("GPL");
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/air_an8855.c b/target/linux/mediatek/files-6.6/drivers/net/phy/air_an8855.c
new file mode 100644
index 00000000000000..7fab0854ef7838
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/air_an8855.c
@@ -0,0 +1,267 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Copyright (C) 2024 Christian Marangi <ansuelsmth@gmail.com>
+ */
+
+#include <linux/bitfield.h>
+#include <linux/module.h>
+#include <linux/nvmem-consumer.h>
+#include <linux/phy.h>
+
+#define AN8855_PHY_SELECT_PAGE			0x1f
+#define   AN8855_PHY_PAGE			GENMASK(2, 0)
+#define   AN8855_PHY_PAGE_STANDARD		FIELD_PREP_CONST(AN8855_PHY_PAGE, 0x0)
+#define   AN8855_PHY_PAGE_EXTENDED_1		FIELD_PREP_CONST(AN8855_PHY_PAGE, 0x1)
+
+/* MII Registers Page 1 */
+#define AN8855_PHY_EXT_REG_14			0x14
+#define   AN8855_PHY_EN_DOWN_SHIFT		BIT(4)
+
+/* R50 Calibration regs in MDIO_MMD_VEND1 */
+#define AN8855_PHY_R500HM_RSEL_TX_AB		0x174
+#define AN8855_PHY_R50OHM_RSEL_TX_A_EN		BIT(15)
+#define AN8855_PHY_R50OHM_RSEL_TX_A		GENMASK(14, 8)
+#define AN8855_PHY_R50OHM_RSEL_TX_B_EN		BIT(7)
+#define AN8855_PHY_R50OHM_RSEL_TX_B		GENMASK(6, 0)
+#define AN8855_PHY_R500HM_RSEL_TX_CD		0x175
+#define AN8855_PHY_R50OHM_RSEL_TX_C_EN		BIT(15)
+#define AN8855_PHY_R50OHM_RSEL_TX_C		GENMASK(14, 8)
+#define AN8855_PHY_R50OHM_RSEL_TX_D_EN		BIT(7)
+#define AN8855_PHY_R50OHM_RSEL_TX_D		GENMASK(6, 0)
+
+#define AN8855_SWITCH_EFUSE_R50O		GENMASK(30, 24)
+
+/* PHY TX PAIR DELAY SELECT Register */
+#define AN8855_PHY_TX_PAIR_DLY_SEL_GBE		0x013
+#define   AN8855_PHY_CR_DA_TX_PAIR_DELKAY_SEL_A_GBE GENMASK(14, 12)
+#define   AN8855_PHY_CR_DA_TX_PAIR_DELKAY_SEL_B_GBE GENMASK(10, 8)
+#define   AN8855_PHY_CR_DA_TX_PAIR_DELKAY_SEL_C_GBE GENMASK(6, 4)
+#define   AN8855_PHY_CR_DA_TX_PAIR_DELKAY_SEL_D_GBE GENMASK(2, 0)
+/* PHY ADC Register */
+#define AN8855_PHY_RXADC_CTRL			0x0d8
+#define   AN8855_PHY_RG_AD_SAMNPLE_PHSEL_A	BIT(12)
+#define   AN8855_PHY_RG_AD_SAMNPLE_PHSEL_B	BIT(8)
+#define   AN8855_PHY_RG_AD_SAMNPLE_PHSEL_C	BIT(4)
+#define   AN8855_PHY_RG_AD_SAMNPLE_PHSEL_D	BIT(0)
+#define AN8855_PHY_RXADC_REV_0			0x0d9
+#define   AN8855_PHY_RG_AD_RESERVE0_A		GENMASK(15, 8)
+#define   AN8855_PHY_RG_AD_RESERVE0_B		GENMASK(7, 0)
+#define AN8855_PHY_RXADC_REV_1			0x0da
+#define   AN8855_PHY_RG_AD_RESERVE0_C		GENMASK(15, 8)
+#define   AN8855_PHY_RG_AD_RESERVE0_D		GENMASK(7, 0)
+
+#define AN8855_PHY_ID				0xc0ff0410
+
+#define AN8855_PHY_FLAGS_EN_CALIBRATION		BIT(0)
+
+struct air_an8855_priv {
+	u8 calibration_data[4];
+};
+
+static const u8 dsa_r50ohm_table[] = {
+	127, 127, 127, 127, 127, 127, 127, 127, 127, 127,
+	127, 127, 127, 127, 127, 127, 127, 126, 122, 117,
+	112, 109, 104, 101,  97,  94,  90,  88,  84,  80,
+	78,  74,  72,  68,  66,  64,  61,  58,  56,  53,
+	51,  48,  47,  44,  42,  40,  38,  36,  34,  32,
+	31,  28,  27,  24,  24,  22,  20,  18,  16,  16,
+	14,  12,  11,   9
+};
+
+static int en8855_get_r50ohm_val(struct device *dev, const char *calib_name,
+				 u8 *dest)
+{
+	u32 shift_sel, val;
+	int ret;
+	int i;
+
+	ret = nvmem_cell_read_u32(dev, calib_name, &val);
+	if (ret)
+		return ret;
+
+	shift_sel = FIELD_GET(AN8855_SWITCH_EFUSE_R50O, val);
+	for (i = 0; i < ARRAY_SIZE(dsa_r50ohm_table); i++)
+		if (dsa_r50ohm_table[i] == shift_sel)
+			break;
+
+	if (i < 8 || i >= ARRAY_SIZE(dsa_r50ohm_table))
+		*dest = dsa_r50ohm_table[25];
+	else
+		*dest = dsa_r50ohm_table[i - 8];
+
+	return 0;
+}
+
+static int an8855_probe(struct phy_device *phydev)
+{
+	struct device *dev = &phydev->mdio.dev;
+	struct device_node *node = dev->of_node;
+	struct air_an8855_priv *priv;
+
+	/* If we don't have a node, skip calib */
+	if (!node)
+		return 0;
+
+	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return -ENOMEM;
+
+	phydev->priv = priv;
+
+	return 0;
+}
+
+static int an8855_get_downshift(struct phy_device *phydev, u8 *data)
+{
+	int val;
+
+	val = phy_read_paged(phydev, AN8855_PHY_PAGE_EXTENDED_1, AN8855_PHY_EXT_REG_14);
+	if (val < 0)
+		return val;
+
+	*data = val & AN8855_PHY_EN_DOWN_SHIFT ? DOWNSHIFT_DEV_DEFAULT_COUNT :
+						 DOWNSHIFT_DEV_DISABLE;
+
+	return 0;
+}
+
+static int an8855_set_downshift(struct phy_device *phydev, u8 cnt)
+{
+	u16 ds = cnt != DOWNSHIFT_DEV_DISABLE ? AN8855_PHY_EN_DOWN_SHIFT : 0;
+
+	return phy_modify_paged(phydev, AN8855_PHY_PAGE_EXTENDED_1,
+				AN8855_PHY_EXT_REG_14, AN8855_PHY_EN_DOWN_SHIFT,
+				ds);
+}
+
+static int an8855_config_init(struct phy_device *phydev)
+{
+	struct air_an8855_priv *priv = phydev->priv;
+	struct device *dev = &phydev->mdio.dev;
+	int ret;
+
+	/* Enable HW auto downshift */
+	ret = an8855_set_downshift(phydev, DOWNSHIFT_DEV_DEFAULT_COUNT);
+	if (ret)
+		return ret;
+
+	/* Apply calibration values, if needed.
+	 * AN8855_PHY_FLAGS_EN_CALIBRATION signal this.
+	 */
+	if (priv && phydev->dev_flags & AN8855_PHY_FLAGS_EN_CALIBRATION) {
+		u8 *calibration_data = priv->calibration_data;
+
+		ret = en8855_get_r50ohm_val(dev, "tx_a", &calibration_data[0]);
+		if (ret)
+			return ret;
+
+		ret = en8855_get_r50ohm_val(dev, "tx_b", &calibration_data[1]);
+		if (ret)
+			return ret;
+
+		ret = en8855_get_r50ohm_val(dev, "tx_c", &calibration_data[2]);
+		if (ret)
+			return ret;
+
+		ret = en8855_get_r50ohm_val(dev, "tx_d", &calibration_data[3]);
+		if (ret)
+			return ret;
+
+		ret = phy_modify_mmd(phydev, MDIO_MMD_VEND1, AN8855_PHY_R500HM_RSEL_TX_AB,
+				     AN8855_PHY_R50OHM_RSEL_TX_A | AN8855_PHY_R50OHM_RSEL_TX_B,
+				     FIELD_PREP(AN8855_PHY_R50OHM_RSEL_TX_A, calibration_data[0]) |
+				     FIELD_PREP(AN8855_PHY_R50OHM_RSEL_TX_B, calibration_data[1]));
+		if (ret)
+			return ret;
+		ret = phy_modify_mmd(phydev, MDIO_MMD_VEND1, AN8855_PHY_R500HM_RSEL_TX_CD,
+				     AN8855_PHY_R50OHM_RSEL_TX_C | AN8855_PHY_R50OHM_RSEL_TX_D,
+				     FIELD_PREP(AN8855_PHY_R50OHM_RSEL_TX_C, calibration_data[2]) |
+				     FIELD_PREP(AN8855_PHY_R50OHM_RSEL_TX_D, calibration_data[3]));
+		if (ret)
+			return ret;
+	}
+
+	/* Apply values to reduce signal noise */
+	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, AN8855_PHY_TX_PAIR_DLY_SEL_GBE,
+			    FIELD_PREP(AN8855_PHY_CR_DA_TX_PAIR_DELKAY_SEL_A_GBE, 0x4) |
+			    FIELD_PREP(AN8855_PHY_CR_DA_TX_PAIR_DELKAY_SEL_C_GBE, 0x4));
+	if (ret)
+		return ret;
+	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, AN8855_PHY_RXADC_CTRL,
+			    AN8855_PHY_RG_AD_SAMNPLE_PHSEL_A |
+			    AN8855_PHY_RG_AD_SAMNPLE_PHSEL_C);
+	if (ret)
+		return ret;
+	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, AN8855_PHY_RXADC_REV_0,
+			    FIELD_PREP(AN8855_PHY_RG_AD_RESERVE0_A, 0x1));
+	if (ret)
+		return ret;
+	ret = phy_write_mmd(phydev, MDIO_MMD_VEND1, AN8855_PHY_RXADC_REV_1,
+			    FIELD_PREP(AN8855_PHY_RG_AD_RESERVE0_C, 0x1));
+	if (ret)
+		return ret;
+
+	return 0;
+}
+
+static int an8855_get_tunable(struct phy_device *phydev,
+			      struct ethtool_tunable *tuna, void *data)
+{
+	switch (tuna->id) {
+	case ETHTOOL_PHY_DOWNSHIFT:
+		return an8855_get_downshift(phydev, data);
+	default:
+		return -EOPNOTSUPP;
+	}
+}
+
+static int an8855_set_tunable(struct phy_device *phydev,
+			      struct ethtool_tunable *tuna, const void *data)
+{
+	switch (tuna->id) {
+	case ETHTOOL_PHY_DOWNSHIFT:
+		return an8855_set_downshift(phydev, *(const u8 *)data);
+	default:
+		return -EOPNOTSUPP;
+	}
+}
+
+static int an8855_read_page(struct phy_device *phydev)
+{
+	return __phy_read(phydev, AN8855_PHY_SELECT_PAGE);
+}
+
+static int an8855_write_page(struct phy_device *phydev, int page)
+{
+	return __phy_write(phydev, AN8855_PHY_SELECT_PAGE, page);
+}
+
+static struct phy_driver an8855_driver[] = {
+{
+	PHY_ID_MATCH_EXACT(AN8855_PHY_ID),
+	.name			= "Airoha AN8855 internal PHY",
+	/* PHY_GBIT_FEATURES */
+	.flags			= PHY_IS_INTERNAL,
+	.probe			= an8855_probe,
+	.config_init		= an8855_config_init,
+	.soft_reset		= genphy_soft_reset,
+	.get_tunable		= an8855_get_tunable,
+	.set_tunable		= an8855_set_tunable,
+	.suspend		= genphy_suspend,
+	.resume			= genphy_resume,
+	.read_page		= an8855_read_page,
+	.write_page		= an8855_write_page,
+}, };
+
+module_phy_driver(an8855_driver);
+
+static struct mdio_device_id __maybe_unused an8855_tbl[] = {
+	{ PHY_ID_MATCH_EXACT(AN8855_PHY_ID) },
+	{ }
+};
+
+MODULE_DEVICE_TABLE(mdio, an8855_tbl);
+
+MODULE_DESCRIPTION("Airoha AN8855 PHY driver");
+MODULE_AUTHOR("Christian Marangi <ansuelsmth@gmail.com>");
+MODULE_LICENSE("GPL");
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/Kconfig b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/Kconfig
new file mode 100644
index 00000000000000..cdb5cb74882a91
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/Kconfig
@@ -0,0 +1,5 @@
+
+config RTL8261N_PHY
+	tristate "Driver for Realtek RTL8261N PHYs"
+	help
+	  Currently supports the RTL8261N,RTL8264B PHYs.
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/Makefile b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/Makefile
new file mode 100644
index 00000000000000..a661d6ce85e8c9
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/Makefile
@@ -0,0 +1,11 @@
+
+obj-$(CONFIG_RTL8261N_PHY) += rtl8621n.o
+
+rtl8621n-objs += phy_patch.o
+rtl8621n-objs += phy_rtl826xb_patch.o
+rtl8621n-objs += rtk_osal.o
+rtl8621n-objs += rtk_phy.o
+rtl8621n-objs += rtk_phylib.o
+rtl8621n-objs += rtk_phylib_rtl826xb.o
+
+ccflags-y += -Werror -DRTK_PHYDRV_IN_LINUX
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/construct/conf_rtl8261n_c.c b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/construct/conf_rtl8261n_c.c
new file mode 100644
index 00000000000000..8e7c714fc40191
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/construct/conf_rtl8261n_c.c
@@ -0,0 +1,1465 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2023 Realtek Semiconductor Corp. All rights reserved.
+ */
+
+//Date: Tue Nov 15 19:53:03 2022
+
+rtk_hwpatch_t rtl8261n_c_top_conf[] = {
+    {RTK_PATCH_OP_TOP     , 0xf  , 2     , 20    , 15, 0 , 0x5   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 2     , 21    , 15, 0 , 0x0   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 2     , 22    , 15, 0 , 0x280 , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 2     , 23    , 15, 0 , 0x0014, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 3     , 16    , 15, 0 , 0x0300, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 3     , 17    , 15, 0 , 0x01ff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 3     , 18    , 15, 0 , 0x000c, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 3     , 19    , 15, 0 , 0x01ff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 3     , 20    , 15, 0 , 0x0200, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 3     , 21    , 15, 0 , 0x0015, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 3     , 22    , 15, 0 , 0x0200, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 3     , 23    , 15, 0 , 0x0   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 4     , 16    , 15, 0 , 0x0   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 13    , 23    , 8 , 5 , 0x6   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 90    , 18    , 15, 0 , 0x5   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 90    , 19    , 15, 0 , 0x5   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 90    , 20    , 15, 8 , 0x01  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8261n_c_sds_conf[] = {
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 18    , 15, 0 , 0x881F, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 19    , 15, 0 , 0x003F, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 20    , 15, 0 , 0x003F, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 21    , 15, 0 , 0x003F, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 22    , 15, 0 , 0x001F, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x06  , 0x0D  , 15, 0 , 0x0F00, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x06  , 0x0E  , 15, 0 , 0x3F5A, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x07  , 0x10  , 15, 12, 0x8   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x07  , 0x10  , 7 , 0 , 0x3   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x06  , 0x1D  , 15, 0 , 0x0600, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x21  , 0x00  , 15, 0 , 0x4902, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x21  , 0x08  , 15, 0 , 0x0FC0, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x21  , 0x09  , 15, 0 , 0x33F0, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x21  , 0x0C  , 15, 0 , 0x08BF, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x21  , 0x12  , 15, 0 , 0x8000, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x36  , 0x07  , 15, 0 , 0x04C0, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x36  , 0x08  , 15, 0 , 0x2000, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2E  , 0x0B  , 15, 0 , 0x2390, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2E  , 0x0C  , 15, 0 , 0xAA17, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2E  , 0x0D  , 15, 0 , 0xFE40, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2E  , 0x0E  , 15, 0 , 0x12F4, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2E  , 0x11  , 15, 0 , 0xF2AD, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2E  , 0x15  , 15, 0 , 0x7A41, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2E  , 0x16  , 15, 0 , 0x0041, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2F  , 0x00  , 15, 0 , 0x1F00, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2F  , 0x01  , 15, 0 , 0x2800, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2F  , 0x02  , 15, 0 , 0x0FC8, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2F  , 0x11  , 15, 0 , 0x3000, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2F  , 0x13  , 15, 0 , 0xF400, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2F  , 0x1E  , 15, 0 , 0x0500, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x34  , 0x0B  , 15, 0 , 0x2390, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x34  , 0x0C  , 15, 0 , 0xA517, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x34  , 0x0D  , 15, 0 , 0xFE41, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x34  , 0x0E  , 15, 0 , 0x12F4, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x34  , 0x11  , 15, 0 , 0xF2AD, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x34  , 0x15  , 15, 0 , 0x7A41, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x34  , 0x16  , 15, 0 , 0x0041, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x35  , 0x00  , 15, 0 , 0x1F80, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x35  , 0x01  , 15, 0 , 0x0800, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x35  , 0x02  , 15, 0 , 0x0FC8, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x35  , 0x11  , 15, 0 , 0x3001, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x35  , 0x13  , 15, 0 , 0xF400, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x35  , 0x1E  , 15, 0 , 0x0100, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2C  , 0x0B  , 15, 0 , 0x2390, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2C  , 0x0C  , 15, 0 , 0xA517, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2C  , 0x0D  , 15, 0 , 0xFE41, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2C  , 0x0E  , 15, 0 , 0x12F4, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2C  , 0x11  , 15, 0 , 0xF2AD, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2C  , 0x15  , 15, 0 , 0x7A61, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2C  , 0x16  , 15, 0 , 0x0041, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2D  , 0x00  , 15, 0 , 0x1F80, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2D  , 0x01  , 15, 0 , 0x0800, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2D  , 0x02  , 15, 0 , 0x0FC8, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2D  , 0x11  , 15, 0 , 0x3001, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2D  , 0x13  , 15, 0 , 0xF400, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2D  , 0x1E  , 15, 0 , 0x0100, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x28  , 0x0B  , 15, 0 , 0x2390, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x28  , 0x0C  , 15, 0 , 0xA514, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x28  , 0x0D  , 15, 0 , 0xFE43, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x28  , 0x0E  , 15, 0 , 0x12F4, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x28  , 0x11  , 15, 0 , 0xF2AD, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x28  , 0x15  , 15, 0 , 0x7A61, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x28  , 0x16  , 15, 0 , 0x0041, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x29  , 0x00  , 15, 0 , 0x1F80, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x29  , 0x01  , 15, 0 , 0x0800, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x29  , 0x02  , 15, 0 , 0x0FC8, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x29  , 0x11  , 15, 0 , 0x3001, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x29  , 0x13  , 15, 0 , 0xF400, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x29  , 0x1E  , 15, 0 , 0x0100, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x26  , 0x0B  , 15, 0 , 0x2390, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x26  , 0x0C  , 15, 0 , 0xA514, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x26  , 0x0D  , 15, 0 , 0xFE43, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x26  , 0x0E  , 15, 0 , 0x12F4, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x26  , 0x11  , 15, 0 , 0xF2AD, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x26  , 0x15  , 15, 0 , 0x7A41, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x26  , 0x16  , 15, 0 , 0x0041, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x27  , 0x00  , 15, 0 , 0x1F80, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x27  , 0x01  , 15, 0 , 0x0800, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x27  , 0x02  , 15, 0 , 0x0FC8, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x27  , 0x11  , 15, 0 , 0x3001, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x27  , 0x13  , 15, 0 , 0xF400, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x27  , 0x1E  , 15, 0 , 0x0100, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x24  , 0x0B  , 15, 0 , 0x2390, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x24  , 0x0C  , 15, 0 , 0xA514, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x24  , 0x0D  , 15, 0 , 0xFE43, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x24  , 0x0E  , 15, 0 , 0x12F4, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x24  , 0x11  , 15, 0 , 0xF2AD, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x24  , 0x15  , 15, 0 , 0x7A41, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x24  , 0x16  , 15, 0 , 0x0041, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x25  , 0x00  , 15, 0 , 0x1F80, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x25  , 0x01  , 15, 0 , 0x0800, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x25  , 0x02  , 15, 0 , 0x0FC8, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x25  , 0x11  , 15, 0 , 0x3001, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x25  , 0x13  , 15, 0 , 0xF400, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x25  , 0x1E  , 15, 0 , 0x0100, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 18    , 15, 0 , 0x880D, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 19    , 15, 0 , 0x0024, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 20    , 15, 0 , 0x0036, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 21    , 15, 0 , 0x0035, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 22    , 15, 0 , 0x001A, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x1F  , 0x00  , 15, 0 , 0x001B, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x1F  , 0x00  , 15, 0 , 0x0000, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 90    , 20    , 7 , 0 , 0x01  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8261n_c_afe_conf[] = {
+};
+
+rtk_hwpatch_t rtl8261n_c_uc_conf[] = {
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb820, 7 , 7 , 0x0   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbd8a, 5 , 3 , 0x3   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbd8c, 6 , 4 , 0x5   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x8060, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 12, 10, 0x3   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x8061, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 13, 0x5   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa466, 1 , 1 , 0x1   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x8491, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x3D  , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8261n_c_uc2_conf[] = {
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb820, 7 , 7 , 0x1   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb87c, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8af6, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb87e, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf8b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8af6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0eaf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8af8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8b41, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8afa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf8b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8afc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4faf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8afe},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8b5b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b00},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf8b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b02},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xb4af, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b04},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8bc0, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b06},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf8b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b08},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xdaaf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b0a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8bda, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b0c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf8ef, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b0e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x49f8, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b10},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf70, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b12},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3f02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b14},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6772, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b16},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xad28, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b18},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13e1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b1a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8a55, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b1c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xad28, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b1e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0502, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b20},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5ee2, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b22},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xae0e, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b24},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x025d, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b26},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8f02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b28},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8bda, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b2a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xae06, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b2c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x025d, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b2e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7002, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b30},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8c22, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b32},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe087, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b34},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1ef6, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b36},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x27e4, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b38},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x871e, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b3a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfcef, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b3c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x94fc, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b3e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x04a1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b40},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0103, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b42},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x028b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b44},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfee0, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b46},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8a09, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b48},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xef23, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b4a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf5e, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b4c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5bac, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b4e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5003, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b50},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf62, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b52},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8a02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b54},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8c22, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b56},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf62, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b58},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xb0bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b5a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x68e0, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b5c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0267, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b5e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x72ef, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b60},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x31bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b62},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x68dd, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b64},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0267, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b66},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x721e, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b68},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x31ac, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b6a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3819, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b6c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf68, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b6e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe902, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b70},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6772, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b72},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xef31, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b74},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf68, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b76},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe602, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b78},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6772, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b7a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1e31, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b7c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xac38, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b7e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cee, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b80},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8933, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b82},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x02ae, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b84},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0aee, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b86},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8933, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b88},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x00ae, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b8a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x04ee, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b8c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8933, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b8e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x01bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b90},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8ff9, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b92},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe189, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b94},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x331a, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b96},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x91db, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b98},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf69, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b9a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4c02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b9c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6772, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b9e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1f00, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ba0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1f22, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ba2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1b45, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ba4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xad27, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ba6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x05e1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ba8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x870d, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8baa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xae03, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bac},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe187, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bae},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0eaf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bb0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2d1a, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bb2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0248, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bb4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf702, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bb6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8c46, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bb8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0222, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bba},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4faf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bbc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4176, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bbe},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf8c, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bc0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9002, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bc2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70eb, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bc4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf8c, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bc6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9f02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bc8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70eb, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bca},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf8c, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bcc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa502, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bce},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70eb, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bd0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd300, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bd2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0241, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bd4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7caf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bd6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x46b2, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bd8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf8ef, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bda},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x49f8, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bdc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bde},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3a02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8be0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6772, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8be2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xac28, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8be4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x12bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8be6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6d63, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8be8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0267, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bea},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x72e5, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bec},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8ffc, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bee},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6d, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bf0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6f02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bf2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6772, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bf4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe58f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bf6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfdfc, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bf8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xef94, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bfa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfc04, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bfc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf8ef, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bfe},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x49f8, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c00},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c02},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3a02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c04},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6772, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c06},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xac28, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c08},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x12e1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c0a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8ffe, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c0c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6d, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c0e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6302, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c10},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6753, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c12},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe18f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c14},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffbf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c16},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6d6f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c18},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0267, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c1a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x53fc, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c1c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xef94, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c1e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfc04, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c20},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf8ef, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c22},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x49f8, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c24},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c26},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3a02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c28},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6772, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c2a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xac28, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c2c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x12e1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c2e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8ffc, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c30},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6d, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c32},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6302, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c34},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6753, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c36},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe18f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c38},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfdbf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c3a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6d6f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c3c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0267, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c3e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x53fc, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c40},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xef94, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c42},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfc04, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c44},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf8fa, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c46},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xef69, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c48},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c4a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3a02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c4c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6772, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c4e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xad28, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c50},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0ebf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c52},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8c93, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c54},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c56},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf4bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c58},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8c90, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c5a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c5c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf4ae, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c5e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2ad1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c60},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0fbf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c62},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8c96, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c64},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0267, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c66},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x53bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c68},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8c99, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c6a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c6c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xebd1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c6e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x00bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c70},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8c9c, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c72},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0267, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c74},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x53bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c76},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8c9f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c78},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c7a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf4d1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c7c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x00bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c7e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8ca2, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c80},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0267, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c82},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x53bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c84},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8ca5, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c86},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c88},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf4ef, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c8a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x96fe, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c8c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfc04, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c8e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x77bd, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c90},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6c66, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c92},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbd6c, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c94},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x30bd, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c96},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5444, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c98},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbd54, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c9a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x85bd, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c9c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5e55, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c9e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbd54, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ca0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa7bd, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ca2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5cbb, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ca4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbd5c, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ca6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb85e, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x62ba, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb860, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5e56, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb862, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6287, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb864, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2d07, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb886, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4170, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb888, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x46ad, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb88a, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb88c, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb838, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x003f, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb820, 7 , 7 , 0x0   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8261n_c_nctl0_conf[] = {
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb820, 7 , 7 , 0x1   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA016, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA012, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA014, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8010, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x801a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x801a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x801a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x801a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x801a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x801a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x801a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd719, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x10},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3bb7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x11},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8014, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x12},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x13},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd704, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x14},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x406e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x15},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x16},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x12db, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x17},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x18},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1301, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x19},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA026, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA024, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA022, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA020, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA006, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA004, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA002, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA000, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x12d7, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA008, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0100, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb820, 7 , 7 , 0x0   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8261n_c_nctl1_conf[] = {
+};
+
+rtk_hwpatch_t rtl8261n_c_nctl2_conf[] = {
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb820, 7 , 7 , 0x1   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA016, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0020, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA012, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA014, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8010, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8029, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8217, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x82d0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x82f9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8322, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8322, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8322, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x10},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x11},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcb0a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x12},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cc7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x13},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x14},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x15},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x16},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4127, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x17},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x18},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x19},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c0f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b05, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c38, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0d28, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf008, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x20},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x21},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c0f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x22},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b0a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x23},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c38, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x24},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0d18, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x25},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x26},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x27},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0f73, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x28},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x29},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8034, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8031, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1bf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd06d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x30},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1dd, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x31},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd06d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x32},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x33},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd199, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x34},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd06e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x35},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x36},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x37},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x38},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5fba, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x39},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd05a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x60cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x60f1, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6113, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6135, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x40},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6157, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x41},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x42},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x43},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x44},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x45},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf008, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x46},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x47},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x48},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x49},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf004, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf002, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x142d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x50},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x51},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0ccf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x52},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b40, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x53},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c3f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x54},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c24, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x55},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x56},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa340, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x57},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x58},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x147c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x59},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa110, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1435, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8110, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1485, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa304, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x60},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa8c0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x61},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8810, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x62},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x63},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa120, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x64},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa310, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x65},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cfc, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x66},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0224, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x67},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0ca0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x68},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0480, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x69},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa340, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd162, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x70},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x71},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x72},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5fba, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x73},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8840, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x74},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1c4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x75},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd045, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x76},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x77},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x78},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x79},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5fba, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x7a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x7b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6127, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x7c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x7d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f3b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x7e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x88c0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x7f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x800a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x80},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8120, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x81},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8350, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x82},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x84a0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x83},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffb6, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x84},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xb920, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x85},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcd33, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x86},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x87},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x88},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x89},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7fb4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x8a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9920, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x8b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x8c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x8d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x8e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6065, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x8f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f94, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x90},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffee, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x91},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xb820, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x92},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x93},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x94},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x95},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7fa5, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x96},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9820, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x97},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x800a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x98},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8120, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x99},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x9a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x147c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x9b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa108, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x9c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x9d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1435, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x9e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8108, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x9f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1485, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa2fc, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa304, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8880, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cc0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0440, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcd34, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cc0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xaa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b80, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xab},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xac3f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xac},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c38, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xad},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0d08, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xae},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xaf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa810, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa120, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa480, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa604, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x80bb, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd049, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xba},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd19f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xbb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd049, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xbc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xbd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xbe},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xbf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x63f4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f7a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4368, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cc0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b40, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8c3f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8d38, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xca},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xcb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xcc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xcd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x80d7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xce},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xcf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x80d4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1f4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1b7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1c6, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xda},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xdb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6074, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xdc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xdd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f7a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xde},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xdf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4056, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf004, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x61fc, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfff9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xea},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4070, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xeb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xec},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x81a4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xed},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xee},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xef},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xae80, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x81a4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd05a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x60cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x60f1, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6113, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6135, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xfa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6157, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xfb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xfc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xfd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xfe},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xff},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf008, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x100},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x101},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x102},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x103},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf004, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x104},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x105},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf002, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x106},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x107},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x108},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x142d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x109},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x10a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x10b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0ccf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x10c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b40, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x10d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c3f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x10e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c24, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x10f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x110},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa340, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x111},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x112},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x147c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x113},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa110, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x114},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x115},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1435, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x116},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8110, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x117},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x118},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1485, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x119},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa304, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x11a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa8c0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x11b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8810, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x11c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x11d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa120, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x11e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa310, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x11f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cfc, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x120},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0224, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x121},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0ca0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x122},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0480, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x123},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8604, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x124},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcd35, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x125},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd162, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x126},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x127},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x128},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x129},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x12a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5fba, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x12b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8840, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x12c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1c4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x12d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd045, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x12e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x12f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x130},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x131},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5fba, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x132},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x133},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6127, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x134},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x135},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f3b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x136},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x88c0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x137},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x800a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x138},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8120, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x139},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8350, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x13a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x84a0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x13b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffb8, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x13c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbb80, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x13d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x13e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x13f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x140},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5fb4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x141},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xb920, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x142},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcd36, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x143},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x144},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x145},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x146},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7fb4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x147},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9920, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x148},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9b80, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x149},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x14a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x14b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x14c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6065, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x14d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f94, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x14e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffe8, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x14f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xb820, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x150},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x151},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x152},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x153},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7fa5, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x154},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9820, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x155},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x800a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x156},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8120, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x157},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x158},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x147c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x159},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa108, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x15a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x15b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1435, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x15c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8108, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x15d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x15e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1485, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x15f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa2fc, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x160},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa304, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x161},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8880, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x162},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cc0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x163},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0440, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x164},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcd37, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x165},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x166},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x167},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cc0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x168},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b80, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x169},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xac3f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x16a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c38, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x16b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0d08, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x16c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x16d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa810, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x16e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x16f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa120, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x170},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa480, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x171},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa604, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x172},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x173},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x174},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x817e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x175},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x176},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x817b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x177},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x178},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x179},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x17a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x17b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x17c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x17d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x17e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x17f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x180},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x181},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x182},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1463, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x183},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x184},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f7a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x185},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x186},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f28, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x187},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x188},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x189},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cc0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x18a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b40, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x18b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8c3f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x18c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8d38, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x18d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x18e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x18f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x190},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x819a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x191},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x192},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8197, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x193},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd199, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x194},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x195},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x196},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x197},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x198},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x199},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd189, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x19a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x19b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x19c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x19d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x19e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1463, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x19f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f7a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f28, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c0f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b05, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x60cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1aa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x60f1, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ab},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6113, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ac},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6135, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ad},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6157, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ae},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1af},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce08, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce08, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf008, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce08, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce08, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf004, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce08, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf002, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce08, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ba},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1bb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x142d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1bc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa180, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1bd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcd38, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1be},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1bf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x81d4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x81cc, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf013, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd100, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd049, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ca},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf010, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1cb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1cc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1cd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1b7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ce},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd049, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1cf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd100, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf008, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd199, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1da},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd13b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1db},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd055, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1dc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1dd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1de},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1df},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1463, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f7b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa302, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1463, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f7a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ea},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f28, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1eb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ec},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ed},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c3f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ee},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c12, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ef},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8206, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x81fe, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd199, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf013, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1fa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd100, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1fb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1fc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf010, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1fd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1fe},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ff},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x200},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x201},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x202},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd100, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x203},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd040, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x204},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf008, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x205},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x206},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x207},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd199, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x208},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x209},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x20a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd16b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x20b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x20c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x20d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x20e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x20f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1463, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x210},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x211},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f7a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x212},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x213},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f2a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x214},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x215},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x087a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x216},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x217},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x646d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x218},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x219},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8231, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x21a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x21b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8227, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x21c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x21d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x40c7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x21e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x21f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x220},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd100, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x221},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd049, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x222},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf01a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x223},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x224},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd049, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x225},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf017, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x226},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x227},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x40c7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x228},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x229},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x22a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd100, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x22b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd049, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x22c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf010, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x22d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x22e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x22f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x230},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x231},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x40c7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x232},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x233},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x234},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x235},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x236},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x237},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x238},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x239},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x23a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x23b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x23c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x23d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x23e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x23f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1463, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x240},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x241},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f7a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x242},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x243},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f29, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x244},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x245},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x60cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x246},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x60f1, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x247},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6113, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x248},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6135, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x249},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6157, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x24a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x24b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x24c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x24d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x24e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf008, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x24f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x250},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x251},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x252},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf004, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x253},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x254},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf002, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x255},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x256},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x257},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x142d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x258},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x259},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x25a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8bc0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x25b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c3f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x25c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c09, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x25d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x25e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa120, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x25f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa310, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x260},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa420, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x261},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcd3b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x262},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x263},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x65ad, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x264},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x43c7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x265},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x266},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x267},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x827b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x268},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x269},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8273, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x26a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x26b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x26c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd199, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x26d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x26e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf024, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x26f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd15d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x270},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x271},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf021, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x272},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x273},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x274},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1c6, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x275},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x276},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf01c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x277},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd15d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x278},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x279},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf019, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x27a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x27b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x27c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd199, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x27d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x27e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf014, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x27f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x280},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x281},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf011, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x282},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x283},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x284},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x828e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x285},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x286},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x828b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x287},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1e5, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x288},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x289},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf009, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x28a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd191, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x28b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x28c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x28d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x28e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x28f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x290},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd16b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x291},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x292},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x293},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1418, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x294},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x295},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1463, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x296},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x297},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f7a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x298},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x299},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f2c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x29a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x29b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x40e7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x29c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x29d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x29e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c0f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x29f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b05, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c0f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b0a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcd3c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x644d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2aa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x43c7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ab},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ac},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ad},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x82c1, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ae},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2af},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x82b9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf019, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf016, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ba},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2bb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2bc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf011, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2bd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd13e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2be},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd049, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2bf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf009, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd049, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ca},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2cb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2cc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2cd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ce},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0956, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2cf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2969, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x82f5, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x82eb, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x82e1, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x40c7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2da},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd15c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2db},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2dc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf01a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2dd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd199, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2de},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2df},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf017, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x40c7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd13e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf010, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd199, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ea},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2eb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x40c7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ec},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ed},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ee},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ef},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd199, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x09a0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2969, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2fa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x831e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2fb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2fc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8314, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2fd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2fe},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x830a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ff},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x300},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x40c7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x301},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x302},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x303},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd15d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x304},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x305},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf01a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x306},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x307},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x308},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf017, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x309},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x30a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x40c7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x30b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x30c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x30d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd16b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x30e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x30f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf010, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x310},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x311},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x312},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x313},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x314},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x40c7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x315},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x316},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x317},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x318},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x319},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x31a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x31b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x31c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x31d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1b7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x31e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x31f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x320},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0a39, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x321},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA10E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA10C, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA10A, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA108, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0a12, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA106, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0979, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA104, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x089f, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA102, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0692, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA100, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0f60, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA110, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x001f, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA016, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0020, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA012, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1ff8, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA014, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b0e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ff8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b0e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ff9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b0e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ffa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ffb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ffc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ffd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ffe},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1fff},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA164, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0baa, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA166, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c19, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA168, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1293, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA16A, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3fff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA16C, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3fff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA16E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3fff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA170, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3fff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA172, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3fff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA162, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0007, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb820, 7 , 7 , 0x0   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8261n_c_algxg_conf[] = {
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8165, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x22  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8167, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x33  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x827E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x68  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8013, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x39  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8ffb, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x14  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8ffa, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x1e  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8ff9, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x1e  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x82D9, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x20  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x82DA, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x00  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x816E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0xab  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8159, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x58  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x815A, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x99  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8139, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x25  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8125, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x67  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8126, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x89  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x827D, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x42  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8261n_c_alg_giga_conf[] = {
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x8367, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x5d  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8261n_c_normal_conf[] = {
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x817d, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x07  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb516, 6 , 0 , 0x0   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8ffe, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x04  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8fff, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x05  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8132, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x77  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8134, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x88  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x80ca, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x77  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x80cc, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x88  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8062, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x77  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8064, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x88  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x801E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0005, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8261n_c_dataram_conf[] = {
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb820, 7 , 7 , 0x0   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb896, 0 , 0 , 0x0   , RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb892, 15, 8 , 0x0   , RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC10B, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xD5  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC10C, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xD5  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC10D, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xD5  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC10E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xD5  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC10F, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xD5  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC110, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xD5  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC149, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x08  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC14A, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x08  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC14B, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x08  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC14C, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x08  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC14D, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x08  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC14E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x08  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC166, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xEE  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC167, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xEE  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC168, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x07  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC169, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x09  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC16A, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x0B  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC16B, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x0D  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC16C, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x13  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC16D, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x0E  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC16E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x11  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC16F, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x14  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC170, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x17  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC171, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x15  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC172, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x10  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC173, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x0B  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC128, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xF7  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC129, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xF7  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC12A, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xF8  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC12B, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xF7  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC12C, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xF6  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC12D, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xF5  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC12E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xF2  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC12F, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xF7  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC130, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xF5  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC131, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xF2  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC132, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xF0  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC133, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xF1  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC134, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xF4  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC135, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xF7  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb896, 0 , 0 , 0x1   , RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8261n_c_rtct_conf[] = {
+};
+
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/construct/conf_rtl8264b.c b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/construct/conf_rtl8264b.c
new file mode 100644
index 00000000000000..d5cae3fd3bac03
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/construct/conf_rtl8264b.c
@@ -0,0 +1,2177 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2023 Realtek Semiconductor Corp. All rights reserved.
+ */
+
+//Date: Thu Dec 15 16:01:01 2022
+
+rtk_hwpatch_t rtl8264b_top_conf[] = {
+    {RTK_PATCH_OP_TOP     , 0xf  , 2     , 20    , 15, 0 , 0x5   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 2     , 21    , 15, 0 , 0x0   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 2     , 22    , 15, 0 , 0x280 , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 2     , 23    , 15, 0 , 0x0014, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 3     , 16    , 15, 0 , 0x0300, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 3     , 17    , 15, 0 , 0x01ff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 3     , 18    , 15, 0 , 0x000c, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 3     , 19    , 15, 0 , 0x01ff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 3     , 20    , 15, 0 , 0x0200, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 3     , 21    , 15, 0 , 0x0015, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 3     , 22    , 15, 0 , 0x0200, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 3     , 23    , 15, 0 , 0x0   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 4     , 16    , 15, 0 , 0x0   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 13    , 23    , 8 , 5 , 0x6   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 90    , 18    , 15, 0 , 0xc   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 90    , 19    , 15, 0 , 0xc   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 90    , 20    , 15, 8 , 0x01  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8264b_sds_conf[] = {
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 18    , 15, 0 , 0x881F, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 19    , 15, 0 , 0x003F, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 20    , 15, 0 , 0x003F, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 21    , 15, 0 , 0x003F, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 22    , 15, 0 , 0x001F, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x06  , 0x0D  , 15, 0 , 0x0F00, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x06  , 0x0E  , 15, 0 , 0x3F5A, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x07  , 0x10  , 15, 12, 0x8   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x07  , 0x10  , 7 , 0 , 0x3   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x06  , 0x1D  , 15, 0 , 0x0600, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x21  , 0x00  , 15, 0 , 0x4902, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x21  , 0x08  , 15, 0 , 0x0FC0, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x21  , 0x09  , 15, 0 , 0x33F0, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x21  , 0x0C  , 15, 0 , 0x08BF, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x21  , 0x12  , 15, 0 , 0x8000, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x36  , 0x07  , 15, 0 , 0x04C0, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x36  , 0x08  , 15, 0 , 0x2000, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2E  , 0x0B  , 15, 0 , 0x2390, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2E  , 0x0C  , 15, 0 , 0xAA17, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2E  , 0x0D  , 15, 0 , 0xFE40, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2E  , 0x0E  , 15, 0 , 0x12F4, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2E  , 0x11  , 15, 0 , 0xF2AD, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2E  , 0x15  , 15, 0 , 0x7A41, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2E  , 0x16  , 15, 0 , 0x0041, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2F  , 0x00  , 15, 0 , 0x1F00, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2F  , 0x01  , 15, 0 , 0x2800, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2F  , 0x02  , 15, 0 , 0x0FC8, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2F  , 0x11  , 15, 0 , 0x3000, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2F  , 0x13  , 15, 0 , 0xF400, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2F  , 0x1E  , 15, 0 , 0x0500, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x34  , 0x0B  , 15, 0 , 0x2390, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x34  , 0x0C  , 15, 0 , 0xA517, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x34  , 0x0D  , 15, 0 , 0xFE41, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x34  , 0x0E  , 15, 0 , 0x12F4, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x34  , 0x11  , 15, 0 , 0xF2AD, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x34  , 0x15  , 15, 0 , 0x7A41, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x34  , 0x16  , 15, 0 , 0x0041, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x35  , 0x00  , 15, 0 , 0x1F80, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x35  , 0x01  , 15, 0 , 0x0800, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x35  , 0x02  , 15, 0 , 0x0FC8, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x35  , 0x11  , 15, 0 , 0x3001, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x35  , 0x13  , 15, 0 , 0xF400, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x35  , 0x1E  , 15, 0 , 0x0100, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2C  , 0x0B  , 15, 0 , 0x2390, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2C  , 0x0C  , 15, 0 , 0xA517, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2C  , 0x0D  , 15, 0 , 0xFE41, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2C  , 0x0E  , 15, 0 , 0x12F4, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2C  , 0x11  , 15, 0 , 0xF2AD, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2C  , 0x15  , 15, 0 , 0x7A61, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2C  , 0x16  , 15, 0 , 0x0041, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2D  , 0x00  , 15, 0 , 0x1F80, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2D  , 0x01  , 15, 0 , 0x0800, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2D  , 0x02  , 15, 0 , 0x0FC8, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2D  , 0x11  , 15, 0 , 0x3001, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2D  , 0x13  , 15, 0 , 0xF400, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x2D  , 0x1E  , 15, 0 , 0x0100, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x28  , 0x0B  , 15, 0 , 0x2390, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x28  , 0x0C  , 15, 0 , 0xA514, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x28  , 0x0D  , 15, 0 , 0xFE43, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x28  , 0x0E  , 15, 0 , 0x12F4, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x28  , 0x11  , 15, 0 , 0xF2AD, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x28  , 0x15  , 15, 0 , 0x7A61, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x28  , 0x16  , 15, 0 , 0x0041, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x29  , 0x00  , 15, 0 , 0x1F80, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x29  , 0x01  , 15, 0 , 0x0800, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x29  , 0x02  , 15, 0 , 0x0FC8, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x29  , 0x11  , 15, 0 , 0x3001, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x29  , 0x13  , 15, 0 , 0xF400, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x29  , 0x1E  , 15, 0 , 0x0100, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x26  , 0x0B  , 15, 0 , 0x2390, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x26  , 0x0C  , 15, 0 , 0xA514, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x26  , 0x0D  , 15, 0 , 0xFE43, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x26  , 0x0E  , 15, 0 , 0x12F4, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x26  , 0x11  , 15, 0 , 0xF2AD, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x26  , 0x15  , 15, 0 , 0x7A41, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x26  , 0x16  , 15, 0 , 0x0041, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x27  , 0x00  , 15, 0 , 0x1F80, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x27  , 0x01  , 15, 0 , 0x0800, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x27  , 0x02  , 15, 0 , 0x0FC8, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x27  , 0x11  , 15, 0 , 0x3001, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x27  , 0x13  , 15, 0 , 0xF400, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x27  , 0x1E  , 15, 0 , 0x0100, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x24  , 0x0B  , 15, 0 , 0x2390, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x24  , 0x0C  , 15, 0 , 0xA514, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x24  , 0x0D  , 15, 0 , 0xFE43, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x24  , 0x0E  , 15, 0 , 0x12F4, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x24  , 0x11  , 15, 0 , 0xF2AD, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x24  , 0x15  , 15, 0 , 0x7A41, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x24  , 0x16  , 15, 0 , 0x0041, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x25  , 0x00  , 15, 0 , 0x1F80, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x25  , 0x01  , 15, 0 , 0x0800, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x25  , 0x02  , 15, 0 , 0x0FC8, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x25  , 0x11  , 15, 0 , 0x3001, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x25  , 0x13  , 15, 0 , 0xF400, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x25  , 0x1E  , 15, 0 , 0x0100, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 18    , 15, 0 , 0x880D, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 19    , 15, 0 , 0x0024, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 20    , 15, 0 , 0x0036, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 21    , 15, 0 , 0x0035, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 24    , 22    , 15, 0 , 0x001A, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x1F  , 0x00  , 15, 0 , 0x001B, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PSDS0   , 0xf  , 0x1F  , 0x00  , 15, 0 , 0x0000, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 90    , 20    , 7 , 0 , 0x03  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8264b_afe_conf[] = {
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbf92, 15, 11, 0x1C  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbfaa, 10, 8 , 0x5   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbfae, 8 , 6 , 0x5   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbfaa, 12, 11, 0x1   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbf1c, 4 , 4 , 0x1   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbf0e, 5 , 4 , 0x3   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbf1c, 15, 13, 0x5   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbf16, 12, 12, 0x0   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbc24, 3 , 2 , 0x1   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbc24, 1 , 0 , 0x1   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbf08, 2 , 0 , 0x6   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbf0c, 5 , 3 , 0x7   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbf0c, 8 , 6 , 0x7   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbf0c, 11, 9 , 0x7   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbf0c, 14, 12, 0x7   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_TOP     , 0xf  , 90    , 21    , 15, 8 , 0x03  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8264b_uc_conf[] = {
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb820, 7 , 7 , 0x0   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbd8a, 5 , 3 , 0x3   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbd8c, 6 , 4 , 0x5   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x8060, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 12, 10, 0x3   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x8061, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 13, 0x5   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa466, 1 , 1 , 0x1   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x8491, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x1D  , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x8018, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 12, 12, 0x1   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x85af, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf85, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85af},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xc7af, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85b1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x85df, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85b3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf86, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85b5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1baf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85b7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8674, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85b9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf86, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85bb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7daf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85bd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x875b, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85bf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf87, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85c1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x67af, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85c3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8774, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85c5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf85, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85c7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xdc02, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85c9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6957, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85cb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe48f, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85cd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2ce5, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85cf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8f2d, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85d1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe084, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85d3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x11e1, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85d5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8412, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85d7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf5d, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85d9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x73f6, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85db},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xb01a, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85dd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe08f, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85df},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2ce1, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85e1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8f2d, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85e3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6d, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85e5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6802, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85e7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6938, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85e9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6d, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85eb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6b02, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85ed},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6938, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85ef},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6d, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85f1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6e02, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85f3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6938, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85f5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6d, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85f7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7102, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85f9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6938, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85fb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6d, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85fd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7402, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x85ff},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70e5, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8601},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6d, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8603},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7702, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8605},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70e5, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8607},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6d, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8609},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7a02, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x860b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70e5, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x860d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6d, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x860f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7d02, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8611},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70e5, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8613},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd784, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8615},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa2af, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8617},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5eed, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8619},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0286, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x861b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x21af, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x861d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x07ad, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x861f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf8f9, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8621},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfaef, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8623},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x69e0, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8625},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8018, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8627},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xad24, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8629},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x39d4, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x862b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x002e, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x862d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6e, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x862f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0402, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8631},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6938, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8633},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd480, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8635},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x03bf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8637},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x866e, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8639},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0269, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x863b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x38d4, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x863d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x000f, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x863f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf86, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8641},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7102, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8643},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6938, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8645},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf86, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8647},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7102, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8649},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70dc, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x864b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd480, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x864d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0bbf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x864f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x866e, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8651},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0269, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8653},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x38d4, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8655},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x000f, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8657},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf86, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8659},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7102, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x865b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6938, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x865d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf86, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x865f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7102, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8661},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70dc, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8663},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0208, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8665},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1eef, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8667},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x96fe, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8669},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfdfc, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x866b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x04f0, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x866d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbd94, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x866f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x30bd, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8671},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9602, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8673},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8621, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8675},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0254, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8677},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xdcaf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8679},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x03c1, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x867b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0286, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x867d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2102, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x867f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8686, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8681},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf04, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8683},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x41f8, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8685},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfbef, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8687},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x79e0, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8689},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8018, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x868b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xac20, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x868d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x03af, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x868f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8756, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8691},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6b, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8693},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3402, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8695},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70dc, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8697},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6b, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8699},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3102, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x869b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70e5, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x869d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6f, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x869f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4902, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86a1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70dc, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86a3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6f, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86a5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4c02, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86a7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70e5, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86a9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6f, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86ab},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4f02, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86ad},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70e5, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86af},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6b, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86b1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3702, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86b3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70dc, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86b5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6c, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86b7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c02, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86b9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70dc, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86bb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6b, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86bd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3402, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86bf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70e5, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86c1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1f00, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86c3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe183, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86c5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd4bf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86c7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6bcd, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86c9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0269, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86cb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x38bf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86cd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6bd0, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86cf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0269, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86d1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x38bf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86d3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6bd3, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86d5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0269, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86d7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x38bf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86d9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6bd6, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86db},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0269, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86dd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x38bf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86df},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6bd9, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86e1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86e3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe5bf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86e5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6bdc, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86e7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86e9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe5bf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86eb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6bdf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86ed},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86ef},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe5bf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86f1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6be2, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86f3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86f5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe5bf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86f7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6f46, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86f9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86fb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xdce1, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86fd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x83d3, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x86ff},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6f, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8701},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3a02, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8703},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6938, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8705},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0d14, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8707},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6f, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8709},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4002, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x870b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6938, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x870d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0d12, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x870f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6f, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8711},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3d02, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8713},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6938, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8715},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6f, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8717},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4302, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8719},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70dc, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x871b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0238, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x871d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xb5bf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x871f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6bd9, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8721},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8723},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xdcbf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8725},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6bdc, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8727},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8729},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xdcbf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x872b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6bdf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x872d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x872f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xdcbf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8731},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6be2, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8733},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8735},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xdcbf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8737},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6b34, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8739},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x873b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xdcbf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x873d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6b37, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x873f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8741},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe5bf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8743},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6f4f, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8745},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8747},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xdcbf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8749},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6b31, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x874b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x874d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xdcbf, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x874f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6f4c, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8751},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0270, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8753},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xdcef, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8755},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x97ff, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8757},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfc04, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8759},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xac2f, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x875b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x03af, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x875d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b2a, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x875f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x020e, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8761},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x95af, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8763},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b3f, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8765},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xee84, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8767},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3c00, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8769},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6c, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x876b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c02, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x876d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x70e5, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x876f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf01, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8771},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0300, RTK_PATCH_CMP_SWC , 0, 0xa438, 0xa436, 0x8773},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb818, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5d6d, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb81a, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5eea, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb81c, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x07aa, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb81e, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x03be, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb850, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x043e, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb852, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b26, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb878, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x00fd, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb884, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb832, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x007f, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8264b_uc2_conf[] = {
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb820, 7 , 7 , 0x1   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb87c, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8acf, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb87e, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf8a, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8acf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe7af, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ad1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8b40, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ad3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf8b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ad5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4caf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ad7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8b6a, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ad9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf8b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8adb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xb5af, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8add},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8bd1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8adf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf8c, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ae1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x04af, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ae3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8c12, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ae5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf67, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ae7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6302, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ae9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x65f5, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8aeb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xef31, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8aed},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf67, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8aef},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6002, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8af1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x65f5, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8af3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1e31, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8af5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xac38, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8af7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x19bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8af9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x676c, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8afb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0265, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8afd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf5ef, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8aff},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x31bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b01},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6769, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b03},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0265, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b05},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf51e, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b07},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x31ac, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b09},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x380c, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b0b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xee89, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b0d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2c02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b0f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xae0a, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b11},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xee89, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b13},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2c00, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b15},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xae04, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b17},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xee89, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b19},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2c01, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b1b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf8f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b1d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd5e1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b1f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x892c, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b21},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1a91, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b23},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xdbbf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b25},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x67cf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b27},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0265, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b29},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf51f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b2b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x001f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b2d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x221b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b2f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x45ad, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b31},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2705, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b33},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe187, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b35},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x06ae, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b37},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x03e1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b39},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8707, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b3b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf2d, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b3d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1a02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b3f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8c1e, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b41},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x028c, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b43},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7b02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b45},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x224f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b47},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf40, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b49},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xb8ac, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b4b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2f0f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b4d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0210, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b4f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x62bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b51},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6d36, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b53},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0265, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b55},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf5e5, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b57},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8fde, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b59},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf10, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b5b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4ae1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b5d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8fde, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b5f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6d, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b61},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3602, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b63},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x65d6, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b65},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf10, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b67},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x59e1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b69},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8fdd, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b6b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa100, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b6d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0dbf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b6f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6d36, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b71},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0265, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b73},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf5e5, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b75},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8fdc, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b77},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xee8f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b79},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xdd01, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b7b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6d, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b7d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3602, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b7f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6f77, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b81},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf86, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b83},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xc7e1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b85},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x892c, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b87},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4903, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b89},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1a91, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b8b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xef69, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b8d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xdbbf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b8f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x67cf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b91},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0265, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b93},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf51f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b95},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x001f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b97},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x22ef, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b99},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x741b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b9b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x45ad, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b9d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2711, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8b9f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf86, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ba1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd0d0, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ba3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x00e1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ba5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8fdc, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ba7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6d, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ba9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3602, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bab},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x65d6, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bad},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf35, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8baf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x46af, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bb1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3527, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bb3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x026f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bb5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6eee, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bb7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8fdd, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bb9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x00bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bbb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8d31, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bbd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x026f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bbf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6ebf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bc1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8d40, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bc3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x026f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bc5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6ebf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bc7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8d46, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bc9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x026f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bcb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6eaf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bcd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x36a9, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bcf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf8ef, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bd1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x49f8, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bd3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6e, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bd5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xc202, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bd7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x65f5, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bd9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xad28, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bdb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13e1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bdd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8a4e, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bdf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xad28, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8be1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0502, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8be3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5d65, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8be5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xae0e, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8be7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x025c, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8be9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1202, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8beb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8cc5, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bed},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xae06, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bef},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x025b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bf1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf302, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bf3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8d0d, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bf5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe087, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bf7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x17f6, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bf9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x27e4, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bfb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8717, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bfd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfcef, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8bff},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x94fc, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c01},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x04a1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c03},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0103, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c05},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x028c, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c07},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe9e0, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c09},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8a02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c0b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xef23, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c0d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf5c, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c0f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xdeac, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c11},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5003, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c13},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf61, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c15},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0d02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c17},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8d0d, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c19},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaf61, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c1b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33f8, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c1d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfafb, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c1f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xef79, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c21},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfbbf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c23},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6766, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c25},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0265, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c27},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf5ad, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c29},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2810, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c2b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xad30, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c2d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x05d7, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c2f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0002, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c31},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xae16, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c33},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xad32, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c35},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x24d7, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c37},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0003, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c39},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xae0e, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c3b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xad31, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c3d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x05d7, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c3f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c41},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xae06, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c43},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xad33, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c45},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x14d7, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c47},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0001, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c49},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf8f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c4b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xdf4f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c4d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0008, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c4f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1a97, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c51},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd78c, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c53},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x63d6, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c55},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8c7b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c57},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0265, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c59},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3bff, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c5b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xef97, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c5d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfffe, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c5f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfc04, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c61},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x206b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c63},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0e20, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c65},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6b11, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c67},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x206b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c69},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1420, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c6b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6b17, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c6d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x206b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c6f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2020, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c71},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6b23, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c73},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x206b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c75},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2600, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c77},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6b29, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c79},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf8fa, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c7b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xef69, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c7d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6d, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c7f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbd02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c81},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x65f5, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c83},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xad28, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c85},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0ebf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c87},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8d34, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c89},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x026f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c8b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x77bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c8d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8d31, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c8f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x026f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c91},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x77ae, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c93},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2ad1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c95},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0fbf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c97},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8d37, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c99},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0265, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c9b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd6bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c9d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8d3a, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8c9f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x026f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ca1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6ed1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ca3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x00bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ca5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8d3d, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ca7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0265, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ca9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd6bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cab},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8d40, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cad},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x026f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8caf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x77d1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cb1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x00bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cb3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8d43, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cb5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0265, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cb7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd6bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cb9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8d46, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cbb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x026f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cbd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x77ef, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cbf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x96fe, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cc1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfc04, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cc3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf8ef, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cc5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x49f8, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cc7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6d, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cc9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbd02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ccb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x65f5, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ccd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xac28, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ccf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x12bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cd1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6be6, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cd3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0265, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cd5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf5e5, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cd7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8fd8, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cd9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cdb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf202, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cdd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x65f5, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cdf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe58f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ce1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd9fc, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ce3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xef94, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ce5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfc04, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ce7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf8ef, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ce9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x49f8, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ceb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6d, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8ced},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbd02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cef},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x65f5, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cf1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xac28, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cf3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x12e1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cf5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8fda, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cf7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cf9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe602, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cfb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x65d6, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cfd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe18f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8cff},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xdbbf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d01},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6bf2, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d03},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0265, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d05},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd6fc, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d07},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xef94, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d09},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfc04, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d0b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf8ef, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d0d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x49f8, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d0f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6d, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d11},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbd02, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d13},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x65f5, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d15},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xac28, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d17},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x12e1, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d19},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8fd8, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d1b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf6b, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d1d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe602, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d1f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x65d6, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d21},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xe18f, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d23},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd9bf, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d25},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6bf2, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d27},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0265, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d29},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd6fc, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d2b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xef94, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d2d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfc04, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d2f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x77bd, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d31},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6c66, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d33},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbd6c, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d35},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x30bd, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d37},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5444, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d39},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbd54, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d3b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x85bd, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d3d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5e55, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d3f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbd54, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d41},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa7bd, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d43},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5cbb, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d45},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbd5c, RTK_PATCH_CMP_SWC , 0, 0xb87e, 0xb87c, 0x8d47},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb85e, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2d07, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb860, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x40b5, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb862, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1047, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb864, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3504, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb886, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x36A6, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb888, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x613d, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb88a, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5cd9, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb88c, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x610a, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xb838, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x00ff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb820, 7 , 7 , 0x0   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8264b_nctl0_conf[] = {
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb820, 7 , 7 , 0x1   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA016, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA012, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA014, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8010, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8015, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8020, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x802a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8030, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8035, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8046, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x806b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd707, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x10},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x606f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x11},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x12},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x801a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x13},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x14},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd707, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x15},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x606f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x16},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x17},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x801a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x18},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x19},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce10, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcf01, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd705, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4004, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcf02, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd719, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x20},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3bb7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x21},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8024, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x22},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x23},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd704, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x24},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x406e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x25},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x26},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x12bd, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x27},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x28},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x12e3, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x29},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xab80, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd500, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xc402, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x004a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x30},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8b80, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x31},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd500, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x32},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x33},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0108, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x34},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c0f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x35},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x090f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x36},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c0f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x37},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0a03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x38},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd004, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x39},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1c1, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x401c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce00, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd500, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x801a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x40},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd501, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x41},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce01, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x42},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x43},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x44},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0aa9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x45},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd500, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x46},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x47},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2a69, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x48},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8056, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x49},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3f48, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8058, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3f4b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x805a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x618c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3f40, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x805c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x50},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3f43, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x51},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x805e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x52},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x616b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x53},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6187, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x54},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x55},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcc8f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x56},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x57},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcc8d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x58},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf008, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x59},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcc8b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcc89, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf004, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcc87, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf002, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcc91, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x60},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x61},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b9a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x62},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x63},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xca80, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x64},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x65},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0ba0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x66},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xca00, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x67},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd504, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x68},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x69},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1658, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa208, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0a88, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0d91, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA026, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0d90, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA024, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1657, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA022, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0aa1, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA020, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0047, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA006, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0049, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA004, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x12b9, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA002, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0be5, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA000, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1811, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA008, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xff00, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA016, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA012, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0ff8, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA014, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xc483, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x0ff8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xc483, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xff9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xffa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xffb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xffc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xffd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xffe},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xfff},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA152, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1a83, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA154, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1d29, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA156, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3fff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA158, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3fff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA15A, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3fff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA15C, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3fff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA15E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3fff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA160, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3fff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA150, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0003, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb820, 7 , 7 , 0x0   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8264b_nctl1_conf[] = {
+};
+
+rtk_hwpatch_t rtl8264b_nctl2_conf[] = {
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb820, 7 , 7 , 0x1   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA016, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0020, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA012, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA014, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8010, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8022, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8029, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8085, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x808c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8093, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8281, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x829a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x10},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x11},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8370, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x12},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x13},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd707, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x14},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x416f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x15},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x16},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd05a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x17},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa501, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x18},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x19},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd701, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5fbd, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8501, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0427, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x20},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x040b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x21},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8501, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x22},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd707, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x23},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x406f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x24},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x25},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x01d8, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x26},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x27},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x01cb, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x28},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd705, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x29},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3fa7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8030, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd75f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x699c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1340, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd704, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x30},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4066, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x31},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x800a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x32},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf002, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x33},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x34},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd705, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x35},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x61b4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x36},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd704, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x37},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x609f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x38},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6150, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x39},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x2d71, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8043, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cf0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x05a0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x3f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x40},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x41},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13b1, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x42},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x43},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x44},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8220, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x45},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c30, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x46},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0410, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x47},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x48},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x800a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x49},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x81a0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8302, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8480, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8684, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x4f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8203, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x50},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8340, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x51},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x52},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xaa10, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x53},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8b07, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x54},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x55},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x60cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x56},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x60f1, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x57},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6113, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x58},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6135, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x59},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6157, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce0b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce0b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf008, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x5f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce0a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x60},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x61},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce0a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x62},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf004, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x63},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce09, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x64},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf002, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x65},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce09, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x66},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x67},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x68},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa204, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x69},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13e4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xab08, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcda0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd705, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x6f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x40de, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x70},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd162, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x71},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd045, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x72},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbf10, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x73},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x74},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13b1, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x75},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9f10, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x76},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x77},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13b1, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x78},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x79},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x607a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x7a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x7b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13b1, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x7c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9f10, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x7d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x7e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x7f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8210, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x80},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa210, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x81},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x82},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x83},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1340, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x84},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x85},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x86},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8df8, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x87},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8370, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x88},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x89},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x8a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x01c1, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x8b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x8c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x8d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8df8, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x8e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8370, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x8f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x90},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x91},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x009e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x92},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x93},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x94},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x809e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x95},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x96},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x809b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x97},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1bf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x98},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd06d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x99},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x9a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1dd, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x9b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd06d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x9c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x9d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd199, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x9e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd06e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x9f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5fba, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd05a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x60cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x60f1, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6113, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xa9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6135, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xaa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6157, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xab},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xac},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xad},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xae},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xaf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf008, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf004, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf002, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13e4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xb9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xba},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xbb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0ccf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xbc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b40, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xbd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c3f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xbe},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c24, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xbf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa340, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1433, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa110, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13ec, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8110, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x143c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xc9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa304, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xca},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa8c0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xcb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8810, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xcc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xcd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa120, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xce},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa310, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xcf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cfc, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0224, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0ca0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0480, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa340, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd162, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xd9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xda},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xdb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xdc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5fba, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xdd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8840, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xde},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1c4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xdf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd045, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5fba, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6127, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f3b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x88c0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xe9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x800a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xea},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8120, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xeb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8350, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xec},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x84a0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xed},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffb6, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xee},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xb920, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xef},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcd33, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7fb4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9920, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6065, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xf9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f94, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xfa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffee, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xfb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xb820, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xfc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xfd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xfe},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0xff},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7fa5, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x100},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9820, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x101},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x800a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x102},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8120, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x103},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x104},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1433, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x105},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa108, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x106},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x107},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13ec, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x108},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8108, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x109},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x10a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x143c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x10b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa2fc, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x10c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa304, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x10d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8880, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x10e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cc0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x10f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0440, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x110},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcd34, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x111},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x112},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x113},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cc0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x114},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b80, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x115},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xac3f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x116},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c38, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x117},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0d08, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x118},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x119},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa810, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x11a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x11b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa120, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x11c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa480, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x11d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa604, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x11e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x11f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x120},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8125, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x121},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x122},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd049, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x123},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x124},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd19f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x125},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd049, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x126},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x127},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x128},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x129},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x63f4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x12a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x12b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f7a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x12c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x12d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4368, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x12e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x12f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x130},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cc0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x131},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b40, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x132},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8c3f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x133},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8d38, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x134},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x135},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x136},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x137},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8141, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x138},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x139},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x813e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x13a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1f4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x13b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x13c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x13d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1b7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x13e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x13f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x140},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1c6, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x141},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x142},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x143},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x144},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x145},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6074, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x146},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x147},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f7a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x148},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x149},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x14a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x14b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4056, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x14c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf004, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x14d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x14e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x61fc, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x14f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xfff9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x150},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x151},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x152},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x153},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x154},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4070, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x155},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x156},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x820e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x157},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x158},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x159},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xae80, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x15a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x15b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x15c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x820e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x15d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x15e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd05a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x15f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x160},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x60cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x161},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x60f1, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x162},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6113, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x163},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6135, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x164},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6157, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x165},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x166},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x167},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x168},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x169},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf008, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x16a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x16b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x16c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x16d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf004, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x16e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x16f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf002, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x170},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x171},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x172},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13e4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x173},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x174},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x175},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0ccf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x176},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b40, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x177},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c3f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x178},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c24, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x179},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x17a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa340, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x17b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x17c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1433, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x17d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa110, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x17e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x17f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13ec, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x180},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8110, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x181},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x182},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x143c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x183},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa304, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x184},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa8c0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x185},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8810, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x186},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x187},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa120, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x188},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa310, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x189},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cfc, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x18a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0224, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x18b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0ca0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x18c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0480, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x18d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8604, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x18e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcd35, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x18f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd162, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x190},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x191},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x192},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x193},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x194},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5fba, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x195},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8840, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x196},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1c4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x197},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd045, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x198},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x199},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x19a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x19b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5fba, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x19c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x19d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6127, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x19e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x19f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f3b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x88c0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x800a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8120, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8350, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x84a0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffb8, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xbb80, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1a9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1aa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5fb4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ab},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xb920, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ac},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcd36, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ad},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ae},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1af},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7fb4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9920, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9b80, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6065, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f94, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xffe8, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1b9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xb820, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ba},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1bb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1bc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd71f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1bd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x7fa5, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1be},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9820, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1bf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x800a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8120, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1433, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa108, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13ec, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8108, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x143c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1c9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa2fc, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ca},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa304, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1cb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8880, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1cc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cc0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1cd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0440, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ce},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcd37, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1cf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cc0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b80, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xac3f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c38, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0d08, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa810, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1d9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa120, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1da},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa480, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1db},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa604, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1dc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1dd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1de},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x81e8, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1df},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x81e5, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1e9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ea},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1eb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ec},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x141a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ed},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ee},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f7a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ef},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f28, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cc0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b40, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8c3f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8d38, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1f9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1fa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8204, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1fb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1fc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8201, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1fd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd199, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1fe},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ff},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x200},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x201},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x202},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x203},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd189, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x204},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x205},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x206},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x207},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x208},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x141a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x209},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x20a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f7a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x20b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x20c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f28, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x20d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x20e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x20f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c0f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x210},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b05, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x211},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x212},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x213},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x60cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x214},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x60f1, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x215},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6113, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x216},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6135, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x217},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6157, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x218},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x219},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce08, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x21a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x21b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce08, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x21c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf008, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x21d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce08, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x21e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x21f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce08, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x220},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf004, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x221},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce08, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x222},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf002, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x223},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce08, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x224},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x225},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13e4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x226},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa180, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x227},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcd38, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x228},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x229},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x22a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x823e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x22b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x22c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8236, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x22d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x22e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x22f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x230},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x231},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf013, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x232},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd100, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x233},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd049, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x234},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf010, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x235},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x236},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x237},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1b7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x238},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd049, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x239},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x23a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd100, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x23b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x23c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf008, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x23d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x23e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x23f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x240},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x241},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x242},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd199, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x243},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x244},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd13b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x245},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd055, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x246},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x247},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x248},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x249},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x141a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x24a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x24b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f7b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x24c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa302, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x24d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x24e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x24f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x250},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x141a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x251},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x252},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f7a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x253},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x254},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f28, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x255},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x256},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x257},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c3f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x258},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c12, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x259},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x25a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x25b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x25c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8270, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x25d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x25e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8268, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x25f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x260},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x261},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd199, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x262},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x263},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf013, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x264},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd100, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x265},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x266},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf010, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x267},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x268},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x269},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x26a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x26b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x26c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd100, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x26d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd040, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x26e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf008, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x26f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x270},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x271},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd199, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x272},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x273},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x274},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd16b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x275},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x276},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x277},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x278},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x279},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x141a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x27a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x27b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f7a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x27c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x27d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f2a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x27e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x27f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x085e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x280},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x281},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x282},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcb0a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x283},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0cc7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x284},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x285},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x286},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x287},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4127, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x288},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x289},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x28a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c0f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x28b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b05, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x28c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c38, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x28d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0d28, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x28e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x28f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf008, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x290},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x291},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x292},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c0f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x293},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b0a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x294},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c38, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x295},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0d18, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x296},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x297},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x298},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0f45, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x299},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x29a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x646d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x29b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x29c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x82b4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x29d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x29e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x82aa, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x29f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x40c7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd100, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd049, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf01a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd049, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf017, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2a9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2aa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x40c7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ab},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ac},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ad},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd100, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ae},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd049, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2af},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf010, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x40c7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2b9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ba},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2bb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2bc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2bd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2be},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2bf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x141a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f7a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f29, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x60cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2c9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x60f1, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ca},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6113, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2cb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6135, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2cc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x6157, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2cd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ce},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2cf},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf008, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf004, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf002, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xce06, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2d9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2da},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13e4, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2db},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2dc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2dd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8bc0, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2de},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c3f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2df},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c09, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa120, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa310, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xa420, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcd3b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x65ad, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x43c7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2e9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ea},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x82fe, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2eb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ec},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x82f6, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ed},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ee},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ef},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd199, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f1},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf024, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f2},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd15d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f3},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f4},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf021, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f5},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f6},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f7},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1c6, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2f9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf01c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2fa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd15d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2fb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2fc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf019, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2fd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2fe},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x2ff},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd199, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x300},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x301},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf014, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x302},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x303},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x304},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf011, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x305},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x306},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x307},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8311, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x308},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x309},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x830e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x30a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd1e5, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x30b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x30c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf009, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x30d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd191, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x30e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x30f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x310},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x311},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x312},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x313},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd16b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x314},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x315},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x316},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x13cf, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x317},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x318},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x141a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x319},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x31a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f7a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x31b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd706, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x31c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x5f2c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x31d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x31e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x40e7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x31f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x320},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x321},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c0f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x322},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b05, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x323},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x324},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x325},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c03, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x326},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1502, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x327},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0c0f, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x328},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b0a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x329},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x9503, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x32a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xcd3c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x32b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x32c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x644d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x32d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x43c7, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x32e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd700, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x32f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x37c9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x330},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x8344, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x331},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x33a9, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x332},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x833c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x333},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x334},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x335},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x336},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x337},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf019, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x338},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x339},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x33a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf016, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x33b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x33c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x33d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x33e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x33f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf011, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x340},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd13e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x341},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd049, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x342},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf00e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x343},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd702, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x344},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x4098, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x345},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x346},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x347},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf009, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x348},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x349},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd049, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x34a},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf006, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x34b},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x34c},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd04b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x34d},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf003, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x34e},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd17a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x34f},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd048, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x350},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1800, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x351},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x093a, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x352},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA10E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0883, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA10C, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0f32, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA10A, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0676, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA108, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x00fa, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA106, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x021d, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA104, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x12fe, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA102, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x01ca, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA100, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x047f, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA110, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x00ff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA016, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0020, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA012, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x1ff8, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA014, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd13e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ff8},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd15c, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ff9},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd16b, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ffa},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xd15d, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ffb},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b0e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ffc},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b0e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ffd},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b0e, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1ffe},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_SWC , 0, 0xa014, 0xa012, 0x1fff},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA164, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0972, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA166, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0968, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA168, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0a0b, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA16A, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0a01, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA16C, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0b8a, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA16E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0bf9, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA170, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x125c, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA172, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x3fff, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0xA162, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x007F, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb820, 7 , 7 , 0x0   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8264b_algxg_conf[] = {
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x815B, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x75  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x80CD, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x25  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8065, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x15  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8175, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0xa2  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8176, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0xc5  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8077, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x40  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8078, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0xcc  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8969, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x0f  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8957, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x2C  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8959, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x15  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x895A, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x3E  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x895F, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x1E  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8165, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x22  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x827E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x68  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8167, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x33  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8013, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x39  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8fd7, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x14  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8fd6, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x1e  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8fd5, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x1e  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x82D9, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x20  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x82DA, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x00  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x816E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0xab  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8159, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x58  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x815A, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x99  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8139, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x25  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8125, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x67  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8126, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x89  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x827D, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x42  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8264b_alg_giga_conf[] = {
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80b8, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x4d  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80b9, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0xcc  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80ba, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x0   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80bb, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 13, 8 , 0x0   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80bc, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x37  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80bd, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 12, 8 , 0x0c  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80be, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0xBB  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80bf, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0xca  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80c0, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x45  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80c2, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x3b  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80cc, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x16  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80cd, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 10, 8 , 0x4   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80ce, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x0   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80cf, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 13, 8 , 0x0   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80d0, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x53  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80d1, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 12, 8 , 0x0a  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80d2, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0xB9  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80d3, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0xd0  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80d4, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x4a  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80d6, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x35  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80a4, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x0d  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80a5, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0xa4  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80a6, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x59  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80a7, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 13, 8 , 0x05  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80a8, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0xab  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80a9, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 12, 8 , 0x0b  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80aa, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0xef  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80ab, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0xae  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80ac, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0xdf  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x80ae, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x28  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x8367, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x5d  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8264b_normal_conf[] = {
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbd92, 15, 0 , 0x002e, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbd94, 15, 0 , 0x8003, RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbd96, 3 , 0 , 0xf   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbd96, 3 , 0 , 0x0   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbd94, 15, 0 , 0x800b, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbd96, 3 , 0 , 0xf   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xbd96, 3 , 0 , 0x0   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x817D, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x07  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x8426, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x46  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x8428, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x46  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x84de, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x84e0, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x00fc, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x84e2, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf61a, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x84e4, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x58  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x84e6, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x84e8, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x00fc, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x84ea, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf61a, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x84ec, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x58  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x84ee, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0000, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x84f0, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x00fc, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x84f2, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0xf61a, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x84f4, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 8 , 0x58  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xae32, 5 , 5 , 0x1   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x8018, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 12, 12, 0x1   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8fdf, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 0 , 0x0496, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8fe1, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 0 , 0x03a5, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8fe3, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 0 , 0x02e5, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8fe5, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 0 , 0x020d, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8fe7, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 0 , 0x0496, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8fe9, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 0 , 0x03a5, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8feb, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 0 , 0x02e5, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8fed, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 0 , 0x020d, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8fef, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 0 , 0x0496, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8ff1, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 0 , 0x03a5, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8ff3, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 0 , 0x02e5, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8ff5, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 0 , 0x020d, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8ff7, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 0 , 0x0496, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8ff9, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 0 , 0x03a5, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8ffb, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 0 , 0x02e5, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8ffd, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 0 , 0x020d, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb516, 6 , 0 , 0x0   , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8fda, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x04  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8fdb, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x05  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8132, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x77  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8134, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x88  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x80ca, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x77  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x80cc, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x88  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8062, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x77  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87c, 15, 0 , 0x8064, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb87e, 15, 8 , 0x88  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa436, 15, 0 , 0x801E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xa438, 15, 0 , 0x0012, RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8264b_dataram_conf[] = {
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb820, 7 , 7 , 0x0   , RTK_PATCH_CMP_WS  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb896, 0 , 0 , 0x0   , RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb892, 15, 8 , 0x0   , RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC037, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x33  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC038, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x2A  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC039, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x25  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC03A, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x20  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC03B, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x1C  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC03C, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x17  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC03D, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x13  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC075, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xA1  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC076, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xB1  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC077, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x2E  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC078, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x55  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC079, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x19  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC07A, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xDC  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC07B, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xA0  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC10B, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xD5  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC10C, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xD5  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC10D, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xD5  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC10E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xD5  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC10F, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xD5  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC110, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xD5  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC149, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x08  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC14A, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x08  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC14B, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x08  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC14C, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x08  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC14D, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x08  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC14E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x08  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC166, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xEE  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC167, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xEE  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC168, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x07  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC169, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x09  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC16A, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x0B  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC16B, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x0D  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC16C, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x13  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC16D, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x0E  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC16E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x11  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC16F, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x14  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC170, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x17  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC171, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x15  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC172, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0x10  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC173, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0x0B  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC128, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xF7  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC129, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xF7  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC12A, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xF8  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC12B, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xF7  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC12C, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xF6  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC12D, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xF5  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC12E, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xF2  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC12F, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xF7  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC130, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xF5  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC131, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xF2  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC132, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xF0  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC133, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xF1  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC134, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 15, 8 , 0xF4  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb88e, 15, 0 , 0xC135, RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb890, 7 , 0 , 0xF7  , RTK_PATCH_CMP_WC  , 0, 0, 0, 0},
+    {RTK_PATCH_OP_PHYOCP  , 0xf  , 0     , 0xb896, 0 , 0 , 0x1   , RTK_PATCH_CMP_W   , 0, 0, 0, 0},
+};
+
+rtk_hwpatch_t rtl8264b_rtct_conf[] = {
+};
+
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/error.h b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/error.h
new file mode 100644
index 00000000000000..d99a996f8c05c2
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/error.h
@@ -0,0 +1,165 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2023 Realtek Semiconductor Corp. All rights reserved.
+ */
+
+#ifndef __COMMON_ERROR_H__
+#define __COMMON_ERROR_H__
+
+/*
+ * Include Files
+ */
+#if defined(RTK_PHYDRV_IN_LINUX)
+  #include "type.h"
+#else
+  #include <common/type.h>
+#endif
+/*
+ * Data Type Declaration
+ */
+typedef enum rt_error_common_e
+{
+    RT_ERR_FAILED = -1,                             /* General Error                                                                    */
+
+    /* 0x0000xxxx for common error code */
+    RT_ERR_OK = 0,                                  /* 0x00000000, OK                                                                   */
+    RT_ERR_INPUT = 0xF001,                          /* 0x0000F001, invalid input parameter                                              */
+    RT_ERR_UNIT_ID,                                 /* 0x0000F002, invalid unit id                                                      */
+    RT_ERR_PORT_ID,                                 /* 0x0000F003, invalid port id                                                      */
+    RT_ERR_PORT_MASK,                               /* 0x0000F004, invalid port mask                                                    */
+    RT_ERR_PORT_LINKDOWN,                           /* 0x0000F005, link down port status                                                */
+    RT_ERR_ENTRY_INDEX,                             /* 0x0000F006, invalid entry index                                                  */
+    RT_ERR_NULL_POINTER,                            /* 0x0000F007, input parameter is null pointer                                      */
+    RT_ERR_QUEUE_ID,                                /* 0x0000F008, invalid queue id                                                     */
+    RT_ERR_QUEUE_NUM,                               /* 0x0000F009, invalid queue number                                                 */
+    RT_ERR_BUSYWAIT_TIMEOUT,                        /* 0x0000F00a, busy watting time out                                                */
+    RT_ERR_MAC,                                     /* 0x0000F00b, invalid mac address                                                  */
+    RT_ERR_OUT_OF_RANGE,                            /* 0x0000F00c, input parameter out of range                                         */
+    RT_ERR_CHIP_NOT_SUPPORTED,                      /* 0x0000F00d, functions not supported by this chip model                           */
+    RT_ERR_SMI,                                     /* 0x0000F00e, SMI error                                                            */
+    RT_ERR_NOT_INIT,                                /* 0x0000F00f, The module is not initial                                            */
+    RT_ERR_CHIP_NOT_FOUND,                          /* 0x0000F010, The chip can not found                                               */
+    RT_ERR_NOT_ALLOWED,                             /* 0x0000F011, actions not allowed by the function                                  */
+    RT_ERR_DRIVER_NOT_FOUND,                        /* 0x0000F012, The driver can not found                                             */
+    RT_ERR_SEM_LOCK_FAILED,                         /* 0x0000F013, Failed to lock semaphore                                             */
+    RT_ERR_SEM_UNLOCK_FAILED,                       /* 0x0000F014, Failed to unlock semaphore                                           */
+    RT_ERR_THREAD_EXIST,                            /* 0x0000F015, Thread exist                                                         */
+    RT_ERR_THREAD_CREATE_FAILED,                    /* 0x0000F016, Thread create fail                                                   */
+    RT_ERR_FWD_ACTION,                              /* 0x0000F017, Invalid forwarding Action                                            */
+    RT_ERR_IPV4_ADDRESS,                            /* 0x0000F018, Invalid IPv4 address                                                 */
+    RT_ERR_IPV6_ADDRESS,                            /* 0x0000F019, Invalid IPv6 address                                                 */
+    RT_ERR_PRIORITY,                                /* 0x0000F01a, Invalid Priority value                                               */
+    RT_ERR_FID,                                     /* 0x0000F01b, invalid fid                                                          */
+    RT_ERR_ENTRY_NOTFOUND,                          /* 0x0000F01c, specified entry not found                                            */
+    RT_ERR_DROP_PRECEDENCE,                         /* 0x0000F01d, invalid drop precedence                                              */
+    RT_ERR_NOT_FINISH,                              /* 0x0000F01e, Action not finish, still need to wait                                */
+    RT_ERR_TIMEOUT,                                 /* 0x0000F01f, Time out                                                             */
+    RT_ERR_REG_ARRAY_INDEX_1,                       /* 0x0000F020, invalid index 1 of register array                                    */
+    RT_ERR_REG_ARRAY_INDEX_2,                       /* 0x0000F021, invalid index 2 of register array                                    */
+    RT_ERR_ETHER_TYPE,                              /* 0x0000F022, invalid ether type                                                   */
+    RT_ERR_MBUF_PKT_NOT_AVAILABLE,                  /* 0x0000F023, mbuf->packet is not available                                        */
+    RT_ERR_QOS_INVLD_RSN,                           /* 0x0000F024, invalid pkt to CPU reason                                            */
+    RT_ERR_CB_FUNCTION_EXIST,                       /* 0x0000F025, Callback function exist                                              */
+    RT_ERR_CB_FUNCTION_FULL,                        /* 0x0000F026, Callback function number is full                                     */
+    RT_ERR_CB_FUNCTION_NOT_FOUND,                   /* 0x0000F027, Callback function can not found                                      */
+    RT_ERR_TBL_FULL,                                /* 0x0000F028, The table is full                                                    */
+    RT_ERR_TRUNK_ID,                                /* 0x0000F029, invalid trunk id                                                     */
+    RT_ERR_TYPE,                                    /* 0x0000F02a, invalid type                                                         */
+    RT_ERR_ENTRY_EXIST,                             /* 0x0000F02b, entry exists                                                         */
+    RT_ERR_CHIP_UNDEFINED_VALUE,                    /* 0x0000F02c, chip returned an undefined value                                     */
+    RT_ERR_EXCEEDS_CAPACITY,                        /* 0x0000F02d, exceeds the capacity of hardware                                     */
+    RT_ERR_ENTRY_REFERRED,                          /* 0x0000F02e, entry is still being referred                                        */
+    RT_ERR_OPER_DENIED,                             /* 0x0000F02f, operation denied                                                     */
+    RT_ERR_PORT_NOT_SUPPORTED,                      /* 0x0000F030, functions not supported by this port                                 */
+    RT_ERR_SOCKET,                                  /* 0x0000F031, socket error                                                         */
+    RT_ERR_MEM_ALLOC,                               /* 0x0000F032, insufficient memory resource                                         */
+    RT_ERR_ABORT,                                   /* 0x0000F033, operation aborted                                                    */
+    RT_ERR_DEV_ID,                                  /* 0x0000F034, invalid device id                                                    */
+    RT_ERR_DRIVER_NOT_SUPPORTED,                    /* 0x0000F035, functions not supported by this driver                               */
+    RT_ERR_NOT_SUPPORTED,                           /* 0x0000F036, functions not supported                                              */
+    RT_ERR_SER,                                     /* 0x0000F037, ECC or parity error                                                  */
+    RT_ERR_MEM_NOT_ALIGN,                           /* 0x0000F038, memory address is not aligned                                        */
+    RT_ERR_SEM_FAKELOCK_OK,                         /* 0x0000F039, attach thread lock a semaphore which was already locked              */
+    RT_ERR_CHECK_FAILED,                            /* 0x0000F03a, check result is failed                                               */
+
+    RT_ERR_COMMON_END = 0xFFFF                      /* The symbol is the latest symbol of common error                                  */
+} rt_error_common_t;
+
+/*
+ * Macro Definition
+ */
+#define RT_PARAM_CHK(expr, errCode)\
+do {\
+    if ((int32)(expr)) {\
+        return errCode; \
+    }\
+} while (0)
+
+#define RT_PARAM_CHK_EHDL(expr, errCode, err_hdl)\
+do {\
+    if ((int32)(expr)) {\
+        {err_hdl}\
+        return errCode; \
+    }\
+} while (0)
+
+#define RT_INIT_CHK(state)\
+do {\
+    if (INIT_COMPLETED != (state)) {\
+        return RT_ERR_NOT_INIT;\
+    }\
+} while (0)
+
+#define RT_INIT_REENTRY_CHK(state)\
+do {\
+    if (INIT_COMPLETED == (state)) {\
+        osal_printf(" %s had already been initialized!\n", __FUNCTION__);\
+        return RT_ERR_OK;\
+    }\
+} while (0)
+
+#define RT_INIT_REENTRY_CHK_NO_WARNING(state)\
+    do {\
+        if (INIT_COMPLETED == (state)) {\
+            return RT_ERR_OK;\
+        }\
+    } while (0)
+
+#define RT_ERR_CHK(op, ret)\
+do {\
+    if ((ret = (op)) != RT_ERR_OK)\
+        return ret;\
+} while(0)
+
+#define RT_ERR_HDL(op, errHandle, ret)\
+do {\
+    if ((ret = (op)) != RT_ERR_OK)\
+        goto errHandle;\
+} while(0)
+
+#define RT_ERR_CHK_EHDL(op, ret, err_hdl)\
+do {\
+    if ((ret = (op)) != RT_ERR_OK)\
+    {\
+        {err_hdl}\
+        return ret;\
+    }\
+} while(0)
+
+#define RT_NULL_HDL(pointer, err_label)\
+do {\
+    if (NULL == (pointer)) {\
+        goto err_label;\
+    }\
+} while (0)
+
+#define RT_ERR_VOID_CHK(op, ret)\
+do {\
+    if ((ret = (op)) != RT_ERR_OK) {\
+        osal_printf("Fail in %s %d, ret %x!\n", __FUNCTION__, __LINE__, ret);\
+        return ;}\
+} while(0)
+
+#endif /* __COMMON_ERROR_H__ */
+
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/phy_patch.c b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/phy_patch.c
new file mode 100644
index 00000000000000..f9af3ffe022e54
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/phy_patch.c
@@ -0,0 +1,179 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2023 Realtek Semiconductor Corp. All rights reserved.
+ */
+
+/*
+ * Include Files
+ */
+#if defined(RTK_PHYDRV_IN_LINUX)
+  #include "rtk_osal.h"
+#else
+  #include <common/rt_type.h>
+  #include <common/rt_error.h>
+  #include <common/debug/rt_log.h>
+  #include <hal/common/halctrl.h>
+  #include <hal/phy/phy_patch.h>
+#endif
+
+/*
+ * Function Declaration
+ */
+uint8 phy_patch_op_translate(uint8 patch_mode, uint8 patch_op, uint8 compare_op)
+{
+    if (patch_mode != PHY_PATCH_MODE_CMP)
+    {
+        return patch_op;
+    }
+    else
+    {
+        switch (compare_op)
+        {
+            case RTK_PATCH_CMP_WS:
+                return RTK_PATCH_OP_SKIP;
+            case RTK_PATCH_CMP_W:
+            case RTK_PATCH_CMP_WC:
+            case RTK_PATCH_CMP_SWC:
+            default:
+                return RTK_PATCH_OP_TO_CMP(patch_op, compare_op);
+        }
+    }
+}
+
+int32 phy_patch_op(rt_phy_patch_db_t *pPhy_patchDb, uint32 unit, rtk_port_t port, uint8 portOffset, uint8 patch_op, uint16 portmask, uint16 pagemmd, uint16 addr, uint8 msb, uint8 lsb, uint16 data, uint8 patch_mode)
+{
+    rtk_hwpatch_t op;
+
+    op.patch_op = patch_op;
+    op.portmask = portmask;
+    op.pagemmd  = pagemmd;
+    op.addr     = addr;
+    op.msb      = msb;
+    op.lsb      = lsb;
+    op.data     = data;
+    op.compare_op = RTK_PATCH_CMP_W;
+
+    return pPhy_patchDb->fPatch_op(unit, port, portOffset, &op, patch_mode);
+}
+
+static int32 _phy_patch_process(uint32 unit, rtk_port_t port, uint8 portOffset, rtk_hwpatch_t *pPatch, int32 size, uint8 patch_mode)
+{
+    int32 i = 0;
+    int32 ret = 0;
+    int32 chk_ret = RT_ERR_OK;
+    int32 n;
+    rtk_hwpatch_t *patch = pPatch;
+    rt_phy_patch_db_t *pPatchDb = NULL;
+
+    PHYPATCH_DB_GET(unit, port, pPatchDb);
+
+    if (size <= 0)
+    {
+        return RT_ERR_OK;
+    }
+    n = size / sizeof(rtk_hwpatch_t);
+
+    for (i = 0; i < n; i++)
+    {
+        ret = pPatchDb->fPatch_op(unit, port, portOffset, &patch[i], patch_mode);
+        if ((ret != RT_ERR_ABORT) && (ret != RT_ERR_OK))
+        {
+            if ((ret == RT_ERR_CHECK_FAILED) && (patch_mode == PHY_PATCH_MODE_CMP))
+            {
+                osal_printf("PATCH CHECK: Failed entry:%u|%u|0x%X|0x%X|%u|%u|0x%X\n",
+                            i + 1, patch[i].patch_op, patch[i].pagemmd, patch[i].addr, patch[i].msb, patch[i].lsb, patch[i].data);
+                chk_ret = RT_ERR_CHECK_FAILED;
+                continue;
+            }
+            else
+            {
+                RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u %s failed! %u[%u][0x%X][0x%X][0x%X] ret=0x%X\n", unit, port, __FUNCTION__,
+                       i+1, patch[i].patch_op, patch[i].pagemmd, patch[i].addr, patch[i].data, ret);
+                return ret;
+            }
+        }
+
+    }
+    return (chk_ret == RT_ERR_CHECK_FAILED) ? chk_ret : RT_ERR_OK;
+}
+
+/* Function Name:
+ *      phy_patch
+ * Description:
+ *      apply initial patch data to PHY
+ * Input:
+ *      unit       - unit id
+ *      port       - port id
+ *      portOffset - the index offset of port based the base port in the PHY chip
+ * Output:
+ *      None
+ * Return:
+ *      RT_ERR_OK
+ *      RT_ERR_FAILED
+ *      RT_ERR_CHECK_FAILED
+ *      RT_ERR_NOT_SUPPORTED
+ * Note:
+ *      None
+ */
+int32 phy_patch(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 patch_mode)
+{
+    int32 ret = RT_ERR_OK;
+    int32 chk_ret = RT_ERR_OK;
+    uint32 i = 0;
+    uint8 patch_type = 0;
+    rt_phy_patch_db_t *pPatchDb = NULL;
+    rtk_hwpatch_seq_t *table = NULL;
+
+    PHYPATCH_DB_GET(unit, port, pPatchDb);
+
+    if ((pPatchDb == NULL) || (pPatchDb->fPatch_op == NULL) || (pPatchDb->fPatch_flow == NULL))
+    {
+        RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u phy_patch, db is NULL\n", unit, port);
+        return RT_ERR_DRIVER_NOT_SUPPORTED;
+    }
+
+    if (patch_mode == PHY_PATCH_MODE_CMP)
+    {
+        table = pPatchDb->cmp_table;
+    }
+    else
+    {
+        table = pPatchDb->seq_table;
+    }
+    RT_LOG(LOG_INFO, (MOD_HAL | MOD_PHY), "phy_patch: U%u P%u portOffset:%u  patch_mode:%u\n", unit, port, portOffset, patch_mode);
+
+    for (i = 0; i < RTK_PATCH_SEQ_MAX; i++)
+    {
+        patch_type = table[i].patch_type;
+        RT_LOG(LOG_INFO, (MOD_HAL | MOD_PHY), "phy_patch: table[%u] patch_type:%u\n", i, patch_type);
+
+        if (RTK_PATCH_TYPE_IS_DATA(patch_type))
+        {
+            ret = _phy_patch_process(unit, port, portOffset, table[i].patch.data.conf, table[i].patch.data.size, patch_mode);
+
+            if (ret == RT_ERR_CHECK_FAILED)
+                chk_ret = ret;
+            else if (ret  != RT_ERR_OK)
+            {
+                RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u patch_mode:%u id:%u patch-%u failed. ret:0x%X\n", unit, port, patch_mode, i, patch_type, ret);
+                return ret;
+            }
+        }
+        else if (RTK_PATCH_TYPE_IS_FLOW(patch_type))
+        {
+            RT_ERR_CHK_EHDL(pPatchDb->fPatch_flow(unit, port, portOffset, table[i].patch.flow_id, patch_mode),
+                            ret, RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u patch_mode:%u id:%u patch-%u failed. ret:0x%X\n", unit, port, patch_mode, i, patch_type, ret););
+        }
+        else
+        {
+            break;
+        }
+    }
+
+    return (chk_ret == RT_ERR_CHECK_FAILED) ? chk_ret : RT_ERR_OK;
+}
+
+
+
+
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/phy_patch.h b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/phy_patch.h
new file mode 100644
index 00000000000000..c2b7b1279c7e2c
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/phy_patch.h
@@ -0,0 +1,174 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2023 Realtek Semiconductor Corp. All rights reserved.
+ */
+
+#ifndef __HAL_PHY_PATCH_H__
+#define __HAL_PHY_PATCH_H__
+
+/*
+ * Include Files
+ */
+#if defined(RTK_PHYDRV_IN_LINUX)
+  #include "rtk_phylib_def.h"
+#else
+  #include <common/rt_type.h>
+  #include <common/rt_autoconf.h>
+#endif
+
+/*
+ * Symbol Definition
+ */
+#define PHYPATCH_PHYCTRL_IN_HALCTRL   0  /* 3.6.x: 1 ,4.0.x: 1, 4.1.x+: 0 */
+#define PHYPATCH_FMAILY_IN_HWP        0  /* 3.6.x: 1 ,4.0.x: 0, 4.1.x+: 0 */
+#define PHY_PATCH_MODE_BCAST_DEFAULT  PHY_PATCH_MODE_BCAST  /* 3.6.x: PHY_PATCH_MODE_BCAST_BUS ,4.0.x+: PHY_PATCH_MODE_BCAST */
+
+#define PHY_PATCH_MODE_NORMAL       0
+#define PHY_PATCH_MODE_CMP          1
+#define PHY_PATCH_MODE_BCAST        2
+#define PHY_PATCH_MODE_BCAST_BUS    3
+
+#define RTK_PATCH_CMP_W        0  /* write */
+#define RTK_PATCH_CMP_WC       1  /* compare */
+#define RTK_PATCH_CMP_SWC      2  /* sram compare */
+#define RTK_PATCH_CMP_WS       3  /* skip */
+
+#define RTK_PATCH_OP_SECTION_SIZE           50
+#define RTK_PATCH_OP_TO_CMP(_op, _cmp)       (_op + (RTK_PATCH_OP_SECTION_SIZE * _cmp))
+/* 0~49 normal op */
+#define RTK_PATCH_OP_PHY                     0
+#define RTK_PATCH_OP_PHYOCP                  1
+#define RTK_PATCH_OP_TOP                     2
+#define RTK_PATCH_OP_TOPOCP                  3
+#define RTK_PATCH_OP_PSDS0                   4
+#define RTK_PATCH_OP_PSDS1                   5
+#define RTK_PATCH_OP_MSDS                    6
+#define RTK_PATCH_OP_MAC                     7
+
+/* 50~99 normal op for compare */
+#define RTK_PATCH_OP_CMP_PHY                 RTK_PATCH_OP_TO_CMP(RTK_PATCH_OP_PHY     , RTK_PATCH_CMP_WC)
+#define RTK_PATCH_OP_CMP_PHYOCP              RTK_PATCH_OP_TO_CMP(RTK_PATCH_OP_PHYOCP  , RTK_PATCH_CMP_WC)
+#define RTK_PATCH_OP_CMP_TOP                 RTK_PATCH_OP_TO_CMP(RTK_PATCH_OP_TOP     , RTK_PATCH_CMP_WC)
+#define RTK_PATCH_OP_CMP_TOPOCP              RTK_PATCH_OP_TO_CMP(RTK_PATCH_OP_TOPOCP  , RTK_PATCH_CMP_WC)
+#define RTK_PATCH_OP_CMP_PSDS0               RTK_PATCH_OP_TO_CMP(RTK_PATCH_OP_PSDS0   , RTK_PATCH_CMP_WC)
+#define RTK_PATCH_OP_CMP_PSDS1               RTK_PATCH_OP_TO_CMP(RTK_PATCH_OP_PSDS1   , RTK_PATCH_CMP_WC)
+#define RTK_PATCH_OP_CMP_MSDS                RTK_PATCH_OP_TO_CMP(RTK_PATCH_OP_MSDS    , RTK_PATCH_CMP_WC)
+#define RTK_PATCH_OP_CMP_MAC                 RTK_PATCH_OP_TO_CMP(RTK_PATCH_OP_MAC     , RTK_PATCH_CMP_WC)
+
+/* 100~149 normal op for sram compare */
+#define RTK_PATCH_OP_CMP_SRAM_PHY            RTK_PATCH_OP_TO_CMP(RTK_PATCH_OP_PHY     , RTK_PATCH_CMP_SWC)
+#define RTK_PATCH_OP_CMP_SRAM_PHYOCP         RTK_PATCH_OP_TO_CMP(RTK_PATCH_OP_PHYOCP  , RTK_PATCH_CMP_SWC)
+#define RTK_PATCH_OP_CMP_SRAM_TOP            RTK_PATCH_OP_TO_CMP(RTK_PATCH_OP_TOP     , RTK_PATCH_CMP_SWC)
+#define RTK_PATCH_OP_CMP_SRAM_TOPOCP         RTK_PATCH_OP_TO_CMP(RTK_PATCH_OP_TOPOCP  , RTK_PATCH_CMP_SWC)
+#define RTK_PATCH_OP_CMP_SRAM_PSDS0          RTK_PATCH_OP_TO_CMP(RTK_PATCH_OP_PSDS0   , RTK_PATCH_CMP_SWC)
+#define RTK_PATCH_OP_CMP_SRAM_PSDS1          RTK_PATCH_OP_TO_CMP(RTK_PATCH_OP_PSDS1   , RTK_PATCH_CMP_SWC)
+#define RTK_PATCH_OP_CMP_SRAM_MSDS           RTK_PATCH_OP_TO_CMP(RTK_PATCH_OP_MSDS    , RTK_PATCH_CMP_SWC)
+#define RTK_PATCH_OP_CMP_SRAM_MAC            RTK_PATCH_OP_TO_CMP(RTK_PATCH_OP_MAC     , RTK_PATCH_CMP_SWC)
+
+/* 200~255 control op */
+#define RTK_PATCH_OP_DELAY_MS                200
+#define RTK_PATCH_OP_SKIP                    255
+
+
+/*
+   patch type  PHY_PATCH_TYPE_NONE => empty
+   patch type: PHY_PATCH_TYPE_TOP ~ (PHY_PATCH_TYPE_END-1)  => data array
+   patch type: PHY_PATCH_TYPE_END ~ (PHY_PATCH_TYPE_END + RTK_PATCH_TYPE_FLOW_MAX)  => flow
+*/
+#define RTK_PATCH_TYPE_IS_DATA(_patch_type)    (_patch_type > PHY_PATCH_TYPE_NONE && _patch_type < PHY_PATCH_TYPE_END)
+#define RTK_PATCH_TYPE_IS_FLOW(_patch_type)    (_patch_type >= PHY_PATCH_TYPE_END && _patch_type <= (PHY_PATCH_TYPE_END + RTK_PATCH_TYPE_FLOWID_MAX))
+
+
+/*
+ * Macro Definition
+ */
+#if PHYPATCH_PHYCTRL_IN_HALCTRL
+  #define PHYPATCH_DB_GET(_unit, _port, _pPatchDb) \
+    do {\
+        hal_control_t   *pHalCtrl = NULL;\
+        if ((pHalCtrl = hal_ctrlInfo_get(_unit)) == NULL)\
+            return RT_ERR_FAILED;\
+        _pPatchDb = (pHalCtrl->pPhy_ctrl[_port]->pPhy_patchDb);\
+    } while(0)
+#else
+  #if defined(RTK_PHYDRV_IN_LINUX)
+  #else
+    #include <hal/phy/phydef.h>
+    #include <hal/phy/phy_probe.h>
+  #endif
+  #define PHYPATCH_DB_GET(_unit, _port, _pPatchDb) \
+    do {\
+        rt_phyctrl_t *pPhyCtrl = NULL;\
+        if ((pPhyCtrl = phy_phyctrl_get(_unit, _port)) == NULL)\
+            return RT_ERR_FAILED;\
+        _pPatchDb = (pPhyCtrl->pPhy_patchDb);\
+    } while(0)
+#endif
+
+#if PHYPATCH_FMAILY_IN_HWP
+  #define PHYPATCH_IS_RTKSDS(_unit) (HWP_9300_FAMILY_ID(_unit) || HWP_9310_FAMILY_ID(_unit))
+#else
+  #define PHYPATCH_IS_RTKSDS(_unit) (RTK_9300_FAMILY_ID(_unit) || RTK_9310_FAMILY_ID(_unit) || RTK_9311B_FAMILY_ID(_unit) || RTK_9330_FAMILY_ID(_unit))
+#endif
+
+#define PHYPATCH_TABLE_ASSIGN(_pPatchDb, _table, _idx, _patch_type, _para) \
+    do {\
+        if (RTK_PATCH_TYPE_IS_DATA(_patch_type)) {\
+            _pPatchDb->_table[_idx].patch_type = _patch_type;\
+            _pPatchDb->_table[_idx].patch.data.conf = _para;\
+            _pPatchDb->_table[_idx].patch.data.size = sizeof(_para);\
+        }\
+        else if (RTK_PATCH_TYPE_IS_FLOW(_patch_type)) {\
+            _pPatchDb->_table[_idx].patch_type = _patch_type;\
+            _pPatchDb->_table[_idx].patch.flow_id = _patch_type;\
+        }\
+        else {\
+            _pPatchDb->_table[_idx].patch_type = PHY_PATCH_TYPE_NONE;\
+        }\
+    } while(0)
+#define PHYPATCH_SEQ_TABLE_ASSIGN(_pPatchDb, _idx, _patch_type, _para) PHYPATCH_TABLE_ASSIGN(_pPatchDb, seq_table, _idx, _patch_type, _para)
+#define PHYPATCH_CMP_TABLE_ASSIGN(_pPatchDb, _idx, _patch_type, _para) PHYPATCH_TABLE_ASSIGN(_pPatchDb, cmp_table, _idx, _patch_type, _para)
+
+#define PHYPATCH_COMPARE(_mmdpage, _reg, _msb, _lsb, _exp, _real, _mask) \
+    do {\
+        uint32 _rData = REG32_FIELD_GET(_real, _lsb, _mask);\
+        if (_exp != _rData) {\
+            osal_printf("PATCH CHECK: %u(0x%X).%u(0x%X)[%u:%u] = 0x%X (!= 0x%X)\n", _mmdpage, _mmdpage, _reg, _reg, _msb, _lsb, _rData, _exp);\
+            return RT_ERR_CHECK_FAILED;\
+        }\
+    } while (0)
+
+/*
+ * Function Declaration
+ */
+
+extern uint8 phy_patch_op_translate(uint8 patch_mode, uint8 patch_op, uint8 compare_op);
+extern int32 phy_patch_op(rt_phy_patch_db_t *pPhy_patchDb, uint32 unit, rtk_port_t port, uint8 portOffset,
+                            uint8 patch_op, uint16 portmask, uint16 pagemmd, uint16 addr, uint8 msb, uint8 lsb, uint16 data,
+                            uint8 patch_mode);
+
+
+/* Function Name:
+ *      phy_patch
+ * Description:
+ *      apply initial patch data to PHY
+ * Input:
+ *      unit       - unit id
+ *      port       - port id
+ *      portOffset - the index offset of port based the base port in the PHY chip
+ * Output:
+ *      None
+ * Return:
+ *      RT_ERR_OK
+ *      RT_ERR_FAILED
+ *      RT_ERR_CHECK_FAILED
+ *      RT_ERR_NOT_SUPPORTED
+ * Note:
+ *      None
+ */
+extern int32 phy_patch(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 patch_mode);
+
+
+
+#endif /* __HAL_PHY_PATCH_H__ */
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/phy_rtl826xb_patch.c b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/phy_rtl826xb_patch.c
new file mode 100644
index 00000000000000..90a792a17b26ae
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/phy_rtl826xb_patch.c
@@ -0,0 +1,1031 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2023 Realtek Semiconductor Corp. All rights reserved.
+ */
+
+/*
+ * Include Files
+ */
+#if defined(RTK_PHYDRV_IN_LINUX)
+  #include "phy_rtl826xb_patch.h"
+  #include "construct/conf_rtl8264b.c"
+  #include "construct/conf_rtl8261n_c.c"
+#else
+  #include <common/rt_type.h>
+  #include <common/rt_error.h>
+  #include <common/debug/rt_log.h>
+  #include <soc/type.h>
+  #include <hal/common/halctrl.h>
+  #include <hal/mac/miim_common_drv.h>
+  #include <hal/phy/phy_construct.h>
+  #include <osal/time.h>
+  #include <hal/phy/construct/conftypes.h>
+  #include <hal/phy/phy_probe.h>
+  #include <hal/phy/phy_patch.h>
+  #include <osal/memory.h>
+  #if defined(CONFIG_SDK_RTL826XB)
+    #include <hal/phy/phy_rtl826xb.h>
+    #include <hal/phy/construct/conf_rtl8264b.c>
+    #include <hal/phy/construct/conf_rtl8261n_c.c>
+  #endif
+#endif
+/*
+ * Symbol Definition
+ */
+#define PHY_PATCH_WAIT_TIMEOUT     10000000
+
+#define PHY_PATCH_LOG    LOG_INFO
+
+/*
+ * Data Declaration
+ */
+
+/*
+ * Macro Declaration
+ */
+
+/*
+ * Function Declaration
+ */
+static uint16 _phy_rtl826xb_mmd_convert(uint16 page, uint16 addr)
+{
+    uint16 reg = 0;
+    if (addr < 16)
+    {
+        reg = 0xA400 + (page * 2);
+    }
+    else if (addr < 24)
+    {
+        reg = (16*page) + ((addr - 16) * 2);
+    }
+    else
+    {
+        reg = 0xA430 + ((addr - 24) * 2);
+    }
+    return reg;
+}
+
+int32
+_phy_rtl826xb_patch_wait(uint32 unit, rtk_port_t port, uint32 mmdAddr, uint32 mmdReg, uint32 data, uint32 mask, uint8 patch_mode)
+{
+    int32  ret = 0;
+    uint32 rData = 0;
+    uint32 cnt = 0;
+    WAIT_COMPLETE_VAR()
+
+    rtk_port_t  p = 0;
+    uint8  smiBus = HWP_PORT_SMI(unit, port);
+    uint32 phyChip = HWP_PHY_MODEL_BY_PORT(unit, port);
+    uint8  bcast_phyad = HWP_PHY_ADDR(unit, port);;
+
+
+    if (patch_mode == PHY_PATCH_MODE_BCAST_BUS)
+    {
+        if ((ret = phy_826xb_ctrl_set(unit, port, RTK_PHY_CTRL_MIIM_BCAST, 0)) != RT_ERR_OK)
+        {
+            RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u 826XB patch wait disable broadcast failed! 0x%X\n", unit, p, ret);
+            return ret;
+        }
+
+        HWP_PORT_TRAVS_EXCEPT_CPU(unit, p)
+        {
+            if ((HWP_PORT_SMI(unit, p) == smiBus) && (HWP_PHY_MODEL_BY_PORT(unit, p) == phyChip))
+            {
+                WAIT_COMPLETE(PHY_PATCH_WAIT_TIMEOUT)
+                {
+                    if ((ret = phy_common_general_reg_mmd_get(unit, p, mmdAddr, mmdReg, &rData)) != RT_ERR_OK)
+                    {
+                        return ret;
+                    }
+                    ++cnt;
+
+                    if ((rData & mask) == data)
+                        break;
+
+                    //osal_time_udelay(10);
+                }
+
+                if (WAIT_COMPLETE_IS_TIMEOUT())
+                {
+                    RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u 826XB patch wait[%u,0x%X,0x%X,0x%X]:0x%X cnt:%u\n", unit, p, mmdAddr, mmdReg, data, mask, rData, cnt);
+                    return RT_ERR_TIMEOUT;
+                }
+            }
+        }
+
+        osal_time_mdelay(1);
+        //for port in same SMI bus, set mdio broadcast ENABLE
+        HWP_PORT_TRAVS_EXCEPT_CPU(unit, p)
+        {
+            if ((HWP_PORT_SMI(unit, p) == smiBus) && (HWP_PHY_MODEL_BY_PORT(unit, p) == phyChip))
+            {
+                if ((ret = phy_826xb_ctrl_set(unit, p, RTK_PHY_CTRL_MIIM_BCAST_PHYAD, (uint32)bcast_phyad)) != RT_ERR_OK)
+                {
+                    RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u 826XB patch wait set broadcast PHYAD failed! 0x%X\n", unit, p, ret);
+                    return ret;
+                }
+
+                if ((ret = phy_826xb_ctrl_set(unit, p, RTK_PHY_CTRL_MIIM_BCAST, 1)) != RT_ERR_OK)
+                {
+                    RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u 826XB patch wait enable broadcast failed! 0x%X\n", unit, p, ret);
+                    return ret;
+                }
+            }
+        }
+    }
+    else if (patch_mode == PHY_PATCH_MODE_BCAST)
+    {
+        if ((ret = phy_826xb_ctrl_set(unit, port, RTK_PHY_CTRL_MIIM_BCAST, 0)) != RT_ERR_OK)
+        {
+            RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u 826x patch wait disable broadcast failed! 0x%X\n", unit, p, ret);
+            return ret;
+        }
+
+        HWP_PORT_TRAVS_EXCEPT_CPU(unit, p)
+        {
+            if (HWP_PHY_BASE_MACID(unit, p) == HWP_PHY_BASE_MACID(unit, port))
+            {
+                WAIT_COMPLETE(PHY_PATCH_WAIT_TIMEOUT)
+                {
+                    if ((ret = phy_common_general_reg_mmd_get(unit, p, mmdAddr, mmdReg, &rData)) != RT_ERR_OK)
+                    {
+                        return ret;
+                    }
+                    ++cnt;
+
+                    if ((rData & mask) == data)
+                        break;
+                    //osal_time_udelay(10);
+                }
+
+                if (WAIT_COMPLETE_IS_TIMEOUT())
+                {
+                    RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u 826x patch wait[%u,0x%X,0x%X,0x%X]:0x%X cnt:%u\n", unit, p, mmdAddr, mmdReg, data, mask, rData, cnt);
+                    return RT_ERR_TIMEOUT;
+                }
+            }
+        }
+
+        osal_time_mdelay(1);
+        //for port in same PHY, set mdio broadcast ENABLE
+        HWP_PORT_TRAVS_EXCEPT_CPU(unit, p)
+        {
+            if (HWP_PHY_BASE_MACID(unit, p) == HWP_PHY_BASE_MACID(unit, port))
+            {
+                if ((ret = phy_826xb_ctrl_set(unit, p, RTK_PHY_CTRL_MIIM_BCAST_PHYAD, (uint32)bcast_phyad)) != RT_ERR_OK)
+                {
+                    RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u 826XB patch wait set broadcast PHYAD failed! 0x%X\n", unit, p, ret);
+                    return ret;
+                }
+
+                if ((ret = phy_826xb_ctrl_set(unit, p, RTK_PHY_CTRL_MIIM_BCAST, 1)) != RT_ERR_OK)
+                {
+                    RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u 826XB patch wait enable broadcast failed! 0x%X\n", unit, p, ret);
+                    return ret;
+                }
+            }
+        }
+    }
+    else
+    {
+        WAIT_COMPLETE(PHY_PATCH_WAIT_TIMEOUT)
+        {
+            if ((ret = phy_common_general_reg_mmd_get(unit, port, mmdAddr, mmdReg, &rData)) != RT_ERR_OK)
+                return ret;
+
+            ++cnt;
+            if ((rData & mask) == data)
+                break;
+
+            osal_time_mdelay(1);
+        }
+
+        if (WAIT_COMPLETE_IS_TIMEOUT())
+        {
+            RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u 826XB patch wait[%u,0x%X,0x%X,0x%X]:0x%X cnt:%u\n", unit, port, mmdAddr, mmdReg, data, mask, rData, cnt);
+            return RT_ERR_TIMEOUT;
+        }
+    }
+
+    return RT_ERR_OK;
+}
+
+int32
+_phy_rtl826xb_patch_wait_not_equal(uint32 unit, rtk_port_t port, uint32 mmdAddr, uint32 mmdReg, uint32 data, uint32 mask, uint8 patch_mode)
+{
+    int32  ret = 0;
+    uint32 rData = 0;
+    uint32 cnt = 0;
+    WAIT_COMPLETE_VAR()
+
+    rtk_port_t  p = 0;
+    uint8  smiBus = HWP_PORT_SMI(unit, port);
+    uint32 phyChip = HWP_PHY_MODEL_BY_PORT(unit, port);
+    uint8  bcast_phyad = HWP_PHY_ADDR(unit, port);
+
+    if (patch_mode == PHY_PATCH_MODE_BCAST_BUS)
+    {
+        if ((ret = phy_826xb_ctrl_set(unit, port, RTK_PHY_CTRL_MIIM_BCAST, 0)) != RT_ERR_OK)
+        {
+            RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u 826XB patch wait disable broadcast failed! 0x%X\n", unit, p, ret);
+            return ret;
+        }
+
+        HWP_PORT_TRAVS_EXCEPT_CPU(unit, p)
+        {
+            if ((HWP_PORT_SMI(unit, p) == smiBus) && (HWP_PHY_MODEL_BY_PORT(unit, p) == phyChip))
+            {
+                WAIT_COMPLETE(PHY_PATCH_WAIT_TIMEOUT)
+                {
+                    if ((ret = phy_common_general_reg_mmd_get(unit, p, mmdAddr, mmdReg, &rData)) != RT_ERR_OK)
+                    {
+                        return ret;
+                    }
+                    ++cnt;
+
+                    if ((rData & mask) != data)
+                        break;
+
+                    //osal_time_udelay(10);
+                }
+                if (WAIT_COMPLETE_IS_TIMEOUT())
+                {
+                    RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u 826XB patch wait[%u,0x%X,0x%X,0x%X]:0x%X cnt:%u\n", unit, p, mmdAddr, mmdReg, data, mask, rData, cnt);
+                    return RT_ERR_TIMEOUT;
+                }
+            }
+        }
+
+        osal_time_mdelay(1);
+        //for port in same SMI bus, set mdio broadcast ENABLE
+        HWP_PORT_TRAVS_EXCEPT_CPU(unit, p)
+        {
+            if ((HWP_PORT_SMI(unit, p) == smiBus) && (HWP_PHY_MODEL_BY_PORT(unit, p) == phyChip))
+            {
+                if ((ret = phy_826xb_ctrl_set(unit, p, RTK_PHY_CTRL_MIIM_BCAST_PHYAD, (uint32)bcast_phyad)) != RT_ERR_OK)
+                {
+                    RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u 826XB patch wait set broadcast PHYAD failed! 0x%X\n", unit, p, ret);
+                    return ret;
+                }
+
+                if ((ret = phy_826xb_ctrl_set(unit, p, RTK_PHY_CTRL_MIIM_BCAST, 1)) != RT_ERR_OK)
+                {
+                    RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u 826XB patch wait enable broadcast failed! 0x%X\n", unit, p, ret);
+                    return ret;
+                }
+            }
+        }
+    }
+    else if (patch_mode == PHY_PATCH_MODE_BCAST)
+    {
+        if ((ret = phy_826xb_ctrl_set(unit, port, RTK_PHY_CTRL_MIIM_BCAST, 0)) != RT_ERR_OK)
+        {
+            RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u 826x patch wait disable broadcast failed! 0x%X\n", unit, p, ret);
+            return ret;
+        }
+
+        HWP_PORT_TRAVS_EXCEPT_CPU(unit, p)
+        {
+            if (HWP_PHY_BASE_MACID(unit, p) == HWP_PHY_BASE_MACID(unit, port))
+            {
+                WAIT_COMPLETE(PHY_PATCH_WAIT_TIMEOUT)
+                {
+                    if ((ret = phy_common_general_reg_mmd_get(unit, p, mmdAddr, mmdReg, &rData)) != RT_ERR_OK)
+                    {
+                        return ret;
+                    }
+                    ++cnt;
+
+                    if (((rData & mask) != data))
+                        break;
+
+                    //osal_time_udelay(10);
+                }
+
+                if (WAIT_COMPLETE_IS_TIMEOUT())
+                {
+                    RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u 826XB patch wait[%u,0x%X,0x%X,0x%X]:0x%X cnt:%u\n", unit, p, mmdAddr, mmdReg, data, mask, rData, cnt);
+                    return RT_ERR_TIMEOUT;
+                }
+            }
+        }
+
+        osal_time_mdelay(1);
+        //for port in same PHY, set mdio broadcast ENABLE
+        HWP_PORT_TRAVS_EXCEPT_CPU(unit, p)
+        {
+            if (HWP_PHY_BASE_MACID(unit, p) == HWP_PHY_BASE_MACID(unit, port))
+            {
+                if ((ret = phy_826xb_ctrl_set(unit, p, RTK_PHY_CTRL_MIIM_BCAST_PHYAD, (uint32)bcast_phyad)) != RT_ERR_OK)
+                {
+                    RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u 826XB patch wait set broadcast PHYAD failed! 0x%X\n", unit, p, ret);
+                    return ret;
+                }
+
+                if ((ret = phy_826xb_ctrl_set(unit, p, RTK_PHY_CTRL_MIIM_BCAST, 1)) != RT_ERR_OK)
+                {
+                    RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u 826XB patch wait enable broadcast failed! 0x%X\n", unit, p, ret);
+                    return ret;
+                }
+            }
+        }
+    }
+    else
+    {
+        WAIT_COMPLETE(PHY_PATCH_WAIT_TIMEOUT)
+        {
+            if ((ret = phy_common_general_reg_mmd_get(unit, port, mmdAddr, mmdReg, &rData)) != RT_ERR_OK)
+                return ret;
+
+            ++cnt;
+            if ((rData & mask) != data)
+                break;
+
+            osal_time_mdelay(1);
+        }
+        if (WAIT_COMPLETE_IS_TIMEOUT())
+        {
+            RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u 826xb patch wait[%u,0x%X,0x%X,0x%X]:0x%X cnt:%u\n", unit, port, mmdAddr, mmdReg, data, mask, rData, cnt);
+            return RT_ERR_TIMEOUT;
+        }
+
+    }
+
+    return RT_ERR_OK;
+}
+
+int32
+_phy_rtl826xb_patch_top_get(uint32 unit, rtk_port_t port, uint32 topPage, uint32 topReg, uint32 *pData)
+{
+    int32  ret = 0;
+    uint32 rData = 0;
+    uint32 topAddr = (topPage * 8) + (topReg - 16);
+
+    if ((ret = phy_common_general_reg_mmd_get(unit, port, PHY_MMD_VEND1, topAddr, &rData)) != RT_ERR_OK)
+        return ret;
+    *pData = rData;
+    return RT_ERR_OK;
+}
+
+int32
+_phy_rtl826xb_patch_top_set(uint32 unit, rtk_port_t port, uint32 topPage, uint32 topReg, uint32 wData)
+{
+    int32  ret = 0;
+    uint32 topAddr = (topPage * 8) + (topReg - 16);
+    if ((ret = phy_common_general_reg_mmd_set(unit, port, PHY_MMD_VEND1, topAddr, wData)) != RT_ERR_OK)
+        return ret;
+    return RT_ERR_OK;
+}
+
+int32
+_phy_rtl826xb_patch_sds_get(uint32 unit, rtk_port_t port, uint32 sdsPage, uint32 sdsReg, uint32 *pData)
+{
+    int32  ret = 0;
+    uint32 rData = 0;
+    uint32 sdsAddr = 0x8000 + (sdsReg << 6) + sdsPage;
+
+    if ((ret = _phy_rtl826xb_patch_top_set(unit, port, 40, 19, sdsAddr)) != RT_ERR_OK)
+        return ret;
+    if ((ret = _phy_rtl826xb_patch_top_get(unit, port, 40, 18, &rData)) != RT_ERR_OK)
+        return ret;
+    *pData = rData;
+    return _phy_rtl826xb_patch_wait(unit, port, PHY_MMD_VEND1, 0x143, 0, BIT_15, PHY_PATCH_MODE_NORMAL);
+}
+
+int32
+_phy_rtl826xb_patch_sds_set(uint32 unit, rtk_port_t port, uint32 sdsPage, uint32 sdsReg, uint32 wData, uint8 patch_mode)
+{
+    int32  ret = 0;
+    uint32 sdsAddr = 0x8800 + (sdsReg << 6) + sdsPage;
+
+    if ((ret = _phy_rtl826xb_patch_top_set(unit, port, 40, 17, wData)) != RT_ERR_OK)
+        return ret;
+    if ((ret = _phy_rtl826xb_patch_top_set(unit, port, 40, 19, sdsAddr)) != RT_ERR_OK)
+        return ret;
+    return _phy_rtl826xb_patch_wait(unit, port, PHY_MMD_VEND1, 0x143, 0, BIT_15, patch_mode);
+}
+
+static int32 _phy_rtl826xb_flow_r1(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 patch_mode)
+{
+    int32 ret = RT_ERR_OK;
+    rt_phy_patch_db_t *pPatchDb = NULL;
+
+    PHYPATCH_DB_GET(unit, port, pPatchDb);
+
+    //PHYReg_bit w $PHYID 0xb82 16 4 4 0x1
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xb82, 16, 4, 4, 0x1, patch_mode), ret);
+    //PHYReg_bit w $PHYID 0xb82 16 4 4 0x1
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xb82, 16, 4, 4, 0x1, patch_mode), ret);
+
+    //set patch_rdy [PHYReg_bit r $PHYID 0xb80 16 6 6] ; Wait for patch ready = 1
+    RT_ERR_CHK(_phy_rtl826xb_patch_wait(unit, port, 31, _phy_rtl826xb_mmd_convert(0xb80, 16), BIT_6, BIT_6, patch_mode), ret);
+
+    //PHYReg w $PHYID 0xa43 27 $0x8023
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa43, 27, 15, 0, 0x8023, patch_mode), ret);
+    //PHYReg w $PHYID 0xa43 28 $0x3802
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa43, 28, 15, 0, 0x3802, patch_mode), ret);
+    //PHYReg w $PHYID 0xa43 27 0xB82E
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa43, 27, 15, 0, 0xB82E, patch_mode), ret);
+    //PHYReg w $PHYID 0xa43 28 0x1
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa43, 28, 15, 0, 0x1, patch_mode), ret);
+
+     return RT_ERR_OK;
+}
+
+static int32 _phy_rtl826xb_flow_r12(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 patch_mode)
+{
+    int32 ret = RT_ERR_OK;
+    rt_phy_patch_db_t *pPatchDb = NULL;
+
+    PHYPATCH_DB_GET(unit, port, pPatchDb);
+
+    //PHYReg_bit w $PHYID 0xb82 16 4 4 0x1
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xb82, 16, 4, 4, 0x1, patch_mode), ret);
+    //PHYReg_bit w $PHYID 0xb82 16 4 4 0x1
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xb82, 16, 4, 4, 0x1, patch_mode), ret);
+
+    //set patch_rdy [PHYReg_bit r $PHYID 0xb80 16 6 6] ; Wait for patch ready = 1
+    RT_ERR_CHK(_phy_rtl826xb_patch_wait(unit, port, 31, _phy_rtl826xb_mmd_convert(0xb80, 16), BIT_6, BIT_6, patch_mode), ret);
+
+    //PHYReg w $PHYID 0xa43 27 $0x8023
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa43, 27, 15, 0, 0x8023, patch_mode), ret);
+    //PHYReg w $PHYID 0xa43 28 $0x3800
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa43, 28, 15, 0, 0x3800, patch_mode), ret);
+    //PHYReg w $PHYID 0xa43 27 0xB82E
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa43, 27, 15, 0, 0xB82E, patch_mode), ret);
+    //PHYReg w $PHYID 0xa43 28 0x1
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa43, 28, 15, 0, 0x1, patch_mode), ret);
+
+    return RT_ERR_OK;
+}
+
+
+static int32 _phy_rtl826xb_flow_r2(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 patch_mode)
+{
+    int32 ret = RT_ERR_OK;
+    rt_phy_patch_db_t *pPatchDb = NULL;
+
+    PHYPATCH_DB_GET(unit, port, pPatchDb);
+
+    //PHYReg w $PHYID 0xa43 27 0x0000
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa43, 27, 15, 0, 0x0000, patch_mode), ret);
+    //PHYReg w $PHYID 0xa43 28 0x0000
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa43, 28, 15, 0, 0x0000, patch_mode), ret);
+    //PHYReg_bit w $PHYID 0xB82 23 0 0 0x0
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xB82, 23, 0, 0, 0x0, patch_mode), ret);
+    //PHYReg w $PHYID 0xa43 27 $0x8023
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa43, 27, 15, 0, 0x8023, patch_mode), ret);
+    //PHYReg w $PHYID 0xa43 28 0x0000
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa43, 28, 15, 0, 0x0000, patch_mode), ret);
+
+    //PHYReg_bit w $PHYID 0xb82 16 4 4 0x0
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xb82, 16, 4, 4, 0x0, patch_mode), ret);
+    //set patch_rdy [PHYReg_bit r $PHYID 0xb80 16 6 6] ; Wait for patch ready != 1
+    RT_ERR_CHK( _phy_rtl826xb_patch_wait_not_equal(unit, port, 31, _phy_rtl826xb_mmd_convert(0xb80, 16), BIT_6, BIT_6, patch_mode), ret);
+
+    return RT_ERR_OK;
+}
+
+static int32 _phy_rtl826xb_flow_l1(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 patch_mode)
+{
+    int32 ret = RT_ERR_OK;
+    rt_phy_patch_db_t *pPatchDb = NULL;
+
+    PHYPATCH_DB_GET(unit, port, pPatchDb);
+
+    //PHYReg_bit w $PHYID 0xa4a 16 10 10 0x1
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa4a, 16, 10, 10, 0x1, patch_mode), ret);
+    //PHYReg_bit w $PHYID 0xa4a 16 10 10 0x1
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa4a, 16, 10, 10, 0x1, patch_mode), ret);
+
+    //set pcs_state [PHYReg_bit r $PHYID 0xa60 16 7 0] ; Wait for pcs state = 1
+    RT_ERR_CHK( _phy_rtl826xb_patch_wait(unit, port, 31, _phy_rtl826xb_mmd_convert(0xa60, 16), 0x1, 0xFF, patch_mode), ret);
+
+    return RT_ERR_OK;
+}
+
+static int32 _phy_rtl826xb_flow_l2(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 patch_mode)
+{
+    int32 ret = RT_ERR_OK;
+    rt_phy_patch_db_t *pPatchDb = NULL;
+
+    PHYPATCH_DB_GET(unit, port, pPatchDb);
+
+    //PHYReg_bit w $PHYID 0xa4a 16 10 10 0x0
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa4a, 16, 10, 10, 0x0, patch_mode), ret);
+
+    //set pcs_state [PHYReg_bit r $PHYID 0xa60 16 7 0] ; Wait for pcs state != 1
+    RT_ERR_CHK( _phy_rtl826xb_patch_wait_not_equal(unit, port, 31, _phy_rtl826xb_mmd_convert(0xa60, 16), 0x1, 0xFF, patch_mode), ret);
+
+     return RT_ERR_OK;
+}
+
+static int32 _phy_rtl826xb_flow_pi(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 patch_mode)
+{
+    int32 ret = RT_ERR_OK;
+    rt_phy_patch_db_t *pPatchDb = NULL;
+    uint32 rData = 0, cnt = 0;
+
+    PHYPATCH_DB_GET(unit, port, pPatchDb);
+
+    _phy_rtl826xb_flow_l1(unit, port, portOffset, patch_mode);
+
+    //  PP_PHYReg_bit w $PHYID 0xbf86 9 9 0x1; #SS_EN_XG = 1
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHYOCP, 0xFF, 31, 0xbf86, 9, 9, 0x1, patch_mode), ret);
+    //   PP_PHYReg_bit w $PHYID 0xbf86 8 8 0x0;
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHYOCP, 0xFF, 31, 0xbf86, 8, 8, 0x0, patch_mode), ret);
+    //   PP_PHYReg_bit w $PHYID 0xbf86 7 7 0x1;
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHYOCP, 0xFF, 31, 0xbf86, 7, 7, 0x1, patch_mode), ret);
+    //   PP_PHYReg_bit w $PHYID 0xbf86 6 6 0x1;
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHYOCP, 0xFF, 31, 0xbf86, 6, 6, 0x1, patch_mode), ret);
+    //   PP_PHYReg_bit w $PHYID 0xbf86 5 5 0x1;
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHYOCP, 0xFF, 31, 0xbf86, 5, 5, 0x1, patch_mode), ret);
+    //   PP_PHYReg_bit w $PHYID 0xbf86 4 4 0x1;
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHYOCP, 0xFF, 31, 0xbf86, 4, 4, 0x1, patch_mode), ret);
+    //   PP_PHYReg_bit w $PHYID 0xbf86 6 6 0x0;
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHYOCP, 0xFF, 31, 0xbf86, 6, 6, 0x0, patch_mode), ret);
+    //   PP_PHYReg_bit w $PHYID 0xbf86 9 9 0x0;
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHYOCP, 0xFF, 31, 0xbf86, 9, 9, 0x0, patch_mode), ret);
+    //   PP_PHYReg_bit w $PHYID 0xbf86 7 7 0x0;
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHYOCP, 0xFF, 31, 0xbf86, 7, 7, 0x0, patch_mode), ret);
+
+    //PP_PHYReg_bit r $PHYID 0xbc62 12 8
+    if ((ret = phy_common_general_reg_mmd_get(unit, port, PHY_MMD_VEND2, 0xbc62, &rData)) != RT_ERR_OK)
+        return ret;
+    rData = REG32_FIELD_GET(rData, 8, 0x1F00);
+    for (cnt = 0; cnt <= rData; cnt++)
+    {
+        //PP_PHYReg_bit w $PHYID 0xbc62 12 8 $t
+        RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHYOCP, 0xFF, 31, 0xbc62, 12, 8, cnt, patch_mode), ret);
+    }
+
+    //   PP_PHYReg_bit w $PHYID 0xbc02 2 2 0x1
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHYOCP, 0xFF, 31, 0xbc02, 2, 2, 0x1, patch_mode), ret);
+    //   PP_PHYReg_bit w $PHYID 0xbc02 3 3 0x1
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHYOCP, 0xFF, 31, 0xbc02, 3, 3, 0x1, patch_mode), ret);
+    //   PP_PHYReg_bit w $PHYID 0xbf86 6 6 0x1
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHYOCP, 0xFF, 31, 0xbf86, 6, 6, 0x1, patch_mode), ret);
+    //   PP_PHYReg_bit w $PHYID 0xbf86 9 9 0x1
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHYOCP, 0xFF, 31, 0xbf86, 9, 9, 0x1, patch_mode), ret);
+    //   PP_PHYReg_bit w $PHYID 0xbf86 7 7 0x1
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHYOCP, 0xFF, 31, 0xbf86, 7, 7, 0x1, patch_mode), ret);
+    //   PP_PHYReg_bit w $PHYID 0xbc04 9 2 0xff
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHYOCP, 0xFF, 31, 0xbc04, 9, 2, 0xff, patch_mode), ret);
+
+    _phy_rtl826xb_flow_l2(unit, port, portOffset, patch_mode);
+    return RT_ERR_OK;
+}
+
+static int32 _phy_rtl826xb_flow_n01(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 patch_mode)
+{
+    int32 ret = RT_ERR_OK;
+    rt_phy_patch_db_t *pPatchDb = NULL;
+
+    PHYPATCH_DB_GET(unit, port, pPatchDb);
+
+    //PHYReg_bit w $PHYID 0xa01 21 15 0 0x1
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa01, 21, 15, 0, 0x1, patch_mode), ret);
+    //PHYReg_bit w $PHYID 0xa01 19 15 0 0x0000
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa01, 19, 15, 0, 0x0000, patch_mode), ret);
+    //# PHYReg_bit w $PHYID 0xa01 17 15 0 0x0000
+    //RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa01, 17, 15, 0, 0x0000, patch_mode), ret);
+
+    return RT_ERR_OK;
+}
+
+static int32 _phy_rtl826xb_flow_n02(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 patch_mode)
+{
+    int32 ret = RT_ERR_OK;
+    rt_phy_patch_db_t *pPatchDb = NULL;
+
+    PHYPATCH_DB_GET(unit, port, pPatchDb);
+
+    //PHYReg_bit w $PHYID 0xa01 21 15 0 0x0
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa01, 21, 15, 0, 0x0, patch_mode), ret);
+    //PHYReg_bit w $PHYID 0xa01 19 15 0 0x0000
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa01, 19, 15, 0, 0x0000, patch_mode), ret);
+    //PHYReg_bit w $PHYID 0xa01 17 15 0 0x0000
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa01, 17, 15, 0, 0x0000, patch_mode), ret);
+    return RT_ERR_OK;
+}
+
+static int32 _phy_rtl826xb_flow_n11(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 patch_mode)
+{
+    int32 ret = RT_ERR_OK;
+    rt_phy_patch_db_t *pPatchDb = NULL;
+
+    PHYPATCH_DB_GET(unit, port, pPatchDb);
+
+    //PHYReg_bit w $PHYID 0xa01 21 15 0 0x1
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa01, 21, 15, 0, 0x1, patch_mode), ret);
+    //PHYReg_bit w $PHYID 0xa01 19 15 0 0x0010
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa01, 19, 15, 0, 0x0010, patch_mode), ret);
+    //# PHYReg_bit w $PHYID 0xa01 17 15 0 0x0000
+    //RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa01, 17, 15, 0, 0x0000, patch_mode), ret);
+
+    return RT_ERR_OK;
+}
+
+static int32 _phy_rtl826xb_flow_n12(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 patch_mode)
+{
+    int32 ret = RT_ERR_OK;
+    rt_phy_patch_db_t *pPatchDb = NULL;
+
+    PHYPATCH_DB_GET(unit, port, pPatchDb);
+
+    //PHYReg_bit w $PHYID 0xa01 21 15 0 0x0
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa01, 21, 15, 0, 0x0, patch_mode), ret);
+    //PHYReg_bit w $PHYID 0xa01 19 15 0 0x0010
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa01, 19, 15, 0, 0x0010, patch_mode), ret);
+    //PHYReg_bit w $PHYID 0xa01 17 15 0 0x0000
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa01, 17, 15, 0, 0x0000, patch_mode), ret);
+
+    return RT_ERR_OK;
+}
+
+static int32 _phy_rtl826xb_flow_n21(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 patch_mode)
+{
+    int32 ret = RT_ERR_OK;
+    rt_phy_patch_db_t *pPatchDb = NULL;
+
+    PHYPATCH_DB_GET(unit, port, pPatchDb);
+
+    //PHYReg_bit w $PHYID 0xa01 21 15 0 0x1
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa01, 21, 15, 0, 0x1, patch_mode), ret);
+    //PHYReg_bit w $PHYID 0xa01 19 15 0 0x0020
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa01, 19, 15, 0, 0x0020, patch_mode), ret);
+    //# PHYReg_bit w $PHYID 0xa01 17 15 0 0x0000
+    //RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa01, 17, 15, 0, 0x0000, patch_mode), ret);
+
+    return RT_ERR_OK;
+}
+
+static int32 _phy_rtl826xb_flow_n22(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 patch_mode)
+{
+    int32 ret = RT_ERR_OK;
+    rt_phy_patch_db_t *pPatchDb = NULL;
+
+    PHYPATCH_DB_GET(unit, port, pPatchDb);
+
+    //PHYReg_bit w $PHYID 0xa01 21 15 0 0x0
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa01, 21, 15, 0, 0x0, patch_mode), ret);
+    //PHYReg_bit w $PHYID 0xa01 19 15 0 0x0020
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa01, 19, 15, 0, 0x0020, patch_mode), ret);
+    //PHYReg_bit w $PHYID 0xa01 17 15 0 0x0000
+    RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PHY, 0xFF, 0xa01, 17, 15, 0, 0x0000, patch_mode), ret);
+
+    return RT_ERR_OK;
+}
+
+static int32 _phy_rtl826xb_flow_s(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 patch_mode)
+{
+    int32 ret = RT_ERR_OK;
+    rt_phy_patch_db_t *pPatchDb = NULL;
+
+    if (PHYPATCH_IS_RTKSDS(unit))
+    {
+        PHYPATCH_DB_GET(unit, port, pPatchDb);
+        RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PSDS0, 0xff, 0x07, 0x10, 15, 0, 0x80aa, patch_mode), ret);
+        RT_ERR_CHK(phy_patch_op(pPatchDb, unit, port, portOffset, RTK_PATCH_OP_PSDS0, 0xff, 0x06, 0x12, 15, 0, 0x5078, patch_mode), ret);
+    }
+
+    return RT_ERR_OK;
+}
+
+int32 phy_rtl826xb_patch_op(uint32 unit, rtk_port_t port, uint8 portOffset, rtk_hwpatch_t *pPatch_data, uint8 patch_mode)
+{
+    int32 ret = RT_ERR_OK;
+    uint32 rData = 0, wData = 0;
+    uint16 reg = 0;
+    uint8 patch_op = 0;
+    uint32 mask = 0;
+
+    if ((pPatch_data->portmask & (1 << portOffset)) == 0)
+    {
+        return RT_ERR_ABORT;
+    }
+    mask = UINT32_BITS_MASK(pPatch_data->msb, pPatch_data->lsb);
+    patch_op = phy_patch_op_translate(patch_mode, pPatch_data->patch_op, pPatch_data->compare_op);
+
+    #if 0
+    osal_printf("[%s,%d]u%up%u, patch_mode:%u/patch_op:%u/compare_op:%u => op: %u\n", __FUNCTION__, __LINE__, unit, port,
+                           patch_mode, pPatch_data->patch_op, pPatch_data->compare_op,
+                           patch_op);
+    #endif
+
+    switch (patch_op)
+    {
+        case RTK_PATCH_OP_PHY:
+            reg = _phy_rtl826xb_mmd_convert(pPatch_data->pagemmd, pPatch_data->addr);
+            if ((pPatch_data->msb != 15) || (pPatch_data->lsb != 0))
+            {
+                RT_ERR_CHK(phy_common_general_reg_mmd_get(unit, port, 31, reg, &rData), ret);
+            }
+            wData = REG32_FIELD_SET(rData, pPatch_data->data, pPatch_data->lsb, mask);
+            RT_ERR_CHK(phy_common_general_reg_mmd_set(unit, port, 31, reg, wData), ret);
+            break;
+        case RTK_PATCH_OP_CMP_PHY:
+            reg = _phy_rtl826xb_mmd_convert(pPatch_data->pagemmd, pPatch_data->addr);
+            RT_ERR_CHK(phy_common_general_reg_mmd_get(unit, port, 31, reg, &rData), ret);
+            PHYPATCH_COMPARE(pPatch_data->pagemmd, pPatch_data->addr, pPatch_data->msb, pPatch_data->lsb, pPatch_data->data, rData, mask);
+            break;
+        case RTK_PATCH_OP_CMP_SRAM_PHY:
+            reg = _phy_rtl826xb_mmd_convert(pPatch_data->sram_p, pPatch_data->sram_rw);
+            RT_ERR_CHK(phy_common_general_reg_mmd_set(unit, port, 31, reg, pPatch_data->sram_a), ret);
+            reg = _phy_rtl826xb_mmd_convert(pPatch_data->sram_p, pPatch_data->sram_rr);
+            RT_ERR_CHK(phy_common_general_reg_mmd_get(unit, port, 31, reg, &rData), ret);
+            PHYPATCH_COMPARE(pPatch_data->pagemmd, pPatch_data->addr, pPatch_data->msb, pPatch_data->lsb, pPatch_data->data, rData, mask);
+            break;
+
+        case RTK_PATCH_OP_PHYOCP:
+            if ((pPatch_data->msb != 15) || (pPatch_data->lsb != 0))
+            {
+                RT_ERR_CHK(phy_common_general_reg_mmd_get(unit, port, 31, pPatch_data->addr, &rData), ret);
+            }
+            wData = REG32_FIELD_SET(rData, pPatch_data->data, pPatch_data->lsb, mask);
+            RT_ERR_CHK(phy_common_general_reg_mmd_set(unit, port, 31, pPatch_data->addr, wData), ret);
+            break;
+        case RTK_PATCH_OP_CMP_PHYOCP:
+            RT_ERR_CHK(phy_common_general_reg_mmd_get(unit, port, 31, pPatch_data->addr, &rData), ret);
+            PHYPATCH_COMPARE(pPatch_data->pagemmd, pPatch_data->addr, pPatch_data->msb, pPatch_data->lsb, pPatch_data->data, rData, mask);
+            break;
+        case RTK_PATCH_OP_CMP_SRAM_PHYOCP:
+            RT_ERR_CHK(phy_common_general_reg_mmd_set(unit, port, 31, pPatch_data->sram_rw, pPatch_data->sram_a), ret);
+            RT_ERR_CHK(phy_common_general_reg_mmd_get(unit, port, 31, pPatch_data->sram_rr, &rData), ret);
+            PHYPATCH_COMPARE(pPatch_data->pagemmd, pPatch_data->addr, pPatch_data->msb, pPatch_data->lsb, pPatch_data->data, rData, mask);
+            break;
+
+        case RTK_PATCH_OP_TOP:
+            if ((pPatch_data->msb != 15) || (pPatch_data->lsb != 0))
+            {
+                RT_ERR_CHK(_phy_rtl826xb_patch_top_get(unit, port, pPatch_data->pagemmd, pPatch_data->addr, &rData), ret);
+            }
+            wData = REG32_FIELD_SET(rData, pPatch_data->data, pPatch_data->lsb, mask);
+            RT_ERR_CHK(_phy_rtl826xb_patch_top_set(unit, port, pPatch_data->pagemmd, pPatch_data->addr, wData), ret);
+            break;
+        case RTK_PATCH_OP_CMP_TOP:
+            RT_ERR_CHK(_phy_rtl826xb_patch_top_get(unit, port, pPatch_data->pagemmd, pPatch_data->addr, &rData), ret);
+            PHYPATCH_COMPARE(pPatch_data->pagemmd, pPatch_data->addr, pPatch_data->msb, pPatch_data->lsb, pPatch_data->data, rData, mask);
+            break;
+        case RTK_PATCH_OP_CMP_SRAM_TOP:
+            RT_ERR_CHK(_phy_rtl826xb_patch_top_set(unit, port, pPatch_data->sram_p, pPatch_data->sram_rw, pPatch_data->sram_a), ret);
+            RT_ERR_CHK(_phy_rtl826xb_patch_top_get(unit, port, pPatch_data->sram_p, pPatch_data->sram_rr, &rData), ret);
+            PHYPATCH_COMPARE(pPatch_data->pagemmd, pPatch_data->addr, pPatch_data->msb, pPatch_data->lsb, pPatch_data->data, rData, mask);
+            break;
+
+        case RTK_PATCH_OP_PSDS0:
+            if ((pPatch_data->msb != 15) || (pPatch_data->lsb != 0))
+            {
+                RT_ERR_CHK(_phy_rtl826xb_patch_sds_get(unit, port, pPatch_data->pagemmd, pPatch_data->addr, &rData), ret);
+            }
+            wData = REG32_FIELD_SET(rData, pPatch_data->data, pPatch_data->lsb, mask);
+            RT_ERR_CHK(_phy_rtl826xb_patch_sds_set(unit, port, pPatch_data->pagemmd, pPatch_data->addr, wData, patch_mode), ret);
+            break;
+        case RTK_PATCH_OP_CMP_PSDS0:
+            RT_ERR_CHK(_phy_rtl826xb_patch_sds_get(unit, port, pPatch_data->pagemmd, pPatch_data->addr, &rData), ret);
+            PHYPATCH_COMPARE(pPatch_data->pagemmd, pPatch_data->addr, pPatch_data->msb, pPatch_data->lsb, pPatch_data->data, rData, mask);
+            break;
+        case RTK_PATCH_OP_CMP_SRAM_PSDS0:
+            RT_ERR_CHK(_phy_rtl826xb_patch_sds_set(unit, port, pPatch_data->sram_p, pPatch_data->sram_rw, pPatch_data->sram_a, patch_mode), ret);
+            RT_ERR_CHK(_phy_rtl826xb_patch_sds_get(unit, port, pPatch_data->sram_p, pPatch_data->sram_rr, &rData), ret);
+            PHYPATCH_COMPARE(pPatch_data->pagemmd, pPatch_data->addr, pPatch_data->msb, pPatch_data->lsb, pPatch_data->data, rData, mask);
+            break;
+
+        case RTK_PATCH_OP_SKIP:
+            return RT_ERR_ABORT;
+
+        default:
+            RT_LOG(LOG_MAJOR_ERR, (MOD_HAL | MOD_PHY), "U%u P%u patch_op:%u not implemented yet!\n", unit, port, pPatch_data->patch_op);
+            return RT_ERR_DRIVER_NOT_SUPPORTED;
+    }
+
+    return ret;
+}
+
+int32 phy_rtl826xb_patch_flow(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 patch_flow, uint8 patch_mode)
+{
+    int32 ret = RT_ERR_OK;
+
+    RT_LOG(LOG_INFO, (MOD_HAL | MOD_PHY), "[%s]U%u,P%u,flow%u\n", __FUNCTION__, unit, port, (patch_flow - PHY_PATCH_TYPE_END));
+    switch (patch_flow)
+    {
+        case RTK_PATCH_TYPE_FLOW(0):
+            RT_ERR_CHK(_phy_rtl826xb_flow_r1(unit, port, portOffset, patch_mode), ret);
+            break;
+        case RTK_PATCH_TYPE_FLOW(1):
+            RT_ERR_CHK(_phy_rtl826xb_flow_r2(unit, port, portOffset, patch_mode), ret);
+            break;
+
+        case RTK_PATCH_TYPE_FLOW(2):
+            RT_ERR_CHK(_phy_rtl826xb_flow_l1(unit, port, portOffset, patch_mode), ret);
+            break;
+        case RTK_PATCH_TYPE_FLOW(3):
+            RT_ERR_CHK(_phy_rtl826xb_flow_l2(unit, port, portOffset, patch_mode), ret);
+            break;
+
+        case RTK_PATCH_TYPE_FLOW(4):
+            RT_ERR_CHK(_phy_rtl826xb_flow_n01(unit, port, portOffset, patch_mode), ret);
+            break;
+        case RTK_PATCH_TYPE_FLOW(5):
+            RT_ERR_CHK(_phy_rtl826xb_flow_n02(unit, port, portOffset, patch_mode), ret);
+            break;
+
+        case RTK_PATCH_TYPE_FLOW(6):
+            RT_ERR_CHK(_phy_rtl826xb_flow_n11(unit, port, portOffset, patch_mode), ret);
+            break;
+        case RTK_PATCH_TYPE_FLOW(7):
+            RT_ERR_CHK(_phy_rtl826xb_flow_n12(unit, port, portOffset, patch_mode), ret);
+            break;
+
+        case RTK_PATCH_TYPE_FLOW(8):
+            RT_ERR_CHK(_phy_rtl826xb_flow_n21(unit, port, portOffset, patch_mode), ret);
+            break;
+        case RTK_PATCH_TYPE_FLOW(9):
+            RT_ERR_CHK(_phy_rtl826xb_flow_n22(unit, port, portOffset, patch_mode), ret);
+            break;
+
+        case RTK_PATCH_TYPE_FLOW(10):
+            RT_ERR_CHK(_phy_rtl826xb_flow_s(unit, port, portOffset, patch_mode), ret);
+            break;
+
+        case RTK_PATCH_TYPE_FLOW(11):
+            RT_ERR_CHK(_phy_rtl826xb_flow_pi(unit, port, portOffset, patch_mode), ret);
+            break;
+        case RTK_PATCH_TYPE_FLOW(12):
+            RT_ERR_CHK(_phy_rtl826xb_flow_r12(unit, port, portOffset, patch_mode), ret);
+            break;
+
+        default:
+            return RT_ERR_INPUT;
+    }
+    return RT_ERR_OK;
+}
+
+int32 phy_rtl826xb_patch_db_init(uint32 unit, rtk_port_t port, rt_phy_patch_db_t **pPhy_patchDb)
+{
+    int32 ret = RT_ERR_OK;
+    rt_phy_patch_db_t *patch_db = NULL;
+    uint32 rData = 0;
+
+    patch_db = osal_alloc(sizeof(rt_phy_patch_db_t));
+    RT_PARAM_CHK(NULL == patch_db, RT_ERR_MEM_ALLOC);
+    osal_memset(patch_db, 0x0, sizeof(rt_phy_patch_db_t));
+
+    /* patch callback */
+    patch_db->fPatch_op = phy_rtl826xb_patch_op;
+    patch_db->fPatch_flow = phy_rtl826xb_patch_flow;
+
+    /* patch table */
+    RT_ERR_CHK(phy_common_general_reg_mmd_get(unit, port, 30, 0x104, &rData), ret);
+    if ((rData & 0x7) == 0x0)
+    {
+        /* patch */
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  0, RTK_PATCH_TYPE_FLOW(12), NULL);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  1, PHY_PATCH_TYPE_NCTL0, rtl8264b_nctl0_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  2, PHY_PATCH_TYPE_NCTL1, rtl8264b_nctl1_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  3, PHY_PATCH_TYPE_NCTL2, rtl8264b_nctl2_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  4, PHY_PATCH_TYPE_UC2, rtl8264b_uc2_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  5, PHY_PATCH_TYPE_UC, rtl8264b_uc_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  6, PHY_PATCH_TYPE_DATARAM, rtl8264b_dataram_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  7, RTK_PATCH_TYPE_FLOW(1), NULL);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  8, RTK_PATCH_TYPE_FLOW(2), NULL);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  9, PHY_PATCH_TYPE_ALGXG, rtl8264b_algxg_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db, 10, PHY_PATCH_TYPE_ALG1G, rtl8264b_alg_giga_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db, 11, PHY_PATCH_TYPE_NORMAL, rtl8264b_normal_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db, 12, PHY_PATCH_TYPE_TOP, rtl8264b_top_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db, 13, PHY_PATCH_TYPE_SDS, rtl8264b_sds_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db, 14, PHY_PATCH_TYPE_AFE, rtl8264b_afe_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db, 15, PHY_PATCH_TYPE_RTCT, rtl8264b_rtct_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db, 16, RTK_PATCH_TYPE_FLOW(3), NULL);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db, 17, RTK_PATCH_TYPE_FLOW(11), NULL);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db, 18, RTK_PATCH_TYPE_FLOW(10), NULL);
+
+        /* compare */
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  0, PHY_PATCH_TYPE_TOP, rtl8264b_top_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  1, PHY_PATCH_TYPE_SDS, rtl8264b_sds_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  2, PHY_PATCH_TYPE_AFE, rtl8264b_afe_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  3, RTK_PATCH_TYPE_FLOW(4), NULL);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  4, PHY_PATCH_TYPE_NCTL0, rtl8264b_nctl0_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  5, RTK_PATCH_TYPE_FLOW(5), NULL);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  6, RTK_PATCH_TYPE_FLOW(6), NULL);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  7, PHY_PATCH_TYPE_NCTL1, rtl8264b_nctl1_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  8, RTK_PATCH_TYPE_FLOW(7), NULL);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  9, RTK_PATCH_TYPE_FLOW(8), NULL);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 10, PHY_PATCH_TYPE_NCTL2, rtl8264b_nctl2_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 11, RTK_PATCH_TYPE_FLOW(9), NULL);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 12, PHY_PATCH_TYPE_UC, rtl8264b_uc_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 13, PHY_PATCH_TYPE_UC2, rtl8264b_uc2_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 14, RTK_PATCH_TYPE_FLOW(12), NULL);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 15, PHY_PATCH_TYPE_DATARAM, rtl8264b_dataram_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 16, RTK_PATCH_TYPE_FLOW(1), NULL);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 17, PHY_PATCH_TYPE_ALGXG, rtl8264b_algxg_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 18, PHY_PATCH_TYPE_ALG1G, rtl8264b_alg_giga_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 19, PHY_PATCH_TYPE_NORMAL, rtl8264b_normal_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 20, PHY_PATCH_TYPE_RTCT, rtl8264b_rtct_conf);
+    }
+    else
+    {
+        /* patch */
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  0, RTK_PATCH_TYPE_FLOW(0), NULL);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  1, PHY_PATCH_TYPE_NCTL0, rtl8261n_c_nctl0_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  2, PHY_PATCH_TYPE_NCTL1, rtl8261n_c_nctl1_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  3, PHY_PATCH_TYPE_NCTL2, rtl8261n_c_nctl2_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  4, PHY_PATCH_TYPE_UC2, rtl8261n_c_uc2_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  5, PHY_PATCH_TYPE_UC, rtl8261n_c_uc_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  6, PHY_PATCH_TYPE_DATARAM, rtl8261n_c_dataram_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  7, RTK_PATCH_TYPE_FLOW(1), NULL);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  8, RTK_PATCH_TYPE_FLOW(2), NULL);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db,  9, PHY_PATCH_TYPE_ALGXG, rtl8261n_c_algxg_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db, 10, PHY_PATCH_TYPE_ALG1G, rtl8261n_c_alg_giga_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db, 11, PHY_PATCH_TYPE_NORMAL, rtl8261n_c_normal_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db, 12, PHY_PATCH_TYPE_TOP, rtl8261n_c_top_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db, 13, PHY_PATCH_TYPE_SDS, rtl8261n_c_sds_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db, 14, PHY_PATCH_TYPE_AFE, rtl8261n_c_afe_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db, 15, PHY_PATCH_TYPE_RTCT, rtl8261n_c_rtct_conf);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db, 16, RTK_PATCH_TYPE_FLOW(3), NULL);
+        PHYPATCH_SEQ_TABLE_ASSIGN(patch_db, 17, RTK_PATCH_TYPE_FLOW(10), NULL);
+
+        /* compare */
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  0, PHY_PATCH_TYPE_TOP, rtl8261n_c_top_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  1, PHY_PATCH_TYPE_SDS, rtl8261n_c_sds_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  2, PHY_PATCH_TYPE_AFE, rtl8261n_c_afe_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  3, RTK_PATCH_TYPE_FLOW(4), NULL);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  4, PHY_PATCH_TYPE_NCTL0, rtl8261n_c_nctl0_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  5, RTK_PATCH_TYPE_FLOW(5), NULL);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  6, RTK_PATCH_TYPE_FLOW(6), NULL);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  7, PHY_PATCH_TYPE_NCTL1, rtl8261n_c_nctl1_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  8, RTK_PATCH_TYPE_FLOW(7), NULL);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db,  9, RTK_PATCH_TYPE_FLOW(8), NULL);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 10, PHY_PATCH_TYPE_NCTL2, rtl8261n_c_nctl2_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 11, RTK_PATCH_TYPE_FLOW(9), NULL);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 12, PHY_PATCH_TYPE_UC, rtl8261n_c_uc_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 13, PHY_PATCH_TYPE_UC2, rtl8261n_c_uc2_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 14, RTK_PATCH_TYPE_FLOW(0), NULL);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 15, PHY_PATCH_TYPE_DATARAM, rtl8261n_c_dataram_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 16, RTK_PATCH_TYPE_FLOW(1), NULL);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 17, PHY_PATCH_TYPE_ALGXG, rtl8261n_c_algxg_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 18, PHY_PATCH_TYPE_ALG1G, rtl8261n_c_alg_giga_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 19, PHY_PATCH_TYPE_NORMAL, rtl8261n_c_normal_conf);
+        PHYPATCH_CMP_TABLE_ASSIGN(patch_db, 20, PHY_PATCH_TYPE_RTCT, rtl8261n_c_rtct_conf);
+    }
+    *pPhy_patchDb = patch_db;
+    return ret;
+}
+
+/* Function Name:
+ *      phy_rtl826xb_patch
+ * Description:
+ *      apply initial patch data to PHY
+ * Input:
+ *      unit       - unit id
+ *      baseport   - base port id on the PHY chip
+ *      portOffset - the index offset base on baseport for the port to patch
+ * Output:
+ *      None
+ * Return:
+ *      RT_ERR_OK
+ *      RT_ERR_FAILED
+ *      RT_ERR_NOT_SUPPORTED
+ *      RT_ERR_ABORT
+ * Note:
+ *      None
+ */
+int32 phy_rtl826xb_patch(uint32 unit, rtk_port_t port, uint8 portOffset)
+{
+    return phy_patch( unit, port, portOffset, PHY_PATCH_MODE_NORMAL);
+}
+
+/* Function Name:
+ *      phy_rtl826xb_broadcast_patch
+ * Description:
+ *      apply patch data to PHY
+ * Input:
+ *      unit       - unit id
+ *      baseport   - base port id on the PHY chip
+ *      portOffset - the index offset base on baseport for the port to patch
+ *      perChip    - 1 for per-chip mode, 0 for per-bus mode
+ * Output:
+ *      None
+ * Return:
+ *      RT_ERR_OK
+ *      RT_ERR_FAILED
+ *      RT_ERR_NOT_SUPPORTED
+ *      RT_ERR_ABORT
+ * Note:
+ *      None
+ */
+int32 phy_rtl826xb_broadcast_patch(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 perChip)
+{
+    int32 ret = 0;
+    if (perChip == 0)
+    {
+        ret = phy_patch(unit, port, portOffset, PHY_PATCH_MODE_BCAST_BUS);
+    }
+    else
+    {
+        ret = phy_patch(unit, port, portOffset, PHY_PATCH_MODE_BCAST);
+    }
+    return ret;
+}
+
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/phy_rtl826xb_patch.h b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/phy_rtl826xb_patch.h
new file mode 100644
index 00000000000000..c2311ef2bf46d9
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/phy_rtl826xb_patch.h
@@ -0,0 +1,63 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2023 Realtek Semiconductor Corp. All rights reserved.
+ */
+
+#ifndef __HAL_PHY_PHY_RTL826XB_PATCH_H__
+#define __HAL_PHY_PHY_RTL826XB_PATCH_H__
+
+/*
+ * Include Files
+ */
+#if defined(RTK_PHYDRV_IN_LINUX)
+  #include "rtk_osal.h"
+  #include "rtk_phylib_def.h"
+#else
+  #include <common/rt_type.h>
+  #include <rtk/port.h>
+#endif
+
+/* Function Name:
+ *      phy_rtl826xb_patch
+ * Description:
+ *      apply patch data to PHY
+ * Input:
+ *      unit       - unit id
+ *      baseport   - base port id on the PHY chip
+ *      portOffset - the index offset base on baseport for the port to patch
+ * Output:
+ *      None
+ * Return:
+ *      RT_ERR_OK
+ *      RT_ERR_FAILED
+ *      RT_ERR_NOT_SUPPORTED
+ *      RT_ERR_ABORT
+ * Note:
+ *      None
+ */
+extern int32 phy_rtl826xb_patch(uint32 unit, rtk_port_t baseport, uint8 portOffset);
+
+/* Function Name:
+ *      phy_rtl826xb_broadcast_patch
+ * Description:
+ *      apply patch data to PHY
+ * Input:
+ *      unit       - unit id
+ *      baseport   - base port id on the PHY chip
+ *      portOffset - the index offset base on baseport for the port to patch
+ *      perChip    - 1 for per-chip mode, 0 for per-bus mode
+ * Output:
+ *      None
+ * Return:
+ *      RT_ERR_OK
+ *      RT_ERR_FAILED
+ *      RT_ERR_NOT_SUPPORTED
+ *      RT_ERR_ABORT
+ * Note:
+ *      None
+ */
+extern int32 phy_rtl826xb_broadcast_patch(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 perChip);
+
+extern int32 phy_rtl826xb_patch_db_init(uint32 unit, rtk_port_t port, rt_phy_patch_db_t **pPhy_patchDb);
+#endif /* __HAL_PHY_PHY_RTL826XB_PATCH_H__ */
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_osal.c b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_osal.c
new file mode 100644
index 00000000000000..bf3ac4b12447c8
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_osal.c
@@ -0,0 +1,56 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2023 Realtek Semiconductor Corp. All rights reserved.
+ */
+
+#include "type.h"
+#include "error.h"
+#include "rtk_phylib_def.h"
+
+#include <linux/version.h>
+#include <linux/jiffies.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/sched.h>
+#include <linux/wait.h>
+#include <linux/sched/signal.h>
+#include <linux/phy.h>
+
+int32
+osal_time_usecs_get(osal_usecs_t *pUsec)
+{
+    struct timespec64 ts;
+
+    RT_PARAM_CHK((NULL == pUsec), RT_ERR_NULL_POINTER);
+
+    ktime_get_ts64(&ts);
+    *pUsec = (osal_usecs_t)((ts.tv_sec * USEC_PER_SEC) + (ts.tv_nsec / NSEC_PER_USEC));
+    return RT_ERR_OK;
+}
+
+void *
+osal_alloc(uint32 size)
+{
+    void *p;
+    p = kmalloc((size_t)size, GFP_ATOMIC);
+    return p;
+}
+
+int32
+phy_common_general_reg_mmd_get(uint32 unit, rtk_port_t port, uint32 mmdAddr, uint32 mmdReg, uint32 *pData)
+{
+    int32 rData = 0;
+    rData = phy_read_mmd(port, mmdAddr, mmdReg);
+    if (rData < 0)
+        return RT_ERR_FAILED;
+    *pData = (uint32)rData;
+    return RT_ERR_OK;
+}
+
+int32
+phy_common_general_reg_mmd_set(uint32 unit, rtk_port_t port, uint32 mmdAddr, uint32 mmdReg, uint32 data)
+{
+    int ret = phy_write_mmd(port, mmdAddr, mmdReg, data);
+    return (ret < 0) ? RT_ERR_FAILED : RT_ERR_OK;
+}
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_osal.h b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_osal.h
new file mode 100644
index 00000000000000..edf674611efdae
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_osal.h
@@ -0,0 +1,99 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2023 Realtek Semiconductor Corp. All rights reserved.
+ */
+
+#ifndef __RTK_PHY_OSAL_H
+#define __RTK_PHY_OSAL_H
+
+#include <linux/kernel.h>
+#include <linux/phy.h>
+#include "type.h"
+#include "error.h"
+#include "phy_patch.h"
+#include "rtk_phylib.h"
+
+#ifdef PHYPATCH_DB_GET
+    #undef PHYPATCH_DB_GET
+#endif
+
+#define PHYPATCH_DB_GET(_unit, _pPhy_device, _pPatchDb) \
+    do { \
+        struct rtk_phy_priv *_pPriv = (_pPhy_device)->priv; \
+        rt_phy_patch_db_t *_pDb = _pPriv->patch; _pPatchDb = _pDb; \
+        /*printk("[PHYPATCH_DB_GET] ? [%s]\n", (_pDb != NULL) ? "E":"N");*/ \
+    } while(0)
+
+#define HWP_9300_FAMILY_ID(_unit)       0
+#define HWP_9310_FAMILY_ID(_unit)       0
+#define RTK_9300_FAMILY_ID(_unit)       0
+#define RTK_9310_FAMILY_ID(_unit)       0
+#define RTK_9311B_FAMILY_ID(_unit)      0
+#define RTK_9330_FAMILY_ID(_unit)       0
+
+#ifndef WAIT_COMPLETE_VAR
+#define WAIT_COMPLETE_VAR() \
+    osal_usecs_t    _t, _now, _t_wait=0, _timeout;  \
+    int32           _chkCnt=0;
+
+#define WAIT_COMPLETE(_timeout_us)     \
+    _timeout = _timeout_us;  \
+    for(osal_time_usecs_get(&_t),osal_time_usecs_get(&_now),_t_wait=0,_chkCnt=0 ; \
+        (_t_wait <= _timeout); \
+        osal_time_usecs_get(&_now), _chkCnt++, _t_wait += ((_now >= _t) ? (_now - _t) : (0xFFFFFFFF - _t + _now)),_t = _now \
+       )
+
+#define WAIT_COMPLETE_IS_TIMEOUT()   (_t_wait > _timeout)
+#endif
+
+/* OSAL */
+#include <linux/slab.h>
+int32 osal_time_usecs_get(osal_usecs_t *pUsec);
+void *osal_alloc(uint32 size);
+#define osal_time_mdelay  mdelay
+
+#include <linux/ctype.h>    /* for Kernel Space */
+#include <linux/kernel.h>
+#include <linux/string.h>
+#define osal_strlen   strlen
+#define osal_strcmp   strcmp
+#define osal_strcpy   strcpy
+#define osal_strncpy  strncpy
+#define osal_strcat   strcat
+#define osal_strchr   strchr
+#define osal_memset   memset
+#define osal_memcpy   memcpy
+#define osal_memcmp   memcmp
+#define osal_strdup   strdup
+#define osal_strncmp  strncmp
+#define osal_strstr   strstr
+#define osal_strtok   strtok
+#define osal_strtok_r   strtok_r
+#define osal_toupper  toupper
+
+#define osal_printf   printk
+
+/* HWP */
+#define HWP_PORT_SMI(unit, port)               0
+#define HWP_PHY_MODEL_BY_PORT(unit, port)      0
+#define HWP_PHY_ADDR(unit, port)               0
+#define HWP_PHY_BASE_MACID(unit, p)            0
+#define HWP_PORT_TRAVS_EXCEPT_CPU(unit, p)     if (bcast_phyad < 0x1F && p != NULL)
+
+
+/* RT_LOG */
+//#define RT_LOG(level, module, fmt, args...)               do { printk("RT_LOG:"fmt, ## args); } while(0)
+#define RT_LOG(level, module, fmt, args...)               do {} while(0)
+#define RT_ERR(error_code, module, fmt, args...)          do {} while(0)
+#define RT_INIT_ERR(error_code, module, fmt, args...)     do {} while(0)
+#define RT_INIT_MSG(fmt, args...)                         do {} while(0)
+
+#define phy_826xb_ctrl_set(unit, p, RTK_PHY_CTRL_MIIM_BCAST_PHYAD, bcast_phyad)  0
+
+/* reg access */
+int32 phy_common_general_reg_mmd_get(uint32 unit, rtk_port_t port, uint32 mmdAddr, uint32 mmdReg, uint32 *pData);
+int32 phy_common_general_reg_mmd_set(uint32 unit, rtk_port_t port, uint32 mmdAddr, uint32 mmdReg, uint32 data);
+
+
+#endif /* __RTK_PHY_OSAL_H */
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_phy.c b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_phy.c
new file mode 100644
index 00000000000000..2818a2736b73bc
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_phy.c
@@ -0,0 +1,282 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2023 Realtek Semiconductor Corp. All rights reserved.
+ */
+
+#include <linux/module.h>
+#include <linux/phy.h>
+
+#include "phy_rtl826xb_patch.h"
+#include "rtk_phylib_rtl826xb.h"
+#include "rtk_phylib.h"
+
+#define REALTEK_PHY_ID_RTL8261N         0x001CCAF3
+#define REALTEK_PHY_ID_RTL8264B         0x001CC813
+
+static int rtl826xb_get_features(struct phy_device *phydev)
+{
+    int ret;
+    ret = genphy_c45_pma_read_abilities(phydev);
+    if (ret)
+        return ret;
+
+    linkmode_or(phydev->supported, phydev->supported, PHY_BASIC_FEATURES);
+
+
+    linkmode_set_bit(ETHTOOL_LINK_MODE_2500baseT_Full_BIT,
+                       phydev->supported);
+    linkmode_set_bit(ETHTOOL_LINK_MODE_5000baseT_Full_BIT,
+                       phydev->supported);
+
+    /* not support 10M modes */
+    linkmode_clear_bit(ETHTOOL_LINK_MODE_10baseT_Half_BIT,
+                       phydev->supported);
+    linkmode_clear_bit(ETHTOOL_LINK_MODE_10baseT_Full_BIT,
+                       phydev->supported);
+
+    return 0;
+}
+
+static int rtl826xb_probe(struct phy_device *phydev)
+{
+    struct rtk_phy_priv *priv = NULL;
+
+    priv = devm_kzalloc(&phydev->mdio.dev, sizeof(struct rtk_phy_priv), GFP_KERNEL);
+    if (!priv)
+    {
+        return -ENOMEM;
+    }
+    memset(priv, 0, sizeof(struct rtk_phy_priv));
+
+    if (phy_rtl826xb_patch_db_init(0, phydev, &(priv->patch)) != RT_ERR_OK)
+        return -ENOMEM;
+
+    priv->phytype = (phydev->drv->phy_id == REALTEK_PHY_ID_RTL8261N) ? (RTK_PHYLIB_RTL8261N) : (RTK_PHYLIB_RTL8264B);
+    priv->isBasePort = (phydev->drv->phy_id == REALTEK_PHY_ID_RTL8261N) ? (1) : (((phydev->mdio.addr % 4) == 0) ? (1) : (0));
+    phydev->priv = priv;
+
+    return 0;
+}
+
+static int rtkphy_config_init(struct phy_device *phydev)
+{
+    int ret = 0;
+    switch (phydev->drv->phy_id)
+    {
+        case REALTEK_PHY_ID_RTL8261N:
+        case REALTEK_PHY_ID_RTL8264B:
+            phydev_info(phydev, "%s:%u [RTL8261N/RTL826XB] phy_id: 0x%X PHYAD:%d\n", __FUNCTION__, __LINE__, phydev->drv->phy_id, phydev->mdio.addr);
+
+
+          #if 1 /* toggle reset */
+            phy_modify_mmd_changed(phydev, 30, 0x145, BIT(0)  , 1);
+            phy_modify_mmd_changed(phydev, 30, 0x145, BIT(0)  , 0);
+            mdelay(30);
+          #endif
+
+            ret = phy_patch(0, phydev, 0, PHY_PATCH_MODE_NORMAL);
+            if (ret)
+            {
+                phydev_err(phydev, "%s:%u [RTL8261N/RTL826XB] patch failed!! 0x%X\n", __FUNCTION__, __LINE__, ret);
+                return ret;
+            }
+          #if 0 /* Debug: patch check */
+            ret = phy_patch(0, phydev, 0, PHY_PATCH_MODE_CMP);
+            if (ret)
+            {
+                phydev_err(phydev, "%s:%u [RTL8261N/RTL826XB] phy_patch failed!! 0x%X\n", __FUNCTION__, __LINE__, ret);
+                return ret;
+            }
+            printk("[%s,%u] patch chk %s\n", __FUNCTION__, __LINE__, (ret == 0) ? "PASS" : "FAIL");
+          #endif
+          #if 0 /* Debug: USXGMII*/
+            {
+                uint32 data = 0;
+                rtk_phylib_826xb_sds_read(phydev, 0x07, 0x10, 15, 0, &data);
+                printk("[%s,%u] SDS 0x07, 0x10 : 0x%X\n", __FUNCTION__, __LINE__, data);
+                rtk_phylib_826xb_sds_read(phydev, 0x06, 0x12, 15, 0, &data);
+                printk("[%s,%u] SDS 0x06, 0x12 : 0x%X\n", __FUNCTION__, __LINE__, data);
+            }
+            {
+                u16 sdspage = 0x5, sdsreg = 0x0;
+                u16 regData = (sdspage & 0x3f) | ((sdsreg & 0x1f) << 6) | BIT(15);
+                u16 readData = 0;
+                phy_write_mmd(phydev, 30, 323, regData);
+                do
+                {
+                    udelay(10);
+                    readData = phy_read_mmd(phydev, 30, 323);
+                } while ((readData & BIT(15)) != 0);
+                readData = phy_read_mmd(phydev, 30, 322);
+                printk("[%s,%d] sds link [%s] (0x%X)\n", __FUNCTION__, __LINE__, (readData & BIT(12)) ? "UP" : "DOWN", readData);
+            }
+          #endif
+
+            break;
+        default:
+            phydev_err(phydev, "%s:%u Unknow phy_id: 0x%X\n", __FUNCTION__, __LINE__, phydev->drv->phy_id);
+            return -EPERM;
+    }
+
+    return ret;
+}
+
+static int rtkphy_c45_suspend(struct phy_device *phydev)
+{
+    int ret = 0;
+
+    ret = rtk_phylib_c45_power_low(phydev);
+
+    phydev->speed = SPEED_UNKNOWN;
+    phydev->duplex = DUPLEX_UNKNOWN;
+    phydev->pause = 0;
+    phydev->asym_pause = 0;
+
+    return ret;
+}
+
+static int rtkphy_c45_resume(struct phy_device *phydev)
+{
+    return rtk_phylib_c45_power_normal(phydev);
+}
+
+static int rtkphy_c45_config_aneg(struct phy_device *phydev)
+{
+    bool changed = false;
+    u16 reg = 0;
+    int ret = 0;
+
+    phydev->mdix_ctrl = ETH_TP_MDI_AUTO;
+    if (phydev->autoneg == AUTONEG_DISABLE)
+        return genphy_c45_pma_setup_forced(phydev);
+
+    ret = genphy_c45_an_config_aneg(phydev);
+    if (ret < 0)
+        return ret;
+    if (ret > 0)
+        changed = true;
+
+    reg = 0;
+    if (linkmode_test_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT,
+                  phydev->advertising))
+        reg |= BIT(9);
+
+    if (linkmode_test_bit(ETHTOOL_LINK_MODE_1000baseT_Half_BIT,
+                  phydev->advertising))
+        reg |= BIT(8);
+
+    ret = phy_modify_mmd_changed(phydev, MDIO_MMD_VEND2, 0xA412,
+                     BIT(9) | BIT(8) , reg);
+    if (ret < 0)
+        return ret;
+    if (ret > 0)
+        changed = true;
+
+    return genphy_c45_check_and_restart_aneg(phydev, changed);
+}
+
+static int rtkphy_c45_aneg_done(struct phy_device *phydev)
+{
+    return genphy_c45_aneg_done(phydev);
+}
+
+static int rtkphy_c45_read_status(struct phy_device *phydev)
+{
+    int ret = 0, status = 0;
+    phydev->speed = SPEED_UNKNOWN;
+    phydev->duplex = DUPLEX_UNKNOWN;
+    phydev->pause = 0;
+    phydev->asym_pause = 0;
+
+    ret = genphy_c45_read_link(phydev);
+    if (ret)
+        return ret;
+
+    if (phydev->autoneg == AUTONEG_ENABLE)
+    {
+        linkmode_clear_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT,
+           phydev->lp_advertising);
+
+        ret = genphy_c45_read_lpa(phydev);
+        if (ret)
+            return ret;
+
+        status =  phy_read_mmd(phydev, 31, 0xA414);
+        if (status < 0)
+            return status;
+        linkmode_mod_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT,
+            phydev->lp_advertising, status & BIT(11));
+
+        phy_resolve_aneg_linkmode(phydev);
+    }
+    else
+    {
+        ret = genphy_c45_read_pma(phydev);
+    }
+
+    /* mdix*/
+    status = phy_read_mmd(phydev, MDIO_MMD_PMAPMD, MDIO_PMA_10GBT_SWAPPOL);
+    if (status < 0)
+        return status;
+
+    switch (status & 0x3)
+    {
+        case MDIO_PMA_10GBT_SWAPPOL_ABNX | MDIO_PMA_10GBT_SWAPPOL_CDNX:
+            phydev->mdix = ETH_TP_MDI;
+            break;
+
+        case 0:
+            phydev->mdix = ETH_TP_MDI_X;
+            break;
+
+        default:
+            phydev->mdix = ETH_TP_MDI_INVALID;
+            break;
+    }
+
+    return ret;
+}
+
+
+static struct phy_driver rtk_phy_drivers[] = {
+    {
+        PHY_ID_MATCH_EXACT(REALTEK_PHY_ID_RTL8261N),
+        .name               = "Realtek RTL8261N",
+        .get_features       = rtl826xb_get_features,
+        .config_init        = rtkphy_config_init,
+        .probe              = rtl826xb_probe,
+        .suspend            = rtkphy_c45_suspend,
+        .resume             = rtkphy_c45_resume,
+        .config_aneg        = rtkphy_c45_config_aneg,
+        .aneg_done          = rtkphy_c45_aneg_done,
+        .read_status        = rtkphy_c45_read_status,
+    },
+    {
+        PHY_ID_MATCH_EXACT(REALTEK_PHY_ID_RTL8264B),
+        .name               = "Realtek RTL8264B",
+        .get_features       = rtl826xb_get_features,
+        .config_init        = rtkphy_config_init,
+        .probe              = rtl826xb_probe,
+        .suspend            = rtkphy_c45_suspend,
+        .resume             = rtkphy_c45_resume,
+        .config_aneg        = rtkphy_c45_config_aneg,
+        .aneg_done          = rtkphy_c45_aneg_done,
+        .read_status        = rtkphy_c45_read_status,
+    },
+};
+
+module_phy_driver(rtk_phy_drivers);
+
+
+static struct mdio_device_id __maybe_unused rtk_phy_tbl[] = {
+    { PHY_ID_MATCH_EXACT(REALTEK_PHY_ID_RTL8261N) },
+    { PHY_ID_MATCH_EXACT(REALTEK_PHY_ID_RTL8264B) },
+    { },
+};
+
+MODULE_DEVICE_TABLE(mdio, rtk_phy_tbl);
+
+MODULE_AUTHOR("Realtek");
+MODULE_DESCRIPTION("Realtek PHY drivers");
+MODULE_LICENSE("GPL");
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_phylib.c b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_phylib.c
new file mode 100644
index 00000000000000..7dd593ce72df27
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_phylib.c
@@ -0,0 +1,108 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2023 Realtek Semiconductor Corp. All rights reserved.
+ */
+
+#include "rtk_phylib.h"
+#include <linux/phy.h>
+
+
+/* OSAL */
+
+void rtk_phylib_mdelay(uint32 msec)
+{
+#if defined(RTK_PHYDRV_IN_LINUX)
+    mdelay(msec);
+#else
+    osal_time_mdelay(msec);
+#endif
+}
+
+
+void rtk_phylib_udelay(uint32 usec)
+{
+#if defined(RTK_PHYDRV_IN_LINUX)
+    if (1000 <= usec)
+    {
+        mdelay(usec/1000);
+        usec = usec % 1000;
+    }
+    udelay(usec);
+#else
+    osal_time_udelay(usec);
+#endif
+}
+
+
+/* Register Access APIs */
+int32 rtk_phylib_mmd_write(rtk_phydev *phydev, uint32 mmd, uint32 reg, uint8 msb, uint8 lsb, uint32 data)
+{
+    int32  ret = 0;
+    uint32 mask = 0;
+    mask = UINT32_BITS_MASK(msb,lsb);
+
+#if defined(RTK_PHYDRV_IN_LINUX)
+    ret = phy_modify_mmd(phydev, mmd, reg, mask, data);
+#else
+    {
+        uint32 rData = 0, wData = 0;
+        if ((msb != 15) || (lsb != 0))
+        {
+            if ((ret = phy_common_general_reg_mmd_get(phydev->unit, phydev->port, page, reg, &rData)) != RT_ERR_OK)
+                return ret;
+        }
+        wData = REG32_FIELD_SET(rData, data, lsb, mask);
+        ret = phy_common_general_reg_mmd_set(phydev->unit, phydev->port, page, reg, wData);
+    }
+#endif
+
+    return ret;
+}
+
+int32 rtk_phylib_mmd_read(rtk_phydev *phydev, uint32 mmd, uint32 reg, uint8 msb, uint8 lsb, uint32 *pData)
+{
+    int32  ret = 0;
+    uint32 rData = 0;
+    uint32 mask = 0;
+    mask = UINT32_BITS_MASK(msb,lsb);
+
+#if defined(RTK_PHYDRV_IN_LINUX)
+    rData =  phy_read_mmd(phydev, mmd, reg);
+#else
+    {
+        ret = phy_common_general_reg_mmd_get(phydev->unit, phydev->port, page, reg, &rData);
+    }
+#endif
+
+    *pData = REG32_FIELD_GET(rData, lsb, mask);
+    return ret;
+}
+
+/* Function Driver */
+
+int32 rtk_phylib_c45_power_normal(rtk_phydev *phydev)
+{
+    int32  ret = 0;
+    RTK_PHYLIB_ERR_CHK(rtk_phylib_mmd_write(phydev, 1, 0, 11, 11, 0));
+
+    return 0;
+}
+
+int32 rtk_phylib_c45_power_low(rtk_phydev *phydev)
+{
+    int32  ret = 0;
+    RTK_PHYLIB_ERR_CHK(rtk_phylib_mmd_write(phydev, 1, 0, 11, 11, 1));
+
+    return 0;
+}
+
+int32 rtk_phylib_c45_pcs_loopback(rtk_phydev *phydev, uint32 enable)
+{
+    int32  ret = 0;
+    RTK_PHYLIB_ERR_CHK(rtk_phylib_mmd_write(phydev, 3, 0, 14, 14, (enable == 0) ? 0 : 1));
+
+    return 0;
+}
+
+
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_phylib.h b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_phylib.h
new file mode 100644
index 00000000000000..70eb8e48edc90f
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_phylib.h
@@ -0,0 +1,101 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2023 Realtek Semiconductor Corp. All rights reserved.
+ */
+
+#ifndef __RTK_PHYLIB_H
+#define __RTK_PHYLIB_H
+
+#if defined(RTK_PHYDRV_IN_LINUX)
+  #include "type.h"
+  #include "rtk_phylib_def.h"
+#else
+  //#include SDK headers
+#endif
+
+#if defined(RTK_PHYDRV_IN_LINUX)
+  #define PR_INFO(_fmt, _args...) pr_info(_fmt, ##_args)
+  #define PR_DBG(_fmt, _args...)  pr_debug(_fmt, ##_args)
+  #define PR_ERR(_fmt, _args...)  pr_err("ERROR: "_fmt, ##_args)
+
+  #define RTK_PHYLIB_ERR_FAILED             (-EPERM)
+  #define RTK_PHYLIB_ERR_INPUT              (-EINVAL)
+  #define RTK_PHYLIB_ERR_EXCEEDS_CAPACITY   (-ENOSPC)
+  #define RTK_PHYLIB_ERR_TIMEOUT            (-ETIME)
+  #define RTK_PHYLIB_ERR_ENTRY_NOTFOUND     (-ENODATA)
+#else
+  #define PR_INFO(_fmt, _args...) RT_LOG(LOG_INFO, (MOD_HAL|MOD_PHY), _fmt, ##_args)
+  #define PR_DBG(_fmt, _args...)  RT_LOG(LOG_DEBUG, (MOD_HAL|MOD_PHY), _fmt, ##_args)
+  #define PR_ERR(_fmt, _args...)  RT_LOG(LOG_MAJOR_ERR, (MOD_HAL|MOD_PHY), _fmt, ##_args)
+
+  #define RTK_PHYLIB_ERR_FAILED              (RT_ERR_FAILED)
+  #define RTK_PHYLIB_ERR_INPUT               (RT_ERR_INPUT)
+  #define RTK_PHYLIB_ERR_EXCEEDS_CAPACITY    (RT_ERR_EXCEEDS_CAPACITY)
+  #define RTK_PHYLIB_ERR_TIMEOUT             (RT_ERR_BUSYWAIT_TIMEOUT)
+  #define RTK_PHYLIB_ERR_ENTRY_NOTFOUND      (RT_ERR_ENTRY_NOTFOUND)
+#endif
+
+typedef enum rtk_phylib_phy_e
+{
+    RTK_PHYLIB_NONE,
+    RTK_PHYLIB_RTL8261N,
+    RTK_PHYLIB_RTL8264B,
+    RTK_PHYLIB_END
+} rtk_phylib_phy_t;
+
+struct rtk_phy_priv {
+    rtk_phylib_phy_t phytype;
+    uint8 isBasePort;
+    rt_phy_patch_db_t *patch;
+};
+
+#if defined(RTK_PHYDRV_IN_LINUX)
+    typedef struct phy_device rtk_phydev;
+#else
+    struct rtk_phy_dev_s
+    {
+        uint32 unit;
+        rtk_port_t port;
+
+        struct rtk_phy_priv *priv;
+    };
+    typedef struct rtk_phy_dev_s rtk_phydev;
+#endif
+
+#define RTK_PHYLIB_ERR_CHK(op)\
+do {\
+    if ((ret = (op)) != 0)\
+        return ret;\
+} while(0)
+
+#define RTK_PHYLIB_VAL_TO_BYTE_ARRAY(_val, _valbytes, _array, _start, _bytes)\
+do{\
+    uint32 _i = 0;\
+    for (_i = 0; _i < _bytes; _i++)\
+        _array[_start+_i] = (_val >> (8* (_valbytes - _i - 1)));\
+}while(0)
+
+#define RTK_PHYLIB_BYTE_ARRAY_TO_VAL(_val, _array, _start, _bytes)\
+do{\
+    uint32 _i = 0;\
+    for (_i = 0; _i < _bytes; _i++)\
+        _val = (_val << 8) | _array[_start + _i];\
+}while(0)
+
+
+/* OSAL */
+void rtk_phylib_mdelay(uint32 msec);
+void rtk_phylib_udelay(uint32 usec);
+
+/* Register Access APIs */
+int32 rtk_phylib_mmd_write(rtk_phydev *phydev, uint32 mmd, uint32 reg, uint8 msb, uint8 lsb, uint32 data);
+int32 rtk_phylib_mmd_read(rtk_phydev *phydev, uint32 mmd, uint32 reg, uint8 msb, uint8 lsb, uint32 *pData);
+
+/* Function Driver */
+int32 rtk_phylib_c45_power_normal(rtk_phydev *phydev);
+int32 rtk_phylib_c45_power_low(rtk_phydev *phydev);
+int32 rtk_phylib_c45_pcs_loopback(rtk_phydev *phydev, uint32 enable);
+
+
+#endif /* __RTK_PHYLIB_H */
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_phylib_def.h b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_phylib_def.h
new file mode 100644
index 00000000000000..f49f0b547cc3e2
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_phylib_def.h
@@ -0,0 +1,166 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2023 Realtek Semiconductor Corp. All rights reserved.
+ */
+#ifndef __RTK_PHYLIB_DEF_H
+#define __RTK_PHYLIB_DEF_H
+
+#include "type.h"
+
+//#define PHY_C22_MMD_PAGE            0
+#define PHY_C22_MMD_PAGE            0x0A41
+#define PHY_C22_MMD_DEV_REG         13
+#define PHY_C22_MMD_ADD_REG         14
+
+/* MDIO Manageable Device(MDD) address*/
+#define PHY_MMD_PMAPMD              1
+#define PHY_MMD_PCS                 3
+#define PHY_MMD_AN                  7
+#define PHY_MMD_VEND1               30   /* Vendor specific 1 */
+#define PHY_MMD_VEND2               31   /* Vendor specific 2 */
+
+#define BIT_0        0x00000001U
+#define BIT_1        0x00000002U
+#define BIT_2        0x00000004U
+#define BIT_3        0x00000008U
+#define BIT_4        0x00000010U
+#define BIT_5        0x00000020U
+#define BIT_6        0x00000040U
+#define BIT_7        0x00000080U
+#define BIT_8        0x00000100U
+#define BIT_9        0x00000200U
+#define BIT_10       0x00000400U
+#define BIT_11       0x00000800U
+#define BIT_12       0x00001000U
+#define BIT_13       0x00002000U
+#define BIT_14       0x00004000U
+#define BIT_15       0x00008000U
+#define BIT_16       0x00010000U
+#define BIT_17       0x00020000U
+#define BIT_18       0x00040000U
+#define BIT_19       0x00080000U
+#define BIT_20       0x00100000U
+#define BIT_21       0x00200000U
+#define BIT_22       0x00400000U
+#define BIT_23       0x00800000U
+#define BIT_24       0x01000000U
+#define BIT_25       0x02000000U
+#define BIT_26       0x04000000U
+#define BIT_27       0x08000000U
+#define BIT_28       0x10000000U
+#define BIT_29       0x20000000U
+#define BIT_30       0x40000000U
+#define BIT_31       0x80000000U
+
+#define MASK_1_BITS     (BIT_1 - 1)
+#define MASK_2_BITS     (BIT_2 - 1)
+#define MASK_3_BITS     (BIT_3 - 1)
+#define MASK_4_BITS     (BIT_4 - 1)
+#define MASK_5_BITS     (BIT_5 - 1)
+#define MASK_6_BITS     (BIT_6 - 1)
+#define MASK_7_BITS     (BIT_7 - 1)
+#define MASK_8_BITS     (BIT_8 - 1)
+#define MASK_9_BITS     (BIT_9 - 1)
+#define MASK_10_BITS    (BIT_10 - 1)
+#define MASK_11_BITS    (BIT_11 - 1)
+#define MASK_12_BITS    (BIT_12 - 1)
+#define MASK_13_BITS    (BIT_13 - 1)
+#define MASK_14_BITS    (BIT_14 - 1)
+#define MASK_15_BITS    (BIT_15 - 1)
+#define MASK_16_BITS    (BIT_16 - 1)
+#define MASK_17_BITS    (BIT_17 - 1)
+#define MASK_18_BITS    (BIT_18 - 1)
+#define MASK_19_BITS    (BIT_19 - 1)
+#define MASK_20_BITS    (BIT_20 - 1)
+#define MASK_21_BITS    (BIT_21 - 1)
+#define MASK_22_BITS    (BIT_22 - 1)
+#define MASK_23_BITS    (BIT_23 - 1)
+#define MASK_24_BITS    (BIT_24 - 1)
+#define MASK_25_BITS    (BIT_25 - 1)
+#define MASK_26_BITS    (BIT_26 - 1)
+#define MASK_27_BITS    (BIT_27 - 1)
+#define MASK_28_BITS    (BIT_28 - 1)
+#define MASK_29_BITS    (BIT_29 - 1)
+#define MASK_30_BITS    (BIT_30 - 1)
+#define MASK_31_BITS    (BIT_31 - 1)
+
+#define REG32_FIELD_SET(_data, _val, _fOffset, _fMask)      ((_data & ~(_fMask)) | ((_val << (_fOffset)) & (_fMask)))
+#define REG32_FIELD_GET(_data, _fOffset, _fMask)            ((_data & (_fMask)) >> (_fOffset))
+#define UINT32_BITS_MASK(_mBit, _lBit)                      ((0xFFFFFFFF >> (31 - _mBit)) ^ ((1 << _lBit) - 1))
+
+typedef struct phy_device *  rtk_port_t;
+
+#if 1 /* ss\sdk\include\hal\phy\phydef.h */
+/* unified patch format */
+typedef enum rtk_phypatch_type_e
+{
+    PHY_PATCH_TYPE_NONE = 0,
+    PHY_PATCH_TYPE_TOP = 1,
+    PHY_PATCH_TYPE_SDS,
+    PHY_PATCH_TYPE_AFE,
+    PHY_PATCH_TYPE_UC,
+    PHY_PATCH_TYPE_UC2,
+    PHY_PATCH_TYPE_NCTL0,
+    PHY_PATCH_TYPE_NCTL1,
+    PHY_PATCH_TYPE_NCTL2,
+    PHY_PATCH_TYPE_ALGXG,
+    PHY_PATCH_TYPE_ALG1G,
+    PHY_PATCH_TYPE_NORMAL,
+    PHY_PATCH_TYPE_DATARAM,
+    PHY_PATCH_TYPE_RTCT,
+    PHY_PATCH_TYPE_END
+} rtk_phypatch_type_t;
+
+#define RTK_PATCH_TYPE_FLOW(_id)    (PHY_PATCH_TYPE_END + _id)
+#define RTK_PATCH_TYPE_FLOWID_MAX   PHY_PATCH_TYPE_END
+#define RTK_PATCH_SEQ_MAX     ( PHY_PATCH_TYPE_END + RTK_PATCH_TYPE_FLOWID_MAX -1)
+
+typedef struct rtk_hwpatch_s
+{
+    uint8    patch_op;
+    uint8    portmask;
+    uint16   pagemmd;
+    uint16   addr;
+    uint8    msb;
+    uint8    lsb;
+    uint16   data;
+    uint8    compare_op;
+    uint16   sram_p;
+    uint16   sram_rr;
+    uint16   sram_rw;
+    uint16   sram_a;
+} rtk_hwpatch_t;
+
+typedef struct rtk_hwpatch_data_s
+{
+    rtk_hwpatch_t *conf;
+    uint32        size;
+} rtk_hwpatch_data_t;
+
+typedef struct rtk_hwpatch_seq_s
+{
+    uint8 patch_type;
+    union
+    {
+        rtk_hwpatch_data_t data;
+        uint8 flow_id;
+    } patch;
+} rtk_hwpatch_seq_t;
+
+typedef struct rt_phy_patch_db_s
+{
+    /* patch operation */
+    int32   (*fPatch_op)(uint32 unit, rtk_port_t port, uint8 portOffset, rtk_hwpatch_t *pPatch_data, uint8 patch_mode);
+    int32   (*fPatch_flow)(uint32 unit, rtk_port_t port, uint8 portOffset, uint8 patch_flow, uint8 patch_mode);
+
+    /* patch data */
+    rtk_hwpatch_seq_t seq_table[RTK_PATCH_SEQ_MAX];
+    rtk_hwpatch_seq_t cmp_table[RTK_PATCH_SEQ_MAX];
+
+} rt_phy_patch_db_t;
+#endif
+
+
+
+#endif /* __RTK_PHYLIB_DEF_H */
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_phylib_rtl826xb.c b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_phylib_rtl826xb.c
new file mode 100644
index 00000000000000..1c33846a70fc46
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_phylib_rtl826xb.c
@@ -0,0 +1,57 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2023 Realtek Semiconductor Corp. All rights reserved.
+ */
+
+#include "rtk_phylib_rtl826xb.h"
+
+/* Indirect Register Access APIs */
+int rtk_phylib_826xb_sds_read(rtk_phydev *phydev, uint32 page, uint32 reg, uint8 msb, uint8 lsb, uint32 *pData)
+{
+    int32  ret = 0;
+    uint32 rData = 0;
+    uint32 op = (page & 0x3f) | ((reg & 0x1f) << 6) | (0x8000);
+    uint32 i = 0;
+    uint32 mask = 0;
+    mask = UINT32_BITS_MASK(msb,lsb);
+
+    RTK_PHYLIB_ERR_CHK(rtk_phylib_mmd_write(phydev, 30, 323, 15, 0, op));
+
+    for (i = 0; i < 10; i++)
+    {
+        RTK_PHYLIB_ERR_CHK(rtk_phylib_mmd_read(phydev, 30, 323, 15, 15, &rData));
+        if (rData == 0)
+        {
+            break;
+        }
+        rtk_phylib_udelay(10);
+    }
+    if (i == 10)
+    {
+        return -1;
+    }
+
+    RTK_PHYLIB_ERR_CHK(rtk_phylib_mmd_read(phydev, 30, 322, 15, 0, &rData));
+    *pData = REG32_FIELD_GET(rData, lsb, mask);
+
+    return ret;
+}
+
+int rtk_phylib_826xb_sds_write(rtk_phydev *phydev, uint32 page, uint32 reg, uint8 msb, uint8 lsb, uint32 data)
+{
+    int32  ret = 0;
+    uint32 wData = 0, rData = 0;
+    uint32 op = (page & 0x3f) | ((reg & 0x1f) << 6) | (0x8800);
+    uint32 mask = 0;
+    mask = UINT32_BITS_MASK(msb,lsb);
+
+    RTK_PHYLIB_ERR_CHK(rtk_phylib_826xb_sds_read(phydev, page, reg, 15, 0, &rData));
+
+    wData = REG32_FIELD_SET(rData, data, lsb, mask);
+
+    RTK_PHYLIB_ERR_CHK(rtk_phylib_mmd_write(phydev, 30, 321, 15, 0, wData));
+    RTK_PHYLIB_ERR_CHK(rtk_phylib_mmd_write(phydev, 30, 323, 15, 0, op));
+
+    return ret;
+}
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_phylib_rtl826xb.h b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_phylib_rtl826xb.h
new file mode 100644
index 00000000000000..9f827d4ba25469
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/rtk_phylib_rtl826xb.h
@@ -0,0 +1,19 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2023 Realtek Semiconductor Corp. All rights reserved.
+ */
+
+#ifndef __RTK_PHYLIB_RTL826XB_H
+#define __RTK_PHYLIB_RTL826XB_H
+
+#if defined(RTK_PHYDRV_IN_LINUX)
+  #include "rtk_phylib.h"
+#else
+  //#include SDK headers
+#endif
+
+int rtk_phylib_826xb_sds_read(rtk_phydev *phydev, uint32 page, uint32 reg, uint8 msb, uint8 lsb, uint32 *pData);
+int rtk_phylib_826xb_sds_write(rtk_phydev *phydev, uint32 page, uint32 reg, uint8 msb, uint8 lsb, uint32 data);
+
+#endif /* __RTK_PHYLIB_RTL826XB_H */
diff --git a/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/type.h b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/type.h
new file mode 100644
index 00000000000000..98d7e15e1e4bc9
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/net/phy/rtl8261n/type.h
@@ -0,0 +1,117 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-only
+ *
+ * Copyright (c) 2023 Realtek Semiconductor Corp. All rights reserved.
+ */
+
+#ifndef __COMMON_TYPE_H__
+#define __COMMON_TYPE_H__
+
+/*
+ * Symbol Definition
+ */
+
+#define USING_RTSTK_PKT_AS_RAIL
+
+
+#ifndef NULL
+#define NULL 0
+#endif
+
+#ifndef TRUE
+#define TRUE 1
+#endif
+
+#ifndef FALSE
+#define FALSE 0
+#endif
+
+#ifndef ETHER_ADDR_LEN
+#define ETHER_ADDR_LEN 6
+#endif
+
+#ifndef IP6_ADDR_LEN
+#define IP6_ADDR_LEN    16
+#endif
+
+
+/*
+ * Data Type Declaration
+ */
+#ifndef uint64
+typedef unsigned long long  uint64;
+#endif
+
+#ifndef int64
+typedef signed long long    int64;
+#endif
+
+#ifndef uint32
+typedef unsigned int        uint32;
+#endif
+
+#ifndef int32
+typedef signed int          int32;
+#endif
+
+#ifndef uint16
+typedef unsigned short      uint16;
+#endif
+
+#ifndef int16
+typedef signed short        int16;
+#endif
+
+#ifndef uint8
+typedef unsigned char       uint8;
+#endif
+
+#ifndef int8
+typedef signed char         int8;
+#endif
+
+//#define CONFIG_SDK_WORDSIZE_64 /* not ready */
+#ifdef CONFIG_SDK_WORDSIZE_64
+  typedef long int                intptr;
+  typedef unsigned long int       uintptr;
+#else
+  typedef int                     intptr;
+  typedef unsigned int            uintptr;
+#endif
+
+
+#ifndef ipaddr_t
+typedef uint32  ipaddr_t;           /* ipv4 address type */
+#endif
+
+/* configuration mode type */
+typedef enum rtk_enable_e
+{
+    DISABLED = 0,
+    ENABLED,
+    RTK_ENABLE_END
+} rtk_enable_t;
+
+/* initial state of module */
+typedef enum init_state_e
+{
+    INIT_NOT_COMPLETED = 0,
+    INIT_COMPLETED,
+    INIT_STATE_END
+} init_state_t;
+
+/* ethernet address type */
+typedef struct  rtk_mac_s
+{
+    uint8 octet[ETHER_ADDR_LEN];
+} rtk_mac_t;
+
+typedef uint32  osal_time_t;
+typedef uint32  osal_usecs_t;
+
+/*
+ * Macro Definition
+ */
+
+#endif /* __COMMON_TYPE_H__ */
+
diff --git a/target/linux/mediatek/files-6.6/drivers/nvmem/an8855-efuse.c b/target/linux/mediatek/files-6.6/drivers/nvmem/an8855-efuse.c
new file mode 100644
index 00000000000000..7940453d6e58e3
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/drivers/nvmem/an8855-efuse.c
@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ *  Airoha AN8855 Switch EFUSE Driver
+ */
+
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/nvmem-provider.h>
+#include <linux/platform_device.h>
+#include <linux/regmap.h>
+
+#define AN8855_EFUSE_CELL		50
+
+#define AN8855_EFUSE_DATA0		0x1000a500
+#define   AN8855_EFUSE_R50O		GENMASK(30, 24)
+
+static int an8855_efuse_read(void *context, unsigned int offset,
+			     void *val, size_t bytes)
+{
+	struct regmap *regmap = context;
+
+	return regmap_bulk_read(regmap, AN8855_EFUSE_DATA0 + offset,
+				val, bytes / sizeof(u32));
+}
+
+static int an8855_efuse_probe(struct platform_device *pdev)
+{
+	struct nvmem_config an8855_nvmem_config = {
+		.name = "an8855-efuse",
+		.size = AN8855_EFUSE_CELL * sizeof(u32),
+		.stride = sizeof(u32),
+		.word_size = sizeof(u32),
+		.reg_read = an8855_efuse_read,
+	};
+	struct device *dev = &pdev->dev;
+	struct nvmem_device *nvmem;
+
+	/* Assign NVMEM priv to MFD regmap */
+	an8855_nvmem_config.priv = dev_get_regmap(dev->parent, NULL);
+	an8855_nvmem_config.dev = dev;
+	nvmem = devm_nvmem_register(dev, &an8855_nvmem_config);
+
+	return PTR_ERR_OR_ZERO(nvmem);
+}
+
+static const struct of_device_id an8855_efuse_of_match[] = {
+	{ .compatible = "airoha,an8855-efuse", },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, an8855_efuse_of_match);
+
+static struct platform_driver an8855_efuse_driver = {
+	.probe = an8855_efuse_probe,
+	.driver = {
+		.name = "an8855-efuse",
+		.of_match_table = an8855_efuse_of_match,
+	},
+};
+module_platform_driver(an8855_efuse_driver);
+
+MODULE_AUTHOR("Christian Marangi <ansuelsmth@gmail.com>");
+MODULE_DESCRIPTION("Driver for AN8855 Switch EFUSE");
+MODULE_LICENSE("GPL");
diff --git a/target/linux/mediatek/files-6.6/drivers/pinctrl/mediatek/pinctrl-mt7988.c b/target/linux/mediatek/files-6.6/drivers/pinctrl/mediatek/pinctrl-mt7988.c
index 9f9291124522c9..648bd03acbc3cf 100644
--- a/target/linux/mediatek/files-6.6/drivers/pinctrl/mediatek/pinctrl-mt7988.c
+++ b/target/linux/mediatek/files-6.6/drivers/pinctrl/mediatek/pinctrl-mt7988.c
@@ -776,21 +776,39 @@ static int mt7988_pwm1_funcs[] = { 1 };
 static int mt7988_pwm2_pins[] = { 80 };
 static int mt7988_pwm2_funcs[] = { 2 };
 
+static int mt7988_pwm2_0_pins[] = { 58 };
+static int mt7988_pwm2_0_funcs[] = { 5 };
+
 static int mt7988_pwm3_pins[] = { 81 };
 static int mt7988_pwm3_funcs[] = { 2 };
 
+static int mt7988_pwm3_0_pins[] = { 59 };
+static int mt7988_pwm3_0_funcs[] = { 5 };
+
 static int mt7988_pwm4_pins[] = { 82 };
 static int mt7988_pwm4_funcs[] = { 2 };
 
+static int mt7988_pwm4_0_pins[] = { 60 };
+static int mt7988_pwm4_0_funcs[] = { 5 };
+
 static int mt7988_pwm5_pins[] = { 83 };
 static int mt7988_pwm5_funcs[] = { 2 };
 
+static int mt7988_pwm5_0_pins[] = { 61 };
+static int mt7988_pwm5_0_funcs[] = { 5 };
+
 static int mt7988_pwm6_pins[] = { 69 };
 static int mt7988_pwm6_funcs[] = { 3 };
 
+static int mt7988_pwm6_0_pins[] = { 62 };
+static int mt7988_pwm6_0_funcs[] = { 5 };
+
 static int mt7988_pwm7_pins[] = { 70 };
 static int mt7988_pwm7_funcs[] = { 3 };
 
+static int mt7988_pwm7_0_pins[] = { 4 };
+static int mt7988_pwm7_0_funcs[] = { 3 };
+
 /* dfd */
 static int mt7988_dfd_pins[] = { 0, 1, 2, 3, 4 };
 static int mt7988_dfd_funcs[] = { 4, 4, 4, 4, 4 };
@@ -1113,6 +1131,8 @@ static const struct group_desc mt7988_groups[] = {
 	PINCTRL_PIN_GROUP("xfi_phy_pll_i2c0", mt7988_xfi_phy_pll_i2c0),
 	/*  @GPIO(3,4): xfi_phy_pll_i2c1 */
 	PINCTRL_PIN_GROUP("xfi_phy_pll_i2c1", mt7988_xfi_phy_pll_i2c1),
+	/*  @GPIO(4): pwm7 */
+	PINCTRL_PIN_GROUP("pwm7_0", mt7988_pwm7_0),
 	/*  @GPIO(5,6) i2c0_0 */
 	PINCTRL_PIN_GROUP("i2c0_0", mt7988_i2c0_0),
 	/*  @GPIO(5,6) i2c1_sfp */
@@ -1243,6 +1263,14 @@ static const struct group_desc mt7988_groups[] = {
 	PINCTRL_PIN_GROUP("wo2_jtag", mt7988_wo2_jtag),
 	/*  @GPIO(57) pwm0 */
 	PINCTRL_PIN_GROUP("pwm0", mt7988_pwm0),
+	/*  @GPIO(58) pwm2_0 */
+	PINCTRL_PIN_GROUP("pwm2_0", mt7988_pwm2_0),
+	/*  @GPIO(59) pwm3_0 */
+	PINCTRL_PIN_GROUP("pwm3_0", mt7988_pwm3_0),
+	/*  @GPIO(60) pwm4_0 */
+	PINCTRL_PIN_GROUP("pwm4_0", mt7988_pwm4_0),
+	/*  @GPIO(61) pwm5_0 */
+	PINCTRL_PIN_GROUP("pwm5_0", mt7988_pwm5_0),
 	/*  @GPIO(58,59,60,61,62) jtag */
 	PINCTRL_PIN_GROUP("jtag", mt7988_jtag),
 	/*  @GPIO(58,59,60,61,62) tops_jtag0_1 */
@@ -1256,6 +1284,8 @@ static const struct group_desc mt7988_groups[] = {
 	PINCTRL_PIN_GROUP("gbe1_led1", mt7988_gbe1_led1),
 	PINCTRL_PIN_GROUP("gbe2_led1", mt7988_gbe2_led1),
 	PINCTRL_PIN_GROUP("gbe3_led1", mt7988_gbe3_led1),
+	/*  @GPIO(62) pwm6_0 */
+	PINCTRL_PIN_GROUP("pwm6_0", mt7988_pwm6_0),
 	/*  @GPIO(62) 2p5gbe_led1 */
 	PINCTRL_PIN_GROUP("2p5gbe_led1", mt7988_2p5gbe_led1),
 	/*  @GPIO(64,65,66,67) gbe_led0 */
@@ -1336,7 +1366,8 @@ static const char * const mt7988_int_usxgmii_groups[] = {
 	"int_usxgmii",
 };
 static const char * const mt7988_pwm_groups[] = {
-	"pwm0", "pwm1", "pwm2", "pwm3", "pwm4",	"pwm5",	"pwm6", "pwm7"
+	"pwm0", "pwm1", "pwm2", "pwm2_0", "pwm3", "pwm3_0", "pwm4", "pwm4_0",
+	"pwm5", "pwm5_0", "pwm6", "pwm6_0", "pwm7", "pwm7_0",
 };
 static const char * const mt7988_dfd_groups[] = {
 	"dfd",
diff --git a/target/linux/mediatek/files-6.6/include/linux/mfd/airoha-an8855-mfd.h b/target/linux/mediatek/files-6.6/include/linux/mfd/airoha-an8855-mfd.h
new file mode 100644
index 00000000000000..56061566a0796f
--- /dev/null
+++ b/target/linux/mediatek/files-6.6/include/linux/mfd/airoha-an8855-mfd.h
@@ -0,0 +1,41 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * MFD driver for Airoha AN8855 Switch
+ */
+#ifndef _LINUX_INCLUDE_MFD_AIROHA_AN8855_MFD_H
+#define _LINUX_INCLUDE_MFD_AIROHA_AN8855_MFD_H
+
+#include <linux/bitfield.h>
+
+/* MII Registers */
+#define AN8855_PHY_SELECT_PAGE		0x1f
+#define   AN8855_PHY_PAGE		GENMASK(2, 0)
+#define   AN8855_PHY_PAGE_STANDARD	FIELD_PREP_CONST(AN8855_PHY_PAGE, 0x0)
+#define   AN8855_PHY_PAGE_EXTENDED_1	FIELD_PREP_CONST(AN8855_PHY_PAGE, 0x1)
+#define   AN8855_PHY_PAGE_EXTENDED_4	FIELD_PREP_CONST(AN8855_PHY_PAGE, 0x4)
+
+/* MII Registers Page 4 */
+#define AN8855_PBUS_MODE		0x10
+#define   AN8855_PBUS_MODE_ADDR_FIXED	0x0
+#define AN8855_PBUS_MODE_ADDR_INCR	BIT(15)
+#define AN8855_PBUS_WR_ADDR_HIGH	0x11
+#define AN8855_PBUS_WR_ADDR_LOW		0x12
+#define AN8855_PBUS_WR_DATA_HIGH	0x13
+#define AN8855_PBUS_WR_DATA_LOW		0x14
+#define AN8855_PBUS_RD_ADDR_HIGH	0x15
+#define AN8855_PBUS_RD_ADDR_LOW		0x16
+#define AN8855_PBUS_RD_DATA_HIGH	0x17
+#define AN8855_PBUS_RD_DATA_LOW		0x18
+
+struct an8855_mfd_priv {
+	struct device *dev;
+	struct mii_bus *bus;
+
+	unsigned int switch_addr;
+	u16 current_page;
+};
+
+int an8855_mii_set_page(struct an8855_mfd_priv *priv, u8 phy_id,
+			u8 page);
+
+#endif
diff --git a/target/linux/mediatek/files/drivers/net/phy/rtk/modules.builtin b/target/linux/mediatek/files/drivers/net/phy/rtk/modules.builtin
deleted file mode 100644
index 961a70a150d478..00000000000000
--- a/target/linux/mediatek/files/drivers/net/phy/rtk/modules.builtin
+++ /dev/null
@@ -1 +0,0 @@
-kernel/drivers/net/phy/rtk/rtl8367s_gsw.ko
diff --git a/target/linux/mediatek/files/drivers/net/phy/rtk/rtl8367s_mdio.c b/target/linux/mediatek/files/drivers/net/phy/rtk/rtl8367s_mdio.c
index b4d4554d4fef51..d958d622e0c28c 100644
--- a/target/linux/mediatek/files/drivers/net/phy/rtk/rtl8367s_mdio.c
+++ b/target/linux/mediatek/files/drivers/net/phy/rtk/rtl8367s_mdio.c
@@ -296,7 +296,6 @@ static struct platform_driver gsw_driver = {
 	.remove = rtk_gsw_remove,
 	.driver = {
 		.name = "rtk-gsw",
-		.owner = THIS_MODULE,
 		.of_match_table = rtk_gsw_match,
 	},
 };
diff --git a/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds b/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds
index dad5c293dec377..217f495f95f5d6 100644
--- a/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds
+++ b/target/linux/mediatek/filogic/base-files/etc/board.d/01_leds
@@ -11,6 +11,9 @@ abt,asr3000)
 	ucidef_set_led_netdev "wlan2g" "WLAN2G" "green:wlan-2ghz" "phy0-ap0"
 	ucidef_set_led_netdev "wlan5g" "WLAN5G" "green:wlan-5ghz" "phy1-ap0"
 	;;
+asus,rt-ax52)
+	ucidef_set_led_netdev "wan" "wan" "blue:wan" "wan" "link tx rx"
+	;;
 confiabits,mt7981)
 	ucidef_set_led_netdev "lan1" "lan1" "blue:lan-1" "lan1" "link tx rx"
 	ucidef_set_led_netdev "lan2" "lan2" "blue:lan-2" "lan2" "link tx rx"
@@ -32,12 +35,21 @@ bananapi,bpi-r4-poe)
 	ucidef_set_led_netdev "lan2" "lan2" "mt7530-0:02:green:lan" "lan2" "link tx rx"
 	ucidef_set_led_netdev "lan3" "lan3" "mt7530-0:03:green:lan" "lan3" "link tx rx"
 	;;
-cudy,re3000-v1)
+cudy,re3000-v1|\
+wavlink,wl-wn573hx3)
 	ucidef_set_led_netdev "lan" "lan" "green:lan" "eth0" "link tx rx"
 	;;
 cudy,wr3000-v1)
 	ucidef_set_led_netdev "wan" "wan" "blue:wan" "wan"
 	;;
+cudy,wr3000h-v1)
+	ucidef_set_led_netdev "lan1" "lan1" "white:lan-1" "lan1" "link tx rx"
+	ucidef_set_led_netdev "lan2" "lan2" "white:lan-2" "lan2" "link tx rx"
+	ucidef_set_led_netdev "lan3" "lan3" "white:lan-3" "lan3" "link tx rx"
+	ucidef_set_led_netdev "lan4" "lan4" "white:lan-4" "lan4" "link tx rx"
+	ucidef_set_led_netdev "wan" "wan" "white:wan" "wan" "link tx rx"
+	ucidef_set_led_netdev "internet" "internet" "white:wan-online" "wan" "link"
+	;;
 glinet,gl-x3000|\
 glinet,gl-xe3000)
 	ucidef_set_led_default "power" "POWER" "green:power" "1"
@@ -49,7 +61,23 @@ glinet,gl-xe3000)
 	ucidef_set_led_netdev "wlan2g" "WLAN2G" "green:wifi2g" "phy0-ap0"
 	ucidef_set_led_netdev "wlan5g" "WLAN5G" "green:wifi5g" "phy1-ap0"
 	;;
-mercusys,mr90x-v1)
+huasifei,wh3000)
+	ucidef_set_led_netdev "wan" "WAN" "red:wan" "eth1" "link tx rx"
+	;;
+iptime,ax3000q)
+	ucidef_set_led_netdev "wan" "WAN" "amber:wan" "wan" "link tx rx"
+	;;
+iptime,ax3000sm)
+	ucidef_set_led_netdev "wan" "wan" "amber:wan" "eth1" "link tx rx"
+	;;
+mercusys,mr80x-v3)
+	ucidef_set_led_netdev "lan1" "lan-1" "green:lan-1" "lan1" "link tx rx"
+	ucidef_set_led_netdev "lan2" "lan-2" "green:lan-2" "lan2" "link tx rx"
+	ucidef_set_led_netdev "lan3" "lan-3" "green:lan-3" "lan3" "link tx rx"
+	ucidef_set_led_netdev "wan" "wan" "green:wan" "wan" "link tx rx"
+	;;
+mercusys,mr90x-v1|\
+mercusys,mr90x-v1-ubi)
 	ucidef_set_led_netdev "lan-0" "lan-0" "green:lan-0" "lan0" "link tx rx"
 	ucidef_set_led_netdev "lan-1" "lan-1" "green:lan-1" "lan1" "link tx rx"
 	ucidef_set_led_netdev "lan-2" "lan-2" "green:lan-2" "lan2" "link tx rx"
@@ -57,8 +85,9 @@ mercusys,mr90x-v1)
 	;;
 netgear,wax220)
 	ucidef_set_led_netdev "eth0" "LAN" "green:lan" "eth0"
-	ucidef_set_led_netdev "wlan2g" "WLAN2G" "blue:wlan2g" "phy0-ap0"
-	ucidef_set_led_netdev "wlan5g" "WLAN5G" "blue:wlan5g" "phy1-ap0"
+	;;
+netis,nx31)
+	ucidef_set_led_netdev "wan" "wan" "blue:wan" "eth1" "link tx rx"
 	;;
 nokia,ea0326gmp)
 	ucidef_set_led_netdev "wan" "WAN" "green:wan" "eth1" "link"
@@ -66,8 +95,11 @@ nokia,ea0326gmp)
 	ucidef_set_led_netdev "wlan" "WLAN" "green:wlan" "phy1-ap0" "link"
 	;;
 openembed,som7981)
-	ucidef_set_led_netdev "lanact" "LANACT" "green:lan" "eth1" "rx tx"
-	ucidef_set_led_netdev "lanlink" "LANLINK" "amber:lan" "eth1" "link"
+	ucidef_set_led_netdev "lanact" "LANACT" "amber:lan" "eth1" "rx tx"
+	ucidef_set_led_netdev "lanlink" "LANLINK" "green:lan" "eth1" "link"
+	;;
+openfi,6c)
+	ucidef_set_led_netdev "lan" "LAN" "green:lan" "eth0" "link tx rx"
 	;;
 openwrt,one)
 	ucidef_set_led_netdev "wanact" "WANACT" "mdio-bus:0f:green:wan" "eth0" "rx tx"
@@ -75,13 +107,21 @@ openwrt,one)
 	ucidef_set_led_netdev "lanact" "LANACT" "green:lan" "eth1" "rx tx"
 	ucidef_set_led_netdev "lanlink" "LANLINK" "amber:lan" "eth1" "link"
 	;;
-routerich,ax3000)
+routerich,ax3000|\
+routerich,ax3000-ubootmod)
 	ucidef_set_led_netdev "lan-1" "lan-1" "blue:lan-1" "lan1" "link tx rx"
 	ucidef_set_led_netdev "lan-2" "lan-2" "blue:lan-2" "lan2" "link tx rx"
 	ucidef_set_led_netdev "lan-3" "lan-3" "blue:lan-3" "lan3" "link tx rx"
 	ucidef_set_led_netdev "wan" "wan" "blue:wan" "wan" "link tx rx"
 	ucidef_set_led_netdev "wan-off" "wan-off" "red:wan" "wan" "link"
 	;;
+routerich,ax3000-v1)
+	ucidef_set_led_netdev "lan-1" "lan-1" "blue:lan-1" "lan1" "link tx rx"
+	ucidef_set_led_netdev "lan-2" "lan-2" "blue:lan-2" "lan2" "link tx rx"
+	ucidef_set_led_netdev "lan-3" "lan-3" "blue:lan-3" "lan3" "link tx rx"
+	ucidef_set_led_netdev "wan" "wan" "blue:wan" "eth1" "link tx rx"
+	ucidef_set_led_netdev "wan-off" "wan-off" "red:wan" "eth1" "link"
+	;;
 smartrg,sdg-8733|\
 smartrg,sdg-8734)
 	ucidef_set_led_netdev "lan-1-green" "LAN1" "mdio-bus:08:green:lan" "lan1" "link_2500 link_5000"
@@ -126,7 +166,7 @@ xiaomi,redmi-router-ax6000-ubootmod)
 zbtlink,zbt-z8103ax)
 	ucidef_set_led_netdev "wan" "wan" "green:wan" "eth1" "link tx rx"
 	;;
-zyxel_ex5601-t0-stock|\
+zyxel,ex5601-t0-stock|\
 zyxel,ex5601-t0-ubootmod)
 	ucidef_set_led_netdev "lan" "LAN" "green:lan" "eth0" "link tx rx"
 	ucidef_set_led_netdev "wan" "WAN" "green:inet" "eth1" "link tx rx"
diff --git a/target/linux/mediatek/filogic/base-files/etc/board.d/02_network b/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
index af5c4ceafee131..59a7a720f3af66 100644
--- a/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
+++ b/target/linux/mediatek/filogic/base-files/etc/board.d/02_network
@@ -11,32 +11,49 @@ mediatek_setup_interfaces()
 	abt,asr3000|\
 	cmcc,rax3000m|\
 	h3c,magic-nx30-pro|\
+	netis,nx31|\
 	nokia,ea0326gmp|\
+	mercusys,mr80x-v3|\
+	routerich,ax3000-v1|\
 	zbtlink,zbt-z8103ax)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" eth1
 		;;
 	acelink,ew-7886cax)
 		ucidef_set_interface_lan "eth0" "dhcp"
 		;;
-	acer,predator-w6)
+	acer,predator-w6|\
+	acer,predator-w6d)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 game" eth1
 		;;
+	acer,vero-w6m)
+		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" internet
+		;;
+	arcadyan,mozart)
+		ucidef_set_interfaces_lan_wan "lan0 eth1" eth2
+		;;
+	asus,rt-ax52|\
 	asus,rt-ax59u|\
 	cetron,ct3003|\
+	cmcc,a10-stock|\
+	cmcc,a10-ubootmod|\
 	confiabits,mt7981|\
 	cudy,wr3000-v1|\
 	jcg,q30-pro|\
+	keenetic,kn-3811|\
 	qihoo,360t7|\
-	routerich,ax3000)
+	routerich,ax3000|\
+	routerich,ax3000-ubootmod)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" wan
 		;;
 	asus,tuf-ax4200|\
+	iptime,ax3000sm|\
 	jdcloud,re-cp-03|\
 	mediatek,mt7981-rfb|\
 	netcore,n60|\
 	ruijie,rg-x60-pro|\
 	unielec,u7981-01*|\
 	zbtlink,zbt-z8102ax|\
+	zbtlink,zbt-z8102ax-v2|\
 	zyxel,ex5601-t0-stock|\
 	zyxel,ex5601-t0-ubootmod)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" eth1
@@ -52,7 +69,9 @@ mediatek_setup_interfaces()
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 sfp2" "eth1 wan"
 		;;
 	bananapi,bpi-r3-mini|\
-	edgecore,eap111)
+	edgecore,eap111|\
+	huasifei,wh3000|\
+	huasifei,wh3000-pro)
 		ucidef_set_interfaces_lan_wan eth0 eth1
 		;;
 	bananapi,bpi-r4|\
@@ -63,14 +82,19 @@ mediatek_setup_interfaces()
 		ucidef_set_interfaces_lan_wan "lan1" eth1
 		;;
 	cudy,ap3000outdoor-v1|\
+	cudy,ap3000-v1|\
 	cudy,re3000-v1|\
 	netgear,wax220|\
+	openfi,6c|\
 	ubnt,unifi-6-plus|\
+	wavlink,wl-wn573hx3|\
 	zyxel,nwa50ax-pro)
 		ucidef_set_interface_lan "eth0"
 		;;
 	cudy,m3000-v1|\
+	cudy,tr3000-256mb-v1|\
 	cudy,tr3000-v1|\
+	cudy,tr3000-v1-ubootmod|\
 	glinet,gl-mt2500|\
 	glinet,gl-mt3000|\
 	glinet,gl-x3000|\
@@ -79,9 +103,17 @@ mediatek_setup_interfaces()
 	openwrt,one)
 		ucidef_set_interfaces_lan_wan eth1 eth0
 		;;
-	dlink,aquila-pro-ai-m30-a1)
+	dlink,aquila-pro-ai-m30-a1|\
+	dlink,aquila-pro-ai-m60-a1)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" internet
 		;;
+	keenetic,kn-3911|\
+	smartrg,sdg-8622|\
+	smartrg,sdg-8632|\
+	smartrg,sdg-8733a|\
+	yuncore,ax835)
+		ucidef_set_interfaces_lan_wan lan wan
+		;;
 	mediatek,mt7986a-rfb)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4 lan6" "eth1 wan"
 		;;
@@ -91,19 +123,17 @@ mediatek_setup_interfaces()
 	mediatek,mt7988a-rfb)
 		ucidef_set_interfaces_lan_wan "lan0 lan1 lan2 lan3 eth2" eth1
 		;;
-	mercusys,mr90x-v1)
+	mercusys,mr90x-v1|\
+	mercusys,mr90x-v1-ubi)
 		ucidef_set_interfaces_lan_wan "lan0 lan1 lan2" eth1
 		;;
-	smartrg,sdg-8622|\
-	smartrg,sdg-8632|\
-	smartrg,sdg-8733a|\
-	yuncore,ax835)
-		ucidef_set_interfaces_lan_wan lan wan
-		;;
 	tplink,tl-xdr6086|\
 	wavlink,wl-wn586x3)
 		ucidef_set_interfaces_lan_wan "lan1 lan2" eth1
 		;;
+	tplink,archer-ax80-v1)
+		ucidef_set_interfaces_lan_wan "lan0 lan1 lan2 lan3" eth1
+		;;
 	tplink,re6000xd)
 		ucidef_set_interface_lan "lan1 lan2 eth1"
 		;;
@@ -129,6 +159,12 @@ mediatek_setup_macs()
 	local label_mac=""
 
 	case $board in
+	acer,predator-w6|\
+	acer,predator-w6d|\
+	acer,vero-w6m)
+		wan_mac=$(mmc_get_mac_ascii u-boot-env WANMAC)
+		lan_mac=$(mmc_get_mac_ascii u-boot-env LANMAC)
+		;;
 	bananapi,bpi-r3|\
 	bananapi,bpi-r3-mini|\
 	bananapi,bpi-r4)
@@ -139,7 +175,14 @@ mediatek_setup_macs()
 		lan_mac=$(macaddr_add "$wan_mac" 1)
 		label_mac=$wan_mac
 		;;
+	mercusys,mr80x-v3)
+		mac_dirty=$(cat "/tmp/tp_data/default-mac" | sed -n 's/^'"MAC"'://p')
+		label_mac=$(macaddr_canonicalize "$mac_dirty")
+		lan_mac=$label_mac
+		wan_mac=$(macaddr_add "$lan_mac" 1)
+		;;
 	mercusys,mr90x-v1|\
+	tplink,archer-ax80-v1|\
 	tplink,re6000xd)
 		label_mac=$(get_mac_binary "/tmp/tp_data/default-mac" 0)
 		lan_mac=$label_mac
diff --git a/target/linux/mediatek/filogic/base-files/etc/board.d/03_gpio_switches b/target/linux/mediatek/filogic/base-files/etc/board.d/03_gpio_switches
index 4cbec1ef078db3..e2fe814439d41a 100644
--- a/target/linux/mediatek/filogic/base-files/etc/board.d/03_gpio_switches
+++ b/target/linux/mediatek/filogic/base-files/etc/board.d/03_gpio_switches
@@ -5,7 +5,11 @@ board_config_update
 board=$(board_name)
 
 case "$board" in
-zbtlink,zbt-z8102ax)
+huasifei,wh3000-pro)
+	ucidef_add_gpio_switch "modem_power" "Modem power" "modem_power" "0"
+	;;
+zbtlink,zbt-z8102ax|\
+zbtlink,zbt-z8102ax-v2)
 	ucidef_add_gpio_switch "5g1" "Power 1st modem" "5g1" "1"
 	ucidef_add_gpio_switch "5g2" "Power 2nd modem" "5g2" "1"
 	ucidef_add_gpio_switch "pcie" "Power PCIe port" "pcie" "1"
diff --git a/target/linux/mediatek/filogic/base-files/etc/board.d/04_defaults b/target/linux/mediatek/filogic/base-files/etc/board.d/04_defaults
new file mode 100644
index 00000000000000..4d4131ec90c1d2
--- /dev/null
+++ b/target/linux/mediatek/filogic/base-files/etc/board.d/04_defaults
@@ -0,0 +1,16 @@
+. /lib/functions/uci-defaults.sh
+
+board=$(board_name)
+
+board_config_update
+
+case $board in
+openwrt,one)
+	ucidef_set_wireless_mac_count 2g 7
+	ucidef_set_wireless_mac_count 5g 7
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/mediatek/filogic/base-files/etc/board.d/05_compat-version b/target/linux/mediatek/filogic/base-files/etc/board.d/05_compat-version
index d0cfd8f0a1232e..9b704b983cb7f0 100644
--- a/target/linux/mediatek/filogic/base-files/etc/board.d/05_compat-version
+++ b/target/linux/mediatek/filogic/base-files/etc/board.d/05_compat-version
@@ -8,6 +8,9 @@ case "$(board_name)" in
 	bananapi,bpi-r3)
 		ucidef_set_compat_version "1.2"
 		;;
+	routerich,ax3000)
+		ucidef_set_compat_version "1.1"
+		;;
 esac
 
 board_config_flush
diff --git a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/firmware/11-mt76-caldata b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/firmware/11-mt76-caldata
index 8456c462b6339b..1d9db845db6860 100644
--- a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/firmware/11-mt76-caldata
+++ b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/firmware/11-mt76-caldata
@@ -9,6 +9,10 @@ board=$(board_name)
 case "$FIRMWARE" in
 "mediatek/mt7981_eeprom_mt7976_dbdc.bin")
 	case "$board" in
+	mercusys,mr80x-v3)
+		ln -sf /tmp/tp_data/MT7981_EEPROM.bin \
+			/lib/firmware/$FIRMWARE
+		;;
 	ubnt,unifi-6-plus)
 		caldata_extract_mmc "factory" 0x0 0x1000
 		;;
@@ -23,6 +27,14 @@ case "$FIRMWARE" in
 		;;
 	esac
 	;;
+"mediatek/mt7986_eeprom_mt7976_dual.bin")
+	case "$board" in
+	tplink,archer-ax80-v1)
+		ln -sf /tmp/tp_data/MT7986_EEPROM.bin \
+			/lib/firmware/$FIRMWARE
+		;;
+	esac
+	;;
 *)
 	exit 1
 	;;
diff --git a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/05-wifi-migrate b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/05-wifi-migrate
new file mode 100644
index 00000000000000..ae3bc643cd5d0d
--- /dev/null
+++ b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/05-wifi-migrate
@@ -0,0 +1,63 @@
+#!/bin/sh
+
+# This must run before 10-wifi-detect
+
+
+[ "${ACTION}" = "add" ] || return
+
+
+. /lib/functions.sh
+
+
+check_radio()
+{
+	local cfg="$1" to="$2"
+
+	config_get path "$cfg" path
+
+	[ "$path" = "$to" ] && PATH_EXISTS=true
+}
+
+do_migrate_radio()
+{
+	local cfg="$1" from="$2" to="$3"
+
+	config_get path "$cfg" path
+
+	[ "$path" = "$from" ] || return
+
+	uci set "wireless.${cfg}.path=${to}"
+	WIRELESS_CHANGED=true
+
+	logger -t wifi-migrate "Updated path of wireless.${cfg} from '${from}' to '${to}'"
+}
+
+migrate_radio()
+{
+	local from="$1" to="$2"
+
+	config_load wireless
+
+	# Check if there is already a section with the target path: In this case, the system
+	# was already upgraded to a version without this migration script before; better bail out,
+	# as we can't be sure we don't break more than we fix.
+	PATH_EXISTS=false
+	config_foreach check_radio wifi-device "$to"
+	$PATH_EXISTS && return
+
+	config_foreach do_migrate_radio wifi-device "$from" "$to"
+}
+
+
+WIRELESS_CHANGED=false
+
+case "$(board_name)" in
+*)
+	migrate_radio 'platform/18000000.wifi' 'platform/soc/18000000.wifi'
+	migrate_radio 'platform/18000000.wifi+1' 'platform/soc/18000000.wifi+1'
+    ;;
+esac
+
+$WIRELESS_CHANGED && uci commit wireless
+
+exit 0
diff --git a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
index 3042858353a7cf..58672d9d72f5ac 100644
--- a/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
+++ b/target/linux/mediatek/filogic/base-files/etc/hotplug.d/ieee80211/11_fix_wifi_mac
@@ -17,11 +17,15 @@ case "$board" in
 		[ "$PHYNBR" = "0" ] && macaddr_add $addr 1 > /sys${DEVPATH}/macaddress
 		[ "$PHYNBR" = "1" ] && macaddr_setbit_la $addr > /sys${DEVPATH}/macaddress
 		;;
-	acer,predator-w6)
-		key_path="/var/qcidata/data"
-		[ "$PHYNBR" = "0" ] && cat $key_path/2gMAC > /sys${DEVPATH}/macaddress
-		[ "$PHYNBR" = "1" ] && cat $key_path/6gMAC > /sys${DEVPATH}/macaddress
-		[ "$PHYNBR" = "2" ] && cat $key_path/5gMAC > /sys${DEVPATH}/macaddress
+	acer,predator-w6|\
+	acer,vero-w6m)
+		[ "$PHYNBR" = "0" ] && mmc_get_mac_ascii u-boot-env 2gMAC > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && mmc_get_mac_ascii u-boot-env 6gMAC > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "2" ] && mmc_get_mac_ascii u-boot-env 5gMAC > /sys${DEVPATH}/macaddress
+		;;
+	acer,predator-w6d)
+		[ "$PHYNBR" = "0" ] && mmc_get_mac_ascii u-boot-env 2gMAC > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && mmc_get_mac_ascii u-boot-env 5gMAC > /sys${DEVPATH}/macaddress
 		;;
 	asus,rt-ax59u)
 		CI_UBIPART="UBI_DEV"
@@ -33,6 +37,7 @@ case "$board" in
 			macaddr_setbit_la $(macaddr_setbit $(macaddr_add $addr 1) 28) > \
 			/sys${DEVPATH}/macaddress
 		;;
+	asus,rt-ax52|\
 	asus,tuf-ax4200|\
 	asus,tuf-ax6000)
 		CI_UBIPART="UBI_DEV"
@@ -69,14 +74,16 @@ case "$board" in
 		addr=$(mtd_get_mac_binary "Factory" 0x8000)
 		[ "$PHYNBR" = "1" ] && macaddr_add $addr 1 > /sys${DEVPATH}/macaddress
 		;;
-	cudy,tr3000-v1|\
-	cudy,re3000-v1)
-		addr=$(mtd_get_mac_binary bdinfo 0xde00)
-		[ "$PHYNBR" = "0" ] && echo "$addr" > /sys${DEVPATH}/macaddress
-		[ "$PHYNBR" = "1" ] && macaddr_setbit_la $(macaddr_add $addr 1) > /sys${DEVPATH}/macaddress
-		;;
 	cudy,ap3000outdoor-v1|\
+	cudy,ap3000-v1|\
 	cudy,m3000-v1|\
+	cudy,re3000-v1|\
+	cudy,tr3000-256mb-v1|\
+	cudy,tr3000-v1|\
+	cudy,tr3000-v1-ubootmod|\
+	cudy,wr3000e-v1|\
+	cudy,wr3000s-v1|\
+	cudy,wr3000h-v1|\
 	cudy,wr3000-v1)
 		addr=$(mtd_get_mac_binary bdinfo 0xde00)
 		# Originally, phy0 is phy1 mac with LA bit set. However, this would conflict
@@ -101,6 +108,15 @@ case "$board" in
 		[ "$PHYNBR" = "0" ] && macaddr_add $addr 2 > /sys${DEVPATH}/macaddress
 		[ "$PHYNBR" = "1" ] && macaddr_add $addr 3 > /sys${DEVPATH}/macaddress
 		;;
+	iptime,ax3000q)
+		addr=$(mtd_get_mac_binary "Factory" 0x4)
+		[ "$PHYNBR" = "1" ] && macaddr_setbit_la $addr > /sys${DEVPATH}/macaddress
+		;;
+	iptime,ax3000sm)
+		addr=$(mtd_get_mac_binary "Factory" 0x4)
+		[ "$PHYNBR" = "1" ] && macaddr_setbit_la $(macaddr_unsetbit $(macaddr_unsetbit $(macaddr_unsetbit $(macaddr_setbit $addr 26) 25) 27) 28) > \
+			/sys${DEVPATH}/macaddress
+		;;
 	jcg,q30-pro|\
 	netcore,n60)
 		# Originally, phy1 is phy0 mac with LA bit set. However, this would conflict
@@ -110,7 +126,19 @@ case "$board" in
 	jdcloud,re-cp-03)
 		[ "$PHYNBR" = "1" ] && mmc_get_mac_binary factory 0xa > /sys${DEVPATH}/macaddress
 		;;
+	keenetic,kn-3811|\
+	keenetic,kn-3911)
+		[ "$PHYNBR" = "1" ] && \
+			macaddr_setbit_la "$(mtd_get_mac_binary rf-eeprom 0x4)" > /sys${DEVPATH}/macaddress
+		;;
+	mercusys,mr80x-v3)
+		mac_dirty=$(cat "/tmp/tp_data/default-mac" | sed -n 's/^'"MAC"'://p')
+		label_mac=$(macaddr_canonicalize "$mac_dirty")
+		[ "$PHYNBR" = "0" ] && macaddr_add $label_mac -1 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && macaddr_add $label_mac -2 > /sys${DEVPATH}/macaddress
+		;;
 	mercusys,mr90x-v1|\
+	tplink,archer-ax80-v1|\
 	tplink,re6000xd)
 		addr=$(get_mac_binary "/tmp/tp_data/default-mac" 0)
 		[ "$PHYNBR" = "0" ] && echo "$addr" > /sys${DEVPATH}/macaddress
@@ -121,14 +149,19 @@ case "$board" in
 		[ "$PHYNBR" = "0" ] && macaddr_add $hw_mac_addr 2 > /sys${DEVPATH}/macaddress
 		[ "$PHYNBR" = "1" ] && macaddr_add $hw_mac_addr 3 > /sys${DEVPATH}/macaddress
 		;;
+	netis,nx31)
+		addr=$(mtd_get_mac_binary "Factory" 0x4)
+		addr=$(macaddr_unsetbit $(macaddr_setbit_la $addr) 25)
+		addr_2g=$(macaddr_unsetbit $(macaddr_unsetbit $addr 26) 27)
+		addr_5g=$(macaddr_setbit $(macaddr_setbit $addr 26) 27)
+		[ "$PHYNBR" = "0" ] && echo "$addr_2g" > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && echo "$addr_5g" > /sys${DEVPATH}/macaddress
+		;;
 	nokia,ea0326gmp)
 		addr=$(cat /sys/class/net/eth0/address)
 		[ "$PHYNBR" = "0" ] && macaddr_add $addr 1 > /sys${DEVPATH}/macaddress
 		[ "$PHYNBR" = "1" ] && macaddr_add $addr 2 > /sys${DEVPATH}/macaddress
 		;;
-	openembed,som7981)
-		[ "$PHYNBR" = "1" ] && cat /sys/class/net/eth0/address > /sys${DEVPATH}/macaddress
-		;;
 	qihoo,360t7)
 		addr=$(mtd_get_mac_ascii factory lanMac)
 		[ "$PHYNBR" = "0" ] && macaddr_add $addr 2 > /sys${DEVPATH}/macaddress
@@ -153,13 +186,19 @@ case "$board" in
 		[ "$PHYNBR" = "1" ] && macaddr_add $addr 1 > /sys${DEVPATH}/macaddress
 		;;
 	routerich,ax3000|\
+	routerich,ax3000-ubootmod|\
 	zbtlink,zbt-z8102ax|\
+	zbtlink,zbt-z8102ax-v2|\
 	zbtlink,zbt-z8103ax|\
-	zyxel,ex5601-t0|\
+	zyxel,ex5601-t0-stock|\
 	zyxel,ex5601-t0-ubootmod)
 		addr=$(mtd_get_mac_binary "Factory" 0x4)
 		[ "$PHYNBR" = "1" ] && macaddr_add $addr 1 > /sys${DEVPATH}/macaddress
 		;;
+	wavlink,wl-wn573hx3)
+		addr=$(mtd_get_mac_binary factory 0x04)
+		[ "$PHYNBR" = "1" ] && macaddr_setbit_la $(macaddr_add $addr -0x300000) > /sys${DEVPATH}/macaddress
+		;;
 	zyxel,nwa50ax-pro)
 		hw_mac_addr="$(mtd_get_mac_binary mrd 0x1fff8)"
 		[ "$PHYNBR" = "0" ] && macaddr_add $hw_mac_addr 1 > /sys${DEVPATH}/macaddress
diff --git a/target/linux/mediatek/filogic/base-files/etc/init.d/bootcount b/target/linux/mediatek/filogic/base-files/etc/init.d/bootcount
index e186589f281bcd..a0e7d40862930f 100755
--- a/target/linux/mediatek/filogic/base-files/etc/init.d/bootcount
+++ b/target/linux/mediatek/filogic/base-files/etc/init.d/bootcount
@@ -5,12 +5,23 @@ START=99
 
 boot() {
 	case $(board_name) in
-	dlink,aquila-pro-ai-m30-a1)
-		if grep -q bootpart=ubi0 /proc/cmdline; then
-			fw_setenv bootpart 0
-		else
-			fw_setenv bootpart 1
-		fi
+	xiaomi,mi-router-ax3000t)
+		. /lib/upgrade/common.sh
+		[ "$(rootfs_type)" = "tmpfs" ] && \
+			logger "bootcount: initramfs mode detected, exit" && \
+			return 0
+		[ "$(fw_printenv -n flag_try_sys2_failed 2>&1)" = "8" ] && \
+			logger "bootcount: rd03 model detected, exit" && \
+			return 0
+		fw_setenv -s - <<-EOF
+			flag_boot_rootfs 0
+			flag_boot_success 1
+			flag_last_success 0
+			flag_ota_reboot 0
+			flag_try_sys1_failed 0
+			flag_try_sys2_failed 0
+		EOF
+		logger "bootcount: rd23 model detected, nvram was updated"
 		;;
 	zyxel,ex5700-telenor)
 		fw_setenv uboot_bootcount 0
diff --git a/target/linux/mediatek/filogic/base-files/lib/preinit/05_extract_factory_data.sh b/target/linux/mediatek/filogic/base-files/lib/preinit/05_extract_factory_data.sh
deleted file mode 100644
index 87287a7d1c1c98..00000000000000
--- a/target/linux/mediatek/filogic/base-files/lib/preinit/05_extract_factory_data.sh
+++ /dev/null
@@ -1,25 +0,0 @@
-. /lib/functions/system.sh
-
-predator_w6_factory_extract() {
-	local mmc_part
-
-	mmc_part="$(find_mmc_part qcidata)"
-
-	mkdir -p /var/qcidata/data
-	mkdir -p /var/qcidata/mount
-
-	mount -r "$mmc_part" /var/qcidata/mount
-
-	cp /var/qcidata/mount/factory/*MAC "/var/qcidata/data/"
-	umount "/var/qcidata/mount"
-}
-
-preinit_extract_factory() {
-	case $(board_name) in
-	acer,predator-w6)
-		predator_w6_factory_extract
-		;;
-	esac
-}
-
-boot_hook_add preinit_main preinit_extract_factory
diff --git a/target/linux/mediatek/filogic/base-files/lib/preinit/09_mount_cfg_part b/target/linux/mediatek/filogic/base-files/lib/preinit/09_mount_cfg_part
index 11e3b598af8eae..87e51a4429470f 100644
--- a/target/linux/mediatek/filogic/base-files/lib/preinit/09_mount_cfg_part
+++ b/target/linux/mediatek/filogic/base-files/lib/preinit/09_mount_cfg_part
@@ -12,7 +12,9 @@ mount_ubi_part() {
 
 preinit_mount_cfg_part() {
 	case $(board_name) in
+	mercusys,mr80x-v3|\
 	mercusys,mr90x-v1|\
+	tplink,archer-ax80-v1|\
 	tplink,re6000xd)
 		mount_ubi_part "tp_data"
 		;;
diff --git a/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh b/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh
index 0497d7dfa2474f..936ed44ff9667c 100644
--- a/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh
+++ b/target/linux/mediatek/filogic/base-files/lib/preinit/10_fix_eth_mac.sh
@@ -2,13 +2,23 @@
 
 preinit_set_mac_address() {
 	case $(board_name) in
-	acer,predator-w6)
-		key_path="/var/qcidata/data"
-		ip link set dev lan1 address "$(cat $key_path/LANMAC)"
-		ip link set dev lan2 address "$(cat $key_path/LANMAC)"
-		ip link set dev lan3 address "$(cat $key_path/LANMAC)"
-		ip link set dev game address "$(cat $key_path/LANMAC)"
-		ip link set dev eth1 address "$(cat $key_path/WANMAC)"
+	acer,predator-w6|\
+	acer,predator-w6d)
+		$(mmc_get_mac_ascii u-boot-env WANMAC)
+		$(mmc_get_mac_ascii u-boot-env LANMAC)
+		ip link set dev lan1 address "$lan_mac"
+		ip link set dev lan2 address "$lan_mac"
+		ip link set dev lan3 address "$lan_mac"
+		ip link set dev game address "$lan_mac"
+		ip link set dev eth1 address "$wan_mac"
+		;;
+	acer,vero-w6m)
+		wan_mac=$(mmc_get_mac_ascii u-boot-env WANMAC)
+		lan_mac=$(mmc_get_mac_ascii u-boot-env LANMAC)
+		ip link set dev lan1 address "$lan_mac"
+		ip link set dev lan2 address "$lan_mac"
+		ip link set dev lan3 address "$lan_mac"
+		ip link set dev internet address "$wan_mac"
 		;;
 	asus,tuf-ax4200|\
 	asus,tuf-ax6000)
@@ -18,6 +28,7 @@ preinit_set_mac_address() {
 		ip link set dev eth1 address "$addr"
 		;;
 	mercusys,mr90x-v1|\
+	tplink,archer-ax80-v1|\
 	tplink,re6000xd)
 		addr=$(get_mac_binary "/tmp/tp_data/default-mac" 0)
 		ip link set dev eth1 address "$(macaddr_add $addr 1)"
diff --git a/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh b/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh
index edc045656639c2..64b6d4b60b0880 100755
--- a/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh
+++ b/target/linux/mediatek/filogic/base-files/lib/upgrade/platform.sh
@@ -40,13 +40,15 @@ xiaomi_initial_setup()
 		return 0
 	fi
 
-	fw_setenv boot_wait on
-	fw_setenv uart_en 1
-	fw_setenv flag_boot_rootfs 0
-	fw_setenv flag_last_success 1
-	fw_setenv flag_boot_success 1
-	fw_setenv flag_try_sys1_failed 8
-	fw_setenv flag_try_sys2_failed 8
+	fw_setenv -s - <<-EOF
+		boot_wait on
+		uart_en 1
+		flag_boot_rootfs 0
+		flag_last_success 1
+		flag_boot_success 1
+		flag_try_sys1_failed 8
+		flag_try_sys2_failed 8
+	EOF
 
 	local board=$(board_name)
 	case "$board" in
@@ -69,16 +71,22 @@ platform_do_upgrade() {
 	bananapi,bpi-r3-mini|\
 	bananapi,bpi-r4|\
 	bananapi,bpi-r4-poe|\
+	cmcc,a10-ubootmod|\
 	cmcc,rax3000m|\
+	cudy,tr3000-v1-ubootmod|\
+	gatonetworks,gdsp|\
 	h3c,magic-nx30-pro|\
 	jcg,q30-pro|\
 	jdcloud,re-cp-03|\
 	mediatek,mt7981-rfb|\
 	mediatek,mt7988a-rfb|\
+	mercusys,mr90x-v1-ubi|\
+	netis,nx31|\
 	nokia,ea0326gmp|\
 	openwrt,one|\
 	netcore,n60|\
 	qihoo,360t7|\
+	routerich,ax3000-ubootmod|\
 	tplink,tl-xdr4288|\
 	tplink,tl-xdr6086|\
 	tplink,tl-xdr6088|\
@@ -90,6 +98,15 @@ platform_do_upgrade() {
 		fit_do_upgrade "$1"
 		;;
 	acer,predator-w6|\
+	acer,predator-w6d|\
+	acer,vero-w6m|\
+	arcadyan,mozart|\
+	glinet,gl-mt2500|\
+	glinet,gl-mt6000|\
+	glinet,gl-x3000|\
+	glinet,gl-xe3000|\
+	huasifei,wh3000|\
+	huasifei,wh3000-pro|\
 	smartrg,sdg-8612|\
 	smartrg,sdg-8614|\
 	smartrg,sdg-8622|\
@@ -101,6 +118,7 @@ platform_do_upgrade() {
 		CI_ROOTPART="rootfs"
 		emmc_do_upgrade "$1"
 		;;
+	asus,rt-ax52|\
 	asus,rt-ax59u|\
 	asus,tuf-ax4200|\
 	asus,tuf-ax6000)
@@ -108,20 +126,24 @@ platform_do_upgrade() {
 		CI_KERNPART="linux"
 		nand_do_upgrade "$1"
 		;;
+	cudy,wr3000h-v1)
+		CI_UBIPART="ubi"
+		nand_do_upgrade "$1"
+		;;
 	cudy,re3000-v1|\
 	cudy,wr3000-v1|\
-	yuncore,ax835)
+	yuncore,ax835|\
+	wavlink,wl-wn573hx3)
 		default_do_upgrade "$1"
 		;;
-	glinet,gl-mt2500|\
-	glinet,gl-mt6000|\
-	glinet,gl-x3000|\
-	glinet,gl-xe3000)
-		CI_KERNPART="kernel"
-		CI_ROOTPART="rootfs"
-		emmc_do_upgrade "$1"
+	dlink,aquila-pro-ai-m30-a1|\
+	dlink,aquila-pro-ai-m60-a1)
+		fw_setenv sw_tryactive 0
+		nand_do_upgrade "$1"
 		;;
+	mercusys,mr80x-v3|\
 	mercusys,mr90x-v1|\
+	tplink,archer-ax80-v1|\
 	tplink,re6000xd)
 		CI_UBIPART="ubi0"
 		nand_do_upgrade "$1"
@@ -202,10 +224,15 @@ platform_copy_config() {
 		fi
 		;;
 	acer,predator-w6|\
+	acer,predator-w6d|\
+	acer,vero-w6m|\
+	arcadyan,mozart|\
 	glinet,gl-mt2500|\
 	glinet,gl-mt6000|\
 	glinet,gl-x3000|\
 	glinet,gl-xe3000|\
+	huasifei,wh3000|\
+	huasifei,wh3000-pro|\
 	jdcloud,re-cp-03|\
 	smartrg,sdg-8612|\
 	smartrg,sdg-8614|\
@@ -224,6 +251,7 @@ platform_pre_upgrade() {
 	local board=$(board_name)
 
 	case "$board" in
+	asus,rt-ax52|\
 	asus,rt-ax59u|\
 	asus,tuf-ax4200|\
 	asus,tuf-ax6000)
diff --git a/target/linux/mediatek/filogic/config-6.6 b/target/linux/mediatek/filogic/config-6.6
index 7cf045ade2a5e2..607d1b3c6f4cb2 100644
--- a/target/linux/mediatek/filogic/config-6.6
+++ b/target/linux/mediatek/filogic/config-6.6
@@ -1,6 +1,7 @@
 CONFIG_64BIT=y
 # CONFIG_AHCI_MTK is not set
 CONFIG_AIROHA_EN8801SC_PHY=y
+CONFIG_AIR_AN8855_PHY=y
 CONFIG_ARCH_BINFMT_ELF_EXTRA_PHDRS=y
 CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y
 CONFIG_ARCH_DEFAULT_KEXEC_IMAGE_VERIFY_SIG=y
@@ -32,7 +33,6 @@ CONFIG_ARM64_VA_BITS_39=y
 CONFIG_ARM_AMBA=y
 CONFIG_ARM_ARCH_TIMER=y
 CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
-# CONFIG_ARM_CORESIGHT_PMU_ARCH_SYSTEM_PMU is not set
 CONFIG_ARM_GIC=y
 CONFIG_ARM_GIC_V2M=y
 CONFIG_ARM_GIC_V3=y
@@ -42,7 +42,6 @@ CONFIG_ARM_MEDIATEK_CPUFREQ=y
 CONFIG_ARM_PMU=y
 CONFIG_ARM_PMUV3=y
 CONFIG_ARM_PSCI_FW=y
-# CONFIG_ARM_SMMU_V3_PMU is not set
 CONFIG_ATA=y
 CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
 CONFIG_BLK_DEV_LOOP=y
@@ -56,8 +55,6 @@ CONFIG_BUFFER_HEAD=y
 CONFIG_BUILTIN_RETURN_ADDRESS_STRIPS_PAC=y
 CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CMDLINE_OVERRIDE=y
@@ -98,6 +95,7 @@ CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
 CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_STAT=y
 CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_MITIGATIONS=y
 CONFIG_CPU_RMAP=y
 CONFIG_CPU_THERMAL=y
 CONFIG_CRC16=y
@@ -168,8 +166,6 @@ CONFIG_FUNCTION_ALIGNMENT_4B=y
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
-CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
@@ -236,6 +232,7 @@ CONFIG_LZO_COMPRESS=y
 CONFIG_LZO_DECOMPRESS=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_MAXLINEAR_GPHY=y
+CONFIG_MDIO_AN8855=y
 CONFIG_MDIO_BUS=y
 CONFIG_MDIO_DEVICE=y
 CONFIG_MDIO_DEVRES=y
@@ -244,9 +241,10 @@ CONFIG_MEDIATEK_GE_PHY=y
 CONFIG_MEDIATEK_GE_SOC_PHY=y
 CONFIG_MEDIATEK_WATCHDOG=y
 CONFIG_MESSAGE_LOGLEVEL_DEFAULT=7
+CONFIG_MFD_AIROHA_AN8855=y
+CONFIG_MFD_CORE=y
 CONFIG_MFD_SYSCON=y
 CONFIG_MIGRATION=y
-# CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY is not set
 CONFIG_MMC=y
 CONFIG_MMC_BLOCK=y
 CONFIG_MMC_CQHCI=y
@@ -272,6 +270,7 @@ CONFIG_MTD_UBI_BLOCK=y
 CONFIG_MTD_UBI_FASTMAP=y
 CONFIG_MTD_UBI_NVMEM=y
 CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_MTD_VIRT_CONCAT=y
 # CONFIG_MTK_CMDQ is not set
 CONFIG_MTK_CPUX_TIMER=y
 # CONFIG_MTK_CQDMA is not set
@@ -279,6 +278,7 @@ CONFIG_MTK_HSDMA=y
 CONFIG_MTK_INFRACFG=y
 CONFIG_MTK_LVTS_THERMAL=y
 CONFIG_MTK_LVTS_THERMAL_DEBUGFS=y
+CONFIG_MTK_NET_PHYLIB=y
 CONFIG_MTK_PMIC_WRAP=y
 CONFIG_MTK_REGULATOR_COUPLER=y
 CONFIG_MTK_SCPSYS=y
@@ -293,6 +293,7 @@ CONFIG_NEED_DMA_MAP_STATE=y
 CONFIG_NEED_SG_DMA_LENGTH=y
 CONFIG_NET_DEVLINK=y
 CONFIG_NET_DSA=y
+CONFIG_NET_DSA_AN8855=y
 CONFIG_NET_DSA_MT7530=y
 CONFIG_NET_DSA_MT7530_MDIO=y
 CONFIG_NET_DSA_MT7530_MMIO=y
@@ -311,6 +312,7 @@ CONFIG_NO_HZ_COMMON=y
 CONFIG_NO_HZ_IDLE=y
 CONFIG_NR_CPUS=4
 CONFIG_NVMEM=y
+CONFIG_NVMEM_AN8855_EFUSE=y
 CONFIG_NVMEM_BLOCK=y
 CONFIG_NVMEM_LAYOUTS=y
 CONFIG_NVMEM_LAYOUT_ADTRAN=y
@@ -332,7 +334,6 @@ CONFIG_PAGE_POOL=y
 CONFIG_PAGE_POOL_STATS=y
 CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
 CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
-CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y
 CONFIG_PARTITION_PERCPU=y
 CONFIG_PCI=y
 CONFIG_PCIEAER=y
@@ -410,6 +411,7 @@ CONFIG_RAS=y
 CONFIG_RATIONAL=y
 # CONFIG_RAVE_SP_CORE is not set
 CONFIG_REALTEK_PHY=y
+CONFIG_REALTEK_PHY_HWMON=y
 CONFIG_REED_SOLOMON=y
 CONFIG_REED_SOLOMON_DEC8=y
 CONFIG_REED_SOLOMON_ENC8=y
@@ -428,6 +430,7 @@ CONFIG_RPS=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_MT7622=y
 CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RTL8261N_PHY=y
 # CONFIG_RTL8367S_GSW is not set
 CONFIG_RWSEM_SPIN_ON_OWNER=y
 CONFIG_SCHED_MC=y
diff --git a/target/linux/mediatek/image/filogic.mk b/target/linux/mediatek/image/filogic.mk
index 37fe740c31d4e3..6a18adaa7b1b5b 100644
--- a/target/linux/mediatek/image/filogic.mk
+++ b/target/linux/mediatek/image/filogic.mk
@@ -152,7 +152,7 @@ TARGET_DEVICES += acelink_ew-7886cax
 
 define Device/acer_predator-w6
   DEVICE_VENDOR := Acer
-  DEVICE_MODEL := Predator W6
+  DEVICE_MODEL := Predator Connect W6
   DEVICE_DTS := mt7986a-acer-predator-w6
   DEVICE_DTS_DIR := ../dts
   DEVICE_DTS_LOADADDR := 0x47000000
@@ -165,6 +165,36 @@ define Device/acer_predator-w6
 endef
 TARGET_DEVICES += acer_predator-w6
 
+define Device/acer_predator-w6d
+  DEVICE_VENDOR := Acer
+  DEVICE_MODEL := Predator Connect W6d
+  DEVICE_DTS := mt7986a-acer-predator-w6d
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x47000000
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt7915e kmod-mt7916-firmware kmod-mt7986-firmware mt7986-wo-firmware e2fsprogs f2fsck mkf2fs
+  IMAGES := sysupgrade.bin
+  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += acer_predator-w6d
+
+define Device/acer_vero-w6m
+  DEVICE_VENDOR := Acer
+  DEVICE_MODEL := Connect Vero W6m
+  DEVICE_DTS := mt7986a-acer-vero-w6m
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x47000000
+  DEVICE_PACKAGES := kmod-leds-ktd202x kmod-mt7915e kmod-mt7916-firmware kmod-mt7986-firmware mt7986-wo-firmware e2fsprogs f2fsck mkf2fs
+  IMAGES := sysupgrade.bin
+  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += acer_vero-w6m
+
 define Device/adtran_smartrg
   DEVICE_VENDOR := Adtran
   DEVICE_DTS_DIR := ../dts
@@ -228,6 +258,21 @@ $(call Device/adtran_smartrg)
 endef
 TARGET_DEVICES += smartrg_sdg-8734
 
+define Device/asus_rt-ax52
+  DEVICE_VENDOR := ASUS
+  DEVICE_MODEL := RT-AX52
+  DEVICE_DTS := mt7981b-asus-rt-ax52
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  IMAGES := sysupgrade.bin
+  KERNEL := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += asus_rt-ax52
+
 define Device/asus_rt-ax59u
   DEVICE_VENDOR := ASUS
   DEVICE_MODEL := RT-AX59U
@@ -254,6 +299,30 @@ define Device/asus_tuf-ax4200
 endef
 TARGET_DEVICES += asus_tuf-ax4200
 
+define Device/arcadyan_mozart
+  DEVICE_VENDOR := Arcadyan
+  DEVICE_MODEL := Mozart
+  DEVICE_DTS := mt7988a-arcadyan-mozart
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTC_FLAGS := --pad 4096
+  DEVICE_DTS_LOADADDR := 0x45f00000
+  DEVICE_PACKAGES := kmod-hwmon-pwmfan e2fsprogs f2fsck mkf2fs kmod-mt7996-firmware
+  KERNEL_LOADADDR := 0x46000000
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  KERNEL_INITRAMFS_SUFFIX := .itb
+  IMAGE_SIZE := $$(shell expr 64 + $$(CONFIG_TARGET_ROOTFS_PARTSIZE))m
+  IMAGES := sysupgrade.itb
+  IMAGE/sysupgrade.itb := append-kernel | fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-with-rootfs | pad-rootfs | append-metadata
+  ARTIFACTS := emmc-preloader.bin emmc-bl31-uboot.fip emmc-gpt.bin
+  ARTIFACT/emmc-gpt.bin := mt798x-gpt emmc
+  ARTIFACT/emmc-preloader.bin	:= mt7988-bl2 emmc-comb
+  ARTIFACT/emmc-bl31-uboot.fip	:= mt7988-bl31-uboot arcadyan_mozart
+  SUPPORTED_DEVICES += arcadyan,mozart
+endef
+TARGET_DEVICES += arcadyan_mozart
+
 define Device/asus_tuf-ax6000
   DEVICE_VENDOR := ASUS
   DEVICE_MODEL := TUF-AX6000
@@ -446,9 +515,66 @@ define Device/cetron_ct3003
 endef
 TARGET_DEVICES += cetron_ct3003
 
+define Device/cmcc_a10-stock
+  DEVICE_VENDOR := CMCC
+  DEVICE_MODEL := A10 (stock layout)
+  DEVICE_ALT0_VENDOR := SuperElectron
+  DEVICE_ALT0_MODEL := ZN-M5 (stock layout)
+  DEVICE_ALT1_VENDOR := SuperElectron
+  DEVICE_ALT1_MODEL := ZN-M8 (stock layout)
+  DEVICE_DTS := mt7981b-cmcc-a10-stock
+  DEVICE_DTS_DIR := ../dts
+  SUPPORTED_DEVICES += mediatek,mt7981-spim-snand-rfb
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  KERNEL_IN_UBI := 1
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-ubi | check-size $$$$(IMAGE_SIZE)
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  KERNEL = kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS = kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd
+endef
+TARGET_DEVICES += cmcc_a10-stock
+
+define Device/cmcc_a10-ubootmod
+  DEVICE_VENDOR := CMCC
+  DEVICE_MODEL := A10 (OpenWrt U-Boot layout)
+  DEVICE_ALT0_VENDOR := SuperElectron
+  DEVICE_ALT0_MODEL := ZN-M5 (OpenWrt U-Boot layout)
+  DEVICE_ALT1_VENDOR := SuperElectron
+  DEVICE_ALT1_MODEL := ZN-M8 (OpenWrt U-Boot layout)
+  DEVICE_DTS := mt7981b-cmcc-a10-ubootmod
+  DEVICE_DTS_DIR := ../dts
+  SUPPORTED_DEVICES += cmcc,a10
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+	fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | append-metadata
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7981-bl2 spim-nand-ddr3
+  ARTIFACT/bl31-uboot.fip := mt7981-bl31-uboot cmcc_a10
+endef
+TARGET_DEVICES += cmcc_a10-ubootmod
+
 define Device/cmcc_rax3000m
   DEVICE_VENDOR := CMCC
   DEVICE_MODEL := RAX3000M
+  DEVICE_ALT0_VENDOR := CMCC
+  DEVICE_ALT0_MODEL := RAX3000Me
   DEVICE_DTS := mt7981b-cmcc-rax3000m
   DEVICE_DTS_OVERLAY := mt7981b-cmcc-rax3000m-emmc mt7981b-cmcc-rax3000m-nand
   DEVICE_DTS_DIR := ../dts
@@ -482,6 +608,8 @@ TARGET_DEVICES += cmcc_rax3000m
 define Device/comfast_cf-e393ax
   DEVICE_VENDOR := COMFAST
   DEVICE_MODEL := CF-E393AX
+  DEVICE_ALT0_VENDOR := COMFAST
+  DEVICE_ALT0_MODEL := CF-E395AX
   DEVICE_DTS := mt7981a-comfast-cf-e393ax
   DEVICE_DTS_DIR := ../dts
   DEVICE_DTC_FLAGS := --pad 4096
@@ -536,6 +664,23 @@ define Device/cudy_ap3000outdoor-v1
 endef
 TARGET_DEVICES += cudy_ap3000outdoor-v1
 
+define Device/cudy_ap3000-v1
+  DEVICE_VENDOR := Cudy
+  DEVICE_MODEL := AP3000
+  DEVICE_VARIANT := v1
+  DEVICE_DTS := mt7981b-cudy-ap3000-v1
+  DEVICE_DTS_DIR := ../dts
+  SUPPORTED_DEVICES += R49
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  KERNEL_IN_UBI := 1
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+endef
+TARGET_DEVICES += cudy_ap3000-v1
+
 define Device/cudy_m3000-v1
   DEVICE_VENDOR := Cudy
   DEVICE_MODEL := M3000
@@ -577,6 +722,23 @@ define Device/cudy_re3000-v1
 endef
 TARGET_DEVICES += cudy_re3000-v1
 
+define Device/cudy_tr3000-256mb-v1
+  DEVICE_VENDOR := Cudy
+  DEVICE_MODEL := TR3000
+  DEVICE_VARIANT := 256mb v1
+  DEVICE_DTS := mt7981b-cudy-tr3000-256mb-v1
+  DEVICE_DTS_DIR := ../dts
+  SUPPORTED_DEVICES += R103
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 235520k
+  KERNEL_IN_UBI := 1
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+endef
+TARGET_DEVICES += cudy_tr3000-256mb-v1
+
 define Device/cudy_tr3000-v1
   DEVICE_VENDOR := Cudy
   DEVICE_MODEL := TR3000
@@ -594,6 +756,31 @@ define Device/cudy_tr3000-v1
 endef
 TARGET_DEVICES += cudy_tr3000-v1
 
+define Device/cudy_tr3000-v1-ubootmod
+  DEVICE_VENDOR := Cudy
+  DEVICE_MODEL := TR3000
+  DEVICE_VARIANT := v1 (OpenWrt U-Boot layout)
+  DEVICE_DTS := mt7981b-cudy-tr3000-v1-ubootmod
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-usb3 kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+	fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | append-metadata
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7981-bl2 cudy-tr3000-v1
+  ARTIFACT/bl31-uboot.fip := mt7981-bl31-uboot cudy_tr3000-v1
+endef
+TARGET_DEVICES += cudy_tr3000-v1-ubootmod
+
 define Device/cudy_wr3000-v1
   DEVICE_VENDOR := Cudy
   DEVICE_MODEL := WR3000
@@ -613,6 +800,57 @@ define Device/cudy_wr3000-v1
 endef
 TARGET_DEVICES += cudy_wr3000-v1
 
+define Device/cudy_wr3000e-v1
+  DEVICE_VENDOR := Cudy
+  DEVICE_MODEL := WR3000E
+  DEVICE_VARIANT := v1
+  DEVICE_DTS := mt7981b-cudy-wr3000e-v1
+  DEVICE_DTS_DIR := ../dts
+  SUPPORTED_DEVICES += R53
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  KERNEL_IN_UBI := 1
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+endef
+TARGET_DEVICES += cudy_wr3000e-v1
+
+define Device/cudy_wr3000s-v1
+  DEVICE_VENDOR := Cudy
+  DEVICE_MODEL := WR3000S
+  DEVICE_VARIANT := v1
+  DEVICE_DTS := mt7981b-cudy-wr3000s-v1
+  DEVICE_DTS_DIR := ../dts
+  SUPPORTED_DEVICES += R59
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  KERNEL_IN_UBI := 1
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+endef
+TARGET_DEVICES += cudy_wr3000s-v1
+
+define Device/cudy_wr3000h-v1
+  DEVICE_VENDOR := Cudy
+  DEVICE_MODEL := WR3000H
+  DEVICE_VARIANT := v1
+  DEVICE_DTS := mt7981b-cudy-wr3000h-v1
+  DEVICE_DTS_DIR := ../dts
+  SUPPORTED_DEVICES += R63
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  KERNEL_IN_UBI := 1
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+endef
+TARGET_DEVICES += cudy_wr3000h-v1
+
 define Device/dlink_aquila-pro-ai-m30-a1
   DEVICE_VENDOR := D-Link
   DEVICE_MODEL := AQUILA PRO AI M30
@@ -624,10 +862,30 @@ define Device/dlink_aquila-pro-ai-m30-a1
   IMAGES += recovery.bin
   IMAGE_SIZE := 51200k
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
-  IMAGE/recovery.bin := sysupgrade-tar | pad-to $$(IMAGE_SIZE) | dlink-ai-recovery-header DLK6E6110001 \x6A\x28\xEE\x0B \x00\x00\x2C\x00 \x00\x00\x20\x03 \x61\x6E
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+  IMAGE/recovery.bin := append-image-stage initramfs-kernel.bin | sysupgrade-tar kernel=$$$$@ |\
+    pad-to $$(IMAGE_SIZE) | dlink-ai-recovery-header DLK6E6110001 \x6A\x28\xEE\x0B \x00\x00\x2C\x00 \x00\x00\x20\x03 \x61\x6E
+endif
 endef
 TARGET_DEVICES += dlink_aquila-pro-ai-m30-a1
 
+define Device/dlink_aquila-pro-ai-m60-a1
+  DEVICE_VENDOR := D-Link
+  DEVICE_MODEL := AQUILA PRO AI M60
+  DEVICE_VARIANT := A1
+  DEVICE_DTS := mt7986a-dlink-aquila-pro-ai-m60-a1
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-leds-gca230718 kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  IMAGES += recovery.bin
+  IMAGE_SIZE := 51200k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+  IMAGE/recovery.bin := append-image-stage initramfs-kernel.bin | sysupgrade-tar kernel=$$$$@ |\
+    pad-to $$(IMAGE_SIZE) | dlink-ai-recovery-header DLK6E8202001 \x30\x6C\x19\x0C \x00\x00\x2C\x00 \x00\x00\x20\x03 \x82\x6E
+endif
+endef
+TARGET_DEVICES += dlink_aquila-pro-ai-m60-a1
+
 define Device/edgecore_eap111
   DEVICE_VENDOR := Edgecore
   DEVICE_MODEL := EAP111
@@ -646,6 +904,26 @@ define Device/edgecore_eap111
 endef
 TARGET_DEVICES += edgecore_eap111
 
+define Device/gatonetworks_gdsp
+  DEVICE_VENDOR := GatoNetworks
+  DEVICE_MODEL := gdsp
+  DEVICE_DTS := mt7981b-gatonetworks-gdsp
+  DEVICE_DTS_DIR := ../dts
+  IMAGES := sysupgrade.itb
+  IMAGE_SIZE := 32768k
+  DEVICE_PACKAGES := fitblk kmod-mt7915e kmod-mt7981-firmware \
+    kmod-usb-net-qmi-wwan kmod-usb-serial-option kmod-usb3 \
+    mt7981-wo-firmware -kmod-phy-aquantia
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7981-bl2 nor-ddr3
+  ARTIFACT/bl31-uboot.fip := mt7981-bl31-uboot gatonetworks_gdsp
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | pad-rootfs | append-metadata
+endef
+TARGET_DEVICES += gatonetworks_gdsp
+
 define Device/glinet_gl-mt2500
   DEVICE_VENDOR := GL.iNet
   DEVICE_MODEL := GL-MT2500
@@ -746,6 +1024,72 @@ define Device/h3c_magic-nx30-pro
 endef
 TARGET_DEVICES += h3c_magic-nx30-pro
 
+define Device/huasifei_wh3000
+  DEVICE_VENDOR := Huasifei
+  DEVICE_MODEL := WH3000
+  DEVICE_DTS := mt7981b-huasifei-wh3000
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware \
+	kmod-usb3 f2fsck mkf2fs
+  SUPPORTED_DEVICES += huasifei,wh3000-emmc
+  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += huasifei_wh3000
+
+define Device/huasifei_wh3000-pro
+  DEVICE_VENDOR := Huasifei
+  DEVICE_MODEL := WH3000 Pro
+  DEVICE_DTS := mt7981b-huasifei-wh3000-pro
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware kmod-hwmon-pwmfan kmod-usb3 f2fsck mkf2fs
+  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += huasifei_wh3000-pro
+
+define Device/iptime_ax3000q
+  DEVICE_VENDOR := ipTIME
+  DEVICE_MODEL := AX3000Q
+  DEVICE_DTS := mt7981b-iptime-ax3000q
+  DEVICE_DTS_DIR := ../dts
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 32768k
+  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGES := factory.bin sysupgrade.bin
+  IMAGE/factory.bin := sysupgrade-tar | append-metadata | check-size | iptime-crc32 ax3000q
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  SUPPORTED_DEVICES += mediatek,mt7981-spim-snand-rfb
+endef
+TARGET_DEVICES += iptime_ax3000q
+
+define Device/iptime_ax3000sm
+  DEVICE_VENDOR := ipTIME
+  DEVICE_MODEL := AX3000SM
+  DEVICE_DTS := mt7981b-iptime-ax3000sm
+  DEVICE_DTS_DIR := ../dts
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 32768k
+  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGES := factory.bin sysupgrade.bin
+  IMAGE/factory.bin := sysupgrade-tar | append-metadata | check-size | iptime-crc32 ax3ksm
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  SUPPORTED_DEVICES += mediatek,mt7981-spim-snand-rfb
+endef
+TARGET_DEVICES += iptime_ax3000sm
+
 define Device/jcg_q30-pro
   DEVICE_VENDOR := JCG
   DEVICE_MODEL := Q30 PRO
@@ -796,6 +1140,46 @@ define Device/jdcloud_re-cp-03
 endef
 TARGET_DEVICES += jdcloud_re-cp-03
 
+define Device/keenetic_kn-3811
+  DEVICE_VENDOR := Keenetic
+  DEVICE_MODEL := KN-3811
+  DEVICE_DTS := mt7981b-keenetic-kn-3811
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware kmod-usb3
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_SIZE := 6144k
+  IMAGE_SIZE := 233984k
+  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb | \
+	append-squashfs4-fakeroot
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | \
+	append-ubi | check-size | zyimage -d 0x803811 -v "KN-3811"
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += keenetic_kn-3811
+
+define Device/keenetic_kn-3911
+  DEVICE_VENDOR := Keenetic
+  DEVICE_MODEL := KN-3911
+  DEVICE_DTS := mt7981b-keenetic-kn-3911
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware kmod-phy-airoha-en8811h
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_SIZE := 6144k
+  IMAGE_SIZE := 108544k
+  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb | \
+	append-squashfs4-fakeroot
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-kernel | pad-to $$(KERNEL_SIZE) | \
+	append-ubi | check-size | zyimage -d 0x803911 -v "KN-3911"
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += keenetic_kn-3911
+
 define Device/mediatek_mt7981-rfb
   DEVICE_VENDOR := MediaTek
   DEVICE_MODEL := MT7981 rfb
@@ -954,6 +1338,20 @@ define Device/mediatek_mt7988a-rfb
 endef
 TARGET_DEVICES += mediatek_mt7988a-rfb
 
+define Device/mercusys_mr80x-v3
+  DEVICE_VENDOR := MERCUSYS
+  DEVICE_MODEL := MR80X
+  DEVICE_VARIANT := v3
+  DEVICE_DTS := mt7981b-mercusys-mr80x-v3
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += mercusys_mr80x-v3
+
 define Device/mercusys_mr90x-v1
   DEVICE_VENDOR := MERCUSYS
   DEVICE_MODEL := MR90X v1
@@ -968,6 +1366,34 @@ define Device/mercusys_mr90x-v1
 endef
 TARGET_DEVICES += mercusys_mr90x-v1
 
+define Device/mercusys_mr90x-v1-ubi
+  DEVICE_VENDOR := MERCUSYS
+  DEVICE_MODEL := MR90X v1 (UBI)
+  DEVICE_DTS := mt7986b-mercusys-mr90x-v1-ubi
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTC_FLAGS := --pad 4096
+  DEVICE_DTS_LOADADDR := 0x43f00000
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | \
+	pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+	fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-with-rootfs | \
+	append-metadata
+  ARTIFACTS := bl31-uboot.fip preloader.bin
+  ARTIFACT/bl31-uboot.fip := mt7986-bl31-uboot mercusys_mr90x-v1
+  ARTIFACT/preloader.bin := mt7986-bl2 spim-nand-ubi-ddr3
+endef
+TARGET_DEVICES += mercusys_mr90x-v1-ubi
+
 define Device/netcore_n60
   DEVICE_VENDOR := Netcore
   DEVICE_MODEL := N60
@@ -1010,6 +1436,31 @@ define Device/netgear_wax220
 endef
 TARGET_DEVICES += netgear_wax220
 
+define Device/netis_nx31
+  DEVICE_VENDOR := netis
+  DEVICE_MODEL := NX31
+  DEVICE_DTS := mt7981b-netis-nx31
+  DEVICE_DTS_DIR := ../dts
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+	fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | \
+	append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7981-bl2 spim-nand-ddr3
+  ARTIFACT/bl31-uboot.fip := mt7981-bl31-uboot netis_nx31
+endef
+TARGET_DEVICES += netis_nx31
+
 define Device/nokia_ea0326gmp
   DEVICE_VENDOR := Nokia
   DEVICE_MODEL := EA0326GMP
@@ -1039,7 +1490,10 @@ define Device/openembed_som7981
   DEVICE_MODEL := SOM7981
   DEVICE_DTS := mt7981b-openembed-som7981
   DEVICE_DTS_DIR := ../dts
-  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware kmod-usb3
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware \
+	kmod-crypto-hw-atmel kmod-eeprom-at24 kmod-gpio-beeper kmod-rtc-pcf8563 \
+	kmod-usb-net-cdc-mbim kmod-usb-net-qmi-wwan kmod-usb-serial-option \
+	kmod-usb3 uqmi
   UBINIZE_OPTS := -E 5
   BLOCKSIZE := 128k
   PAGESIZE := 2048
@@ -1051,6 +1505,19 @@ define Device/openembed_som7981
 endef
 TARGET_DEVICES += openembed_som7981
 
+define Device/openfi_6c
+  DEVICE_VENDOR := OpenFi
+  DEVICE_MODEL := 6C
+  DEVICE_DTS := mt7981b-openfi-6c
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware kmod-usb3
+  KERNEL := kernel-bin | lzma | fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+        fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += openfi_6c
+
 define Device/openwrt_one
   DEVICE_VENDOR := OpenWrt
   DEVICE_MODEL := One
@@ -1129,9 +1596,51 @@ define Device/routerich_ax3000
   DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware kmod-usb3
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   SUPPORTED_DEVICES += mediatek,mt7981-spim-snand-rfb
+  DEVICE_COMPAT_VERSION := 1.1
+  DEVICE_COMPAT_MESSAGE := Partition layout has been changed. Bootloader MUST be \
+	upgraded to avoid data corruption and getting bricked. \
+	Please, contact your vendor and follow the guide: \
+	https://openwrt.org/toh/routerich/ax3000#web_ui_method
 endef
 TARGET_DEVICES += routerich_ax3000
 
+define Device/routerich_ax3000-ubootmod
+  DEVICE_VENDOR := Routerich
+  DEVICE_MODEL := AX3000 (OpenWrt U-Boot layout)
+  DEVICE_DTS := mt7981b-routerich-ax3000-ubootmod
+  DEVICE_DTS_DIR := ../dts
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  KERNEL_IN_UBI := 1
+  UBOOTENV_IN_UBI := 1
+  IMAGES := sysupgrade.itb
+  KERNEL_INITRAMFS_SUFFIX := -recovery.itb
+  KERNEL := kernel-bin | gzip
+  KERNEL_INITRAMFS := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb with-initrd | pad-to 64k
+  IMAGE/sysupgrade.itb := append-kernel | \
+	fit gzip $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb external-static-with-rootfs | \
+	append-metadata
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware kmod-usb3 mt7981-wo-firmware
+  ARTIFACTS := preloader.bin bl31-uboot.fip
+  ARTIFACT/preloader.bin := mt7981-bl2 spim-nand-ddr3
+  ARTIFACT/bl31-uboot.fip := mt7981-bl31-uboot routerich_ax3000
+endef
+TARGET_DEVICES += routerich_ax3000-ubootmod
+
+define Device/routerich_ax3000-v1
+  DEVICE_VENDOR := Routerich
+  DEVICE_MODEL := AX3000
+  DEVICE_VARIANT := v1
+  DEVICE_DTS := mt7981b-routerich-ax3000-v1
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware kmod-usb3 mt7981-wo-firmware
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+  SUPPORTED_DEVICES += mediatek,mt7981-spim-snand-rfb
+endef
+TARGET_DEVICES += routerich_ax3000-v1
+
 define Device/ruijie_rg-x60-pro
   DEVICE_VENDOR := Ruijie
   DEVICE_MODEL := RG-X60 Pro
@@ -1142,6 +1651,20 @@ define Device/ruijie_rg-x60-pro
 endef
 TARGET_DEVICES += ruijie_rg-x60-pro
 
+define Device/tplink_archer-ax80-v1
+  DEVICE_VENDOR := TP-Link
+  DEVICE_MODEL := Archer AX80V1
+  DEVICE_DTS := mt7986a-tplink-archer-ax80-v1
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-leds-lp5523 kmod-usb3 kmod-mt7915e kmod-mt7986-firmware mt7986-wo-firmware
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 51200k
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += tplink_archer-ax80-v1
+
 define Device/tplink_re6000xd
   DEVICE_VENDOR := TP-Link
   DEVICE_MODEL := RE6000XD
@@ -1253,6 +1776,24 @@ define Device/wavlink_wl-wn586x3
 endef
 TARGET_DEVICES += wavlink_wl-wn586x3
 
+define Device/wavlink_wl-wn573hx3
+  DEVICE_VENDOR := WAVLINK
+  DEVICE_MODEL := WL-WN573HX3
+  DEVICE_ALT0_VENDOR := 7Links
+  DEVICE_ALT0_MODEL := WLR-1300
+  DEVICE_DTS := mt7981b-wavlink-wl-wn573hx3
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_DTS_LOADADDR := 0x47000000
+  IMAGE_SIZE := 14336k
+  KERNEL := kernel-bin | lzma | \
+	fit lzma $$(KDIR)/image-$$(firstword $$(DEVICE_DTS)).dtb
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware
+  SUPPORTED_DEVICES += mediatek,mt7981-spim-nor-rfb
+  IMAGES = WN573HX3-sysupgrade.bin
+  IMAGE/WN573HX3-sysupgrade.bin := append-kernel | pad-to 128k | append-rootfs | pad-rootfs | check-size | append-metadata
+endef
+TARGET_DEVICES += wavlink_wl-wn573hx3
+
 define Device/xiaomi_mi-router-ax3000t
   DEVICE_VENDOR := Xiaomi
   DEVICE_MODEL := Mi Router AX3000T
@@ -1423,6 +1964,23 @@ define Device/zbtlink_zbt-z8102ax
 endef
 TARGET_DEVICES += zbtlink_zbt-z8102ax
 
+define Device/zbtlink_zbt-z8102ax-v2
+  DEVICE_VENDOR := Zbtlink
+  DEVICE_MODEL := ZBT-Z8102AX-V2
+  DEVICE_DTS := mt7981b-zbtlink-zbt-z8102ax-v2
+  DEVICE_DTS_DIR := ../dts
+  DEVICE_PACKAGES := kmod-mt7915e kmod-mt7981-firmware mt7981-wo-firmware kmod-usb3 kmod-usb-net-qmi-wwan kmod-usb-serial-option
+  KERNEL_IN_UBI := 1
+  UBINIZE_OPTS := -E 5
+  BLOCKSIZE := 128k
+  PAGESIZE := 2048
+  IMAGE_SIZE := 65536k
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-ubi | check-size $$(IMAGE_SIZE)
+  IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
+endef
+TARGET_DEVICES += zbtlink_zbt-z8102ax-v2
+
 define Device/zbtlink_zbt-z8103ax
   DEVICE_VENDOR := Zbtlink
   DEVICE_MODEL := ZBT-Z8103AX
@@ -1443,6 +2001,10 @@ TARGET_DEVICES += zbtlink_zbt-z8103ax
 define Device/zyxel_ex5601-t0-stock
   DEVICE_VENDOR := Zyxel
   DEVICE_MODEL := EX5601-T0
+  DEVICE_ALT0_VENDOR := Zyxel
+  DEVICE_ALT0_MODEL := EX5601-T1
+  DEVICE_ALT1_VENDOR := Zyxel
+  DEVICE_ALT1_MODEL := T-56
   DEVICE_VARIANT := (stock layout)
   DEVICE_DTS := mt7986a-zyxel-ex5601-t0-stock
   DEVICE_DTS_DIR := ../dts
@@ -1466,6 +2028,10 @@ TARGET_DEVICES += zyxel_ex5601-t0-stock
 define Device/zyxel_ex5601-t0-ubootmod
   DEVICE_VENDOR := Zyxel
   DEVICE_MODEL := EX5601-T0
+  DEVICE_ALT0_VENDOR := Zyxel
+  DEVICE_ALT0_MODEL := EX5601-T1
+  DEVICE_ALT1_VENDOR := Zyxel
+  DEVICE_ALT1_MODEL := T-56
   DEVICE_VARIANT := (OpenWrt U-Boot layout)
   DEVICE_DTS := mt7986a-zyxel-ex5601-t0-ubootmod
   DEVICE_DTS_DIR := ../dts
diff --git a/target/linux/mediatek/image/mt7622.mk b/target/linux/mediatek/image/mt7622.mk
index 9f5fdc86888521..faf1b20e4ac47a 100644
--- a/target/linux/mediatek/image/mt7622.mk
+++ b/target/linux/mediatek/image/mt7622.mk
@@ -123,7 +123,7 @@ define Device/buffalo_wsr
 	buffalo-enc $$(DEVICE_MODEL) $$(BUFFALO_TAG_VERSION) -l | \
 	buffalo-tag-dhp $$(DEVICE_MODEL) JP JP | buffalo-enc-tag -l | buffalo-dhp-image
   IMAGE/factory-uboot.bin := append-ubi | \
-	buffalo-trx $$$$(BUFFALO_TRX_MAGIC) $$$$@ $(KDIR)/ubi_mark
+	buffalo-trx $$$$(BUFFALO_TRX_MAGIC) $$$$@ $(KDIR)/ubi_mark | append-metadata
   IMAGE/sysupgrade.bin := \
 	buffalo-trx $$$$(BUFFALO_TRX_MAGIC) $(KDIR)/tmp/$$(DEVICE_NAME).null | \
 	sysupgrade-tar kernel=$$$$@ | append-metadata
diff --git a/target/linux/mediatek/mt7622/config-6.6 b/target/linux/mediatek/mt7622/config-6.6
index 138eb2aaca0e04..bdfb06af76bbe5 100644
--- a/target/linux/mediatek/mt7622/config-6.6
+++ b/target/linux/mediatek/mt7622/config-6.6
@@ -1,6 +1,7 @@
 CONFIG_64BIT=y
 # CONFIG_AHCI_MTK is not set
 # CONFIG_AIROHA_EN8801SC_PHY is not set
+# CONFIG_AIR_AN8855_PHY is not set
 CONFIG_AQUANTIA_PHY=y
 CONFIG_ARCH_BINFMT_ELF_EXTRA_PHDRS=y
 CONFIG_ARCH_CORRECT_STACKTRACE_ON_KRETPROBE=y
@@ -33,7 +34,6 @@ CONFIG_ARM64_VA_BITS_39=y
 CONFIG_ARM_AMBA=y
 CONFIG_ARM_ARCH_TIMER=y
 CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
-# CONFIG_ARM_CORESIGHT_PMU_ARCH_SYSTEM_PMU is not set
 CONFIG_ARM_GIC=y
 CONFIG_ARM_GIC_V2M=y
 CONFIG_ARM_GIC_V3=y
@@ -43,21 +43,19 @@ CONFIG_ARM_MEDIATEK_CPUFREQ=y
 CONFIG_ARM_PMU=y
 CONFIG_ARM_PMUV3=y
 CONFIG_ARM_PSCI_FW=y
-# CONFIG_ARM_SMMU_V3_PMU is not set
 CONFIG_ATA=y
 CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_SD=y
 CONFIG_BLK_MQ_PCI=y
 CONFIG_BLK_PM=y
+CONFIG_BLOCK_NOTIFIERS=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
 CONFIG_BUFFER_HEAD=y
 CONFIG_BUILTIN_RETURN_ADDRESS_STRIPS_PAC=y
 CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLONE_BACKWARDS=y
 # CONFIG_CMDLINE_OVERRIDE is not set
@@ -106,6 +104,7 @@ CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
 CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_STAT=y
 CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_MITIGATIONS=y
 CONFIG_CPU_RMAP=y
 CONFIG_CPU_THERMAL=y
 CONFIG_CRC16=y
@@ -174,8 +173,6 @@ CONFIG_FUNCTION_ALIGNMENT_4B=y
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
-CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
@@ -248,6 +245,7 @@ CONFIG_MEDIATEK_GE_PHY=y
 # CONFIG_MEDIATEK_GE_SOC_PHY is not set
 CONFIG_MEDIATEK_WATCHDOG=y
 CONFIG_MESSAGE_LOGLEVEL_DEFAULT=7
+# CONFIG_MFD_AIROHA_AN8855 is not set
 CONFIG_MFD_SYSCON=y
 CONFIG_MIGRATION=y
 # CONFIG_MITIGATE_SPECTRE_BRANCH_HISTORY is not set
@@ -283,6 +281,7 @@ CONFIG_MTK_CPUX_TIMER=y
 CONFIG_MTK_HSDMA=y
 CONFIG_MTK_INFRACFG=y
 # CONFIG_MTK_LVTS_THERMAL is not set
+CONFIG_MTK_NET_PHYLIB=y
 CONFIG_MTK_PMIC_WRAP=y
 CONFIG_MTK_REGULATOR_COUPLER=y
 CONFIG_MTK_SCPSYS=y
@@ -336,7 +335,6 @@ CONFIG_PAGE_POOL=y
 CONFIG_PAGE_POOL_STATS=y
 CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
 CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
-CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y
 CONFIG_PARTITION_PERCPU=y
 CONFIG_PCI=y
 CONFIG_PCIEAER=y
@@ -386,6 +384,7 @@ CONFIG_PM_CLK=y
 CONFIG_PM_GENERIC_DOMAINS=y
 CONFIG_PM_GENERIC_DOMAINS_OF=y
 CONFIG_PM_OPP=y
+CONFIG_POLYNOMIAL=y
 CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y
 CONFIG_POWER_RESET=y
 CONFIG_POWER_RESET_SYSCON=y
@@ -409,6 +408,7 @@ CONFIG_RAS=y
 CONFIG_RATIONAL=y
 # CONFIG_RAVE_SP_CORE is not set
 CONFIG_REALTEK_PHY=y
+CONFIG_REALTEK_PHY_HWMON=y
 CONFIG_REED_SOLOMON=y
 CONFIG_REED_SOLOMON_DEC8=y
 CONFIG_REED_SOLOMON_ENC8=y
@@ -424,6 +424,7 @@ CONFIG_RPS=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_MT7622=y
 CONFIG_RTC_I2C_AND_SPI=y
+# CONFIG_RTL8261N_PHY is not set
 CONFIG_RTL8367S_GSW=y
 CONFIG_RWSEM_SPIN_ON_OWNER=y
 CONFIG_SCHED_MC=y
diff --git a/target/linux/mediatek/mt7623/config-6.6 b/target/linux/mediatek/mt7623/config-6.6
index baa31b465df9ad..8fd0f3a5995f6a 100644
--- a/target/linux/mediatek/mt7623/config-6.6
+++ b/target/linux/mediatek/mt7623/config-6.6
@@ -1,5 +1,6 @@
 # CONFIG_AIO is not set
 # CONFIG_AIROHA_EN8801SC_PHY is not set
+# CONFIG_AIR_AN8855_PHY is not set
 CONFIG_ALIGNMENT_TRAP=y
 CONFIG_ARCH_32BIT_OFF_T=y
 CONFIG_ARCH_HIBERNATION_POSSIBLE=y
@@ -52,8 +53,6 @@ CONFIG_BOUNCE=y
 CONFIG_BUFFER_HEAD=y
 # CONFIG_CACHE_L2X0 is not set
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CMDLINE="earlyprintk console=ttyS0,115200 rootfstype=squashfs,jffs2"
@@ -107,6 +106,7 @@ CONFIG_CPU_FREQ_GOV_POWERSAVE=y
 CONFIG_CPU_FREQ_STAT=y
 CONFIG_CPU_HAS_ASID=y
 CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_MITIGATIONS=y
 CONFIG_CPU_PABRT_V7=y
 CONFIG_CPU_PM=y
 CONFIG_CPU_RMAP=y
@@ -115,8 +115,6 @@ CONFIG_CPU_THUMB_CAPABLE=y
 CONFIG_CPU_TLB_V7=y
 CONFIG_CPU_V7=y
 CONFIG_CRC16=y
-# CONFIG_CRC32_SARWATE is not set
-CONFIG_CRC32_SLICEBY8=y
 CONFIG_CROSS_MEMORY_ATTACH=y
 CONFIG_CRYPTO_CRC32=y
 CONFIG_CRYPTO_CRC32C=y
@@ -189,17 +187,8 @@ CONFIG_DRM_MEDIATEK_HDMI=y
 CONFIG_DRM_MIPI_DSI=y
 CONFIG_DRM_PANEL=y
 CONFIG_DRM_PANEL_BRIDGE=y
-# CONFIG_DRM_PANEL_HIMAX_HX8394 is not set
-# CONFIG_DRM_PANEL_JADARD_JD9365DA_H3 is not set
-# CONFIG_DRM_PANEL_MAGNACHIP_D53E6EA8966 is not set
-# CONFIG_DRM_PANEL_NEWVISION_NV3051D is not set
-# CONFIG_DRM_PANEL_NOVATEK_NT36523 is not set
 CONFIG_DRM_PANEL_ORIENTATION_QUIRKS=y
 CONFIG_DRM_PANEL_RASPBERRYPI_TOUCHSCREEN=y
-# CONFIG_DRM_PANEL_SONY_TD4353_JDI is not set
-# CONFIG_DRM_PANEL_STARTEK_KD070FHFID015 is not set
-# CONFIG_DRM_PANEL_VISIONOX_R66451 is not set
-# CONFIG_DRM_PANEL_VISIONOX_VTDR6130 is not set
 CONFIG_DRM_SCHED=y
 CONFIG_DRM_SIMPLE_BRIDGE=y
 CONFIG_DTC=y
@@ -240,8 +229,6 @@ CONFIG_FWNODE_MDIO=y
 CONFIG_FW_CACHE=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
-CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_BUG=y
 CONFIG_GENERIC_CLOCKEVENTS=y
@@ -360,6 +347,7 @@ CONFIG_MEDIATEK_GE_PHY=y
 CONFIG_MEDIATEK_MT6577_AUXADC=y
 CONFIG_MEDIATEK_WATCHDOG=y
 CONFIG_MEMORY=y
+# CONFIG_MFD_AIROHA_AN8855 is not set
 CONFIG_MFD_CORE=y
 # CONFIG_MFD_HI6421_SPMI is not set
 CONFIG_MFD_MT6397=y
@@ -395,6 +383,7 @@ CONFIG_MTK_IOMMU=y
 CONFIG_MTK_IOMMU_V1=y
 # CONFIG_MTK_LVTS_THERMAL is not set
 CONFIG_MTK_MMSYS=y
+CONFIG_MTK_NET_PHYLIB=y
 CONFIG_MTK_PMIC_WRAP=y
 CONFIG_MTK_REGULATOR_COUPLER=y
 CONFIG_MTK_SCPSYS=y
@@ -459,7 +448,6 @@ CONFIG_PAGE_POOL=y
 CONFIG_PAGE_POOL_STATS=y
 CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
 CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
-CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y
 CONFIG_PCI=y
 CONFIG_PCIEAER=y
 CONFIG_PCIEPORTBUS=y
@@ -541,6 +529,7 @@ CONFIG_RTC_CLASS=y
 # CONFIG_RTC_DRV_MT7622 is not set
 CONFIG_RTC_I2C_AND_SPI=y
 CONFIG_RTC_MC146818_LIB=y
+# CONFIG_RTL8261N_PHY is not set
 # CONFIG_RTL8367S_GSW is not set
 CONFIG_RWSEM_SPIN_ON_OWNER=y
 # CONFIG_SERIAL_8250_DMA is not set
@@ -585,7 +574,6 @@ CONFIG_TIMER_PROBE=y
 CONFIG_TOUCHSCREEN_EDT_FT5X06=y
 CONFIG_TREE_RCU=y
 CONFIG_TREE_SRCU=y
-# CONFIG_UACCE is not set
 CONFIG_UBIFS_FS=y
 CONFIG_UEVENT_HELPER_PATH=""
 CONFIG_UIMAGE_FIT_BLK=y
diff --git a/target/linux/mediatek/mt7629/config-6.6 b/target/linux/mediatek/mt7629/config-6.6
index 5169acb99f0033..661f31ced6ff51 100644
--- a/target/linux/mediatek/mt7629/config-6.6
+++ b/target/linux/mediatek/mt7629/config-6.6
@@ -1,4 +1,5 @@
 # CONFIG_AIROHA_EN8801SC_PHY is not set
+# CONFIG_AIR_AN8855_PHY is not set
 CONFIG_ALIGNMENT_TRAP=y
 CONFIG_ARCH_32BIT_OFF_T=y
 CONFIG_ARCH_HIBERNATION_POSSIBLE=y
@@ -37,8 +38,6 @@ CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
 CONFIG_CACHE_L2X0=y
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 # CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE is not set
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
 CONFIG_CHR_DEV_SCH=y
@@ -77,6 +76,7 @@ CONFIG_CPU_HAS_ASID=y
 CONFIG_CPU_IDLE=y
 CONFIG_CPU_IDLE_GOV_MENU=y
 CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_MITIGATIONS=y
 CONFIG_CPU_PABRT_V7=y
 CONFIG_CPU_PM=y
 CONFIG_CPU_RMAP=y
@@ -113,8 +113,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
-CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
 CONFIG_GENERIC_BUG=y
@@ -186,6 +184,7 @@ CONFIG_MDIO_DEVICE=y
 CONFIG_MDIO_DEVRES=y
 CONFIG_MEDIATEK_GE_PHY=y
 CONFIG_MEDIATEK_WATCHDOG=y
+# CONFIG_MFD_AIROHA_AN8855 is not set
 CONFIG_MFD_SYSCON=y
 CONFIG_MIGHT_HAVE_CACHE_L2X0=y
 CONFIG_MIGRATION=y
@@ -208,6 +207,7 @@ CONFIG_MTD_UBI_WL_THRESHOLD=4096
 # CONFIG_MTK_CMDQ is not set
 CONFIG_MTK_CPUX_TIMER=y
 CONFIG_MTK_INFRACFG=y
+CONFIG_MTK_NET_PHYLIB=y
 # CONFIG_MTK_PMIC_WRAP is not set
 CONFIG_MTK_SCPSYS=y
 CONFIG_MTK_SCPSYS_PM_DOMAINS=y
@@ -259,7 +259,6 @@ CONFIG_PAGE_POOL=y
 CONFIG_PAGE_POOL_STATS=y
 CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
 CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
-CONFIG_PAHOLE_HAS_LANG_EXCLUDE=y
 CONFIG_PCI=y
 CONFIG_PCIEAER=y
 CONFIG_PCIEPORTBUS=y
@@ -301,6 +300,7 @@ CONFIG_REGMAP_MMIO=y
 CONFIG_RESET_CONTROLLER=y
 CONFIG_RFS_ACCEL=y
 CONFIG_RPS=y
+# CONFIG_RTL8261N_PHY is not set
 # CONFIG_RTL8367S_GSW is not set
 CONFIG_RWSEM_SPIN_ON_OWNER=y
 CONFIG_SCSI=y
diff --git a/target/linux/mediatek/patches-6.6/115-Revert-arm64-dts-mediatek-fix-t-phy-unit-name.patch b/target/linux/mediatek/patches-6.6/115-Revert-arm64-dts-mediatek-fix-t-phy-unit-name.patch
new file mode 100644
index 00000000000000..1d53cefd7f7fc6
--- /dev/null
+++ b/target/linux/mediatek/patches-6.6/115-Revert-arm64-dts-mediatek-fix-t-phy-unit-name.patch
@@ -0,0 +1,33 @@
+From 4c4baed29b168e9bf39545a945a9523ea280cb44 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Sat, 1 Feb 2025 04:24:17 +0000
+Subject: [PATCH 1/2] Revert "arm64: dts: mediatek: fix t-phy unit name"
+
+This reverts commit 963c3b0c47ec29b4c49c9f45965cd066f419d17f.
+---
+ arch/arm64/boot/dts/mediatek/mt7622.dtsi  | 2 +-
+ arch/arm64/boot/dts/mediatek/mt7986a.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+@@ -908,7 +908,7 @@
+ 		status = "disabled";
+ 	};
+ 
+-	sata_phy: t-phy {
++	sata_phy: t-phy@1a243000 {
+ 		compatible = "mediatek,mt7622-tphy",
+ 			     "mediatek,generic-tphy-v1";
+ 		#address-cells = <2>;
+--- a/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7986a.dtsi
+@@ -428,7 +428,7 @@
+ 			};
+ 		};
+ 
+-		pcie_phy: t-phy {
++		pcie_phy: t-phy@11c00000 {
+ 			compatible = "mediatek,mt7986-tphy",
+ 				     "mediatek,generic-tphy-v2";
+ 			ranges;
diff --git a/target/linux/mediatek/patches-6.6/116-arm64-dts-mediatek-mt7622-readd-syscon-to-pciesys-no.patch b/target/linux/mediatek/patches-6.6/116-arm64-dts-mediatek-mt7622-readd-syscon-to-pciesys-no.patch
new file mode 100644
index 00000000000000..4ae72fd70ae65d
--- /dev/null
+++ b/target/linux/mediatek/patches-6.6/116-arm64-dts-mediatek-mt7622-readd-syscon-to-pciesys-no.patch
@@ -0,0 +1,33 @@
+From 98bc223d174c7f544e8f6c4f0caa8fa144f2f4dc Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Fri, 28 Jun 2024 12:55:40 +0200
+Subject: [PATCH 2/2] arm64: dts: mediatek: mt7622: readd syscon to pciesys
+ node
+
+Sata node reference the pciesys with the property mediatek,phy-node
+and that is used as a syscon to access the pciesys regs.
+
+Readd the syscon compatible to pciesys node to restore correct
+functionality of the SATA interface.
+
+Fixes: 3ba5a6159434 ("arm64: dts: mediatek: mt7622: fix clock controllers")
+Reported-by: Frank Wunderlich <frank-w@public-files.de>
+Co-developed-by: Frank Wunderlich <frank-w@public-files.de>
+Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Cc: stable@vger.kernel.org
+---
+ arch/arm64/boot/dts/mediatek/mt7622.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi
+@@ -798,7 +798,7 @@
+ 	};
+ 
+ 	pciesys: clock-controller@1a100800 {
+-		compatible = "mediatek,mt7622-pciesys";
++		compatible = "mediatek,mt7622-pciesys", "syscon";
+ 		reg = <0 0x1a100800 0 0x1000>;
+ 		#clock-cells = <1>;
+ 		#reset-cells = <1>;
diff --git a/target/linux/mediatek/patches-6.6/121-hack-spi-nand-1b-bbm.patch b/target/linux/mediatek/patches-6.6/121-hack-spi-nand-1b-bbm.patch
index ff5521c44eafd5..d3fccad71192c9 100644
--- a/target/linux/mediatek/patches-6.6/121-hack-spi-nand-1b-bbm.patch
+++ b/target/linux/mediatek/patches-6.6/121-hack-spi-nand-1b-bbm.patch
@@ -1,6 +1,6 @@
 --- a/drivers/mtd/nand/spi/core.c
 +++ b/drivers/mtd/nand/spi/core.c
-@@ -724,7 +724,7 @@ static int spinand_mtd_write(struct mtd_
+@@ -727,7 +727,7 @@ static int spinand_mtd_write(struct mtd_
  static bool spinand_isbad(struct nand_device *nand, const struct nand_pos *pos)
  {
  	struct spinand_device *spinand = nand_to_spinand(nand);
@@ -9,7 +9,7 @@
  	struct nand_page_io_req req = {
  		.pos = *pos,
  		.ooblen = sizeof(marker),
-@@ -735,7 +735,7 @@ static bool spinand_isbad(struct nand_de
+@@ -738,7 +738,7 @@ static bool spinand_isbad(struct nand_de
  
  	spinand_select_target(spinand, pos->target);
  	spinand_read_page(spinand, &req);
diff --git a/target/linux/mediatek/patches-6.6/251-v6.8-watchdog-mediatek-mt7988-add-wdt-support.patch b/target/linux/mediatek/patches-6.6/251-v6.8-watchdog-mediatek-mt7988-add-wdt-support.patch
index b89b385eeb466f..984034125ca471 100644
--- a/target/linux/mediatek/patches-6.6/251-v6.8-watchdog-mediatek-mt7988-add-wdt-support.patch
+++ b/target/linux/mediatek/patches-6.6/251-v6.8-watchdog-mediatek-mt7988-add-wdt-support.patch
@@ -18,7 +18,7 @@ Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
 
 --- a/drivers/watchdog/mtk_wdt.c
 +++ b/drivers/watchdog/mtk_wdt.c
-@@ -58,9 +58,13 @@
+@@ -59,9 +59,13 @@
  #define WDT_SWSYSRST		0x18U
  #define WDT_SWSYS_RST_KEY	0x88000000
  
@@ -32,7 +32,7 @@ Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
  static bool nowayout = WATCHDOG_NOWAYOUT;
  static unsigned int timeout;
  
-@@ -71,10 +75,12 @@ struct mtk_wdt_dev {
+@@ -72,10 +76,12 @@ struct mtk_wdt_dev {
  	struct reset_controller_dev rcdev;
  	bool disable_wdt_extrst;
  	bool reset_by_toprgu;
@@ -45,7 +45,7 @@ Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
  };
  
  static const struct mtk_wdt_data mt2712_data = {
-@@ -89,6 +95,11 @@ static const struct mtk_wdt_data mt7986_
+@@ -94,6 +100,11 @@ static const struct mtk_wdt_data mt7986_
  	.toprgu_sw_rst_num = MT7986_TOPRGU_SW_RST_NUM,
  };
  
@@ -57,7 +57,7 @@ Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
  static const struct mtk_wdt_data mt8183_data = {
  	.toprgu_sw_rst_num = MT8183_TOPRGU_SW_RST_NUM,
  };
-@@ -109,6 +120,28 @@ static const struct mtk_wdt_data mt8195_
+@@ -114,6 +125,28 @@ static const struct mtk_wdt_data mt8195_
  	.toprgu_sw_rst_num = MT8195_TOPRGU_SW_RST_NUM,
  };
  
@@ -86,7 +86,7 @@ Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
  static int toprgu_reset_update(struct reset_controller_dev *rcdev,
  			       unsigned long id, bool assert)
  {
-@@ -119,6 +152,9 @@ static int toprgu_reset_update(struct re
+@@ -124,6 +157,9 @@ static int toprgu_reset_update(struct re
  
  	spin_lock_irqsave(&data->lock, flags);
  
@@ -96,7 +96,7 @@ Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
  	tmp = readl(data->wdt_base + WDT_SWSYSRST);
  	if (assert)
  		tmp |= BIT(id);
-@@ -127,6 +163,9 @@ static int toprgu_reset_update(struct re
+@@ -132,6 +168,9 @@ static int toprgu_reset_update(struct re
  	tmp |= WDT_SWSYS_RST_KEY;
  	writel(tmp, data->wdt_base + WDT_SWSYSRST);
  
@@ -106,7 +106,7 @@ Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
  	spin_unlock_irqrestore(&data->lock, flags);
  
  	return 0;
-@@ -406,6 +445,8 @@ static int mtk_wdt_probe(struct platform
+@@ -417,6 +456,8 @@ static int mtk_wdt_probe(struct platform
  						       wdt_data->toprgu_sw_rst_num);
  		if (err)
  			return err;
@@ -115,8 +115,8 @@ Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
  	}
  
  	mtk_wdt->disable_wdt_extrst =
-@@ -444,6 +485,7 @@ static const struct of_device_id mtk_wdt
- 	{ .compatible = "mediatek,mt6589-wdt" },
+@@ -456,6 +497,7 @@ static const struct of_device_id mtk_wdt
+ 	{ .compatible = "mediatek,mt6735-wdt", .data = &mt6735_data },
  	{ .compatible = "mediatek,mt6795-wdt", .data = &mt6795_data },
  	{ .compatible = "mediatek,mt7986-wdt", .data = &mt7986_data },
 +	{ .compatible = "mediatek,mt7988-wdt", .data = &mt7988_data },
diff --git a/target/linux/mediatek/patches-6.6/255-clk-mediatek-mt7988-infracfg-SPI0-clocks-are-not-critical.patch b/target/linux/mediatek/patches-6.6/255-clk-mediatek-mt7988-infracfg-SPI0-clocks-are-not-critical.patch
new file mode 100644
index 00000000000000..ed3471933c4103
--- /dev/null
+++ b/target/linux/mediatek/patches-6.6/255-clk-mediatek-mt7988-infracfg-SPI0-clocks-are-not-critical.patch
@@ -0,0 +1,65 @@
+From patchwork Fri Nov  1 03:19:39 2024
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Daniel Golle <daniel@makrotopia.org>
+X-Patchwork-Id: 13858671
+Return-Path: 
+ <linux-mediatek-bounces+linux-mediatek=archiver.kernel.org@lists.infradead.org>
+Date: Fri, 1 Nov 2024 03:19:39 +0000
+From: Daniel Golle <daniel@makrotopia.org>
+To: linux-mediatek@lists.infradead.org, linux-arm-kernel@lists.infradead.org,
+ linux-kernel@vger.kernel.org, linux-clk@vger.kernel.org, Uwe
+	=?iso-8859-1?q?Kleine-K=F6nig?= <u.kleine-koenig@baylibre.com>,
+ Sam Shih <sam.shih@mediatek.com>, Frank Wunderlich <frank-w@public-files.de>,
+ Daniel Golle <daniel@makrotopia.org>,
+ AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>,
+ Matthias Brugger <matthias.bgg@gmail.com>, Stephen Boyd <sboyd@kernel.org>,
+ Michael Turquette <mturquette@baylibre.com>
+Subject: [PATCH] clk: mediatek: mt7988-infracfg: SPI0 clocks are not critical
+Message-ID: <ZyRIy22aS_Yjoavg@pidgin.makrotopia.org>
+MIME-Version: 1.0
+Content-Disposition: inline
+X-BeenThere: linux-mediatek@lists.infradead.org
+X-Mailman-Version: 2.1.34
+Precedence: list
+List-Id: <linux-mediatek.lists.infradead.org>
+List-Unsubscribe: <http://lists.infradead.org/mailman/options/linux-mediatek>,
+ <mailto:linux-mediatek-request@lists.infradead.org?subject=unsubscribe>
+List-Archive: <http://lists.infradead.org/pipermail/linux-mediatek/>
+List-Post: <mailto:linux-mediatek@lists.infradead.org>
+List-Help: <mailto:linux-mediatek-request@lists.infradead.org?subject=help>
+List-Subscribe: <http://lists.infradead.org/mailman/listinfo/linux-mediatek>,
+ <mailto:linux-mediatek-request@lists.infradead.org?subject=subscribe>
+Sender: "Linux-mediatek" <linux-mediatek-bounces@lists.infradead.org>
+Errors-To: 
+ linux-mediatek-bounces+linux-mediatek=archiver.kernel.org@lists.infradead.org
+
+SPI0 clocks have wrongly been marked as critical while, probably due
+to the SPI driver not requesting them. This can (and should) be addressed
+in device tree instead.
+Remove CLK_IS_CRITICAL flag from clocks related to SPI0.
+
+Fixes: 4b4719437d85 ("clk: mediatek: add drivers for MT7988 SoC")
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/clk/mediatek/clk-mt7988-infracfg.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/clk/mediatek/clk-mt7988-infracfg.c
++++ b/drivers/clk/mediatek/clk-mt7988-infracfg.c
+@@ -196,12 +196,10 @@ static const struct mtk_gate infra_clks[
+ 	GATE_INFRA2(CLK_INFRA_SPINFI, "infra_f_fspinfi", "spinfi_sel", 10),
+ 	GATE_INFRA2_FLAGS(CLK_INFRA_66M_NFI_HCK, "infra_hf_66m_nfi_hck", "sysaxi_sel", 11,
+ 			  CLK_IS_CRITICAL),
+-	GATE_INFRA2_FLAGS(CLK_INFRA_104M_SPI0, "infra_hf_104m_spi0", "infra_mux_spi0_sel", 12,
+-			  CLK_IS_CRITICAL),
++	GATE_INFRA2(CLK_INFRA_104M_SPI0, "infra_hf_104m_spi0", "infra_mux_spi0_sel", 12),
+ 	GATE_INFRA2(CLK_INFRA_104M_SPI1, "infra_hf_104m_spi1", "infra_mux_spi1_sel", 13),
+ 	GATE_INFRA2(CLK_INFRA_104M_SPI2_BCK, "infra_hf_104m_spi2_bck", "infra_mux_spi2_sel", 14),
+-	GATE_INFRA2_FLAGS(CLK_INFRA_66M_SPI0_HCK, "infra_hf_66m_spi0_hck", "sysaxi_sel", 15,
+-			  CLK_IS_CRITICAL),
++	GATE_INFRA2(CLK_INFRA_66M_SPI0_HCK, "infra_hf_66m_spi0_hck", "sysaxi_sel", 15),
+ 	GATE_INFRA2(CLK_INFRA_66M_SPI1_HCK, "infra_hf_66m_spi1_hck", "sysaxi_sel", 16),
+ 	GATE_INFRA2(CLK_INFRA_66M_SPI2_HCK, "infra_hf_66m_spi2_hck", "sysaxi_sel", 17),
+ 	GATE_INFRA2(CLK_INFRA_66M_FLASHIF_AXI, "infra_hf_66m_flashif_axi", "sysaxi_sel", 18),
diff --git a/target/linux/mediatek/patches-6.6/330-snand-mtk-bmt-support.patch b/target/linux/mediatek/patches-6.6/330-snand-mtk-bmt-support.patch
index de8e8806433c60..90619d971ea406 100644
--- a/target/linux/mediatek/patches-6.6/330-snand-mtk-bmt-support.patch
+++ b/target/linux/mediatek/patches-6.6/330-snand-mtk-bmt-support.patch
@@ -8,7 +8,7 @@
  
  static int spinand_read_reg_op(struct spinand_device *spinand, u8 reg, u8 *val)
  {
-@@ -1346,6 +1347,7 @@ static int spinand_probe(struct spi_mem
+@@ -1352,6 +1353,7 @@ static int spinand_probe(struct spi_mem
  	if (ret)
  		return ret;
  
@@ -16,7 +16,7 @@
  	ret = mtd_device_register(mtd, NULL, 0);
  	if (ret)
  		goto err_spinand_cleanup;
-@@ -1353,6 +1355,7 @@ static int spinand_probe(struct spi_mem
+@@ -1359,6 +1361,7 @@ static int spinand_probe(struct spi_mem
  	return 0;
  
  err_spinand_cleanup:
@@ -24,7 +24,7 @@
  	spinand_cleanup(spinand);
  
  	return ret;
-@@ -1371,6 +1374,7 @@ static int spinand_remove(struct spi_mem
+@@ -1377,6 +1380,7 @@ static int spinand_remove(struct spi_mem
  	if (ret)
  		return ret;
  
diff --git a/target/linux/mediatek/patches-6.6/340-mtd-spinand-Add-support-for-the-Fidelix-FM35X1GA.patch b/target/linux/mediatek/patches-6.6/340-mtd-spinand-Add-support-for-the-Fidelix-FM35X1GA.patch
index 22408b9273dfcc..9ff6e811ecfa6c 100644
--- a/target/linux/mediatek/patches-6.6/340-mtd-spinand-Add-support-for-the-Fidelix-FM35X1GA.patch
+++ b/target/linux/mediatek/patches-6.6/340-mtd-spinand-Add-support-for-the-Fidelix-FM35X1GA.patch
@@ -18,18 +18,18 @@ Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
 +++ b/drivers/mtd/nand/spi/Makefile
 @@ -1,4 +1,4 @@
  # SPDX-License-Identifier: GPL-2.0
--spinand-objs := core.o alliancememory.o ato.o esmt.o etron.o gigadevice.o
-+spinand-objs := core.o alliancememory.o ato.o esmt.o etron.o fidelix.o gigadevice.o
+-spinand-objs := core.o alliancememory.o ato.o esmt.o etron.o fmsh.o foresee.o gigadevice.o
++spinand-objs := core.o alliancememory.o ato.o esmt.o etron.o fidelix.o fmsh.o foresee.o gigadevice.o
  spinand-objs += macronix.o micron.o paragon.o toshiba.o winbond.o xtx.o
  obj-$(CONFIG_MTD_SPI_NAND) += spinand.o
 --- a/drivers/mtd/nand/spi/core.c
 +++ b/drivers/mtd/nand/spi/core.c
-@@ -941,6 +941,7 @@ static const struct spinand_manufacturer
- 	&alliancememory_spinand_manufacturer,
- 	&ato_spinand_manufacturer,
+@@ -946,6 +946,7 @@ static const struct spinand_manufacturer
  	&esmt_c8_spinand_manufacturer,
-+	&fidelix_spinand_manufacturer,
  	&etron_spinand_manufacturer,
+ 	&fmsh_spinand_manufacturer,
++	&fidelix_spinand_manufacturer,
+ 	&foresee_spinand_manufacturer,
  	&gigadevice_spinand_manufacturer,
  	&macronix_spinand_manufacturer,
 --- /dev/null
@@ -113,11 +113,11 @@ Signed-off-by: Davide Fioravanti <pantanastyle@gmail.com>
 +};
 --- a/include/linux/mtd/spinand.h
 +++ b/include/linux/mtd/spinand.h
-@@ -264,6 +264,7 @@ extern const struct spinand_manufacturer
- extern const struct spinand_manufacturer ato_spinand_manufacturer;
+@@ -265,6 +265,7 @@ extern const struct spinand_manufacturer
  extern const struct spinand_manufacturer esmt_c8_spinand_manufacturer;
  extern const struct spinand_manufacturer etron_spinand_manufacturer;
+ extern const struct spinand_manufacturer fmsh_spinand_manufacturer;
 +extern const struct spinand_manufacturer fidelix_spinand_manufacturer;
+ extern const struct spinand_manufacturer foresee_spinand_manufacturer;
  extern const struct spinand_manufacturer gigadevice_spinand_manufacturer;
  extern const struct spinand_manufacturer macronix_spinand_manufacturer;
- extern const struct spinand_manufacturer micron_spinand_manufacturer;
diff --git a/target/linux/mediatek/patches-6.6/410-bt-mtk-serial-fix.patch b/target/linux/mediatek/patches-6.6/410-bt-mtk-serial-fix.patch
index 53e92a6dd38da4..907c0fb765abc0 100644
--- a/target/linux/mediatek/patches-6.6/410-bt-mtk-serial-fix.patch
+++ b/target/linux/mediatek/patches-6.6/410-bt-mtk-serial-fix.patch
@@ -19,7 +19,7 @@
  	},
  	[PORT_NPCM] = {
  		.name		= "Nuvoton 16550",
-@@ -2774,6 +2774,11 @@ serial8250_do_set_termios(struct uart_po
+@@ -2782,6 +2782,11 @@ serial8250_do_set_termios(struct uart_po
  	unsigned long flags;
  	unsigned int baud, quot, frac = 0;
  
diff --git a/target/linux/mediatek/patches-6.6/411-mtd-spinand-fix-support-for-FORESEE.patch b/target/linux/mediatek/patches-6.6/411-mtd-spinand-fix-support-for-FORESEE.patch
new file mode 100644
index 00000000000000..48a6515b56a238
--- /dev/null
+++ b/target/linux/mediatek/patches-6.6/411-mtd-spinand-fix-support-for-FORESEE.patch
@@ -0,0 +1,19 @@
+Force update_cache_variants to use reset for Foresee NAND with bad blocks
+
+Tested on Xiaomi AX3000T + F35SQA001G with bad blocks and without bad blocks
+
+Signed-off-by: Dim Fish <dimfish@gmail.com>
+
+--- a/drivers/mtd/nand/spi/foresee.c
++++ b/drivers/mtd/nand/spi/foresee.c
+@@ -22,8 +22,8 @@ static SPINAND_OP_VARIANTS(write_cache_v
+ 		SPINAND_PROG_LOAD(true, 0, NULL, 0));
+ 
+ static SPINAND_OP_VARIANTS(update_cache_variants,
+-		SPINAND_PROG_LOAD_X4(false, 0, NULL, 0),
+-		SPINAND_PROG_LOAD(false, 0, NULL, 0));
++		SPINAND_PROG_LOAD_X4(true, 0, NULL, 0),
++		SPINAND_PROG_LOAD(true, 0, NULL, 0));
+ 
+ static int f35sqa002g_ooblayout_ecc(struct mtd_info *mtd, int section,
+ 				    struct mtd_oob_region *region)
diff --git a/target/linux/mediatek/patches-6.6/432-drivers-spi-Add-support-for-dynamic-calibration.patch b/target/linux/mediatek/patches-6.6/432-drivers-spi-Add-support-for-dynamic-calibration.patch
index 19fe984aa6179b..7ff7b05301aea5 100644
--- a/target/linux/mediatek/patches-6.6/432-drivers-spi-Add-support-for-dynamic-calibration.patch
+++ b/target/linux/mediatek/patches-6.6/432-drivers-spi-Add-support-for-dynamic-calibration.patch
@@ -11,7 +11,7 @@ Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
 
 --- a/drivers/spi/spi.c
 +++ b/drivers/spi/spi.c
-@@ -1370,6 +1370,70 @@ static int spi_transfer_wait(struct spi_
+@@ -1380,6 +1380,70 @@ static int spi_transfer_wait(struct spi_
  	return 0;
  }
  
@@ -82,7 +82,7 @@ Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
  static void _spi_transfer_delay_ns(u32 ns)
  {
  	if (!ns)
-@@ -2215,6 +2279,75 @@ void spi_flush_queue(struct spi_controll
+@@ -2225,6 +2289,75 @@ void spi_flush_queue(struct spi_controll
  /*-------------------------------------------------------------------------*/
  
  #if defined(CONFIG_OF)
@@ -158,7 +158,7 @@ Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
  static void of_spi_parse_dt_cs_delay(struct device_node *nc,
  				     struct spi_delay *delay, const char *prop)
  {
-@@ -2354,6 +2487,10 @@ of_register_spi_device(struct spi_contro
+@@ -2364,6 +2497,10 @@ of_register_spi_device(struct spi_contro
  	if (rc)
  		goto err_out;
  
diff --git a/target/linux/mediatek/patches-6.6/435-drivers-mtd-spinand-Add-calibration-support-for-spin.patch b/target/linux/mediatek/patches-6.6/435-drivers-mtd-spinand-Add-calibration-support-for-spin.patch
index bd8e738a37cc6a..8da008f09f896e 100644
--- a/target/linux/mediatek/patches-6.6/435-drivers-mtd-spinand-Add-calibration-support-for-spin.patch
+++ b/target/linux/mediatek/patches-6.6/435-drivers-mtd-spinand-Add-calibration-support-for-spin.patch
@@ -11,7 +11,7 @@ Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
 
 --- a/drivers/mtd/nand/spi/core.c
 +++ b/drivers/mtd/nand/spi/core.c
-@@ -979,6 +979,56 @@ static int spinand_manufacturer_match(st
+@@ -984,6 +984,56 @@ static int spinand_manufacturer_match(st
  	return -ENOTSUPP;
  }
  
@@ -68,7 +68,7 @@ Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
  static int spinand_id_detect(struct spinand_device *spinand)
  {
  	u8 *id = spinand->id.data;
-@@ -1229,6 +1279,10 @@ static int spinand_init(struct spinand_d
+@@ -1234,6 +1284,10 @@ static int spinand_init(struct spinand_d
  	if (!spinand->scratchbuf)
  		return -ENOMEM;
  
diff --git a/target/linux/mediatek/patches-6.6/436-drivers-mtd-spi-nor-Add-calibration-support-for-spi-.patch b/target/linux/mediatek/patches-6.6/436-drivers-mtd-spi-nor-Add-calibration-support-for-spi-.patch
index 744042ae1aa56e..f4802f5d15d576 100644
--- a/target/linux/mediatek/patches-6.6/436-drivers-mtd-spi-nor-Add-calibration-support-for-spi-.patch
+++ b/target/linux/mediatek/patches-6.6/436-drivers-mtd-spi-nor-Add-calibration-support-for-spi-.patch
@@ -12,7 +12,7 @@ Signed-off-by: SkyLake.Huang <skylake.huang@mediatek.com>
 
 --- a/drivers/mtd/nand/spi/core.c
 +++ b/drivers/mtd/nand/spi/core.c
-@@ -1020,7 +1020,10 @@ int spinand_cal_read(void *priv, u32 *ad
+@@ -1025,7 +1025,10 @@ int spinand_cal_read(void *priv, u32 *ad
  	if (ret)
  		return ret;
  
diff --git a/target/linux/mediatek/patches-6.6/500-gsw-rtl8367s-mt7622-support.patch b/target/linux/mediatek/patches-6.6/500-gsw-rtl8367s-mt7622-support.patch
index 73f735828f110d..bb7e7be6d24307 100644
--- a/target/linux/mediatek/patches-6.6/500-gsw-rtl8367s-mt7622-support.patch
+++ b/target/linux/mediatek/patches-6.6/500-gsw-rtl8367s-mt7622-support.patch
@@ -1,6 +1,6 @@
 --- a/drivers/net/phy/Kconfig
 +++ b/drivers/net/phy/Kconfig
-@@ -419,6 +419,12 @@ config ROCKCHIP_PHY
+@@ -416,6 +416,12 @@ config ROCKCHIP_PHY
  	help
  	  Currently supports the integrated Ethernet PHY.
  
@@ -16,7 +16,7 @@
 --- a/drivers/net/phy/Makefile
 +++ b/drivers/net/phy/Makefile
 @@ -102,6 +102,7 @@ obj-$(CONFIG_QSEMI_PHY)		+= qsemi.o
- obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek/
  obj-$(CONFIG_RENESAS_PHY)	+= uPD60620.o
  obj-$(CONFIG_ROCKCHIP_PHY)	+= rockchip.o
 +obj-$(CONFIG_RTL8367S_GSW)	+= rtk/
diff --git a/target/linux/mediatek/patches-6.6/735-net-phy-realtek-rtl8261n.patch b/target/linux/mediatek/patches-6.6/735-net-phy-realtek-rtl8261n.patch
new file mode 100644
index 00000000000000..676bd7c093d24c
--- /dev/null
+++ b/target/linux/mediatek/patches-6.6/735-net-phy-realtek-rtl8261n.patch
@@ -0,0 +1,21 @@
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -396,6 +396,8 @@ config QSEMI_PHY
+ 
+ source "drivers/net/phy/realtek/Kconfig"
+ 
++source "drivers/net/phy/rtl8261n/Kconfig"
++
+ config RENESAS_PHY
+ 	tristate "Renesas PHYs"
+ 	help
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -100,6 +100,7 @@ obj-$(CONFIG_NXP_TJA11XX_PHY)	+= nxp-tja
+ obj-y				+= qcom/
+ obj-$(CONFIG_QSEMI_PHY)		+= qsemi.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek/
++obj-y				+= rtl8261n/
+ obj-$(CONFIG_RENESAS_PHY)	+= uPD60620.o
+ obj-$(CONFIG_ROCKCHIP_PHY)	+= rockchip.o
+ obj-$(CONFIG_RTL8367S_GSW)	+= rtk/
diff --git a/target/linux/mediatek/patches-6.6/736-net-pcs-mtk_usxgmii-add-polarity-control.patch b/target/linux/mediatek/patches-6.6/736-net-pcs-mtk_usxgmii-add-polarity-control.patch
new file mode 100644
index 00000000000000..68ee609aace0ce
--- /dev/null
+++ b/target/linux/mediatek/patches-6.6/736-net-pcs-mtk_usxgmii-add-polarity-control.patch
@@ -0,0 +1,56 @@
+--- a/drivers/net/pcs/pcs-mtk-usxgmii.c
++++ b/drivers/net/pcs/pcs-mtk-usxgmii.c
+@@ -52,6 +52,12 @@
+ #define USXGMII_LPA				GENMASK(15, 0)
+ #define USXGMII_LPA_LATCH			BIT(31)
+ 
++/* Register to control PCS polarity */
++#define RG_PHY_TOP_CTRL0			0x82C
++#define USXGMII_PN_SWAP_MASK			GENMASK(1, 0)
++#define USXGMII_PN_SWAP_RX			BIT(1)
++#define USXGMII_PN_SWAP_TX			BIT(0)
++
+ /* Register to read PCS link status */
+ #define RG_PCS_RX_STATUS0			0x904
+ #define RG_PCS_RX_STATUS_UPDATE			BIT(16)
+@@ -74,6 +80,7 @@ struct mtk_usxgmii_pcs {
+ 	struct clk			*clk;
+ 	struct reset_control		*reset;
+ 	phy_interface_t			interface;
++	unsigned int			polarity;
+ 	unsigned int			neg_mode;
+ 	struct list_head		node;
+ };
+@@ -155,6 +162,10 @@ static int mtk_usxgmii_pcs_config(struct
+ 
+ 	mtk_usxgmii_reset(mpcs);
+ 
++	/* Configure the interface polarity */
++	mtk_m32(mpcs, RG_PHY_TOP_CTRL0,
++		USXGMII_PN_SWAP_MASK, mpcs->polarity);
++
+ 	/* Setup USXGMII AN ctrl */
+ 	mtk_m32(mpcs, RG_PCS_AN_CTRL0,
+ 		USXGMII_AN_SYNC_CNT | USXGMII_AN_ENABLE,
+@@ -332,6 +343,7 @@ static const struct phylink_pcs_ops mtk_
+ static int mtk_usxgmii_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
++	struct device_node *np = dev->of_node;
+ 	struct mtk_usxgmii_pcs *mpcs;
+ 
+ 	mpcs = devm_kzalloc(dev, sizeof(*mpcs), GFP_KERNEL);
+@@ -342,6 +354,13 @@ static int mtk_usxgmii_probe(struct plat
+ 	if (IS_ERR(mpcs->base))
+ 		return PTR_ERR(mpcs->base);
+ 
++	if (of_property_read_bool(np->parent, "mediatek,pnswap"))
++		mpcs->polarity = USXGMII_PN_SWAP_TX | USXGMII_PN_SWAP_RX;
++	else if (of_property_read_bool(np, "mediatek,pnswap-tx"))
++		mpcs->polarity = USXGMII_PN_SWAP_TX;
++	else if (of_property_read_bool(np, "mediatek,pnswap-rx"))
++		mpcs->polarity = USXGMII_PN_SWAP_RX;
++
+ 	mpcs->dev = dev;
+ 	mpcs->pcs.ops = &mtk_usxgmii_pcs_ops;
+ 	mpcs->pcs.poll = true;
diff --git a/target/linux/mediatek/patches-6.6/737-net-dsa-add-Airoha-AN8855.patch b/target/linux/mediatek/patches-6.6/737-net-dsa-add-Airoha-AN8855.patch
new file mode 100644
index 00000000000000..bd70bec4b37e13
--- /dev/null
+++ b/target/linux/mediatek/patches-6.6/737-net-dsa-add-Airoha-AN8855.patch
@@ -0,0 +1,309 @@
+From: Christian Marangi <ansuelsmth@gmail.com>
+To: Christian Marangi <ansuelsmth@gmail.com>,
+	Lee Jones <lee@kernel.org>, Rob Herring <robh@kernel.org>,
+	Krzysztof Kozlowski <krzk+dt@kernel.org>,
+	Conor Dooley <conor+dt@kernel.org>,
+	Andrew Lunn <andrew+netdev@lunn.ch>,
+	"David S. Miller" <davem@davemloft.net>,
+	Eric Dumazet <edumazet@google.com>,
+	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
+	Vladimir Oltean <olteanv@gmail.com>,
+	Srinivas Kandagatla <srinivas.kandagatla@linaro.org>,
+	Heiner Kallweit <hkallweit1@gmail.com>,
+	Russell King <linux@armlinux.org.uk>,
+	Matthias Brugger <matthias.bgg@gmail.com>,
+	AngeloGioacchino Del Regno
+	<angelogioacchino.delregno@collabora.com>,
+	linux-arm-kernel@lists.infradead.org,
+	linux-mediatek@lists.infradead.org, netdev@vger.kernel.org,
+	devicetree@vger.kernel.org, linux-kernel@vger.kernel.org,
+	upstream@airoha.com
+Subject: [net-next PATCH v11 0/9] net: dsa: Add Airoha AN8855 support
+Date: Mon,  9 Dec 2024 14:44:17 +0100	[thread overview]
+Message-ID: <20241209134459.27110-1-ansuelsmth@gmail.com> (raw)
+
+This small series add the initial support for the Airoha AN8855 Switch.
+
+It's a 5 port Gigabit Switch with SGMII/HSGMII upstream port.
+
+This is starting to get in the wild and there are already some router
+having this switch chip.
+
+It's conceptually similar to mediatek switch but register and bits
+are different. And there is that massive Hell that is the PCS
+configuration.
+Saddly for that part we have absolutely NO documentation currently.
+
+There is this special thing where PHY needs to be calibrated with values
+from the switch efuse. (the thing have a whole cpu timer and MCU)
+
+Changes v11:
+- Address reviews from Christophe (spell mistake + dev_err_probe)
+- Fix kconfig dependency for MFD driver (depends on MDIO_DEVICE instead of MDIO)
+  (indirectly fix link error for mdio APIs)
+- Fix copy-paste error for MFD driver of_table
+- Fix compilation error for PHY (move NVMEM to .config)
+- Drop unneeded NVMEM node from MDIO example schema (from Andrew)
+- Adapt MFD example schema to MDIO reg property restrictions
+Changes v10:
+- Entire rework to MFD + split to MDIO, EFUSE, SWITCH separate drivers
+- Drop EEE OPs (while Russell finish RFC for EEE changes)
+- Use new pcs_inpand OPs
+- Drop AN restart function and move to pcs_config
+- Enable assisted_learning and disable CPU learn (preparation for fdb_isolation)
+- Move EFUSE read in Internal PHY driver to .config to handle EPROBE_DEFER
+  (needed now that NVMEM driver is register externally instead of internally to switch
+   node)
+Changes v9:
+- Error out on using 5G speed as currently not supported
+- Add missing MAC_2500FD in phylink mac_capabilities
+- Add comment and improve if condition for an8855_phylink_mac_config
+Changes v8:
+- Add port Fast Age support
+- Add support for Port Isolation
+- Use correct register for Learning Disable
+- Add support for Ageing Time OP
+- Set default PVID to 0 by default
+- Add mdb OPs
+- Add port change MTU
+- Fix support for Upper VLAN
+Changes v7:
+- Fix devm_dsa_register_switch wrong export symbol
+Changes v6:
+- Drop standard MIB and handle with ethtool OPs (as requested by Jakub)
+- Cosmetic: use bool instead of 0 or 1
+Changes v5:
+- Add devm_dsa_register_switch() patch
+- Add Reviewed-by tag for DT patch
+Changes v4:
+- Set regmap readable_table static (mute compilation warning)
+- Add support for port_bridge flags (LEARNING, FLOOD)
+- Reset fdb struct in fdb_dump
+- Drop support_asym_pause in port_enable
+- Add define for get_phy_flags
+- Fix bug for port not inititially part of a bridge
+  (in an8855_setup the port matrix was always cleared but
+   the CPU port was never initially added)
+- Disable learning and flood for user port by default
+- Set CPU port to flood and learning by default
+- Correctly AND force duplex and flow control in an8855_phylink_mac_link_up
+- Drop RGMII from pcs_config
+- Check ret in "Disable AN if not in autoneg"
+- Use devm_mutex_init
+- Fix typo for AN8855_PORT_CHECK_MODE
+- Better define AN8855_STP_LISTENING = AN8855_STP_BLOCKING
+- Fix typo in AN8855_PHY_EN_DOWN_SHIFT
+- Use paged helper for PHY
+- Skip calibration in config_init if priv not defined
+Changes v3:
+- Out of RFC
+- Switch PHY code to select_page API
+- Better describe masks and bits in PHY driver for ADC register
+- Drop raw values and use define for mii read/write
+- Switch to absolute PHY address
+- Replace raw values with mask and bits for pcs_config
+- Fix typo for ext-surge property name
+- Drop support for relocating Switch base PHY address on the bus
+Changes v2:
+- Drop mutex guard patch
+- Drop guard usage in DSA driver
+- Use __mdiobus_write/read
+- Check return condition and return errors for mii read/write
+- Fix wrong logic for EEE
+- Fix link_down (don't force link down with autoneg)
+- Fix forcing speed on sgmii autoneg
+- Better document link speed for sgmii reg
+- Use standard define for sgmii reg
+- Imlement nvmem support to expose switch EFUSE
+- Rework PHY calibration with the use of NVMEM producer/consumer
+- Update DT with new NVMEM property
+- Move aneg validation for 2500-basex in pcs_config
+- Move r50Ohm table and function to PHY driver
+
+Christian Marangi (9):
+  dt-bindings: nvmem: Document support for Airoha AN8855 Switch EFUSE
+  dt-bindings: net: Document support for Airoha AN8855 Switch Virtual
+    MDIO
+  dt-bindings: net: dsa: Document support for Airoha AN8855 DSA Switch
+  dt-bindings: mfd: Document support for Airoha AN8855 Switch SoC
+  mfd: an8855: Add support for Airoha AN8855 Switch MFD
+  net: mdio: Add Airoha AN8855 Switch MDIO Passtrough
+  nvmem: an8855: Add support for Airoha AN8855 Switch EFUSE
+  net: dsa: Add Airoha AN8855 5-Port Gigabit DSA Switch driver
+  net: phy: Add Airoha AN8855 Internal Switch Gigabit PHY
+
+ .../bindings/mfd/airoha,an8855-mfd.yaml       |  178 ++
+ .../bindings/net/airoha,an8855-mdio.yaml      |   56 +
+ .../net/dsa/airoha,an8855-switch.yaml         |  105 +
+ .../bindings/nvmem/airoha,an8855-efuse.yaml   |  123 +
+ MAINTAINERS                                   |   17 +
+ drivers/mfd/Kconfig                           |   10 +
+ drivers/mfd/Makefile                          |    1 +
+ drivers/mfd/airoha-an8855.c                   |  278 ++
+ drivers/net/dsa/Kconfig                       |    9 +
+ drivers/net/dsa/Makefile                      |    1 +
+ drivers/net/dsa/an8855.c                      | 2310 +++++++++++++++++
+ drivers/net/dsa/an8855.h                      |  783 ++++++
+ drivers/net/mdio/Kconfig                      |    9 +
+ drivers/net/mdio/Makefile                     |    1 +
+ drivers/net/mdio/mdio-an8855.c                |  113 +
+ drivers/net/phy/Kconfig                       |    5 +
+ drivers/net/phy/Makefile                      |    1 +
+ drivers/net/phy/air_an8855.c                  |  267 ++
+ drivers/nvmem/Kconfig                         |   11 +
+ drivers/nvmem/Makefile                        |    2 +
+ drivers/nvmem/an8855-efuse.c                  |   63 +
+ include/linux/mfd/airoha-an8855-mfd.h         |   41 +
+ 22 files changed, 4384 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/mfd/airoha,an8855-mfd.yaml
+ create mode 100644 Documentation/devicetree/bindings/net/airoha,an8855-mdio.yaml
+ create mode 100644 Documentation/devicetree/bindings/net/dsa/airoha,an8855-switch.yaml
+ create mode 100644 Documentation/devicetree/bindings/nvmem/airoha,an8855-efuse.yaml
+ create mode 100644 drivers/mfd/airoha-an8855.c
+ create mode 100644 drivers/net/dsa/an8855.c
+ create mode 100644 drivers/net/dsa/an8855.h
+ create mode 100644 drivers/net/mdio/mdio-an8855.c
+ create mode 100644 drivers/net/phy/air_an8855.c
+ create mode 100644 drivers/nvmem/an8855-efuse.c
+ create mode 100644 include/linux/mfd/airoha-an8855-mfd.h
+
+--- a/drivers/mfd/Kconfig
++++ b/drivers/mfd/Kconfig
+@@ -41,6 +41,16 @@ config MFD_ALTERA_SYSMGR
+ 	  using regmap_mmio accesses for ARM32 parts and SMC calls to
+ 	  EL3 for ARM64 parts.
+ 
++config MFD_AIROHA_AN8855
++	tristate "Airoha AN8855 Switch MFD"
++	select MFD_CORE
++	select MDIO_DEVICE
++	depends on NETDEVICES && OF
++	help
++	  Support for the Airoha AN8855 Switch MFD. This is a SoC Switch
++	  that provides various peripherals. Currently it provides a
++	  DSA switch and a NVMEM provider.
++
+ config MFD_ACT8945A
+ 	tristate "Active-semi ACT8945A"
+ 	select MFD_CORE
+--- a/drivers/mfd/Makefile
++++ b/drivers/mfd/Makefile
+@@ -7,6 +7,7 @@
+ obj-$(CONFIG_MFD_88PM860X)	+= 88pm860x.o
+ obj-$(CONFIG_MFD_88PM800)	+= 88pm800.o 88pm80x.o
+ obj-$(CONFIG_MFD_88PM805)	+= 88pm805.o 88pm80x.o
++obj-$(CONFIG_MFD_AIROHA_AN8855)	+= airoha-an8855.o
+ obj-$(CONFIG_MFD_ACT8945A)	+= act8945a.o
+ obj-$(CONFIG_MFD_SM501)		+= sm501.o
+ obj-$(CONFIG_ARCH_BCM2835)	+= bcm2835-pm.o
+--- a/drivers/net/dsa/Kconfig
++++ b/drivers/net/dsa/Kconfig
+@@ -24,6 +24,15 @@ config NET_DSA_LOOP
+ 	  This enables support for a fake mock-up switch chip which
+ 	  exercises the DSA APIs.
+ 
++config NET_DSA_AN8855
++	tristate "Airoha AN8855 Ethernet switch support"
++	depends on MFD_AIROHA_AN8855
++	depends on NET_DSA
++	select NET_DSA_TAG_MTK
++	help
++	  This enables support for the Airoha AN8855 Ethernet switch
++	  chip.
++
+ source "drivers/net/dsa/hirschmann/Kconfig"
+ 
+ config NET_DSA_LANTIQ_GSWIP
+--- a/drivers/net/dsa/Makefile
++++ b/drivers/net/dsa/Makefile
+@@ -5,6 +5,7 @@ obj-$(CONFIG_NET_DSA_LOOP)	+= dsa_loop.o
+ ifdef CONFIG_NET_DSA_LOOP
+ obj-$(CONFIG_FIXED_PHY)		+= dsa_loop_bdinfo.o
+ endif
++obj-$(CONFIG_NET_DSA_AN8855)	+= an8855.o
+ obj-$(CONFIG_NET_DSA_LANTIQ_GSWIP) += lantiq_gswip.o
+ obj-$(CONFIG_NET_DSA_MT7530)	+= mt7530.o
+ obj-$(CONFIG_NET_DSA_MT7530_MDIO) += mt7530-mdio.o
+--- a/drivers/net/mdio/Kconfig
++++ b/drivers/net/mdio/Kconfig
+@@ -61,6 +61,15 @@ config MDIO_XGENE
+ 	  This module provides a driver for the MDIO busses found in the
+ 	  APM X-Gene SoC's.
+ 
++config MDIO_AN8855
++	tristate "Airoha AN8855 Switch MDIO bus controller"
++	depends on MFD_AIROHA_AN8855
++	depends on OF_MDIO
++	help
++	  This module provides a driver for the Airoha AN8855 Switch
++	  that requires a MDIO passtrough as switch address is shared
++	  with the internal PHYs and requires additional page handling.
++
+ config MDIO_ASPEED
+ 	tristate "ASPEED MDIO bus controller"
+ 	depends on ARCH_ASPEED || COMPILE_TEST
+--- a/drivers/net/mdio/Makefile
++++ b/drivers/net/mdio/Makefile
+@@ -5,6 +5,7 @@ obj-$(CONFIG_ACPI_MDIO)		+= acpi_mdio.o
+ obj-$(CONFIG_FWNODE_MDIO)	+= fwnode_mdio.o
+ obj-$(CONFIG_OF_MDIO)		+= of_mdio.o
+ 
++obj-$(CONFIG_MDIO_AN8855)		+= mdio-an8855.o
+ obj-$(CONFIG_MDIO_ASPEED)		+= mdio-aspeed.o
+ obj-$(CONFIG_MDIO_BCM_IPROC)		+= mdio-bcm-iproc.o
+ obj-$(CONFIG_MDIO_BCM_UNIMAC)		+= mdio-bcm-unimac.o
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -147,6 +147,11 @@ config AIROHA_EN8801SC_PHY
+ 	help
+ 	  Currently supports the Airoha EN8801SC PHY.
+ 
++config AIR_AN8855_PHY
++	tristate "Airoha AN8855 Internal Gigabit PHY"
++	help
++	  Currently supports the internal Airoha AN8855 Switch PHY.
++
+ config AIR_EN8811H_PHY
+ 	tristate "Airoha EN8811H 2.5 Gigabit PHY"
+ 	help
+--- a/drivers/net/phy/Makefile
++++ b/drivers/net/phy/Makefile
+@@ -50,6 +50,7 @@ obj-y				+= $(sfp-obj-y) $(sfp-obj-m)
+ obj-$(CONFIG_ADIN_PHY)		+= adin.o
+ obj-$(CONFIG_ADIN1100_PHY)	+= adin1100.o
+ obj-$(CONFIG_AIROHA_EN8801SC_PHY)   += en8801sc.o
++obj-$(CONFIG_AIR_AN8855_PHY)		+= air_an8855.o
+ obj-$(CONFIG_AIR_EN8811H_PHY)   += air_en8811h.o
+ obj-$(CONFIG_AMD_PHY)		+= amd.o
+ obj-$(CONFIG_AQUANTIA_PHY)	+= aquantia/
+--- a/drivers/nvmem/Kconfig
++++ b/drivers/nvmem/Kconfig
+@@ -29,6 +29,17 @@ source "drivers/nvmem/layouts/Kconfig"
+ 
+ # Devices
+ 
++config NVMEM_AN8855_EFUSE
++	tristate "Airoha AN8855 eFuse support"
++	depends on MFD_AIROHA_AN8855 || COMPILE_TEST
++	help
++	  Say y here to enable support for reading eFuses on Airoha AN8855
++	  Switch. These are e.g. used to store factory programmed
++	  calibration data required for the PHY.
++
++	  This driver can also be built as a module. If so, the module will
++	  be called nvmem-an8855-efuse.
++
+ config NVMEM_APPLE_EFUSES
+ 	tristate "Apple eFuse support"
+ 	depends on ARCH_APPLE || COMPILE_TEST
+--- a/drivers/nvmem/Makefile
++++ b/drivers/nvmem/Makefile
+@@ -10,6 +10,8 @@ nvmem_layouts-y			:= layouts.o
+ obj-y				+= layouts/
+ 
+ # Devices
++obj-$(CONFIG_NVMEM_AN8855_EFUSE)	+= nvmem-an8855-efuse.o
++nvmem-an8855-efuse-y 			:= an8855-efuse.o
+ obj-$(CONFIG_NVMEM_APPLE_EFUSES)	+= nvmem-apple-efuses.o
+ nvmem-apple-efuses-y 			:= apple-efuses.o
+ obj-$(CONFIG_NVMEM_BCM_OCOTP)		+= nvmem-bcm-ocotp.o
diff --git a/target/linux/mediatek/patches-6.6/738-net-phylink-move-phylink_pcs_neg_mode.patch b/target/linux/mediatek/patches-6.6/738-net-phylink-move-phylink_pcs_neg_mode.patch
new file mode 100644
index 00000000000000..2860b785faf869
--- /dev/null
+++ b/target/linux/mediatek/patches-6.6/738-net-phylink-move-phylink_pcs_neg_mode.patch
@@ -0,0 +1,166 @@
+From 5e5401d6612ef599ad45785b941eebda7effc90f Mon Sep 17 00:00:00 2001
+From: "Russell King (Oracle)" <rmk+kernel@armlinux.org.uk>
+Date: Thu, 4 Jan 2024 09:47:36 +0000
+Subject: [PATCH] net: phylink: move phylink_pcs_neg_mode() into phylink.c
+
+Move phylink_pcs_neg_mode() from the header file into the .c file since
+nothing should be using it.
+
+Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ drivers/net/phy/phylink.c | 66 +++++++++++++++++++++++++++++++++++++++
+ include/linux/phylink.h   | 66 ---------------------------------------
+ 2 files changed, 66 insertions(+), 66 deletions(-)
+
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -1150,6 +1150,72 @@ static void phylink_pcs_an_restart(struc
+ 		pl->pcs->ops->pcs_an_restart(pl->pcs);
+ }
+ 
++/**
++ * phylink_pcs_neg_mode() - helper to determine PCS inband mode
++ * @mode: one of %MLO_AN_FIXED, %MLO_AN_PHY, %MLO_AN_INBAND.
++ * @interface: interface mode to be used
++ * @advertising: adertisement ethtool link mode mask
++ *
++ * Determines the negotiation mode to be used by the PCS, and returns
++ * one of:
++ *
++ * - %PHYLINK_PCS_NEG_NONE: interface mode does not support inband
++ * - %PHYLINK_PCS_NEG_OUTBAND: an out of band mode (e.g. reading the PHY)
++ *   will be used.
++ * - %PHYLINK_PCS_NEG_INBAND_DISABLED: inband mode selected but autoneg
++ *   disabled
++ * - %PHYLINK_PCS_NEG_INBAND_ENABLED: inband mode selected and autoneg enabled
++ *
++ * Note: this is for cases where the PCS itself is involved in negotiation
++ * (e.g. Clause 37, SGMII and similar) not Clause 73.
++ */
++static unsigned int phylink_pcs_neg_mode(unsigned int mode,
++					 phy_interface_t interface,
++					 const unsigned long *advertising)
++{
++	unsigned int neg_mode;
++
++	switch (interface) {
++	case PHY_INTERFACE_MODE_SGMII:
++	case PHY_INTERFACE_MODE_QSGMII:
++	case PHY_INTERFACE_MODE_QUSGMII:
++	case PHY_INTERFACE_MODE_USXGMII:
++		/* These protocols are designed for use with a PHY which
++		 * communicates its negotiation result back to the MAC via
++		 * inband communication. Note: there exist PHYs that run
++		 * with SGMII but do not send the inband data.
++		 */
++		if (!phylink_autoneg_inband(mode))
++			neg_mode = PHYLINK_PCS_NEG_OUTBAND;
++		else
++			neg_mode = PHYLINK_PCS_NEG_INBAND_ENABLED;
++		break;
++
++	case PHY_INTERFACE_MODE_1000BASEX:
++	case PHY_INTERFACE_MODE_2500BASEX:
++		/* 1000base-X is designed for use media-side for Fibre
++		 * connections, and thus the Autoneg bit needs to be
++		 * taken into account. We also do this for 2500base-X
++		 * as well, but drivers may not support this, so may
++		 * need to override this.
++		 */
++		if (!phylink_autoneg_inband(mode))
++			neg_mode = PHYLINK_PCS_NEG_OUTBAND;
++		else if (linkmode_test_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
++					   advertising))
++			neg_mode = PHYLINK_PCS_NEG_INBAND_ENABLED;
++		else
++			neg_mode = PHYLINK_PCS_NEG_INBAND_DISABLED;
++		break;
++
++	default:
++		neg_mode = PHYLINK_PCS_NEG_NONE;
++		break;
++	}
++
++	return neg_mode;
++}
++
+ static void phylink_major_config(struct phylink *pl, bool restart,
+ 				  const struct phylink_link_state *state)
+ {
+--- a/include/linux/phylink.h
++++ b/include/linux/phylink.h
+@@ -99,72 +99,6 @@ static inline bool phylink_autoneg_inban
+ }
+ 
+ /**
+- * phylink_pcs_neg_mode() - helper to determine PCS inband mode
+- * @mode: one of %MLO_AN_FIXED, %MLO_AN_PHY, %MLO_AN_INBAND.
+- * @interface: interface mode to be used
+- * @advertising: adertisement ethtool link mode mask
+- *
+- * Determines the negotiation mode to be used by the PCS, and returns
+- * one of:
+- *
+- * - %PHYLINK_PCS_NEG_NONE: interface mode does not support inband
+- * - %PHYLINK_PCS_NEG_OUTBAND: an out of band mode (e.g. reading the PHY)
+- *   will be used.
+- * - %PHYLINK_PCS_NEG_INBAND_DISABLED: inband mode selected but autoneg
+- *   disabled
+- * - %PHYLINK_PCS_NEG_INBAND_ENABLED: inband mode selected and autoneg enabled
+- *
+- * Note: this is for cases where the PCS itself is involved in negotiation
+- * (e.g. Clause 37, SGMII and similar) not Clause 73.
+- */
+-static inline unsigned int phylink_pcs_neg_mode(unsigned int mode,
+-						phy_interface_t interface,
+-						const unsigned long *advertising)
+-{
+-	unsigned int neg_mode;
+-
+-	switch (interface) {
+-	case PHY_INTERFACE_MODE_SGMII:
+-	case PHY_INTERFACE_MODE_QSGMII:
+-	case PHY_INTERFACE_MODE_QUSGMII:
+-	case PHY_INTERFACE_MODE_USXGMII:
+-		/* These protocols are designed for use with a PHY which
+-		 * communicates its negotiation result back to the MAC via
+-		 * inband communication. Note: there exist PHYs that run
+-		 * with SGMII but do not send the inband data.
+-		 */
+-		if (!phylink_autoneg_inband(mode))
+-			neg_mode = PHYLINK_PCS_NEG_OUTBAND;
+-		else
+-			neg_mode = PHYLINK_PCS_NEG_INBAND_ENABLED;
+-		break;
+-
+-	case PHY_INTERFACE_MODE_1000BASEX:
+-	case PHY_INTERFACE_MODE_2500BASEX:
+-		/* 1000base-X is designed for use media-side for Fibre
+-		 * connections, and thus the Autoneg bit needs to be
+-		 * taken into account. We also do this for 2500base-X
+-		 * as well, but drivers may not support this, so may
+-		 * need to override this.
+-		 */
+-		if (!phylink_autoneg_inband(mode))
+-			neg_mode = PHYLINK_PCS_NEG_OUTBAND;
+-		else if (linkmode_test_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
+-					   advertising))
+-			neg_mode = PHYLINK_PCS_NEG_INBAND_ENABLED;
+-		else
+-			neg_mode = PHYLINK_PCS_NEG_INBAND_DISABLED;
+-		break;
+-
+-	default:
+-		neg_mode = PHYLINK_PCS_NEG_NONE;
+-		break;
+-	}
+-
+-	return neg_mode;
+-}
+-
+-/**
+  * struct phylink_link_state - link state structure
+  * @advertising: ethtool bitmask containing advertised link modes
+  * @lp_advertising: ethtool bitmask containing link partner advertised link
diff --git a/target/linux/mediatek/patches-6.6/739-net-add-negotiation-of-in-band-capabilities.patch b/target/linux/mediatek/patches-6.6/739-net-add-negotiation-of-in-band-capabilities.patch
new file mode 100644
index 00000000000000..b0c78979451d78
--- /dev/null
+++ b/target/linux/mediatek/patches-6.6/739-net-add-negotiation-of-in-band-capabilities.patch
@@ -0,0 +1,1233 @@
+From: "Russell King (Oracle)" <linux@armlinux.org.uk>
+To: Andrew Lunn <andrew@lunn.ch>, Heiner Kallweit <hkallweit1@gmail.com>
+Cc: Alexander Couzens <lynxis@fe80.eu>,
+	Andrew Lunn <andrew+netdev@lunn.ch>,
+	AngeloGioacchino Del Regno
+	<angelogioacchino.delregno@collabora.com>,
+	Broadcom internal kernel review list
+	<bcm-kernel-feedback-list@broadcom.com>,
+	Daniel Golle <daniel@makrotopia.org>,
+	"David S. Miller" <davem@davemloft.net>,
+	Eric Dumazet <edumazet@google.com>,
+	Florian Fainelli <florian.fainelli@broadcom.com>,
+	Ioana Ciornei <ioana.ciornei@nxp.com>,
+	Jakub Kicinski <kuba@kernel.org>,
+	Jose Abreu <Jose.Abreu@synopsys.com>,
+	linux-arm-kernel@lists.infradead.org,
+	linux-mediatek@lists.infradead.org,
+	Marcin Wojtas <marcin.s.wojtas@gmail.com>,
+	Matthias Brugger <matthias.bgg@gmail.com>,
+	netdev@vger.kernel.org, Paolo Abeni <pabeni@redhat.com>
+Subject: [PATCH RFC net-next 00/16] net: add negotiation of in-band capabilities
+Date: Tue, 26 Nov 2024 09:23:48 +0000	[thread overview]
+Message-ID: <Z0WTpE8wkpjMiv_J@shell.armlinux.org.uk> (raw)
+
+Hi,
+
+Yes, this is one patch over the limit of 15 for netdev - but I think it's
+important to include the last patch to head off review comments like "why
+don't you remove phylink_phy_no_inband() in this series?"
+
+Phylink's handling of in-band has been deficient for a long time, and
+people keep hitting problems with it. Notably, situations with the way-
+to-late standardized 2500Base-X and whether that should or should not
+have in-band enabled. We have also been carrying a hack in the form of
+phylink_phy_no_inband() for a PHY that has been used on a SFP module,
+but has no in-band capabilities, not even for SGMII.
+
+When phylink is trying to operate in in-band mode, this series will look
+at the capabilities of the MAC-side PCS and PHY, and work out whether
+in-band can or should be used, programming the PHY as appropriate. This
+includes in-band bypass mode at the PHY.
+
+We don't... yet... support that on the MAC side PCS, because that
+requires yet more complexity.
+
+Patch 1 passes struct phylink and struct phylink_pcs into
+phylink_pcs_neg_mode() so we can look at more state in this function in
+a future patch.
+
+Patch 2 splits "cur_link_an_mode" (the MLO_AN_* mode) into two separate
+purposes - a requested and an active mode. The active mode is the one
+we will be using for the MAC, which becomes dependent on the result of
+in-band negotiation.
+
+Patch 3 adds debug to phylink_major_config() so we can see what is going
+on with the requested and active AN modes.
+
+Patch 4 adds to phylib a method to get the in-band capabilities of the
+PHY from phylib. Patches 5 and 6 add implementations for BCM84881 and
+some Marvell PHYs found on SFPs.
+
+Patch 7 adds to phylib a method to configure the PHY in-band signalling,
+and patch 8 implements it for those Marvell PHYs that support the method
+in patch 4.
+
+Patch 9 does the same as patch 4 but for the MAC-side PCS, with patches
+10 through 14 adding support to several PCS.
+
+Patch 15 adds the code to phylink_pcs_neg_mode() which looks at the
+capabilities, and works out whether to use in-band or out-band mode for
+driving the link between the MAC PCS and PHY.
+
+Patch 16 removes the phylink_phy_no_inband() hack now that we are
+publishing the in-band capabilities from the BCM84881 PHY driver.
+
+ drivers/net/ethernet/marvell/mvneta.c           |  27 +-
+ drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c |  25 +-
+ drivers/net/pcs/pcs-lynx.c                      |  22 ++
+ drivers/net/pcs/pcs-mtk-lynxi.c                 |  16 ++
+ drivers/net/pcs/pcs-xpcs.c                      |  28 ++
+ drivers/net/phy/bcm84881.c                      |  10 +
+ drivers/net/phy/marvell.c                       |  48 ++++
+ drivers/net/phy/phy.c                           |  52 ++++
+ drivers/net/phy/phylink.c                       | 352 +++++++++++++++++++-----
+ include/linux/phy.h                             |  34 +++
+ include/linux/phylink.h                         |  17 ++
+ 11 files changed, 539 insertions(+), 92 deletions(-)
+
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -56,7 +56,8 @@ struct phylink {
+ 	struct phy_device *phydev;
+ 	phy_interface_t link_interface;	/* PHY_INTERFACE_xxx */
+ 	u8 cfg_link_an_mode;		/* MLO_AN_xxx */
+-	u8 cur_link_an_mode;
++	u8 req_link_an_mode;		/* Requested MLO_AN_xxx mode */
++	u8 act_link_an_mode;		/* Active MLO_AN_xxx mode */
+ 	u8 link_port;			/* The current non-phy ethtool port */
+ 	__ETHTOOL_DECLARE_LINK_MODE_MASK(supported);
+ 
+@@ -74,6 +75,7 @@ struct phylink {
+ 
+ 	struct mutex state_mutex;
+ 	struct phylink_link_state phy_state;
++	unsigned int phy_ib_mode;
+ 	struct work_struct resolve;
+ 	unsigned int pcs_neg_mode;
+ 	unsigned int pcs_state;
+@@ -175,6 +177,24 @@ static const char *phylink_an_mode_str(u
+ 	return mode < ARRAY_SIZE(modestr) ? modestr[mode] : "unknown";
+ }
+ 
++static const char *phylink_pcs_mode_str(unsigned int mode)
++{
++	if (!mode)
++		return "none";
++
++	if (mode & PHYLINK_PCS_NEG_OUTBAND)
++		return "outband";
++
++	if (mode & PHYLINK_PCS_NEG_INBAND) {
++		if (mode & PHYLINK_PCS_NEG_ENABLED)
++			return "inband,an-enabled";
++		else
++			return "inband,an-disabled";
++	}
++
++	return "unknown";
++}
++
+ static unsigned int phylink_interface_signal_rate(phy_interface_t interface)
+ {
+ 	switch (interface) {
+@@ -1053,6 +1073,15 @@ static void phylink_resolve_an_pause(str
+ 	}
+ }
+ 
++static unsigned int phylink_pcs_inband_caps(struct phylink_pcs *pcs,
++				    phy_interface_t interface)
++{
++	if (pcs && pcs->ops->pcs_inband_caps)
++		return pcs->ops->pcs_inband_caps(pcs, interface);
++
++	return 0;
++}
++
+ static void phylink_pcs_pre_config(struct phylink_pcs *pcs,
+ 				   phy_interface_t interface)
+ {
+@@ -1106,6 +1135,24 @@ static void phylink_pcs_link_up(struct p
+ 		pcs->ops->pcs_link_up(pcs, neg_mode, interface, speed, duplex);
+ }
+ 
++/* Query inband for a specific interface mode, asking the MAC for the
++ * PCS which will be used to handle the interface mode.
++ */
++static unsigned int phylink_inband_caps(struct phylink *pl,
++					 phy_interface_t interface)
++{
++	struct phylink_pcs *pcs;
++
++	if (!pl->mac_ops->mac_select_pcs)
++		return 0;
++
++	pcs = pl->mac_ops->mac_select_pcs(pl->config, interface);
++	if (!pcs)
++		return 0;
++
++	return phylink_pcs_inband_caps(pcs, interface);
++}
++
+ static void phylink_pcs_poll_stop(struct phylink *pl)
+ {
+ 	if (pl->cfg_link_an_mode == MLO_AN_INBAND)
+@@ -1132,13 +1179,13 @@ static void phylink_mac_config(struct ph
+ 
+ 	phylink_dbg(pl,
+ 		    "%s: mode=%s/%s/%s adv=%*pb pause=%02x\n",
+-		    __func__, phylink_an_mode_str(pl->cur_link_an_mode),
++		    __func__, phylink_an_mode_str(pl->act_link_an_mode),
+ 		    phy_modes(st.interface),
+ 		    phy_rate_matching_to_str(st.rate_matching),
+ 		    __ETHTOOL_LINK_MODE_MASK_NBITS, st.advertising,
+ 		    st.pause);
+ 
+-	pl->mac_ops->mac_config(pl->config, pl->cur_link_an_mode, &st);
++	pl->mac_ops->mac_config(pl->config, pl->act_link_an_mode, &st);
+ }
+ 
+ static void phylink_pcs_an_restart(struct phylink *pl)
+@@ -1146,13 +1193,14 @@ static void phylink_pcs_an_restart(struc
+ 	if (pl->pcs && linkmode_test_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
+ 					 pl->link_config.advertising) &&
+ 	    phy_interface_mode_is_8023z(pl->link_config.interface) &&
+-	    phylink_autoneg_inband(pl->cur_link_an_mode))
++	    phylink_autoneg_inband(pl->act_link_an_mode))
+ 		pl->pcs->ops->pcs_an_restart(pl->pcs);
+ }
+ 
+ /**
+  * phylink_pcs_neg_mode() - helper to determine PCS inband mode
+- * @mode: one of %MLO_AN_FIXED, %MLO_AN_PHY, %MLO_AN_INBAND.
++ * @pl: a pointer to a &struct phylink returned from phylink_create()
++ * @pcs: a pointer to &struct phylink_pcs
+  * @interface: interface mode to be used
+  * @advertising: adertisement ethtool link mode mask
+  *
+@@ -1169,11 +1217,21 @@ static void phylink_pcs_an_restart(struc
+  * Note: this is for cases where the PCS itself is involved in negotiation
+  * (e.g. Clause 37, SGMII and similar) not Clause 73.
+  */
+-static unsigned int phylink_pcs_neg_mode(unsigned int mode,
+-					 phy_interface_t interface,
+-					 const unsigned long *advertising)
++static void phylink_pcs_neg_mode(struct phylink *pl, struct phylink_pcs *pcs,
++				 phy_interface_t interface,
++				 const unsigned long *advertising)
+ {
+-	unsigned int neg_mode;
++	unsigned int pcs_ib_caps = 0;
++	unsigned int phy_ib_caps = 0;
++	unsigned int neg_mode, mode;
++	enum {
++		INBAND_CISCO_SGMII,
++		INBAND_BASEX,
++	} type;
++
++	mode = pl->req_link_an_mode;
++
++	pl->phy_ib_mode = 0;
+ 
+ 	switch (interface) {
+ 	case PHY_INTERFACE_MODE_SGMII:
+@@ -1185,10 +1243,7 @@ static unsigned int phylink_pcs_neg_mode
+ 		 * inband communication. Note: there exist PHYs that run
+ 		 * with SGMII but do not send the inband data.
+ 		 */
+-		if (!phylink_autoneg_inband(mode))
+-			neg_mode = PHYLINK_PCS_NEG_OUTBAND;
+-		else
+-			neg_mode = PHYLINK_PCS_NEG_INBAND_ENABLED;
++		type = INBAND_CISCO_SGMII;
+ 		break;
+ 
+ 	case PHY_INTERFACE_MODE_1000BASEX:
+@@ -1199,21 +1254,143 @@ static unsigned int phylink_pcs_neg_mode
+ 		 * as well, but drivers may not support this, so may
+ 		 * need to override this.
+ 		 */
+-		if (!phylink_autoneg_inband(mode))
++		type = INBAND_BASEX;
++		break;
++
++	default:
++		pl->pcs_neg_mode = PHYLINK_PCS_NEG_NONE;
++		pl->act_link_an_mode = mode;
++		return;
++	}
++
++	if (pcs)
++		pcs_ib_caps = phylink_pcs_inband_caps(pcs, interface);
++
++	if (pl->phydev)
++		phy_ib_caps = phy_inband_caps(pl->phydev, interface);
++
++	phylink_dbg(pl, "interface %s inband modes: pcs=%02x phy=%02x\n",
++		    phy_modes(interface), pcs_ib_caps, phy_ib_caps);
++
++	if (!phylink_autoneg_inband(mode)) {
++		bool pcs_ib_only = false;
++		bool phy_ib_only = false;
++
++		if (pcs_ib_caps && pcs_ib_caps != LINK_INBAND_DISABLE) {
++			/* PCS supports reporting in-band capabilities, and
++			 * supports more than disable mode.
++			 */
++			if (pcs_ib_caps & LINK_INBAND_DISABLE)
++				neg_mode = PHYLINK_PCS_NEG_OUTBAND;
++			else if (pcs_ib_caps & LINK_INBAND_ENABLE)
++				pcs_ib_only = true;
++		}
++
++		if (phy_ib_caps && phy_ib_caps != LINK_INBAND_DISABLE) {
++			/* PHY supports in-band capabilities, and supports
++			 * more than disable mode.
++			 */
++			if (phy_ib_caps & LINK_INBAND_DISABLE)
++				pl->phy_ib_mode = LINK_INBAND_DISABLE;
++			else if (phy_ib_caps & LINK_INBAND_BYPASS)
++				pl->phy_ib_mode = LINK_INBAND_BYPASS;
++			else if (phy_ib_caps & LINK_INBAND_ENABLE)
++				phy_ib_only = true;
++		}
++
++		/* If either the PCS or PHY requires inband to be enabled,
++		 * this is an invalid configuration. Provide a diagnostic
++		 * message for this case, but don't try to force the issue.
++		 */
++		if (pcs_ib_only || phy_ib_only)
++			phylink_warn(pl,
++				     "firmware wants %s mode, but %s%s%s requires inband\n",
++				     phylink_an_mode_str(mode),
++				     pcs_ib_only ? "PCS" : "",
++				     pcs_ib_only && phy_ib_only ? " and " : "",
++				     phy_ib_only ? "PHY" : "");
++
++		neg_mode = PHYLINK_PCS_NEG_OUTBAND;
++	} else if (type == INBAND_CISCO_SGMII || pl->phydev) {
++		/* For SGMII modes which are designed to be used with PHYs, or
++		 * Base-X with a PHY, we try to use in-band mode where-ever
++		 * possible. However, there are some PHYs e.g. BCM84881 which
++		 * do not support in-band.
++		 */
++		const unsigned int inband_ok = LINK_INBAND_ENABLE |
++					       LINK_INBAND_BYPASS;
++		const unsigned int outband_ok = LINK_INBAND_DISABLE |
++						LINK_INBAND_BYPASS;
++		/* PCS	PHY
++		 * D E	D E
++		 * 0 0  0 0	no information			inband enabled
++		 * 1 0  0 0	pcs doesn't support		outband
++		 * 0 1  0 0	pcs required			inband enabled
++		 * 1 1  0 0	pcs optional			inband enabled
++		 * 0 0  1 0	phy doesn't support		outband
++		 * 1 0  1 0	pcs+phy doesn't support		outband
++		 * 0 1  1 0	pcs required, phy doesn't support, invalid
++		 * 1 1  1 0	pcs optional, phy doesn't support, outband
++		 * 0 0  0 1	phy required			inband enabled
++		 * 1 0  0 1	pcs doesn't support, phy required, invalid
++		 * 0 1  0 1	pcs+phy required		inband enabled
++		 * 1 1  0 1	pcs optional, phy required	inband enabled
++		 * 0 0  1 1	phy optional			inband enabled
++		 * 1 0  1 1	pcs doesn't support, phy optional, outband
++		 * 0 1  1 1	pcs required, phy optional	inband enabled
++		 * 1 1  1 1	pcs+phy optional		inband enabled
++		 */
++		if ((!pcs_ib_caps || pcs_ib_caps & inband_ok) &&
++		    (!phy_ib_caps || phy_ib_caps & inband_ok)) {
++			/* In-band supported or unknown at both ends. Enable
++			 * in-band mode with or without bypass at the PHY.
++			 */
++			if (phy_ib_caps & LINK_INBAND_ENABLE)
++				pl->phy_ib_mode = LINK_INBAND_ENABLE;
++			else if (phy_ib_caps & LINK_INBAND_BYPASS)
++				pl->phy_ib_mode = LINK_INBAND_BYPASS;
++
++			neg_mode = PHYLINK_PCS_NEG_INBAND_ENABLED;
++		} else if ((!pcs_ib_caps || pcs_ib_caps & outband_ok) &&
++			   (!phy_ib_caps || phy_ib_caps & outband_ok)) {
++			/* Either in-band not supported at at least one end.
++			 * In-band bypass at the other end is possible.
++			 */
++			if (phy_ib_caps & LINK_INBAND_DISABLE)
++				pl->phy_ib_mode = LINK_INBAND_DISABLE;
++			else if (phy_ib_caps & LINK_INBAND_BYPASS)
++				pl->phy_ib_mode = LINK_INBAND_BYPASS;
++
+ 			neg_mode = PHYLINK_PCS_NEG_OUTBAND;
++			if (pl->phydev)
++				mode = MLO_AN_PHY;
++		} else {
++			/* invalid */
++			phylink_warn(pl, "%s: incompatible in-band capabilities, trying in-band",
++				     phy_modes(interface));
++			neg_mode = PHYLINK_PCS_NEG_INBAND_ENABLED;
++		}
++	} else {
++		/* For Base-X without a PHY */
++		if (pcs_ib_caps == LINK_INBAND_DISABLE)
++			/* If the PCS doesn't support inband, then inband must
++			 * be disabled.
++			 */
++			neg_mode = PHYLINK_PCS_NEG_INBAND_DISABLED;
++		else if (pcs_ib_caps == LINK_INBAND_ENABLE)
++			/* If the PCS requires inband, then inband must always
++			 * be enabled.
++			 */
++			neg_mode = PHYLINK_PCS_NEG_INBAND_ENABLED;
+ 		else if (linkmode_test_bit(ETHTOOL_LINK_MODE_Autoneg_BIT,
+ 					   advertising))
+ 			neg_mode = PHYLINK_PCS_NEG_INBAND_ENABLED;
+ 		else
+ 			neg_mode = PHYLINK_PCS_NEG_INBAND_DISABLED;
+-		break;
+-
+-	default:
+-		neg_mode = PHYLINK_PCS_NEG_NONE;
+-		break;
+ 	}
+ 
+-	return neg_mode;
++	pl->pcs_neg_mode = neg_mode;
++	pl->act_link_an_mode = mode;
+ }
+ 
+ static void phylink_major_config(struct phylink *pl, bool restart,
+@@ -1225,11 +1402,9 @@ static void phylink_major_config(struct
+ 	unsigned int neg_mode;
+ 	int err;
+ 
+-	phylink_dbg(pl, "major config %s\n", phy_modes(state->interface));
+-
+-	pl->pcs_neg_mode = phylink_pcs_neg_mode(pl->cur_link_an_mode,
+-						state->interface,
+-						state->advertising);
++	phylink_dbg(pl, "major config, requested %s/%s\n",
++		    phylink_an_mode_str(pl->req_link_an_mode),
++		    phy_modes(state->interface));
+ 
+ 	if (pl->using_mac_select_pcs) {
+ 		pcs = pl->mac_ops->mac_select_pcs(pl->config, state->interface);
+@@ -1243,10 +1418,17 @@ static void phylink_major_config(struct
+ 		pcs_changed = pcs && pl->pcs != pcs;
+ 	}
+ 
++	phylink_pcs_neg_mode(pl, pcs, state->interface, state->advertising);
++
++	phylink_dbg(pl, "major config, active %s/%s/%s\n",
++		    phylink_an_mode_str(pl->act_link_an_mode),
++		    phylink_pcs_mode_str(pl->pcs_neg_mode),
++		    phy_modes(state->interface));
++
+ 	phylink_pcs_poll_stop(pl);
+ 
+ 	if (pl->mac_ops->mac_prepare) {
+-		err = pl->mac_ops->mac_prepare(pl->config, pl->cur_link_an_mode,
++		err = pl->mac_ops->mac_prepare(pl->config, pl->act_link_an_mode,
+ 					       state->interface);
+ 		if (err < 0) {
+ 			phylink_err(pl, "mac_prepare failed: %pe\n",
+@@ -1280,7 +1462,7 @@ static void phylink_major_config(struct
+ 	if (pl->pcs_state == PCS_STATE_STARTING || pcs_changed)
+ 		phylink_pcs_enable(pl->pcs);
+ 
+-	neg_mode = pl->cur_link_an_mode;
++	neg_mode = pl->act_link_an_mode;
+ 	if (pl->pcs && pl->pcs->neg_mode)
+ 		neg_mode = pl->pcs_neg_mode;
+ 
+@@ -1296,13 +1478,20 @@ static void phylink_major_config(struct
+ 		phylink_pcs_an_restart(pl);
+ 
+ 	if (pl->mac_ops->mac_finish) {
+-		err = pl->mac_ops->mac_finish(pl->config, pl->cur_link_an_mode,
++		err = pl->mac_ops->mac_finish(pl->config, pl->act_link_an_mode,
+ 					      state->interface);
+ 		if (err < 0)
+ 			phylink_err(pl, "mac_finish failed: %pe\n",
+ 				    ERR_PTR(err));
+ 	}
+ 
++	if (pl->phydev && pl->phy_ib_mode) {
++		err = phy_config_inband(pl->phydev, pl->phy_ib_mode);
++		if (err < 0)
++			phylink_err(pl, "phy_config_inband: %pe\n",
++				    ERR_PTR(err));
++	}
++
+ 	if (pl->sfp_bus) {
+ 		rate_kbd = phylink_interface_signal_rate(state->interface);
+ 		if (rate_kbd)
+@@ -1327,17 +1516,16 @@ static int phylink_change_inband_advert(
+ 		return 0;
+ 
+ 	phylink_dbg(pl, "%s: mode=%s/%s adv=%*pb pause=%02x\n", __func__,
+-		    phylink_an_mode_str(pl->cur_link_an_mode),
++		    phylink_an_mode_str(pl->req_link_an_mode),
+ 		    phy_modes(pl->link_config.interface),
+ 		    __ETHTOOL_LINK_MODE_MASK_NBITS, pl->link_config.advertising,
+ 		    pl->link_config.pause);
+ 
+ 	/* Recompute the PCS neg mode */
+-	pl->pcs_neg_mode = phylink_pcs_neg_mode(pl->cur_link_an_mode,
+-					pl->link_config.interface,
+-					pl->link_config.advertising);
++	phylink_pcs_neg_mode(pl, pl->pcs, pl->link_config.interface,
++			     pl->link_config.advertising);
+ 
+-	neg_mode = pl->cur_link_an_mode;
++	neg_mode = pl->act_link_an_mode;
+ 	if (pl->pcs->neg_mode)
+ 		neg_mode = pl->pcs_neg_mode;
+ 
+@@ -1402,7 +1590,7 @@ static void phylink_mac_initial_config(s
+ {
+ 	struct phylink_link_state link_state;
+ 
+-	switch (pl->cur_link_an_mode) {
++	switch (pl->req_link_an_mode) {
+ 	case MLO_AN_PHY:
+ 		link_state = pl->phy_state;
+ 		break;
+@@ -1476,14 +1664,14 @@ static void phylink_link_up(struct phyli
+ 
+ 	pl->cur_interface = link_state.interface;
+ 
+-	neg_mode = pl->cur_link_an_mode;
++	neg_mode = pl->act_link_an_mode;
+ 	if (pl->pcs && pl->pcs->neg_mode)
+ 		neg_mode = pl->pcs_neg_mode;
+ 
+ 	phylink_pcs_link_up(pl->pcs, neg_mode, pl->cur_interface, speed,
+ 			    duplex);
+ 
+-	pl->mac_ops->mac_link_up(pl->config, pl->phydev, pl->cur_link_an_mode,
++	pl->mac_ops->mac_link_up(pl->config, pl->phydev, pl->act_link_an_mode,
+ 				 pl->cur_interface, speed, duplex,
+ 				 !!(link_state.pause & MLO_PAUSE_TX), rx_pause);
+ 
+@@ -1503,7 +1691,7 @@ static void phylink_link_down(struct phy
+ 
+ 	if (ndev)
+ 		netif_carrier_off(ndev);
+-	pl->mac_ops->mac_link_down(pl->config, pl->cur_link_an_mode,
++	pl->mac_ops->mac_link_down(pl->config, pl->act_link_an_mode,
+ 				   pl->cur_interface);
+ 	phylink_info(pl, "Link is Down\n");
+ }
+@@ -1530,7 +1718,7 @@ static void phylink_resolve(struct work_
+ 		link_state.link = false;
+ 		retrigger = true;
+ 	} else {
+-		switch (pl->cur_link_an_mode) {
++		switch (pl->act_link_an_mode) {
+ 		case MLO_AN_PHY:
+ 			link_state = pl->phy_state;
+ 			phylink_apply_manual_flow(pl, &link_state);
+@@ -1773,7 +1961,7 @@ struct phylink *phylink_create(struct ph
+ 		}
+ 	}
+ 
+-	pl->cur_link_an_mode = pl->cfg_link_an_mode;
++	pl->req_link_an_mode = pl->cfg_link_an_mode;
+ 
+ 	ret = phylink_register_sfp(pl, fwnode);
+ 	if (ret < 0) {
+@@ -2236,7 +2424,7 @@ void phylink_start(struct phylink *pl)
+ 	ASSERT_RTNL();
+ 
+ 	phylink_info(pl, "configuring for %s/%s link mode\n",
+-		     phylink_an_mode_str(pl->cur_link_an_mode),
++		     phylink_an_mode_str(pl->req_link_an_mode),
+ 		     phy_modes(pl->link_config.interface));
+ 
+ 	/* Always set the carrier off */
+@@ -2495,7 +2683,7 @@ int phylink_ethtool_ksettings_get(struct
+ 
+ 	linkmode_copy(kset->link_modes.supported, pl->supported);
+ 
+-	switch (pl->cur_link_an_mode) {
++	switch (pl->act_link_an_mode) {
+ 	case MLO_AN_FIXED:
+ 		/* We are using fixed settings. Report these as the
+ 		 * current link settings - and note that these also
+@@ -2526,6 +2714,26 @@ int phylink_ethtool_ksettings_get(struct
+ }
+ EXPORT_SYMBOL_GPL(phylink_ethtool_ksettings_get);
+ 
++static bool phylink_validate_pcs_inband_autoneg(struct phylink *pl,
++					        phy_interface_t interface,
++						unsigned long *adv)
++{
++	unsigned int inband = phylink_inband_caps(pl, interface);
++	unsigned int mask;
++
++	/* If the PCS doesn't implement inband support, be permissive. */
++	if (!inband)
++		return true;
++
++	if (linkmode_test_bit(ETHTOOL_LINK_MODE_Autoneg_BIT, adv))
++		mask = LINK_INBAND_ENABLE;
++	else
++		mask = LINK_INBAND_DISABLE;
++
++	/* Check whether the PCS implements the required mode */
++	return !!(inband & mask);
++}
++
+ /**
+  * phylink_ethtool_ksettings_set() - set the link settings
+  * @pl: a pointer to a &struct phylink returned from phylink_create()
+@@ -2587,7 +2795,7 @@ int phylink_ethtool_ksettings_set(struct
+ 		/* If we have a fixed link, refuse to change link parameters.
+ 		 * If the link parameters match, accept them but do nothing.
+ 		 */
+-		if (pl->cur_link_an_mode == MLO_AN_FIXED) {
++		if (pl->req_link_an_mode == MLO_AN_FIXED) {
+ 			if (s->speed != pl->link_config.speed ||
+ 			    s->duplex != pl->link_config.duplex)
+ 				return -EINVAL;
+@@ -2603,7 +2811,7 @@ int phylink_ethtool_ksettings_set(struct
+ 		 * is our default case) but do not allow the advertisement to
+ 		 * be changed. If the advertisement matches, simply return.
+ 		 */
+-		if (pl->cur_link_an_mode == MLO_AN_FIXED) {
++		if (pl->req_link_an_mode == MLO_AN_FIXED) {
+ 			if (!linkmode_equal(config.advertising,
+ 					    pl->link_config.advertising))
+ 				return -EINVAL;
+@@ -2643,7 +2851,7 @@ int phylink_ethtool_ksettings_set(struct
+ 		linkmode_copy(support, pl->supported);
+ 		if (phylink_validate(pl, support, &config)) {
+ 			phylink_err(pl, "validation of %s/%s with support %*pb failed\n",
+-				    phylink_an_mode_str(pl->cur_link_an_mode),
++				    phylink_an_mode_str(pl->req_link_an_mode),
+ 				    phy_modes(config.interface),
+ 				    __ETHTOOL_LINK_MODE_MASK_NBITS, support);
+ 			return -EINVAL;
+@@ -2661,6 +2869,13 @@ int phylink_ethtool_ksettings_set(struct
+ 	    phylink_is_empty_linkmode(config.advertising))
+ 		return -EINVAL;
+ 
++	/* Validate the autonegotiation state. We don't have a PHY in this
++	 * situation, so the PCS is the media-facing entity.
++	 */
++	if (!phylink_validate_pcs_inband_autoneg(pl, config.interface,
++						 config.advertising))
++		return -EINVAL;
++
+ 	mutex_lock(&pl->state_mutex);
+ 	pl->link_config.speed = config.speed;
+ 	pl->link_config.duplex = config.duplex;
+@@ -2743,7 +2958,7 @@ int phylink_ethtool_set_pauseparam(struc
+ 
+ 	ASSERT_RTNL();
+ 
+-	if (pl->cur_link_an_mode == MLO_AN_FIXED)
++	if (pl->req_link_an_mode == MLO_AN_FIXED)
+ 		return -EOPNOTSUPP;
+ 
+ 	if (!phylink_test(pl->supported, Pause) &&
+@@ -3007,7 +3222,7 @@ static int phylink_mii_read(struct phyli
+ 	struct phylink_link_state state;
+ 	int val = 0xffff;
+ 
+-	switch (pl->cur_link_an_mode) {
++	switch (pl->act_link_an_mode) {
+ 	case MLO_AN_FIXED:
+ 		if (phy_id == 0) {
+ 			phylink_get_fixed_state(pl, &state);
+@@ -3032,7 +3247,7 @@ static int phylink_mii_read(struct phyli
+ static int phylink_mii_write(struct phylink *pl, unsigned int phy_id,
+ 			     unsigned int reg, unsigned int val)
+ {
+-	switch (pl->cur_link_an_mode) {
++	switch (pl->act_link_an_mode) {
+ 	case MLO_AN_FIXED:
+ 		break;
+ 
+@@ -3202,10 +3417,11 @@ static phy_interface_t phylink_choose_sf
+ 	return interface;
+ }
+ 
+-static void phylink_sfp_set_config(struct phylink *pl, u8 mode,
++static void phylink_sfp_set_config(struct phylink *pl,
+ 				   unsigned long *supported,
+ 				   struct phylink_link_state *state)
+ {
++	u8 mode = MLO_AN_INBAND;
+ 	bool changed = false;
+ 
+ 	phylink_dbg(pl, "requesting link mode %s/%s with support %*pb\n",
+@@ -3222,9 +3438,9 @@ static void phylink_sfp_set_config(struc
+ 		changed = true;
+ 	}
+ 
+-	if (pl->cur_link_an_mode != mode ||
++	if (pl->req_link_an_mode != mode ||
+ 	    pl->link_config.interface != state->interface) {
+-		pl->cur_link_an_mode = mode;
++		pl->req_link_an_mode = mode;
+ 		pl->link_config.interface = state->interface;
+ 
+ 		changed = true;
+@@ -3239,8 +3455,7 @@ static void phylink_sfp_set_config(struc
+ 		phylink_mac_initial_config(pl, false);
+ }
+ 
+-static int phylink_sfp_config_phy(struct phylink *pl, u8 mode,
+-				  struct phy_device *phy)
++static int phylink_sfp_config_phy(struct phylink *pl, struct phy_device *phy)
+ {
+ 	__ETHTOOL_DECLARE_LINK_MODE_MASK(support1);
+ 	__ETHTOOL_DECLARE_LINK_MODE_MASK(support);
+@@ -3279,8 +3494,7 @@ static int phylink_sfp_config_phy(struct
+ 	ret = phylink_validate(pl, support1, &config);
+ 	if (ret) {
+ 		phylink_err(pl,
+-			    "validation of %s/%s with support %*pb failed: %pe\n",
+-			    phylink_an_mode_str(mode),
++			    "validation of %s with support %*pb failed: %pe\n",
+ 			    phy_modes(config.interface),
+ 			    __ETHTOOL_LINK_MODE_MASK_NBITS, support,
+ 			    ERR_PTR(ret));
+@@ -3289,7 +3503,7 @@ static int phylink_sfp_config_phy(struct
+ 
+ 	pl->link_port = pl->sfp_port;
+ 
+-	phylink_sfp_set_config(pl, mode, support, &config);
++	phylink_sfp_set_config(pl, support, &config);
+ 
+ 	return 0;
+ }
+@@ -3345,6 +3559,12 @@ static int phylink_sfp_config_optical(st
+ 	phylink_dbg(pl, "optical SFP: chosen %s interface\n",
+ 		    phy_modes(interface));
+ 
++	if (!phylink_validate_pcs_inband_autoneg(pl, interface,
++						 config.advertising)) {
++		phylink_err(pl, "autoneg setting not compatible with PCS");
++		return -EINVAL;
++	}
++
+ 	config.interface = interface;
+ 
+ 	/* Ignore errors if we're expecting a PHY to attach later */
+@@ -3358,7 +3578,7 @@ static int phylink_sfp_config_optical(st
+ 
+ 	pl->link_port = pl->sfp_port;
+ 
+-	phylink_sfp_set_config(pl, MLO_AN_INBAND, pl->sfp_support, &config);
++	phylink_sfp_set_config(pl, pl->sfp_support, &config);
+ 
+ 	return 0;
+ }
+@@ -3429,20 +3649,10 @@ static void phylink_sfp_link_up(void *up
+ 	phylink_enable_and_run_resolve(pl, PHYLINK_DISABLE_LINK);
+ }
+ 
+-/* The Broadcom BCM84881 in the Methode DM7052 is unable to provide a SGMII
+- * or 802.3z control word, so inband will not work.
+- */
+-static bool phylink_phy_no_inband(struct phy_device *phy)
+-{
+-	return phy->is_c45 && phy_id_compare(phy->c45_ids.device_ids[1],
+-					     0xae025150, 0xfffffff0);
+-}
+-
+ static int phylink_sfp_connect_phy(void *upstream, struct phy_device *phy)
+ {
+ 	struct phylink *pl = upstream;
+ 	phy_interface_t interface;
+-	u8 mode;
+ 	int ret;
+ 
+ 	/*
+@@ -3454,17 +3664,12 @@ static int phylink_sfp_connect_phy(void
+ 	 */
+ 	phy_support_asym_pause(phy);
+ 
+-	if (phylink_phy_no_inband(phy))
+-		mode = MLO_AN_PHY;
+-	else
+-		mode = MLO_AN_INBAND;
+-
+ 	/* Set the PHY's host supported interfaces */
+ 	phy_interface_and(phy->host_interfaces, phylink_sfp_interfaces,
+ 			  pl->config->supported_interfaces);
+ 
+ 	/* Do the initial configuration */
+-	ret = phylink_sfp_config_phy(pl, mode, phy);
++	ret = phylink_sfp_config_phy(pl, phy);
+ 	if (ret < 0)
+ 		return ret;
+ 
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -973,6 +973,58 @@ static int phy_check_link_status(struct
+ }
+ 
+ /**
++ * phy_inband_caps - query which in-band signalling modes are supported
++ * @phydev: a pointer to a &struct phy_device
++ * @interface: the interface mode for the PHY
++ *
++ * Returns zero if it is unknown what in-band signalling is supported by the
++ * PHY (e.g. because the PHY driver doesn't implement the method.) Otherwise,
++ * returns a bit mask of the LINK_INBAND_* values from
++ * &enum link_inband_signalling to describe which inband modes are supported
++ * by the PHY for this interface mode.
++ */
++unsigned int phy_inband_caps(struct phy_device *phydev,
++			     phy_interface_t interface)
++{
++	if (phydev->drv && phydev->drv->inband_caps)
++		return phydev->drv->inband_caps(phydev, interface);
++
++	return 0;
++}
++EXPORT_SYMBOL_GPL(phy_inband_caps);
++
++/**
++ * phy_config_inband - configure the desired PHY in-band mode
++ * @phydev: the phy_device struct
++ * @modes: in-band modes to configure
++ *
++ * Description: disables, enables or enables-with-bypass in-band signalling
++ *   between the PHY and host system.
++ *
++ * Returns: zero on success, or negative errno value.
++ */
++int phy_config_inband(struct phy_device *phydev, unsigned int modes)
++{
++	int err;
++
++	if (!!(modes & LINK_INBAND_DISABLE) +
++	    !!(modes & LINK_INBAND_ENABLE) +
++	    !!(modes & LINK_INBAND_BYPASS) != 1)
++		return -EINVAL;
++
++	mutex_lock(&phydev->lock);
++	if (!phydev->drv)
++		err = -EIO;
++	else if (!phydev->drv->config_inband)
++		err = -EOPNOTSUPP;
++	else
++		err = phydev->drv->config_inband(phydev, modes);
++	mutex_unlock(&phydev->lock);
++
++	return err;
++}
++
++/**
+  * _phy_start_aneg - start auto-negotiation for this PHY device
+  * @phydev: the phy_device struct
+  *
+--- a/include/linux/phy.h
++++ b/include/linux/phy.h
+@@ -797,6 +797,24 @@ struct phy_tdr_config {
+ #define PHY_PAIR_ALL -1
+ 
+ /**
++ * enum link_inband_signalling - in-band signalling modes that are supported
++ *
++ * @LINK_INBAND_DISABLE: in-band signalling can be disabled
++ * @LINK_INBAND_ENABLE: in-band signalling can be enabled without bypass
++ * @LINK_INBAND_BYPASS: in-band signalling can be enabled with bypass
++ *
++ * The possible and required bits can only be used if the valid bit is set.
++ * If possible is clear, that means inband signalling can not be used.
++ * Required is only valid when possible is set, and means that inband
++ * signalling must be used.
++ */
++enum link_inband_signalling {
++	LINK_INBAND_DISABLE		= BIT(0),
++	LINK_INBAND_ENABLE		= BIT(1),
++	LINK_INBAND_BYPASS		= BIT(2),
++};
++
++/**
+  * struct phy_plca_cfg - Configuration of the PLCA (Physical Layer Collision
+  * Avoidance) Reconciliation Sublayer.
+  *
+@@ -936,6 +954,19 @@ struct phy_driver {
+ 	int (*get_features)(struct phy_device *phydev);
+ 
+ 	/**
++	 * @inband_caps: query whether in-band is supported for the given PHY
++	 * interface mode. Returns a bitmask of bits defined by enum
++	 * link_inband_signalling.
++	 */
++	unsigned int (*inband_caps)(struct phy_device *phydev,
++				    phy_interface_t interface);
++
++	/**
++	 * @config_inband: configure in-band mode for the PHY
++	 */
++	int (*config_inband)(struct phy_device *phydev, unsigned int modes);
++
++	/**
+ 	 * @get_rate_matching: Get the supported type of rate matching for a
+ 	 * particular phy interface. This is used by phy consumers to determine
+ 	 * whether to advertise lower-speed modes for that interface. It is
+@@ -1771,6 +1802,9 @@ void phy_stop(struct phy_device *phydev)
+ int phy_config_aneg(struct phy_device *phydev);
+ int phy_start_aneg(struct phy_device *phydev);
+ int phy_aneg_done(struct phy_device *phydev);
++unsigned int phy_inband_caps(struct phy_device *phydev,
++			     phy_interface_t interface);
++int phy_config_inband(struct phy_device *phydev, unsigned int modes);
+ int phy_speed_down(struct phy_device *phydev, bool sync);
+ int phy_speed_up(struct phy_device *phydev);
+ bool phy_check_valid(int speed, int duplex, unsigned long *features);
+--- a/drivers/net/phy/bcm84881.c
++++ b/drivers/net/phy/bcm84881.c
+@@ -223,11 +223,21 @@ static int bcm84881_read_status(struct p
+ 	return genphy_c45_read_mdix(phydev);
+ }
+ 
++/* The Broadcom BCM84881 in the Methode DM7052 is unable to provide a SGMII
++ * or 802.3z control word, so inband will not work.
++ */
++static unsigned int bcm84881_inband_caps(struct phy_device *phydev,
++					 phy_interface_t interface)
++{
++	return LINK_INBAND_DISABLE;
++}
++
+ static struct phy_driver bcm84881_drivers[] = {
+ 	{
+ 		.phy_id		= 0xae025150,
+ 		.phy_id_mask	= 0xfffffff0,
+ 		.name		= "Broadcom BCM84881",
++		.inband_caps	= bcm84881_inband_caps,
+ 		.config_init	= bcm84881_config_init,
+ 		.probe		= bcm84881_probe,
+ 		.get_features	= bcm84881_get_features,
+--- a/drivers/net/phy/marvell.c
++++ b/drivers/net/phy/marvell.c
+@@ -673,6 +673,48 @@ static int marvell_config_aneg_fiber(str
+ 	return genphy_check_and_restart_aneg(phydev, changed);
+ }
+ 
++static unsigned int m88e1111_inband_caps(struct phy_device *phydev,
++					 phy_interface_t interface)
++{
++	/* In 1000base-X and SGMII modes, the inband mode can be changed
++	 * through the Fibre page BMCR ANENABLE bit.
++	 */
++	if (interface == PHY_INTERFACE_MODE_1000BASEX ||
++	    interface == PHY_INTERFACE_MODE_SGMII)
++		return LINK_INBAND_DISABLE | LINK_INBAND_ENABLE |
++		       LINK_INBAND_BYPASS;
++
++	return 0;
++}
++
++static int m88e1111_config_inband(struct phy_device *phydev, unsigned int modes)
++{
++	u16 extsr, bmcr;
++	int err;
++
++	if (phydev->interface != PHY_INTERFACE_MODE_1000BASEX &&
++	    phydev->interface != PHY_INTERFACE_MODE_SGMII)
++		return -EINVAL;
++
++	if (modes == LINK_INBAND_BYPASS)
++		extsr = MII_M1111_HWCFG_SERIAL_AN_BYPASS;
++	else
++		extsr = 0;
++
++	if (modes == LINK_INBAND_DISABLE)
++		bmcr = 0;
++	else
++		bmcr = BMCR_ANENABLE;
++
++	err = phy_modify(phydev, MII_M1111_PHY_EXT_SR,
++			 MII_M1111_HWCFG_SERIAL_AN_BYPASS, extsr);
++	if (err < 0)
++		return extsr;
++
++	return phy_modify_paged(phydev, MII_MARVELL_FIBER_PAGE, MII_BMCR,
++				BMCR_ANENABLE, bmcr);
++}
++
+ static int m88e1111_config_aneg(struct phy_device *phydev)
+ {
+ 	int extsr = phy_read(phydev, MII_M1111_PHY_EXT_SR);
+@@ -3292,6 +3334,8 @@ static struct phy_driver marvell_drivers
+ 		.name = "Marvell 88E1112",
+ 		/* PHY_GBIT_FEATURES */
+ 		.probe = marvell_probe,
++		.inband_caps = m88e1111_inband_caps,
++		.config_inband = m88e1111_config_inband,
+ 		.config_init = m88e1112_config_init,
+ 		.config_aneg = marvell_config_aneg,
+ 		.config_intr = marvell_config_intr,
+@@ -3312,6 +3356,8 @@ static struct phy_driver marvell_drivers
+ 		.name = "Marvell 88E1111",
+ 		/* PHY_GBIT_FEATURES */
+ 		.probe = marvell_probe,
++		.inband_caps = m88e1111_inband_caps,
++		.config_inband = m88e1111_config_inband,
+ 		.config_init = m88e1111gbe_config_init,
+ 		.config_aneg = m88e1111_config_aneg,
+ 		.read_status = marvell_read_status,
+@@ -3333,6 +3379,8 @@ static struct phy_driver marvell_drivers
+ 		.name = "Marvell 88E1111 (Finisar)",
+ 		/* PHY_GBIT_FEATURES */
+ 		.probe = marvell_probe,
++		.inband_caps = m88e1111_inband_caps,
++		.config_inband = m88e1111_config_inband,
+ 		.config_init = m88e1111gbe_config_init,
+ 		.config_aneg = m88e1111_config_aneg,
+ 		.read_status = marvell_read_status,
+--- a/include/linux/phylink.h
++++ b/include/linux/phylink.h
+@@ -432,6 +432,7 @@ struct phylink_pcs {
+ /**
+  * struct phylink_pcs_ops - MAC PCS operations structure.
+  * @pcs_validate: validate the link configuration.
++ * @pcs_inband_caps: query inband support for interface mode.
+  * @pcs_enable: enable the PCS.
+  * @pcs_disable: disable the PCS.
+  * @pcs_pre_config: pre-mac_config method (for errata)
+@@ -445,6 +446,8 @@ struct phylink_pcs {
+ struct phylink_pcs_ops {
+ 	int (*pcs_validate)(struct phylink_pcs *pcs, unsigned long *supported,
+ 			    const struct phylink_link_state *state);
++	unsigned int (*pcs_inband_caps)(struct phylink_pcs *pcs,
++					phy_interface_t interface);
+ 	int (*pcs_enable)(struct phylink_pcs *pcs);
+ 	void (*pcs_disable)(struct phylink_pcs *pcs);
+ 	void (*pcs_pre_config)(struct phylink_pcs *pcs,
+@@ -481,6 +484,20 @@ int pcs_validate(struct phylink_pcs *pcs
+ 		 const struct phylink_link_state *state);
+ 
+ /**
++ * pcs_inband_caps - query PCS in-band capabilities for interface mode.
++ * @pcs: a pointer to a &struct phylink_pcs.
++ * @interface: interface mode to be queried
++ *
++ * Returns zero if it is unknown what in-band signalling is supported by the
++ * PHY (e.g. because the PHY driver doesn't implement the method.) Otherwise,
++ * returns a bit mask of the LINK_INBAND_* values from
++ * &enum link_inband_signalling to describe which inband modes are supported
++ * for this interface mode.
++ */
++unsigned int pcs_inband_caps(struct phylink_pcs *pcs,
++			     phy_interface_t interface);
++
++/**
+  * pcs_enable() - enable the PCS.
+  * @pcs: a pointer to a &struct phylink_pcs.
+  */
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -3959,20 +3959,27 @@ static struct mvneta_port *mvneta_pcs_to
+ 	return container_of(pcs, struct mvneta_port, phylink_pcs);
+ }
+ 
+-static int mvneta_pcs_validate(struct phylink_pcs *pcs,
+-			       unsigned long *supported,
+-			       const struct phylink_link_state *state)
++static unsigned int mvneta_pcs_inband_caps(struct phylink_pcs *pcs,
++					   phy_interface_t interface)
+ {
+-	/* We only support QSGMII, SGMII, 802.3z and RGMII modes.
+-	 * When in 802.3z mode, we must have AN enabled:
++	/* When operating in an 802.3z mode, we must have AN enabled:
+ 	 * "Bit 2 Field InBandAnEn In-band Auto-Negotiation enable. ...
+ 	 * When <PortType> = 1 (1000BASE-X) this field must be set to 1."
++	 * Therefore, inband is "required".
+ 	 */
+-	if (phy_interface_mode_is_8023z(state->interface) &&
+-	    !phylink_test(state->advertising, Autoneg))
+-		return -EINVAL;
++	if (phy_interface_mode_is_8023z(interface))
++		return LINK_INBAND_ENABLE;
+ 
+-	return 0;
++	/* QSGMII, SGMII and RGMII can be configured to use inband
++	 * signalling of the AN result. Indicate these as "possible".
++	 */
++	if (interface == PHY_INTERFACE_MODE_SGMII ||
++	    interface == PHY_INTERFACE_MODE_QSGMII ||
++	    phy_interface_mode_is_rgmii(interface))
++		return LINK_INBAND_DISABLE | LINK_INBAND_ENABLE;
++
++	/* For any other modes, indicate that inband is not supported. */
++	return LINK_INBAND_DISABLE;
+ }
+ 
+ static void mvneta_pcs_get_state(struct phylink_pcs *pcs,
+@@ -4070,7 +4077,7 @@ static void mvneta_pcs_an_restart(struct
+ }
+ 
+ static const struct phylink_pcs_ops mvneta_phylink_pcs_ops = {
+-	.pcs_validate = mvneta_pcs_validate,
++	.pcs_inband_caps = mvneta_pcs_inband_caps,
+ 	.pcs_get_state = mvneta_pcs_get_state,
+ 	.pcs_config = mvneta_pcs_config,
+ 	.pcs_an_restart = mvneta_pcs_an_restart,
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -6214,19 +6214,26 @@ static const struct phylink_pcs_ops mvpp
+ 	.pcs_config = mvpp2_xlg_pcs_config,
+ };
+ 
+-static int mvpp2_gmac_pcs_validate(struct phylink_pcs *pcs,
+-				   unsigned long *supported,
+-				   const struct phylink_link_state *state)
++static unsigned int mvpp2_gmac_pcs_inband_caps(struct phylink_pcs *pcs,
++					       phy_interface_t interface)
+ {
+-	/* When in 802.3z mode, we must have AN enabled:
++	/* When operating in an 802.3z mode, we must have AN enabled:
+ 	 * Bit 2 Field InBandAnEn In-band Auto-Negotiation enable. ...
+ 	 * When <PortType> = 1 (1000BASE-X) this field must be set to 1.
++	 * Therefore, inband is "required".
+ 	 */
+-	if (phy_interface_mode_is_8023z(state->interface) &&
+-	    !phylink_test(state->advertising, Autoneg))
+-		return -EINVAL;
++	if (phy_interface_mode_is_8023z(interface))
++		return LINK_INBAND_ENABLE;
+ 
+-	return 0;
++	/* SGMII and RGMII can be configured to use inband signalling of the
++	 * AN result. Indicate these as "possible".
++	 */
++	if (interface == PHY_INTERFACE_MODE_SGMII ||
++	    phy_interface_mode_is_rgmii(interface))
++		return LINK_INBAND_DISABLE | LINK_INBAND_ENABLE;
++
++	/* For any other modes, indicate that inband is not supported. */
++	return LINK_INBAND_DISABLE;
+ }
+ 
+ static void mvpp2_gmac_pcs_get_state(struct phylink_pcs *pcs,
+@@ -6333,7 +6340,7 @@ static void mvpp2_gmac_pcs_an_restart(st
+ }
+ 
+ static const struct phylink_pcs_ops mvpp2_phylink_gmac_pcs_ops = {
+-	.pcs_validate = mvpp2_gmac_pcs_validate,
++	.pcs_inband_caps = mvpp2_gmac_pcs_inband_caps,
+ 	.pcs_get_state = mvpp2_gmac_pcs_get_state,
+ 	.pcs_config = mvpp2_gmac_pcs_config,
+ 	.pcs_an_restart = mvpp2_gmac_pcs_an_restart,
+--- a/drivers/net/pcs/pcs-lynx.c
++++ b/drivers/net/pcs/pcs-lynx.c
+@@ -35,6 +35,27 @@ enum sgmii_speed {
+ #define phylink_pcs_to_lynx(pl_pcs) container_of((pl_pcs), struct lynx_pcs, pcs)
+ #define lynx_to_phylink_pcs(lynx) (&(lynx)->pcs)
+ 
++static unsigned int lynx_pcs_inband_caps(struct phylink_pcs *pcs,
++					 phy_interface_t interface)
++{
++	switch (interface) {
++	case PHY_INTERFACE_MODE_1000BASEX:
++	case PHY_INTERFACE_MODE_SGMII:
++	case PHY_INTERFACE_MODE_QSGMII:
++		return LINK_INBAND_DISABLE | LINK_INBAND_ENABLE;
++
++	case PHY_INTERFACE_MODE_10GBASER:
++	case PHY_INTERFACE_MODE_2500BASEX:
++		return LINK_INBAND_DISABLE;
++
++	case PHY_INTERFACE_MODE_USXGMII:
++		return LINK_INBAND_ENABLE;
++
++	default:
++		return 0;
++	}
++}
++
+ static void lynx_pcs_get_state_usxgmii(struct mdio_device *pcs,
+ 				       struct phylink_link_state *state)
+ {
+@@ -307,6 +328,7 @@ static void lynx_pcs_link_up(struct phyl
+ }
+ 
+ static const struct phylink_pcs_ops lynx_pcs_phylink_ops = {
++	.pcs_inband_caps = lynx_pcs_inband_caps,
+ 	.pcs_get_state = lynx_pcs_get_state,
+ 	.pcs_config = lynx_pcs_config,
+ 	.pcs_an_restart = lynx_pcs_an_restart,
+--- a/drivers/net/pcs/pcs-mtk-lynxi.c
++++ b/drivers/net/pcs/pcs-mtk-lynxi.c
+@@ -110,6 +110,21 @@ static struct mtk_pcs_lynxi *pcs_to_mtk_
+ 	return container_of(pcs, struct mtk_pcs_lynxi, pcs);
+ }
+ 
++static unsigned int mtk_pcs_lynxi_inband_caps(struct phylink_pcs *pcs,
++					      phy_interface_t interface)
++{
++	switch (interface) {
++	case PHY_INTERFACE_MODE_1000BASEX:
++	case PHY_INTERFACE_MODE_2500BASEX:
++	case PHY_INTERFACE_MODE_SGMII:
++	case PHY_INTERFACE_MODE_QSGMII:
++		return LINK_INBAND_DISABLE | LINK_INBAND_ENABLE;
++
++	default:
++		return 0;
++	}
++}
++
+ static void mtk_pcs_lynxi_get_state(struct phylink_pcs *pcs,
+ 				    struct phylink_link_state *state)
+ {
+@@ -302,6 +317,7 @@ static void mtk_pcs_lynxi_disable(struct
+ }
+ 
+ static const struct phylink_pcs_ops mtk_pcs_lynxi_ops = {
++	.pcs_inband_caps = mtk_pcs_lynxi_inband_caps,
+ 	.pcs_get_state = mtk_pcs_lynxi_get_state,
+ 	.pcs_config = mtk_pcs_lynxi_config,
+ 	.pcs_an_restart = mtk_pcs_lynxi_restart_an,
+--- a/drivers/net/pcs/pcs-xpcs.c
++++ b/drivers/net/pcs/pcs-xpcs.c
+@@ -628,6 +628,33 @@ static int xpcs_validate(struct phylink_
+ 	return 0;
+ }
+ 
++static unsigned int xpcs_inband_caps(struct phylink_pcs *pcs,
++				     phy_interface_t interface)
++{
++	struct dw_xpcs *xpcs = phylink_pcs_to_xpcs(pcs);
++	const struct dw_xpcs_compat *compat;
++
++	compat = xpcs_find_compat(xpcs, interface);
++	if (!compat)
++		return 0;
++
++	switch (compat->an_mode) {
++	case DW_AN_C73:
++		return LINK_INBAND_ENABLE;
++
++	case DW_AN_C37_SGMII:
++	case DW_AN_C37_1000BASEX:
++		return LINK_INBAND_DISABLE | LINK_INBAND_ENABLE;
++
++	case DW_10GBASER:
++	case DW_2500BASEX:
++		return LINK_INBAND_DISABLE;
++
++	default:
++		return 0;
++	}
++}
++
+ void xpcs_get_interfaces(struct dw_xpcs *xpcs, unsigned long *interfaces)
+ {
+ 	int i, j;
+@@ -1331,6 +1358,7 @@ static const struct xpcs_id xpcs_id_list
+ 
+ static const struct phylink_pcs_ops xpcs_phylink_ops = {
+ 	.pcs_validate = xpcs_validate,
++	.pcs_inband_caps = xpcs_inband_caps,
+ 	.pcs_config = xpcs_config,
+ 	.pcs_get_state = xpcs_get_state,
+ 	.pcs_an_restart = xpcs_an_restart,
diff --git a/target/linux/mediatek/patches-6.6/806-v6.9-pwm-mediatek-add-support-for-MT7988.patch b/target/linux/mediatek/patches-6.6/806-v6.9-pwm-mediatek-add-support-for-MT7988.patch
index 01768ff01fdb9a..7e0c1a7cdd4952 100644
--- a/target/linux/mediatek/patches-6.6/806-v6.9-pwm-mediatek-add-support-for-MT7988.patch
+++ b/target/linux/mediatek/patches-6.6/806-v6.9-pwm-mediatek-add-support-for-MT7988.patch
@@ -20,7 +20,7 @@ Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
 
 --- a/drivers/pwm/pwm-mediatek.c
 +++ b/drivers/pwm/pwm-mediatek.c
-@@ -341,6 +341,13 @@ static const struct pwm_mediatek_of_data
+@@ -351,6 +351,13 @@ static const struct pwm_mediatek_of_data
  	.reg_offset = mtk_pwm_reg_offset_v1,
  };
  
@@ -34,7 +34,7 @@ Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
  static const struct pwm_mediatek_of_data mt8183_pwm_data = {
  	.num_pwms = 4,
  	.pwm45_fixup = false,
-@@ -371,6 +378,7 @@ static const struct of_device_id pwm_med
+@@ -381,6 +388,7 @@ static const struct of_device_id pwm_med
  	{ .compatible = "mediatek,mt7629-pwm", .data = &mt7629_pwm_data },
  	{ .compatible = "mediatek,mt7981-pwm", .data = &mt7981_pwm_data },
  	{ .compatible = "mediatek,mt7986-pwm", .data = &mt7986_pwm_data },
diff --git a/target/linux/mediatek/patches-6.6/901-arm-add-cmdline-override.patch b/target/linux/mediatek/patches-6.6/901-arm-add-cmdline-override.patch
index 034826253df2a6..7b7c905a0f3b60 100644
--- a/target/linux/mediatek/patches-6.6/901-arm-add-cmdline-override.patch
+++ b/target/linux/mediatek/patches-6.6/901-arm-add-cmdline-override.patch
@@ -17,7 +17,7 @@
  	default ""
 --- a/drivers/of/fdt.c
 +++ b/drivers/of/fdt.c
-@@ -1189,6 +1189,17 @@ int __init early_init_dt_scan_chosen(cha
+@@ -1190,6 +1190,17 @@ int __init early_init_dt_scan_chosen(cha
  	if (p != NULL && l > 0)
  		strlcat(cmdline, p, min_t(int, strlen(cmdline) + (int)l, COMMAND_LINE_SIZE));
  
@@ -37,7 +37,7 @@
  	 * CONFIG_CMDLINE is meant to be a default in case nothing else
 --- a/arch/arm64/Kconfig
 +++ b/arch/arm64/Kconfig
-@@ -2308,6 +2308,14 @@ config CMDLINE_FORCE
+@@ -2309,6 +2309,14 @@ config CMDLINE_FORCE
  
  endchoice
  
diff --git a/target/linux/mediatek/patches-6.6/960-asus-hack-u-boot-ignore-mtdparts.patch b/target/linux/mediatek/patches-6.6/960-asus-hack-u-boot-ignore-mtdparts.patch
new file mode 100644
index 00000000000000..3167dc9c593e90
--- /dev/null
+++ b/target/linux/mediatek/patches-6.6/960-asus-hack-u-boot-ignore-mtdparts.patch
@@ -0,0 +1,47 @@
+From 30a04cf5b6ffa1249df72ccd98cef05f37890f89 Mon Sep 17 00:00:00 2001
+From: Daniel Golle <daniel@makrotopia.org>
+Date: Thu, 6 Feb 2025 05:07:20 +0000
+Subject: [PATCH] mtd: spinand: add work-around to prevent bootloader wiping
+ mtdparts
+
+ASUS makes use of U-Boot's fdt_fixup_mtdparts() function which applies
+the partitions defined in U-Boot's mtdparts and mtdids environment
+variables to the devicetree passed over to Linux.
+
+The undesired side-effect is that in this way also all additional
+properties and child nodes get wiped, preventing NVMEM cells to be
+defined for MTD partitions or UBI volumes.
+
+To work-around this issue, add an additional compatible string
+'u-boot-dont-touch-spi-nand' which can be used instead of 'spi-nand' in
+case the replacement of the MTD partitions by U-Boot should be skipped
+alltogether.
+
+In practise this is mostly relevant for SPI-NAND which anyway comes only
+with two partitions nowadays: 'Bootloader' and 'UBI_DEV'. Hence this
+work-around is applicable for SPI-NAND only. Similar work-arounds for
+other MTD devices can be created as well should they actually be needed.
+
+Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+---
+ drivers/mtd/nand/spi/core.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/mtd/nand/spi/core.c
++++ b/drivers/mtd/nand/spi/core.c
+@@ -1446,6 +1446,7 @@ static int spinand_remove(struct spi_mem
+ 
+ static const struct spi_device_id spinand_ids[] = {
+ 	{ .name = "spi-nand" },
++	{ .name = "u-boot-dont-touch-spi-nand" },
+ 	{ /* sentinel */ },
+ };
+ MODULE_DEVICE_TABLE(spi, spinand_ids);
+@@ -1453,6 +1454,7 @@ MODULE_DEVICE_TABLE(spi, spinand_ids);
+ #ifdef CONFIG_OF
+ static const struct of_device_id spinand_of_ids[] = {
+ 	{ .compatible = "spi-nand" },
++	{ .compatible = "u-boot-dont-touch-spi-nand" },
+ 	{ /* sentinel */ },
+ };
+ MODULE_DEVICE_TABLE(of, spinand_of_ids);
diff --git a/target/linux/mpc85xx/config-6.6 b/target/linux/mpc85xx/config-6.6
index 14d5650fb50746..30a551e55edfb7 100644
--- a/target/linux/mpc85xx/config-6.6
+++ b/target/linux/mpc85xx/config-6.6
@@ -29,8 +29,6 @@ CONFIG_BOOKE_WDT=y
 # CONFIG_BSC9131_RDB is not set
 # CONFIG_BSC9132_QDS is not set
 # CONFIG_C293_PCIE is not set
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CLZ_TAB=y
 CONFIG_CMDLINE="console=ttyS0,115200"
@@ -42,6 +40,7 @@ CONFIG_COMPAT_32BIT_TIME=y
 # CONFIG_CORENET_GENERIC is not set
 # CONFIG_CPM2 is not set
 CONFIG_CPU_BIG_ENDIAN=y
+CONFIG_CPU_MITIGATIONS=y
 # CONFIG_CRYPTO_AES_PPC_SPE is not set
 CONFIG_CRYPTO_AUTHENC=y
 CONFIG_CRYPTO_HW=y
@@ -73,6 +72,7 @@ CONFIG_EDAC_SUPPORT=y
 CONFIG_EXCLUSIVE_SYSTEM_RAM=y
 # CONFIG_FIREBOX_T10 is not set
 CONFIG_FIXED_PHY=y
+CONFIG_FORCE_NR_CPUS=y
 CONFIG_FSL_EMB_PERFMON=y
 # CONFIG_FSL_FMAN is not set
 CONFIG_FSL_LBC=y
@@ -86,8 +86,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
-CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_BUG=y
diff --git a/target/linux/mpc85xx/files/arch/powerpc/boot/dts/tl-wdr4900-v1.dts b/target/linux/mpc85xx/files/arch/powerpc/boot/dts/tl-wdr4900-v1.dts
index 4fd9767d2d4550..861f4511de4d2d 100644
--- a/target/linux/mpc85xx/files/arch/powerpc/boot/dts/tl-wdr4900-v1.dts
+++ b/target/linux/mpc85xx/files/arch/powerpc/boot/dts/tl-wdr4900-v1.dts
@@ -395,18 +395,25 @@
 		compatible = "gpio-leds";
 
 		led-0 {
+			gpios = <&ath9k 0 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN_5GHZ;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led-1 {
 			gpios = <&ath9k 1 GPIO_ACTIVE_LOW>;
 			color = <LED_COLOR_ID_GREEN>;
 			function = LED_FUNCTION_WPS;
 		};
 
-		system_green: led-1 {
+		system_green: led-2 {
 			gpios = <&gpio0 2 GPIO_ACTIVE_LOW>;
 			color = <LED_COLOR_ID_GREEN>;
 			function = LED_FUNCTION_STATUS;
 		};
 
-		led-2 {
+		led-3 {
 			gpios = <&gpio0 3 GPIO_ACTIVE_LOW>;
 			color = <LED_COLOR_ID_GREEN>;
 			function = LED_FUNCTION_USB;
@@ -415,7 +422,7 @@
 			trigger-sources = <&hub_port1>;
 		};
 
-		led-3 {
+		led-4 {
 			gpios = <&gpio0 4 GPIO_ACTIVE_LOW>;
 			color = <LED_COLOR_ID_GREEN>;
 			function = LED_FUNCTION_USB;
diff --git a/target/linux/mpc85xx/p1010/config-default b/target/linux/mpc85xx/p1010/config-default
index 5a17e38f5c737b..22801b9c2b9d45 100644
--- a/target/linux/mpc85xx/p1010/config-default
+++ b/target/linux/mpc85xx/p1010/config-default
@@ -1,11 +1,19 @@
 CONFIG_BR200_WP=y
 CONFIG_CMDLINE_OVERRIDE=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_DEFAULT_UIMAGE=y
 CONFIG_FIREBOX_T10=y
 # CONFIG_FSL_CORENET_CF is not set
 CONFIG_FSL_IFC=y
 CONFIG_GPIO_74X164=y
+CONFIG_GRO_CELLS=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
 CONFIG_MEMORY=y
-CONFIG_MTD_CFI=y
 CONFIG_MTD_NAND_FSL_IFC=y
 CONFIG_MTD_PHYSMAP=y
 CONFIG_MTD_SPLIT_TPLINK_FW=y
@@ -14,6 +22,7 @@ CONFIG_MTD_UBI=y
 CONFIG_MTD_UBI_BEB_LIMIT=20
 CONFIG_MTD_UBI_BLOCK=y
 CONFIG_MTD_UBI_WL_THRESHOLD=4096
+CONFIG_NEED_DMA_MAP_STATE=y
 CONFIG_NET_DEVLINK=y
 CONFIG_NET_DSA=y
 CONFIG_NET_DSA_QCA8K=y
@@ -27,7 +36,16 @@ CONFIG_REALTEK_PHY=y
 CONFIG_RED_15W_REV1=y
 CONFIG_REGMAP=y
 CONFIG_REGULATOR=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SPI_BITBANG=y
 CONFIG_SPI_GPIO=y
+CONFIG_SWIOTLB=y
 CONFIG_TL_WDR4900_V1=y
 CONFIG_UBIFS_FS=y
 CONFIG_WS_AP3715I=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMMON=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/mpc85xx/p1020/config-default b/target/linux/mpc85xx/p1020/config-default
index 66710a9aceb8f0..616979100725ed 100644
--- a/target/linux/mpc85xx/p1020/config-default
+++ b/target/linux/mpc85xx/p1020/config-default
@@ -1,24 +1,31 @@
-CONFIG_ARCH_HAS_TICK_BROADCAST=y
 CONFIG_AT803X_PHY=y
 CONFIG_B53=y
 CONFIG_B53_MDIO_DRIVER=y
 CONFIG_BCM_NET_PHYLIB=y
 CONFIG_BROADCOM_PHY=y
 CONFIG_CMDLINE_OVERRIDE=y
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
 CONFIG_CPU_RMAP=y
+CONFIG_CRC16=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_HASH_INFO=y
+CONFIG_CRYPTO_LZO=y
+CONFIG_CRYPTO_ZSTD=y
+CONFIG_DEFAULT_UIMAGE=y
 CONFIG_EEPROM_LEGACY=y
-# CONFIG_FSL_CORENET_CF is not set
 CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
 CONFIG_GENERIC_TBSYNC=y
 CONFIG_GPIO_74X164=y
 # CONFIG_GPIO_MAX77620 is not set
 CONFIG_GRO_CELLS=y
-CONFIG_HAVE_RCU_TABLE_FREE=y
 CONFIG_HIVEAP_330=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_LEDS_LP5521=y
 CONFIG_LEDS_LP55XX_COMMON=y
 CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LZO_COMPRESS=y
+CONFIG_LZO_DECOMPRESS=y
 # CONFIG_MAX77620_THERMAL is not set
 # CONFIG_MAX77620_WATCHDOG is not set
 CONFIG_MFD_CORE=y
@@ -46,16 +53,30 @@ CONFIG_NET_SWITCHDEV=y
 CONFIG_NR_CPUS=2
 CONFIG_PADATA=y
 CONFIG_PANDA=y
+CONFIG_PHYLINK=y
+CONFIG_PPC_ZIMAGE_LA3000000=y
+CONFIG_QCOM_NET_PHYLIB=y
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
 CONFIG_REGMAP_IRQ=y
 CONFIG_REGULATOR=y
 CONFIG_RFS_ACCEL=y
 CONFIG_RPS=y
-# CONFIG_RTC_DRV_MAX77686 is not set
 CONFIG_RWSEM_SPIN_ON_OWNER=y
+CONFIG_SGL_ALLOC=y
 CONFIG_SMP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SPI_BITBANG=y
 CONFIG_SPI_GPIO=y
 CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
 CONFIG_UBIFS_FS=y
 CONFIG_WS_AP3710I=y
 CONFIG_WS_AP3825I=y
 CONFIG_XPS=y
+CONFIG_XXHASH=y
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
+CONFIG_ZSTD_COMMON=y
+CONFIG_ZSTD_COMPRESS=y
+CONFIG_ZSTD_DECOMPRESS=y
diff --git a/target/linux/mpc85xx/p2020/config-default b/target/linux/mpc85xx/p2020/config-default
index ff8c8cb9393445..bfdb48959ac69b 100644
--- a/target/linux/mpc85xx/p2020/config-default
+++ b/target/linux/mpc85xx/p2020/config-default
@@ -1,16 +1,16 @@
 CONFIG_BLK_DEV_NVME=y
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
 CONFIG_CPU_RMAP=y
 CONFIG_DEFAULT_UIMAGE=y
 CONFIG_FSL_ULI1575=y
 CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
 CONFIG_GENERIC_IRQ_MIGRATION=y
 CONFIG_GENERIC_MSI_IRQ=y
-CONFIG_GENERIC_MSI_IRQ_DOMAIN=y
 CONFIG_GENERIC_TBSYNC=y
 CONFIG_IRQ_DOMAIN_HIERARCHY=y
 CONFIG_LOCK_SPIN_ON_OWNER=y
 CONFIG_MAX63XX_WATCHDOG=y
-CONFIG_MDIO_DEVRES=y
 CONFIG_MPC85xx_RDB=y
 CONFIG_MTD_CFI=y
 CONFIG_MTD_NAND_FSL_ELBC=y
@@ -36,6 +36,7 @@ CONFIG_RPS=y
 CONFIG_RTC_DRV_DS1307=y
 CONFIG_RWSEM_SPIN_ON_OWNER=y
 CONFIG_SMP=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
 CONFIG_SWIOTLB=y
 CONFIG_TARGET_CPU="8540"
 CONFIG_TARGET_CPU_BOOL=y
diff --git a/target/linux/mpc85xx/patches-6.6/010-powerpc-add-compressed-zImage-for-mpc85xx.patch b/target/linux/mpc85xx/patches-6.6/010-powerpc-add-compressed-zImage-for-mpc85xx.patch
index eeb501dfebc170..056dac043d8d6d 100644
--- a/target/linux/mpc85xx/patches-6.6/010-powerpc-add-compressed-zImage-for-mpc85xx.patch
+++ b/target/linux/mpc85xx/patches-6.6/010-powerpc-add-compressed-zImage-for-mpc85xx.patch
@@ -16,7 +16,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
-@@ -177,6 +177,7 @@ src-plat-$(CONFIG_EMBEDDED6xx) += cuboot
+@@ -178,6 +178,7 @@ src-plat-$(CONFIG_EMBEDDED6xx) += cuboot
  src-plat-$(CONFIG_AMIGAONE) += cuboot-amigaone.c
  src-plat-$(CONFIG_PPC_PS3) += ps3-head.S ps3-hvcall.S ps3.c
  src-plat-$(CONFIG_EPAPR_BOOT) += epapr.c epapr-wrapper.c
@@ -24,7 +24,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  src-plat-$(CONFIG_PPC_PSERIES) += pseries-head.S
  src-plat-$(CONFIG_PPC_POWERNV) += pseries-head.S
  src-plat-$(CONFIG_PPC_IBM_CELL_BLADE) += pseries-head.S
-@@ -342,6 +343,7 @@ image-$(CONFIG_MPC834x_ITX)		+= cuImage.
+@@ -343,6 +344,7 @@ image-$(CONFIG_MPC834x_ITX)		+= cuImage.
  image-$(CONFIG_ASP834x)			+= dtbImage.asp834x-redboot
  
  # Board ports in arch/powerpc/platform/85xx/Kconfig
@@ -34,7 +34,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  					   cuImage.mpc8572ds
 --- a/arch/powerpc/boot/wrapper
 +++ b/arch/powerpc/boot/wrapper
-@@ -258,6 +258,11 @@ if [ -n "$esm_blob" -a "$platform" != "p
+@@ -256,6 +256,11 @@ if [ -n "$esm_blob" -a "$platform" != "p
  fi
  
  case "$platform" in
diff --git a/target/linux/mpc85xx/patches-6.6/100-powerpc-85xx-tl-wdr4900-v1-support.patch b/target/linux/mpc85xx/patches-6.6/100-powerpc-85xx-tl-wdr4900-v1-support.patch
index 2f8d4d4e3d57a9..0dbe4d8494724d 100644
--- a/target/linux/mpc85xx/patches-6.6/100-powerpc-85xx-tl-wdr4900-v1-support.patch
+++ b/target/linux/mpc85xx/patches-6.6/100-powerpc-85xx-tl-wdr4900-v1-support.patch
@@ -19,7 +19,7 @@ Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
 
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
-@@ -182,6 +182,7 @@ src-plat-$(CONFIG_PPC_PSERIES) += pserie
+@@ -183,6 +183,7 @@ src-plat-$(CONFIG_PPC_PSERIES) += pserie
  src-plat-$(CONFIG_PPC_POWERNV) += pseries-head.S
  src-plat-$(CONFIG_PPC_IBM_CELL_BLADE) += pseries-head.S
  src-plat-$(CONFIG_MVME7100) += motload-head.S mvme7100.c
@@ -27,7 +27,7 @@ Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
  
  src-plat-$(CONFIG_PPC_MICROWATT) += fixed-head.S microwatt.c
  
-@@ -353,7 +354,7 @@ image-$(CONFIG_TQM8548)			+= cuImage.tqm
+@@ -354,7 +355,7 @@ image-$(CONFIG_TQM8548)			+= cuImage.tqm
  image-$(CONFIG_TQM8555)			+= cuImage.tqm8555
  image-$(CONFIG_TQM8560)			+= cuImage.tqm8560
  image-$(CONFIG_KSI8560)			+= cuImage.ksi8560
@@ -38,7 +38,7 @@ Signed-off-by: Pawel Dembicki <paweldembicki@gmail.com>
  
 --- a/arch/powerpc/boot/wrapper
 +++ b/arch/powerpc/boot/wrapper
-@@ -350,6 +350,11 @@ adder875-redboot)
+@@ -348,6 +348,11 @@ adder875-redboot)
      platformo="$object/fixed-head.o $object/redboot-8xx.o"
      binary=y
      ;;
diff --git a/target/linux/mpc85xx/patches-6.6/101-powerpc-85xx-hiveap-330-support.patch b/target/linux/mpc85xx/patches-6.6/101-powerpc-85xx-hiveap-330-support.patch
index 85de47bfb5760b..1c6f7878a0fd92 100644
--- a/target/linux/mpc85xx/patches-6.6/101-powerpc-85xx-hiveap-330-support.patch
+++ b/target/linux/mpc85xx/patches-6.6/101-powerpc-85xx-hiveap-330-support.patch
@@ -30,7 +30,7 @@
  obj-$(CONFIG_MPC85xx_DS)  += mpc85xx_ds.o $(obj8259-y)
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
-@@ -182,6 +182,7 @@ src-plat-$(CONFIG_PPC_PSERIES) += pserie
+@@ -183,6 +183,7 @@ src-plat-$(CONFIG_PPC_PSERIES) += pserie
  src-plat-$(CONFIG_PPC_POWERNV) += pseries-head.S
  src-plat-$(CONFIG_PPC_IBM_CELL_BLADE) += pseries-head.S
  src-plat-$(CONFIG_MVME7100) += motload-head.S mvme7100.c
@@ -38,7 +38,7 @@
  src-plat-$(CONFIG_TL_WDR4900_V1) += simpleboot.c fixed-head.S
  
  src-plat-$(CONFIG_PPC_MICROWATT) += fixed-head.S microwatt.c
-@@ -354,6 +355,7 @@ image-$(CONFIG_TQM8548)			+= cuImage.tqm
+@@ -355,6 +356,7 @@ image-$(CONFIG_TQM8548)			+= cuImage.tqm
  image-$(CONFIG_TQM8555)			+= cuImage.tqm8555
  image-$(CONFIG_TQM8560)			+= cuImage.tqm8560
  image-$(CONFIG_KSI8560)			+= cuImage.ksi8560
@@ -48,7 +48,7 @@
  image-$(CONFIG_MVME7100)                += dtbImage.mvme7100
 --- a/arch/powerpc/boot/wrapper
 +++ b/arch/powerpc/boot/wrapper
-@@ -350,6 +350,7 @@ adder875-redboot)
+@@ -348,6 +348,7 @@ adder875-redboot)
      platformo="$object/fixed-head.o $object/redboot-8xx.o"
      binary=y
      ;;
diff --git a/target/linux/mpc85xx/patches-6.6/102-powerpc-add-cmdline-override.patch b/target/linux/mpc85xx/patches-6.6/102-powerpc-add-cmdline-override.patch
index 1aa7c3dbd340ef..34bb95e4c01e69 100644
--- a/target/linux/mpc85xx/patches-6.6/102-powerpc-add-cmdline-override.patch
+++ b/target/linux/mpc85xx/patches-6.6/102-powerpc-add-cmdline-override.patch
@@ -17,7 +17,7 @@
  	help
 --- a/drivers/of/fdt.c
 +++ b/drivers/of/fdt.c
-@@ -1189,6 +1189,17 @@ int __init early_init_dt_scan_chosen(cha
+@@ -1190,6 +1190,17 @@ int __init early_init_dt_scan_chosen(cha
  	if (p != NULL && l > 0)
  		strlcat(cmdline, p, min_t(int, strlen(cmdline) + (int)l, COMMAND_LINE_SIZE));
  
diff --git a/target/linux/mpc85xx/patches-6.6/106-powerpc-85xx-ws-ap3710i-support.patch b/target/linux/mpc85xx/patches-6.6/106-powerpc-85xx-ws-ap3710i-support.patch
index 983772131c31cc..4276effed22488 100644
--- a/target/linux/mpc85xx/patches-6.6/106-powerpc-85xx-ws-ap3710i-support.patch
+++ b/target/linux/mpc85xx/patches-6.6/106-powerpc-85xx-ws-ap3710i-support.patch
@@ -30,7 +30,7 @@
  obj-$(CONFIG_RED_15W_REV1)	+= red15w_rev1.o
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
-@@ -184,6 +184,7 @@ src-plat-$(CONFIG_PPC_IBM_CELL_BLADE) +=
+@@ -185,6 +185,7 @@ src-plat-$(CONFIG_PPC_IBM_CELL_BLADE) +=
  src-plat-$(CONFIG_MVME7100) += motload-head.S mvme7100.c
  src-plat-$(CONFIG_HIVEAP_330) += simpleboot.c fixed-head.S
  src-plat-$(CONFIG_TL_WDR4900_V1) += simpleboot.c fixed-head.S
@@ -38,7 +38,7 @@
  
  src-plat-$(CONFIG_PPC_MICROWATT) += fixed-head.S microwatt.c
  
-@@ -357,6 +358,7 @@ image-$(CONFIG_TQM8560)			+= cuImage.tqm
+@@ -358,6 +359,7 @@ image-$(CONFIG_TQM8560)			+= cuImage.tqm
  image-$(CONFIG_KSI8560)			+= cuImage.ksi8560
  image-$(CONFIG_HIVEAP_330)		+= simpleImage.hiveap-330
  image-$(CONFIG_TL_WDR4900_V1)		+= simpleImage.tl-wdr4900-v1
@@ -48,7 +48,7 @@
  
 --- a/arch/powerpc/boot/wrapper
 +++ b/arch/powerpc/boot/wrapper
-@@ -351,7 +351,8 @@ adder875-redboot)
+@@ -349,7 +349,8 @@ adder875-redboot)
      binary=y
      ;;
  simpleboot-hiveap-330|\
diff --git a/target/linux/mpc85xx/patches-6.6/107-powerpc-85xx-add-ws-ap3825i-support.patch b/target/linux/mpc85xx/patches-6.6/107-powerpc-85xx-add-ws-ap3825i-support.patch
index 29e3b221335530..9d96081c9df20e 100644
--- a/target/linux/mpc85xx/patches-6.6/107-powerpc-85xx-add-ws-ap3825i-support.patch
+++ b/target/linux/mpc85xx/patches-6.6/107-powerpc-85xx-add-ws-ap3825i-support.patch
@@ -37,7 +37,7 @@ WS-AP3825i AP.
  obj-$(CONFIG_RED_15W_REV1)	+= red15w_rev1.o
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
-@@ -185,6 +185,7 @@ src-plat-$(CONFIG_MVME7100) += motload-h
+@@ -186,6 +186,7 @@ src-plat-$(CONFIG_MVME7100) += motload-h
  src-plat-$(CONFIG_HIVEAP_330) += simpleboot.c fixed-head.S
  src-plat-$(CONFIG_TL_WDR4900_V1) += simpleboot.c fixed-head.S
  src-plat-$(CONFIG_WS_AP3710I) += simpleboot.c fixed-head.S
@@ -45,7 +45,7 @@ WS-AP3825i AP.
  
  src-plat-$(CONFIG_PPC_MICROWATT) += fixed-head.S microwatt.c
  
-@@ -359,6 +360,7 @@ image-$(CONFIG_KSI8560)			+= cuImage.ksi
+@@ -360,6 +361,7 @@ image-$(CONFIG_KSI8560)			+= cuImage.ksi
  image-$(CONFIG_HIVEAP_330)		+= simpleImage.hiveap-330
  image-$(CONFIG_TL_WDR4900_V1)		+= simpleImage.tl-wdr4900-v1
  image-$(CONFIG_WS_AP3710I)		+= simpleImage.ws-ap3710i
@@ -55,7 +55,7 @@ WS-AP3825i AP.
  
 --- a/arch/powerpc/boot/wrapper
 +++ b/arch/powerpc/boot/wrapper
-@@ -352,7 +352,8 @@ adder875-redboot)
+@@ -350,7 +350,8 @@ adder875-redboot)
      ;;
  simpleboot-hiveap-330|\
  simpleboot-tl-wdr4900-v1|\
diff --git a/target/linux/mpc85xx/patches-6.6/109-powerpc-85xx-add-ws-ap3715i-support.patch b/target/linux/mpc85xx/patches-6.6/109-powerpc-85xx-add-ws-ap3715i-support.patch
index aa1126569f4413..1ebc87081a2d04 100644
--- a/target/linux/mpc85xx/patches-6.6/109-powerpc-85xx-add-ws-ap3715i-support.patch
+++ b/target/linux/mpc85xx/patches-6.6/109-powerpc-85xx-add-ws-ap3715i-support.patch
@@ -30,7 +30,7 @@
  obj-$(CONFIG_CORENET_GENERIC)   += corenet_generic.o
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
-@@ -185,6 +185,7 @@ src-plat-$(CONFIG_MVME7100) += motload-h
+@@ -186,6 +186,7 @@ src-plat-$(CONFIG_MVME7100) += motload-h
  src-plat-$(CONFIG_HIVEAP_330) += simpleboot.c fixed-head.S
  src-plat-$(CONFIG_TL_WDR4900_V1) += simpleboot.c fixed-head.S
  src-plat-$(CONFIG_WS_AP3710I) += simpleboot.c fixed-head.S
@@ -38,7 +38,7 @@
  src-plat-$(CONFIG_WS_AP3825I) += simpleboot.c fixed-head.S
  
  src-plat-$(CONFIG_PPC_MICROWATT) += fixed-head.S microwatt.c
-@@ -360,6 +361,7 @@ image-$(CONFIG_KSI8560)			+= cuImage.ksi
+@@ -361,6 +362,7 @@ image-$(CONFIG_KSI8560)			+= cuImage.ksi
  image-$(CONFIG_HIVEAP_330)		+= simpleImage.hiveap-330
  image-$(CONFIG_TL_WDR4900_V1)		+= simpleImage.tl-wdr4900-v1
  image-$(CONFIG_WS_AP3710I)		+= simpleImage.ws-ap3710i
diff --git a/target/linux/mpc85xx/patches-6.6/110-powerpc-85xx-br200-wp-support.patch b/target/linux/mpc85xx/patches-6.6/110-powerpc-85xx-br200-wp-support.patch
index 28a2bed017f07f..5174e938f01d2d 100644
--- a/target/linux/mpc85xx/patches-6.6/110-powerpc-85xx-br200-wp-support.patch
+++ b/target/linux/mpc85xx/patches-6.6/110-powerpc-85xx-br200-wp-support.patch
@@ -29,7 +29,7 @@
  obj8259-$(CONFIG_PPC_I8259)   += mpc85xx_8259.o
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
-@@ -182,6 +182,7 @@ src-plat-$(CONFIG_PPC_PSERIES) += pserie
+@@ -183,6 +183,7 @@ src-plat-$(CONFIG_PPC_PSERIES) += pserie
  src-plat-$(CONFIG_PPC_POWERNV) += pseries-head.S
  src-plat-$(CONFIG_PPC_IBM_CELL_BLADE) += pseries-head.S
  src-plat-$(CONFIG_MVME7100) += motload-head.S mvme7100.c
@@ -37,7 +37,7 @@
  src-plat-$(CONFIG_HIVEAP_330) += simpleboot.c fixed-head.S
  src-plat-$(CONFIG_TL_WDR4900_V1) += simpleboot.c fixed-head.S
  src-plat-$(CONFIG_WS_AP3710I) += simpleboot.c fixed-head.S
-@@ -358,6 +359,7 @@ image-$(CONFIG_TQM8548)			+= cuImage.tqm
+@@ -359,6 +360,7 @@ image-$(CONFIG_TQM8548)			+= cuImage.tqm
  image-$(CONFIG_TQM8555)			+= cuImage.tqm8555
  image-$(CONFIG_TQM8560)			+= cuImage.tqm8560
  image-$(CONFIG_KSI8560)			+= cuImage.ksi8560
@@ -47,7 +47,7 @@
  image-$(CONFIG_WS_AP3710I)		+= simpleImage.ws-ap3710i
 --- a/arch/powerpc/boot/wrapper
 +++ b/arch/powerpc/boot/wrapper
-@@ -350,6 +350,7 @@ adder875-redboot)
+@@ -348,6 +348,7 @@ adder875-redboot)
      platformo="$object/fixed-head.o $object/redboot-8xx.o"
      binary=y
      ;;
diff --git a/target/linux/mpc85xx/patches-6.6/900-powerpc-bootwrapper-disable-uImage-generation.patch b/target/linux/mpc85xx/patches-6.6/900-powerpc-bootwrapper-disable-uImage-generation.patch
index 5ffc32e9dea6d7..f24fefa1100124 100644
--- a/target/linux/mpc85xx/patches-6.6/900-powerpc-bootwrapper-disable-uImage-generation.patch
+++ b/target/linux/mpc85xx/patches-6.6/900-powerpc-bootwrapper-disable-uImage-generation.patch
@@ -16,7 +16,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
 
 --- a/arch/powerpc/boot/Makefile
 +++ b/arch/powerpc/boot/Makefile
-@@ -296,7 +296,6 @@ image-$(CONFIG_PPC_CHRP)		+= zImage.chrp
+@@ -297,7 +297,6 @@ image-$(CONFIG_PPC_CHRP)		+= zImage.chrp
  image-$(CONFIG_PPC_EFIKA)		+= zImage.chrp
  image-$(CONFIG_PPC_PMAC)		+= zImage.pmac
  image-$(CONFIG_PPC_HOLLY)		+= dtbImage.holly
@@ -24,7 +24,7 @@ Signed-off-by: David Bauer <mail@david-bauer.net>
  image-$(CONFIG_EPAPR_BOOT)		+= zImage.epapr
  
  #
-@@ -423,15 +422,6 @@ $(obj)/dtbImage.%: vmlinux $(wrapperbits
+@@ -424,15 +423,6 @@ $(obj)/dtbImage.%: vmlinux $(wrapperbits
  $(obj)/vmlinux.strip: vmlinux
  	$(STRIP) -s -R .comment $< -o $@
  
diff --git a/target/linux/mvebu/config-6.6 b/target/linux/mvebu/config-6.6
index a4572d8a896bda..bb29d80c5cf2f1 100644
--- a/target/linux/mvebu/config-6.6
+++ b/target/linux/mvebu/config-6.6
@@ -57,8 +57,6 @@ CONFIG_BOUNCE=y
 # CONFIG_CACHE_FEROCEON_L2 is not set
 CONFIG_CACHE_L2X0=y
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_ARM_GLOBAL_TIMER_SCHED_CLOCK=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLONE_BACKWARDS=y
@@ -161,7 +159,6 @@ CONFIG_FS_MBCACHE=y
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
 CONFIG_GENERIC_BUG=y
diff --git a/target/linux/mvebu/cortexa9/base-files/etc/board.d/02_network b/target/linux/mvebu/cortexa9/base-files/etc/board.d/02_network
index 680af1ce673730..8cf1c0e4261c6a 100644
--- a/target/linux/mvebu/cortexa9/base-files/etc/board.d/02_network
+++ b/target/linux/mvebu/cortexa9/base-files/etc/board.d/02_network
@@ -13,7 +13,8 @@ mvebu_setup_interfaces()
 
 	case "$board" in
 	ctera,c200-v2|\
-	synology,ds213j)
+	synology,ds213j|\
+	wd,cloud-mirror-gen2)
 		ucidef_set_interface_lan "eth0" "dhcp"
 		;;
 	cznic,turris-omnia)
@@ -94,6 +95,12 @@ mvebu_setup_macs()
 		lan_mac=$label_mac
 		wan_mac=$label_mac
 		;;
+	wd,cloud-mirror-gen2)
+		# mac address is on ubi "config" or ubi "reserve2" in text file.
+		# ubi "reserve2" /dev/mtd7 is twice small and only contains basic OEM factory info
+		label_mac=$(macaddr_canonicalize $(strings /dev/mtd7|grep -E '([0-9A-F]{2}[:])'))
+		lan_mac=$label_mac
+		;;
 	esac
 
 	[ -n "$lan_mac" ] && ucidef_set_interface_macaddr "lan" $lan_mac
diff --git a/target/linux/mvebu/cortexa9/base-files/lib/upgrade/platform.sh b/target/linux/mvebu/cortexa9/base-files/lib/upgrade/platform.sh
index 70678622d34a28..13d8e77c93cc6a 100755
--- a/target/linux/mvebu/cortexa9/base-files/lib/upgrade/platform.sh
+++ b/target/linux/mvebu/cortexa9/base-files/lib/upgrade/platform.sh
@@ -31,7 +31,8 @@ platform_do_upgrade() {
 		CI_ROOT_UBIPART=ubi
 		nand_do_upgrade "$1"
 		;;
-	buffalo,ls421de)
+	buffalo,ls421de|\
+	wd,cloud-mirror-gen2)
 		nand_do_upgrade "$1"
 		;;
 	ctera,c200-v2)
diff --git a/target/linux/mvebu/files-6.6/arch/arm/boot/dts/marvell/armada-385-wd_cloud-mirror-gen2.dts b/target/linux/mvebu/files-6.6/arch/arm/boot/dts/marvell/armada-385-wd_cloud-mirror-gen2.dts
new file mode 100644
index 00000000000000..50936e72adfa2f
--- /dev/null
+++ b/target/linux/mvebu/files-6.6/arch/arm/boot/dts/marvell/armada-385-wd_cloud-mirror-gen2.dts
@@ -0,0 +1,368 @@
+// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+/*
+ * Device Tree file for Western Digital My Cloud Mirror Gen 2
+ * (BWVZ/Grand Teton)
+ *
+ * Copyright (C) 2020
+ *
+ * Based on the code from:
+ *
+ * Copyright (C) 2019 Evgeny Kolesnikov <evgenyz@gmail.com>
+ * Copyright (C) 2016 Martin Mueller <mm@sig21.net>
+ * Copyright (C) 2013 Gregory CLEMENT <gregory.clement@free-electrons.com>
+ * Copyright (C) 2014 Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
+ *
+ */
+
+/dts-v1/;
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+#include "armada-385.dtsi"
+
+/ {
+	model = "WD MyCloud Mirror Gen 2 (BWVZ/Grand Teton)";
+	compatible = "wd,cloud-mirror-gen2", "marvell,armada385", "marvell,armada380";
+
+	aliases {
+		led-boot = &led_boot;
+		led-failsafe = &led_boot;
+		led-upgrade = &led_boot;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+		append-rootblock = "nullparameter="; /* override the bootloader args */
+	};
+
+	memory {
+		device_type = "memory";
+		reg = <0x00000000 0x20000000>; /* 512 MB */
+	};
+
+	soc {
+		ranges = <MBUS_ID(0xf0, 0x01) 0 0xf1000000 0x100000
+		          MBUS_ID(0x01, 0x1d) 0 0xfff00000 0x100000
+		          MBUS_ID(0x09, 0x19) 0 0xf1100000 0x10000
+		          MBUS_ID(0x09, 0x15) 0 0xf1110000 0x10000
+		          MBUS_ID(0x0c, 0x04) 0 0xf1200000 0x100000>;
+
+		internal-regs {
+			timer@c200 {
+				status = "okay";
+			};
+
+			i2c0: i2c@11000 {
+				status = "okay";
+				clock-frequency = <100000>;
+			};
+
+			i2c1: i2c@11100 {
+				status = "okay";
+				clock-frequency = <100000>;
+			};
+
+			serial@12000 {
+				status = "okay";
+			};
+
+			/* Connected to Welltrend 6703F-OG240WT MCU
+			 * which controls power, fan and other things
+			 */
+			serial@12100 {
+				status = "okay";
+			};
+
+			pinctrl@18000 {
+				/* use only one pin for UART1, as mpp20 is used by sata0 */
+				uart1_pins: uart-pins-1 {
+					marvell,pins = "mpp19";
+					marvell,function = "ua1";
+				};
+
+				xhci0_vbus_pins: xhci0-vbus-pins {
+					marvell,pins = "mpp26";
+					marvell,function = "gpio";
+				};
+
+				xhci1_vbus_pins: xhci1-vbus-pins {
+					marvell,pins = "mpp27";
+					marvell,function = "gpio";
+				};
+
+				sata0_pins: sata-pins-0 {
+					marvell,pins = "mpp55";
+					marvell,function = "sata0";
+				};
+
+				sata1_pins: sata-pins-1 {
+					marvell,pins = "mpp56";
+					marvell,function = "sata1";
+				};
+
+				sata_leds: sata-leds {
+					marvell,pins = "mpp43", "mpp52", "mpp53", "mpp54";
+					marvell,function = "gpio";
+				};
+
+				btn_pins: btn-pins {
+					marvell,pins = "mpp50";
+					marvell,function = "gpio";
+				};
+			};
+
+			usb@58000 {
+				status = "okay";
+			};
+
+			phy: mdio@72004 {
+				phy0: ethernet-phy@0 {
+					/* Init ETH LEDs */
+					marvell,reg-init = <3 16 0 0x101e>;
+					reg = <0>;
+				};
+			};
+
+			sata@a8000 {
+				status = "okay";
+			};
+
+			nand-controller@d0000 {
+				status = "okay";
+
+				nand: nand@0 {
+					reg = <0>;
+					label = "pxa3xx_nand-0";
+					nand-rb = <0>;
+					marvell,nand-keep-config;
+					#marvell,nand-enable-arbiter; //optional
+					nand-on-flash-bbt;
+					nand-ecc-strength = <4>;
+					nand-ecc-step-size = <512>;
+
+					partitions {
+						compatible = "fixed-partitions";
+						#address-cells = <1>;
+						#size-cells = <1>;
+
+						partition@00000000 {
+							label = "U-Boot";
+							reg = <0x00000000 0x00500000>;    /*   5 MB */
+							read-only;
+						};
+
+						partition@00500000 {
+							label = "kernel";
+							reg = <0x00500000 0x00500000>;    /*   5 MB */
+						};
+
+						partition@00a00000 {
+							label = "uRamdisk";
+							reg = <0x00a00000 0x00500000>;    /*   5 MB */
+							read-only;
+						};
+
+						partition@00f00000 {
+							label = "ubi";
+							reg = <0x00f00000 0x0b900000>;    /* 185 MB */
+						};
+
+						partition@c800000 {
+							label = "rescue fw";
+							reg = <0x0c800000 0x00f00000>;    /*  15 MB */
+							read-only;
+						};
+
+						partition@d70000 {
+							label = "config";
+							reg = <0x0d700000 0x01400000>;    /*  20 MB */
+							read-only;
+						};
+
+						partition@eb00000 {
+							label = "reserve1";
+							reg = <0x0eb00000 0x00a00000>;    /*  10 MB */
+							read-only;
+						};
+
+						partition@f500000 {
+							label = "reserve2";
+							reg = <0x0f500000 0x00a00000>;    /*  10 MB */
+							read-only;
+						};
+					};
+				};
+			};
+
+			usb3@f0000 {
+				usb-phy = <&usb3_0_phy>;
+				status = "okay";
+			};
+
+			usb3@f8000 {
+				usb-phy = <&usb3_1_phy>;
+				status = "okay";
+			};
+		};
+	};
+
+	gpio-leds {
+		compatible = "gpio-leds";
+		pinctrl-names = "default";
+		pinctrl-0 = <&sata_leds>;
+
+		led_boot: s1red {
+			label = "red:hdd1";
+			gpios = <&gpio1 11 GPIO_ACTIVE_HIGH>;
+		};
+		s2red {
+			label = "red:hdd2";
+			gpios = <&gpio1 20 GPIO_ACTIVE_HIGH>;
+		};
+		s1blue {
+			label = "blue:hdd1";
+			gpios = <&gpio1 21 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "ata1";
+		};
+		s2blue {
+			label = "blue:hdd2";
+			gpios = <&gpio1 22 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "ata2";
+		};
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+		pinctrl-names = "default";
+		pinctrl-0 = <&btn_pins>;
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;  // Restart=0x198, Power=0x116
+			gpios = <&gpio1 18 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+			wakeup-source;
+		};
+	};
+
+	usb3_0_phy: usb3_0_phy {
+		compatible = "usb-nop-xceiv";
+		vcc-supply = <&reg_usb3_0_vbus>;
+	};
+
+	usb3_1_phy: usb3_1_phy {
+		compatible = "usb-nop-xceiv";
+		vcc-supply = <&reg_usb3_1_vbus>;
+	};
+
+	reg_usb3_0_vbus: usb3-vbus0 {
+		compatible = "regulator-fixed";
+		regulator-name = "usb3-vbus0";
+		pinctrl-names = "default";
+		pinctrl-0 = <&xhci0_vbus_pins>;
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		enable-active-high;
+		regulator-always-on;
+		gpio = <&gpio0 26 GPIO_ACTIVE_HIGH>;
+	};
+
+	reg_usb3_1_vbus: usb3-vbus1 {
+		compatible = "regulator-fixed";
+		regulator-name = "usb3-vbus1";
+		pinctrl-names = "default";
+		pinctrl-0 = <&xhci1_vbus_pins>;
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		enable-active-high;
+		regulator-always-on;
+		gpio = <&gpio0 27 GPIO_ACTIVE_HIGH>;
+	};
+
+	reg_sata0: pwr-sata0 {
+		compatible = "regulator-fixed";
+		regulator-name = "pwr_en_sata0";
+		regulator-min-microvolt = <12000000>;
+		regulator-max-microvolt = <12000000>;
+		enable-active-high;
+		regulator-boot-on;
+		gpio = <&gpio1 23 GPIO_ACTIVE_HIGH>;
+	};
+
+	reg_5v_sata0: v5-sata0 {
+		compatible = "regulator-fixed";
+		regulator-name = "v5.0-sata0";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		vin-supply = <&reg_sata0>;
+	};
+
+	reg_12v_sata0: v12-sata0 {
+		compatible = "regulator-fixed";
+		regulator-name = "v12.0-sata0";
+		regulator-min-microvolt = <12000000>;
+		regulator-max-microvolt = <12000000>;
+		vin-supply = <&reg_sata0>;
+	};
+
+	reg_sata1: pwr-sata1 {
+		compatible = "regulator-fixed";
+		regulator-name = "pwr_en_sata1";
+		regulator-min-microvolt = <12000000>;
+		regulator-max-microvolt = <12000000>;
+		enable-active-high;
+		regulator-boot-on;
+		gpio = <&gpio1 24 GPIO_ACTIVE_HIGH>;
+	};
+
+	reg_5v_sata1: v5-sata1 {
+		compatible = "regulator-fixed";
+		regulator-name = "v5.0-sata1";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		vin-supply = <&reg_sata1>;
+	};
+
+	reg_12v_sata1: v12-sata1 {
+		compatible = "regulator-fixed";
+		regulator-name = "v12.0-sata1";
+		regulator-min-microvolt = <12000000>;
+		regulator-max-microvolt = <12000000>;
+		vin-supply = <&reg_sata1>;
+	};
+};
+
+&bm {
+	status = "okay";
+};
+
+&bm_bppi {
+	status = "okay";
+};
+
+&eth2 {
+	status = "okay";
+	phy = <&phy0>;
+	phy-mode = "sgmii";
+	buffer-manager = <&bm>;
+	bm,pool-long = <0>;
+	bm,pool-short = <1>;
+};
+
+&ahci0 {
+	status = "okay";
+	#address-cells = <1>;
+	#size-cells = <0>;
+
+	sata-port@0 {
+		reg = <0>;
+		target-supply = <&reg_sata0>;
+		#thermal-sensor-cells = <0>;
+	};
+
+	sata-port@1 {
+		reg = <1>;
+		target-supply = <&reg_sata1>;
+		#thermal-sensor-cells = <1>;
+	};
+};
diff --git a/target/linux/mvebu/image/cortexa9.mk b/target/linux/mvebu/image/cortexa9.mk
index 6e49045f68432e..b5f89aec20c977 100644
--- a/target/linux/mvebu/image/cortexa9.mk
+++ b/target/linux/mvebu/image/cortexa9.mk
@@ -107,7 +107,8 @@ define Device/cznic_turris-omnia
     mkf2fs e2fsprogs kmod-fs-vfat kmod-nls-cp437 kmod-nls-iso8859-1 \
     wpad-basic-mbedtls kmod-ath9k kmod-ath10k-ct ath10k-firmware-qca988x-ct \
     kmod-mt7915-firmware partx-utils kmod-i2c-mux-pca954x kmod-leds-turris-omnia \
-    kmod-turris-omnia-mcu kmod-gpio-button-hotplug omnia-mcu-firmware omnia-mcutool
+    kmod-turris-omnia-mcu kmod-gpio-button-hotplug omnia-eeprom omnia-mcu-firmware \
+    omnia-mcutool
   IMAGES := sysupgrade.img.gz
   IMAGE/sysupgrade.img.gz := boot-scr | boot-img | sdcard-img | gzip | append-metadata
   SUPPORTED_DEVICES += armada-385-turris-omnia
@@ -447,3 +448,20 @@ define Device/synology_ds213j
     -ppp -kmod-nft-offload -dnsmasq -odhcpd-ipv6only
 endef
 TARGET_DEVICES += synology_ds213j
+
+define Device/wd_cloud-mirror-gen2
+  $(Device/NAND-128K)
+  DEVICE_VENDOR := Western Digital
+  DEVICE_MODEL := MyCloud Mirror Gen 2 (BWVZ/Grand Teton)
+  DEVICE_PACKAGES += -uboot-envtools mkf2fs e2fsprogs \
+	partx-utils kmod-hwmon-drivetemp -ppp -kmod-nft-offload -dnsmasq \
+	-odhcpd-ipv6only 
+  DEVICE_DTS := armada-385-wd_cloud-mirror-gen2
+  KERNEL_SIZE := 5120k
+  KERNEL := kernel-bin | append-dtb | uImage none
+  KERNEL_INITRAMFS := kernel-bin | append-dtb | uImage none
+  IMAGES += image-cfs-factory.bin uImage-factory.bin
+  IMAGE/image-cfs-factory.bin := append-ubi
+  IMAGE/uImage-factory.bin := append-kernel
+endef
+TARGET_DEVICES += wd_cloud-mirror-gen2
diff --git a/target/linux/mvebu/patches-6.6/0003-v6.16-pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch b/target/linux/mvebu/patches-6.6/0003-v6.16-pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch
new file mode 100644
index 00000000000000..2d7b6b5176210f
--- /dev/null
+++ b/target/linux/mvebu/patches-6.6/0003-v6.16-pinctrl-armada-37xx-propagate-error-from-armada_37xx.patch
@@ -0,0 +1,31 @@
+From 0396a8731efd17aec4719ad9981fefeaa13ffa56 Mon Sep 17 00:00:00 2001
+From: Gabor Juhos <j4g8y7@gmail.com>
+Date: Wed, 14 May 2025 21:18:34 +0200
+Subject: [PATCH 3/7] pinctrl: armada-37xx: propagate error from
+ armada_37xx_gpio_direction_output()
+
+The regmap_update_bits() function can fail, so propagate its error
+up to the stack instead of silently ignoring that.
+
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Link: https://lore.kernel.org/20250514-pinctrl-a37xx-fixes-v2-3-07e9ac1ab737@gmail.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+---
+ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
++++ b/drivers/pinctrl/mvebu/pinctrl-armada-37xx.c
+@@ -433,9 +433,7 @@ static int armada_37xx_gpio_direction_ou
+ 	reg = OUTPUT_EN;
+ 	armada_37xx_update_reg(&reg, &en_offset);
+ 
+-	regmap_update_bits(info->regmap, reg, mask, mask);
+-
+-	return 0;
++	return regmap_update_bits(info->regmap, reg, mask, mask);
+ }
+ 
+ static int armada_37xx_gpio_get(struct gpio_chip *chip, unsigned int offset)
diff --git a/target/linux/mvebu/patches-6.6/309-linksys-status-led.patch b/target/linux/mvebu/patches-6.6/309-linksys-status-led.patch
index 4ad9abc3a1988f..270937a924b240 100644
--- a/target/linux/mvebu/patches-6.6/309-linksys-status-led.patch
+++ b/target/linux/mvebu/patches-6.6/309-linksys-status-led.patch
@@ -19,7 +19,7 @@
  		pinctrl-names = "default";
  
 -		led-power {
-+		led_power: power {
++		led_power: led-power {
  			gpios = <&gpio1 23 GPIO_ACTIVE_HIGH>;
  			default-state = "on";
  		};
@@ -44,7 +44,7 @@
  		pinctrl-names = "default";
  
 -		led-power {
-+		led_power: power {
++		led_power: led-power {
  			label = "mamba:white:power";
  			gpios = <&gpio1 8 GPIO_ACTIVE_HIGH>;
  			default-state = "on";
diff --git a/target/linux/mvebu/patches-6.6/830-01-i2c-add-init_recovery-callback.patch b/target/linux/mvebu/patches-6.6/830-01-i2c-add-init_recovery-callback.patch
new file mode 100644
index 00000000000000..de46f339dec044
--- /dev/null
+++ b/target/linux/mvebu/patches-6.6/830-01-i2c-add-init_recovery-callback.patch
@@ -0,0 +1,189 @@
+From patchwork Sun May 11 13:31:05 2025
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Gabor Juhos <j4g8y7@gmail.com>
+X-Patchwork-Id: 14084055
+Return-Path: 
+ <linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from bombadil.infradead.org (bombadil.infradead.org
+ [198.137.202.133])
+	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
+	(No client certificate requested)
+	by smtp.lore.kernel.org (Postfix) with ESMTPS id 0802BC3ABC3
+	for <linux-arm-kernel@archiver.kernel.org>;
+ Sun, 11 May 2025 13:35:46 +0000 (UTC)
+DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
+	d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help
+	:List-Post:List-Archive:List-Unsubscribe:List-Id:Cc:To:In-Reply-To:References
+	:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:
+	From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:
+	Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner;
+	bh=n9RYlne5nhTN7kCu5Yc7zW4CF0YUJUWg2clQo/viA0M=; b=LBsqIvaHPjMCwZZfbGyry56BIg
+	sEpAZY6rWjqf0DWQjODfNe8G8EZOzfHbMRA8HElCRdUR54+uQkesdQ9CuQip0FUIEkRlfRHM8HYTB
+	iWLgZE6pnElndi/4uhAmfvgQFvMbDhxrsoAqAjLY4K+sPr53QSEGO7ygY+TPHmcpyVfD+kRqjMAv3
+	wbypdxFC5lHAOvIiAdaKreajEf7HBqztprh/D1aE29TQdWILixJTAl5isgLzJyZUOEnqrefGvBQ9g
+	+zg0jQwLLnjnsCMzkjho6mjwi1Q7I3ERQVRnebKf9eslmNstr9apYy5yfz6BKzHGxBk3yC+Boyvde
+	FP62KNGQ==;
+Received: from localhost ([::1] helo=bombadil.infradead.org)
+	by bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux))
+	id 1uE6qC-00000007Glw-1vse;
+	Sun, 11 May 2025 13:35:40 +0000
+Received: from mail-ej1-x630.google.com ([2a00:1450:4864:20::630])
+	by bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux))
+	id 1uE6mD-00000007GP8-397T
+	for linux-arm-kernel@lists.infradead.org;
+	Sun, 11 May 2025 13:31:34 +0000
+Received: by mail-ej1-x630.google.com with SMTP id
+ a640c23a62f3a-ad1f6aa2f84so764633466b.0
+        for <linux-arm-kernel@lists.infradead.org>;
+ Sun, 11 May 2025 06:31:33 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20230601; t=1746970292; x=1747575092;
+ darn=lists.infradead.org;
+        h=cc:to:in-reply-to:references:message-id:content-transfer-encoding
+         :mime-version:subject:date:from:from:to:cc:subject:date:message-id
+         :reply-to;
+        bh=n9RYlne5nhTN7kCu5Yc7zW4CF0YUJUWg2clQo/viA0M=;
+        b=mK6aKMspWjttCQGv7A/DF5F1n7JFLuDEaCeCKlEp4FrClZQD6JhAlON6yEPPTc86q2
+         XnRAAh8tIk3Gu/QyNYXIsrlBeqtv5b+sxUxV+ebyFg0AaMi+tbhf8koryKoVPDMQljmm
+         i/Rv5GrycEwvnGMNsTHc+xLCwkjAy15KoLGdsfc+Uw3HrPmX+/8UFaVCmxltLgEprwVA
+         drnzRzYh3IIFjsPYJIrp75cIMMXIHwm2IqKiGuzMaDeCsB3iA/En8PHWr2trxMV7K98g
+         442ZOjY0CqX1mAIKQLXmN7X3fCbOHinxxy7HefUe2YNclBf6UHr3pT2i9UBsalEpUWUl
+         OQ7A==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20230601; t=1746970292; x=1747575092;
+        h=cc:to:in-reply-to:references:message-id:content-transfer-encoding
+         :mime-version:subject:date:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=n9RYlne5nhTN7kCu5Yc7zW4CF0YUJUWg2clQo/viA0M=;
+        b=HSWiBJsVViBeM5B5hMn4oUOZ7JTd6/O5/rjNuDl1Q//i4aFGGSy0L11zacjYVSLegk
+         2j9UiS7yLaVSlnNJle+YrtIy/kbCayoNUrYXtU5v9MvYAHjS0WMYijekCDQ9+lDLpXwg
+         kpERQ/Tu1Fmqb+8Yv/XycWLCyTPR0XGXxVvGiAPs1KnXsuj71MK7/HXof0p3IDqS444Q
+         dBuRDx1xby4/806P/EPvdr4Xj0lVF3tkimKtaPpBdXp+kkJ8xyYlMhLHAUX16F8Xktqs
+         yuzG1OASvIocfiEiluOxqrM6727wJhtt8qiBxCiI/UBaEr5bUkIBvmvktYSVy+/N4Itf
+         +qAw==
+X-Forwarded-Encrypted: i=1;
+ AJvYcCWF5SWWguUIUPp10Yp8M+dIc/7999B/vb7xwMluPb/Vj9FZyJ4hnhDgLC60CD9icfYXYWwLlHN06vKw5onkKXF5@lists.infradead.org
+X-Gm-Message-State: AOJu0Yx7y5pv/+Mt1FmIK+MTvi1kVFAvXtKteYPDneNKNfNZuwqrLoNt
+	F6DpKLyTyp8r/NQFiROomu/JLI5qMM4JRr5VwmbDeYC0dWKD4xH1
+X-Gm-Gg: ASbGncttO+Rf69HYuAf22AOp+cMso2pjn2/z/ZJhaxvqOUUqzypHmtdf5RV1S1/NJt+
+	2U8XzEy/JHeASbx9scc+3q0mJPtPNp8qCQpF+0zPaU8cbrfcsiggtSVfMhZP6sxqoI2iJtnMdLF
+	JVZhFcynNHOqZYLBh8pWdnToMBYILJM7VhgFcJZIeDPaGbC5JDSKus+OUR31/TKl/K/+83r309I
+	dYCCeBcJgLPA+Z5pDDHhFh/tjag+5ID+tTI3hH7IrEjz0LCb3DFL0QEsrwm9yQn4xUtQ9ms+KST
+	4DF3TYm4r0/Uqf8zWSPTbC4CL69YtYYBDCt22gKAW+PPDTQ4UBcDfIwI7MxiOOT2rnjfzWNtD+1
+	6uO29
+X-Google-Smtp-Source: 
+ AGHT+IFAmDDIIuhS51ef1EGvEQpU//VoeH0fQBhRPIfrKUiYydYis8s+qNymb53gRE7q67J/kVk0HA==
+X-Received: by 2002:a17:907:94d5:b0:acb:3acd:2845 with SMTP id
+ a640c23a62f3a-ad1fccfced9mr1181053766b.25.1746970291841;
+        Sun, 11 May 2025 06:31:31 -0700 (PDT)
+Received: from [192.168.0.253] (5D59A51C.catv.pool.telekom.hu. [93.89.165.28])
+        by smtp.googlemail.com with ESMTPSA id
+ a640c23a62f3a-ad2197bd398sm466765366b.152.2025.05.11.06.31.30
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Sun, 11 May 2025 06:31:31 -0700 (PDT)
+From: Gabor Juhos <j4g8y7@gmail.com>
+Date: Sun, 11 May 2025 15:31:05 +0200
+Subject: [PATCH 1/3] i2c: add init_recovery() callback
+MIME-Version: 1.0
+Message-Id: 
+ <20250511-i2c-pxa-fix-i2c-communication-v1-1-e9097d09a015@gmail.com>
+References: 
+ <20250511-i2c-pxa-fix-i2c-communication-v1-0-e9097d09a015@gmail.com>
+In-Reply-To: 
+ <20250511-i2c-pxa-fix-i2c-communication-v1-0-e9097d09a015@gmail.com>
+To: Wolfram Sang <wsa@kernel.org>, Andi Shyti <andi.shyti@kernel.org>,
+ Russell King <rmk+kernel@armlinux.org.uk>, Andrew Lunn <andrew@lunn.ch>
+Cc: Robert Marko <robert.marko@sartura.hr>,
+ Linus Walleij <linus.walleij@linaro.org>,
+ Russell King <rmk+kernel@armlinux.org.uk>, linux-i2c@vger.kernel.org,
+ linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org,
+ Gabor Juhos <j4g8y7@gmail.com>, Imre Kaloz <kaloz@openwrt.org>,
+ stable@vger.kernel.org
+X-Mailer: b4 0.14.2
+X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 
+X-CRM114-CacheID: sfid-20250511_063133_790603_F3EAC078 
+X-CRM114-Status: GOOD (  20.27  )
+X-BeenThere: linux-arm-kernel@lists.infradead.org
+X-Mailman-Version: 2.1.34
+Precedence: list
+List-Id: <linux-arm-kernel.lists.infradead.org>
+List-Unsubscribe: 
+ <http://lists.infradead.org/mailman/options/linux-arm-kernel>,
+ <mailto:linux-arm-kernel-request@lists.infradead.org?subject=unsubscribe>
+List-Archive: <http://lists.infradead.org/pipermail/linux-arm-kernel/>
+List-Post: <mailto:linux-arm-kernel@lists.infradead.org>
+List-Help: <mailto:linux-arm-kernel-request@lists.infradead.org?subject=help>
+List-Subscribe: 
+ <http://lists.infradead.org/mailman/listinfo/linux-arm-kernel>,
+ <mailto:linux-arm-kernel-request@lists.infradead.org?subject=subscribe>
+Sender: "linux-arm-kernel" <linux-arm-kernel-bounces@lists.infradead.org>
+Errors-To: 
+ linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org
+
+Add a new init_recovery() callback to struct 'i2c_bus_recovery_info'
+and modify the i2c_init_recovery() function to call that if specified
+instead of the generic i2c_gpio_init_recovery() function.
+
+This allows controller drivers to skip calling the generic code by
+implementing a dummy callback function, or alternatively to run a
+fine tuned custom implementation.
+
+This is needed for the 'i2c-pxa' driver in order to be able to fix
+a long standing bug for which the fix will be implemented in a
+followup patch.
+
+Cc: stable@vger.kernel.org # 6.3+
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+---
+ drivers/i2c/i2c-core-base.c | 8 +++++++-
+ include/linux/i2c.h         | 4 ++++
+ 2 files changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/i2c/i2c-core-base.c
++++ b/drivers/i2c/i2c-core-base.c
+@@ -427,12 +427,18 @@ static int i2c_init_recovery(struct i2c_
+ 	struct i2c_bus_recovery_info *bri = adap->bus_recovery_info;
+ 	bool is_error_level = true;
+ 	char *err_str;
++	int ret;
+ 
+ 	if (!bri)
+ 		return 0;
+ 
+-	if (i2c_gpio_init_recovery(adap) == -EPROBE_DEFER)
++	if (bri->init_recovery) {
++		ret = bri->init_recovery(adap);
++		if (ret)
++			return ret;
++	} else if (i2c_gpio_init_recovery(adap) == -EPROBE_DEFER) {
+ 		return -EPROBE_DEFER;
++	}
+ 
+ 	if (!bri->recover_bus) {
+ 		err_str = "no suitable method provided";
+--- a/include/linux/i2c.h
++++ b/include/linux/i2c.h
+@@ -622,6 +622,9 @@ struct i2c_timings {
+  *	for generic GPIO recovery.
+  * @get_bus_free: Returns the bus free state as seen from the IP core in case it
+  *	has a more complex internal logic than just reading SDA. Optional.
++ * @init_recovery: If specified, it will be called instead of the generic GPIO
++ *	recovery initialization code. Platform may use a dummy callback to skip
++ *	calling the generic code, or it may use a custom implementation.
+  * @prepare_recovery: This will be called before starting recovery. Platform may
+  *	configure padmux here for SDA/SCL line or something else they want.
+  * @unprepare_recovery: This will be called after completing recovery. Platform
+@@ -646,6 +649,7 @@ struct i2c_bus_recovery_info {
+ 	void (*set_sda)(struct i2c_adapter *adap, int val);
+ 	int (*get_bus_free)(struct i2c_adapter *adap);
+ 
++	int (*init_recovery)(struct i2c_adapter *adap);
+ 	void (*prepare_recovery)(struct i2c_adapter *adap);
+ 	void (*unprepare_recovery)(struct i2c_adapter *adap);
+ 
diff --git a/target/linux/mvebu/patches-6.6/830-02-i2c-pxa-prevent-calling-of-the-generic-recovery-init-code.patch b/target/linux/mvebu/patches-6.6/830-02-i2c-pxa-prevent-calling-of-the-generic-recovery-init-code.patch
new file mode 100644
index 00000000000000..a05cedcefea82c
--- /dev/null
+++ b/target/linux/mvebu/patches-6.6/830-02-i2c-pxa-prevent-calling-of-the-generic-recovery-init-code.patch
@@ -0,0 +1,224 @@
+From patchwork Sun May 11 13:31:06 2025
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Gabor Juhos <j4g8y7@gmail.com>
+X-Patchwork-Id: 14084056
+Return-Path: 
+ <linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from bombadil.infradead.org (bombadil.infradead.org
+ [198.137.202.133])
+	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
+	(No client certificate requested)
+	by smtp.lore.kernel.org (Postfix) with ESMTPS id 72E7DC3ABC3
+	for <linux-arm-kernel@archiver.kernel.org>;
+ Sun, 11 May 2025 13:37:50 +0000 (UTC)
+DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
+	d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help
+	:List-Post:List-Archive:List-Unsubscribe:List-Id:Cc:To:In-Reply-To:References
+	:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:
+	From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:
+	Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner;
+	bh=BySnXAIGhp18eRP0sg1mjpdXdHwBsus0rtjMi26U9uM=; b=ba0yGs/0cSs2cep9T3wjo3iDxy
+	VSaQu2j7YGuiAMJt8ERY5OVL7YiPC/6+MqGcLqkrGunZq/TEjXRGX9ztKqyko6KY9fLbiH1wXYBjK
+	/9yxbEyt9bPrIw/r64uaUOdRzZMF0i2oBn53RgZJJFaD4ou1E28BMc22AuVGshj99Dlz63ncr/Lz7
+	M3/ptMOWGRp0SrImYRUdvnWj+LKyb4zqRFEYIQuq9WzyhhNuDZDaHFpdJn4go/eoS4kUvTFfixpwV
+	FevQupqdOn62R3ull5YYdI6BFQVL6dISjD34mjoNXJABSjuXmq8FRWuX/V3rPrvnVIflxOmzSrKrF
+	8rdYY/fg==;
+Received: from localhost ([::1] helo=bombadil.infradead.org)
+	by bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux))
+	id 1uE6sA-00000007GuC-0j29;
+	Sun, 11 May 2025 13:37:42 +0000
+Received: from mail-ej1-x636.google.com ([2a00:1450:4864:20::636])
+	by bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux))
+	id 1uE6mF-00000007GPb-1uOE
+	for linux-arm-kernel@lists.infradead.org;
+	Sun, 11 May 2025 13:31:36 +0000
+Received: by mail-ej1-x636.google.com with SMTP id
+ a640c23a62f3a-acae7e7587dso539429266b.2
+        for <linux-arm-kernel@lists.infradead.org>;
+ Sun, 11 May 2025 06:31:35 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20230601; t=1746970294; x=1747575094;
+ darn=lists.infradead.org;
+        h=cc:to:in-reply-to:references:message-id:content-transfer-encoding
+         :mime-version:subject:date:from:from:to:cc:subject:date:message-id
+         :reply-to;
+        bh=BySnXAIGhp18eRP0sg1mjpdXdHwBsus0rtjMi26U9uM=;
+        b=QtIYufKg61b066knR9OpyawErNmkYyoP/2lIkHhyGY7qtGXkc1jJmC0TpPyhp0WGlm
+         xWP3K/PG23VcjEuGj/880thPietuKQuTF029WPfm+yrQ3uHLMzkHqyOiMYyiBR9N0Zjw
+         NICgywX4iqVHVBnXZTiBA7sRSjQqteatDPTGbKgZxpIHpg4ZJtfXZcCE8RiKVVgZCWsq
+         JgTJuTO/4J0cq5TWVOIGLrt0XOslaMmuISPbUDdArr5yKfGZqu51i747A0o0RBdEuH9Y
+         UPI8/GExcWWa+62KCVEwB9OmCZR81ieb8To/XdZO8hIQAlExOzKa3OOPCkS0PF0M9BBa
+         d++Q==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20230601; t=1746970294; x=1747575094;
+        h=cc:to:in-reply-to:references:message-id:content-transfer-encoding
+         :mime-version:subject:date:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=BySnXAIGhp18eRP0sg1mjpdXdHwBsus0rtjMi26U9uM=;
+        b=A+LfIVmyzogyr2akFoGR3PIbjd8E/TVXGlur91KBF7h2W8msMTeMyv0PDVjqEBxWFI
+         cqNLira3TWf9soXrRBGaJVB111/r5woARoN4aO5otCDrh3o5U2gJ5/eZLGbcX49TqJG5
+         rbI1Eq0GGXFdidQ4T5CMLtooa6B5pg7j+o2gcyG/vQlHr6MbG4/2sIDPX0JbL08xibWC
+         5LqP933W+yopGIbnp3YZ9pybbvOUA9x4cYkUm1Of3idmkTN0xUh8kmUWz7FJCH4R/PAN
+         5CA/vn8q1myUvXisU0oAbC9y/WrlExPfvguXjru1LTx9AdPaC9+D3Qxmh2Raz9b4NrKl
+         ZlVw==
+X-Forwarded-Encrypted: i=1;
+ AJvYcCWMm/Er5t6Xp05DMDNak7mbsqx8YZmOrqz9Y39eovLKPkbqcMhQwOzxqxCY8ZfQtETNpZ8X9NptEow+bBHo+z3t@lists.infradead.org
+X-Gm-Message-State: AOJu0YwBTrjBcryZjqJBq66bcSYfV2AWsDAqAfMinxG8gRUJjpKq8RXn
+	kKSKTp2XvMObVTWx7cEMM5BBPWl7LfLwBkjVIusbgScQ8qW8YA9H
+X-Gm-Gg: ASbGnctKtEUhBLJdOfPb7cKwM8a1ZTe5+8zPX9TaLdomZybHHeteF9o/ZyUNbunUsSK
+	fuMy3pPFmYcC4TZtPqfZPdpagbDpOb2R/9xbSTMd1TKDDj4vFnkTIzQHA9E1ZxX44Nw6JkxA0up
+	S94PBow9mEb3tkHLN9hbNe7W8ksyf7RZ25IGC4FYj/wEGQsMy2VidJsfG4bIeImZ8zj8ufUCNby
+	7jIjmP1taNt5U8omPEWhFuRdJfiPqIXx85tIsGVFwG7VSr/JW8LwxBCJLGhWLUZhxYqV4cEfSRC
+	zYKj2qkuRfx5AxzN+JGtfcxYPijsy/rI51OnjOv2CQRPuE6rESamNJiR7pmnDgvHSRm5nps5chp
+	/HVXU
+X-Google-Smtp-Source: 
+ AGHT+IG8Y/7VNg8lhY275mIfLbq8EaG9jCRvvK1wX7rlbuoMvEUYYC3k7sZOxh3RPmKhAB94Kfvlwg==
+X-Received: by 2002:a17:907:7b04:b0:ad1:fab8:88ab with SMTP id
+ a640c23a62f3a-ad219085c07mr897192766b.29.1746970293535;
+        Sun, 11 May 2025 06:31:33 -0700 (PDT)
+Received: from [192.168.0.253] (5D59A51C.catv.pool.telekom.hu. [93.89.165.28])
+        by smtp.googlemail.com with ESMTPSA id
+ a640c23a62f3a-ad2197bd398sm466765366b.152.2025.05.11.06.31.32
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Sun, 11 May 2025 06:31:33 -0700 (PDT)
+From: Gabor Juhos <j4g8y7@gmail.com>
+Date: Sun, 11 May 2025 15:31:06 +0200
+Subject: [PATCH 2/3] i2c: pxa: prevent calling of the generic recovery init
+ code
+MIME-Version: 1.0
+Message-Id: 
+ <20250511-i2c-pxa-fix-i2c-communication-v1-2-e9097d09a015@gmail.com>
+References: 
+ <20250511-i2c-pxa-fix-i2c-communication-v1-0-e9097d09a015@gmail.com>
+In-Reply-To: 
+ <20250511-i2c-pxa-fix-i2c-communication-v1-0-e9097d09a015@gmail.com>
+To: Wolfram Sang <wsa@kernel.org>, Andi Shyti <andi.shyti@kernel.org>,
+ Russell King <rmk+kernel@armlinux.org.uk>, Andrew Lunn <andrew@lunn.ch>
+Cc: Robert Marko <robert.marko@sartura.hr>,
+ Linus Walleij <linus.walleij@linaro.org>,
+ Russell King <rmk+kernel@armlinux.org.uk>, linux-i2c@vger.kernel.org,
+ linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org,
+ Gabor Juhos <j4g8y7@gmail.com>, Imre Kaloz <kaloz@openwrt.org>,
+ stable@vger.kernel.org
+X-Mailer: b4 0.14.2
+X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 
+X-CRM114-CacheID: sfid-20250511_063135_499888_294068DC 
+X-CRM114-Status: GOOD (  21.30  )
+X-BeenThere: linux-arm-kernel@lists.infradead.org
+X-Mailman-Version: 2.1.34
+Precedence: list
+List-Id: <linux-arm-kernel.lists.infradead.org>
+List-Unsubscribe: 
+ <http://lists.infradead.org/mailman/options/linux-arm-kernel>,
+ <mailto:linux-arm-kernel-request@lists.infradead.org?subject=unsubscribe>
+List-Archive: <http://lists.infradead.org/pipermail/linux-arm-kernel/>
+List-Post: <mailto:linux-arm-kernel@lists.infradead.org>
+List-Help: <mailto:linux-arm-kernel-request@lists.infradead.org?subject=help>
+List-Subscribe: 
+ <http://lists.infradead.org/mailman/listinfo/linux-arm-kernel>,
+ <mailto:linux-arm-kernel-request@lists.infradead.org?subject=subscribe>
+Sender: "linux-arm-kernel" <linux-arm-kernel-bounces@lists.infradead.org>
+Errors-To: 
+ linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org
+
+The I2C communication is completely broken on the Armada 3700 platform
+since commit 0b01392c18b9 ("i2c: pxa: move to generic GPIO recovery").
+
+For example, on the Methode uDPU board, probing of the two onboard
+temperature sensors fails ...
+
+  [    7.271713] i2c i2c-0: using pinctrl states for GPIO recovery
+  [    7.277503] i2c i2c-0:  PXA I2C adapter
+  [    7.282199] i2c i2c-1: using pinctrl states for GPIO recovery
+  [    7.288241] i2c i2c-1:  PXA I2C adapter
+  [    7.292947] sfp sfp-eth1: Host maximum power 3.0W
+  [    7.299614] sfp sfp-eth0: Host maximum power 3.0W
+  [    7.308178] lm75 1-0048: supply vs not found, using dummy regulator
+  [   32.489631] lm75 1-0048: probe with driver lm75 failed with error -121
+  [   32.496833] lm75 1-0049: supply vs not found, using dummy regulator
+  [   82.890614] lm75 1-0049: probe with driver lm75 failed with error -121
+
+... and accessing the plugged-in SFP modules also does not work:
+
+  [  511.298537] sfp sfp-eth1: please wait, module slow to respond
+  [  536.488530] sfp sfp-eth0: please wait, module slow to respond
+  ...
+  [ 1065.688536] sfp sfp-eth1: failed to read EEPROM: -EREMOTEIO
+  [ 1090.888532] sfp sfp-eth0: failed to read EEPROM: -EREMOTEIO
+
+After a discussion [1], there was an attempt to fix the problem by
+reverting the offending change by commit 7b211c767121 ("Revert "i2c:
+pxa: move to generic GPIO recovery""), but that only helped to fix
+the issue in the 6.1.y stable tree. The reason behind the partial succes
+is that there was another change in commit 20cb3fce4d60 ("i2c: Set i2c
+pinctrl recovery info from it's device pinctrl") in the 6.3-rc1 cycle
+which broke things further.
+
+The cause of the problem is the same in case of both offending commits
+mentioned above. Namely, the I2C core code changes the pinctrl state to
+GPIO while running the recovery initialization code. Although the PXA
+specific initialization also does this, but the key difference is that
+it happens before the conrtoller is getting enabled in i2c_pxa_reset(),
+whereas in the case of the generic initialization it happens after that.
+
+To resolve the problem, provide an empty init_recovery() callback
+function thus preventing the I2C core to call the generic recovery
+initialization code.
+
+As the result this change restores the original behaviour, which in
+turn makes the I2C communication to work again as it can be seen from
+the following log:
+
+  [    7.305277] i2c i2c-0:  PXA I2C adapter
+  [    7.310198] i2c i2c-1:  PXA I2C adapter
+  [    7.315012] sfp sfp-eth1: Host maximum power 3.0W
+  [    7.324061] lm75 1-0048: supply vs not found, using dummy regulator
+  [    7.331738] sfp sfp-eth0: Host maximum power 3.0W
+  [    7.337000] hwmon hwmon0: temp1_input not attached to any thermal zone
+  [    7.343593] lm75 1-0048: hwmon0: sensor 'tmp75c'
+  [    7.348526] lm75 1-0049: supply vs not found, using dummy regulator
+  [    7.356858] hwmon hwmon1: temp1_input not attached to any thermal zone
+  [    7.363463] lm75 1-0049: hwmon1: sensor 'tmp75c'
+  ...
+  [    7.730315] sfp sfp-eth1: module Mikrotik         S-RJ01           rev 1.0  sn 61B103C55C58     dc 201022
+  [    7.840318] sfp sfp-eth0: module MENTECHOPTO      POS22-LDCC-KR    rev 1.0  sn MNC208U90009     dc 200828
+  [    7.850083] mvneta d0030000.ethernet eth0: unsupported SFP module: no common interface modes
+  [    7.990335] hwmon hwmon2: temp1_input not attached to any thermal zone
+
+[1] https://lore.kernel.org/r/20230926160255.330417-1-robert.marko@sartura.hr
+
+Cc: stable@vger.kernel.org # 6.3+
+Fixes: 20cb3fce4d60 ("i2c: Set i2c pinctrl recovery info from it's device pinctrl")
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+---
+ drivers/i2c/busses/i2c-pxa.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-pxa.c
++++ b/drivers/i2c/busses/i2c-pxa.c
+@@ -1331,6 +1331,12 @@ static void i2c_pxa_unprepare_recovery(s
+ 	i2c_pxa_enable(i2c);
+ }
+ 
++static int i2c_pxa_init_recovery_cb(struct i2c_adapter *adap)
++{
++	/* We have initialized everything already, so nothing to do here. */
++	return 0;
++}
++
+ static int i2c_pxa_init_recovery(struct pxa_i2c *i2c)
+ {
+ 	struct i2c_bus_recovery_info *bri = &i2c->recovery;
+@@ -1399,6 +1405,7 @@ static int i2c_pxa_init_recovery(struct
+ 		return 0;
+ 	}
+ 
++	bri->init_recovery = i2c_pxa_init_recovery_cb;
+ 	bri->prepare_recovery = i2c_pxa_prepare_recovery;
+ 	bri->unprepare_recovery = i2c_pxa_unprepare_recovery;
+ 	bri->recover_bus = i2c_generic_scl_recovery;
diff --git a/target/linux/mvebu/patches-6.6/830-03-i2c-pxa-handle-Early-Bus-Busy-condition-on-Armada-3700.patch b/target/linux/mvebu/patches-6.6/830-03-i2c-pxa-handle-Early-Bus-Busy-condition-on-Armada-3700.patch
new file mode 100644
index 00000000000000..52ccb8cf08cd7a
--- /dev/null
+++ b/target/linux/mvebu/patches-6.6/830-03-i2c-pxa-handle-Early-Bus-Busy-condition-on-Armada-3700.patch
@@ -0,0 +1,309 @@
+From patchwork Sun May 11 13:31:07 2025
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+X-Patchwork-Submitter: Gabor Juhos <j4g8y7@gmail.com>
+X-Patchwork-Id: 14084057
+Return-Path: 
+ <linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org>
+X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
+	aws-us-west-2-korg-lkml-1.web.codeaurora.org
+Received: from bombadil.infradead.org (bombadil.infradead.org
+ [198.137.202.133])
+	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
+	(No client certificate requested)
+	by smtp.lore.kernel.org (Postfix) with ESMTPS id E1323C3ABC3
+	for <linux-arm-kernel@archiver.kernel.org>;
+ Sun, 11 May 2025 13:39:50 +0000 (UTC)
+DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;
+	d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help
+	:List-Post:List-Archive:List-Unsubscribe:List-Id:Cc:To:In-Reply-To:References
+	:Message-Id:Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:
+	From:Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:
+	Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner;
+	bh=jCnitIQrLGML0v/ZGaz7m1EqKZaS5okX2gqREoZgqFA=; b=gjUPiYgZ9tzalLC8hdQSBahsEr
+	yHwsfVsfhm/onN8EySOnZ9iefbvCDb/y94s1ll7+f7UeDZ3epWr0Kl1WPgPVKwCa7AIYumKWi/l4S
+	rNqCfOmyVGO0CspTKlxvV/ZHk+jAJqKqHmd/QtVxJkMi4a9d1J8BMHWdltfYPvpkJkaKxx9WINZ5v
+	BftwJv2+35b3ZWGRWYXmCBFUXaV/w6I0+dE51I25k4NZcTMRbR1sGYEXTm5Eu2KBtJ/UbhiKKCk0b
+	+BTg/BJ/O7lSKl/W3DHnImYv6s65FMGxgHCaKZlN/IWCWLanqi2hg3hmGlDqyZUvezUrcuYEed2et
+	w6FrGCGg==;
+Received: from localhost ([::1] helo=bombadil.infradead.org)
+	by bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux))
+	id 1uE6u7-00000007H4F-41sI;
+	Sun, 11 May 2025 13:39:43 +0000
+Received: from mail-ej1-x62e.google.com ([2a00:1450:4864:20::62e])
+	by bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux))
+	id 1uE6mG-00000007GQ2-3M7w
+	for linux-arm-kernel@lists.infradead.org;
+	Sun, 11 May 2025 13:31:37 +0000
+Received: by mail-ej1-x62e.google.com with SMTP id
+ a640c23a62f3a-ad1a87d93f7so576360566b.0
+        for <linux-arm-kernel@lists.infradead.org>;
+ Sun, 11 May 2025 06:31:36 -0700 (PDT)
+DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=gmail.com; s=20230601; t=1746970295; x=1747575095;
+ darn=lists.infradead.org;
+        h=cc:to:in-reply-to:references:message-id:content-transfer-encoding
+         :mime-version:subject:date:from:from:to:cc:subject:date:message-id
+         :reply-to;
+        bh=jCnitIQrLGML0v/ZGaz7m1EqKZaS5okX2gqREoZgqFA=;
+        b=dFmhAe55mI0ZYgTbA9z06jAcGpibU1yIvZWl8vsEWd0Cow+yYkQlcsnlJcoq22vUt+
+         An87/vI28iqdwgYZpu+vabyC6ytUUqI5IuqTOlv/QtLak3Oi6cbHjoebb9cVfGhTpO16
+         gN8BLLH5Lf9shCAy3lLQahAf3jiE41hB3YKxIusuBnm+DIMYVGMJID5Pt72YgU322uXW
+         hnMLbX75rnBu5DTGM12UT9+nOkBYjITOdnfEA+o3IVlzUEQRr/G7s9RNKTKnsjJDwaZb
+         91UdhJBE/yz2fiFrtN6PGr1B90kJd+GAxRjrbQ8UunMu6C4ggE6aRazKcsQEZIWLa6tR
+         n/Vg==
+X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
+        d=1e100.net; s=20230601; t=1746970295; x=1747575095;
+        h=cc:to:in-reply-to:references:message-id:content-transfer-encoding
+         :mime-version:subject:date:from:x-gm-message-state:from:to:cc
+         :subject:date:message-id:reply-to;
+        bh=jCnitIQrLGML0v/ZGaz7m1EqKZaS5okX2gqREoZgqFA=;
+        b=tlFtjTi8qCbMBXjF1lESzpnVH51JUuhJV5lirRh7dyHdWcVtBgKdnrbGpR+ZDHFvvV
+         1FJUR377ZyrZPwleAZ8bfUcjMx1NSDhxGsHI+05Mpt7LzRZCCUE/nuTHROytYhalDR35
+         yh8YprIJwMhZ9zFNNXrZ/GQCPbRMA0fkOJYWCfMRPsf+VGHsDniGzF9Dbsy3aq0hG+mw
+         5r85WCALVE55cSW22kla9QPeOxpX6nheglHKz2svFKgo+nI9xXgcR2F9vsSah5DBTxkQ
+         WK1fEkdtF+6If4W/u3cZ1kQTbkrifLbpV8i+z6VqFq+iRZuf9eZjyyuMXP53A7PQGpW3
+         BKKA==
+X-Forwarded-Encrypted: i=1;
+ AJvYcCWtVH3IlKfQOiuwxLM94ic5Bi0XTfGdTLWK5BWhh9b026VHto4M4zjf8wBmIUmekjUFrgWvBcW3eJkv9VuD0NNu@lists.infradead.org
+X-Gm-Message-State: AOJu0YxUrhwcNLQkyGCiTZ3Ci5GaLENJhrPiMNwOQ2HqRWQ5fFYTksDJ
+	6eb+myA0GGrJOmcEortiBND+ipH4vXcxwtKOVyNjgBBJMq27NJBTQ16Asw==
+X-Gm-Gg: ASbGncu1guGFlZm8KpI1qJ3LeFM8WO7ZvfanWSzK7lzUZES0sLxvvjBNy8SgeycdGUF
+	QifE6Z+xBPK9i0m0CRfzWuNm9a/dr/W14EAzBiSWq5pOW0fbH1rGo/FFbaUZ8T7OroQ0wipdZ9J
+	tIZJz+dbSRk4kRsYhhm4cJZh4GfKL8me6+8NM/db/a0oKAE0VMhHLmqDw0BFjgpwdWO4YnaUBLt
+	MU5Pu+S3TKwVV7SHRma2c7662QZ2pxXIngJdGW2qnrr1TejUMaK39IRBPm7sgzBCntS8fd9uVdb
+	35NbstsZrboDcHBnDhFroXwe5QWwncAo1aJm/DVM39fE5OCOqNDp7iz6XZbPE/fzVdEDg00L9fR
+	x8yAy
+X-Google-Smtp-Source: 
+ AGHT+IFtWSfALiUVVnpFFz7ImelE+nmATZJYkY40gYG/szbhM9XPyGAl4heVD8RQkSCE7sXqGFzn6Q==
+X-Received: by 2002:a17:907:d30e:b0:ad2:4cad:9824 with SMTP id
+ a640c23a62f3a-ad24cad9bd2mr198358366b.28.1746970294838;
+        Sun, 11 May 2025 06:31:34 -0700 (PDT)
+Received: from [192.168.0.253] (5D59A51C.catv.pool.telekom.hu. [93.89.165.28])
+        by smtp.googlemail.com with ESMTPSA id
+ a640c23a62f3a-ad2197bd398sm466765366b.152.2025.05.11.06.31.33
+        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
+        Sun, 11 May 2025 06:31:34 -0700 (PDT)
+From: Gabor Juhos <j4g8y7@gmail.com>
+Date: Sun, 11 May 2025 15:31:07 +0200
+Subject: [PATCH 3/3] i2c: pxa: handle 'Early Bus Busy' condition on Armada
+ 3700
+MIME-Version: 1.0
+Message-Id: 
+ <20250511-i2c-pxa-fix-i2c-communication-v1-3-e9097d09a015@gmail.com>
+References: 
+ <20250511-i2c-pxa-fix-i2c-communication-v1-0-e9097d09a015@gmail.com>
+In-Reply-To: 
+ <20250511-i2c-pxa-fix-i2c-communication-v1-0-e9097d09a015@gmail.com>
+To: Wolfram Sang <wsa@kernel.org>, Andi Shyti <andi.shyti@kernel.org>,
+ Russell King <rmk+kernel@armlinux.org.uk>, Andrew Lunn <andrew@lunn.ch>
+Cc: Robert Marko <robert.marko@sartura.hr>,
+ Linus Walleij <linus.walleij@linaro.org>,
+ Russell King <rmk+kernel@armlinux.org.uk>, linux-i2c@vger.kernel.org,
+ linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org,
+ Gabor Juhos <j4g8y7@gmail.com>, Imre Kaloz <kaloz@openwrt.org>,
+ stable@vger.kernel.org
+X-Mailer: b4 0.14.2
+X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 
+X-CRM114-CacheID: sfid-20250511_063136_845554_2BF89522 
+X-CRM114-Status: GOOD (  32.59  )
+X-BeenThere: linux-arm-kernel@lists.infradead.org
+X-Mailman-Version: 2.1.34
+Precedence: list
+List-Id: <linux-arm-kernel.lists.infradead.org>
+List-Unsubscribe: 
+ <http://lists.infradead.org/mailman/options/linux-arm-kernel>,
+ <mailto:linux-arm-kernel-request@lists.infradead.org?subject=unsubscribe>
+List-Archive: <http://lists.infradead.org/pipermail/linux-arm-kernel/>
+List-Post: <mailto:linux-arm-kernel@lists.infradead.org>
+List-Help: <mailto:linux-arm-kernel-request@lists.infradead.org?subject=help>
+List-Subscribe: 
+ <http://lists.infradead.org/mailman/listinfo/linux-arm-kernel>,
+ <mailto:linux-arm-kernel-request@lists.infradead.org?subject=subscribe>
+Sender: "linux-arm-kernel" <linux-arm-kernel-bounces@lists.infradead.org>
+Errors-To: 
+ linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org
+
+Under some circumstances I2C recovery fails on Armada 3700. At least
+on the Methode uDPU board, removing and replugging an SFP module fails
+often, like this:
+
+  [   36.953127] sfp sfp-eth1: module removed
+  [   38.468549] i2c i2c-1: i2c_pxa: timeout waiting for bus free
+  [   38.486960] sfp sfp-eth1: module MENTECHOPTO      POS22-LDCC-KR    rev 1.0  sn MNC208U90009     dc 200828
+  [   38.496867] mvneta d0040000.ethernet eth1: unsupported SFP module: no common interface modes
+  [   38.521448] hwmon hwmon2: temp1_input not attached to any thermal zone
+  [   39.249196] sfp sfp-eth1: module removed
+  ...
+  [  292.568799] sfp sfp-eth1: please wait, module slow to respond
+  ...
+  [  625.208814] sfp sfp-eth1: failed to read EEPROM: -EREMOTEIO
+
+Note that the 'unsupported SFP module' messages are not relevant. The
+module is used only for testing the I2C recovery funcionality, because
+the error can be triggered easily with this specific one.
+
+Enabling debug in the i2c-pxa driver reveals the following:
+
+  [   82.034678] sfp sfp-eth1: module removed
+  [   90.008654] i2c i2c-1: slave_0x50 error: timeout with active message
+  [   90.015112] i2c i2c-1: msg_num: 2 msg_idx: 0 msg_ptr: 0
+  [   90.020464] i2c i2c-1: IBMR: 00000003 IDBR: 000000a0 ICR: 000007e0 ISR: 00000802
+  [   90.027906] i2c i2c-1: log:
+  [   90.030787]
+
+This continues until the retries are exhausted ...
+
+  [  110.192489] i2c i2c-1: slave_0x50 error: exhausted retries
+  [  110.198012] i2c i2c-1: msg_num: 2 msg_idx: 0 msg_ptr: 0
+  [  110.203323] i2c i2c-1: IBMR: 00000003 IDBR: 000000a0 ICR: 000007e0 ISR: 00000802
+  [  110.210810] i2c i2c-1: log:
+  [  110.213633]
+
+... then the whole sequence starts again ...
+
+  [  115.368641] i2c i2c-1: slave_0x50 error: timeout with active message
+
+... while finally the SFP core gives up:
+
+  [  671.975258] sfp sfp-eth1: failed to read EEPROM: -EREMOTEIO
+
+When we analyze the log, it can be seen that bit 1 and 11 is set in the
+ISR (Interface Status Register). Bit 1 indicates the ACK/NACK status, but
+the purpose of bit 11 is not documented in the driver code unfortunately.
+
+The 'Functional Specification' document of the Armada 3700 SoCs family
+however says that this bit indicates an 'Early Bus Busy' condition. The
+document also notes that whenever this bit is set, it is not possible to
+initiate a transaction on the I2C bus. The observed behaviour corresponds
+to this statement.
+
+Unfortunately, I2C recovery does not help as it never runs in this
+special case. Although the driver checks the busyness of the bus at
+several places, but since it does not consider the A3700 specific bit
+in these checks it can't determine the actual status of the bus correctly
+which results in the errors above.
+
+In order to fix the problem, add a new member to struct 'i2c_pxa' to
+store a controller specific bitmask containing the bits indicating the
+busy status, and use that in the code while checking the actual status
+of the bus. This ensures that the correct status can be determined on
+the Armada 3700 based devices without causing functional changes on
+devices based on other SoCs.
+
+With the change applied, the driver detects the busy condition, and runs
+the recovery process:
+
+  [  742.617312] i2c i2c-1: state:i2c_pxa_wait_bus_not_busy:449: ISR=00000802, ICR=000007e0, IBMR=03
+  [  742.626099] i2c i2c-1: i2c_pxa: timeout waiting for bus free
+  [  742.631933] i2c i2c-1: recovery: resetting controller, ISR=0x00000802
+  [  742.638421] i2c i2c-1: recovery: IBMR 0x00000003 ISR 0x00000000
+
+This clears the EBB bit in the ISR register, so it makes it possible to
+initiate transactions on the I2C bus again.
+
+After this patch, the SFP module used for testing can be removed and
+replugged numerous times without causing the error described at the
+beginning. Previously, the error happened after a few such attempts.
+
+The patch has been tested also with the following kernel versions:
+5.10.237, 5.15.182, 6.1.138, 6.6.90, 6.12.28, 6.14.6. It improves
+recoverabilty on all of them.
+
+Cc: stable@vger.kernel.org # 5.8+
+Fixes: 7c9ec2c52518 ("i2c: pxa: implement generic i2c bus recovery")
+Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
+Signed-off-by: Imre Kaloz <kaloz@openwrt.org>
+---
+Note: the patch is included in this series for completeness however
+it can be applied independently from the preceding patches. On kernels
+6.3+, it restores I2C functionality even in itself because it recovers
+the controller from the bad state described in the previous patch.
+---
+ drivers/i2c/busses/i2c-pxa.c | 18 ++++++++++++------
+ 1 file changed, 12 insertions(+), 6 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-pxa.c
++++ b/drivers/i2c/busses/i2c-pxa.c
+@@ -70,6 +70,7 @@
+ #define ISR_GCAD	(1 << 8)	   /* general call address detected */
+ #define ISR_SAD		(1 << 9)	   /* slave address detected */
+ #define ISR_BED		(1 << 10)	   /* bus error no ACK/NAK */
++#define ISR_A3700_EBB	(1 << 11)	   /* early bus busy for armada 3700 */
+ 
+ #define ILCR_SLV_SHIFT		0
+ #define ILCR_SLV_MASK		(0x1FF << ILCR_SLV_SHIFT)
+@@ -262,6 +263,7 @@ struct pxa_i2c {
+ 	bool			highmode_enter;
+ 	u32			fm_mask;
+ 	u32			hs_mask;
++	u32			busy_mask;
+ 
+ 	struct i2c_bus_recovery_info recovery;
+ 	struct pinctrl		*pinctrl;
+@@ -428,7 +430,7 @@ static int i2c_pxa_wait_bus_not_busy(str
+ 
+ 	while (1) {
+ 		isr = readl(_ISR(i2c));
+-		if (!(isr & (ISR_IBB | ISR_UB)))
++		if (!(isr & i2c->busy_mask))
+ 			return 0;
+ 
+ 		if (isr & ISR_SAD)
+@@ -465,7 +467,7 @@ static int i2c_pxa_wait_master(struct px
+ 		 * quick check of the i2c lines themselves to ensure they've
+ 		 * gone high...
+ 		 */
+-		if ((readl(_ISR(i2c)) & (ISR_UB | ISR_IBB)) == 0 &&
++		if ((readl(_ISR(i2c)) & i2c->busy_mask) == 0 &&
+ 		    readl(_IBMR(i2c)) == (IBMR_SCLS | IBMR_SDAS)) {
+ 			if (i2c_debug > 0)
+ 				dev_dbg(&i2c->adap.dev, "%s: done\n", __func__);
+@@ -486,7 +488,7 @@ static int i2c_pxa_set_master(struct pxa
+ 	if (i2c_debug)
+ 		dev_dbg(&i2c->adap.dev, "setting to bus master\n");
+ 
+-	if ((readl(_ISR(i2c)) & (ISR_UB | ISR_IBB)) != 0) {
++	if ((readl(_ISR(i2c)) & i2c->busy_mask) != 0) {
+ 		dev_dbg(&i2c->adap.dev, "%s: unit is busy\n", __func__);
+ 		if (!i2c_pxa_wait_master(i2c)) {
+ 			dev_dbg(&i2c->adap.dev, "%s: error: unit busy\n", __func__);
+@@ -512,7 +514,7 @@ static int i2c_pxa_wait_slave(struct pxa
+ 			dev_dbg(&i2c->adap.dev, "%s: %ld: ISR=%08x, ICR=%08x, IBMR=%02x\n",
+ 				__func__, (long)jiffies, readl(_ISR(i2c)), readl(_ICR(i2c)), readl(_IBMR(i2c)));
+ 
+-		if ((readl(_ISR(i2c)) & (ISR_UB|ISR_IBB)) == 0 ||
++		if ((readl(_ISR(i2c)) & i2c->busy_mask) == 0 ||
+ 		    (readl(_ISR(i2c)) & ISR_SAD) != 0 ||
+ 		    (readl(_ICR(i2c)) & ICR_SCLE) == 0) {
+ 			if (i2c_debug > 1)
+@@ -1170,7 +1172,7 @@ static int i2c_pxa_pio_set_master(struct
+ 	/*
+ 	 * Wait for the bus to become free.
+ 	 */
+-	while (timeout-- && readl(_ISR(i2c)) & (ISR_IBB | ISR_UB))
++	while (timeout-- && readl(_ISR(i2c)) & i2c->busy_mask)
+ 		udelay(1000);
+ 
+ 	if (timeout < 0) {
+@@ -1317,7 +1319,7 @@ static void i2c_pxa_unprepare_recovery(s
+ 	 * handing control of the bus back to avoid the bus changing state.
+ 	 */
+ 	isr = readl(_ISR(i2c));
+-	if (isr & (ISR_UB | ISR_IBB)) {
++	if (isr & i2c->busy_mask) {
+ 		dev_dbg(&i2c->adap.dev,
+ 			"recovery: resetting controller, ISR=0x%08x\n", isr);
+ 		i2c_pxa_do_reset(i2c);
+@@ -1481,6 +1483,10 @@ static int i2c_pxa_probe(struct platform
+ 	i2c->fm_mask = pxa_reg_layout[i2c_type].fm;
+ 	i2c->hs_mask = pxa_reg_layout[i2c_type].hs;
+ 
++	i2c->busy_mask = ISR_UB | ISR_IBB;
++	if (i2c_type == REGS_A3700)
++		i2c->busy_mask |= ISR_A3700_EBB;
++
+ 	if (i2c_type != REGS_CE4100)
+ 		i2c->reg_isar = i2c->reg_base + pxa_reg_layout[i2c_type].isar;
+ 
diff --git a/target/linux/mvebu/patches-6.6/901-dt-bindings-Add-IEI-vendor-prefix-and-IEI-WT61P803-P.patch b/target/linux/mvebu/patches-6.6/901-dt-bindings-Add-IEI-vendor-prefix-and-IEI-WT61P803-P.patch
index e9c1d57d244e12..2f7361c93edb68 100644
--- a/target/linux/mvebu/patches-6.6/901-dt-bindings-Add-IEI-vendor-prefix-and-IEI-WT61P803-P.patch
+++ b/target/linux/mvebu/patches-6.6/901-dt-bindings-Add-IEI-vendor-prefix-and-IEI-WT61P803-P.patch
@@ -207,7 +207,7 @@ Cc: Robert Marko <robert.marko@sartura.hr>
 +    };
 --- a/Documentation/devicetree/bindings/vendor-prefixes.yaml
 +++ b/Documentation/devicetree/bindings/vendor-prefixes.yaml
-@@ -609,6 +609,8 @@ patternProperties:
+@@ -611,6 +611,8 @@ patternProperties:
      description: IC Plus Corp.
    "^idt,.*":
      description: Integrated Device Technologies, Inc.
diff --git a/target/linux/mvebu/patches-6.6/902-drivers-mfd-Add-a-driver-for-IEI-WT61P803-PUZZLE-MCU.patch b/target/linux/mvebu/patches-6.6/902-drivers-mfd-Add-a-driver-for-IEI-WT61P803-PUZZLE-MCU.patch
index 1046b15e4b79dc..2aac515eb192da 100644
--- a/target/linux/mvebu/patches-6.6/902-drivers-mfd-Add-a-driver-for-IEI-WT61P803-PUZZLE-MCU.patch
+++ b/target/linux/mvebu/patches-6.6/902-drivers-mfd-Add-a-driver-for-IEI-WT61P803-PUZZLE-MCU.patch
@@ -54,7 +54,7 @@ Cc: Robert Marko <robert.marko@sartura.hr>
  obj-$(CONFIG_INTEL_SOC_PMIC_BXTWC)	+= intel_soc_pmic_bxtwc.o
 --- /dev/null
 +++ b/drivers/mfd/iei-wt61p803-puzzle.c
-@@ -0,0 +1,908 @@
+@@ -0,0 +1,912 @@
 +// SPDX-License-Identifier: GPL-2.0-only
 +/* IEI WT61P803 PUZZLE MCU Driver
 + * System management microcontroller for fan control, temperature sensor reading,
@@ -894,8 +894,12 @@ Cc: Robert Marko <robert.marko@sartura.hr>
 +	mcu->serdev = serdev;
 +	mcu->dev = dev;
 +	init_completion(&mcu->reply->received);
-+	mutex_init(&mcu->reply_lock);
-+	mutex_init(&mcu->lock);
++	ret = devm_mutex_init(dev, &mcu->reply_lock);
++	if (ret)
++		return ret;
++	ret = devm_mutex_init(dev, &mcu->lock);
++	if (ret)
++		return ret;
 +
 +	/* Setup UART interface */
 +	serdev_device_set_drvdata(serdev, mcu);
diff --git a/target/linux/mvebu/patches-6.6/903-drivers-hwmon-Add-the-IEI-WT61P803-PUZZLE-HWMON-driv.patch b/target/linux/mvebu/patches-6.6/903-drivers-hwmon-Add-the-IEI-WT61P803-PUZZLE-HWMON-driv.patch
index 983434e66620cf..eca2bb81e48d50 100644
--- a/target/linux/mvebu/patches-6.6/903-drivers-hwmon-Add-the-IEI-WT61P803-PUZZLE-HWMON-driv.patch
+++ b/target/linux/mvebu/patches-6.6/903-drivers-hwmon-Add-the-IEI-WT61P803-PUZZLE-HWMON-driv.patch
@@ -53,7 +53,7 @@ Cc: Robert Marko <robert.marko@sartura.hr>
  obj-$(CONFIG_SENSORS_IBMPOWERNV)+= ibmpowernv.o
 --- /dev/null
 +++ b/drivers/hwmon/iei-wt61p803-puzzle-hwmon.c
-@@ -0,0 +1,445 @@
+@@ -0,0 +1,447 @@
 +// SPDX-License-Identifier: GPL-2.0-only
 +/* IEI WT61P803 PUZZLE MCU HWMON Driver
 + *
@@ -457,7 +457,9 @@ Cc: Robert Marko <robert.marko@sartura.hr>
 +
 +	mcu_hwmon->mcu = mcu;
 +	platform_set_drvdata(pdev, mcu_hwmon);
-+	mutex_init(&mcu_hwmon->lock);
++	ret = devm_mutex_init(dev, &mcu_hwmon->lock);
++	if (ret)
++		return ret;
 +
 +	hwmon_dev = devm_hwmon_device_register_with_info(dev, "iei_wt61p803_puzzle",
 +							 mcu_hwmon,
diff --git a/target/linux/mvebu/patches-6.6/907-MAINTAINERS-Add-an-entry-for-the-IEI-WT61P803-PUZZLE.patch b/target/linux/mvebu/patches-6.6/907-MAINTAINERS-Add-an-entry-for-the-IEI-WT61P803-PUZZLE.patch
index dad8c16be1d340..d70bfe9a1af0ec 100644
--- a/target/linux/mvebu/patches-6.6/907-MAINTAINERS-Add-an-entry-for-the-IEI-WT61P803-PUZZLE.patch
+++ b/target/linux/mvebu/patches-6.6/907-MAINTAINERS-Add-an-entry-for-the-IEI-WT61P803-PUZZLE.patch
@@ -16,7 +16,7 @@ Cc: Robert Marko <robert.marko@sartura.hr>
 
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -10142,6 +10142,22 @@ IFCVF VIRTIO DATA PATH ACCELERATOR
+@@ -10143,6 +10143,22 @@ IFCVF VIRTIO DATA PATH ACCELERATOR
  R:	Zhu Lingshan <lingshan.zhu@intel.com>
  F:	drivers/vdpa/ifcvf/
  
diff --git a/target/linux/mvebu/patches-6.6/910-drivers-leds-wt61p803-puzzle-improvements.patch b/target/linux/mvebu/patches-6.6/910-drivers-leds-wt61p803-puzzle-improvements.patch
index 150a65498cd3d4..8de403773a0891 100644
--- a/target/linux/mvebu/patches-6.6/910-drivers-leds-wt61p803-puzzle-improvements.patch
+++ b/target/linux/mvebu/patches-6.6/910-drivers-leds-wt61p803-puzzle-improvements.patch
@@ -47,7 +47,7 @@
  
  	ret = iei_wt61p803_puzzle_write_command(priv->mcu, led_power_cmd,
  						sizeof(led_power_cmd),
-@@ -90,39 +106,166 @@ static enum led_brightness iei_wt61p803_
+@@ -90,39 +106,168 @@ static enum led_brightness iei_wt61p803_
  	return led_state;
  }
  
@@ -194,7 +194,9 @@
 +			goto put_child_node;
 +		}
 +
-+		mutex_init(&priv->lock);
++		ret = devm_mutex_init(dev, &priv->lock);
++		if (ret)
++			goto put_child_node;
 +
 +		dev_set_drvdata(dev, priv);
 +
diff --git a/target/linux/mxs/config-6.6 b/target/linux/mxs/config-6.6
index 76aecd17ff5aeb..e01e266c0d3fdf 100644
--- a/target/linux/mxs/config-6.6
+++ b/target/linux/mxs/config-6.6
@@ -32,8 +32,6 @@ CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
 CONFIG_BLK_PM=y
 CONFIG_BUFFER_HEAD=y
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CMDLINE="console=ttyAMA0,115200 root=/dev/mmcblk0p2 rw rootwait"
@@ -55,6 +53,7 @@ CONFIG_CPU_IDLE=y
 CONFIG_CPU_IDLE_GOV_LADDER=y
 CONFIG_CPU_IDLE_GOV_MENU=y
 CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_MITIGATIONS=y
 CONFIG_CPU_PABRT_LEGACY=y
 CONFIG_CPU_PM=y
 CONFIG_CPU_THUMB_CAPABLE=y
@@ -72,6 +71,7 @@ CONFIG_CRYPTO_LIB_GF128MUL=y
 CONFIG_CRYPTO_LIB_SHA1=y
 CONFIG_CRYPTO_LIB_UTILS=y
 CONFIG_DEBUG_ALIGN_RODATA=y
+CONFIG_DEBUG_INFO=y
 CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
 CONFIG_DMADEVICES=y
 CONFIG_DMA_ENGINE=y
@@ -86,13 +86,13 @@ CONFIG_EXTCON=y
 CONFIG_FEC=y
 CONFIG_FIXED_PHY=y
 CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FORCE_NR_CPUS=y
 CONFIG_FS_IOMAP=y
 CONFIG_FS_MBCACHE=y
 CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_BUG=y
@@ -209,6 +209,7 @@ CONFIG_PPS=y
 CONFIG_PREEMPT_NONE_BUILD=y
 CONFIG_PTP_1588_CLOCK=y
 CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_RANDSTRUCT_NONE=y
 CONFIG_RATIONAL=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
@@ -234,6 +235,7 @@ CONFIG_SPI=y
 CONFIG_SPI_MASTER=y
 CONFIG_SPI_MXS=y
 CONFIG_SPLIT_PTLOCK_CPUS=999999
+CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU=y
 CONFIG_STMP3XXX_RTC_WATCHDOG=y
 CONFIG_STMP_DEVICE=y
 CONFIG_SWPHY=y
diff --git a/target/linux/octeon/Makefile b/target/linux/octeon/Makefile
index c59b0af6a2fe85..f14f4537b864d4 100644
--- a/target/linux/octeon/Makefile
+++ b/target/linux/octeon/Makefile
@@ -18,6 +18,6 @@ endef
 
 include $(INCLUDE_DIR)/target.mk
 
-DEFAULT_PACKAGES += mkf2fs e2fsprogs
+DEFAULT_PACKAGES += mkf2fs e2fsprogs kmod-usb-dwc3-octeon
 
 $(eval $(call BuildTarget))
diff --git a/target/linux/octeon/config-6.6 b/target/linux/octeon/config-6.6
index 724361d5ea7cc4..5cae2a8821a3ac 100644
--- a/target/linux/octeon/config-6.6
+++ b/target/linux/octeon/config-6.6
@@ -9,6 +9,7 @@ CONFIG_ARCH_MMAP_RND_BITS_MIN=12
 CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
 CONFIG_ARCH_SPARSEMEM_ENABLE=y
 CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_AT803X_PHY=y
 CONFIG_ATA=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BLK_DEV_SD=y
@@ -25,8 +26,6 @@ CONFIG_CAVIUM_OCTEON_LOCK_L2_MEMCPY=y
 CONFIG_CAVIUM_OCTEON_LOCK_L2_TLB=y
 CONFIG_CAVIUM_OCTEON_SOC=y
 CONFIG_CAVIUM_RESERVE32=0
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
 CONFIG_CLONE_BACKWARDS=y
 # CONFIG_COMMON_CLK is not set
@@ -90,7 +89,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CMOS_UPDATE=y
@@ -219,6 +217,7 @@ CONFIG_QUEUED_RWLOCKS=y
 CONFIG_QUEUED_SPINLOCKS=y
 CONFIG_RANDSTRUCT_NONE=y
 CONFIG_RAS=y
+CONFIG_REGULATOR=y
 CONFIG_REGMAP=y
 CONFIG_REGMAP_I2C=y
 CONFIG_RELAY=y
diff --git a/target/linux/octeon/image/Makefile b/target/linux/octeon/image/Makefile
index f00e87c5201674..dec04809150aee 100644
--- a/target/linux/octeon/image/Makefile
+++ b/target/linux/octeon/image/Makefile
@@ -92,6 +92,7 @@ define Device/ubnt_unifi-usg
   DEVICE_PACKAGES += kmod-gpio-button-hotplug kmod-leds-gpio
   DEVICE_DTS := cn5020_ubnt_usg
   KERNEL += | append-dtb-to-elf
+  SUPPORTED_DEVICES += ubnt,usg
 endef
 TARGET_DEVICES += ubnt_unifi-usg
 
diff --git a/target/linux/octeon/patches-6.6/400-ubnt_dts_pruning.patch b/target/linux/octeon/patches-6.6/400-ubnt_dts_pruning.patch
new file mode 100644
index 00000000000000..b4f36c350774c4
--- /dev/null
+++ b/target/linux/octeon/patches-6.6/400-ubnt_dts_pruning.patch
@@ -0,0 +1,81 @@
+commit eb6c3ba1d42fd087708f568ca220ff557f22104e
+Author: Jakob Haufe <sur5r@sur5r.net>
+Date:   Tue Jun 17 13:58:19 2025 +0200
+
+    MIPS: OCTEON: Add UBNT specific DTS pruning
+    
+    This imports device specific DTS pruning from
+    https://github.com/UI-Packages/kernel_e200/blob/master/arch/mips/cavium-octeon/octeon-platform.c#L1067
+    
+    - Reduce MMC clock frequency on E200/E220 to make
+      MMC communication reliable again. See linked issue.
+    - Remove unused MMC node on E300.
+    
+    Related: https://github.com/openwrt/openwrt/issues/13762
+    
+    Signed-off-by: Jakob Haufe <sur5r@sur5r.net>
+
+--- a/arch/mips/cavium-octeon/octeon-platform.c
++++ b/arch/mips/cavium-octeon/octeon-platform.c
+@@ -1133,6 +1133,41 @@ end_led:
+ 	}
+ #endif
+ 
++
++	return 0;
++}
++
++int __init ubnt_prune_device_tree(void)
++{
++	/* MMC on UBNT */
++	pr_info("UBNT board DTS pruning...\n");
++	if (octeon_bootinfo->board_type == CVMX_BOARD_TYPE_UBNT_E300) {
++		pr_info("UBNT E300 found, looking for mmc-slot@2\n");
++		// Remove unused MMC slot definition
++		int mmc_slot2 = fdt_path_offset(initial_boot_params, "/soc/mmc/mmc-slot@2");
++
++		if (mmc_slot2 > 0) {
++			pr_info("UBNT E300 found, deleting mmc-slot@2\n");
++			fdt_nop_node(initial_boot_params, mmc_slot2);
++		} else {
++			pr_info("mmc-slot@2 not found\n");
++		}
++	} else if (octeon_bootinfo->board_type == CVMX_BOARD_TYPE_UBNT_E200 ||
++		   octeon_bootinfo->board_type == CVMX_BOARD_TYPE_UBNT_E220) {
++		pr_info("UBNT E200/E220 found, looking for mmc-slot@0\n");
++		int mmc_slot0 = fdt_path_offset(initial_boot_params, "/soc/mmc/mmc-slot@0");
++
++		u32 freq = 26000000;
++
++		if (mmc_slot0 > 0) {
++			pr_info("UBNT E200/E220 mmc-slot@0 found, setting frequency to 26MHz");
++			fdt_setprop_inplace_cell(initial_boot_params, mmc_slot0,
++						 "spi-max-frequency", freq);
++		} else {
++			pr_info("mmc-slot@0 not found\n");
++		}
++	}
++
+ 	return 0;
+ }
+ 
+--- a/arch/mips/cavium-octeon/setup.c
++++ b/arch/mips/cavium-octeon/setup.c
+@@ -1168,6 +1168,7 @@ void __init prom_free_prom_memory(void)
+ 	}
+ }
+ 
++int __init ubnt_prune_device_tree(void);
+ void __init octeon_fill_mac_addresses(void);
+ 
+ void __init device_tree_init(void)
+@@ -1207,6 +1208,9 @@ void __init device_tree_init(void)
+ 		octeon_prune_device_tree();
+ 		pr_info("Using internal Device Tree.\n");
+ 	}
++
++	ubnt_prune_device_tree();
++
+ 	if (fill_mac)
+ 		octeon_fill_mac_addresses();
+ 	unflatten_and_copy_device_tree();
diff --git a/target/linux/omap/config-6.6 b/target/linux/omap/config-6.6
index f85a68f0aad886..5f19df0d8b930e 100644
--- a/target/linux/omap/config-6.6
+++ b/target/linux/omap/config-6.6
@@ -66,8 +66,6 @@ CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BUFFER_HEAD=y
 CONFIG_CACHE_L2X0=y
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEC_CORE=y
 # CONFIG_CHARGER_TPS65217 is not set
 CONFIG_CLKSRC_MMIO=y
@@ -244,7 +242,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
 CONFIG_GENERIC_BUG=y
diff --git a/target/linux/pistachio/config-6.6 b/target/linux/pistachio/config-6.6
index 80ff36ebbb364f..69c566a1e877f6 100644
--- a/target/linux/pistachio/config-6.6
+++ b/target/linux/pistachio/config-6.6
@@ -10,8 +10,6 @@ CONFIG_BLK_DEV_SD=y
 CONFIG_BOARD_SCACHE=y
 CONFIG_BUFFER_HEAD=y
 CONFIG_BUILTIN_DTB=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
 CONFIG_CLKSRC_MIPS_GIC=y
 CONFIG_CLKSRC_PISTACHIO=y
@@ -102,7 +100,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_CLOCKEVENTS=y
diff --git a/target/linux/qoriq/config-6.6 b/target/linux/qoriq/config-6.6
index 750e6c65510227..28ece0679f7888 100644
--- a/target/linux/qoriq/config-6.6
+++ b/target/linux/qoriq/config-6.6
@@ -29,8 +29,6 @@ CONFIG_BOOKE=y
 CONFIG_BOOKE_OR_40x=y
 CONFIG_BOOKE_WDT=y
 CONFIG_BUFFER_HEAD=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLK_QORIQ=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CLZ_TAB=y
@@ -148,7 +146,6 @@ CONFIG_FUNCTION_ERROR_INJECTION=y
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_BUG=y
 CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
diff --git a/target/linux/qualcommax/config-6.6 b/target/linux/qualcommax/config-6.6
index 1d05868cafd291..ac5059682a5cdf 100644
--- a/target/linux/qualcommax/config-6.6
+++ b/target/linux/qualcommax/config-6.6
@@ -65,8 +65,6 @@ CONFIG_BUILTIN_RETURN_ADDRESS_STRIPS_PAC=y
 CONFIG_CAVIUM_TX2_ERRATUM_219=y
 CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_COMMON_CLK=y
 CONFIG_COMMON_CLK_QCOM=y
@@ -151,7 +149,6 @@ CONFIG_FUNCTION_ALIGNMENT_4B=y
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS=y
 CONFIG_GENERIC_ALLOCATOR=y
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts
index c5c089c00f7dd4..d25bc90153c433 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-dl-wrx36.dts
@@ -178,14 +178,15 @@
 
 			led@0 {
 				reg = <0>;
-				color = <LED_COLOR_ID_GREEN>;
+				color = <LED_COLOR_ID_YELLOW>;
 				function = LED_FUNCTION_WAN;
 				default-state = "keep";
+				active-low;
 			};
 
-			led@1 {
-				reg = <1>;
-				color = <LED_COLOR_ID_YELLOW>;
+			led@2 {
+				reg = <2>;
+				color = <LED_COLOR_ID_GREEN>;
 				function = LED_FUNCTION_WAN;
 				default-state = "keep";
 			};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-sax1v1k.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-sax1v1k.dts
index fbb652a097b05f..15ca4d8ec403cc 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-sax1v1k.dts
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8072-sax1v1k.dts
@@ -137,6 +137,27 @@
 		reg = <28>;
 		reset-gpios = <&tlmm 44 GPIO_ACTIVE_LOW>;
 		reset-deassert-us = <10000>;
+		
+		leds {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			led@0 {
+				reg = <0>;
+				color = <LED_COLOR_ID_YELLOW>;
+				function = LED_FUNCTION_WAN;
+				default-state = "keep";
+				active-low;
+			};
+
+			led@2 {
+				reg = <2>;
+				color = <LED_COLOR_ID_GREEN>;
+				function = LED_FUNCTION_WAN;
+				default-state = "keep";
+				active-low;
+			};
+		};
 	};
 };
 
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi
index 13ce8d16016860..5867cd42227b8b 100644
--- a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8174-mx4200.dtsi
@@ -1,80 +1,16 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 /* Copyright (c) 2023, Mohammad Sayful Islam <Sayf.mohammad01@gmail.com> */
 
-#include "ipq8074.dtsi"
-#include "ipq8074-ac-cpu.dtsi"
-#include "ipq8074-ess.dtsi"
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
-#include <dt-bindings/leds/common.h>
+#include "ipq8174-mx4x00.dtsi"
 
 / {
-
 	aliases {
-		serial0 = &blsp1_uart5;
-		serial1 = &blsp1_uart3;
-		/*
-		 * Aliases as required by u-boot
-		 * to patch MAC addresses
-		 */
-		ethernet1 = &dp2;
-		ethernet2 = &dp3;
 		ethernet3 = &dp4;
 		ethernet4 = &dp5;
-		led-boot = &led_system_blue;
-		led-running = &led_system_blue;
-		led-failsafe = &led_system_red;
-		led-upgrade = &led_system_green;
-	};
-
-	chosen {
-		stdout-path = "serial0:115200n8";
-		bootargs-append = " root=/dev/ubiblock0_0";
-	};
-
-	keys {
-		compatible = "gpio-keys";
-		pinctrl-0 = <&button_pins>;
-		pinctrl-names = "default";
-
-		reset-button {
-			label = "reset";
-			gpios = <&tlmm 52 GPIO_ACTIVE_LOW>;
-			linux,code = <KEY_RESTART>;
-		};
-
-		wps-button {
-			label = "wps";
-			gpios = <&tlmm 67 GPIO_ACTIVE_LOW>;
-			linux,code = <KEY_WPS_BUTTON>;
-		};
 	};
 };
 
 &tlmm {
-	button_pins: button-state {
-		pins = "gpio52", "gpio67";
-		function = "gpio";
-		drive-strength = <8>;
-		bias-pull-up;
-	};
-
-	mdio_pins: mdio-state {
-		mdc-pins {
-			pins = "gpio68";
-			function = "mdc";
-			drive-strength = <8>;
-			bias-pull-up;
-		};
-
-		mdio-pins {
-			pins = "gpio69";
-			function = "mdio";
-			drive-strength = <8>;
-			bias-pull-up;
-		};
-	};
-
 	iot_pins: iot-state {
 		recovery-pins {
 			pins = "gpio22";
@@ -99,26 +35,6 @@
 	/* Silicon Labs EFR32MG21 IoT */
 };
 
-&blsp1_uart5 {
-	status = "okay";
-};
-
-&prng {
-	status = "okay";
-};
-
-&cryptobam {
-	status = "okay";
-};
-
-&crypto {
-	status = "okay";
-};
-
-&qpic_bam {
-	status = "okay";
-};
-
 &qpic_nand {
 	status = "okay";
 
@@ -289,21 +205,25 @@
 				label = "alt_rootfs";
 				reg = <0xac80000 0x9000000>;
 			};
+
 			partition@13c80000 {
 				label = "sysdiag";
 				reg = <0x13c80000 0x200000>;
 				read-only;
 			};
+
 			partition@13e80000 {
 				label = "0:ethphyfw";
 				reg = <0x13e80000 0x80000>;
 				read-only;
 			};
+
 			partition@13f00000 {
 				label = "syscfg";
 				reg = <0x13f00000 0xb800000>;
 				read-only;
 			};
+
 			partition@1f700000 {
 				label = "0:wififw";
 				reg = <0x1f700000 0x900000>;
@@ -313,102 +233,6 @@
 	};
 };
 
-&blsp1_i2c2 {
-	status = "okay";
-
-	led-controller@62 {
-		compatible = "nxp,pca9633";
-		#address-cells = <1>;
-		#size-cells = <0>;
-		reg = <0x62>;
-		nxp,hw-blink;
-
-		led_system_red: led@0 {
-			reg = <0>;
-			color = <LED_COLOR_ID_RED>;
-			function = LED_FUNCTION_STATUS;
-		};
-
-		led_system_green: led@1 {
-			reg = <1>;
-			color = <LED_COLOR_ID_GREEN>;
-			function = LED_FUNCTION_STATUS;
-		};
-
-		led_system_blue: led@2 {
-			reg = <2>;
-			color = <LED_COLOR_ID_BLUE>;
-			function = LED_FUNCTION_STATUS;
-		};
-	};
-};
-
-&mdio {
-	status = "okay";
-
-	pinctrl-0 = <&mdio_pins>;
-	pinctrl-names = "default";
-	reset-gpios = <&tlmm 37 GPIO_ACTIVE_LOW>;
-
-	ethernet-phy-package@0 {
-		#address-cells = <1>;
-		#size-cells = <0>;
-		compatible = "qcom,qca8075-package";
-		reg = <0>;
-
-		qca8075_1: ethernet-phy@1 {
-			compatible = "ethernet-phy-ieee802.3-c22";
-			reg = <1>;
-		};
-
-		qca8075_2: ethernet-phy@2 {
-			compatible = "ethernet-phy-ieee802.3-c22";
-			reg = <2>;
-		};
-
-		qca8075_3: ethernet-phy@3 {
-			compatible = "ethernet-phy-ieee802.3-c22";
-			reg = <3>;
-		};
-
-		qca8075_4: ethernet-phy@4 {
-			compatible = "ethernet-phy-ieee802.3-c22";
-			reg = <4>;
-		};
-	};
-};
-
-&switch {
-	status = "okay";
-
-	switch_lan_bmp = <(ESS_PORT3 | ESS_PORT4 | ESS_PORT5)>; /* lan port bitmap */
-	switch_wan_bmp = <ESS_PORT2>; /* wan port bitmap */
-	switch_mac_mode = <MAC_MODE_PSGMII>; /* mac mode for uniphy instance0*/
-
-	qcom,port_phyinfo {
-		port@2 {
-			port_id = <2>;
-			phy_address = <1>;
-		};
-		port@3 {
-			port_id = <3>;
-			phy_address = <2>;
-		};
-		port@4 {
-			port_id = <4>;
-			phy_address = <3>;
-		};
-		port@5 {
-			port_id = <5>;
-			phy_address = <4>;
-		};
-	};
-};
-
-&edma {
-	status = "okay";
-};
-
 &dp2 {
 	status = "okay";
 	phy-handle = <&qca8075_1>;
@@ -432,16 +256,3 @@
 	phy-handle = <&qca8075_4>;
 	label = "lan3";
 };
-
-&ssphy_0 {
-	status = "okay";
-};
-
-&qusb_phy_0 {
-	status = "okay";
-};
-
-&usb_0 {
-	status = "okay";
-};
-
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8174-mx4300.dts b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8174-mx4300.dts
new file mode 100644
index 00000000000000..1477019ab941d0
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8174-mx4300.dts
@@ -0,0 +1,273 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+/dts-v1/;
+
+#include "ipq8174-mx4x00.dtsi"
+
+/ {
+	model = "Linksys MX4300";
+	compatible = "linksys,mx4300", "qcom,ipq8074";
+
+	chosen {
+		/*
+		In the kernel command line, replace the first occurence of bootargs-find-X with bootargs-replace-X.
+		If bootargs-exact-match-X is set to "y", then replacement happens only if the kernel command line
+		is identical to bootargs-find-X.
+		*/
+		bootargs-find-1 = "ubi.mtd=22,2048";
+		bootargs-replace-1 = "ubi.mtd=22,4096";
+
+		bootargs-find-2 = "ubi.mtd=24,2048";
+		bootargs-replace-2 = "ubi.mtd=24,4096";
+	};
+};
+
+&qpic_nand {
+	status = "okay";
+
+	/*
+	 * Bootloader will find the NAND DT node by the compatible and
+	 * then "fixup" it by adding the partitions from the SMEM table
+	 * using the legacy bindings thus making it impossible for us
+	 * to change the partition table or utilize NVMEM for calibration.
+	 * So add a dummy partitions node that bootloader will populate
+	 * and set it as disabled so the kernel ignores it instead of
+	 * printing warnings due to the broken way bootloader adds the
+	 * partitions.
+	 */
+	partitions {
+		status = "disabled";
+	};
+
+	nand@0 {
+		reg = <0>;
+		/*
+		 * Some devices use Micron NAND with with 8 bit ECC 
+		 * other AMD/Spansion NAND with 4 bit ECC
+		 *nand-ecc-strength = <4>;
+		 *nand-ecc-step-size = <512>;
+		 */
+		nand-bus-width = <8>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "0:sbl1";
+				reg = <0x0 0x100000>;
+				read-only;
+			};
+
+			partition@100000 {
+				label = "0:mibib";
+				reg = <0x100000 0x100000>;
+				read-only;
+			};
+
+			partition@200000 {
+				label = "0:bootconfig";
+				reg = <0x200000 0x80000>;
+				read-only;
+			};
+
+			partition@280000 {
+				label = "0:bootconfig1";
+				reg = <0x280000 0x80000>;
+				read-only;
+			};
+
+			partition@300000 {
+				label = "0:qsee";
+				reg = <0x300000 0x300000>;
+				read-only;
+			};
+
+			partition@600000 {
+				label = "0:qsee_1";
+				reg = <0x600000 0x300000>;
+				read-only;
+			};
+
+			partition@900000 {
+				label = "0:devcfg";
+				reg = <0x900000 0x80000>;
+				read-only;
+			};
+
+			partition@980000 {
+				label = "0:devcfg_1";
+				reg = <0x980000 0x80000>;
+				read-only;
+			};
+
+			partition@a00000 {
+				label = "0:apdp";
+				reg = <0xa00000 0x80000>;
+				read-only;
+			};
+
+			partition@a80000 {
+				label = "0:apdp_1";
+				reg = <0xa80000 0x80000>;
+				read-only;
+			};
+
+			partition@b00000 {
+				label = "0:rpm";
+				reg = <0xb00000 0x80000>;
+				read-only;
+			};
+
+			partition@b80000 {
+				label = "0:rpm_1";
+				reg = <0xb80000 0x80000>;
+				read-only;
+			};
+
+			partition@c00000 {
+				label = "0:cdt";
+				reg = <0xc00000 0x80000>;
+				read-only;
+			};
+
+			partition@c80000 {
+				label = "0:cdt_1";
+				reg = <0xc80000 0x80000>;
+				read-only;
+			};
+
+			partition@d00000 {
+				label = "0:appsblenv";
+				reg = <0xd00000 0x80000>;
+			};
+
+			partition@d80000 {
+				label = "0:appsbl";
+				reg = <0xd80000 0x100000>;
+				read-only;
+			};
+
+			partition@e80000 {
+				label = "0:appsbl_1";
+				reg = <0xe80000 0x100000>;
+				read-only;
+			};
+
+			partition@f80000 {
+				label = "0:art";
+				reg = <0xf80000 0x80000>;
+				read-only;
+			};
+
+			partition@1000000 {
+				label = "u_env";
+				reg = <0x1000000 0x100000>;
+			};
+
+			partition@1100000 {
+				label = "s_env";
+				reg = <0x1100000 0x100000>;
+			};
+
+			partition@1200000 {
+				label = "devinfo";
+				reg = <0x1200000 0x40000>;
+				read-only;
+			};
+
+			partition@1240000 {
+				label = "kernel";
+				reg = <0x1240000 0xaf40000>;
+			};
+
+			partition@1a40000 {
+				label = "rootfs";
+				reg = <0x1a40000 0xa740000>;
+			};
+
+			partition@c180000 {
+				label = "alt_kernel";
+				reg = <0xc180000 0xaf40000>;
+			};
+
+			partition@c980000 {
+				label = "alt_rootfs";
+				reg = <0xc980000 0xa740000>;
+			};
+
+			partition@170c0000 {
+				label = "sysdiag";
+				reg = <0x170c0000 0x400000>;
+				read-only;
+			};
+
+			partition@174c0000 {
+				label = "0:ethphyfw";
+				reg = <0x174c0000 0x80000>;
+				read-only;
+			};
+
+			partition@17540000 {
+				label = "syscfg";
+				reg = <0x17540000 0x79c0000>;
+				read-only;
+			};
+
+			partition@1ef00000 {
+				label = "secured_store";
+				reg = <0x1ef00000 0x400000>;
+				read-only;
+			};
+
+			partition@1f300000 {
+				label = "0:wififw";
+				reg = <0x1f300000 0x1900000>;
+				read-only;
+			};
+
+			partition@20c00000 {
+				label = "app2_data";
+				reg = <0x20c00000 0x16180000>;
+				read-only;
+			};
+
+			partition@36d80000 {
+				label = "app2";
+				reg = <0x36d80000 0x9280000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&dp2 {
+	status = "okay";
+	phy-handle = <&qca8075_1>;
+	label = "wan";
+};
+
+&dp3 {
+	status = "okay";
+	phy-handle = <&qca8075_2>;
+	label = "lan3";
+};
+
+&dp4 {
+	status = "okay";
+	phy-handle = <&qca8075_3>;
+	label = "lan2";
+};
+
+&dp5 {
+	status = "okay";
+	phy-handle = <&qca8075_4>;
+	label = "lan1";
+};
+
+&wifi {
+	status = "okay";
+
+	qcom,ath11k-calibration-variant = "Linksys-MX4200v1";
+};
diff --git a/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8174-mx4x00.dtsi b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8174-mx4x00.dtsi
new file mode 100644
index 00000000000000..84e68dae356bac
--- /dev/null
+++ b/target/linux/qualcommax/files/arch/arm64/boot/dts/qcom/ipq8174-mx4x00.dtsi
@@ -0,0 +1,204 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+/* Copyright (c) 2023, Mohammad Sayful Islam <Sayf.mohammad01@gmail.com> */
+
+#include "ipq8074.dtsi"
+#include "ipq8074-ac-cpu.dtsi"
+#include "ipq8074-ess.dtsi"
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	aliases {
+		serial0 = &blsp1_uart5;
+		serial1 = &blsp1_uart3;
+		/*
+		 * Aliases as required by u-boot
+		 * to patch MAC addresses
+		 */
+		ethernet1 = &dp2;
+		ethernet2 = &dp3;
+		led-boot = &led_system_blue;
+		led-running = &led_system_blue;
+		led-failsafe = &led_system_red;
+		led-upgrade = &led_system_green;
+	};
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+		pinctrl-0 = <&button_pins>;
+		pinctrl-names = "default";
+
+		reset-button {
+			label = "reset";
+			gpios = <&tlmm 52 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps-button {
+			label = "wps";
+			gpios = <&tlmm 67 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+};
+
+&tlmm {
+	button_pins: button-state {
+		pins = "gpio52", "gpio67";
+		function = "gpio";
+		drive-strength = <8>;
+		bias-pull-up;
+	};
+
+	mdio_pins: mdio-state {
+		mdc-pins {
+			pins = "gpio68";
+			function = "mdc";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+
+		mdio-pins {
+			pins = "gpio69";
+			function = "mdio";
+			drive-strength = <8>;
+			bias-pull-up;
+		};
+	};
+};
+
+&blsp1_uart5 {
+	status = "okay";
+};
+
+&prng {
+	status = "okay";
+};
+
+&cryptobam {
+	status = "okay";
+};
+
+&crypto {
+	status = "okay";
+};
+
+&qpic_bam {
+	status = "okay";
+};
+
+&blsp1_i2c2 {
+	status = "okay";
+
+	led-controller@62 {
+		compatible = "nxp,pca9633";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <0x62>;
+		nxp,hw-blink;
+
+		led_system_red: led@0 {
+			reg = <0>;
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+		};
+
+		led_system_green: led@1 {
+			reg = <1>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+		};
+
+		led_system_blue: led@2 {
+			reg = <2>;
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+		};
+	};
+};
+
+&mdio {
+	status = "okay";
+
+	pinctrl-0 = <&mdio_pins>;
+	pinctrl-names = "default";
+	reset-gpios = <&tlmm 37 GPIO_ACTIVE_LOW>;
+
+	ethernet-phy-package@0 {
+		#address-cells = <1>;
+		#size-cells = <0>;
+		compatible = "qcom,qca8075-package";
+		reg = <0>;
+
+		qca8075_1: ethernet-phy@1 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <1>;
+		};
+
+		qca8075_2: ethernet-phy@2 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <2>;
+		};
+
+		qca8075_3: ethernet-phy@3 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <3>;
+		};
+
+		qca8075_4: ethernet-phy@4 {
+			compatible = "ethernet-phy-ieee802.3-c22";
+			reg = <4>;
+		};
+	};
+};
+
+&switch {
+	status = "okay";
+
+	switch_lan_bmp = <(ESS_PORT3 | ESS_PORT4 | ESS_PORT5)>; /* lan port bitmap */
+	switch_wan_bmp = <ESS_PORT2>; /* wan port bitmap */
+	switch_mac_mode = <MAC_MODE_PSGMII>; /* mac mode for uniphy instance0*/
+
+	qcom,port_phyinfo {
+		port@2 {
+			port_id = <2>;
+			phy_address = <1>;
+		};
+
+		port@3 {
+			port_id = <3>;
+			phy_address = <2>;
+		};
+
+		port@4 {
+			port_id = <4>;
+			phy_address = <3>;
+		};
+
+		port@5 {
+			port_id = <5>;
+			phy_address = <4>;
+		};
+	};
+};
+
+&edma {
+	status = "okay";
+};
+
+&ssphy_0 {
+	status = "okay";
+};
+
+&qusb_phy_0 {
+	status = "okay";
+};
+
+&usb_0 {
+	status = "okay";
+};
diff --git a/target/linux/qualcommax/image/ipq807x.mk b/target/linux/qualcommax/image/ipq807x.mk
index faefb479c24ea7..77d89b69380e3c 100644
--- a/target/linux/qualcommax/image/ipq807x.mk
+++ b/target/linux/qualcommax/image/ipq807x.mk
@@ -1,3 +1,5 @@
+DEVICE_VARS += NETGEAR_BOARD_ID NETGEAR_HW_ID
+
 define Build/asus-fake-ramdisk
 	rm -rf $(KDIR)/tmp/fakerd
 	dd if=/dev/zero bs=32 count=1 > $(KDIR)/tmp/fakerd
@@ -168,12 +170,17 @@ define Device/linksys_mx
 	DEVICE_PACKAGES := kmod-leds-pca963x
 endef
 
-define Device/linksys_mx4200v1
+define Device/linksys_mx4x00
 	$(call Device/linksys_mx)
+	SOC := ipq8174
+	DEVICE_PACKAGES += ipq-wifi-linksys_mx4200
+endef
+
+define Device/linksys_mx4200v1
+	$(call Device/linksys_mx4x00)
 	DEVICE_MODEL := MX4200
 	DEVICE_VARIANT := v1
-	SOC := ipq8174
-	DEVICE_PACKAGES += ipq-wifi-linksys_mx4200 kmod-bluetooth
+	DEVICE_PACKAGES += kmod-bluetooth
 endef
 TARGET_DEVICES += linksys_mx4200v1
 
@@ -183,6 +190,17 @@ define Device/linksys_mx4200v2
 endef
 TARGET_DEVICES += linksys_mx4200v2
 
+define Device/linksys_mx4300
+	$(call Device/linksys_mx4x00)
+	DEVICE_MODEL := MX4300
+	BLOCKSIZE := 256k
+	PAGESIZE := 4096
+	KERNEL_SIZE := 8192k
+	IMAGE_SIZE := 171264k
+	NAND_SIZE := 1024m
+endef
+TARGET_DEVICES += linksys_mx4300
+
 define Device/linksys_mx5300
 	$(call Device/linksys_mx)
 	DEVICE_MODEL := MX5300
@@ -308,7 +326,7 @@ define Device/prpl_haze
 	DEVICE_DTS_CONFIG := config@hk09
 	SOC := ipq8072
 	DEVICE_PACKAGES := ath11k-firmware-qcn9074 ipq-wifi-prpl_haze kmod-ath11k-pci \
-		mkf2fs f2fsck kmod-fs-f2fs kmod-leds-lp5562
+		kmod-fs-f2fs f2fs-tools kmod-leds-lp5562
 endef
 TARGET_DEVICES += prpl_haze
 
@@ -320,7 +338,7 @@ define Device/qnap_301w
 	DEVICE_DTS_CONFIG := config@hk01
 	KERNEL_SIZE := 16384k
 	SOC := ipq8072
-	DEVICE_PACKAGES := ipq-wifi-qnap_301w
+	DEVICE_PACKAGES := kmod-fs-f2fs f2fs-tools ipq-wifi-qnap_301w
 endef
 TARGET_DEVICES += qnap_301w
 
@@ -446,7 +464,7 @@ define Device/zyxel_nbg7815
 	DEVICE_MODEL := NBG7815
 	DEVICE_DTS_CONFIG := config@nbg7815
 	SOC := ipq8074
-	DEVICE_PACKAGES := ipq-wifi-zyxel_nbg7815 kmod-ath11k-pci \
+	DEVICE_PACKAGES := kmod-fs-f2fs f2fs-tools ipq-wifi-zyxel_nbg7815 kmod-ath11k-pci \
 		kmod-bluetooth kmod-hwmon-tmp103
 endef
 TARGET_DEVICES += zyxel_nbg7815
diff --git a/target/linux/qualcommax/ipq807x/base-files/etc/board.d/01_leds b/target/linux/qualcommax/ipq807x/base-files/etc/board.d/01_leds
index b5c3cbc73656fa..ae941657f94ea9 100644
--- a/target/linux/qualcommax/ipq807x/base-files/etc/board.d/01_leds
+++ b/target/linux/qualcommax/ipq807x/base-files/etc/board.d/01_leds
@@ -16,7 +16,8 @@ asus,rt-ax89x)
 	ucidef_set_led_netdev "sfp" "SFP" "white:sfp" "10g-sfp"
 	ucidef_set_led_netdev "wan" "WAN" "white:wan" "wan"
 	;;
-dynalink,dl-wrx36)
+dynalink,dl-wrx36|\
+spectrum,sax1v1k)
 	ucidef_set_led_netdev "wan-port-link-green" "WAN-PORT-LINK-GREEN" "90000.mdio-1:1c:green:wan" "wan" "link_2500"
 	ucidef_set_led_netdev "wan-port-link-yellow" "WAN-PORT-LINK-YELLOW" "90000.mdio-1:1c:yellow:wan" "wan" "tx rx link_10 link_100 link_1000"
 	;;
diff --git a/target/linux/qualcommax/ipq807x/base-files/etc/board.d/02_network b/target/linux/qualcommax/ipq807x/base-files/etc/board.d/02_network
index 437581d001127a..edb1ae9557c005 100644
--- a/target/linux/qualcommax/ipq807x/base-files/etc/board.d/02_network
+++ b/target/linux/qualcommax/ipq807x/base-files/etc/board.d/02_network
@@ -29,6 +29,7 @@ ipq807x_setup_interfaces()
 	compex,wpq873|\
 	linksys,mx4200v1|\
 	linksys,mx4200v2|\
+	linksys,mx4300|\
 	prpl,haze|\
 	redmi,ax6|\
 	spectrum,sax1v1k|\
@@ -80,12 +81,11 @@ ipq807x_setup_macs()
 	local label_mac=""
 
 	case "$board" in
-		linksys,mx4200v2)
+		linksys,mx4200v2|\
+		linksys,mx4300)
 			label_mac=$(mtd_get_mac_ascii devinfo hw_mac_addr)
-			for i in $(seq 3 5); do
-				[ "$(mtd_get_mac_ascii u_env eth${i}addr)" != "$label_mac" ] && lan_mac=$label_mac
-			done
-			[ "$(mtd_get_mac_ascii u_env eth2addr)" != "$label_mac" ] && wan_mac=$label_mac
+			[ "$(mtd_get_mac_ascii u_env eth1addr)" != "$label_mac" ] && wan_mac=$label_mac
+			[ "$(mtd_get_mac_ascii u_env eth2addr)" != "$label_mac" ] && lan_mac=$label_mac
 		;;
 		linksys,mx8500)
 			label_mac=$(mtd_get_mac_ascii devinfo hw_mac_addr)
diff --git a/target/linux/qualcommax/ipq807x/base-files/etc/hotplug.d/firmware/11-ath11k-caldata b/target/linux/qualcommax/ipq807x/base-files/etc/hotplug.d/firmware/11-ath11k-caldata
index 2e741f044841c6..34c0a476d351c4 100644
--- a/target/linux/qualcommax/ipq807x/base-files/etc/hotplug.d/firmware/11-ath11k-caldata
+++ b/target/linux/qualcommax/ipq807x/base-files/etc/hotplug.d/firmware/11-ath11k-caldata
@@ -44,6 +44,14 @@ case "$FIRMWARE" in
 		ath11k_remove_regdomain
 		ath11k_set_macflag
 		;;
+	linksys,mx4300)
+		caldata_extract "0:art" 0x1000 0x20000
+		label_mac=$(mtd_get_mac_ascii devinfo hw_mac_addr)
+		ath11k_patch_mac $(macaddr_add $label_mac 2) 0
+		ath11k_patch_mac $(macaddr_add $label_mac 1) 1
+		ath11k_patch_mac $(macaddr_add $label_mac 3) 2
+		ath11k_remove_regdomain
+		;;
 	netgear,rax120v2)
 		caldata_extract "0:art" 0x1000 0x20000
 		ath11k_patch_mac $(mtd_get_mac_binary boarddata1 0xc) 0
diff --git a/target/linux/qualcommax/ipq807x/base-files/etc/init.d/bootcount b/target/linux/qualcommax/ipq807x/base-files/etc/init.d/bootcount
index 26da7cd614efec..176a5a144a0799 100755
--- a/target/linux/qualcommax/ipq807x/base-files/etc/init.d/bootcount
+++ b/target/linux/qualcommax/ipq807x/base-files/etc/init.d/bootcount
@@ -12,6 +12,7 @@ boot() {
 	;;
 	linksys,mx4200v1|\
 	linksys,mx4200v2|\
+	linksys,mx4300|\
 	linksys,mx5300|\
 	linksys,mx8500)
 		mtd resetbc s_env || true
diff --git a/target/linux/qualcommax/ipq807x/base-files/lib/upgrade/mmc.sh b/target/linux/qualcommax/ipq807x/base-files/lib/upgrade/mmc.sh
deleted file mode 100644
index 21cd7928e303f4..00000000000000
--- a/target/linux/qualcommax/ipq807x/base-files/lib/upgrade/mmc.sh
+++ /dev/null
@@ -1,83 +0,0 @@
-#
-# Copyright (C) 2016 lede-project.org
-#
-
-# this can be used as a generic mmc upgrade script
-# just add a device entry in platform.sh, 
-# define "kernelname" and "rootfsname" and call mmc_do_upgrade
-# after the kernel and rootfs flash a loopdev (as overlay) is 
-# setup on top of the rootfs partition
-# for the proper function a padded rootfs image is needed, basically 
-# append "pad-to 64k" to the image definition
-# this is based on the ipq806x zyxel.sh mmc upgrade
-
-. /lib/functions.sh
-
-mmc_do_upgrade() {
-	local tar_file="$1"
-	local rootfs=
-	local kernel=
-
-	[ -z "$kernel" ] && kernel=$(find_mmc_part ${kernelname})
-	[ -z "$rootfs" ] && rootfs=$(find_mmc_part ${rootfsname})
-
-	[ -z "$kernel" ] && echo "Upgrade failed: kernel partition not found! Rebooting..." && reboot -f
-	[ -z "$rootfs" ] && echo "Upgrade failed: rootfs partition not found! Rebooting..." && reboot -f
-
-	mmc_do_flash $tar_file $kernel $rootfs
-
-	return 0
-}
-
-mmc_do_flash() {
-	local tar_file=$1
-	local kernel=$2
-	local rootfs=$3
-	
-	# keep sure its unbound
-	losetup --detach-all || {
-		echo Failed to detach all loop devices. Skip this try.
-		reboot -f
-	}
-
-	# use the first found directory in the tar archive
-	local board_dir=$(tar tf $tar_file | grep -m 1 '^sysupgrade-.*/$')
-	board_dir=${board_dir%/}
-
-	echo "flashing kernel to $kernel"
-	tar xf $tar_file ${board_dir}/kernel -O >$kernel
-
-	echo "flashing rootfs to ${rootfs}"
-	tar xf $tar_file ${board_dir}/root -O >"${rootfs}"
-
-	# a padded rootfs is needed for overlay fs creation
-	local offset=$(tar xf $tar_file ${board_dir}/root -O | wc -c)
-	[ $offset -lt 65536 ] && {
-		echo Wrong size for rootfs: $offset
-		sleep 10
-		reboot -f
-	}
-
-	# Mount loop for rootfs_data
-	local loopdev="$(losetup -f)"
-	losetup -o $offset $loopdev $rootfs || {
-		echo "Failed to mount looped rootfs_data."
-		sleep 10
-		reboot -f
-	}
-
-	echo "Format new rootfs_data at position ${offset}."
-	mkfs.ext4 -F -L rootfs_data $loopdev
-	mkdir /tmp/new_root
-	mount -t ext4 $loopdev /tmp/new_root && {
-		echo "Saving config to rootfs_data at position ${offset}."
-		cp -v "$UPGRADE_BACKUP" "/tmp/new_root/$BACKUP_FILE"
-		umount /tmp/new_root
-	}
-
-	# Cleanup
-	losetup -d $loopdev >/dev/null 2>&1
-	sync
-	umount -a
-	reboot -f
-}
diff --git a/target/linux/qualcommax/ipq807x/base-files/lib/upgrade/platform.sh b/target/linux/qualcommax/ipq807x/base-files/lib/upgrade/platform.sh
index 808acac684a216..0691c92184a394 100644
--- a/target/linux/qualcommax/ipq807x/base-files/lib/upgrade/platform.sh
+++ b/target/linux/qualcommax/ipq807x/base-files/lib/upgrade/platform.sh
@@ -168,6 +168,7 @@ platform_do_upgrade() {
 		;;
 	linksys,mx4200v1|\
 	linksys,mx4200v2|\
+	linksys,mx4300|\
 	linksys,mx5300|\
 	linksys,mx8500)
 		boot_part="$(fw_printenv -n boot_part)"
@@ -185,12 +186,9 @@ platform_do_upgrade() {
 		;;
 	prpl,haze|\
 	qnap,301w)
-		kernelname="0:HLOS"
-		rootfsname="rootfs"
-		mmc_do_upgrade "$1"
-		;;
-	tplink,eap660hd-v1)
-		tplink_do_upgrade "$1"
+		CI_KERNPART="0:HLOS"
+		CI_ROOTPART="rootfs"
+		emmc_do_upgrade "$1"
 		;;
 	redmi,ax6|\
 	xiaomi,ax3600|\
@@ -217,6 +215,9 @@ platform_do_upgrade() {
 		CI_DATAPART="rootfs_data"
 		emmc_do_upgrade "$1"
 		;;
+	tplink,eap660hd-v1)
+		tplink_do_upgrade "$1"
+		;;
 	yuncore,ax880)
 		active="$(fw_printenv -n active)"
 		if [ "$active" -eq "1" ]; then
@@ -251,14 +252,13 @@ platform_do_upgrade() {
 		[ -z "$config_mtdnum" ] && reboot
 		part_num="$(hexdump -e '1/1 "%01x|"' -n 1 -s 168 -C /dev/mtd$config_mtdnum | cut -f 1 -d "|" | head -n1)"
 		if [ "$part_num" -eq "0" ]; then
-			kernelname="0:HLOS"
-			rootfsname="rootfs"
-			mmc_do_upgrade "$1"
+			CI_KERNPART="0:HLOS"
+			CI_ROOTPART="rootfs"
 		else
-			kernelname="0:HLOS_1"
-			rootfsname="rootfs_1"
-			mmc_do_upgrade "$1"
+			CI_KERNPART="0:HLOS_1"
+			CI_ROOTPART="rootfs_1"
 		fi
+		emmc_do_upgrade "$1"
 		;;
 	*)
 		default_do_upgrade "$1"
@@ -268,7 +268,10 @@ platform_do_upgrade() {
 
 platform_copy_config() {
 	case "$(board_name)" in
-	spectrum,sax1v1k)
+	prpl,haze|\
+	qnap,301w|\
+	spectrum,sax1v1k|\
+	zyxel,nbg7815)
 		emmc_copy_config
 		;;
 	esac
diff --git a/target/linux/qualcommax/patches-6.6/0025-v6.7-cpufreq-qcom-nvmem-add-support-for-IPQ6018.patch b/target/linux/qualcommax/patches-6.6/0025-v6.7-cpufreq-qcom-nvmem-add-support-for-IPQ6018.patch
index 95c6c9505d666e..a6be040b590d25 100644
--- a/target/linux/qualcommax/patches-6.6/0025-v6.7-cpufreq-qcom-nvmem-add-support-for-IPQ6018.patch
+++ b/target/linux/qualcommax/patches-6.6/0025-v6.7-cpufreq-qcom-nvmem-add-support-for-IPQ6018.patch
@@ -25,7 +25,7 @@ Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
 
 --- a/drivers/cpufreq/cpufreq-dt-platdev.c
 +++ b/drivers/cpufreq/cpufreq-dt-platdev.c
-@@ -177,6 +177,7 @@ static const struct of_device_id blockli
+@@ -178,6 +178,7 @@ static const struct of_device_id blockli
  	{ .compatible = "ti,am625", },
  	{ .compatible = "ti,am62a7", },
  
diff --git a/target/linux/qualcommax/patches-6.6/0026-v6.7-cpufreq-qcom-nvmem-add-support-for-IPQ8074.patch b/target/linux/qualcommax/patches-6.6/0026-v6.7-cpufreq-qcom-nvmem-add-support-for-IPQ8074.patch
index 5640038404702b..dc706d061b2c20 100644
--- a/target/linux/qualcommax/patches-6.6/0026-v6.7-cpufreq-qcom-nvmem-add-support-for-IPQ8074.patch
+++ b/target/linux/qualcommax/patches-6.6/0026-v6.7-cpufreq-qcom-nvmem-add-support-for-IPQ8074.patch
@@ -25,7 +25,7 @@ Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
 
 --- a/drivers/cpufreq/cpufreq-dt-platdev.c
 +++ b/drivers/cpufreq/cpufreq-dt-platdev.c
-@@ -179,6 +179,7 @@ static const struct of_device_id blockli
+@@ -180,6 +180,7 @@ static const struct of_device_id blockli
  
  	{ .compatible = "qcom,ipq6018", },
  	{ .compatible = "qcom,ipq8064", },
diff --git a/target/linux/qualcommax/patches-6.6/0061-v6.8-phy-qcom-qmp-usb-fix-serdes-init-sequence-for-IPQ6018.patch b/target/linux/qualcommax/patches-6.6/0061-v6.8-phy-qcom-qmp-usb-fix-serdes-init-sequence-for-IPQ6018.patch
index 4082e3d8526b9d..95e9ca7253a5e4 100644
--- a/target/linux/qualcommax/patches-6.6/0061-v6.8-phy-qcom-qmp-usb-fix-serdes-init-sequence-for-IPQ6018.patch
+++ b/target/linux/qualcommax/patches-6.6/0061-v6.8-phy-qcom-qmp-usb-fix-serdes-init-sequence-for-IPQ6018.patch
@@ -47,7 +47,7 @@ Signed-off-by: Vinod Koul <vkoul@kernel.org>
  static const struct qmp_phy_cfg ipq8074_usb3phy_cfg = {
  	.lanes			= 1,
  
-@@ -2238,7 +2258,7 @@ err_node_put:
+@@ -2243,7 +2263,7 @@ err_node_put:
  static const struct of_device_id qmp_usb_of_match_table[] = {
  	{
  		.compatible = "qcom,ipq6018-qmp-usb3-phy",
diff --git a/target/linux/qualcommax/patches-6.6/0140-arm64-dts-qcom-ipq6018-add-NSS-reserved-memory.patch b/target/linux/qualcommax/patches-6.6/0140-arm64-dts-qcom-ipq6018-add-NSS-reserved-memory.patch
new file mode 100644
index 00000000000000..84591c845dc5e7
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0140-arm64-dts-qcom-ipq6018-add-NSS-reserved-memory.patch
@@ -0,0 +1,27 @@
+From 7e102b1eb2ca3eff7a6f33ebeab17825e6f70956 Mon Sep 17 00:00:00 2001
+From: Robert Marko <robimarko@gmail.com>
+Date: Mon, 4 Nov 2024 22:01:24 +0100
+Subject: [PATCH] arm64: dts: qcom: ipq6018: add NSS reserved memory
+
+It seems that despite NSS not being supported in OpenWrt the memory it
+usually uses needs to be reserved anyway for stability reasons.
+
+Signed-off-by: Robert Marko <robimarko@gmail.com>
+---
+ arch/arm64/boot/dts/qcom/ipq6018.dtsi | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
++++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
+@@ -199,6 +199,11 @@
+ 			no-map;
+ 		};
+ 
++		nss_region: memory@40000000 {
++			reg = <0x0 0x40000000 0x0 0x01000000>;
++			no-map;
++		};
++
+ 		bootloader@4a100000 {
+ 			reg = <0x0 0x4a100000 0x0 0x400000>;
+ 			no-map;
diff --git a/target/linux/qualcommax/patches-6.6/0900-power-Add-Qualcomm-APM.patch b/target/linux/qualcommax/patches-6.6/0900-power-Add-Qualcomm-APM.patch
index 2e5c72b7d1f6b7..f1053515844ada 100644
--- a/target/linux/qualcommax/patches-6.6/0900-power-Add-Qualcomm-APM.patch
+++ b/target/linux/qualcommax/patches-6.6/0900-power-Add-Qualcomm-APM.patch
@@ -49,7 +49,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 +obj-$(CONFIG_QCOM_APM)		+= apm.o
 --- /dev/null
 +++ b/drivers/power/qcom/apm.c
-@@ -0,0 +1,944 @@
+@@ -0,0 +1,943 @@
 +/*
 + * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
 + *
@@ -971,7 +971,6 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 +	.driver		= {
 +		.name		= MSM_APM_DRIVER_NAME,
 +		.of_match_table	= msm_apm_match_table,
-+		.owner		= THIS_MODULE,
 +	},
 +	.probe		= msm_apm_probe,
 +	.remove		= msm_apm_remove,
diff --git a/target/linux/qualcommax/patches-6.6/0901-regulator-add-Qualcomm-CPR-regulators.patch b/target/linux/qualcommax/patches-6.6/0901-regulator-add-Qualcomm-CPR-regulators.patch
index c85be0357c1fad..46d4fc246fbdc1 100644
--- a/target/linux/qualcommax/patches-6.6/0901-regulator-add-Qualcomm-CPR-regulators.patch
+++ b/target/linux/qualcommax/patches-6.6/0901-regulator-add-Qualcomm-CPR-regulators.patch
@@ -77,7 +77,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
  obj-$(CONFIG_REGULATOR_PF8X00) += pf8x00-regulator.o
 --- /dev/null
 +++ b/drivers/regulator/cpr3-npu-regulator.c
-@@ -0,0 +1,695 @@
+@@ -0,0 +1,694 @@
 +/*
 + * Copyright (c) 2017, The Linux Foundation. All rights reserved.
 + *
@@ -752,7 +752,6 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 +	.driver		= {
 +		.name		= "qcom,cpr3-npu-regulator",
 +		.of_match_table	= cpr3_regulator_match_table,
-+		.owner		= THIS_MODULE,
 +	},
 +	.probe		= cpr3_npu_regulator_probe,
 +	.remove		= cpr3_npu_regulator_remove,
@@ -9866,7 +9865,7 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 +}
 --- /dev/null
 +++ b/drivers/regulator/cpr4-apss-regulator.c
-@@ -0,0 +1,1819 @@
+@@ -0,0 +1,1818 @@
 +/*
 + * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
 + *
@@ -11663,7 +11662,6 @@ Signed-off-by: Robert Marko <robimarko@gmail.com>
 +	.driver		= {
 +		.name		= "qcom,cpr4-apss-regulator",
 +		.of_match_table	= cpr4_regulator_match_table,
-+		.owner		= THIS_MODULE,
 +	},
 +	.probe		= cpr4_apss_regulator_probe,
 +	.remove		= cpr4_apss_regulator_remove,
diff --git a/target/linux/qualcommax/patches-6.6/0906-arm64-dts-qcom-ipq6018-add-wifi-node.patch b/target/linux/qualcommax/patches-6.6/0906-arm64-dts-qcom-ipq6018-add-wifi-node.patch
index f4968f1a4d1c99..d41244d65a6f39 100644
--- a/target/linux/qualcommax/patches-6.6/0906-arm64-dts-qcom-ipq6018-add-wifi-node.patch
+++ b/target/linux/qualcommax/patches-6.6/0906-arm64-dts-qcom-ipq6018-add-wifi-node.patch
@@ -15,7 +15,7 @@ Signed-off-by: Mantas Pucka <mantas@8devices.com>
 
 --- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
 +++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
-@@ -809,6 +809,102 @@
+@@ -814,6 +814,102 @@
  			};
  		};
  
diff --git a/target/linux/qualcommax/patches-6.6/0907-soc-qcom-fix-smp2p-ack-on-ipq6018.patch b/target/linux/qualcommax/patches-6.6/0907-soc-qcom-fix-smp2p-ack-on-ipq6018.patch
index 094442a59bec6b..5154aad53163db 100644
--- a/target/linux/qualcommax/patches-6.6/0907-soc-qcom-fix-smp2p-ack-on-ipq6018.patch
+++ b/target/linux/qualcommax/patches-6.6/0907-soc-qcom-fix-smp2p-ack-on-ipq6018.patch
@@ -15,7 +15,7 @@ Signed-off-by: Mantas Pucka <mantas@8devices.com>
 
 --- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
 +++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
-@@ -1157,6 +1157,7 @@
+@@ -1162,6 +1162,7 @@
  
  		wcss_smp2p_out: master-kernel {
  			qcom,entry-name = "master-kernel";
diff --git a/target/linux/qualcommax/patches-6.6/0909-arm64-dts-qcom-ipq6018-assign-QDSS_AT-clock-to-wifi-.patch b/target/linux/qualcommax/patches-6.6/0909-arm64-dts-qcom-ipq6018-assign-QDSS_AT-clock-to-wifi-.patch
index a0528e7f50a21a..993d60870b82ce 100644
--- a/target/linux/qualcommax/patches-6.6/0909-arm64-dts-qcom-ipq6018-assign-QDSS_AT-clock-to-wifi-.patch
+++ b/target/linux/qualcommax/patches-6.6/0909-arm64-dts-qcom-ipq6018-assign-QDSS_AT-clock-to-wifi-.patch
@@ -13,7 +13,7 @@ Signed-off-by: Mantas Pucka <mantas@8devices.com>
 
 --- a/arch/arm64/boot/dts/qcom/ipq6018.dtsi
 +++ b/arch/arm64/boot/dts/qcom/ipq6018.dtsi
-@@ -930,8 +930,8 @@
+@@ -935,8 +935,8 @@
  				      "wcss_reset",
  				      "wcss_q6_reset";
  
diff --git a/target/linux/qualcommax/patches-6.6/0911-arm64-cmdline-replacement.patch b/target/linux/qualcommax/patches-6.6/0911-arm64-cmdline-replacement.patch
new file mode 100644
index 00000000000000..afc71bf995582b
--- /dev/null
+++ b/target/linux/qualcommax/patches-6.6/0911-arm64-cmdline-replacement.patch
@@ -0,0 +1,105 @@
+Subject: qualcommax: add kernel cmdline replacement hack 
+
+Add kernel command line replacement hack to qualcommax. Now we can
+find and replace arguments in the kernel command line by setting
+bootargs-find-1, bootargs-replace-1, bootargs-exact-match-1
+and bootargs-find-2, bootargs-replace-2, bootargs-exact-match-2
+under the chosen node in the device tree.
+
+This hack replaces the first occurence of bootargs-find-X with
+bootargs-replace-X. If bootargs-exact-match-X is set to "y",
+then the replacement happens only if the kernel command line is
+identical to bootargs-find-X.
+
+Signed-off-by: Qiyuan Zhang <zhang.github@outlook.com>
+---
+ drivers/of/fdt.c |   71 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 71 insertions(+)
+
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -1158,6 +1158,14 @@ int __init early_init_dt_scan_chosen(cha
+ 	const void *rng_seed;
+ 	const void *fdt = initial_boot_params;
+ 
++	int i, cmd_len, f_len, r_len, offset, step;
++	char *s_ptr, *l_end, *r_end, *cur_ptr, *end_ptr;
++	const char *exact_match;
++	const int bootargs_replace_num = 2;
++	const char *bootargs_replace_props[2][3] =
++		{ {"bootargs-find-1", "bootargs-replace-1", "bootargs-exact-match-1"},
++		{"bootargs-find-2", "bootargs-replace-2", "bootargs-exact-match-2"} };
++
+ 	node = fdt_path_offset(fdt, "/chosen");
+ 	if (node < 0)
+ 		node = fdt_path_offset(fdt, "/chosen@0");
+@@ -1186,6 +1194,69 @@ int __init early_init_dt_scan_chosen(cha
+ 	p = of_get_flat_dt_prop(node, "bootargs", &l);
+ 	if (p != NULL && l > 0)
+ 		strscpy(cmdline, p, min(l, COMMAND_LINE_SIZE));
++
++	for(i = 0; i < bootargs_replace_num; i++) {
++		p = of_get_flat_dt_prop(node, bootargs_replace_props[i][0], &f_len);
++
++		if (p == NULL || f_len == 0 )
++			continue;
++
++		exact_match = of_get_flat_dt_prop(node, bootargs_replace_props[i][2], &l);
++
++		if (exact_match != NULL && l > 0 && exact_match[0] == 'y') {
++			if(strncmp(cmdline, p, r_len) == 0)
++				s_ptr = cmdline;
++			else
++				s_ptr = NULL;
++		} else {
++			s_ptr = strstr(cmdline, p);
++		}
++
++		if(!s_ptr)
++			continue;
++
++		p = of_get_flat_dt_prop(node, bootargs_replace_props[i][1], &r_len);
++
++		if (p == NULL || r_len == 0)
++			continue;
++
++		pr_info("Input kernel commad line: %s\n", cmdline);
++
++		cmd_len = strlen(cmdline);
++
++		if (cmd_len - f_len + r_len < COMMAND_LINE_SIZE) {
++
++			pr_info("Replace kernel command line with %s\n", bootargs_replace_props[i][1]);
++
++			offset = r_len - f_len;
++
++			if (offset != 0) {
++				l_end = s_ptr + f_len -	1;
++				r_end = cmdline + cmd_len;
++
++				if (offset > 0) {
++					step = -1;
++					cur_ptr = r_end;
++					end_ptr = l_end + step;
++				} else {
++					step = 1;
++					cur_ptr = l_end;
++					end_ptr = r_end + step;
++				}
++
++				for (; cur_ptr != end_ptr; cur_ptr += step)
++					*(cur_ptr + offset) = *cur_ptr;
++			}
++
++			strncpy(s_ptr, p, r_len - 1);
++
++			pr_info("Kernel command line after replacement: %s\n", cmdline);
++		} else {
++			pr_err("Replace kernel command line with %s failed\n", bootargs_replace_props[i][1]);
++		}
++
++	}
++
+ 	p = of_get_flat_dt_prop(node, "bootargs-append", &l);
+ 	if (p != NULL && l > 0)
+ 		strlcat(cmdline, p, min_t(int, strlen(cmdline) + (int)l, COMMAND_LINE_SIZE));
diff --git a/target/linux/ramips/dts/mt7620a.dtsi b/target/linux/ramips/dts/mt7620a.dtsi
index bcc7f4be3fa967..0555674802c0a3 100644
--- a/target/linux/ramips/dts/mt7620a.dtsi
+++ b/target/linux/ramips/dts/mt7620a.dtsi
@@ -32,13 +32,6 @@
 		compatible = "mti,cpu-interrupt-controller";
 	};
 
-	mmc_clk: mmc-clock {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-frequency = <48000000>;
-		clock-accuracy = <100>;
-	};
-
 	mmc_reg_1v8: regulator-1v8 {
 		compatible = "regulator-fixed";
 
@@ -80,7 +73,7 @@
 			compatible = "ralink,rt2880-timer";
 			reg = <0x100 0x20>;
 
-			clocks = <&sysc 5>;
+			clocks = <&sysc 7>;
 
 			interrupt-parent = <&intc>;
 			interrupts = <1>;
@@ -90,7 +83,7 @@
 			compatible = "ralink,rt2880-wdt";
 			reg = <0x120 0x10>;
 
-			clocks = <&sysc 6>;
+			clocks = <&sysc 8>;
 
 			resets = <&sysc 8>;
 			reset-names = "wdt";
@@ -122,7 +115,7 @@
 			compatible = "ralink,mt7620a-uart", "ralink,rt2880-uart", "ns16550a";
 			reg = <0x500 0x100>;
 
-			clocks = <&sysc 7>;
+			clocks = <&sysc 9>;
 
 			resets = <&sysc 12>;
 
@@ -216,7 +209,7 @@
 			compatible = "ralink,rt2880-i2c";
 			reg = <0x900 0x100>;
 
-			clocks = <&sysc 8>;
+			clocks = <&sysc 10>;
 
 			resets = <&sysc 16>;
 			reset-names = "i2c";
@@ -234,7 +227,7 @@
 			compatible = "mediatek,mt7620-i2s";
 			reg = <0xa00 0x100>;
 
-			clocks = <&sysc 9>;
+			clocks = <&sysc 11>;
 
 			resets = <&sysc 17>;
 			reset-names = "i2s";
@@ -256,7 +249,7 @@
 			compatible = "ralink,rt2880-spi";
 			reg = <0xb00 0x40>;
 
-			clocks = <&sysc 10>;
+			clocks = <&sysc 12>;
 
 			resets = <&sysc 18>;
 			reset-names = "spi";
@@ -274,7 +267,7 @@
 			compatible = "ralink,rt2880-spi";
 			reg = <0xb40 0x60>;
 
-			clocks = <&sysc 11>;
+			clocks = <&sysc 13>;
 
 			resets = <&sysc 18>;
 			reset-names = "spi";
@@ -292,7 +285,7 @@
 			compatible = "ralink,mt7620a-uart", "ralink,rt2880-uart", "ns16550a";
 			reg = <0xc00 0x100>;
 
-			clocks = <&sysc 12>;
+			clocks = <&sysc 14>;
 
 			resets = <&sysc 19>;
 
@@ -539,7 +532,7 @@
 		cap-mmc-highspeed;
 		cap-sd-highspeed;
 
-		clocks = <&mmc_clk>, <&mmc_clk>;
+		clocks = <&sysc 15>, <&sysc 15>;
 		clock-names = "source", "hclk";
 
 		disable-wp;
@@ -547,7 +540,7 @@
 		interrupt-parent = <&intc>;
 		interrupts = <14>;
 
-		max-frequency = <48000000>;
+		max-frequency = <24000000>;
 
 		pinctrl-names = "default", "state_uhs";
 		pinctrl-0 = <&sdhci_pins>;
@@ -645,7 +638,7 @@
 		compatible = "ralink,rt7620-wmac", "ralink,rt2880-wmac";
 		reg = <0x10180000 0x40000>;
 
-		clocks = <&sysc 13>;
+		clocks = <&sysc 16>;
 
 		interrupt-parent = <&cpuintc>;
 		interrupts = <6>;
diff --git a/target/linux/ramips/dts/mt7620a_hiwifi_hc5861.dts b/target/linux/ramips/dts/mt7620a_hiwifi_hc5861.dts
index 29aff9958a8797..2cb7017972e206 100644
--- a/target/linux/ramips/dts/mt7620a_hiwifi_hc5861.dts
+++ b/target/linux/ramips/dts/mt7620a_hiwifi_hc5861.dts
@@ -108,10 +108,6 @@
 	};
 };
 
-&sdhci {
-	max-frequency = <24000000>;
-};
-
 &wmac {
 	pinctrl-names = "default", "pa_gpio";
 	pinctrl-0 = <&pa_pins>;
diff --git a/target/linux/ramips/dts/mt7620a_hongdian_h8922-v30.dts b/target/linux/ramips/dts/mt7620a_hongdian_h8922-v30.dts
new file mode 100644
index 00000000000000..64c19a6012d265
--- /dev/null
+++ b/target/linux/ramips/dts/mt7620a_hongdian_h8922-v30.dts
@@ -0,0 +1,189 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7620a.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "hongdian,h8922-v30", "ralink,mt7620a-soc";
+	model = "Hongdian H8922 v30";
+
+	aliases {
+		led-boot = &led_sys;
+		led-failsafe = &led_sys;
+		led-running = &led_sys;
+		led-upgrade = &led_sys;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-wps {
+			gpios = <&gpio0 12 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WPS;
+		};
+
+		led-rf-2 {
+			gpios = <&gpio1 0 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = "rf";
+			function-enumerator = <2>;
+		};
+
+		led_sys: led-sys {
+			gpios = <&gpio1 2 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+			default-state = "on";
+		};
+
+		led-net-1 {
+			gpios = <&gpio2 26 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_MOBILE;
+			function-enumerator = <1>;
+		};
+
+		led-rf-1 {
+			gpios = <&gpio2 27 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = "rf";
+			function-enumerator = <1>;
+		};
+
+		led-net-2 {
+			gpios = <&gpio2 31 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_MOBILE;
+			function-enumerator = <2>;
+		};
+
+		led-wlan {
+			gpios = <&gpio3 0 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN;
+			linux,default-trigger = "phy0tpt";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio1 10 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	watchdog {
+		compatible = "linux,wdt-gpio";
+
+		gpios = <&gpio2 22 GPIO_ACTIVE_HIGH>;
+		hw_algo = "toggle";
+		hw_margin_ms = <600>;
+		always-running;
+	};
+};
+
+&watchdog {
+	status = "disabled";
+};
+
+&gpio1 {
+	status = "okay";
+};
+
+&gpio2 {
+	status = "okay";
+};
+
+&gpio3 {
+	status = "okay";
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <50000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x2f000>;
+				read-only;
+			};
+
+			partition@2f000 {
+				label = "u-boot-env";
+				reg = <0x2f000 0x1000>;
+				read-only;
+			};
+
+			partition@30000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x30000 0xffd000>;
+			};
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "uartf", "wled", "rgmii1", "rgmii2";
+		function = "gpio";
+	};
+};
+
+&ethernet {
+	pinctrl-names = "default";
+	pinctrl-0 = <&ephy_pins>;
+
+	mediatek,portmap = "llllw";
+};
+
+&pcie {
+	status = "okay";
+};
+
+&wmac {
+	ralink,eeprom-data = <0x20760501 0x000c4376 0x2058ffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0x000c4376 0x2077000c 0x43762066 0x220c0000 0xffffb701 0x5577a8aa
+			      0x8c88ffff 0x0a000000 0x00000000 0x0000ffff 0xffff0a0a 0x0a0a0808 0x08080808 0x08080808
+			      0x0e0e0e0e 0x0e0e0e0e 0x0e0e0e0e 0x0e0e80ff 0xffff80ff 0xffff0000 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0x20ffffff 0xffffffff 0xffffffff 0xffff0606
+			      0x06060402 0x06060400 0x06060400 0x07070400 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff
+			      0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff>;
+};
+
+&ehci {
+	status = "okay";
+};
+
+&ohci {
+	status = "okay";
+};
diff --git a/target/linux/ramips/dts/mt7620a_linksys_e1700.dts b/target/linux/ramips/dts/mt7620a_linksys_e1700.dts
index caa6780d600a4d..4dca56cd7eee8f 100644
--- a/target/linux/ramips/dts/mt7620a_linksys_e1700.dts
+++ b/target/linux/ramips/dts/mt7620a_linksys_e1700.dts
@@ -167,6 +167,10 @@
 };
 
 &wmac {
+	pinctrl-names = "default", "pa_gpio";
+	pinctrl-0 = <&pa_pins>;
+	pinctrl-1 = <&pa_gpio_pins>;
+
 	nvmem-cells = <&eeprom_factory_0>;
 	nvmem-cell-names = "eeprom";
 };
diff --git a/target/linux/ramips/dts/mt7620n.dtsi b/target/linux/ramips/dts/mt7620n.dtsi
index b284119961418a..64dbd0a50ea635 100644
--- a/target/linux/ramips/dts/mt7620n.dtsi
+++ b/target/linux/ramips/dts/mt7620n.dtsi
@@ -51,7 +51,7 @@
 			compatible = "ralink,rt2880-timer";
 			reg = <0x100 0x20>;
 
-			clocks = <&sysc 5>;
+			clocks = <&sysc 7>;
 
 			interrupt-parent = <&intc>;
 			interrupts = <1>;
@@ -61,7 +61,7 @@
 			compatible = "ralink,rt2880-wdt";
 			reg = <0x120 0x10>;
 
-			clocks = <&sysc 6>;
+			clocks = <&sysc 8>;
 
 			resets = <&sysc 8>;
 			reset-names = "wdt";
@@ -171,7 +171,7 @@
 			compatible = "ralink,rt2880-i2c";
 			reg = <0x900 0x100>;
 
-			clocks = <&sysc 8>;
+			clocks = <&sysc 10>;
 
 			resets = <&sysc 16>;
 			reset-names = "i2c";
@@ -189,7 +189,7 @@
 			compatible = "ralink,rt2880-spi";
 			reg = <0xb00 0x40>;
 
-			clocks = <&sysc 10>;
+			clocks = <&sysc 12>;
 
 			resets = <&sysc 18>;
 			reset-names = "spi";
@@ -207,7 +207,7 @@
 			compatible = "ralink,rt2880-spi";
 			reg = <0xb40 0x60>;
 
-			clocks = <&sysc 11>;
+			clocks = <&sysc 13>;
 
 			resets = <&sysc 18>;
 			reset-names = "spi";
@@ -225,7 +225,7 @@
 			compatible = "ralink,mt7620a-uart", "ralink,rt2880-uart", "ns16550a";
 			reg = <0xc00 0x100>;
 
-			clocks = <&sysc 12>;
+			clocks = <&sysc 14>;
 
 			resets = <&sysc 19>;
 
@@ -372,7 +372,7 @@
 		compatible = "ralink,rt7620-wmac", "ralink,rt2880-wmac";
 		reg = <0x10180000 0x40000>;
 
-		clocks = <&sysc 13>;
+		clocks = <&sysc 16>;
 
 		interrupt-parent = <&cpuintc>;
 		interrupts = <6>;
diff --git a/target/linux/ramips/dts/mt7621.dtsi b/target/linux/ramips/dts/mt7621.dtsi
index da992bada4f3b1..da03d47ff6b7bf 100644
--- a/target/linux/ramips/dts/mt7621.dtsi
+++ b/target/linux/ramips/dts/mt7621.dtsi
@@ -522,26 +522,36 @@
 					ethphy0: ethernet-phy@0 {
 						reg = <0>;
 						interrupts = <0>;
+						eee-broken-100tx;
+						eee-broken-1000t;
 					};
 
 					ethphy1: ethernet-phy@1 {
 						reg = <1>;
 						interrupts = <1>;
+						eee-broken-100tx;
+						eee-broken-1000t;
 					};
 
 					ethphy2: ethernet-phy@2 {
 						reg = <2>;
 						interrupts = <2>;
+						eee-broken-100tx;
+						eee-broken-1000t;
 					};
 
 					ethphy3: ethernet-phy@3 {
 						reg = <3>;
 						interrupts = <3>;
+						eee-broken-100tx;
+						eee-broken-1000t;
 					};
 
 					ethphy4: ethernet-phy@4 {
 						reg = <4>;
 						interrupts = <4>;
+						eee-broken-100tx;
+						eee-broken-1000t;
 					};
 				};
 
diff --git a/target/linux/ramips/dts/mt7621_arcadyan_we410443.dts b/target/linux/ramips/dts/mt7621_arcadyan_we410443.dts
new file mode 100755
index 00000000000000..ddcf37fdb03659
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_arcadyan_we410443.dts
@@ -0,0 +1,197 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	model = "Arcadyan WE410443";
+	compatible = "arcadyan,we410443", "mediatek,mt7621-soc";
+
+	aliases {
+		led-boot = &led_status_green;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_blue;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_blue: blue {
+			color = <LED_COLOR_ID_BLUE>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 41 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_green: green {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 42 GPIO_ACTIVE_HIGH>;
+		};
+
+		led_status_red: red {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 44 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <50000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "all";
+				reg = <0x0 0x2000000>;
+				read-only;
+			};
+
+			partition@1 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x4da8>;
+					};
+
+					eeprom_factory_8000: eeprom@8000 {
+						reg = <0x8000 0x4da8>;
+					};
+				};
+			};
+
+			partition@50000 {
+				compatible = "fixed-partitions";
+				label = "firmware";
+				reg = <0x50000 0x1f60000>;
+				#address-cells = <1>;
+				#size-cells = <1>;
+
+				partition@0 {
+					label = "kernel";
+					reg = <0x0 0x440000>;
+				};
+
+				partition@400000 {
+					label = "rootfs";
+					reg = <0x440000 0x1b20000>;
+				};
+			};
+
+			partition@1fb0000 {
+				label = "glbcfg";
+				reg = <0x1fb0000 0x10000>;
+				read-only;
+			};
+
+			partition@1fc0000 {
+				label = "config";
+				reg = <0x1fc0000 0x10000>;
+				read-only;
+			};
+
+			partition@1fd0000 {
+				label = "glbcfg2";
+				reg = <0x1fd0000 0x10000>;
+				read-only;
+			};
+
+			partition@1fe0000 {
+				label = "config2";
+				reg = <0x1fe0000 0x10000>;
+				read-only;
+			};
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&eeprom_factory_0>;
+		nvmem-cell-names = "eeprom";
+		ieee80211-freq-limit = <2400000 2500000>;
+	};
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&eeprom_factory_8000>;
+		nvmem-cell-names = "eeprom";
+		ieee80211-freq-limit = <5000000 6000000>;
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "wdt", "sdhci";
+		function = "gpio";
+	};
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan";
+		};
+	};
+};
+
+&xhci {
+	status = "disabled";
+};
diff --git a/target/linux/ramips/dts/mt7621_confiabits_mt7621-v1.dts b/target/linux/ramips/dts/mt7621_confiabits_mt7621-v1.dts
new file mode 100644
index 00000000000000..858747ecada399
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_confiabits_mt7621-v1.dts
@@ -0,0 +1,215 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "confiabits,mt7621-v1", "mediatek,mt7621-soc";
+	model = "Confiabits MT7621 v1";
+
+	aliases {
+		led-boot = &led_power_green;
+		led-failsafe = &led_power_green;
+		led-running = &led_power_green;
+		led-upgrade = &led_power_green;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,57600";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		button-wps {
+			label = "wps";
+			gpios = <&gpio 13 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+
+		button-reset {
+			label = "reset";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			debounce-interval = <60>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_power_green: led-power-green {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+		};
+
+		led-wan-red {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+		};
+
+		led-wlan5 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN_5GHZ;
+			gpios = <&gpio 14 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy1tpt";
+		};
+
+		led-wps {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WPS;
+			gpios = <&gpio 15 GPIO_ACTIVE_LOW>;
+		};
+
+		led-wlan24 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN_2GHZ;
+			gpios = <&gpio 16 GPIO_ACTIVE_LOW>;
+			linux,default-trigger = "phy0tpt";
+		};
+
+		led-wan-green {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WAN;
+			gpios = <&gpio 17 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <40000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "radio";
+				reg = <0x40000 0x10000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_radio_0: eeprom@0 {
+						reg = <0x0 0x400>;
+					};
+
+					eeprom_radio_8000: eeprom@8000 {
+						reg = <0x8000 0x4da8>;
+					};
+
+					macaddr_radio_4: macaddr@4 {
+						reg = <0x4 0x6>;
+					};
+
+					macaddr_radio_8004: macaddr@8004 {
+						reg = <0x8004 0x6>;
+					};
+				};
+			};
+
+			partition@50000 {
+				label = "firmware";
+				compatible = "denx,uimage";
+				reg = <0x50000 0xfb0000>;
+			};
+		};
+	};
+};
+
+&gmac0 {
+	nvmem-cells = <&macaddr_radio_4>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy4>;
+
+	nvmem-cells = <&macaddr_radio_4>;
+	nvmem-cell-names = "mac-address";
+};
+
+&ethphy4 {
+	/delete-property/ interrupts;
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		ieee80211-freq-limit = <2400000 2500000>;
+
+		nvmem-cells = <&eeprom_radio_0>;
+		nvmem-cell-names = "eeprom";
+	};
+};
+
+&pcie1 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		ieee80211-freq-limit = <5000000 6000000>;
+
+		nvmem-cells = <&eeprom_radio_8000>;
+		nvmem-cell-names = "eeprom";
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "jtag", "wdt";
+		function = "gpio";
+	};
+};
+
+&switch0 {
+	ports {
+		port@0 {
+			status = "okay";
+			label = "lan1";
+		};
+
+		port@1 {
+			status = "okay";
+			label = "lan2";
+		};
+
+		port@2 {
+			status = "okay";
+			label = "lan3";
+		};
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_cudy_m1300-v2.dts b/target/linux/ramips/dts/mt7621_cudy_m1300-v2.dts
new file mode 100644
index 00000000000000..f988b3375bb180
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_cudy_m1300-v2.dts
@@ -0,0 +1,201 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+#include <dt-bindings/gpio/gpio.h>
+
+/ {
+	compatible = "cudy,m1300-v2", "mediatek,mt7621-soc";
+	model = "Cudy M1300 v2";
+};
+
+/ {
+	aliases {
+		led-boot = &led_status_white;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_white;
+		led-upgrade = &led_status_red;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+		wps {
+			label = "wps";
+			gpios = <&gpio 10 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_WPS_BUTTON>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_red: led-status-red {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_white: led-status-white {
+			color = <LED_COLOR_ID_WHITE>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x400>;
+					};
+
+					eeprom_factory_8000: eeprom@8000 {
+						reg = <0x8000 0x4da8>;
+					};
+				};
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0xf80000>;
+			};
+
+			partition@fd0000 {
+				label = "debug";
+				reg = <0xfd0000 0x10000>;
+				read-only;
+			};
+
+			partition@fe0000 {
+				label = "backup";
+				reg = <0xfe0000 0x10000>;
+				read-only;
+			};
+
+			partition@ff0000 {
+				label = "bdinfo";
+				reg = <0xff0000 0x10000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_bdinfo_de00: macaddr@de00 {
+						compatible = "mac-base";
+						reg = <0xde00 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+		};
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+       wifi@0,0 {
+               compatible = "mediatek,mt76";
+               reg = <0x0000 0 0 0 0>;
+               nvmem-cells = <&eeprom_factory_0>, <&macaddr_bdinfo_de00 0>;
+               nvmem-cell-names = "eeprom", "mac-address";
+               ieee80211-freq-limit = <2400000 2500000>;
+       };
+};
+
+&pcie1 {
+       wifi@0,0 {
+               compatible = "mediatek,mt76";
+               reg = <0x0000 0 0 0 0>;
+               nvmem-cells = <&eeprom_factory_8000>, <&macaddr_bdinfo_de00 2>;
+               nvmem-cell-names = "eeprom", "mac-address";
+               ieee80211-freq-limit = <5000000 6000000>;
+       };
+};
+
+
+&gmac0 {
+	nvmem-cells = <&macaddr_bdinfo_de00 0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&gmac1 {
+	status = "okay";
+	label = "wan";
+	phy-handle = <&ethphy4>;
+
+	nvmem-cells = <&macaddr_bdinfo_de00 2>;
+	nvmem-cell-names = "mac-address";
+};
+
+&ethphy4 {
+	/delete-property/ interrupts;
+};
+
+&switch0 {
+	ports {
+		port@3 {
+			status = "okay";
+			label = "lan";
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "wdt", "jtag";
+		function = "gpio";
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_d-team_newifi-d2.dts b/target/linux/ramips/dts/mt7621_d-team_newifi-d2.dts
index 9d426fb17df106..cba4ceae72810a 100644
--- a/target/linux/ramips/dts/mt7621_d-team_newifi-d2.dts
+++ b/target/linux/ramips/dts/mt7621_d-team_newifi-d2.dts
@@ -80,15 +80,14 @@
 		};
 	};
 
-	gpio_export {
-		compatible = "gpio-export";
-		#size-cells = <0>;
-
-		power_usb3 {
-			gpio-export,name = "power_usb3";
-			gpio-export,output = <1>;
-			gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
-		};
+	reg_power_usb3: regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "power_usb3";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+		regulator-boot-on;
 	};
 };
 
@@ -155,6 +154,10 @@
 	};
 };
 
+&xhci {
+	vbus-supply = <&reg_power_usb3>;
+};
+
 &pcie {
 	status = "okay";
 };
diff --git a/target/linux/ramips/dts/mt7621_dna_valokuitu-plus-ex400.dts b/target/linux/ramips/dts/mt7621_dna_valokuitu-plus-ex400.dts
index cc5b4b71d07e45..e06da71d76fca4 100644
--- a/target/linux/ramips/dts/mt7621_dna_valokuitu-plus-ex400.dts
+++ b/target/linux/ramips/dts/mt7621_dna_valokuitu-plus-ex400.dts
@@ -1,131 +1,23 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
-#include "mt7621.dtsi"
-
-#include <dt-bindings/gpio/gpio.h>
-#include <dt-bindings/input/input.h>
-#include <dt-bindings/leds/common.h>
+#include "mt7621_genexis_pulse-ex400-common.dtsi"
 
 / {
 	compatible = "dna,valokuitu-plus-ex400", "mediatek,mt7621-soc";
 	model = "DNA Valokuitu Plus EX400";
 
 	aliases {
-		ethernet0 = &gmac0;
-		label-mac-device = &gmac0;
 		led-boot = &led_status_red;
 		led-failsafe = &led_status_red;
 		led-running = &led_status_green;
 		led-upgrade = &led_update_green;
 	};
+};
 
-	chosen {
-		bootargs-override = "console=ttyS0,115200 rootfstype=squashfs,jffs2";
-	};
-
-	keys {
-		compatible = "gpio-keys";
-
-		reset {
-			label = "reset";
-			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
-			linux,code = <KEY_RESTART>;
-		};
-	};
-
-	leds {
-		compatible = "gpio-leds";
-
-		led_status_green: led-0 {
-			color = <LED_COLOR_ID_GREEN>;
-			function = LED_FUNCTION_STATUS;
-			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
-		};
-
-		led_status_red: led-1 {
-			color = <LED_COLOR_ID_RED>;
-			function = LED_FUNCTION_STATUS;
-			gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
-		};
-
+&leds {
 		led_update_green: led-2 {
 			color = <LED_COLOR_ID_GREEN>;
 			function = LED_FUNCTION_PROGRAMMING;
 			gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
 		};
-	};
-};
-
-&pcie {
-	status = "okay";
-};
-
-&nand {
-	status = "okay";
-
-	partitions {
-		compatible = "fixed-partitions";
-		#address-cells = <1>;
-		#size-cells = <1>;
-
-		partition@0 {
-			reg = <0x00 0x100000>;
-			label = "uboot";
-			read-only;
-		};
-
-		partition@100000 {
-			reg = <0x100000 0xff00000>;
-			label = "ubi";
-			compatible = "linux,ubi";
-
-			volumes {
-				ubi-volume-env1 {
-					volname = "env1";
-
-					nvmem-layout {
-						compatible = "u-boot,env-redundant-count";
-
-						ethaddr: ethaddr {
-							#nvmem-cell-cells = <1>;
-						};
-					};
-				};
-			};
-		};
-	};
-};
-
-&gmac1 {
-	label = "wan";
-	phy-handle = <&ethphy0>;
-	nvmem-cells = <&ethaddr 1>;
-	nvmem-cell-names = "mac-address";
-	status = "okay";
-};
-
-&i2c {
-	status = "okay";
-};
-
-&ethphy0 {
-	/delete-property/ interrupts;
-};
-
-&state_default {
-	gpio {
-		groups = "uart2", "uart3";
-		function = "gpio";
-	};
-};
-
-&switch0 {
-	ports {
-		port@1 {
-			label = "lan";
-			nvmem-cells = <&ethaddr 0>;
-			nvmem-cell-names = "mac-address";
-			status = "okay";
-		};
-	};
 };
diff --git a/target/linux/ramips/dts/mt7621_genexis_pulse-ex400-common.dtsi b/target/linux/ramips/dts/mt7621_genexis_pulse-ex400-common.dtsi
new file mode 100644
index 00000000000000..ebcf558359b426
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_genexis_pulse-ex400-common.dtsi
@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	aliases {
+		ethernet0 = &gmac0;
+		label-mac-device = &gmac0;
+	};
+
+	chosen {
+		bootargs-override = "console=ttyS0,115200 rootfstype=squashfs,jffs2";
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 18 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	leds: leds {
+		compatible = "gpio-leds";
+
+		led_status_green: led-0 {
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 8 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_red: led-1 {
+			color = <LED_COLOR_ID_RED>;
+			function = LED_FUNCTION_STATUS;
+			gpios = <&gpio 11 GPIO_ACTIVE_HIGH>;
+		};
+	};
+
+	i2c_gpio: i2c-gpio {
+		compatible = "i2c-gpio";
+
+		sda-gpios = <&gpio 3 GPIO_ACTIVE_HIGH>;
+		scl-gpios = <&gpio 4 GPIO_ACTIVE_HIGH>;
+
+		i2c-gpio,delay-us = <50>;
+		i2c-gpio,timeout-ms = <100>;
+
+		/* Semtech SX9512 */
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&nand {
+	status = "okay";
+
+	partitions {
+		compatible = "fixed-partitions";
+		#address-cells = <1>;
+		#size-cells = <1>;
+
+		partition@0 {
+			reg = <0x00 0x100000>;
+			label = "uboot";
+			read-only;
+		};
+
+		partition@100000 {
+			reg = <0x100000 0xff00000>;
+			label = "ubi";
+			compatible = "linux,ubi";
+
+			volumes {
+				ubi-volume-env1 {
+					volname = "env1";
+
+					nvmem-layout {
+						compatible = "u-boot,env-redundant-count";
+
+						ethaddr: ethaddr {
+							#nvmem-cell-cells = <1>;
+						};
+					};
+				};
+			};
+		};
+	};
+};
+
+&gmac1 {
+	label = "wan";
+	phy-handle = <&ethphy0>;
+	nvmem-cells = <&ethaddr 1>;
+	nvmem-cell-names = "mac-address";
+	status = "okay";
+};
+
+&i2c {
+	/* Uses i2c-gpio */
+	status = "disabled";
+};
+
+&ethphy0 {
+	/delete-property/ interrupts;
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "uart2", "uart3";
+		function = "gpio";
+	};
+};
+
+&switch0 {
+	ports {
+		port@1 {
+			label = "lan";
+			nvmem-cells = <&ethaddr 0>;
+			nvmem-cell-names = "mac-address";
+			status = "okay";
+		};
+	};
+};
diff --git a/target/linux/ramips/dts/mt7621_genexis_pulse-ex400.dts b/target/linux/ramips/dts/mt7621_genexis_pulse-ex400.dts
new file mode 100644
index 00000000000000..ad8a22ad79d369
--- /dev/null
+++ b/target/linux/ramips/dts/mt7621_genexis_pulse-ex400.dts
@@ -0,0 +1,103 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7621_genexis_pulse-ex400-common.dtsi"
+
+/ {
+	compatible = "genexis,pulse-ex400", "mediatek,mt7621-soc";
+	model = "Genexis Pulse EX400";
+
+	aliases {
+		led-boot = &led_status_red;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_green;
+		led-upgrade = &led_status_red;
+	};
+};
+
+&leds {
+	led_wps_green: led-2 {
+		color = <LED_COLOR_ID_GREEN>;
+		function = LED_FUNCTION_WPS;
+		gpios = <&gpio 12 GPIO_ACTIVE_LOW>;
+	};
+};
+
+&i2c_gpio {
+	touch@2b {
+		compatible = "semtech,sx9512";
+
+		reg = <0x2b>;
+
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		poll-interval = <150>;
+
+		/* Touch area 2.4 GHz */
+		channel@1 {
+			reg = <1>;
+
+			semtech,cin-delta = <0x3>;
+			semtech,sense-threshold = <0x04>;
+
+			linux,keycodes = <KEY_A>;
+		};
+
+		/* Touch area 5 GHz */
+		channel@2 {
+			reg = <2>;
+
+			semtech,cin-delta = <0x3>;
+			semtech,sense-threshold = <0x04>;
+
+			linux,keycodes = <KEY_B>;
+		};
+		/* Touch area WPS */
+		channel@3 {
+			reg = <3>;
+
+			semtech,cin-delta = <0x3>;
+			semtech,sense-threshold = <0x04>;
+
+			linux,keycodes = <KEY_WPS_BUTTON>;
+		};
+
+		channel@4 {
+			reg = <4>;
+
+			led {
+				color = <LED_COLOR_ID_RED>;
+				function = LED_FUNCTION_WAN;
+			};
+		};
+
+		channel@5 {
+			reg = <5>;
+
+			led {
+				color = <LED_COLOR_ID_GREEN>;
+				function = LED_FUNCTION_WAN;
+			};
+		};
+
+		channel@6 {
+			reg = <6>;
+
+			led {
+				color = <LED_COLOR_ID_GREEN>;
+				function = LED_FUNCTION_WLAN_5GHZ;
+				linux,default-trigger = "phy1tpt";
+			};
+		};
+
+		channel@7 {
+			reg = <7>;
+
+			led {
+				color = <LED_COLOR_ID_GREEN>;
+				function = LED_FUNCTION_WLAN_2GHZ;
+				linux,default-trigger = "phy0tpt";
+			};
+		};
+	};
+};
\ No newline at end of file
diff --git a/target/linux/ramips/dts/mt7621_humax_e10.dts b/target/linux/ramips/dts/mt7621_humax_e10.dts
index 39eac32d538f4e..fd66578eaf0953 100644
--- a/target/linux/ramips/dts/mt7621_humax_e10.dts
+++ b/target/linux/ramips/dts/mt7621_humax_e10.dts
@@ -19,16 +19,6 @@
 		label-mac-device = &gmac1;
 	};
 
-	gpio-export {
-		compatible = "gpio-export";
-
-		gpio-usb-power {
-			gpio-export,name = "power:usb";
-			gpio-export,output = <1>;
-			gpios = <&gpio 8 GPIO_ACTIVE_HIGH>;
-		};
-	};
-
 	leds {
 		compatible = "gpio-leds";
 
@@ -65,6 +55,16 @@
 			linux,code = <KEY_RESTART>;
 		};
 	};
+
+	reg_power_usb: regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "power:usb";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpios = <&gpio 8 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+		regulator-boot-on;
+	};
 };
 
 &spi0 {
@@ -131,6 +131,10 @@
 	};
 };
 
+&xhci {
+	vbus-supply = <&reg_power_usb>;
+};
+
 &pcie {
 	status = "okay";
 };
diff --git a/target/linux/ramips/dts/mt7621_mikrotik_routerboard-7xx.dtsi b/target/linux/ramips/dts/mt7621_mikrotik_routerboard-7xx.dtsi
index cdca47f8b8c77a..7429ce673dd2f8 100644
--- a/target/linux/ramips/dts/mt7621_mikrotik_routerboard-7xx.dtsi
+++ b/target/linux/ramips/dts/mt7621_mikrotik_routerboard-7xx.dtsi
@@ -13,15 +13,23 @@
 			gpio-export,output = <0>;
 			gpios = <&gpio 15 GPIO_ACTIVE_HIGH>;
 		};
+	};
 
-		usb_power {
-			gpio-export,name = "usb_power";
-			gpio-export,output = <1>;
-			gpios = <&gpio 12 GPIO_ACTIVE_HIGH>;
-		};
+	reg_usb_power: regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "usb_power";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpios = <&gpio 12 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+		regulator-boot-on;
 	};
 };
 
+&xhci {
+	vbus-supply = <&reg_usb_power>;
+};
+
 &keys {
 	mode {
 		label = "mode";
diff --git a/target/linux/ramips/dts/mt7621_tplink_deco-m4r-v4.dts b/target/linux/ramips/dts/mt7621_tplink_deco-m4r-v4.dts
index 6274f9859983f5..b9e359d2f14f86 100644
--- a/target/linux/ramips/dts/mt7621_tplink_deco-m4r-v4.dts
+++ b/target/linux/ramips/dts/mt7621_tplink_deco-m4r-v4.dts
@@ -181,19 +181,19 @@
 &gmac0 {
 	nvmem-cells = <&macaddr_config_8>;
 	nvmem-cell-names = "mac-address";
-	label = "dsa";
+	openwrt,netdev-name = "dsa";
 };
 
 &switch0 {
 	ports {
 		port@0 {
 			status = "okay";
-			label = "eth0";
+			openwrt,netdev-name = "eth0";
 		};
 
 		port@1 {
 			status = "okay";
-			label = "eth1";
+			openwrt,netdev-name = "eth1";
 		};
 	};
 };
diff --git a/target/linux/ramips/dts/mt7621_tplink_mr600-v2-eu.dts b/target/linux/ramips/dts/mt7621_tplink_mr600-v2-eu.dts
index 165b48d20914de..17a4b1d6aa8175 100644
--- a/target/linux/ramips/dts/mt7621_tplink_mr600-v2-eu.dts
+++ b/target/linux/ramips/dts/mt7621_tplink_mr600-v2-eu.dts
@@ -136,9 +136,26 @@
 				read-only;
 			};
 
+			/* The boot log of the stock kernel suggests the radio partition is at
+			 * 0xfe0000, but this is wrong. The U-Boot log lists it at 0xff0000. The
+			 * WiFi driver's log output indicates the calibration data is read from a
+			 * hardcoded 0xff0000, ignoring mtd partitions:
+			 *
+			 * 0x000000fe0000-0x000000ff0000 : "radio" <- WRONG
+			 * ...
+			 * MT7603E--> ####  read 2.4G cal from flash !! ####
+			 * spiflash_ioctl_read, Read from 0x00ff0000 length 0x10000, ...
+			 *
+			 * Manual inspection shows 0xfe0000 is empty (0xff) bytes. 0xff0000 contains
+			 * the data we want. */
 			partition@fe0000 {
-				label = "radio";
+				label = "filler";
 				reg = <0xfe0000 0x10000>;
+			};
+
+			partition@ff0000 {
+				label = "radio";
+				reg = <0xff0000 0x10000>;
 				read-only;
 
 				nvmem-layout {
diff --git a/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x-sfp.dts b/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x-sfp.dts
index 50a77c3877a055..9f1e0a8d20c675 100644
--- a/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x-sfp.dts
+++ b/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x-sfp.dts
@@ -69,11 +69,12 @@
 	ports {
 		port@5 {
 			reg = <5>;
-			label = "eth5";
+			openwrt,netdev-name = "eth5";
 			phy-handle = <&ephy7>;
 			phy-mode = "rgmii-rxid";
 			nvmem-cells = <&macaddr_factory_22 5>;
 			nvmem-cell-names = "mac-address";
+			/delete-property/ label;
 		};
 	};
 };
diff --git a/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x.dts b/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x.dts
index 80467c88e98343..c0230e13b42393 100644
--- a/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x.dts
+++ b/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x.dts
@@ -7,7 +7,7 @@
 
 &gmac1 {
 	status = "okay";
-	label = "eth0";
+	openwrt,netdev-name = "eth0";
 	phy-handle = <&ethphy0>;
 
 	nvmem-cells = <&macaddr_factory_22 0>;
diff --git a/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x.dtsi b/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x.dtsi
index 0902ad56b961ff..40433c1c43b23d 100644
--- a/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x.dtsi
+++ b/target/linux/ramips/dts/mt7621_ubnt_edgerouter-x.dtsi
@@ -22,42 +22,47 @@
 &gmac0 {
 	nvmem-cells = <&macaddr_factory_22 0>;
 	nvmem-cell-names = "mac-address";
-	label = "dsa";
+	openwrt,netdev-name = "dsa";
 };
 
 &switch0 {
 	ports {
 		port@0 {
 			status = "okay";
-			label = "eth0";
+			openwrt,netdev-name = "eth0";
+			/delete-property/ label;
 		};
 
 		port@1 {
 			status = "okay";
-			label = "eth1";
+			openwrt,netdev-name = "eth1";
 			nvmem-cells = <&macaddr_factory_22 1>;
 			nvmem-cell-names = "mac-address";
+			/delete-property/ label;
 		};
 
 		port@2 {
 			status = "okay";
-			label = "eth2";
+			openwrt,netdev-name = "eth2";
 			nvmem-cells = <&macaddr_factory_22 2>;
 			nvmem-cell-names = "mac-address";
+			/delete-property/ label;
 		};
 
 		port@3 {
 			status = "okay";
-			label = "eth3";
+			openwrt,netdev-name = "eth3";
 			nvmem-cells = <&macaddr_factory_22 3>;
 			nvmem-cell-names = "mac-address";
+			/delete-property/ label;
 		};
 
 		port@4 {
 			status = "okay";
-			label = "eth4";
+			openwrt,netdev-name = "eth4";
 			nvmem-cells = <&macaddr_factory_22 4>;
 			nvmem-cell-names = "mac-address";
+			/delete-property/ label;
 		};
 	};
 };
@@ -100,13 +105,8 @@
 		};
 
 		partition@140000 {
-			label = "kernel1";
-			reg = <0x140000 0x300000>;
-		};
-
-		partition@440000 {
-			label = "kernel2";
-			reg = <0x440000 0x300000>;
+			label = "kernel";
+			reg = <0x140000 0x600000>;
 		};
 
 		partition@740000 {
diff --git a/target/linux/ramips/dts/mt7621_ubnt_usw-flex.dts b/target/linux/ramips/dts/mt7621_ubnt_usw-flex.dts
index f2fb48cac2b2cb..f548f1f9b786ea 100644
--- a/target/linux/ramips/dts/mt7621_ubnt_usw-flex.dts
+++ b/target/linux/ramips/dts/mt7621_ubnt_usw-flex.dts
@@ -64,19 +64,6 @@
 	label = "dsa";
 };
 
-&gmac1 {
-	status = "okay";
-	label = "lan1";
-	phy-handle = <&ethphy4>;
-
-	nvmem-cells = <&macaddr_eeprom>;
-	nvmem-cell-names = "mac-address";
-};
-
-&ethphy4 {
-	/delete-property/ interrupts;
-};
-
 &switch0 {
 	ports {
 		port@0 {
@@ -98,6 +85,11 @@
 			status = "okay";
 			label = "lan2";
 		};
+
+                port@4 {
+                        status = "okay";
+                        label = "lan1";
+                };
 	};
 };
 
diff --git a/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1602-v04.dtsi b/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1602-v04.dtsi
index c3712fea7b910f..c70b3330e9c79d 100644
--- a/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1602-v04.dtsi
+++ b/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1602-v04.dtsi
@@ -48,6 +48,15 @@
 		};
 	};
 
+	reg_power_usb: regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "power_usb";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpios = <&gpio 6 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+	};
+
 	watchdog {
 		compatible = "linux,wdt-gpio";
 		gpios = <&gpio 3 GPIO_ACTIVE_HIGH>;
@@ -72,15 +81,13 @@
 			gpio-export,output = <1>;
 			gpios = <&gpio 7 GPIO_ACTIVE_HIGH>;
 		};
-
-		ext-usb {
-			gpio-export,name = "ext-usb";
-			gpio-export,output = <1>;
-			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
-		};
 	};
 };
 
+&xhci {
+	vbus-supply = <&reg_power_usb>;
+};
+
 &sdhci {
 	status = "okay";
 };
diff --git a/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1602.dtsi b/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1602.dtsi
index dcad7b26d23b38..3e2a593ae710da 100644
--- a/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1602.dtsi
+++ b/target/linux/ramips/dts/mt7621_zbtlink_zbt-wg1602.dtsi
@@ -47,6 +47,15 @@
 		};
 	};
 
+	reg_power_usb: regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "power_usb";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpios = <&gpio 6 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+	};
+
 	watchdog {
 		compatible = "linux,wdt-gpio";
 		gpios = <&gpio 3 GPIO_ACTIVE_HIGH>;
@@ -71,15 +80,13 @@
 			gpio-export,output = <1>;
 			gpios = <&gpio 7 GPIO_ACTIVE_HIGH>;
 		};
-
-		ext-usb {
-			gpio-export,name = "ext-usb";
-			gpio-export,output = <1>;
-			gpios = <&gpio 6 GPIO_ACTIVE_LOW>;
-		};
 	};
 };
 
+&xhci {
+	vbus-supply = <&reg_power_usb>;
+};
+
 &sdhci {
 	status = "okay";
 };
diff --git a/target/linux/ramips/dts/mt7621_zyxel_lte3301-plus.dts b/target/linux/ramips/dts/mt7621_zyxel_lte3301-plus.dts
index 9eed123157ebfa..2a556190d0b068 100644
--- a/target/linux/ramips/dts/mt7621_zyxel_lte3301-plus.dts
+++ b/target/linux/ramips/dts/mt7621_zyxel_lte3301-plus.dts
@@ -96,17 +96,19 @@
 
 	};
 
+	reg_power_usb: regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "power_usb";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpios = <&gpio 7 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+		regulator-boot-on;
+	};
 };
 
-&gpio {
-	status = "okay";
-
-	enable_usb_power {
-		gpio-hog;
-		line-name = "enable USB power";
-		gpios = <7 GPIO_ACTIVE_HIGH>;
-		output-high;
-	};
+&xhci {
+	vbus-supply = <&reg_power_usb>;
 };
 
 &nand {
diff --git a/target/linux/ramips/dts/mt7621_zyxel_lte5398-m904.dts b/target/linux/ramips/dts/mt7621_zyxel_lte5398-m904.dts
index e121077b0ac908..41173dd1295ffe 100644
--- a/target/linux/ramips/dts/mt7621_zyxel_lte5398-m904.dts
+++ b/target/linux/ramips/dts/mt7621_zyxel_lte5398-m904.dts
@@ -92,15 +92,23 @@
 			gpio-export,output = <0>;
 			gpios = <&gpio 27 GPIO_ACTIVE_LOW>;
 		};
+	};
 
-		usb_power {
-			gpio-export,name = "usb_power";
-			gpio-export,output = <1>;
-			gpios = <&gpio 0 GPIO_ACTIVE_HIGH>;
-		};
+	reg_usb_power: regulator {
+		compatible = "regulator-fixed";
+		regulator-name = "usb_power";
+		regulator-min-microvolt = <5000000>;
+		regulator-max-microvolt = <5000000>;
+		gpios = <&gpio 0 GPIO_ACTIVE_HIGH>;
+		enable-active-high;
+		regulator-boot-on;
 	};
 };
 
+&xhci {
+	vbus-supply = <&reg_usb_power>;
+};
+
 &nand {
 	status = "okay";
 
diff --git a/target/linux/ramips/dts/mt7628an.dtsi b/target/linux/ramips/dts/mt7628an.dtsi
index 445c53081509c1..79763332b8bf58 100644
--- a/target/linux/ramips/dts/mt7628an.dtsi
+++ b/target/linux/ramips/dts/mt7628an.dtsi
@@ -30,13 +30,6 @@
 		compatible = "mti,cpu-interrupt-controller";
 	};
 
-	mmc_clk: mmc-clock {
-		compatible = "fixed-clock";
-		#clock-cells = <0>;
-		clock-frequency = <48000000>;
-		clock-accuracy = <100>;
-	};
-
 	mmc_reg_1v8: regulator-1v8 {
 		compatible = "regulator-fixed";
 
@@ -121,7 +114,7 @@
 			compatible = "mediatek,mt7621-i2c";
 			reg = <0x900 0x100>;
 
-			clocks = <&sysc 7>;
+			clocks = <&sysc 9>;
 			clock-names = "i2c";
 
 			resets = <&sysc 16>;
@@ -140,7 +133,7 @@
 			compatible = "mediatek,mt7628-i2s";
 			reg = <0xa00 0x100>;
 
-			clocks = <&sysc 8>;
+			clocks = <&sysc 10>;
 
 			resets = <&sysc 17>;
 			reset-names = "i2s";
@@ -162,7 +155,7 @@
 			compatible = "ralink,mt7621-spi";
 			reg = <0xb00 0x100>;
 
-			clocks = <&sysc 9>;
+			clocks = <&sysc 11>;
 			clock-names = "spi";
 
 			resets = <&sysc 18>;
@@ -185,7 +178,7 @@
 			reg-io-width = <4>;
 			no-loopback-test;
 
-			clocks = <&sysc 11>;
+			clocks = <&sysc 13>;
 
 			resets = <&sysc 12>;
 
@@ -204,7 +197,7 @@
 			reg-io-width = <4>;
 			no-loopback-test;
 
-			clocks = <&sysc 12>;
+			clocks = <&sysc 14>;
 
 			resets = <&sysc 19>;
 
@@ -225,7 +218,7 @@
 			reg-io-width = <4>;
 			no-loopback-test;
 
-			clocks = <&sysc 13>;
+			clocks = <&sysc 15>;
 
 			resets = <&sysc 20>;
 
@@ -393,7 +386,7 @@
 		cap-mmc-highspeed;
 		cap-sd-highspeed;
 
-		clocks = <&mmc_clk>, <&mmc_clk>;
+		clocks = <&sysc 16>, <&sysc 16>;
 		clock-names = "source", "hclk";
 
 		disable-wp;
@@ -401,7 +394,7 @@
 		interrupt-parent = <&intc>;
 		interrupts = <14>;
 
-		max-frequency = <48000000>;
+		max-frequency = <24000000>;
 
 		pinctrl-names = "default", "state_uhs";
 		pinctrl-0 = <&sdxc_pins>;
@@ -516,7 +509,7 @@
 		compatible = "mediatek,mt7628-wmac";
 		reg = <0x10300000 0x100000>;
 
-		clocks = <&sysc 14>;
+		clocks = <&sysc 17>;
 
 		interrupt-parent = <&cpuintc>;
 		interrupts = <6>;
diff --git a/target/linux/ramips/dts/mt7628an_cudy_m1200-v1.dts b/target/linux/ramips/dts/mt7628an_cudy_m1200-v1.dts
new file mode 100644
index 00000000000000..05721d9984930e
--- /dev/null
+++ b/target/linux/ramips/dts/mt7628an_cudy_m1200-v1.dts
@@ -0,0 +1,187 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7628an.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "cudy,m1200-v1", "mediatek,mt7628an-soc";
+	model = "Cudy M1200 v1";
+
+	aliases {
+		led-boot = &led_status_white;
+		led-running = &led_status_white;
+		led-failsafe = &led_status_red;
+		led-upgrade = &led_status_red;
+		label-mac-device = &ethernet;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	gpio-keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			linux,code = <KEY_RESTART>;
+			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+		};
+ 
+
+		wps {
+ 			label = "wps";
+ 			linux,code = <KEY_WPS_BUTTON>;
+ 			gpios = <&gpio 5 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_red: led-status-red {
+			function = LED_FUNCTION_STATUS;
+			color = <LED_COLOR_ID_RED>;
+			gpios = <&gpio 4 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_white: led-status-white {
+			function = LED_FUNCTION_STATUS;
+			color = <LED_COLOR_ID_WHITE>;
+			gpios = <&gpio 0 GPIO_ACTIVE_LOW>;
+		};
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <40000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x400>;
+					};
+
+					eeprom_factory_8000: eeprom@8000 {
+						reg = <0x8000 0x4da8>;
+					};
+				};
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0xf80000>;
+			};
+
+			partition@fd0000 {
+				label = "debug";
+				reg = <0xfd0000 0x10000>;
+				read-only;
+			};
+
+			partition@fe0000 {
+				label = "backup";
+				reg = <0xfe000 0x10000>;
+				read-only;
+			};
+
+			partition@ff0000 {
+				label = "bdinfo";
+				reg = <0xff0000 0x10000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					macaddr_bdinfo_de00: macaddr@de00 {
+						compatible = "mac-base";
+						reg = <0xde00 0x6>;
+						#nvmem-cell-cells = <1>;
+					};
+				};
+			};
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2c", "gpio", "wdt", "p0led_an", "wled_an";
+		function = "gpio";
+	};
+};
+
+&ehci {
+	status = "okay";
+};
+
+&ohci {
+	status = "okay";
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&eeprom_factory_8000>, <&macaddr_bdinfo_de00 2>;
+		nvmem-cell-names = "eeprom", "mac-address";
+		ieee80211-freq-limit = <5000000 6000000>;
+	};
+};
+
+&wmac {
+	status = "okay";
+
+	nvmem-cells = <&eeprom_factory_0>, <&macaddr_bdinfo_de00 1>;
+	nvmem-cell-names = "eeprom", "mac-address";
+};
+
+&ethernet {
+	nvmem-cells = <&macaddr_bdinfo_de00 0>;
+	nvmem-cell-names = "mac-address";
+};
+
+&esw {
+	mediatek,portmap = <0x3d>;
+	mediatek,portdisable = <0x3c>;
+};
diff --git a/target/linux/ramips/dts/mt7628an_hiwifi_hc5661a.dts b/target/linux/ramips/dts/mt7628an_hiwifi_hc5661a.dts
index 9e4068ce8c7241..52cd3afac89a3f 100644
--- a/target/linux/ramips/dts/mt7628an_hiwifi_hc5661a.dts
+++ b/target/linux/ramips/dts/mt7628an_hiwifi_hc5661a.dts
@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
 #include "mt7628an_hiwifi_hc5x61a.dtsi"
 
 / {
@@ -25,9 +27,25 @@
 	};
 };
 
+&pinctrl {
+	ephy-analog;
+
+	sdxc_router_mode: sdxc_router_mode {
+		groups = "esd", "gpio", "i2c", "sdmode", "uart1";
+		function = "gpio";
+	};
+};
+
+&sdhci {
+	status = "okay";
+
+	pinctrl-0 = <&sdxc_router_mode>;
+	pinctrl-1 = <&sdxc_router_mode>;
+};
+
 &state_default {
 	gpio {
-		groups = "i2c", "refclk", "wdt", "wled_an";
+		groups = "i2s", "refclk", "wdt", "wled_an";
 		function = "gpio";
 	};
 };
diff --git a/target/linux/ramips/dts/mt7628an_hiwifi_hc5761a.dts b/target/linux/ramips/dts/mt7628an_hiwifi_hc5761a.dts
index 5ec041c8048e98..940df6e19a7a8b 100644
--- a/target/linux/ramips/dts/mt7628an_hiwifi_hc5761a.dts
+++ b/target/linux/ramips/dts/mt7628an_hiwifi_hc5761a.dts
@@ -44,9 +44,25 @@
 	};
 };
 
+&pinctrl {
+	ephy-analog;
+
+	sdxc_router_mode: sdxc_router_mode {
+		groups = "esd", "gpio", "i2c", "sdmode", "uart1";
+		function = "gpio";
+	};
+};
+
+&sdhci {
+	status = "okay";
+
+	pinctrl-0 = <&sdxc_router_mode>;
+	pinctrl-1 = <&sdxc_router_mode>;
+};
+
 &state_default {
 	gpio {
-		groups = "i2c", "refclk", "wdt", "p2led_an", "p3led_an", "wled_an";
+		groups = "i2s", "refclk", "wdt", "p2led_an", "p3led_an", "wled_an";
 		function = "gpio";
 	};
 };
diff --git a/target/linux/ramips/dts/mt7628an_hongdian_h7920-v40.dts b/target/linux/ramips/dts/mt7628an_hongdian_h7920-v40.dts
new file mode 100644
index 00000000000000..76c395c382e6d0
--- /dev/null
+++ b/target/linux/ramips/dts/mt7628an_hongdian_h7920-v40.dts
@@ -0,0 +1,171 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7628an.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "hongdian,h7920-v40", "mediatek,mt7628an-soc";
+	model = "Hongdian H7920 v40";
+
+	aliases {
+		led-boot = &led_sys;
+		led-failsafe = &led_sys;
+		led-running = &led_sys;
+		led-upgrade = &led_sys;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led-rf {
+			gpios = <&gpio 2 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = "rf";
+		};
+
+		led-net {
+			gpios = <&gpio 3 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_MOBILE;
+		};
+
+		led_sys: led-sys {
+			gpios = <&gpio 37 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_POWER;
+			default-state = "on";
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+
+	watchdog {
+		compatible = "linux,wdt-gpio";
+
+		gpios = <&gpio 0 GPIO_ACTIVE_HIGH>;
+		hw_algo = "toggle";
+		hw_margin_ms = <600>;
+		always-running;
+	};
+
+	gpio-export {
+		compatible = "gpio-export";
+
+		gpio_modem_power {
+			gpio-export,name = "modem_power";
+			gpio-export,output = <0>;
+			gpios = <&gpio 4 GPIO_ACTIVE_HIGH>;
+		};
+
+		gpio_serial_rs485_mode {
+			gpio-export,name = "serial_rs485_mode";
+			gpio-export,output = <0>;
+			gpios = <&gpio 6 GPIO_ACTIVE_HIGH>;
+		};
+	};
+};
+
+&watchdog {
+	status = "disabled";
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <40000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x400>;
+					};
+
+					macaddr_factory_28: macaddr@28 {
+						reg = <0x28 0x6>;
+					};
+				};
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0xfb0000>;
+			};
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2s", "gpio", "refclk";
+		function = "gpio";
+	};
+};
+
+&ethernet {
+	nvmem-cells = <&macaddr_factory_28>;
+	nvmem-cell-names = "mac-address";
+};
+
+&esw {
+	mediatek,portmap = <0x3e>;
+	mediatek,portdisable = <0x3c>;
+};
+
+&wmac {
+	status = "okay";
+
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+};
+
+&uart1 {
+	status = "okay";
+};
+
+&pcie {
+	status = "okay";
+};
diff --git a/target/linux/ramips/dts/mt7628an_mediatek_linkit-smart-7688.dts b/target/linux/ramips/dts/mt7628an_mediatek_linkit-smart-7688.dts
index 34ef15eca0b722..fab70dc7b7fc9b 100644
--- a/target/linux/ramips/dts/mt7628an_mediatek_linkit-smart-7688.dts
+++ b/target/linux/ramips/dts/mt7628an_mediatek_linkit-smart-7688.dts
@@ -168,8 +168,27 @@
 	nvmem-cell-names = "mac-address";
 };
 
+&pinctrl {
+	ephy-digital;
+
+	sdxc_iot_mode: sdxc_iot_mode {
+		esd {
+			groups = "esd";
+			function = "iot";
+		};
+
+		sdxc {
+			groups = "sdmode";
+			function = "sdxc";
+		};
+	};
+};
+
 &sdhci {
 	status = "okay";
+
+	pinctrl-0 = <&sdxc_iot_mode>;
+	pinctrl-1 = <&sdxc_iot_mode>;
 	cd-inverted;
 };
 
diff --git a/target/linux/ramips/dts/mt7628an_onion_omega2.dtsi b/target/linux/ramips/dts/mt7628an_onion_omega2.dtsi
index d279cbcfb8e81a..2d45e0385f125b 100644
--- a/target/linux/ramips/dts/mt7628an_onion_omega2.dtsi
+++ b/target/linux/ramips/dts/mt7628an_onion_omega2.dtsi
@@ -170,8 +170,27 @@
 	nvmem-cell-names = "mac-address";
 };
 
+&pinctrl {
+	ephy-digital;
+
+	sdxc_iot_mode: sdxc_iot_mode {
+		esd {
+			groups = "esd";
+			function = "iot";
+		};
+
+		sdxc {
+			groups = "sdmode";
+			function = "sdxc";
+		};
+	};
+};
+
 &sdhci {
 	status = "okay";
+
+	pinctrl-0 = <&sdxc_iot_mode>;
+	pinctrl-1 = <&sdxc_iot_mode>;
 };
 
 &wmac {
diff --git a/target/linux/ramips/dts/mt7628an_ravpower_rp-wd009.dts b/target/linux/ramips/dts/mt7628an_ravpower_rp-wd009.dts
index 607787f68e13fd..71c77d7ae671a0 100644
--- a/target/linux/ramips/dts/mt7628an_ravpower_rp-wd009.dts
+++ b/target/linux/ramips/dts/mt7628an_ravpower_rp-wd009.dts
@@ -84,6 +84,22 @@
 	};
 };
 
+&pinctrl {
+	ephy-digital;
+
+	sdxc_iot_mode: sdxc_iot_mode {
+		esd {
+			groups = "esd";
+			function = "iot";
+		};
+
+		sdxc {
+			groups = "sdmode";
+			function = "sdxc";
+		};
+	};
+};
+
 &state_default {
 	gpio {
 		groups = "uart1", "wled_an", "p0led_an", "p2led_an", "p3led_an",
@@ -94,6 +110,9 @@
 
 &sdhci {
 	status = "okay";
+
+	pinctrl-0 = <&sdxc_iot_mode>;
+	pinctrl-1 = <&sdxc_iot_mode>;
 };
 
 &i2c {
diff --git a/target/linux/ramips/dts/mt7628an_tplink_tl-wr902ac-v4.dts b/target/linux/ramips/dts/mt7628an_tplink_tl-wr902ac-v4.dts
index 946efb9443e8aa..a2dd4ce5cb8719 100644
--- a/target/linux/ramips/dts/mt7628an_tplink_tl-wr902ac-v4.dts
+++ b/target/linux/ramips/dts/mt7628an_tplink_tl-wr902ac-v4.dts
@@ -108,7 +108,7 @@
 
 &wmac {
 	status = "okay";
-	nvmem-cells = <&eeprom_factory_28000>, <&macaddr_factory_f100 0>;
+	nvmem-cells = <&eeprom_factory_20000>, <&macaddr_factory_f100 0>;
 	nvmem-cell-names = "eeprom", "mac-address";
 };
 
diff --git a/target/linux/ramips/dts/mt7628an_vocore_vocore2.dtsi b/target/linux/ramips/dts/mt7628an_vocore_vocore2.dtsi
index 4982d8bccc9d7e..da2026ec7d30c3 100644
--- a/target/linux/ramips/dts/mt7628an_vocore_vocore2.dtsi
+++ b/target/linux/ramips/dts/mt7628an_vocore_vocore2.dtsi
@@ -68,6 +68,22 @@
 	};
 };
 
+&pinctrl {
+	ephy-digital;
+
+	sdxc_iot_mode: sdxc_iot_mode {
+		esd {
+			groups = "esd";
+			function = "iot";
+		};
+
+		sdxc {
+			groups = "sdmode";
+			function = "sdxc";
+		};
+	};
+};
+
 &state_default {
 	gpio {
 		groups = "wled_an", "refclk", "wdt";
@@ -75,6 +91,13 @@
 	};
 };
 
+&sdhci {
+	status = "okay";
+
+	pinctrl-0 = <&sdxc_iot_mode>;
+	pinctrl-1 = <&sdxc_iot_mode>;
+};
+
 &wmac {
 	status = "okay";
 
diff --git a/target/linux/ramips/dts/mt7628an_xiaomi_miwifi-3a.dts b/target/linux/ramips/dts/mt7628an_xiaomi_miwifi-3a.dts
new file mode 100644
index 00000000000000..3a48410fa74345
--- /dev/null
+++ b/target/linux/ramips/dts/mt7628an_xiaomi_miwifi-3a.dts
@@ -0,0 +1,190 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7628an.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "xiaomi,miwifi-3a", "mediatek,mt7628an-soc";
+	model = "Xiaomi MiWiFi 3A";
+
+	aliases {
+		led-boot = &led_status_amber;
+		led-failsafe = &led_status_red;
+		led-running = &led_status_blue;
+		led-upgrade = &led_status_amber;
+		label-mac-device = &ethernet;
+	};
+
+	chosen {
+		bootargs = "console=ttyS0,115200";
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		led_status_blue: status_blue {
+			function = LED_FUNCTION_STATUS;
+			color = <LED_COLOR_ID_BLUE>;
+			gpios = <&gpio 11 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_red: status_red {
+			function = LED_FUNCTION_STATUS;
+			color = <LED_COLOR_ID_RED>;
+			gpios = <&gpio 37 GPIO_ACTIVE_LOW>;
+		};
+
+		led_status_amber: status_amber {
+			function = LED_FUNCTION_STATUS;
+			color = <LED_COLOR_ID_AMBER>;
+			gpios = <&gpio 44 GPIO_ACTIVE_LOW>;
+		};
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 38 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "gpio", "refclk", "wdt", "wled_an";
+		function = "gpio";
+	};
+};
+
+&ehci {
+	status = "disabled";
+};
+
+&ohci {
+	status = "disabled";
+};
+
+&esw {
+	mediatek,portmap = <0x3e>;
+	mediatek,portdisable = <0x2a>;
+};
+
+&wmac {
+	status = "okay";
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&eeprom_factory_8000>;
+		nvmem-cell-names = "eeprom";
+		ieee80211-freq-limit = <5000000 6000000>;
+	};
+};
+
+&ethernet {
+	nvmem-cells = <&macaddr_factory_28>;
+	nvmem-cell-names = "mac-address";
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <40000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "Bootloader";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "Config";
+				reg = <0x30000 0x10000>;
+			};
+
+			partition@40000 {
+				label = "Bdata";
+				reg = <0x40000 0x10000>;
+				read-only;
+			};
+
+			partition@50000 {
+				label = "factory";
+				reg = <0x50000 0x10000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x400>;
+					};
+
+					eeprom_factory_8000: eeprom@8000 {
+						reg = <0x8000 0x200>;
+					};
+
+					macaddr_factory_4: macaddr@4 {
+						reg = <0x4 0x6>;
+					};
+
+					macaddr_factory_28: macaddr@28 {
+						reg = <0x28 0x6>;
+					};
+
+					macaddr_factory_8004: macaddr@8004 {
+						reg = <0x8004 0x6>;
+					};
+				};
+			};
+
+			partition@60000 {
+				label = "crash";
+				reg = <0x60000 0x10000>;
+				read-only;
+			};
+
+			partition@70000 {
+				label = "crash_syslog";
+				reg = <0x70000 0x10000>;
+				read-only;
+			};
+
+			partition@80000 {
+				label = "overlay";
+				reg = <0x80000 0x100000>;
+				read-only;
+			};
+
+			partition@180000 {
+				label = "firmware";
+				compatible = "denx,uimage";
+				reg = <0x180000 0xe80000>;
+			};
+		};
+	};
+};
diff --git a/target/linux/ramips/dts/mt7628an_zbtlink_zbt-we2426-b.dts b/target/linux/ramips/dts/mt7628an_zbtlink_zbt-we2426-b.dts
new file mode 100644
index 00000000000000..6dfdb2617c36b2
--- /dev/null
+++ b/target/linux/ramips/dts/mt7628an_zbtlink_zbt-we2426-b.dts
@@ -0,0 +1,183 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "mt7628an.dtsi"
+
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/leds/common.h>
+
+/ {
+	compatible = "zbtlink,zbt-we2426-b", "mediatek,mt7628an-soc";
+	model = "Zbtlink ZBT-WE2426-B";
+
+	aliases {
+		led-boot = &led_wlan;
+		led-failsafe = &led_wlan;
+		led-upgrade = &led_wlan;
+		label-mac-device = &wmac;
+	};
+
+	keys {
+		compatible = "gpio-keys";
+
+		reset {
+			label = "reset";
+			gpios = <&gpio 38 GPIO_ACTIVE_LOW>;
+			linux,code = <KEY_RESTART>;
+		};
+
+	};
+
+	leds {
+		compatible = "gpio-leds";
+
+		lan1 {
+			gpios = <&gpio 43 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <1>;
+		};
+
+		lan2 {
+			gpios = <&gpio 42 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <2>;
+		};
+
+		lan3 {
+			gpios = <&gpio 41 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <3>;
+		};
+
+		lan4 {
+			gpios = <&gpio 40 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_LAN;
+			function-enumerator = <4>;
+		};
+
+		wan {
+			gpios = <&gpio 39 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WAN;
+		};
+
+		led_wlan: wlan2g {
+			gpios = <&gpio 44 GPIO_ACTIVE_LOW>;
+			color = <LED_COLOR_ID_GREEN>;
+			function = LED_FUNCTION_WLAN;
+			linux,default-trigger = "phy0tpt";
+		};
+
+	};
+};
+
+&spi0 {
+	status = "okay";
+
+	flash@0 {
+		compatible = "jedec,spi-nor";
+		reg = <0>;
+		spi-max-frequency = <10000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			partition@0 {
+				label = "u-boot";
+				reg = <0x0 0x30000>;
+				read-only;
+			};
+
+			partition@30000 {
+				label = "u-boot-env";
+				reg = <0x30000 0x10000>;
+				read-only;
+			};
+
+			factory: partition@40000 {
+				label = "factory";
+				reg = <0x40000 0x10000>;
+				read-only;
+
+				nvmem-layout {
+					compatible = "fixed-layout";
+					#address-cells = <1>;
+					#size-cells = <1>;
+
+					eeprom_factory_0: eeprom@0 {
+						reg = <0x0 0x400>;
+					};
+
+					eeprom_factory_8000: eeprom@8000 {
+						reg = <0x8000 0x200>;
+					};
+
+					macaddr_factory_28: macaddr@28 {
+						reg = <0x28 0x6>;
+					};
+				};
+			};
+
+			partition@50000 {
+				compatible = "denx,uimage";
+				label = "firmware";
+				reg = <0x50000 0x7b0000>;
+			};
+		};
+	};
+};
+
+&state_default {
+	gpio {
+		groups = "i2s", "refclk", "wdt", "p4led_an",
+				"p3led_an", "p2led_an",
+				"p1led_an", "p0led_an",
+				"wled_an";
+		function = "gpio";
+	};
+};
+
+&pcie {
+	status = "okay";
+};
+
+&pcie0 {
+	wifi@0,0 {
+		compatible = "mediatek,mt76";
+		reg = <0x0000 0 0 0 0>;
+		nvmem-cells = <&eeprom_factory_8000>;
+		nvmem-cell-names = "eeprom";
+		ieee80211-freq-limit = <5000000 6000000>;
+
+		led {
+			led-sources = <2>;
+			led-active-low;
+		};
+	};
+};
+
+&wmac {
+	status = "okay";
+
+	nvmem-cells = <&eeprom_factory_0>;
+	nvmem-cell-names = "eeprom";
+};
+
+&ethernet {
+	nvmem-cells = <&macaddr_factory_28>;
+	nvmem-cell-names = "mac-address";
+};
+
+&esw {
+	mediatek,portmap = <0x2f>;
+};
+
+&sdhci {
+	status = "okay";
+};
diff --git a/target/linux/ramips/files/drivers/mmc/host/mtk-mmc/sd.c b/target/linux/ramips/files/drivers/mmc/host/mtk-mmc/sd.c
index df95900a26ed27..a9c242bfd36840 100644
--- a/target/linux/ramips/files/drivers/mmc/host/mtk-mmc/sd.c
+++ b/target/linux/ramips/files/drivers/mmc/host/mtk-mmc/sd.c
@@ -2210,12 +2210,6 @@ static int msdc_drv_probe(struct platform_device *pdev)
 	struct msdc_hw *hw;
 	int ret;
 
-	//FIXME: this should be done by pinconf and not by the sd driver
-	if ((ralink_soc == MT762X_SOC_MT7688 ||
-	     ralink_soc == MT762X_SOC_MT7628AN) &&
-	    (!(rt_sysc_r32(0x60) & BIT(15))))
-		rt_sysc_m32(0xf << 17, 0xf << 17, 0x3c);
-
 	hw = &msdc0_hw;
 
 	if (of_property_read_bool(pdev->dev.of_node, "mtk,wp-en"))
diff --git a/target/linux/ramips/files/drivers/net/ethernet/ralink/esw_rt3050.c b/target/linux/ramips/files/drivers/net/ethernet/ralink/esw_rt3050.c
index cafa28e7a44f5e..bbb52d74b240a2 100644
--- a/target/linux/ramips/files/drivers/net/ethernet/ralink/esw_rt3050.c
+++ b/target/linux/ramips/files/drivers/net/ethernet/ralink/esw_rt3050.c
@@ -1525,7 +1525,6 @@ static struct platform_driver esw_driver = {
 	.remove = esw_remove,
 	.driver = {
 		.name = "rt3050-esw",
-		.owner = THIS_MODULE,
 		.of_match_table = ralink_esw_match,
 	},
 };
diff --git a/target/linux/ramips/files/drivers/net/ethernet/ralink/gsw_mt7620.c b/target/linux/ramips/files/drivers/net/ethernet/ralink/gsw_mt7620.c
index 9fc54a74b42337..154983494ee1aa 100644
--- a/target/linux/ramips/files/drivers/net/ethernet/ralink/gsw_mt7620.c
+++ b/target/linux/ramips/files/drivers/net/ethernet/ralink/gsw_mt7620.c
@@ -296,7 +296,6 @@ static struct platform_driver gsw_driver = {
 	.remove = mt7620_gsw_remove,
 	.driver = {
 		.name = "mt7620-gsw",
-		.owner = THIS_MODULE,
 		.of_match_table = mediatek_gsw_match,
 	},
 };
diff --git a/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c b/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c
index d8d27fda3b15d9..4dff1340d70571 100644
--- a/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c
+++ b/target/linux/ramips/files/drivers/net/ethernet/ralink/mtk_eth_soc.c
@@ -1657,7 +1657,6 @@ static struct platform_driver fe_driver = {
 	.remove = fe_remove,
 	.driver = {
 		.name = "mtk_soc_eth",
-		.owner = THIS_MODULE,
 		.of_match_table = of_fe_match,
 	},
 };
diff --git a/target/linux/ramips/image/Makefile b/target/linux/ramips/image/Makefile
index 569717694345c4..53b9c314ef65ec 100644
--- a/target/linux/ramips/image/Makefile
+++ b/target/linux/ramips/image/Makefile
@@ -167,10 +167,6 @@ define Build/wrg-header
 	mv $@.new $@
 endef
 
-define Build/zyimage
-	$(STAGING_DIR_HOST)/bin/zyimage $(1) $@
-endef
-
 define Device/Default
   PROFILES = Default
   BLOCKSIZE := 64k
diff --git a/target/linux/ramips/image/mt7620.mk b/target/linux/ramips/image/mt7620.mk
index 6cf65ad1194bfb..310cff692e2962 100644
--- a/target/linux/ramips/image/mt7620.mk
+++ b/target/linux/ramips/image/mt7620.mk
@@ -604,6 +604,18 @@ define Device/hnet_c108
 endef
 TARGET_DEVICES += hnet_c108
 
+define Device/hongdian_h8922-v30
+  SOC := mt7620a
+  IMAGE_SIZE := 15808k
+  DEVICE_VENDOR := Hongdian
+  DEVICE_MODEL := H8922
+  DEVICE_VARIANT := v30
+  DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-net-qmi-wwan kmod-usb-serial-option uqmi uboot-envtools
+  IMAGES += rootfs.bin
+  IMAGE/rootfs.bin := append-rootfs | check-size 10560k
+endef
+TARGET_DEVICES += hongdian_h8922-v30
+
 define Device/humax_e2
   SOC := mt7620a
   IMAGE_SIZE := 7744k
diff --git a/target/linux/ramips/image/mt7621.mk b/target/linux/ramips/image/mt7621.mk
index 34ed9a4d54a634..f6a05db8d31340 100644
--- a/target/linux/ramips/image/mt7621.mk
+++ b/target/linux/ramips/image/mt7621.mk
@@ -51,7 +51,7 @@ define Build/arcadyan-trx
 	rm $@.hsqs $@.tail
 endef
 
-define Build/dna-header
+define Build/inteno-y3-header
 	BC='$(STAGING_DIR_HOST)/bin/bc' ;\
 	ubifsofs="1024" ;\
 	ubifs="$$(stat -c%s $@)" ;\
@@ -67,12 +67,12 @@ define Build/dna-header
 	echo "IntenoIopY" > $@.tmp ;\
 	echo "version 5" >> $@.tmp ;\
 	echo "integrity MD5SUM" >> $@.tmp ;\
-	echo "board EX400" >> $@.tmp ;\
-	echo "chip 7621" >> $@.tmp ;\
-	echo "arch all mipsel_1004kc" >> $@.tmp ;\
-	echo "model EX400" >> $@.tmp ;\
-	echo "release EX400-X-DNA-4.3.6.100-R-210518_0935" >> $@.tmp ;\
-	echo "customer DNA" >> $@.tmp ;\
+	echo "board $(word 1,$(1))" >> $@.tmp ;\
+	echo "chip $(patsubst mt%,%,$(SOC:bcm%=%))" >> $@.tmp ;\
+	echo "arch all $(CONFIG_TARGET_ARCH_PACKAGES)" >> $@.tmp ;\
+	echo "model $(word 1,$(1))" >> $@.tmp ;\
+	echo "release $(DEVICE_IMG_PREFIX)" >> $@.tmp ;\
+	echo "customer $(if $(CONFIG_VERSION_DIST),$(CONFIG_VERSION_DIST),OpenWrt)" >> $@.tmp ;\
 	echo "ubifsofs $${ubifsofs}" >> $@.tmp ;\
 	echo "ubifs $${ubifs}" >> $@.tmp ;\
 	echo "pkginfoofs $${pkginfoofs}" >> $@.tmp ;\
@@ -91,21 +91,12 @@ define Build/dna-header
 	mv $@.tmp $@
 endef
 
-define Build/dna-bootfs
+define Build/inteno-bootfs
 	mkdir -p $@.ubifs-dir/boot
 
-	# populate the boot fs with the dtb and with either initramfs kernel or
-	# the normal kernel
+	# populate the boot fs with the dtb and the kernel image
 	$(CP) $(KDIR)/image-$(firstword $(DEVICE_DTS)).dtb $@.ubifs-dir/boot/dtb
-
-	$(if $(findstring with-initrd,$(word 1,$(1))),\
-		( \
-			$(CP) $@ $@.ubifs-dir/boot/uImage \
-		) , \
-		( \
-			$(CP) $(IMAGE_KERNEL) $@.ubifs-dir/boot/uImage \
-		) \
-	)
+	$(CP) $@ $@.ubifs-dir/boot/uImage
 
 	# create ubifs
 	$(STAGING_DIR_HOST)/bin/mkfs.ubifs ${MKUBIFS_OPTS} -r $@.ubifs-dir/ -o $@.new
@@ -180,10 +171,6 @@ define Build/iodata-mstc-header2
 	mv $@.new $@
 endef
 
-define Build/kernel-initramfs-bin
-	$(CP) $(KDIR)/vmlinux-initramfs $@
-endef
-
 define Build/znet-header
 	$(eval version=$(word 1,$(1)))
 	$(eval magic=$(if $(word 2,$(1)),$(word 2,$(1)),ZNET))
@@ -233,30 +220,6 @@ define Build/belkin-header
 	mv $@.new $@
 endef
 
-define Build/ubnt-erx-factory-image
-	if [ -e $(KDIR)/tmp/$(KERNEL_INITRAMFS_IMAGE) -a "$$(stat -c%s $@)" -lt "$(KERNEL_SIZE)" ]; then \
-		echo '21001:7' > $(1).compat; \
-		$(TAR) -cf $(1) --transform='s/^.*/compat/' $(1).compat; \
-		\
-		$(TAR) -rf $(1) --transform='s/^.*/vmlinux.tmp/' $(KDIR)/tmp/$(KERNEL_INITRAMFS_IMAGE); \
-		$(MKHASH) md5 $(KDIR)/tmp/$(KERNEL_INITRAMFS_IMAGE) > $(1).md5; \
-		$(TAR) -rf $(1) --transform='s/^.*/vmlinux.tmp.md5/' $(1).md5; \
-		\
-		echo "dummy" > $(1).rootfs; \
-		$(TAR) -rf $(1) --transform='s/^.*/squashfs.tmp/' $(1).rootfs; \
-		\
-		$(MKHASH) md5 $(1).rootfs > $(1).md5; \
-		$(TAR) -rf $(1) --transform='s/^.*/squashfs.tmp.md5/' $(1).md5; \
-		\
-		echo '$(BOARD) $(VERSION_CODE) $(VERSION_NUMBER)' > $(1).version; \
-		$(TAR) -rf $(1) --transform='s/^.*/version.tmp/' $(1).version; \
-		\
-		$(CP) $(1) $(BIN_DIR)/; \
-	else \
-		echo "WARNING: initramfs kernel image too big, cannot generate factory image (actual $$(stat -c%s $@); max $(KERNEL_SIZE))" >&2; \
-	fi
-endef
-
 define Build/zytrx-header
 	$(eval board=$(word 1,$(1)))
 	$(eval version=$(word 2,$(1)))
@@ -331,11 +294,11 @@ TARGET_DEVICES += alfa-network_quad-e4g
 
 define Device/ampedwireless_ally_common
   $(Device/nand)
+  $(Device/uimage-lzma-loader)
   DEVICE_VENDOR := Amped Wireless
   DEVICE_PACKAGES := kmod-mt7615-firmware
   IMAGE_SIZE := 32768k
-  KERNEL_INITRAMFS := $(KERNEL_DTB) | uImage lzma -n 'flashable-initramfs' |\
-	edimax-header -s CSYS -m RN68 -f 0x001c0000 -S 0x01100000
+  KERNEL_INITRAMFS := $$(KERNEL) | edimax-header -s CSYS -m RN68 -f 0x001c0000 -S 0x01100000
 endef
 
 define Device/ampedwireless_ally-r1900k
@@ -351,6 +314,23 @@ define Device/ampedwireless_ally-00x19k
 endef
 TARGET_DEVICES += ampedwireless_ally-00x19k
 
+define Device/arcadyan_we410443
+  $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
+  DEVICE_VENDOR := Arcadyan
+  DEVICE_MODEL := WE410443
+  IMAGE_SIZE := 32128k
+  KERNEL_SIZE := 4352k
+  KERNEL := kernel-bin | append-dtb | lzma | loader-kernel | \
+	uImage none | arcadyan-trx 0x746f435d
+  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | loader-kernel | \
+	uImage none
+  IMAGE/sysupgrade.bin := append-kernel | pad-to $$$$(KERNEL_SIZE) | \
+	append-rootfs | pad-rootfs | check-size | append-metadata
+  DEVICE_PACKAGES := kmod-mt7615-firmware -uboot-envtools
+endef
+TARGET_DEVICES += arcadyan_we410443
+
 define Device/arcadyan_we420223-99
   $(Device/dsa-migration)
   $(Device/uimage-lzma-loader)
@@ -710,6 +690,31 @@ define Device/comfast_cf-ew72-v2
 endef
 TARGET_DEVICES += comfast_cf-ew72-v2
 
+define Device/confiabits_mt7621-v1
+  $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
+  IMAGE_SIZE := 16064k
+  DEVICE_VENDOR := Confiabits
+  DEVICE_MODEL := MT7621
+  DEVICE_VARIANT := v1
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
+	-uboot-envtools
+endef
+TARGET_DEVICES += confiabits_mt7621-v1
+
+define Device/cudy_m1300-v2
+  $(Device/dsa-migration)
+  IMAGE_SIZE := 15872k
+  DEVICE_VENDOR := Cudy
+  DEVICE_MODEL := M1300
+  DEVICE_VARIANT := v2
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615e kmod-mt7663-firmware-ap \
+	-uboot-envtools
+  UIMAGE_NAME := R15
+  SUPPORTED_DEVICES += R15
+endef
+TARGET_DEVICES += cudy_m1300-v2
+
 define Device/cudy_m1800
   $(Device/dsa-migration)
   DEVICE_VENDOR := Cudy
@@ -1083,24 +1088,11 @@ define Device/d-team_pbr-m1
 endef
 TARGET_DEVICES += d-team_pbr-m1
 
+# Branded version of Genexis / Inteno EX400 (difference is one LED)
 define Device/dna_valokuitu-plus-ex400
-  $(Device/dsa-migration)
-  IMAGE_SIZE := 117m
-  PAGESIZE := 2048
-  MKUBIFS_OPTS := --min-io-size=$$(PAGESIZE) --leb-size=124KiB --max-leb-cnt=96 \
-  		  --log-lebs=2 --space-fixup --squash-uids
+  $(Device/genexis_pulse-ex400/common)
   DEVICE_VENDOR := DNA
   DEVICE_MODEL := Valokuitu Plus EX400
-  KERNEL := kernel-bin | lzma | uImage lzma
-  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | uImage lzma
-  IMAGES := factory.bin sysupgrade.bin
-  IMAGE/factory.bin := kernel-initramfs-bin | lzma | uImage lzma | \
-                       dna-bootfs with-initrd | dna-header | \
-                       append-md5sum-ascii-salted
-  IMAGE/sysupgrade.bin := dna-bootfs | sysupgrade-tar kernel=$$$$@ | check-size | \
-  			  append-metadata
-  DEVICE_IMG_NAME = $$(DEVICE_IMG_PREFIX)-$$(2)
-  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware kmod-usb3
 endef
 TARGET_DEVICES += dna_valokuitu-plus-ex400
 
@@ -1405,6 +1397,35 @@ define Device/gemtek_wvrtm-130acn
 endef
 TARGET_DEVICES += gemtek_wvrtm-130acn
 
+# Common definitions shared between genexis_pulse-ex400 and dna_valokuitu-plus-ex400
+define Device/genexis_pulse-ex400/common
+  $(Device/dsa-migration)
+  IMAGE_SIZE := 117m
+  PAGESIZE := 2048
+  MKUBIFS_OPTS := --min-io-size=$$(PAGESIZE) --leb-size=124KiB --max-leb-cnt=96 \
+    --log-lebs=2 --space-fixup --squash-uids
+  KERNEL := kernel-bin | lzma | uImage lzma
+  KERNEL_INITRAMFS := kernel-bin | append-dtb | lzma | uImage lzma
+ifneq ($(CONFIG_TARGET_ROOTFS_INITRAMFS),)
+  IMAGES += factory.bin
+  IMAGE/factory.bin := append-image-stage initramfs-kernel.bin | \
+	inteno-bootfs | inteno-y3-header EX400 | append-md5sum-ascii-salted
+endif
+  IMAGE/sysupgrade.bin := append-kernel | inteno-bootfs | pad-to 10M | \
+    sysupgrade-tar kernel=$$$$@ | check-size | append-metadata
+  DEVICE_IMG_NAME = $$(DEVICE_IMG_PREFIX)-$$(2)
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt7615-firmware kmod-usb3 kmod-keyboard-sx951x kmod-button-hotplug
+endef
+
+define Device/genexis_pulse-ex400
+  $(Device/genexis_pulse-ex400/common)
+  DEVICE_VENDOR := Genexis
+  DEVICE_MODEL := Pulse EX400
+  DEVICE_ALT0_VENDOR := Inteno
+  DEVICE_ALT0_MODEL := Pulse EX400
+endef
+TARGET_DEVICES += genexis_pulse-ex400
+
 define Device/glinet_gl-mt1300
   $(Device/dsa-migration)
   IMAGE_SIZE := 32448k
@@ -1989,6 +2010,8 @@ define Device/mercusys_mr70x-v1
   $(Device/tplink-safeloader)
   DEVICE_VENDOR := MERCUSYS
   DEVICE_MODEL := MR70X
+  DEVICE_ALT0_VENDOR := MERCUSYS
+  DEVICE_ALT0_MODEL := MR1800X
   DEVICE_VARIANT := v1
   DEVICE_PACKAGES := kmod-mt7915-firmware -uboot-envtools
   TPLINK_BOARD_ID := MR70X
@@ -2517,14 +2540,14 @@ endef
 TARGET_DEVICES += sim_simax1800t
 
 define Device/snr_snr-cpe-me1
-	$(Device/dsa-migration)
-	$(Device/uimage-lzma-loader)
-	IMAGE_SIZE := 15040k
-	DEVICE_VENDOR := SNR
-	DEVICE_MODEL := SNR-CPE-ME1
-	UIMAGE_NAME := SNR-CPE-ME1-5GHZ-MT
-	DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x0e kmod-usb3 \
-		kmod-usb-ledtrig-usbport uboot-envtools
+  $(Device/dsa-migration)
+  $(Device/uimage-lzma-loader)
+  IMAGE_SIZE := 15040k
+  DEVICE_VENDOR := SNR
+  DEVICE_MODEL := SNR-CPE-ME1
+  UIMAGE_NAME := SNR-CPE-ME1-5GHZ-MT
+  DEVICE_PACKAGES := kmod-mt7603 kmod-mt76x0e kmod-usb3 \
+	kmod-usb-ledtrig-usbport
 endef
 TARGET_DEVICES += snr_snr-cpe-me1
 
@@ -2547,8 +2570,8 @@ define Device/snr_snr-cpe-me2-sfp
   DEVICE_VENDOR := SNR
   DEVICE_MODEL := SNR-CPE-ME2-SFP
   UIMAGE_NAME := $$(DEVICE_MODEL)
-  DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 \
-	    kmod-sfp kmod-usb-ledtrig-usbport uboot-envtools
+  DEVICE_PACKAGES := kmod-mt7615-firmware kmod-usb3 kmod-sfp \
+	kmod-usb-ledtrig-usbport
 endef
 TARGET_DEVICES += snr_snr-cpe-me2-sfp
 
@@ -2862,14 +2885,15 @@ define Device/ubnt_edgerouter_common
   $(Device/dsa-migration)
   $(Device/uimage-lzma-loader)
   DEVICE_VENDOR := Ubiquiti
-  IMAGE_SIZE := 256768k
+  IMAGE_SIZE := 259840k
   FILESYSTEMS := squashfs
-  KERNEL_SIZE := 3145728
-  KERNEL_INITRAMFS := $$(KERNEL) | \
-	ubnt-erx-factory-image $(KDIR)/tmp/$$(KERNEL_INITRAMFS_PREFIX)-factory.tar
+  KERNEL_SIZE := 6144k
   IMAGE/sysupgrade.bin := sysupgrade-tar | append-metadata
   DEVICE_PACKAGES += -wpad-basic-mbedtls -uboot-envtools
-  DEFAULT := n
+  DEVICE_COMPAT_VERSION := 2.0
+  DEVICE_COMPAT_MESSAGE :=  Partition table has been changed due to kernel size restrictions. \
+    Refer to the wiki page for instructions to migrate to the new layout: \
+    https://openwrt.org/toh/ubiquiti/edgerouter_x_er-x_ka
 endef
 
 define Device/ubnt_edgerouter-x
@@ -3126,8 +3150,7 @@ define Device/xiaomi_mi-router-3g
   $(Device/xiaomi_nand_separate)
   DEVICE_MODEL := Mi Router 3G
   IMAGE_SIZE := 124416k
-  DEVICE_PACKAGES += kmod-mt7603 kmod-mt76x2 kmod-usb3 \
-	kmod-usb-ledtrig-usbport -uboot-envtools
+  DEVICE_PACKAGES += kmod-mt7603 kmod-mt76x2 kmod-usb3 kmod-usb-ledtrig-usbport
   SUPPORTED_DEVICES += R3G mir3g xiaomi,mir3g
 endef
 TARGET_DEVICES += xiaomi_mi-router-3g
@@ -3193,7 +3216,7 @@ define Device/xiaomi_mi-router-ac2100
   $(Device/xiaomi_nand_separate)
   DEVICE_MODEL := Mi Router AC2100
   IMAGE_SIZE := 120320k
-  DEVICE_PACKAGES += kmod-mt7603 kmod-mt7615-firmware -uboot-envtools
+  DEVICE_PACKAGES += kmod-mt7603 kmod-mt7615-firmware
 endef
 TARGET_DEVICES += xiaomi_mi-router-ac2100
 
diff --git a/target/linux/ramips/image/mt76x8.mk b/target/linux/ramips/image/mt76x8.mk
index 8ad840ddfead64..314f8e1e9f77d7 100644
--- a/target/linux/ramips/image/mt76x8.mk
+++ b/target/linux/ramips/image/mt76x8.mk
@@ -167,6 +167,17 @@ define Device/comfast_cf-wr758ac-v2
 endef
 TARGET_DEVICES += comfast_cf-wr758ac-v2
 
+define Device/cudy_m1200-v1
+  IMAGE_SIZE := 15872k
+  DEVICE_VENDOR := Cudy
+  DEVICE_MODEL := M1200
+  DEVICE_VARIANT := v1
+  DEVICE_PACKAGES := kmod-mt7615e kmod-mt7663-firmware-ap
+  UIMAGE_NAME := R22
+  SUPPORTED_DEVICES += R22
+endef
+TARGET_DEVICES += cudy_m1200-v1
+
 define Device/cudy_tr1200-v1
   IMAGE_SIZE := 15872k
   DEVICE_VENDOR := Cudy
@@ -289,6 +300,7 @@ define Device/hiwifi_hc5661a
   IMAGE_SIZE := 15808k
   DEVICE_VENDOR := HiWiFi
   DEVICE_MODEL := HC5661A
+  DEVICE_PACKAGES := kmod-mmc-mtk
   SUPPORTED_DEVICES += hc5661a
 endef
 TARGET_DEVICES += hiwifi_hc5661a
@@ -297,7 +309,7 @@ define Device/hiwifi_hc5761a
   IMAGE_SIZE := 15808k
   DEVICE_VENDOR := HiWiFi
   DEVICE_MODEL := HC5761A
-  DEVICE_PACKAGES := kmod-mt76x0e kmod-usb2 kmod-usb-ohci
+  DEVICE_PACKAGES := kmod-mmc-mtk kmod-mt76x0e kmod-usb2 kmod-usb-ohci
 endef
 TARGET_DEVICES += hiwifi_hc5761a
 
@@ -309,6 +321,15 @@ define Device/hiwifi_hc5861b
 endef
 TARGET_DEVICES += hiwifi_hc5861b
 
+define Device/hongdian_h7920-v40
+  IMAGE_SIZE := 16064k
+  DEVICE_VENDOR := Hongdian
+  DEVICE_MODEL := H7920
+  DEVICE_VARIANT := v40
+  DEVICE_PACKAGES := kmod-usb2 kmod-usb-ohci kmod-usb-net-qmi-wwan kmod-usb-serial-option uqmi
+endef
+TARGET_DEVICES += hongdian_h7920-v40
+
 define Device/iptime_a3
   IMAGE_SIZE := 7936k
   UIMAGE_NAME := a3
@@ -1109,6 +1130,14 @@ define Device/xiaomi_mi-router-4c
 endef
 TARGET_DEVICES += xiaomi_mi-router-4c
 
+define Device/xiaomi_miwifi-3a
+  IMAGE_SIZE := 16064k
+  DEVICE_VENDOR := Xiaomi
+  DEVICE_MODEL := MiWiFi 3A
+  DEVICE_PACKAGES := kmod-mt76x2
+endef
+TARGET_DEVICES += xiaomi_miwifi-3a
+
 define Device/xiaomi_miwifi-3c
   IMAGE_SIZE := 15104k
   DEVICE_VENDOR := Xiaomi
@@ -1158,6 +1187,14 @@ define Device/zbtlink_zbt-we1226
 endef
 TARGET_DEVICES += zbtlink_zbt-we1226
 
+define Device/zbtlink_zbt-we2426-b
+  IMAGE_SIZE := 7872k
+  DEVICE_VENDOR := Zbtlink
+  DEVICE_MODEL := ZBT-WE2426-B
+  DEVICE_PACKAGES := kmod-mt76x2 kmod-usb2 kmod-usb-ohci
+endef
+TARGET_DEVICES += zbtlink_zbt-we2426-b
+
 define Device/zyxel_keenetic-extra-ii
   IMAGE_SIZE := 29824k
   DEVICE_VENDOR := Zyxel
diff --git a/target/linux/ramips/modules.mk b/target/linux/ramips/modules.mk
index ced479dc93e9cb..22a9660b0f34d6 100644
--- a/target/linux/ramips/modules.mk
+++ b/target/linux/ramips/modules.mk
@@ -47,6 +47,7 @@ $(eval $(call KernelPackage,pwm-mediatek-ramips))
 define KernelPackage/sdhci-mt7620
   SUBMENU:=Other modules
   TITLE:=MT7620 SDCI
+  CONFLICTS:=kmod-mmc-mtk
   DEPENDS:=@(TARGET_ramips_mt7620||TARGET_ramips_mt76x8||TARGET_ramips_mt7621) +kmod-mmc
   KCONFIG:= \
 	CONFIG_MTK_MMC \
@@ -151,3 +152,21 @@ define KernelPackage/sound-mt7620/description
 endef
 
 $(eval $(call KernelPackage,sound-mt7620))
+
+
+define KernelPackage/keyboard-sx951x
+  SUBMENU:=Other modules
+  TITLE:=Semtech SX9512/SX9513
+  DEPENDS:=@TARGET_ramips_mt7621 +kmod-input-core
+  KCONFIG:= \
+	CONFIG_KEYBOARD_SX951X \
+	CONFIG_INPUT_KEYBOARD=y
+  FILES:=$(LINUX_DIR)/drivers/input/keyboard/sx951x.ko
+  AUTOLOAD:=$(call AutoProbe,sx951x)
+endef
+
+define KernelPackage/keyboard-sx951x/description
+ Enable support for SX9512/SX9513 capacitive touch controllers
+endef
+
+$(eval $(call KernelPackage,keyboard-sx951x))
diff --git a/target/linux/ramips/mt7620/base-files/etc/board.d/02_network b/target/linux/ramips/mt7620/base-files/etc/board.d/02_network
index 577f77cb9339d4..f07ce73e82bf28 100644
--- a/target/linux/ramips/mt7620/base-files/etc/board.d/02_network
+++ b/target/linux/ramips/mt7620/base-files/etc/board.d/02_network
@@ -15,6 +15,7 @@ ramips_setup_interfaces()
 	dlink,dwr-921-c1|\
 	dlink,dwr-922-e2|\
 	dovado,tiny-ac|\
+	hongdian,h8922-v30|\
 	ohyeah,oy-0001|\
 	phicomm,psg1208|\
 	planex,db-wrt01|\
diff --git a/target/linux/ramips/mt7620/base-files/etc/hotplug.d/firmware/10-rt2x00-eeprom b/target/linux/ramips/mt7620/base-files/etc/hotplug.d/firmware/10-rt2x00-eeprom
index 2d1ac2e872d518..b68efcbba182aa 100644
--- a/target/linux/ramips/mt7620/base-files/etc/hotplug.d/firmware/10-rt2x00-eeprom
+++ b/target/linux/ramips/mt7620/base-files/etc/hotplug.d/firmware/10-rt2x00-eeprom
@@ -34,12 +34,12 @@ case "$FIRMWARE" in
 		wan_mac=$(jboot_config_read -m -i $(find_mtd_part "config") -o 0xE000)
 		wifi_mac=$(macaddr_add "$wan_mac" 1)
 		jboot_eeprom_extract "config" 0xE000
-		caldata_patch_mac $wifi_mac 0x4
+		caldata_patch_data "${wifi_mac//:/}" 0x4
 		;;
 	dovado,tiny-ac)
 		wifi_mac=$(mtd_get_mac_ascii u-boot-env INIC_MAC_ADDR)
 		caldata_extract "factory" 0x0 0x200
-		caldata_patch_mac $wifi_mac 0x4
+		caldata_patch_data "${wifi_mac//:/}" 0x4
 		;;
 	*)
 		caldata_die "Please define mtd-eeprom in $board DTS file!"
diff --git a/target/linux/ramips/mt7620/config-6.6 b/target/linux/ramips/mt7620/config-6.6
index 2c95b9c960ad00..3e1ef761e029b9 100644
--- a/target/linux/ramips/mt7620/config-6.6
+++ b/target/linux/ramips/mt7620/config-6.6
@@ -6,11 +6,8 @@ CONFIG_ARCH_MMAP_RND_BITS_MAX=15
 CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
 CONFIG_ARCH_SUSPEND_POSSIBLE=y
 CONFIG_BLK_MQ_PCI=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
 CONFIG_CEVT_SYSTICK_QUIRK=y
-CONFIG_CLKEVT_RT3352=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLK_MTMIPS=y
 CONFIG_CLONE_BACKWARDS=y
@@ -60,7 +57,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CMOS_UPDATE=y
@@ -183,6 +179,7 @@ CONFIG_PINCTRL_MTK_MTMIPS=y
 CONFIG_PREEMPT_NONE_BUILD=y
 CONFIG_PTP_1588_CLOCK_OPTIONAL=y
 CONFIG_RALINK=y
+CONFIG_RALINK_TIMER=y
 CONFIG_RALINK_WDT=y
 CONFIG_RANDSTRUCT_NONE=y
 CONFIG_RATIONAL=y
diff --git a/target/linux/ramips/mt7621/base-files/etc/board.d/01_leds b/target/linux/ramips/mt7621/base-files/etc/board.d/01_leds
index 9a77b1b1bc4a65..5d92006d66290c 100644
--- a/target/linux/ramips/mt7621/base-files/etc/board.d/01_leds
+++ b/target/linux/ramips/mt7621/base-files/etc/board.d/01_leds
@@ -58,6 +58,11 @@ wifire,s1500-nbn)
 belkin,rt1800)
 	ucidef_set_led_netdev "wan" "wan" "white:wan" "wan"
 	;;
+confiabits,mt7621-v1|\
+genexis,pulse-ex400|\
+netis,n6)
+	ucidef_set_led_netdev "wan" "wan" "green:wan" "wan" "link tx rx"
+	;;
 cudy,wr2100)
 	ucidef_set_led_netdev "lan1" "lan1" "green:lan1" "lan1"
 	ucidef_set_led_netdev "lan2" "lan2" "green:lan2" "lan2"
@@ -188,9 +193,6 @@ netgear,r7450)
 netgear,wax202)
 	ucidef_set_led_netdev "internet" "Internet" "green:net" "wan"
 	;;
-netis,n6)
-	ucidef_set_led_netdev "wan" "wan" "green:wan" "wan" "link tx rx"
-	;;
 oraybox,x3a)
 	ucidef_set_led_netdev "wan" "wan link" "red:status" "wan"
 	ucidef_set_led_netdev "lan" "lan link" "green:status" "br-lan"
diff --git a/target/linux/ramips/mt7621/base-files/etc/board.d/02_network b/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
index c780443c1c58de..9e4f139a4cc6e8 100644
--- a/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
+++ b/target/linux/ramips/mt7621/base-files/etc/board.d/02_network
@@ -1,4 +1,3 @@
-
 . /lib/functions.sh
 . /lib/functions/uci-defaults.sh
 . /lib/functions/system.sh
@@ -13,6 +12,7 @@ ramips_setup_interfaces()
 	asus,rt-ax53u|\
 	buffalo,wsr-2533dhpl2|\
 	buffalo,wsr-2533dhpls|\
+	confiabits,mt7621-v1|\
 	gehua,ghl-r-001|\
 	h3c,tx1800-plus|\
 	h3c,tx1801-plus|\
@@ -22,6 +22,7 @@ ramips_setup_interfaces()
 	mercusys,mr70x-v1|\
 	netgear,wax202|\
 	sim,simax1800t|\
+	tplink,mr600-v2-eu|\
 	xiaomi,mi-router-3-pro|\
 	xiaomi,mi-router-ac2100|\
 	xiaomi,mi-router-cr6606|\
@@ -36,6 +37,7 @@ ramips_setup_interfaces()
 		ucidef_set_interface_lan "swp0 swp1"
 		;;
 	ampedwireless,ally-00x19k|\
+	arcadyan,we410443|\
 	asus,rp-ac56|\
 	asus,rp-ac87|\
 	dlink,dap-1620-b1|\
@@ -67,12 +69,20 @@ ramips_setup_interfaces()
 		ucidef_set_interface_lan "lan"
 		;;
 	asiarf,ap7621-001|\
+	comfast,cf-e390ax|\
+	comfast,cf-ew72-v2|\
+	cudy,m1300-v2|\
+	cudy,m1800|\
 	dna,valokuitu-plus-ex400|\
+	genexis,pulse-ex400|\
 	humax,e10|\
 	keenetic,kn-3510|\
+	meig,slt866|\
 	openfi,5pro|\
 	wavlink,ws-wn572hp3-4g|\
-	winstars,ws-wn583a6)
+	winstars,ws-wn583a6|\
+	yuncore,ax820|\
+	zyxel,nr7101)
 		ucidef_set_interfaces_lan_wan "lan" "wan"
 		;;
 	asiarf,ap7621-nv1|\
@@ -104,11 +114,6 @@ ramips_setup_interfaces()
 		uci add_list firewall.@zone[1].network='eth_data'
 		uci add_list firewall.@zone[1].network='eth_om'
 		;;
-	cudy,m1800|\
-	yuncore,ax820|\
-	zyxel,nr7101)
-		ucidef_set_interfaces_lan_wan "lan" "wan"
-		;;
 	dlink,covr-x1860-a1)
 		ucidef_set_interfaces_lan_wan "ethernet" "internet"
 		;;
@@ -154,9 +159,6 @@ ramips_setup_interfaces()
 	tplink,tl-wpa8631p-v3)
 		ucidef_set_interface_lan "lan1 lan2 lan3 plc0"
 		;;
-	tplink,mr600-v2-eu)
-		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3" "wan"
-		;;
 	ubnt,edgerouter-x)
 		ucidef_set_interfaces_lan_wan "eth1 eth2 eth3 eth4" "eth0"
 		;;
@@ -177,11 +179,6 @@ ramips_setup_interfaces()
 	ruijie,rg-ew1200g-pro-v1.1)
 		ucidef_set_interfaces_lan_wan "lan3 lan2 lan1" "wan"
 		;;
-	comfast,cf-e390ax|\
-	comfast,cf-ew72-v2|\
-	meig,slt866)
-		ucidef_set_interfaces_lan_wan "lan" "wan"
-		;;
 	*)
 		ucidef_set_interfaces_lan_wan "lan1 lan2 lan3 lan4" "wan"
 		;;
@@ -215,6 +212,10 @@ ramips_setup_macs()
 		wan_mac=$(mtd_get_mac_ascii hwconfig HW.WAN.MAC.Address)
 		label_mac=$lan_mac
 		;;
+	arcadyan,we410443)
+		label_mac=$(mtd_get_mac_ascii config mac)
+		lan_mac=$label_mac
+		;;
 	arcadyan,we420223-99)
 		label_mac=$(mtd_get_mac_ascii board_data mac)
 		lan_mac=$label_mac
@@ -270,7 +271,7 @@ ramips_setup_macs()
 		wan_mac=$label_mac
 		;;
 	hiwifi,hc5962)
-		lan_mac=$(mtd_get_mac_ascii bdinfo "Vfac_mac ")
+		lan_mac=$(mtd_get_mac_ascii bdinfo "Vfac_mac")
 		label_mac=$lan_mac
 		[ -n "$lan_mac" ] || lan_mac=$(cat /sys/class/net/eth0/address)
 		wan_mac=$(macaddr_add "$lan_mac" 1)
diff --git a/target/linux/ramips/mt7621/base-files/etc/board.d/05_compat-version b/target/linux/ramips/mt7621/base-files/etc/board.d/05_compat-version
index acc69021d09f71..156fb1735e318e 100644
--- a/target/linux/ramips/mt7621/base-files/etc/board.d/05_compat-version
+++ b/target/linux/ramips/mt7621/base-files/etc/board.d/05_compat-version
@@ -8,6 +8,8 @@
 board_config_update
 
 case "$(board_name)" in
+	ubnt,edgerouter-x|\
+	ubnt,edgerouter-x-sfp|\
 	iptime,ax2004m)
 		ucidef_set_compat_version "2.0"
 		;;
diff --git a/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac b/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
index 4a056623abc021..294929e72349d6 100644
--- a/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
+++ b/target/linux/ramips/mt7621/base-files/etc/hotplug.d/ieee80211/10_fix_wifi_mac
@@ -10,6 +10,13 @@ PHYNBR=${DEVPATH##*/phy}
 board=$(board_name)
 
 case "$board" in
+	arcadyan,we410443)
+		label_mac=$(mtd_get_mac_ascii config mac)
+		[ "$PHYNBR" = "0" ] && \
+			macaddr_add $label_mac 1 > /sys${DEVPATH}/macaddress
+		[ "$PHYNBR" = "1" ] && \
+			macaddr_add $label_mac 2 > /sys${DEVPATH}/macaddress
+		;;
 	arcadyan,we420223-99)
 		if [ "$PHYNBR" = "0" ]; then
 			mac24=$(macaddr_add "$(get_mac_label)" "0xf00001")
@@ -103,7 +110,7 @@ case "$board" in
 			macaddr_setbit_la "$(mtd_get_mac_binary factory 0x4)" > /sys${DEVPATH}/macaddress
 		;;
 	hiwifi,hc5962)
-		label_mac=$(mtd_get_mac_ascii bdinfo "Vfac_mac ")
+		label_mac=$(mtd_get_mac_ascii bdinfo "Vfac_mac")
 		[ "$PHYNBR" = "0" ] && [ -n "$label_mac" ] && \
 		echo -n "$label_mac" > /sys${DEVPATH}/macaddress
 		[ "$PHYNBR" = "1" ] && [ -n "$label_mac" ] && \
diff --git a/target/linux/ramips/mt7621/base-files/etc/init.d/bootcount b/target/linux/ramips/mt7621/base-files/etc/init.d/bootcount
index b83223e7ddd757..2c88d68051854a 100755
--- a/target/linux/ramips/mt7621/base-files/etc/init.d/bootcount
+++ b/target/linux/ramips/mt7621/base-files/etc/init.d/bootcount
@@ -32,7 +32,8 @@ boot() {
 	samknows,whitebox-v8)
 		fw_setenv bootcount 0
 		;;
-	dna,valokuitu-plus-ex400)
+	dna,valokuitu-plus-ex400|\
+	genexis,pulse-ex400)
 		fw_setenv boot_cnt_primary 0
 		fw_setenv boot_cnt_alt 0
 		;;
diff --git a/target/linux/ramips/mt7621/base-files/lib/preinit/04_set_netdev_label b/target/linux/ramips/mt7621/base-files/lib/preinit/04_set_netdev_label
index 110e023b962d3d..2c5e420f93bd17 100644
--- a/target/linux/ramips/mt7621/base-files/lib/preinit/04_set_netdev_label
+++ b/target/linux/ramips/mt7621/base-files/lib/preinit/04_set_netdev_label
@@ -10,6 +10,14 @@ set_netdev_labels() {
 		[ "$netdev" = "$label" ] && continue
 		ip link set "$netdev" name "$label"
 	done
+
+	for dir in /sys/class/net/*; do
+		[ -r "$dir/of_node/openwrt,netdev-name" ] || continue
+		read -r label < "$dir/of_node/openwrt,netdev-name"
+		netdev="${dir##*/}"
+		[ "$netdev" = "$label" ] && continue
+		ip link set "$netdev" name "$label"
+	done
 }
 
 boot_hook_add preinit_main set_netdev_labels
diff --git a/target/linux/ramips/mt7621/base-files/lib/upgrade/dna.sh b/target/linux/ramips/mt7621/base-files/lib/upgrade/inteno.sh
similarity index 79%
rename from target/linux/ramips/mt7621/base-files/lib/upgrade/dna.sh
rename to target/linux/ramips/mt7621/base-files/lib/upgrade/inteno.sh
index d699516ff6f2d5..677000f6b1aef7 100644
--- a/target/linux/ramips/mt7621/base-files/lib/upgrade/dna.sh
+++ b/target/linux/ramips/mt7621/base-files/lib/upgrade/inteno.sh
@@ -16,11 +16,16 @@
 . /lib/functions.sh
 . /lib/upgrade/nand.sh
 
-dna_do_upgrade () {
-	tar -xaf $1
+inteno_do_upgrade () {
+	local tar_file=$1
+	local cmd=cat
+	# WARNING: This fails if tar contains more than one 'sysupgrade-*' directory.
+	local board_dir="$(tar tf "$tar_file" | grep -m 1 '^sysupgrade-.*/$')"
+	board_dir="${board_dir%/}"
+	tar -xaf "$tar_file"
 
 	# get the size of the new bootfs
-	local _bootfs_size=$(wc -c < ./sysupgrade-dna_valokuitu-plus-ex400/kernel)
+	local _bootfs_size=$(wc -c < "$board_dir/kernel")
 	[ -n "$_bootfs_size" -a "$_bootfs_size" -gt "0" ] || nand_do_upgrade_failed
 
 	# remove existing rootfses and recreate rootfs_0
@@ -32,7 +37,7 @@ dna_do_upgrade () {
 
 	# update the rootfs_0 contents
 	local _kern_ubivol=$( nand_find_volume "ubi0" "rootfs_0" )
-	ubiupdatevol /dev/${_kern_ubivol} sysupgrade-dna_valokuitu-plus-ex400/kernel
+	ubiupdatevol "/dev/$_kern_ubivol" "$board_dir/kernel"
 
 	fw_setenv root_vol rootfs_0
 	fw_setenv boot_cnt_primary 0
diff --git a/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh b/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh
index 17532f795b293c..33f8ccd4ce7b13 100755
--- a/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh
+++ b/target/linux/ramips/mt7621/base-files/lib/upgrade/platform.sh
@@ -156,8 +156,9 @@ platform_do_upgrade() {
 	buffalo,wsr-2533dhpls)
 		buffalo_do_upgrade "$1"
 		;;
-	dna,valokuitu-plus-ex400)
-		dna_do_upgrade "$1"
+	dna,valokuitu-plus-ex400|\
+	genexis,pulse-ex400)
+		inteno_do_upgrade "$1"
 		;;
 	elecom,wrc-x1800gs)
 		[ "$(fw_printenv -n bootmenu_delay)" != "0" ] || \
diff --git a/target/linux/ramips/mt7621/base-files/lib/upgrade/ubnt.sh b/target/linux/ramips/mt7621/base-files/lib/upgrade/ubnt.sh
index 748ec8e6286ee6..7e9d937d79f856 100644
--- a/target/linux/ramips/mt7621/base-files/lib/upgrade/ubnt.sh
+++ b/target/linux/ramips/mt7621/base-files/lib/upgrade/ubnt.sh
@@ -8,32 +8,16 @@
 
 UBNT_ERX_KERNEL_INDEX_OFFSET=160
 
-ubnt_get_target_kernel() {
+ubnt_update_kernel_flag() {
 	local factory_mtd=$1
-	local current_kernel_index=$(hexdump -s $UBNT_ERX_KERNEL_INDEX_OFFSET -n 1 -e '/1 "%X "' ${factory_mtd})
+	local kernel_index=$(hexdump -s $UBNT_ERX_KERNEL_INDEX_OFFSET -n 1 -e '/1 "%X "' ${factory_mtd})
 
-	if [ $current_kernel_index == "0" ]; then
-		echo 'kernel2'
-	elif [ $current_kernel_index == "1" ]; then
-		echo 'kernel1'
-	fi
-}
-
-ubnt_update_target_kernel() {
-	local factory_mtd=$1
-	local kernel_part=$2
-
-	local new_kernel_index
-	if [ $kernel_part == "kernel1" ]; then
-		new_kernel_index="\x00"
-	elif [ $kernel_part == "kernel2" ]; then
-		new_kernel_index="\x01"
-	else
-		echo 'Unknown kernel image index' >&2
-		return 1
+	if [ $kernel_index = "0" ]; then
+		echo "Kernel flag already set to kernel slot 1"
+		return 0
 	fi
 
-	if ! (echo -e $new_kernel_index | dd of=${factory_mtd} bs=1 count=1 seek=$UBNT_ERX_KERNEL_INDEX_OFFSET); then
+	if ! (echo -e "\x00" | dd of=${factory_mtd} bs=1 count=1 seek=$UBNT_ERX_KERNEL_INDEX_OFFSET); then
 		echo 'Failed to update kernel bootup index' >&2
 		return 1
 	fi
@@ -46,15 +30,6 @@ platform_upgrade_ubnt_erx() {
 		exit 1
 	fi
 
-	local kernel_part="$(ubnt_get_target_kernel ${factory_mtd})"
-	if [ -z "$kernel_part" ]; then
-		echo "cannot find factory partition" >&2
-		exit 1
-	fi
-
-	# This is a global defined in nand.sh, sets partition kernel will be flashed into
-	CI_KERNPART=${kernel_part}
-
 	#Remove volume possibly left over from stock firmware
 	local ubidev="$( nand_find_ubi "$CI_UBIPART" )"
 	if [ -z "$ubidev" ]; then
@@ -72,7 +47,7 @@ platform_upgrade_ubnt_erx() {
 		[ -n "$troot_ubivol" ] && ubirmvol /dev/$ubidev -N troot || true
 	fi
 
-	ubnt_update_target_kernel ${factory_mtd} ${kernel_part} || exit 1
+	ubnt_update_kernel_flag ${factory_mtd} || exit 1
 
 	nand_do_upgrade "$1"
 }
diff --git a/target/linux/ramips/mt7621/config-6.6 b/target/linux/ramips/mt7621/config-6.6
index d1ca85aebd42bf..7a3e68ef4594aa 100644
--- a/target/linux/ramips/mt7621/config-6.6
+++ b/target/linux/ramips/mt7621/config-6.6
@@ -7,8 +7,6 @@ CONFIG_ARCH_SUSPEND_POSSIBLE=y
 CONFIG_AT803X_PHY=y
 CONFIG_BLK_MQ_PCI=y
 CONFIG_BOARD_SCACHE=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
 CONFIG_CLKSRC_MIPS_GIC=y
 CONFIG_CLK_MT7621=y
@@ -65,7 +63,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CMOS_UPDATE=y
diff --git a/target/linux/ramips/mt76x8/base-files/etc/board.d/01_leds b/target/linux/ramips/mt76x8/base-files/etc/board.d/01_leds
index 5ea668de012624..00e5086bb3fea5 100644
--- a/target/linux/ramips/mt76x8/base-files/etc/board.d/01_leds
+++ b/target/linux/ramips/mt76x8/base-files/etc/board.d/01_leds
@@ -186,6 +186,13 @@ zbtlink,zbt-we1226)
 	ucidef_set_led_switch "lan2" "LAN2" "green:lan2" "switch0" "0x02"
 	ucidef_set_led_switch "wan" "WAN" "green:wan" "switch0" "0x10"
 	;;
+zbtlink,zbt-we2426-b)
+	ucidef_set_led_switch "wan" "wan" "green:wan" "switch0" "0x10"
+	ucidef_set_led_switch "lan1" "lan1" "green:lan-1" "switch0" "0x01"
+	ucidef_set_led_switch "lan2" "lan2" "green:lan-2" "switch0" "0x02"
+	ucidef_set_led_switch "lan3" "lan3" "green:lan-3" "switch0" "0x04"
+	ucidef_set_led_switch "lan4" "lan4" "green:lan-4" "switch0" "0x08"
+	;;
 zyxel,keenetic-extra-ii)
 	ucidef_set_led_netdev "wifi_led" "wifi" "green:wifi" "wlan0"
 	ucidef_set_led_switch "internet" "internet" "green:internet" "switch0" "0x01"
diff --git a/target/linux/ramips/mt76x8/base-files/etc/board.d/02_network b/target/linux/ramips/mt76x8/base-files/etc/board.d/02_network
index cb0983b9dc133b..372821c3b8ebe3 100644
--- a/target/linux/ramips/mt76x8/base-files/etc/board.d/02_network
+++ b/target/linux/ramips/mt76x8/base-files/etc/board.d/02_network
@@ -97,6 +97,7 @@ ramips_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"4:lan" "6@eth0"
 		;;
+	cudy,m1200-v1|\
 	cudy,tr1200-v1)
 		ucidef_add_switch "switch0" \
 			"0:lan" "1:wan" "6@eth0"
@@ -106,7 +107,8 @@ ramips_setup_interfaces()
 			"2:lan:2" "3:lan:1" "4:wan" "6@eth0"
 		;;
 	duzun,dm06|\
-	glinet,gl-mt300n-v2)
+	glinet,gl-mt300n-v2|\
+	hongdian,h7920-v40)
 		ucidef_add_switch "switch0" \
 			"1:lan" "0:wan" "6@eth0"
 		;;
@@ -148,7 +150,8 @@ ramips_setup_interfaces()
 	netgear,r6020|\
 	netgear,r6080|\
 	netgear,r6120|\
-	wavlink,wl-wn531a3)
+	wavlink,wl-wn531a3|\
+	zbtlink,zbt-we2426-b)
 		ucidef_add_switch "switch0" \
 			"0:lan:4" "1:lan:3" "2:lan:2" "3:lan:1" "4:wan" "6@eth0"
 		;;
@@ -196,6 +199,10 @@ ramips_setup_interfaces()
 		ucidef_add_switch "switch0" \
 			"4:lan:1" "2:lan:2" "1:wan" "6@eth0"
 		;;
+	xiaomi,miwifi-3a)
+		ucidef_add_switch "switch0" \
+			"0:wan" "2:lan:1" "4:lan:2" "6@eth0"
+		;;
 	xiaomi,miwifi-3c)
 		ucidef_add_switch "switch0" \
 			"0:wan" "2:lan:2" "4:lan:1" "6@eth0"
@@ -244,7 +251,8 @@ ramips_setup_macs()
 	hilink,hlk-7688a|\
 	wavlink,wl-wn531a3|\
 	wavlink,wl-wn577a2|\
-	wavlink,wl-wn578a2)
+	wavlink,wl-wn578a2|\
+	zbtlink,zbt-we2426-b)
 		wan_mac=$(mtd_get_mac_binary factory 0x2e)
 		label_mac=$(mtd_get_mac_binary factory 0x4)
 		;;
@@ -270,6 +278,7 @@ ramips_setup_macs()
 	totolink,a3)
 		wan_mac=$(mtd_get_mac_binary u-boot 0x1fc40)
 		;;
+	hongdian,h7920-v40|\
 	jotale,js76x8-8m|\
 	jotale,js76x8-16m|\
 	jotale,js76x8-32m|\
diff --git a/target/linux/ramips/mt76x8/base-files/etc/board.d/03_gpio_switches b/target/linux/ramips/mt76x8/base-files/etc/board.d/03_gpio_switches
new file mode 100644
index 00000000000000..c70e59c48032fc
--- /dev/null
+++ b/target/linux/ramips/mt76x8/base-files/etc/board.d/03_gpio_switches
@@ -0,0 +1,20 @@
+#
+# Copyright (C) 2025 OpenWrt.org
+#
+
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+board=$(board_name)
+
+case "$board" in
+hongdian,h7920-v40)
+	ucidef_add_gpio_switch "modem_enable" "Modem power" "modem_power" "1"
+	ucidef_add_gpio_switch "switch_serial_mode" "Switch RS232 to RS485" "serial_rs485_mode" "0"
+	;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/ramips/mt76x8/base-files/etc/init.d/bootcount b/target/linux/ramips/mt76x8/base-files/etc/init.d/bootcount
old mode 100755
new mode 100644
index 23f1e71b41809c..069b481bb94f76
--- a/target/linux/ramips/mt76x8/base-files/etc/init.d/bootcount
+++ b/target/linux/ramips/mt76x8/base-files/etc/init.d/bootcount
@@ -9,6 +9,7 @@ boot() {
 			echo -e "bootcount\nbootchanged\n" | /usr/sbin/fw_setenv -s -
 		;;
 	xiaomi,mi-router-4c|\
+	xiaomi,miwifi-3a|\
 	xiaomi,miwifi-nano)
 		fw_setenv flag_boot_success 1
 		;;
diff --git a/target/linux/ramips/mt76x8/config-6.6 b/target/linux/ramips/mt76x8/config-6.6
index bf57a7a3302d03..f40d18efcce523 100644
--- a/target/linux/ramips/mt76x8/config-6.6
+++ b/target/linux/ramips/mt76x8/config-6.6
@@ -5,12 +5,7 @@ CONFIG_ARCH_MMAP_RND_BITS_MAX=15
 CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
 CONFIG_ARCH_SUSPEND_POSSIBLE=y
 CONFIG_BLK_MQ_PCI=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
-CONFIG_CEVT_SYSTICK_QUIRK=y
-CONFIG_CLKEVT_RT3352=y
-CONFIG_CLKSRC_MMIO=y
 CONFIG_CLK_MTMIPS=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CMDLINE="rootfstype=squashfs,jffs2"
@@ -58,7 +53,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CMOS_UPDATE=y
@@ -176,6 +170,7 @@ CONFIG_PINCTRL_MTK_MTMIPS=y
 CONFIG_PREEMPT_NONE_BUILD=y
 CONFIG_PTP_1588_CLOCK_OPTIONAL=y
 CONFIG_RALINK=y
+# CONFIG_RALINK_TIMER is not set
 # CONFIG_RALINK_WDT is not set
 CONFIG_RANDSTRUCT_NONE=y
 CONFIG_RATIONAL=y
@@ -218,8 +213,6 @@ CONFIG_SYS_SUPPORTS_MIPS16=y
 CONFIG_SYS_SUPPORTS_ZBOOT=y
 CONFIG_TARGET_ISA_REV=2
 CONFIG_TICK_CPU_ACCOUNTING=y
-CONFIG_TIMER_OF=y
-CONFIG_TIMER_PROBE=y
 CONFIG_TINY_SRCU=y
 CONFIG_USB_SUPPORT=y
 CONFIG_USE_OF=y
diff --git a/target/linux/ramips/patches-6.6/001-v6.13-clocksource-drivers-ralink-Add-Ralink-System-Tick-Co.patch b/target/linux/ramips/patches-6.6/001-v6.13-clocksource-drivers-ralink-Add-Ralink-System-Tick-Co.patch
new file mode 100644
index 00000000000000..de3438427d787c
--- /dev/null
+++ b/target/linux/ramips/patches-6.6/001-v6.13-clocksource-drivers-ralink-Add-Ralink-System-Tick-Co.patch
@@ -0,0 +1,384 @@
+From 57cbfd333c9d65bfab1a06b49c75536ee28dc2ce Mon Sep 17 00:00:00 2001
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Date: Mon, 28 Oct 2024 21:36:43 +0100
+Subject: clocksource/drivers/ralink: Add Ralink System Tick Counter driver
+
+System Tick Counter is present on Ralink SoCs RT3352 and MT7620. This
+driver has been in 'arch/mips/ralink' directory since the beggining of
+Ralink architecture support. However, it can be moved into a more proper
+place in 'drivers/clocksource'. Hence add it here adding also support for
+compile test targets and reducing LOC in architecture code folder.
+
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Link: https://lore.kernel.org/r/20241028203643.191268-2-sergio.paracuellos@gmail.com
+Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
+---
+ arch/mips/ralink/Kconfig           |   7 --
+ arch/mips/ralink/Makefile          |   2 -
+ arch/mips/ralink/cevt-rt3352.c     | 153 -------------------------------------
+ drivers/clocksource/Kconfig        |   9 +++
+ drivers/clocksource/Makefile       |   1 +
+ drivers/clocksource/timer-ralink.c | 150 ++++++++++++++++++++++++++++++++++++
+ 6 files changed, 160 insertions(+), 162 deletions(-)
+ delete mode 100644 arch/mips/ralink/cevt-rt3352.c
+ create mode 100644 drivers/clocksource/timer-ralink.c
+
+--- a/arch/mips/ralink/Kconfig
++++ b/arch/mips/ralink/Kconfig
+@@ -1,13 +1,6 @@
+ # SPDX-License-Identifier: GPL-2.0
+ if RALINK
+ 
+-config CLKEVT_RT3352
+-	bool
+-	depends on SOC_RT305X || SOC_MT7620
+-	default y
+-	select TIMER_OF
+-	select CLKSRC_MMIO
+-
+ config RALINK_ILL_ACC
+ 	bool
+ 	depends on SOC_RT305X
+--- a/arch/mips/ralink/Makefile
++++ b/arch/mips/ralink/Makefile
+@@ -10,8 +10,6 @@ ifndef CONFIG_MIPS_GIC
+ 	obj-y += clk.o timer.o
+ endif
+ 
+-obj-$(CONFIG_CLKEVT_RT3352) += cevt-rt3352.o
+-
+ obj-$(CONFIG_RALINK_ILL_ACC) += ill_acc.o
+ 
+ obj-$(CONFIG_IRQ_INTC) += irq.o
+--- a/arch/mips/ralink/cevt-rt3352.c
++++ /dev/null
+@@ -1,153 +0,0 @@
+-/*
+- * This file is subject to the terms and conditions of the GNU General Public
+- * License.  See the file "COPYING" in the main directory of this archive
+- * for more details.
+- *
+- * Copyright (C) 2013 by John Crispin <john@phrozen.org>
+- */
+-
+-#include <linux/clockchips.h>
+-#include <linux/clocksource.h>
+-#include <linux/interrupt.h>
+-#include <linux/reset.h>
+-#include <linux/init.h>
+-#include <linux/time.h>
+-#include <linux/of.h>
+-#include <linux/of_irq.h>
+-#include <linux/of_address.h>
+-
+-#include <asm/mach-ralink/ralink_regs.h>
+-
+-#define SYSTICK_FREQ		(50 * 1000)
+-
+-#define SYSTICK_CONFIG		0x00
+-#define SYSTICK_COMPARE		0x04
+-#define SYSTICK_COUNT		0x08
+-
+-/* route systick irq to mips irq 7 instead of the r4k-timer */
+-#define CFG_EXT_STK_EN		0x2
+-/* enable the counter */
+-#define CFG_CNT_EN		0x1
+-
+-struct systick_device {
+-	void __iomem *membase;
+-	struct clock_event_device dev;
+-	int irq_requested;
+-	int freq_scale;
+-};
+-
+-static int systick_set_oneshot(struct clock_event_device *evt);
+-static int systick_shutdown(struct clock_event_device *evt);
+-
+-static int systick_next_event(unsigned long delta,
+-				struct clock_event_device *evt)
+-{
+-	struct systick_device *sdev;
+-	u32 count;
+-
+-	sdev = container_of(evt, struct systick_device, dev);
+-	count = ioread32(sdev->membase + SYSTICK_COUNT);
+-	count = (count + delta) % SYSTICK_FREQ;
+-	iowrite32(count, sdev->membase + SYSTICK_COMPARE);
+-
+-	return 0;
+-}
+-
+-static void systick_event_handler(struct clock_event_device *dev)
+-{
+-	/* noting to do here */
+-}
+-
+-static irqreturn_t systick_interrupt(int irq, void *dev_id)
+-{
+-	struct clock_event_device *dev = (struct clock_event_device *) dev_id;
+-
+-	dev->event_handler(dev);
+-
+-	return IRQ_HANDLED;
+-}
+-
+-static struct systick_device systick = {
+-	.dev = {
+-		/*
+-		 * cevt-r4k uses 300, make sure systick
+-		 * gets used if available
+-		 */
+-		.rating			= 310,
+-		.features		= CLOCK_EVT_FEAT_ONESHOT,
+-		.set_next_event		= systick_next_event,
+-		.set_state_shutdown	= systick_shutdown,
+-		.set_state_oneshot	= systick_set_oneshot,
+-		.event_handler		= systick_event_handler,
+-	},
+-};
+-
+-static int systick_shutdown(struct clock_event_device *evt)
+-{
+-	struct systick_device *sdev;
+-
+-	sdev = container_of(evt, struct systick_device, dev);
+-
+-	if (sdev->irq_requested)
+-		free_irq(systick.dev.irq, &systick.dev);
+-	sdev->irq_requested = 0;
+-	iowrite32(0, systick.membase + SYSTICK_CONFIG);
+-
+-	return 0;
+-}
+-
+-static int systick_set_oneshot(struct clock_event_device *evt)
+-{
+-	const char *name = systick.dev.name;
+-	struct systick_device *sdev;
+-	int irq = systick.dev.irq;
+-
+-	sdev = container_of(evt, struct systick_device, dev);
+-
+-	if (!sdev->irq_requested) {
+-		if (request_irq(irq, systick_interrupt,
+-				IRQF_PERCPU | IRQF_TIMER, name, &systick.dev))
+-			pr_err("Failed to request irq %d (%s)\n", irq, name);
+-	}
+-	sdev->irq_requested = 1;
+-	iowrite32(CFG_EXT_STK_EN | CFG_CNT_EN,
+-		  systick.membase + SYSTICK_CONFIG);
+-
+-	return 0;
+-}
+-
+-static int __init ralink_systick_init(struct device_node *np)
+-{
+-	int ret;
+-
+-	systick.membase = of_iomap(np, 0);
+-	if (!systick.membase)
+-		return -ENXIO;
+-
+-	systick.dev.name = np->name;
+-	clockevents_calc_mult_shift(&systick.dev, SYSTICK_FREQ, 60);
+-	systick.dev.max_delta_ns = clockevent_delta2ns(0x7fff, &systick.dev);
+-	systick.dev.max_delta_ticks = 0x7fff;
+-	systick.dev.min_delta_ns = clockevent_delta2ns(0x3, &systick.dev);
+-	systick.dev.min_delta_ticks = 0x3;
+-	systick.dev.irq = irq_of_parse_and_map(np, 0);
+-	if (!systick.dev.irq) {
+-		pr_err("%pOFn: request_irq failed", np);
+-		return -EINVAL;
+-	}
+-
+-	ret = clocksource_mmio_init(systick.membase + SYSTICK_COUNT, np->name,
+-				    SYSTICK_FREQ, 301, 16,
+-				    clocksource_mmio_readl_up);
+-	if (ret)
+-		return ret;
+-
+-	clockevents_register_device(&systick.dev);
+-
+-	pr_info("%pOFn: running - mult: %d, shift: %d\n",
+-			np, systick.dev.mult, systick.dev.shift);
+-
+-	return 0;
+-}
+-
+-TIMER_OF_DECLARE(systick, "ralink,cevt-systick", ralink_systick_init);
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -733,4 +733,13 @@ config GOLDFISH_TIMER
+ 	help
+ 	  Support for the timer/counter of goldfish-rtc
+ 
++config RALINK_TIMER
++	bool "Ralink System Tick Counter"
++	depends on SOC_RT305X || SOC_MT7620 || COMPILE_TEST
++	select CLKSRC_MMIO
++	select TIMER_OF
++	help
++	  Enables support for system tick counter present on
++	  Ralink SoCs RT3352 and MT7620.
++
+ endmenu
+--- a/drivers/clocksource/Makefile
++++ b/drivers/clocksource/Makefile
+@@ -89,3 +89,4 @@ obj-$(CONFIG_MSC313E_TIMER)		+= timer-ms
+ obj-$(CONFIG_GOLDFISH_TIMER)		+= timer-goldfish.o
+ obj-$(CONFIG_GXP_TIMER)			+= timer-gxp.o
+ obj-$(CONFIG_CLKSRC_LOONGSON1_PWM)	+= timer-loongson1-pwm.o
++obj-$(CONFIG_RALINK_TIMER)		+= timer-ralink.o
+--- /dev/null
++++ b/drivers/clocksource/timer-ralink.c
+@@ -0,0 +1,150 @@
++// SPDX-License-Identifier: GPL-2.0
++/*
++ * Ralink System Tick Counter driver present on RT3352 and MT7620 SoCs.
++ *
++ * Copyright (C) 2013 by John Crispin <john@phrozen.org>
++ */
++
++#include <linux/clockchips.h>
++#include <linux/clocksource.h>
++#include <linux/interrupt.h>
++#include <linux/reset.h>
++#include <linux/init.h>
++#include <linux/time.h>
++#include <linux/of.h>
++#include <linux/of_irq.h>
++#include <linux/of_address.h>
++
++#define SYSTICK_FREQ		(50 * 1000)
++
++#define SYSTICK_CONFIG		0x00
++#define SYSTICK_COMPARE		0x04
++#define SYSTICK_COUNT		0x08
++
++/* route systick irq to mips irq 7 instead of the r4k-timer */
++#define CFG_EXT_STK_EN		0x2
++/* enable the counter */
++#define CFG_CNT_EN		0x1
++
++struct systick_device {
++	void __iomem *membase;
++	struct clock_event_device dev;
++	int irq_requested;
++	int freq_scale;
++};
++
++static int systick_set_oneshot(struct clock_event_device *evt);
++static int systick_shutdown(struct clock_event_device *evt);
++
++static int systick_next_event(unsigned long delta,
++			      struct clock_event_device *evt)
++{
++	struct systick_device *sdev;
++	u32 count;
++
++	sdev = container_of(evt, struct systick_device, dev);
++	count = ioread32(sdev->membase + SYSTICK_COUNT);
++	count = (count + delta) % SYSTICK_FREQ;
++	iowrite32(count, sdev->membase + SYSTICK_COMPARE);
++
++	return 0;
++}
++
++static void systick_event_handler(struct clock_event_device *dev)
++{
++	/* noting to do here */
++}
++
++static irqreturn_t systick_interrupt(int irq, void *dev_id)
++{
++	struct clock_event_device *dev = (struct clock_event_device *)dev_id;
++
++	dev->event_handler(dev);
++
++	return IRQ_HANDLED;
++}
++
++static struct systick_device systick = {
++	.dev = {
++		/*
++		 * cevt-r4k uses 300, make sure systick
++		 * gets used if available
++		 */
++		.rating			= 310,
++		.features		= CLOCK_EVT_FEAT_ONESHOT,
++		.set_next_event		= systick_next_event,
++		.set_state_shutdown	= systick_shutdown,
++		.set_state_oneshot	= systick_set_oneshot,
++		.event_handler		= systick_event_handler,
++	},
++};
++
++static int systick_shutdown(struct clock_event_device *evt)
++{
++	struct systick_device *sdev;
++
++	sdev = container_of(evt, struct systick_device, dev);
++
++	if (sdev->irq_requested)
++		free_irq(systick.dev.irq, &systick.dev);
++	sdev->irq_requested = 0;
++	iowrite32(0, systick.membase + SYSTICK_CONFIG);
++
++	return 0;
++}
++
++static int systick_set_oneshot(struct clock_event_device *evt)
++{
++	const char *name = systick.dev.name;
++	struct systick_device *sdev;
++	int irq = systick.dev.irq;
++
++	sdev = container_of(evt, struct systick_device, dev);
++
++	if (!sdev->irq_requested) {
++		if (request_irq(irq, systick_interrupt,
++				IRQF_PERCPU | IRQF_TIMER, name, &systick.dev))
++			pr_err("Failed to request irq %d (%s)\n", irq, name);
++	}
++	sdev->irq_requested = 1;
++	iowrite32(CFG_EXT_STK_EN | CFG_CNT_EN,
++		  systick.membase + SYSTICK_CONFIG);
++
++	return 0;
++}
++
++static int __init ralink_systick_init(struct device_node *np)
++{
++	int ret;
++
++	systick.membase = of_iomap(np, 0);
++	if (!systick.membase)
++		return -ENXIO;
++
++	systick.dev.name = np->name;
++	clockevents_calc_mult_shift(&systick.dev, SYSTICK_FREQ, 60);
++	systick.dev.max_delta_ns = clockevent_delta2ns(0x7fff, &systick.dev);
++	systick.dev.max_delta_ticks = 0x7fff;
++	systick.dev.min_delta_ns = clockevent_delta2ns(0x3, &systick.dev);
++	systick.dev.min_delta_ticks = 0x3;
++	systick.dev.irq = irq_of_parse_and_map(np, 0);
++	if (!systick.dev.irq) {
++		pr_err("%pOFn: request_irq failed", np);
++		return -EINVAL;
++	}
++
++	ret = clocksource_mmio_init(systick.membase + SYSTICK_COUNT, np->name,
++				    SYSTICK_FREQ, 301, 16,
++				    clocksource_mmio_readl_up);
++	if (ret)
++		return ret;
++
++	clockevents_register_device(&systick.dev);
++
++	pr_info("%pOFn: running - mult: %d, shift: %d\n",
++			np, systick.dev.mult, systick.dev.shift);
++
++	return 0;
++}
++
++TIMER_OF_DECLARE(systick, "ralink,cevt-systick", ralink_systick_init);
diff --git a/target/linux/ramips/patches-6.6/002-03-v6.13-clk-ralink-mtmips-add-mmc-related-clocks-for-SoCs-MT.patch b/target/linux/ramips/patches-6.6/002-03-v6.13-clk-ralink-mtmips-add-mmc-related-clocks-for-SoCs-MT.patch
new file mode 100644
index 00000000000000..076cda246eed1b
--- /dev/null
+++ b/target/linux/ramips/patches-6.6/002-03-v6.13-clk-ralink-mtmips-add-mmc-related-clocks-for-SoCs-MT.patch
@@ -0,0 +1,101 @@
+From 198675bbc03d437fb80a35d781ad13d622d0ff68 Mon Sep 17 00:00:00 2001
+From: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Date: Tue, 10 Sep 2024 06:40:24 +0200
+Subject: [PATCH 3/3] clk: ralink: mtmips: add mmc related clocks for SoCs
+ MT7620, MT7628 and MT7688
+
+Original architecture clock code from where this driver was derived did not
+include nothing related to mmc clocks. OpenWRT people started to use mtk-sd
+upstream driver recently and they were forced to use a dts 'fixed-clock'
+node with 48 MHz clock:
+- https://github.com/openwrt/openwrt/pull/15896
+The proper thing to do to avoid that is to add the mmc related clocks to the
+driver to avoid a dts with fixed clocks nodes. The minimal documentation in
+the mt7620 programming guide says that there is a BBP_PLL clock of 480 MHz
+derived from the 40 MHz XTAL and from there a clock divider by ten produces
+the desired SDHC clock of 48 MHz for the mmc. Hence add a fixed clock 'bbppll'
+and factor clock 'sdhc' ten divider child to properly set the 'mmc' peripheral
+clock with the desired 48 Mhz rate.
+
+Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
+Link: https://lore.kernel.org/r/20240910044024.120009-4-sergio.paracuellos@gmail.com
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/ralink/clk-mtmips.c | 30 +++++++++++++++++++++++-------
+ 1 file changed, 23 insertions(+), 7 deletions(-)
+
+--- a/drivers/clk/ralink/clk-mtmips.c
++++ b/drivers/clk/ralink/clk-mtmips.c
+@@ -207,6 +207,7 @@ static struct mtmips_clk mt7620_pherip_c
+ 	{ CLK_PERIPH("10000b00.spi", "bus") },
+ 	{ CLK_PERIPH("10000b40.spi", "bus") },
+ 	{ CLK_PERIPH("10000c00.uartlite", "periph") },
++	{ CLK_PERIPH("10130000.mmc", "sdhc") },
+ 	{ CLK_PERIPH("10180000.wmac", "xtal") }
+ };
+ 
+@@ -220,6 +221,7 @@ static struct mtmips_clk mt76x8_pherip_c
+ 	{ CLK_PERIPH("10000c00.uart0", "periph") },
+ 	{ CLK_PERIPH("10000d00.uart1", "periph") },
+ 	{ CLK_PERIPH("10000e00.uart2", "periph") },
++	{ CLK_PERIPH("10130000.mmc", "sdhc") },
+ 	{ CLK_PERIPH("10300000.wmac", "xtal") }
+ };
+ 
+@@ -271,8 +273,13 @@ static struct mtmips_clk_fixed rt3352_fi
+ 	CLK_FIXED("periph", "xtal", 40000000)
+ };
+ 
++static struct mtmips_clk_fixed mt7620_fixed_clocks[] = {
++	CLK_FIXED("bbppll", "xtal", 480000000)
++};
++
+ static struct mtmips_clk_fixed mt76x8_fixed_clocks[] = {
+-	CLK_FIXED("pcmi2s", "xtal", 480000000),
++	CLK_FIXED("bbppll", "xtal", 480000000),
++	CLK_FIXED("pcmi2s", "bbppll", 480000000),
+ 	CLK_FIXED("periph", "xtal", 40000000)
+ };
+ 
+@@ -327,6 +334,15 @@ static struct mtmips_clk_factor rt305x_f
+ 	CLK_FACTOR("bus", "cpu", 1, 3)
+ };
+ 
++static struct mtmips_clk_factor mt7620_factor_clocks[] = {
++	CLK_FACTOR("sdhc", "bbppll", 1, 10)
++};
++
++static struct mtmips_clk_factor mt76x8_factor_clocks[] = {
++	CLK_FACTOR("bus", "cpu", 1, 3),
++	CLK_FACTOR("sdhc", "bbppll", 1, 10)
++};
++
+ static int mtmips_register_factor_clocks(struct clk_hw_onecell_data *clk_data,
+ 					 struct mtmips_clk_priv *priv)
+ {
+@@ -810,10 +826,10 @@ static const struct mtmips_clk_data rt53
+ static const struct mtmips_clk_data mt7620_clk_data = {
+ 	.clk_base = mt7620_clks_base,
+ 	.num_clk_base = ARRAY_SIZE(mt7620_clks_base),
+-	.clk_fixed = NULL,
+-	.num_clk_fixed = 0,
+-	.clk_factor = NULL,
+-	.num_clk_factor = 0,
++	.clk_fixed = mt7620_fixed_clocks,
++	.num_clk_fixed = ARRAY_SIZE(mt7620_fixed_clocks),
++	.clk_factor = mt7620_factor_clocks,
++	.num_clk_factor = ARRAY_SIZE(mt7620_factor_clocks),
+ 	.clk_periph = mt7620_pherip_clks,
+ 	.num_clk_periph = ARRAY_SIZE(mt7620_pherip_clks),
+ };
+@@ -823,8 +839,8 @@ static const struct mtmips_clk_data mt76
+ 	.num_clk_base = ARRAY_SIZE(mt76x8_clks_base),
+ 	.clk_fixed = mt76x8_fixed_clocks,
+ 	.num_clk_fixed = ARRAY_SIZE(mt76x8_fixed_clocks),
+-	.clk_factor = rt305x_factor_clocks,
+-	.num_clk_factor = ARRAY_SIZE(rt305x_factor_clocks),
++	.clk_factor = mt76x8_factor_clocks,
++	.num_clk_factor = ARRAY_SIZE(mt76x8_factor_clocks),
+ 	.clk_periph = mt76x8_pherip_clks,
+ 	.num_clk_periph = ARRAY_SIZE(mt76x8_pherip_clks),
+ };
diff --git a/target/linux/ramips/patches-6.6/100-clk-ralink-mtmips-fix-clock-plan-for-Ralink-SoC-RT3883.patch b/target/linux/ramips/patches-6.6/100-clk-ralink-mtmips-fix-clock-plan-for-Ralink-SoC-RT3883.patch
deleted file mode 100644
index a3d58b78f6de73..00000000000000
--- a/target/linux/ramips/patches-6.6/100-clk-ralink-mtmips-fix-clock-plan-for-Ralink-SoC-RT3883.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-Subject: [PATCH] clk: ralink: mtmips: fix clock plan for Ralink SoC RT3883
-Date: Tue,  6 Aug 2024 16:29:02 +0200
-Message-Id: <20240806142902.224164-1-sergio.paracuellos@gmail.com>
-
-Clock plan for Ralink SoC RT3883 needs an extra 'periph' clock to properly
-set some peripherals that has this clock as their parent. When this driver
-was mainlined we could not find any active users of this SoC so we cannot
-perform any real tests for it. Now, one user of a Belkin f9k1109 version 1
-device which uses this SoC appear and reported some issues in openWRT:
-- https://github.com/openwrt/openwrt/issues/16054
-The peripherals that are wrong are 'uart', 'i2c', 'i2s' and 'uartlite' which
-has a not defined 'periph' clock as parent. Hence, introduce it to have a
-properly working clock plan for this SoC.
-
-Fixes: 6f3b15586eef ("clk: ralink: add clock and reset driver for MTMIPS SoCs")
-Signed-off-by: Sergio Paracuellos <sergio.paracuellos@gmail.com>
----
- drivers/clk/ralink/clk-mtmips.c | 9 +++++++--
- 1 file changed, 7 insertions(+), 2 deletions(-)
-
---- a/drivers/clk/ralink/clk-mtmips.c
-+++ b/drivers/clk/ralink/clk-mtmips.c
-@@ -267,6 +267,11 @@ static struct mtmips_clk_fixed rt305x_fi
- 	CLK_FIXED("xtal", NULL, 40000000)
- };
- 
-+static struct mtmips_clk_fixed rt3383_fixed_clocks[] = {
-+	CLK_FIXED("xtal", NULL, 40000000),
-+	CLK_FIXED("periph", "xtal", 40000000)
-+};
-+
- static struct mtmips_clk_fixed rt3352_fixed_clocks[] = {
- 	CLK_FIXED("periph", "xtal", 40000000)
- };
-@@ -779,8 +784,8 @@ static const struct mtmips_clk_data rt33
- static const struct mtmips_clk_data rt3883_clk_data = {
- 	.clk_base = rt3883_clks_base,
- 	.num_clk_base = ARRAY_SIZE(rt3883_clks_base),
--	.clk_fixed = rt305x_fixed_clocks,
--	.num_clk_fixed = ARRAY_SIZE(rt305x_fixed_clocks),
-+	.clk_fixed = rt3383_fixed_clocks,
-+	.num_clk_fixed = ARRAY_SIZE(rt3383_fixed_clocks),
- 	.clk_factor = NULL,
- 	.num_clk_factor = 0,
- 	.clk_periph = rt5350_pherip_clks,
diff --git a/target/linux/ramips/patches-6.6/100-mips-ralink-update-CPU-clock-index.patch b/target/linux/ramips/patches-6.6/100-mips-ralink-update-CPU-clock-index.patch
new file mode 100644
index 00000000000000..c19771ee87ac25
--- /dev/null
+++ b/target/linux/ramips/patches-6.6/100-mips-ralink-update-CPU-clock-index.patch
@@ -0,0 +1,58 @@
+From ef57412d070fe663a66a5473ffc708bd89671259 Mon Sep 17 00:00:00 2001
+From: Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Date: Sun, 2 Feb 2025 17:10:14 +0800
+Subject: [PATCH] mips: ralink: update CPU clock index
+
+Some clock indexes have been reorganized in commit d34db686a3d7
+("clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs").
+Update CPU clock index to match the clock driver changes.
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+Co-authored-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
+---
+ arch/mips/ralink/clk.c | 11 ++---------
+ 1 file changed, 2 insertions(+), 9 deletions(-)
+
+--- a/arch/mips/ralink/clk.c
++++ b/arch/mips/ralink/clk.c
+@@ -19,27 +19,22 @@
+ 
+ static const char *clk_cpu(int *idx)
+ {
++	*idx = 1;
++
+ 	switch (ralink_soc) {
+ 	case RT2880_SOC:
+-		*idx = 0;
+ 		return "ralink,rt2880-sysc";
+ 	case RT3883_SOC:
+-		*idx = 0;
+ 		return "ralink,rt3883-sysc";
+ 	case RT305X_SOC_RT3050:
+-		*idx = 0;
+ 		return "ralink,rt3050-sysc";
+ 	case RT305X_SOC_RT3052:
+-		*idx = 0;
+ 		return "ralink,rt3052-sysc";
+ 	case RT305X_SOC_RT3350:
+-		*idx = 1;
+ 		return "ralink,rt3350-sysc";
+ 	case RT305X_SOC_RT3352:
+-		*idx = 1;
+ 		return "ralink,rt3352-sysc";
+ 	case RT305X_SOC_RT5350:
+-		*idx = 1;
+ 		return "ralink,rt5350-sysc";
+ 	case MT762X_SOC_MT7620A:
+ 		*idx = 2;
+@@ -48,10 +43,8 @@ static const char *clk_cpu(int *idx)
+ 		*idx = 2;
+ 		return "ralink,mt7620-sysc";
+ 	case MT762X_SOC_MT7628AN:
+-		*idx = 1;
+ 		return "ralink,mt7628-sysc";
+ 	case MT762X_SOC_MT7688:
+-		*idx = 1;
+ 		return "ralink,mt7688-sysc";
+ 	default:
+ 		*idx = -1;
diff --git a/target/linux/ramips/patches-6.6/311-MIPS-use-set_mode-to-enable-disable-the-cevt-r4k-irq.patch b/target/linux/ramips/patches-6.6/311-MIPS-use-set_mode-to-enable-disable-the-cevt-r4k-irq.patch
index 36925b83267cf4..3162d669e1dd49 100644
--- a/target/linux/ramips/patches-6.6/311-MIPS-use-set_mode-to-enable-disable-the-cevt-r4k-irq.patch
+++ b/target/linux/ramips/patches-6.6/311-MIPS-use-set_mode-to-enable-disable-the-cevt-r4k-irq.patch
@@ -1,13 +1,11 @@
-From ce3d4a4111a5f7e6b4e74bceae5faa6ce388e8ec Mon Sep 17 00:00:00 2001
 From: John Crispin <blogic@openwrt.org>
 Date: Sun, 14 Jul 2013 23:08:11 +0200
-Subject: [PATCH 05/53] MIPS: use set_mode() to enable/disable the cevt-r4k
- irq
+Subject: [PATCH 1/2] MIPS: use set_mode() to enable/disable the cevt-r4k irq
 
 Signed-off-by: John Crispin <blogic@openwrt.org>
 ---
  arch/mips/kernel/cevt-r4k.c | 43 +++++++++++++++++++++++++++++++++++++
- arch/mips/ralink/Kconfig    |  5 +++++
+ drivers/clocksource/Kconfig |  5 +++++
  2 files changed, 48 insertions(+)
 
 --- a/arch/mips/kernel/cevt-r4k.c
@@ -96,23 +94,21 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	return 0;
  }
---- a/arch/mips/ralink/Kconfig
-+++ b/arch/mips/ralink/Kconfig
-@@ -1,12 +1,17 @@
- # SPDX-License-Identifier: GPL-2.0
- if RALINK
- 
+--- a/drivers/clocksource/Kconfig
++++ b/drivers/clocksource/Kconfig
+@@ -732,10 +732,15 @@ config GOLDFISH_TIMER
+ 	depends on RTC_DRV_GOLDFISH
+ 	help
+ 	  Support for the timer/counter of goldfish-rtc
++ 
 +config CEVT_SYSTICK_QUIRK
 +	bool
 +	default n
-+
- config CLKEVT_RT3352
- 	bool
- 	depends on SOC_RT305X || SOC_MT7620
- 	default y
- 	select TIMER_OF
- 	select CLKSRC_MMIO
-+	select CEVT_SYSTICK_QUIRK
  
- config RALINK_ILL_ACC
- 	bool
+ config RALINK_TIMER
+ 	bool "Ralink System Tick Counter"
+ 	depends on SOC_RT305X || SOC_MT7620 || COMPILE_TEST
++	select CEVT_SYSTICK_QUIRK
+ 	select CLKSRC_MMIO
+ 	select TIMER_OF
+ 	help
diff --git a/target/linux/ramips/patches-6.6/312-MIPS-ralink-add-cpu-frequency-scaling.patch b/target/linux/ramips/patches-6.6/312-MIPS-ralink-add-cpu-frequency-scaling.patch
index 0d70770941ecf8..6acdfff837cca3 100644
--- a/target/linux/ramips/patches-6.6/312-MIPS-ralink-add-cpu-frequency-scaling.patch
+++ b/target/linux/ramips/patches-6.6/312-MIPS-ralink-add-cpu-frequency-scaling.patch
@@ -1,19 +1,26 @@
-From bd30f19a006fb52bac80c6463c49dd2f4159f4ac Mon Sep 17 00:00:00 2001
 From: John Crispin <blogic@openwrt.org>
 Date: Sun, 28 Jul 2013 16:26:41 +0200
-Subject: [PATCH 06/53] MIPS: ralink: add cpu frequency scaling
+Subject: [PATCH 2/2] MIPS: ralink: add cpu frequency scaling
 
 This feature will break udelay() and cause the delay loop to have longer delays
 when the frequency is scaled causing a performance hit.
 
 Signed-off-by: John Crispin <blogic@openwrt.org>
 ---
- arch/mips/ralink/cevt-rt3352.c |   38 ++++++++++++++++++++++++++++++++++++++
- 1 file changed, 38 insertions(+)
+ drivers/clocksource/timer-ralink.c | 117 ++++++++++++++++++++++-------
+ 1 file changed, 89 insertions(+), 28 deletions(-)
 
---- a/arch/mips/ralink/cevt-rt3352.c
-+++ b/arch/mips/ralink/cevt-rt3352.c
-@@ -29,6 +29,10 @@
+--- a/drivers/clocksource/timer-ralink.c
++++ b/drivers/clocksource/timer-ralink.c
+@@ -5,6 +5,7 @@
+  * Copyright (C) 2013 by John Crispin <john@phrozen.org>
+  */
+ 
++#include <asm/mach-ralink/ralink_regs.h>
+ #include <linux/clockchips.h>
+ #include <linux/clocksource.h>
+ #include <linux/interrupt.h>
+@@ -26,6 +27,10 @@
  /* enable the counter */
  #define CFG_CNT_EN		0x1
  
@@ -24,7 +31,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  struct systick_device {
  	void __iomem *membase;
  	struct clock_event_device dev;
-@@ -36,21 +40,53 @@ struct systick_device {
+@@ -33,21 +38,53 @@ struct systick_device {
  	int freq_scale;
  };
  
@@ -64,7 +71,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +}
 +
  static int systick_next_event(unsigned long delta,
- 				struct clock_event_device *evt)
+ 			      struct clock_event_device *evt)
  {
  	struct systick_device *sdev;
 -	u32 count;
@@ -83,18 +90,18 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  }
  
  static void systick_event_handler(struct clock_event_device *dev)
-@@ -60,20 +96,25 @@ static void systick_event_handler(struct
+@@ -57,20 +94,25 @@ static void systick_event_handler(struct
  
  static irqreturn_t systick_interrupt(int irq, void *dev_id)
  {
--	struct clock_event_device *dev = (struct clock_event_device *) dev_id;
+-	struct clock_event_device *dev = (struct clock_event_device *)dev_id;
 +	int ret = 0;
 +	struct clock_event_device *cdev;
 +	struct systick_device *sdev;
  
 -	dev->event_handler(dev);
 +	if (read_c0_cause() & STATUSF_IP7) {
-+		cdev = (struct clock_event_device *) dev_id;
++		cdev = (struct clock_event_device *)dev_id;
 +		sdev = container_of(cdev, struct systick_device, dev);
 +
 +		/* Clear Count/Compare Interrupt */
@@ -117,7 +124,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  		.features		= CLOCK_EVT_FEAT_ONESHOT,
  		.set_next_event		= systick_next_event,
  		.set_state_shutdown	= systick_shutdown,
-@@ -91,7 +132,13 @@ static int systick_shutdown(struct clock
+@@ -88,7 +130,13 @@ static int systick_shutdown(struct clock
  	if (sdev->irq_requested)
  		free_irq(systick.dev.irq, &systick.dev);
  	sdev->irq_requested = 0;
@@ -132,7 +139,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  
  	return 0;
  }
-@@ -116,33 +163,46 @@ static int systick_set_oneshot(struct cl
+@@ -113,33 +161,46 @@ static int systick_set_oneshot(struct cl
  	return 0;
  }
  
diff --git a/target/linux/ramips/patches-6.6/316-arch-mips-do-not-select-illegal-access-driver-by-def.patch b/target/linux/ramips/patches-6.6/316-arch-mips-do-not-select-illegal-access-driver-by-def.patch
index 1dc54ccf232627..85680416709616 100644
--- a/target/linux/ramips/patches-6.6/316-arch-mips-do-not-select-illegal-access-driver-by-def.patch
+++ b/target/linux/ramips/patches-6.6/316-arch-mips-do-not-select-illegal-access-driver-by-def.patch
@@ -11,8 +11,8 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 
 --- a/arch/mips/ralink/Kconfig
 +++ b/arch/mips/ralink/Kconfig
-@@ -14,9 +14,9 @@ config CLKEVT_RT3352
- 	select CEVT_SYSTICK_QUIRK
+@@ -2,9 +2,9 @@
+ if RALINK
  
  config RALINK_ILL_ACC
 -	bool
diff --git a/target/linux/ramips/patches-6.6/320-MIPS-add-support-for-buggy-MT7621S-core-detection.patch b/target/linux/ramips/patches-6.6/320-MIPS-add-support-for-buggy-MT7621S-core-detection.patch
index ef54835f89c2a3..50329953cf4a39 100644
--- a/target/linux/ramips/patches-6.6/320-MIPS-add-support-for-buggy-MT7621S-core-detection.patch
+++ b/target/linux/ramips/patches-6.6/320-MIPS-add-support-for-buggy-MT7621S-core-detection.patch
@@ -26,8 +26,18 @@ Suggested-by: Felix Fietkau <nbd@nbd.name>
 Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
 Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
 ---
- arch/mips/include/asm/mips-cps.h | 23 ++++++++++++++++++++++-
- 1 file changed, 22 insertions(+), 1 deletion(-)
+
+The proposed detection method was based on reading the LAUNCH_FREADY core flag.
+However, this method only works before the cores are launched.
+For this reason, the core number detection method has been changed to a simpler one.
+For mt6721s the 17th revision bit is zero, hence we know that it is this chip,
+so the number of cores is 1.
+
+Co-authored-by: Shiji Yang <yangshiji66@qq.com>
+Signed-off-by: Mieczyslaw Nalewaj <namiltd@yahoo.com>
+---
+ arch/mips/include/asm/mips-cps.h | 5 +++++
+ 1 file changed, 5 insertions(+)
 
 --- a/arch/mips/include/asm/mips-cps.h
 +++ b/arch/mips/include/asm/mips-cps.h
@@ -35,41 +45,19 @@ Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
  #include <linux/io.h>
  #include <linux/types.h>
  
-+#include <asm/mips-boards/launch.h>
++#include <asm/mach-ralink/mt7621.h>
 +
  extern unsigned long __cps_access_bad_size(void)
  	__compiletime_error("Bad size for CPS accessor");
  
-@@ -162,12 +164,31 @@ static inline uint64_t mips_cps_cluster_
-  */
- static inline unsigned int mips_cps_numcores(unsigned int cluster)
- {
-+	unsigned int ncores;
-+
+@@ -165,6 +167,10 @@ static inline unsigned int mips_cps_numc
  	if (!mips_cm_present())
  		return 0;
  
++	if (IS_ENABLED(CONFIG_SOC_MT7621) &&
++	    !FIELD_GET(0x20000, __raw_readl(MT7621_SYSC_BASE + SYSC_REG_CHIP_REV)))
++		return 1;
++ 
  	/* Add one before masking to handle 0xff indicating no cores */
--	return FIELD_GET(CM_GCR_CONFIG_PCORES,
-+	ncores = FIELD_GET(CM_GCR_CONFIG_PCORES,
+ 	return FIELD_GET(CM_GCR_CONFIG_PCORES,
  			 mips_cps_cluster_config(cluster) + 1);
-+
-+	if (IS_ENABLED(CONFIG_SOC_MT7621)) {
-+		struct cpulaunch *launch;
-+
-+		/*
-+		 * Ralink MT7621S SoC is single core, but the GCR_CONFIG method
-+		 * always reports 2 cores. Check the second core's LAUNCH_FREADY
-+		 * flag to detect if the second core is missing. This method
-+		 * only works before the core has been started.
-+		 */
-+		launch = (struct cpulaunch *)CKSEG0ADDR(CPULAUNCH);
-+		launch += 2; /* MT7621 has 2 VPEs per core */
-+		if (!(launch->flags & LAUNCH_FREADY))
-+			ncores = 1;
-+	}
-+
-+	return ncores;
- }
- 
- /**
diff --git a/target/linux/ramips/patches-6.6/809-pinctrl-mtmips-allow-mux-SDXC-pins-for-mt76x8.patch b/target/linux/ramips/patches-6.6/809-pinctrl-mtmips-allow-mux-SDXC-pins-for-mt76x8.patch
new file mode 100644
index 00000000000000..69dcd7fb2c82c7
--- /dev/null
+++ b/target/linux/ramips/patches-6.6/809-pinctrl-mtmips-allow-mux-SDXC-pins-for-mt76x8.patch
@@ -0,0 +1,105 @@
+From: Shiji Yang <yangshiji66@outlook.com>
+Date: Wed, 1 Jan 2025 13:30:11 +0800
+Subject: [PATCH] pinctrl: mtmips: allow mux SDXC pins for mt76x8
+
+This is a hack to supprot two types of mt76x8 SDXC pinmaps:
+
+a) Use ethernet phy pins as SDXC IO.
+
+&pinctrl {
+	ephy-digital;
+
+	sdxc_iot_mode: sdxc_iot_mode {
+		esd {
+			groups = "esd";
+			function = "iot";
+		};
+
+		sdxc {
+			groups = "sdmode";
+			function = "sdxc";
+		};
+	};
+};
+
+b) Use I2S/I2C/GPIO0/UART1 pins as SDXC IO.
+
+&pinctrl {
+	ephy-analog;
+
+	sdxc_router_mode: sdxc_router_mode {
+		groups = "esd", "gpio", "i2c", "i2s", "sdmode", "uart1";
+		function = "gpio";
+	};
+};
+
+Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
+---
+ drivers/pinctrl/mediatek/pinctrl-mt76x8.c | 24 ++++++++++++++++++++++-
+ 1 file changed, 22 insertions(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/mediatek/pinctrl-mt76x8.c
++++ b/drivers/pinctrl/mediatek/pinctrl-mt76x8.c
+@@ -1,10 +1,13 @@
+ // SPDX-License-Identifier: GPL-2.0-only
+ 
++#include <asm/mach-ralink/ralink_regs.h>
+ #include <linux/module.h>
+ #include <linux/platform_device.h>
+ #include <linux/of.h>
+ #include "pinctrl-mtmips.h"
+ 
++#define SYSC_REG_AGPIO_CFG		0x3c
++
+ #define MT76X8_GPIO_MODE_MASK		0x3
+ 
+ #define MT76X8_GPIO_MODE_P4LED_KN	58
+@@ -26,6 +29,7 @@
+ #define MT76X8_GPIO_MODE_I2C		20
+ #define MT76X8_GPIO_MODE_REFCLK		18
+ #define MT76X8_GPIO_MODE_PERST		16
++#define MT76X8_GPIO_MODE_ESD		15
+ #define MT76X8_GPIO_MODE_WDT		14
+ #define MT76X8_GPIO_MODE_SPI		12
+ #define MT76X8_GPIO_MODE_SDMODE		10
+@@ -74,6 +78,12 @@ static struct mtmips_pmx_func refclk_grp
+ static struct mtmips_pmx_func perst_grp[] = { FUNC("perst", 0, 36, 1) };
+ static struct mtmips_pmx_func wdt_grp[] = { FUNC("wdt", 0, 38, 1) };
+ static struct mtmips_pmx_func spi_grp[] = { FUNC("spi", 0, 7, 4) };
++/*
++ * "esd" (Ethernet SDXC) group supports two mode:
++ * "gpio" - SDXC mux to I2S/I2C/GPIO0/UART1 pins with "gpio" mode
++ * "iot"  - SDXC mux to EPHY pins, eth p1-p4 pad must be set to "digital"
++ */
++static struct mtmips_pmx_func esd_grp[] = { FUNC("iot", 0, 47, 1) };
+ 
+ static struct mtmips_pmx_func sd_mode_grp[] = {
+ 	FUNC("jtag", 3, 22, 8),
+@@ -216,6 +226,7 @@ static struct mtmips_pmx_group mt76x8_pi
+ 	GRP("perst", perst_grp, 1, MT76X8_GPIO_MODE_PERST),
+ 	GRP("wdt", wdt_grp, 1, MT76X8_GPIO_MODE_WDT),
+ 	GRP("spi", spi_grp, 1, MT76X8_GPIO_MODE_SPI),
++	GRP("esd", esd_grp, 1, MT76X8_GPIO_MODE_ESD),
+ 	GRP_G("sdmode", sd_mode_grp, MT76X8_GPIO_MODE_MASK,
+ 				1, MT76X8_GPIO_MODE_SDMODE),
+ 	GRP_G("uart0", uart0_grp, MT76X8_GPIO_MODE_MASK,
+@@ -257,7 +268,18 @@ static struct mtmips_pmx_group mt76x8_pi
+ 
+ static int mt76x8_pinctrl_probe(struct platform_device *pdev)
+ {
+-	return mtmips_pinctrl_init(pdev, mt76x8_pinmux_data);
++	int ret;
++
++	ret = mtmips_pinctrl_init(pdev, mt76x8_pinmux_data);
++	if (ret)
++		return ret;
++
++	if (of_property_present(pdev->dev.of_node, "ephy-analog"))
++		rt_sysc_m32(0xf << 17, 0, SYSC_REG_AGPIO_CFG);
++	else if (of_property_present(pdev->dev.of_node, "ephy-digital"))
++		rt_sysc_m32(0xf << 17, 0xf << 17, SYSC_REG_AGPIO_CFG);
++
++	return ret;
+ }
+ 
+ static const struct of_device_id mt76x8_pinctrl_match[] = {
diff --git a/target/linux/ramips/patches-6.6/810-uvc-add-iPassion-iP2970-support.patch b/target/linux/ramips/patches-6.6/810-uvc-add-iPassion-iP2970-support.patch
index 71adf6600f61ce..c121690786911c 100644
--- a/target/linux/ramips/patches-6.6/810-uvc-add-iPassion-iP2970-support.patch
+++ b/target/linux/ramips/patches-6.6/810-uvc-add-iPassion-iP2970-support.patch
@@ -13,7 +13,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 
 --- a/drivers/media/usb/uvc/uvc_driver.c
 +++ b/drivers/media/usb/uvc/uvc_driver.c
-@@ -3183,6 +3183,18 @@ static const struct usb_device_id uvc_id
+@@ -3310,6 +3310,18 @@ static const struct usb_device_id uvc_id
  	  .bInterfaceSubClass	= 1,
  	  .bInterfaceProtocol	= 0,
  	  .driver_info		= UVC_INFO_META(V4L2_META_FMT_D4XX) },
@@ -42,7 +42,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  			break;
  		}
  
-@@ -273,6 +274,7 @@ int uvc_status_init(struct uvc_device *d
+@@ -274,6 +275,7 @@ int uvc_status_init(struct uvc_device *d
  	}
  
  	pipe = usb_rcvintpipe(dev->udev, ep->desc.bEndpointAddress);
@@ -62,9 +62,9 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +#include <linux/kobject.h>
 +#include <linux/workqueue.h>
  
+ #include <media/jpeg.h>
  #include <media/v4l2-common.h>
- 
-@@ -1275,9 +1280,149 @@ static void uvc_video_decode_data(struct
+@@ -1330,9 +1335,149 @@ static void uvc_video_decode_data(struct
  	uvc_urb->async_operations++;
  }
  
@@ -214,7 +214,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	/* Mark the buffer as done if the EOF marker is set. */
  	if (data[1] & UVC_STREAM_EOF && buf->bytesused != 0) {
  		uvc_dbg(stream->dev, FRAME, "Frame complete (EOF found)\n");
-@@ -1859,6 +2004,8 @@ static int uvc_init_video_isoc(struct uv
+@@ -1914,6 +2059,8 @@ static int uvc_init_video_isoc(struct uv
  	if (npackets == 0)
  		return -ENOMEM;
  
@@ -225,16 +225,16 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
  	for_each_uvc_urb(uvc_urb, stream) {
 --- a/drivers/media/usb/uvc/uvcvideo.h
 +++ b/drivers/media/usb/uvc/uvcvideo.h
-@@ -76,6 +76,8 @@
- #define UVC_QUIRK_NO_RESET_RESUME	0x00004000
+@@ -77,6 +77,8 @@
  #define UVC_QUIRK_DISABLE_AUTOSUSPEND	0x00008000
  #define UVC_QUIRK_INVALID_DEVICE_SOF	0x00010000
-+#define UVC_QUIRK_MOTION		0x00020000
-+#define UVC_QUIRK_SINGLE_ISO		0x00040000
+ #define UVC_QUIRK_MJPEG_NO_EOF		0x00020000
++#define UVC_QUIRK_MOTION		0x00040000
++#define UVC_QUIRK_SINGLE_ISO		0x00080000
  
  /* Format flags */
  #define UVC_FMT_FLAG_COMPRESSED		0x00000001
-@@ -585,6 +587,7 @@ struct uvc_device {
+@@ -591,6 +593,7 @@ struct uvc_device {
  
  	struct input_dev *input;
  	char input_phys[64];
diff --git a/target/linux/ramips/patches-6.6/825-i2c-MIPS-adds-ralink-I2C-driver.patch b/target/linux/ramips/patches-6.6/825-i2c-MIPS-adds-ralink-I2C-driver.patch
index c8cfb784ce5b32..747d515964aa7a 100644
--- a/target/linux/ramips/patches-6.6/825-i2c-MIPS-adds-ralink-I2C-driver.patch
+++ b/target/linux/ramips/patches-6.6/825-i2c-MIPS-adds-ralink-I2C-driver.patch
@@ -45,7 +45,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
 +};
 --- a/drivers/i2c/busses/Kconfig
 +++ b/drivers/i2c/busses/Kconfig
-@@ -1021,6 +1021,11 @@ config I2C_RK3X
+@@ -1024,6 +1024,11 @@ config I2C_RK3X
  	  This driver can also be built as a module. If so, the module will
  	  be called i2c-rk3x.
  
diff --git a/target/linux/ramips/patches-6.6/831-mmc-mtk-sd-initialize-pad-delay-and-drive-strength.patch b/target/linux/ramips/patches-6.6/831-mmc-mtk-sd-initialize-pad-delay-and-drive-strength.patch
index 1d5c6dcd40cc0a..1e9b8d173b2125 100644
--- a/target/linux/ramips/patches-6.6/831-mmc-mtk-sd-initialize-pad-delay-and-drive-strength.patch
+++ b/target/linux/ramips/patches-6.6/831-mmc-mtk-sd-initialize-pad-delay-and-drive-strength.patch
@@ -4,6 +4,8 @@ Subject: [PATCH] mmc: mtk-sd: initialize the pad and tune registers
 
 Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
 ---
+ drivers/mmc/host/mtk-sd.c | 26 +++++++++++++++++++++++---
+ 1 file changed, 23 insertions(+), 3 deletions(-)
 
 --- a/drivers/mmc/host/mtk-sd.c
 +++ b/drivers/mmc/host/mtk-sd.c
@@ -20,19 +22,52 @@ Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
  #define PAD_DS_TUNE      0x188
  #define PAD_CMD_TUNE     0x18c
  #define EMMC51_CFG0	 0x204
-@@ -1795,6 +1799,16 @@ static void msdc_init_hw(struct msdc_hos
+@@ -402,6 +406,7 @@ struct mtk_mmc_compatible {
+ 	bool enhance_rx;
+ 	bool support_64g;
+ 	bool use_internal_cd;
++	bool legacy_mt762x; /* for mt7620, mt7621 and mt76x8 */
+ };
+ 
+ struct msdc_tune_para {
+@@ -539,6 +544,7 @@ static const struct mtk_mmc_compatible m
+ 	.stop_clk_fix = false,
+ 	.enhance_rx = false,
+ 	.use_internal_cd = true,
++	.legacy_mt762x = true,
+ };
+ 
+ static const struct mtk_mmc_compatible mt7622_compat = {
+@@ -1748,9 +1754,11 @@ static void msdc_init_hw(struct msdc_hos
+ 	}
+ 	writel(0, host->base + MSDC_IOCON);
+ 	sdr_set_field(host->base + MSDC_IOCON, MSDC_IOCON_DDLSEL, 0);
+-	writel(0x403c0046, host->base + MSDC_PATCH_BIT);
+-	sdr_set_field(host->base + MSDC_PATCH_BIT, MSDC_CKGEN_MSDC_DLY_SEL, 1);
+-	writel(0xffff4089, host->base + MSDC_PATCH_BIT1);
++	if(!host->dev_comp->legacy_mt762x) {
++		writel(0x403c0046, host->base + MSDC_PATCH_BIT);
++		sdr_set_field(host->base + MSDC_PATCH_BIT, MSDC_CKGEN_MSDC_DLY_SEL, 1);
++		writel(0xffff4089, host->base + MSDC_PATCH_BIT1);
++	}
+ 	sdr_set_bits(host->base + EMMC50_CFG0, EMMC50_CFG_CFCSTS_SEL);
+ 
+ 	if (host->dev_comp->stop_clk_fix) {
+@@ -1814,6 +1822,18 @@ static void msdc_init_hw(struct msdc_hos
  				     MSDC_PAD_TUNE_RXDLYSEL);
  	}
  
-+	/* Set pins drive strength */
-+	writel(0x000d0044, host->base + MSDC_PAD_CTRL0);
-+	writel(0x000e0044, host->base + MSDC_PAD_CTRL1);
-+	writel(0x000e0044, host->base + MSDC_PAD_CTRL2);
++	if (host->dev_comp->legacy_mt762x) {
++		/* Set pins drive strength */
++		writel(0x000d0044, host->base + MSDC_PAD_CTRL0);
++		writel(0x000e0044, host->base + MSDC_PAD_CTRL1);
++		writel(0x000e0044, host->base + MSDC_PAD_CTRL2);
 +
-+	/* Set pad delay */
-+	writel(0x84101010, host->base + MSDC_PAD_TUNE);
-+	writel(0x10101010, host->base + MSDC_PAD_TUNE0);
-+	writel(0x10101010, host->base + MSDC_PAD_TUNE1);
++		/* Set pad delay */
++		writel(0x84101010, host->base + MSDC_PAD_TUNE);
++		writel(0x10101010, host->base + MSDC_PAD_TUNE0);
++		writel(0x10101010, host->base + MSDC_PAD_TUNE1);
++	}
 +
  	if (mmc->caps2 & MMC_CAP2_NO_SDIO) {
  		sdr_clr_bits(host->base + SDC_CFG, SDC_CFG_SDIO);
diff --git a/target/linux/ramips/patches-6.6/870-Input-sx951x-add-Semtech-SX9512-SX9513-driver.patch b/target/linux/ramips/patches-6.6/870-Input-sx951x-add-Semtech-SX9512-SX9513-driver.patch
new file mode 100644
index 00000000000000..9b724e9d5266fe
--- /dev/null
+++ b/target/linux/ramips/patches-6.6/870-Input-sx951x-add-Semtech-SX9512-SX9513-driver.patch
@@ -0,0 +1,550 @@
+From ba92c0187006e2a6eae9573a569d275b0bd31732 Mon Sep 17 00:00:00 2001
+From: David Bauer <mail@david-bauer.net>
+Date: Fri, 2 May 2025 23:04:27 +0200
+Subject: [PATCH] Input sx951x: add Semtech SX9512/SX9513 driver
+
+The Semtech SX9512/SX9513 is a family of capacitive touch-keyboard
+controllers.
+
+All chips offer 8 channel touch sensitive inputs with one LED driver per
+output channel.
+
+The also SX9512 supports proximity detection which is currently not
+supported with the driver.
+
+This chip can be found on the Genexis Pulse EX400 repeater platform.
+
+Link: https://www.mouser.com/datasheet/2/761/SEMTS05226_1-2575172.pdf
+Link: https://www.spinics.net/lists/kernel/msg5669349.html
+
+Signed-off-by: David Bauer <mail@david-bauer.net>
+---
+ drivers/input/keyboard/Kconfig  |  11 +
+ drivers/input/keyboard/Makefile |   1 +
+ drivers/input/keyboard/sx951x.c | 490 ++++++++++++++++++++++++++++++++
+ 3 files changed, 502 insertions(+)
+ create mode 100644 drivers/input/keyboard/sx951x.c
+
+--- a/drivers/input/keyboard/Kconfig
++++ b/drivers/input/keyboard/Kconfig
+@@ -616,6 +616,17 @@ config KEYBOARD_SUNKBD
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called sunkbd.
+ 
++config KEYBOARD_SX951X
++	tristate "Semtech SX951X capacitive touch controller"
++	depends on OF && I2C
++	select REGMAP_I2C
++	help
++	  Say Y here to enable the Semtech SX9512/SX9153 capacitive
++	  touch controller driver.
++
++	  To compile this driver as a module, choose M here: the
++	  module will be called sx951x.
++
+ config KEYBOARD_SH_KEYSC
+ 	tristate "SuperH KEYSC keypad support"
+ 	depends on ARCH_SHMOBILE || COMPILE_TEST
+--- a/drivers/input/keyboard/Makefile
++++ b/drivers/input/keyboard/Makefile
+@@ -66,6 +66,7 @@ obj-$(CONFIG_KEYBOARD_STOWAWAY)		+= stow
+ obj-$(CONFIG_KEYBOARD_ST_KEYSCAN)	+= st-keyscan.o
+ obj-$(CONFIG_KEYBOARD_SUN4I_LRADC)	+= sun4i-lradc-keys.o
+ obj-$(CONFIG_KEYBOARD_SUNKBD)		+= sunkbd.o
++obj-$(CONFIG_KEYBOARD_SX951X)		+= sx951x.o
+ obj-$(CONFIG_KEYBOARD_TC3589X)		+= tc3589x-keypad.o
+ obj-$(CONFIG_KEYBOARD_TEGRA)		+= tegra-kbc.o
+ obj-$(CONFIG_KEYBOARD_TM2_TOUCHKEY)	+= tm2-touchkey.o
+--- /dev/null
++++ b/drivers/input/keyboard/sx951x.c
+@@ -0,0 +1,490 @@
++// SPDX-License-Identifier: GPL-2.0-only
++/*
++ * Input driver for Semtech SX9512/SX9513 capacitive touch sensors.
++ *
++ * The difference between SX9512 and SX9513 is the presence of proximity
++ * sensing capabilities on the SX9512.
++ *
++ * SX951xB is the identical chip but with a different I2C address.
++ *
++ * (c) 2025 David Bauer <mail@david-bauer.net>
++ */
++
++ #include <linux/kernel.h>
++ #include <linux/module.h>
++ #include <linux/input.h>
++ #include <linux/leds.h>
++ #include <linux/of.h>
++ #include <linux/regmap.h>
++ #include <linux/i2c.h>
++ #include <linux/gpio/consumer.h>
++ #include <linux/bitfield.h>
++
++ /* Generic properties */
++#define SX951X_I2C_ADDRESS		0x2b
++#define SX951XB_I2C_ADDRESS_		0x2d
++#define SX951X_NUM_CHANNELS		8
++#define SX951X_POLL_INTERVAL		100
++
++/* Registers*/
++#define SX951X_REG_IRQ_SRC		0x00
++#define SX951X_REG_TOUCH_STATUS		0x01
++#define SX951X_REG_PROXIMITY_STATUS	0x02
++#define SX951X_REG_COMPENSATION_STATUS	0x03
++#define SX951X_REG_IRQ_NVM_CTRL		0x04
++#define SX951X_REG_SPO2_MODE_CTRL	0x07
++#define SX951X_REG_PWR_KEY_CTRL		0x08
++#define SX951X_REG_IRQ_MASK		0x09
++
++/* LED registers */
++#define SX951X_REG_LED_MAP_ENG1		0x0c
++#define SX951X_REG_LED_MAP_ENG2		0x0d
++#define SX951X_REG_LED_PWM_FREQ		0x0e
++#define SX951X_REG_LED_MODE		0x0f
++#define SX951X_REG_LED_IDLE		0x10
++#define SX951X_REG_LED_OFF_DELAY	0x11
++#define SX951X_REG_LED_ON_ENG1		0x12
++#define SX951X_REG_LED_FADE_ENG1	0x13
++#define SX951X_REG_LED_ON_ENG2		0x14
++#define SX951X_REG_LED_FADE_ENG2	0x15
++#define SX951X_REG_LED_POWER_IDLE	0x16
++#define SX951X_REG_LED_POWER_ON		0x17
++#define SX951X_REG_LED_POWER_OFF	0x18
++#define SX951X_REG_LED_POWER_FADE	0x19
++#define SX951X_REG_LED_POWER_ON_PULSE	0x1a
++#define SX951X_REG_LED_POWER_MODE	0x1b
++
++/* Capacitive touch sensing registers*/
++#define SX951X_REG_CAP_SENSE_ENABLE			0x1e
++
++#define SX951X_REG_CAP_SENSE_RANGE(x)			(0x1f + (x))
++#define SX951X_REG_CAP_SENSE_RANGE_CIN_DELTA_MASK	GENMASK(1, 0)
++
++#define SX951X_REG_CAP_SENSE_THRESH(x)			(0x28 + (x))
++#define SX951X_REG_CAP_SENSE_THRESH_ALL			0x30
++
++#define SX951X_REG_CAP_SENSE_OP				0x31
++#define SX951X_REG_CAP_SENSE_MODE			0x32
++#define SX951X_REG_CAP_SENSE_DEBOUNCE			0x33
++
++/* Reset register*/
++#define SX951X_REG_SOFT_RESET			0xff
++
++/* Default properties (keys)*/
++#define SX951X_KEY_DEFAULT_CIN_DELTA		0x03
++#define SX951X_KEY_DEFAULT_SENSE_THRESHOLD	0x04
++
++struct sx951x_key_data {
++	u32 cin_delta;
++	u32 sense_threshold;
++};
++
++struct sx951x_led {
++#ifdef CONFIG_LEDS_CLASS
++	struct led_classdev cdev;
++	struct sx951x_priv *priv;
++
++	u32 reg;
++	bool registered;
++#endif
++};
++
++struct sx951x_priv {
++	struct regmap *regmap;
++	struct device *dev;
++	struct input_dev *idev;
++	const struct sx951x_hw_data *hw;
++
++	struct sx951x_led leds[SX951X_NUM_CHANNELS];
++
++	/* device-config */
++	u32 poll_interval;
++
++	/* key-config */
++	u32 keycodes[SX951X_NUM_CHANNELS];
++	struct sx951x_key_data key_data[SX951X_NUM_CHANNELS];
++};
++
++struct sx951x_hw_data {
++	bool has_proximity_sensing;
++};
++
++static const struct reg_default sx951x_reg_defaults[] = {
++	{ SX951X_REG_LED_MAP_ENG1,		0x00 },
++	{ SX951X_REG_LED_MAP_ENG2,		0x00 },
++	{ SX951X_REG_LED_PWM_FREQ,		0x10 },
++	{ SX951X_REG_LED_IDLE,			0xff },
++	{ SX951X_REG_LED_ON_ENG1,		0xff },
++	{ SX951X_REG_LED_ON_ENG2,		0xff },
++	{ SX951X_REG_LED_POWER_IDLE,		0xff },
++	{ SX951X_REG_LED_POWER_ON,		0xff },
++	{ SX951X_REG_CAP_SENSE_ENABLE,		0x00 },
++	{ SX951X_REG_CAP_SENSE_RANGE(0),	0x40 },
++	{ SX951X_REG_CAP_SENSE_RANGE(1),	0x40 },
++	{ SX951X_REG_CAP_SENSE_RANGE(2),	0x40 },
++	{ SX951X_REG_CAP_SENSE_RANGE(3),	0x40 },
++	{ SX951X_REG_CAP_SENSE_RANGE(4),	0x40 },
++	{ SX951X_REG_CAP_SENSE_RANGE(5),	0x40 },
++	{ SX951X_REG_CAP_SENSE_RANGE(6),	0x40 },
++	{ SX951X_REG_CAP_SENSE_RANGE(7),	0x40 },
++	{ SX951X_REG_CAP_SENSE_THRESH(0),	0x0f },
++	{ SX951X_REG_CAP_SENSE_THRESH(1),	0x0f },
++	{ SX951X_REG_CAP_SENSE_THRESH(2),	0x0f },
++	{ SX951X_REG_CAP_SENSE_THRESH(3),	0x0f },
++	{ SX951X_REG_CAP_SENSE_THRESH(4),	0x0f },
++	{ SX951X_REG_CAP_SENSE_THRESH(5),	0x0f },
++	{ SX951X_REG_CAP_SENSE_THRESH(6),	0x0f },
++	{ SX951X_REG_CAP_SENSE_THRESH(7),	0x0f },
++	{ SX951X_REG_CAP_SENSE_THRESH_ALL,	0x0f },
++	{ SX951X_REG_CAP_SENSE_OP,		0x14 },
++	{ SX951X_REG_CAP_SENSE_MODE,		0x70 },
++	{ SX951X_REG_CAP_SENSE_DEBOUNCE,	0xff },
++};
++
++static bool sx951x_volatile_reg(struct device *dev, unsigned int reg)
++{
++	switch (reg) {
++	case SX951X_REG_TOUCH_STATUS:
++		return true;
++	default:
++		return false;
++	}
++}
++
++static const struct regmap_config sx951x_regmap_config = {
++	.reg_bits = 8,
++	.val_bits = 8,
++
++	.max_register = SX951X_REG_SOFT_RESET,
++
++	.reg_defaults = sx951x_reg_defaults,
++	.num_reg_defaults = ARRAY_SIZE(sx951x_reg_defaults),
++
++	.cache_type = REGCACHE_MAPLE,
++	.volatile_reg = sx951x_volatile_reg,
++};
++
++#ifdef CONFIG_LEDS_CLASS
++static int sx951x_led_set(struct led_classdev *cdev, enum led_brightness value)
++{
++	struct sx951x_led *led = container_of(cdev, struct sx951x_led, cdev);
++	struct sx951x_priv *priv = led->priv;
++
++	return regmap_update_bits(priv->regmap,
++				  SX951X_REG_LED_MAP_ENG2,
++				  BIT(led->reg),
++				  value ? BIT(led->reg) : 0);
++}
++
++static int sx951x_led_init(struct sx951x_priv *priv,
++			   struct device_node *channel_node, u32 reg)
++{
++	struct device_node *led_node;
++	struct sx951x_led *led = &priv->leds[reg];
++	struct led_init_data init_data = {};
++	int error;
++
++	if (led->registered) {
++		dev_err(priv->dev,
++			"LED %d already registered\n", reg);
++		return -EINVAL;
++	}
++
++	led_node = of_get_child_by_name(channel_node, "led");
++	if (!led_node) {
++		/* No LED */
++		return 0;
++	}
++
++	led->cdev.flags = 0;
++	led->cdev.brightness_set_blocking = sx951x_led_set;
++	led->cdev.max_brightness = 1;
++	led->cdev.brightness = LED_OFF;
++
++	init_data.default_label = of_get_property(led_node, "label", NULL);
++	init_data.fwnode = of_fwnode_handle(led_node);
++
++	led->reg = reg;
++	led->priv = priv;
++
++	error = devm_led_classdev_register_ext(priv->dev, &led->cdev, &init_data);
++	if (error)
++		return error;
++
++	return 0;
++}
++#endif
++
++static void sx951x_poll(struct input_dev *input)
++{
++	struct sx951x_priv *priv = input_get_drvdata(input);
++	struct device *dev = priv->dev;
++	unsigned int val;
++	int error;
++	int i;
++
++	error = regmap_read(priv->regmap, SX951X_REG_TOUCH_STATUS, &val);
++	if (error) {
++		dev_err(dev, "Failed to read touch status: %d\n", error);
++		return;
++	}
++
++	for (i = 0; i < SX951X_NUM_CHANNELS; i++) {
++		if (priv->keycodes[i] == KEY_RESERVED)
++			continue;
++
++		input_report_key(input, priv->keycodes[i], !!(val & BIT(i)));
++		input_sync(input);
++	}
++}
++
++static int sx951x_channel_init(struct sx951x_priv *priv, struct device_node *of_node,
++			       u32 chan_idx)
++{
++	struct sx951x_key_data *key_data;
++	struct device *dev = priv->dev;
++	int error;
++
++	key_data = &priv->key_data[chan_idx];
++
++	/* Defaults */
++	key_data->cin_delta = SX951X_KEY_DEFAULT_CIN_DELTA;
++	key_data->sense_threshold = SX951X_KEY_DEFAULT_SENSE_THRESHOLD;
++
++	error = of_property_read_u32(of_node, "linux,keycodes",
++				     &priv->keycodes[chan_idx]);
++	if (error) {
++		/* Not configured */
++		return 0;
++	}
++
++	error = of_property_read_u32(of_node, "semtech,cin-delta",
++				     &key_data->cin_delta);
++	if (key_data->cin_delta > 0x03) {
++		dev_err(dev, "Failed to read cin-delta for channel %d: %d\n",
++			chan_idx, error);
++		return error;
++	}
++
++	error = of_property_read_u32(of_node, "semtech,sense-threshold",
++				     &key_data->sense_threshold);
++	if (key_data->sense_threshold > 0xff) {
++		dev_err(dev, "Failed to read sense-threshold for channel %d: %d\n",
++			chan_idx, error);
++		return error;
++	}
++
++	error = regmap_update_bits(priv->regmap,
++				   SX951X_REG_CAP_SENSE_RANGE(chan_idx),
++				   SX951X_REG_CAP_SENSE_RANGE_CIN_DELTA_MASK,
++				   key_data->cin_delta);
++
++	if (error) {
++		dev_err(dev, "Failed to set cin-delta for channel %d: %d\n",
++			chan_idx, error);
++		return error;
++	}
++
++	error = regmap_write(priv->regmap,
++			     SX951X_REG_CAP_SENSE_THRESH(chan_idx),
++			     key_data->sense_threshold);
++	if (error) {
++		dev_err(dev, "Failed to set sense-threshold for channel %d: %d\n",
++			chan_idx, error);
++		return error;
++	}
++
++	return 0;
++}
++
++static int sx951x_channels_init(struct sx951x_priv *priv)
++{
++	struct device *dev = priv->dev;
++	unsigned int channels = 0;
++	int error;
++	u32 reg;
++
++	for_each_child_of_node_scoped(dev->of_node, child) {
++		error = of_property_read_u32(child, "reg", &reg);
++		if (error != 0 || reg >= SX951X_NUM_CHANNELS) {
++			dev_err(dev, "Invalid channel %d\n", reg);
++			return -EINVAL;
++		}
++
++		priv->keycodes[reg] = KEY_RESERVED;
++
++		error = sx951x_channel_init(priv, child, reg);
++		if (error) {
++			dev_err(dev, "Failed to initialize channel %d: %d\n",
++				reg, error);
++			return error;
++		}
++
++		if (priv->keycodes[reg] != KEY_RESERVED)
++			channels |= BIT(reg);
++
++#ifdef CONFIG_LEDS_CLASS
++		error = sx951x_led_init(priv, child, reg);
++		if (error) {
++			dev_err(dev, "Failed to initialize LED %d: %d\n",
++				reg, error);
++			return error;
++		}
++#endif
++	}
++
++	/* Enable sensing on channels with keycode configured */
++	error = regmap_write(priv->regmap,
++			     SX951X_REG_CAP_SENSE_ENABLE,
++			     channels);
++
++	return 0;
++}
++
++static int sx951x_input_init(struct sx951x_priv *priv)
++{
++	struct device *dev = priv->dev;
++	int i, error;
++
++	priv->idev = devm_input_allocate_device(dev);
++	if (!priv->idev)
++		return -ENOMEM;
++
++	priv->idev->name = "SX9512/SX9513 capacitive touch sensor";
++	priv->idev->id.bustype = BUS_I2C;
++	__set_bit(EV_KEY, priv->idev->evbit);
++
++	for (i = 0; i < SX951X_NUM_CHANNELS; i++)
++		__set_bit(priv->keycodes[i], priv->idev->keybit);
++
++	__clear_bit(KEY_RESERVED, priv->idev->keybit);
++
++	priv->idev->keycode = priv->keycodes;
++	priv->idev->keycodesize = sizeof(priv->keycodes[0]);
++	priv->idev->keycodemax = SX951X_NUM_CHANNELS;
++
++	input_set_drvdata(priv->idev, priv);
++
++	error = input_setup_polling(priv->idev, sx951x_poll);
++	if (error) {
++		dev_err(dev, "Unable to set up polling: %d\n", error);
++		return error;
++	}
++
++	input_set_poll_interval(priv->idev, priv->poll_interval);
++
++	error = input_register_device(priv->idev);
++	if (error) {
++		dev_err(dev, "Unable to register polled device: %d\n",
++			error);
++		return error;
++	}
++
++	return 0;
++}
++
++static int sx951x_probe(struct i2c_client *i2c_client)
++{
++	const struct i2c_device_id *id;
++	const struct sx951x_hw_data *hw;
++	struct device *dev = &i2c_client->dev;
++	struct sx951x_priv *priv;
++	int error;
++
++	if (i2c_client->addr != SX951X_I2C_ADDRESS &&
++	    i2c_client->addr != SX951XB_I2C_ADDRESS_) {
++		dev_err(dev, "Invalid I2C address: 0x%02x\n",
++			i2c_client->addr);
++		return -ENODEV;
++	}
++
++	id = i2c_client_get_device_id(i2c_client);
++	hw = i2c_get_match_data(i2c_client);
++	if (!id || !hw) {
++		dev_err(dev, "Invalid device configuration\n");
++		return -EINVAL;
++	}
++
++	priv = devm_kzalloc(dev,
++			    sizeof(struct sx951x_priv),
++			    GFP_KERNEL);
++	if (!priv)
++		return -ENOMEM;
++
++	priv->dev = dev;
++	priv->hw = hw;
++
++	priv->regmap = devm_regmap_init_i2c(i2c_client, &sx951x_regmap_config);
++	if (IS_ERR(priv->regmap))
++		return PTR_ERR(priv->regmap);
++
++	/* Parse device configuration */
++	if (of_property_read_u32(dev->of_node, "poll-interval",
++				 &priv->poll_interval))
++		priv->poll_interval = SX951X_POLL_INTERVAL;
++
++	/* Register LED and input channels */
++	error = sx951x_channels_init(priv);
++	if (error) {
++		dev_err(dev, "Failed to initialize channels: %d\n", error);
++		return error;
++	}
++
++	/* Register input device */
++	error = sx951x_input_init(priv);
++	if (error) {
++		dev_err(dev, "Failed to register input device: %d\n", error);
++		return error;
++	}
++
++	return 0;
++}
++
++static void sx951x_remove(struct i2c_client *i2c_client)
++{
++	struct sx951x_priv *priv = i2c_get_clientdata(i2c_client);
++
++	/* Disable sensing */
++	regmap_write(priv->regmap, SX951X_REG_CAP_SENSE_ENABLE, 0x00);
++
++	/* Turn off all LEDs */
++	regmap_write(priv->regmap, SX951X_REG_LED_MAP_ENG2, 0x00);
++}
++
++static const struct sx951x_hw_data sx9512_hw_data = {
++	.has_proximity_sensing = true,
++};
++
++static const struct sx951x_hw_data sx9513_hw_data = {
++	.has_proximity_sensing = false,
++};
++
++static const struct of_device_id sx951x_dt_ids[] = {
++	{ .compatible = "semtech,sx9512", .data = &sx9512_hw_data },
++	{ .compatible = "semtech,sx9513", .data = &sx9513_hw_data },
++	{ }
++};
++MODULE_DEVICE_TABLE(of, sx951x_dt_ids);
++
++static const struct i2c_device_id sx951x_i2c_ids[] = {
++	{ "sx9512", (kernel_ulong_t)&sx9512_hw_data },
++	{ "sx9513", (kernel_ulong_t)&sx9513_hw_data },
++	{ }
++};
++MODULE_DEVICE_TABLE(i2c, sx951x_i2c_ids);
++
++static struct i2c_driver sx951x_i2c_driver = {
++	.driver = {
++		.name	= "sx951x",
++		.of_match_table = sx951x_dt_ids,
++	},
++	.id_table	= sx951x_i2c_ids,
++	.probe		= sx951x_probe,
++	.remove		= sx951x_remove,
++};
++
++module_i2c_driver(sx951x_i2c_driver);
++
++MODULE_DESCRIPTION("Semtech SX9512/SX9513 driver");
++MODULE_AUTHOR("David Bauer <mail@david-bauer.net>");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/ramips/rt288x/config-6.6 b/target/linux/ramips/rt288x/config-6.6
index 986bd1ef3ef3e9..0c9798b9f36c1c 100644
--- a/target/linux/ramips/rt288x/config-6.6
+++ b/target/linux/ramips/rt288x/config-6.6
@@ -5,8 +5,6 @@ CONFIG_ARCH_MMAP_RND_BITS_MAX=15
 CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
 CONFIG_ARCH_SUSPEND_POSSIBLE=y
 CONFIG_BLK_MQ_PCI=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
 CONFIG_CLK_MTMIPS=y
 CONFIG_CLONE_BACKWARDS=y
@@ -51,7 +49,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_CLOCKEVENTS=y
diff --git a/target/linux/ramips/rt305x/config-6.6 b/target/linux/ramips/rt305x/config-6.6
index 9b34b94cff6154..33efcba6332f06 100644
--- a/target/linux/ramips/rt305x/config-6.6
+++ b/target/linux/ramips/rt305x/config-6.6
@@ -4,11 +4,8 @@ CONFIG_ARCH_KEEP_MEMBLOCK=y
 CONFIG_ARCH_MMAP_RND_BITS_MAX=15
 CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
 CONFIG_ARCH_SUSPEND_POSSIBLE=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
 CONFIG_CEVT_SYSTICK_QUIRK=y
-CONFIG_CLKEVT_RT3352=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLK_MTMIPS=y
 CONFIG_CLONE_BACKWARDS=y
@@ -54,7 +51,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CMOS_UPDATE=y
@@ -163,6 +159,7 @@ CONFIG_PREEMPT_NONE_BUILD=y
 CONFIG_PTP_1588_CLOCK_OPTIONAL=y
 CONFIG_RALINK=y
 # CONFIG_RALINK_ILL_ACC is not set
+CONFIG_RALINK_TIMER=y
 CONFIG_RALINK_WDT=y
 CONFIG_RANDSTRUCT_NONE=y
 CONFIG_RATIONAL=y
diff --git a/target/linux/ramips/rt3883/config-6.6 b/target/linux/ramips/rt3883/config-6.6
index 7b3f6916ac2ce7..4b768bfb778494 100644
--- a/target/linux/ramips/rt3883/config-6.6
+++ b/target/linux/ramips/rt3883/config-6.6
@@ -6,8 +6,6 @@ CONFIG_ARCH_MMAP_RND_BITS_MAX=15
 CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=15
 CONFIG_ARCH_SUSPEND_POSSIBLE=y
 CONFIG_BLK_MQ_PCI=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
 CONFIG_CLK_MTMIPS=y
 CONFIG_CLONE_BACKWARDS=y
@@ -54,7 +52,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_CMOS_UPDATE=y
diff --git a/target/linux/realtek/Makefile b/target/linux/realtek/Makefile
index 2614b148c4dd54..6cdd32a9d81481 100644
--- a/target/linux/realtek/Makefile
+++ b/target/linux/realtek/Makefile
@@ -20,13 +20,8 @@ include $(INCLUDE_DIR)/target.mk
 DEFAULT_PACKAGES += \
 	ethtool \
 	firewall4 \
-	ip-bridge \
-	ip-full \
 	kmod-gpio-button-hotplug \
-	kmod-nft-offload \
-	nftables \
 	odhcp6c \
-	tc-bpf \
 	uboot-envtools \
 
 
diff --git a/target/linux/realtek/base-files/etc/board.d/02_network b/target/linux/realtek/base-files/etc/board.d/02_network
index 5073dbcc31e90b..1255ee8b9e1c65 100644
--- a/target/linux/realtek/base-files/etc/board.d/02_network
+++ b/target/linux/realtek/base-files/etc/board.d/02_network
@@ -36,6 +36,8 @@ hpe,1920-8g-poe-65w|\
 hpe,1920-8g-poe-180w|\
 hpe,1920-16g|\
 hpe,1920-24g|\
+hpe,1920-24g-poe-180w|\
+hpe,1920-24g-poe-370w|\
 hpe,1920-48g|\
 hpe,1920-48g-poe)
 	label_mac=$(mtd_get_mac_binary factory 0x68)
@@ -95,6 +97,12 @@ hpe,1920-8g-poe-65w)
 hpe,1920-8g-poe-180w)
 	ucidef_set_poe 180 "$(filter_port_list_reverse "$lan_list" "lan9 lan10")"
 	;;
+hpe,1920-24g-poe-180w)
+	ucidef_set_poe 180 "$(filter_port_list_reverse "$lan_list" "lan25 lan26 lan27 lan28")"
+	;;
+hpe,1920-24g-poe-370w)
+	ucidef_set_poe 370 "$(filter_port_list_reverse "$lan_list" "lan25 lan26 lan27 lan28")"
+	;;
 hpe,1920-48g-poe)
 	ucidef_set_poe 370 "lan8 lan7 lan6 lan5 lan4 lan3 lan2 lan1 lan16 lan15 lan14 lan13 lan12 lan11 lan10 lan9 lan24 lan23
 			lan22 lan21 lan20 lan19 lan18 lan17 lan32 lan31 lan30 lan29 lan28 lan27 lan26 lan25 lan40 lan39 lan38 lan37
diff --git a/target/linux/realtek/base-files/etc/board.d/05_compat-version b/target/linux/realtek/base-files/etc/board.d/05_compat-version
new file mode 100644
index 00000000000000..52dbdc627edfc0
--- /dev/null
+++ b/target/linux/realtek/base-files/etc/board.d/05_compat-version
@@ -0,0 +1,34 @@
+#
+# Copyright (C) 2020 OpenWrt.org
+#
+
+. /lib/functions.sh
+. /lib/functions/uci-defaults.sh
+
+board_config_update
+
+case "$(board_name)" in
+	hpe,1920-8g-poe-180w | \
+	hpe,1920-24g-poe-180w | \
+	hpe,1920-24g-poe-370w)
+		ucidef_set_compat_version "1.1"
+	;;
+	zyxel,gs1900-8-v1 | \
+	zyxel,gs1900-8-v2 | \
+	zyxel,gs1900-8hp-v1 | \
+	zyxel,gs1900-8hp-v2 | \
+	zyxel,gs1900-10hp | \
+	zyxel,gs1900-16 | \
+	zyxel,gs1900-24e | \
+	zyxel,gs1900-24ep | \
+	zyxel,gs1900-24hp-v1 | \
+	zyxel,gs1900-24hp-v2 | \
+	zyxel,gs1900-24-v1 | \
+	zyxel,gs1900-48)
+		ucidef_set_compat_version "2.0"
+        ;;
+esac
+
+board_config_flush
+
+exit 0
diff --git a/target/linux/realtek/dts/rtl8380_engenius_ews2910p.dts b/target/linux/realtek/dts/rtl8380_engenius_ews2910p.dts
index 289ec8627407e3..b0f1e9b53899b9 100644
--- a/target/linux/realtek/dts/rtl8380_engenius_ews2910p.dts
+++ b/target/linux/realtek/dts/rtl8380_engenius_ews2910p.dts
@@ -38,29 +38,6 @@
 		};
 	};
 
-	gpio1: rtl8231-gpio {
-		compatible = "realtek,rtl8231-gpio";
-		#gpio-cells = <2>;
-		gpio-controller;
-		indirect-access-bus-id = <0>;
-
-		poe_enable {
-			gpio-hog;
-			gpios = <1 GPIO_ACTIVE_HIGH>;
-			output-high;
-			line-name = "poe-enable";
-		};
-
-		sff_p9_gpios {
-			gpio-hog;
-			gpios = < 6 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>,
-				< 11 GPIO_ACTIVE_HIGH>, /* los-gpio */
-				< 12 GPIO_ACTIVE_LOW>;   /* mod-def0-gpio */
-			input;
-			line-name = "sff-p9-gpios";
-		};
-	};
-
 	gpio-export {
 		compatible = "gpio-export";
 
@@ -119,6 +96,40 @@
 	};
 };
 
+&mdio_aux {
+	status = "okay";
+
+	gpio1: expander@0 {
+		compatible = "realtek,rtl8231";
+		reg = <0>;
+
+		gpio-controller;
+		#gpio-cells = <2>;
+		gpio-ranges = <&gpio1 0 0 37>;
+
+		poe_enable {
+			gpio-hog;
+			gpios = <1 GPIO_ACTIVE_HIGH>;
+			output-high;
+			line-name = "poe-enable";
+		};
+
+		sff_p9_gpios {
+			gpio-hog;
+			gpios = < 6 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>,
+				< 11 GPIO_ACTIVE_HIGH>, /* los-gpio */
+				< 12 GPIO_ACTIVE_LOW>;   /* mod-def0-gpio */
+			input;
+			line-name = "sff-p9-gpios";
+		};
+
+		led-controller {
+			compatible = "realtek,rtl8231-leds";
+			status = "disabled";
+		};
+	};
+};
+
 &spi0 {
 	status = "okay";
 
diff --git a/target/linux/realtek/dts/rtl8380_hpe_1920-8g-poe-180w.dts b/target/linux/realtek/dts/rtl8380_hpe_1920-8g-poe-180w.dts
index 6398e6d034dee3..f15498354e9ae0 100644
--- a/target/linux/realtek/dts/rtl8380_hpe_1920-8g-poe-180w.dts
+++ b/target/linux/realtek/dts/rtl8380_hpe_1920-8g-poe-180w.dts
@@ -5,6 +5,17 @@
 / {
 	compatible = "hpe,1920-8g-poe-180w", "realtek,rtl838x-soc";
 	model = "HPE 1920-8G-PoE+ 180W (JG922A)";
+
+	gpio_fan_array {
+		compatible = "gpio-fan";
+
+		gpios = <&gpio1 5 GPIO_ACTIVE_HIGH>;
+		gpio-fan,speed-map =    <5000 0>,
+					<8200 1>;
+
+		alarm-gpios = <&gpio1 6 GPIO_ACTIVE_LOW>;
+		#cooling-cells = <2>;
+	};
 };
 
 &uart1 {
diff --git a/target/linux/realtek/dts/rtl8380_hpe_1920-8g.dtsi b/target/linux/realtek/dts/rtl8380_hpe_1920-8g.dtsi
index 262dd83d21c6c5..ddd46c4cf649ad 100644
--- a/target/linux/realtek/dts/rtl8380_hpe_1920-8g.dtsi
+++ b/target/linux/realtek/dts/rtl8380_hpe_1920-8g.dtsi
@@ -4,13 +4,6 @@
 #include "rtl83xx_hpe_1920.dtsi"
 
 / {
-	gpio1: rtl8231-gpio {
-		compatible = "realtek,rtl8231-gpio";
-		#gpio-cells = <2>;
-		gpio-controller;
-		indirect-access-bus-id = <0>;
-	};
-
 	i2c0: i2c-gpio-0 {
 		compatible = "i2c-gpio";
 		sda-gpios = <&gpio1 23 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>;
@@ -46,6 +39,24 @@
 	};
 };
 
+&mdio_aux {
+	status = "okay";
+
+	gpio1: expander@0 {
+		compatible = "realtek,rtl8231";
+		reg = <0>;
+
+		gpio-controller;
+		#gpio-cells = <2>;
+		gpio-ranges = <&gpio1 0 0 37>;
+
+		led-controller {
+			compatible = "realtek,rtl8231-leds";
+			status = "disabled";
+		};
+	};
+};
+
 &ethernet0 {
 	mdio: mdio-bus {
 		compatible = "realtek,rtl838x-mdio";
diff --git a/target/linux/realtek/dts/rtl8380_linksys_lgs310c.dts b/target/linux/realtek/dts/rtl8380_linksys_lgs310c.dts
index 08ef740399e656..ab095dbc65966f 100644
--- a/target/linux/realtek/dts/rtl8380_linksys_lgs310c.dts
+++ b/target/linux/realtek/dts/rtl8380_linksys_lgs310c.dts
@@ -92,12 +92,23 @@
 			linux,code = <KEY_RESTART>;
 		};
 	};
+};
+
+&mdio_aux {
+	status = "okay";
+
+	gpio1: expander@0 {
+		compatible = "realtek,rtl8231";
+		reg = <0>;
 
-	gpio1: rtl8231-gpio {
-		compatible = "realtek,rtl8231-gpio";
-		#gpio-cells = <2>;
 		gpio-controller;
-		indirect-access-bus-id = <0>;
+		#gpio-cells = <2>;
+		gpio-ranges = <&gpio1 0 0 37>;
+
+		led-controller {
+			compatible = "realtek,rtl8231-leds";
+			status = "disabled";
+		};
 	};
 };
 
diff --git a/target/linux/realtek/dts/rtl8380_netgear_gigabit.dtsi b/target/linux/realtek/dts/rtl8380_netgear_gigabit.dtsi
index aca1a14774e2ae..75bf06e674d23a 100644
--- a/target/linux/realtek/dts/rtl8380_netgear_gigabit.dtsi
+++ b/target/linux/realtek/dts/rtl8380_netgear_gigabit.dtsi
@@ -31,12 +31,23 @@
 		gpios = <&gpio0 13 GPIO_ACTIVE_LOW>;
 		open-source;
 	};
+};
+
+&mdio_aux {
+	status = "okay";
+
+	gpio1: expander@31 {
+		compatible = "realtek,rtl8231";
+		reg = <31>;
 
-	gpio1: rtl8231-gpio {
-		compatible = "realtek,rtl8231-gpio";
-		#gpio-cells = <2>;
 		gpio-controller;
-		indirect-access-bus-id = <31>;
+		#gpio-cells = <2>;
+		gpio-ranges = <&gpio1 0 0 37>;
+
+		led-controller {
+			compatible = "realtek,rtl8231-leds";
+			status = "disabled";
+		};
 	};
 };
 
diff --git a/target/linux/realtek/dts/rtl8380_netgear_gs110tpp-v1.dts b/target/linux/realtek/dts/rtl8380_netgear_gs110tpp-v1.dts
index f694ae3317c685..d25b81c3cb5cf3 100644
--- a/target/linux/realtek/dts/rtl8380_netgear_gs110tpp-v1.dts
+++ b/target/linux/realtek/dts/rtl8380_netgear_gs110tpp-v1.dts
@@ -37,6 +37,15 @@
 	};
 };
 
+&gpio1 {
+	poe-enable {
+		gpio-hog;
+		gpios = <10 GPIO_ACTIVE_HIGH>;
+		output-high;
+		line-name = "poe-enable";
+	};
+};
+
 &firmware {
 	openwrt,ih-magic = <0x4e474520>;
 };
diff --git a/target/linux/realtek/dts/rtl8380_netgear_gs310tp-v1.dts b/target/linux/realtek/dts/rtl8380_netgear_gs310tp-v1.dts
index a6f7181c11e601..9d58b3028a0bac 100644
--- a/target/linux/realtek/dts/rtl8380_netgear_gs310tp-v1.dts
+++ b/target/linux/realtek/dts/rtl8380_netgear_gs310tp-v1.dts
@@ -8,6 +8,15 @@
 
 };
 
+&gpio1 {
+	poe-enable {
+		gpio-hog;
+		gpios = <10 GPIO_ACTIVE_HIGH>;
+		output-high;
+		line-name = "poe-enable";
+	};
+};
+
 &firmware {
 	openwrt,ih-magic = <0x4e474335>;
 };
diff --git a/target/linux/realtek/dts/rtl8380_zyxel_gs1900-10hp.dts b/target/linux/realtek/dts/rtl8380_zyxel_gs1900-10hp.dts
index 190a77b7ff7198..d21b7483922246 100644
--- a/target/linux/realtek/dts/rtl8380_zyxel_gs1900-10hp.dts
+++ b/target/linux/realtek/dts/rtl8380_zyxel_gs1900-10hp.dts
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 #include "rtl8380_zyxel_gs1900.dtsi"
+#include "rtl8380_zyxel_gs1900_gpio.dtsi"
 
 / {
 	compatible = "zyxel,gs1900-10hp", "realtek,rtl838x-soc";
diff --git a/target/linux/realtek/dts/rtl8380_zyxel_gs1900-8-v1.dts b/target/linux/realtek/dts/rtl8380_zyxel_gs1900-8-v1.dts
new file mode 100644
index 00000000000000..9838c023dabcdb
--- /dev/null
+++ b/target/linux/realtek/dts/rtl8380_zyxel_gs1900-8-v1.dts
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_zyxel_gs1900.dtsi"
+#include "rtl8380_zyxel_gs1900_gpio_emulated.dtsi"
+
+/ {
+	compatible = "zyxel,gs1900-8-v1", "realtek,rtl838x-soc";
+	model = "Zyxel GS1900-8 v1 Switch";
+};
+
+&gpio1 {
+	/delete-node/ poe_enable;
+};
diff --git a/target/linux/realtek/dts/rtl8380_zyxel_gs1900-8-v2.dts b/target/linux/realtek/dts/rtl8380_zyxel_gs1900-8-v2.dts
new file mode 100644
index 00000000000000..84f87ea03749f7
--- /dev/null
+++ b/target/linux/realtek/dts/rtl8380_zyxel_gs1900-8-v2.dts
@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include "rtl8380_zyxel_gs1900.dtsi"
+#include "rtl8380_zyxel_gs1900_gpio.dtsi"
+
+/ {
+	compatible = "zyxel,gs1900-8-v2", "realtek,rtl838x-soc";
+	model = "Zyxel GS1900-8 v2 Switch";
+};
+
+&gpio1 {
+	/delete-node/ poe_enable;
+};
diff --git a/target/linux/realtek/dts/rtl8380_zyxel_gs1900-8.dts b/target/linux/realtek/dts/rtl8380_zyxel_gs1900-8.dts
deleted file mode 100644
index 548e83ba7308eb..00000000000000
--- a/target/linux/realtek/dts/rtl8380_zyxel_gs1900-8.dts
+++ /dev/null
@@ -1,12 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-#include "rtl8380_zyxel_gs1900.dtsi"
-
-/ {
-	compatible = "zyxel,gs1900-8", "realtek,rtl838x-soc";
-	model = "Zyxel GS1900-8v1/v2 Switch";
-};
-
-&gpio1 {
-	/delete-node/ poe_enable;
-};
diff --git a/target/linux/realtek/dts/rtl8380_zyxel_gs1900-8hp-v1.dts b/target/linux/realtek/dts/rtl8380_zyxel_gs1900-8hp-v1.dts
index 386edfb01595f2..22c052f506f95b 100644
--- a/target/linux/realtek/dts/rtl8380_zyxel_gs1900-8hp-v1.dts
+++ b/target/linux/realtek/dts/rtl8380_zyxel_gs1900-8hp-v1.dts
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 #include "rtl8380_zyxel_gs1900.dtsi"
+#include "rtl8380_zyxel_gs1900_gpio.dtsi"
 
 / {
 	compatible = "zyxel,gs1900-8hp-v1", "realtek,rtl838x-soc";
diff --git a/target/linux/realtek/dts/rtl8380_zyxel_gs1900-8hp-v2.dts b/target/linux/realtek/dts/rtl8380_zyxel_gs1900-8hp-v2.dts
index 2702f2ba1cff8a..728342c22fa782 100644
--- a/target/linux/realtek/dts/rtl8380_zyxel_gs1900-8hp-v2.dts
+++ b/target/linux/realtek/dts/rtl8380_zyxel_gs1900-8hp-v2.dts
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 #include "rtl8380_zyxel_gs1900.dtsi"
+#include "rtl8380_zyxel_gs1900_gpio.dtsi"
 
 / {
 	compatible = "zyxel,gs1900-8hp-v2", "realtek,rtl838x-soc";
diff --git a/target/linux/realtek/dts/rtl8380_zyxel_gs1900.dtsi b/target/linux/realtek/dts/rtl8380_zyxel_gs1900.dtsi
index 5993c1b798dfcd..1411ea0f18a47a 100644
--- a/target/linux/realtek/dts/rtl8380_zyxel_gs1900.dtsi
+++ b/target/linux/realtek/dts/rtl8380_zyxel_gs1900.dtsi
@@ -26,6 +26,7 @@
 			label = "reset";
 			gpios = <&gpio1 3 GPIO_ACTIVE_LOW>;
 			linux,code = <KEY_RESTART>;
+			debounce-interval = <100>;
 		};
 	};
 
@@ -39,19 +40,6 @@
 			gpios = <&gpio0 0 GPIO_ACTIVE_HIGH>;
 		};
 	};
-
-	gpio1: rtl8231-gpio {
-		compatible = "realtek,rtl8231-gpio";
-		#gpio-cells = <2>;
-		gpio-controller;
-		indirect-access-bus-id = <0>;
-
-		poe_enable {
-			gpio-hog;
-			gpios = <13 GPIO_ACTIVE_HIGH>;
-			output-high;
-		};
-	};
 };
 
 &spi0 {
@@ -91,14 +79,10 @@
 			};
 			partition@b260000 {
 				label = "firmware";
-				reg = <0x260000 0x6d0000>;
+				reg = <0x260000 0xda0000>;
 				compatible = "openwrt,uimage", "denx,uimage";
 				openwrt,ih-magic = <0x83800000>;
 			};
-			partition@930000 {
-				label = "runtime2";
-				reg = <0x930000 0x6d0000>;
-			};
 		};
 	};
 };
diff --git a/target/linux/realtek/dts/rtl8380_zyxel_gs1900_gpio.dtsi b/target/linux/realtek/dts/rtl8380_zyxel_gs1900_gpio.dtsi
new file mode 100644
index 00000000000000..93ec7e4a1e645d
--- /dev/null
+++ b/target/linux/realtek/dts/rtl8380_zyxel_gs1900_gpio.dtsi
@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include <dt-bindings/gpio/gpio.h>
+
+&mdio_aux {
+	status = "okay";
+
+	reset-gpios = <&gpio0 1 GPIO_ACTIVE_LOW>;
+	reset-delay-us = <1000>;
+	reset-post-delay-us = <10000>;
+
+	gpio1: expander@0 {
+		compatible = "realtek,rtl8231";
+		reg = <0x0>;
+
+		gpio-controller;
+		#gpio-cells = <2>;
+		gpio-ranges = <&gpio1 0 0 37>;
+
+		poe_enable {
+			gpio-hog;
+			gpios = <13 GPIO_ACTIVE_HIGH>;
+			output-high;
+		};
+
+		led-controller {
+			compatible = "realtek,rtl8231-leds";
+			status = "disabled";
+		};
+	};
+};
diff --git a/target/linux/realtek/dts/rtl8380_zyxel_gs1900_gpio_emulated.dtsi b/target/linux/realtek/dts/rtl8380_zyxel_gs1900_gpio_emulated.dtsi
new file mode 100644
index 00000000000000..70969eb00cadaf
--- /dev/null
+++ b/target/linux/realtek/dts/rtl8380_zyxel_gs1900_gpio_emulated.dtsi
@@ -0,0 +1,31 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#include <dt-bindings/gpio/gpio.h>
+
+&mdio_gpio {
+	status = "okay";
+
+	reset-gpios = <&gpio0 1 GPIO_ACTIVE_LOW>;
+	reset-delay-us = <1000>;
+	reset-post-delay-us = <10000>;
+
+	gpio1: expander@0 {
+		compatible = "realtek,rtl8231";
+		reg = <0x0>;
+
+		gpio-controller;
+		#gpio-cells = <2>;
+		gpio-ranges = <&gpio1 0 0 37>;
+
+		poe_enable {
+			gpio-hog;
+			gpios = <13 GPIO_ACTIVE_HIGH>;
+			output-high;
+		};
+
+		led-controller {
+			compatible = "realtek,rtl8231-leds";
+			status = "disabled";
+		};
+	};
+};
diff --git a/target/linux/realtek/dts/rtl8382_d-link_dgs-1210-10p.dts b/target/linux/realtek/dts/rtl8382_d-link_dgs-1210-10p.dts
index 1aef88afd4e165..9365f94a500944 100644
--- a/target/linux/realtek/dts/rtl8382_d-link_dgs-1210-10p.dts
+++ b/target/linux/realtek/dts/rtl8382_d-link_dgs-1210-10p.dts
@@ -2,6 +2,7 @@
 
 #include "rtl838x.dtsi"
 #include "rtl83xx_d-link_dgs-1210_common.dtsi"
+#include "rtl83xx_d-link_dgs-1210_gpio.dtsi"
 
 / {
 	compatible = "d-link,dgs-1210-10p", "realtek,rtl838x-soc";
@@ -43,23 +44,6 @@
 		tx-disable-gpio = <&gpio1 12 GPIO_ACTIVE_HIGH>;
 	};
 
-	keys {
-		compatible = "gpio-keys-polled";
-		poll-interval = <20>;
-
-		mode {
-			label = "mode";
-			gpios = <&gpio1 30 GPIO_ACTIVE_LOW>;
-			linux,code = <KEY_LIGHTS_TOGGLE>;
-		};
-
-		reset {
-			label = "reset";
-			gpios = <&gpio1 33 GPIO_ACTIVE_LOW>;
-			linux,code = <KEY_RESTART>;
-		};
-	};
-
 	leds {
 		link_act {
 			label = "green:link_act";
@@ -76,12 +60,13 @@
 			gpios = <&gpio1 27 GPIO_ACTIVE_LOW>;
 		};
 	};
+};
 
-	gpio1: rtl8231-gpio {
-		compatible = "realtek,rtl8231-gpio";
-		#gpio-cells = <2>;
-		gpio-controller;
-		indirect-access-bus-id = <0>;
+&keys {
+	mode {
+		label = "mode";
+		gpios = <&gpio1 30 GPIO_ACTIVE_LOW>;
+		linux,code = <KEY_LIGHTS_TOGGLE>;
 	};
 };
 
diff --git a/target/linux/realtek/dts/rtl8382_hpe_1920-24g-poe-180w.dts b/target/linux/realtek/dts/rtl8382_hpe_1920-24g-poe-180w.dts
new file mode 100644
index 00000000000000..69e647c59a98e2
--- /dev/null
+++ b/target/linux/realtek/dts/rtl8382_hpe_1920-24g-poe-180w.dts
@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl8382_hpe_1920-24g.dtsi"
+
+/ {
+	compatible = "hpe,1920-24g-poe-180w", "realtek,rtl838x-soc";
+	model = "HPE 1920-24G-PoE+ 180W (JG925A)";
+
+	gpio_fan_array {
+		compatible = "gpio-fan";
+
+		gpios = <&gpio1 5 GPIO_ACTIVE_HIGH>;
+		gpio-fan,speed-map =    <5000 0>,
+					<8200 1>;
+
+		alarm-gpios = <&gpio1 6 GPIO_ACTIVE_LOW>;
+		#cooling-cells = <2>;
+	};
+};
+
+&uart1 {
+	status = "okay";
+};
diff --git a/target/linux/realtek/dts/rtl8382_hpe_1920-24g-poe-370w.dts b/target/linux/realtek/dts/rtl8382_hpe_1920-24g-poe-370w.dts
new file mode 100644
index 00000000000000..532f23ab2f2b6e
--- /dev/null
+++ b/target/linux/realtek/dts/rtl8382_hpe_1920-24g-poe-370w.dts
@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl8382_hpe_1920-24g.dtsi"
+
+/ {
+	compatible = "hpe,1920-24g-poe-370w", "realtek,rtl838x-soc";
+	model = "HPE 1920-24G-PoE+ 370W (JG926A)";
+
+	gpio_fan_array {
+		compatible = "gpio-fan";
+
+		gpios = <&gpio1 5 GPIO_ACTIVE_HIGH>;
+		gpio-fan,speed-map =    <5000 0>,
+					<8200 1>;
+
+		alarm-gpios = <&gpio1 6 GPIO_ACTIVE_LOW>;
+		#cooling-cells = <2>;
+	};
+};
+
+&uart1 {
+	status = "okay";
+};
diff --git a/target/linux/realtek/dts/rtl8382_hpe_1920-24g.dts b/target/linux/realtek/dts/rtl8382_hpe_1920-24g.dts
index 61781c708e288d..cc92b144b5e48e 100644
--- a/target/linux/realtek/dts/rtl8382_hpe_1920-24g.dts
+++ b/target/linux/realtek/dts/rtl8382_hpe_1920-24g.dts
@@ -1,68 +1,8 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
-#include "rtl8382_hpe_1920.dtsi"
+#include "rtl8382_hpe_1920-24g.dtsi"
 
 / {
 	compatible = "hpe,1920-24g", "realtek,rtl838x-soc";
 	model = "HPE 1920-24G (JG924A)";
 };
-
-&mdio {
-	EXTERNAL_PHY(0)
-	EXTERNAL_PHY(1)
-	EXTERNAL_PHY(2)
-	EXTERNAL_PHY(3)
-	EXTERNAL_PHY(4)
-	EXTERNAL_PHY(5)
-	EXTERNAL_PHY(6)
-	EXTERNAL_PHY(7)
-};
-
-&switch0 {
-	ports {
-		#address-cells = <1>;
-		#size-cells = <0>;
-
-		SWITCH_PORT(0, 1, qsgmii)
-		SWITCH_PORT(1, 2, qsgmii)
-		SWITCH_PORT(2, 3, qsgmii)
-		SWITCH_PORT(3, 4, qsgmii)
-		SWITCH_PORT(4, 5, qsgmii)
-		SWITCH_PORT(5, 6, qsgmii)
-		SWITCH_PORT(6, 7, qsgmii)
-		SWITCH_PORT(7, 8, qsgmii)
-
-		SWITCH_PORT(8, 9, internal)
-		SWITCH_PORT(9, 10, internal)
-		SWITCH_PORT(10, 11, internal)
-		SWITCH_PORT(11, 12, internal)
-		SWITCH_PORT(12, 13, internal)
-		SWITCH_PORT(13, 14, internal)
-		SWITCH_PORT(14, 15, internal)
-		SWITCH_PORT(15, 16, internal)
-
-		SWITCH_PORT(16, 17, qsgmii)
-		SWITCH_PORT(17, 18, qsgmii)
-		SWITCH_PORT(18, 19, qsgmii)
-		SWITCH_PORT(19, 20, qsgmii)
-		SWITCH_PORT(20, 21, qsgmii)
-		SWITCH_PORT(21, 22, qsgmii)
-		SWITCH_PORT(22, 23, qsgmii)
-		SWITCH_PORT(23, 24, qsgmii)
-
-		SWITCH_PORT(24, 25, qsgmii)
-		SWITCH_PORT(25, 26, qsgmii)
-		SWITCH_PORT(26, 27, qsgmii)
-		SWITCH_PORT(27, 28, qsgmii)
-
-		port@28 {
-			ethernet = <&ethernet0>;
-			reg = <28>;
-			phy-mode = "internal";
-			fixed-link {
-				speed = <1000>;
-				full-duplex;
-			};
-		};
-	};
-};
diff --git a/target/linux/realtek/dts/rtl8382_hpe_1920-24g.dtsi b/target/linux/realtek/dts/rtl8382_hpe_1920-24g.dtsi
new file mode 100644
index 00000000000000..61781c708e288d
--- /dev/null
+++ b/target/linux/realtek/dts/rtl8382_hpe_1920-24g.dtsi
@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: GPL-2.0-or-later OR MIT
+
+#include "rtl8382_hpe_1920.dtsi"
+
+/ {
+	compatible = "hpe,1920-24g", "realtek,rtl838x-soc";
+	model = "HPE 1920-24G (JG924A)";
+};
+
+&mdio {
+	EXTERNAL_PHY(0)
+	EXTERNAL_PHY(1)
+	EXTERNAL_PHY(2)
+	EXTERNAL_PHY(3)
+	EXTERNAL_PHY(4)
+	EXTERNAL_PHY(5)
+	EXTERNAL_PHY(6)
+	EXTERNAL_PHY(7)
+};
+
+&switch0 {
+	ports {
+		#address-cells = <1>;
+		#size-cells = <0>;
+
+		SWITCH_PORT(0, 1, qsgmii)
+		SWITCH_PORT(1, 2, qsgmii)
+		SWITCH_PORT(2, 3, qsgmii)
+		SWITCH_PORT(3, 4, qsgmii)
+		SWITCH_PORT(4, 5, qsgmii)
+		SWITCH_PORT(5, 6, qsgmii)
+		SWITCH_PORT(6, 7, qsgmii)
+		SWITCH_PORT(7, 8, qsgmii)
+
+		SWITCH_PORT(8, 9, internal)
+		SWITCH_PORT(9, 10, internal)
+		SWITCH_PORT(10, 11, internal)
+		SWITCH_PORT(11, 12, internal)
+		SWITCH_PORT(12, 13, internal)
+		SWITCH_PORT(13, 14, internal)
+		SWITCH_PORT(14, 15, internal)
+		SWITCH_PORT(15, 16, internal)
+
+		SWITCH_PORT(16, 17, qsgmii)
+		SWITCH_PORT(17, 18, qsgmii)
+		SWITCH_PORT(18, 19, qsgmii)
+		SWITCH_PORT(19, 20, qsgmii)
+		SWITCH_PORT(20, 21, qsgmii)
+		SWITCH_PORT(21, 22, qsgmii)
+		SWITCH_PORT(22, 23, qsgmii)
+		SWITCH_PORT(23, 24, qsgmii)
+
+		SWITCH_PORT(24, 25, qsgmii)
+		SWITCH_PORT(25, 26, qsgmii)
+		SWITCH_PORT(26, 27, qsgmii)
+		SWITCH_PORT(27, 28, qsgmii)
+
+		port@28 {
+			ethernet = <&ethernet0>;
+			reg = <28>;
+			phy-mode = "internal";
+			fixed-link {
+				speed = <1000>;
+				full-duplex;
+			};
+		};
+	};
+};
diff --git a/target/linux/realtek/dts/rtl8382_hpe_1920.dtsi b/target/linux/realtek/dts/rtl8382_hpe_1920.dtsi
index af168067d4d935..20d8693a3be4d4 100644
--- a/target/linux/realtek/dts/rtl8382_hpe_1920.dtsi
+++ b/target/linux/realtek/dts/rtl8382_hpe_1920.dtsi
@@ -4,12 +4,6 @@
 #include "rtl83xx_hpe_1920.dtsi"
 
 / {
-	gpio1: rtl8231-gpio {
-		compatible = "realtek,rtl8231-gpio";
-		#gpio-cells = <2>;
-		gpio-controller;
-		indirect-access-bus-id = <0>;
-	};
 
 	i2c0: i2c-gpio-0 {
 		compatible = "i2c-gpio";
@@ -84,6 +78,24 @@
 	};
 };
 
+&mdio_aux {
+	status = "okay";
+
+	gpio1: expander@0 {
+		compatible = "realtek,rtl8231";
+		reg = <0>;
+
+		gpio-controller;
+		#gpio-cells = <2>;
+		gpio-ranges = <&gpio1 0 0 37>;
+
+		led-controller {
+			compatible = "realtek,rtl8231-leds";
+			status = "disabled";
+		};
+	};
+};
+
 &ethernet0 {
 	mdio: mdio-bus {
 		compatible = "realtek,rtl838x-mdio";
diff --git a/target/linux/realtek/dts/rtl8382_iodata_bsh-g24mb.dts b/target/linux/realtek/dts/rtl8382_iodata_bsh-g24mb.dts
index 49b55813f9d503..c4f81656042cde 100644
--- a/target/linux/realtek/dts/rtl8382_iodata_bsh-g24mb.dts
+++ b/target/linux/realtek/dts/rtl8382_iodata_bsh-g24mb.dts
@@ -43,12 +43,23 @@
 			linux,code = <KEY_RESTART>;
 		};
 	};
+};
+
+&mdio_aux {
+	status = "okay";
+
+	gpio1: expander@0 {
+		compatible = "realtek,rtl8231";
+		reg = <0>;
 
-	gpio1: rtl8231-gpio {
-		compatible = "realtek,rtl8231-gpio";
-		#gpio-cells = <2>;
 		gpio-controller;
-		indirect-access-bus-id = <0>;
+		#gpio-cells = <2>;
+		gpio-ranges = <&gpio1 0 0 37>;
+
+		led-controller {
+			compatible = "realtek,rtl8231-leds";
+			status = "disabled";
+		};
 	};
 };
 
diff --git a/target/linux/realtek/dts/rtl8382_zyxel_gs1900-16.dts b/target/linux/realtek/dts/rtl8382_zyxel_gs1900-16.dts
index 6010da2e26c3f5..5b40f1ce097b72 100644
--- a/target/linux/realtek/dts/rtl8382_zyxel_gs1900-16.dts
+++ b/target/linux/realtek/dts/rtl8382_zyxel_gs1900-16.dts
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 #include "rtl8380_zyxel_gs1900.dtsi"
+#include "rtl8380_zyxel_gs1900_gpio.dtsi"
 
 / {
 	compatible = "zyxel,gs1900-16", "realtek,rtl838x-soc";
diff --git a/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24-v1.dts b/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24-v1.dts
index 6d98e7fae1dcd4..87cff0022ef841 100644
--- a/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24-v1.dts
+++ b/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24-v1.dts
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 #include "rtl8380_zyxel_gs1900.dtsi"
+#include "rtl8380_zyxel_gs1900_gpio.dtsi"
 
 / {
 	compatible = "zyxel,gs1900-24-v1", "realtek,rtl838x-soc";
diff --git a/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24e.dts b/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24e.dts
index b455ddf23a990d..1eaf2090abaeb9 100644
--- a/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24e.dts
+++ b/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24e.dts
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 #include "rtl8380_zyxel_gs1900.dtsi"
+#include "rtl8380_zyxel_gs1900_gpio.dtsi"
 
 / {
 	compatible = "zyxel,gs1900-24e", "realtek,rtl838x-soc";
diff --git a/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24ep.dts b/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24ep.dts
index 25c82f089eeaf6..fea2e77f3ecfbc 100644
--- a/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24ep.dts
+++ b/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24ep.dts
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 #include "rtl8380_zyxel_gs1900.dtsi"
+#include "rtl8380_zyxel_gs1900_gpio.dtsi"
 
 / {
 	compatible = "zyxel,gs1900-24ep", "realtek,rtl838x-soc";
diff --git a/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24hp-v1.dts b/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24hp-v1.dts
index fa9bef89d6ba7f..59cd2082a8d567 100644
--- a/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24hp-v1.dts
+++ b/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24hp-v1.dts
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 #include "rtl8380_zyxel_gs1900.dtsi"
+#include "rtl8380_zyxel_gs1900_gpio.dtsi"
 
 / {
 	compatible = "zyxel,gs1900-24hp-v1", "realtek,rtl838x-soc";
diff --git a/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24hp-v2.dts b/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24hp-v2.dts
index 93011cbdaadfab..78c66507f172b7 100644
--- a/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24hp-v2.dts
+++ b/target/linux/realtek/dts/rtl8382_zyxel_gs1900-24hp-v2.dts
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 #include "rtl8380_zyxel_gs1900.dtsi"
+#include "rtl8380_zyxel_gs1900_gpio.dtsi"
 
 / {
 	compatible = "zyxel,gs1900-24hp-v2", "realtek,rtl838x-soc";
diff --git a/target/linux/realtek/dts/rtl838x.dtsi b/target/linux/realtek/dts/rtl838x.dtsi
index 13ba6450b2d6f0..18da4c93800461 100644
--- a/target/linux/realtek/dts/rtl838x.dtsi
+++ b/target/linux/realtek/dts/rtl838x.dtsi
@@ -1,6 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later OR MIT
 
 #include <dt-bindings/clock/rtl83xx-clk.h>
+#include <dt-bindings/gpio/gpio.h>
 
 /dts-v1/;
 
@@ -120,6 +121,7 @@
 	aliases {
 		serial0 = &uart0;
 		serial1 = &uart1;
+		mdio-gpio1 = &mdio_gpio;
 	};
 
 	chosen {
@@ -134,6 +136,22 @@
 		interrupt-controller;
 	};
 
+	/*
+	 * Provided for devices with RTL838xM SoC with revision A silicon.
+	 * Newer SoCs can use the &mdio_aux bus instead.
+	 */
+	mdio_gpio: mdio {
+		compatible = "virtual,mdio-gpio";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		gpios = <&gpio0 2 GPIO_ACTIVE_HIGH>,
+			<&gpio0 3 GPIO_ACTIVE_HIGH>;
+		pinctrl-names = "default";
+		pinctrl-0 = <&mdio_aux_gpio>;
+
+		status = "disabled";
+	};
+
 	soc: soc {
 		compatible = "simple-bus";
 		#address-cells = <1>;
@@ -232,6 +250,42 @@
 		};
 	};
 
+	switchcore@1b000000 {
+		compatible = "syscon", "simple-mfd";
+		reg = <0x1b000000 0x20000>;
+
+		mdio_aux: mdio-aux {
+			compatible = "realtek,rtl8380-aux-mdio";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "disabled";
+
+			pinctrl-names = "default";
+			pinctrl-0 = <&mdio_aux_mdx>, <&aux_mode_mdio>;
+		};
+	};
+
+	pinmux@1b000144 {
+		compatible = "pinctrl-single";
+		reg = <0x1b000144 0x4>;
+
+		pinctrl-single,bit-per-mux;
+		pinctrl-single,register-width = <32>;
+		pinctrl-single,function-mask = <0x1>;
+		#pinctrl-cells = <2>;
+
+		/* I2C mode */
+		aux_mode_i2c: i2c-pins {
+			pinctrl-single,bits = <0x0 0x0 0x1>;
+		};
+
+		/* MDIO mode */
+		aux_mode_mdio: mdx-pins {
+			pinctrl-single,bits = <0x0 0x1 0x1>;
+		};
+	};
+
 	pinmux: pinmux@1b001000 {
 		compatible = "pinctrl-single";
 		reg = <0x1b001000 0x4>;
@@ -262,6 +316,26 @@
 		};
 	};
 
+	pinmux@1b00a0e0 {
+		compatible = "pinctrl-single";
+		reg = <0x1b00a0e0 0x4>;
+
+		pinctrl-single,bit-per-mux;
+		pinctrl-single,register-width = <32>;
+		pinctrl-single,function-mask = <0x1>;
+		#pinctrl-cells = <2>;
+
+		/* Use SoC GPIO 2/3 as GPIO */
+		mdio_aux_gpio: gpio-pins {
+			pinctrl-single,bits = <0x0 0x0 0x1>;
+		};
+
+		/* Use SoC GPIO 2/3 as MDC/MDIO */
+		mdio_aux_mdx: mdx-pins {
+			pinctrl-single,bits = <0x0 0x1 0x1>;
+		};
+	};
+
 	ethernet0: ethernet@1b00a300 {
 		compatible = "realtek,rtl838x-eth";
 		reg = <0x1b00a300 0x100>;
diff --git a/target/linux/realtek/dts/rtl8393_hpe_1920-48g-poe.dts b/target/linux/realtek/dts/rtl8393_hpe_1920-48g-poe.dts
index e2427754341255..9765f80d8817f2 100644
--- a/target/linux/realtek/dts/rtl8393_hpe_1920-48g-poe.dts
+++ b/target/linux/realtek/dts/rtl8393_hpe_1920-48g-poe.dts
@@ -5,8 +5,37 @@
 / {
 	compatible = "hpe,1920-48g-poe", "realtek,rtl8393-soc";
 	model = "HPE 1920-48G-PoE (JG928A)";
+
+	gpio_fan_array {
+		compatible = "gpio-fan";
+
+		gpios = <&gpio1 5 GPIO_ACTIVE_HIGH>;
+		gpio-fan,speed-map =    <5000 0>,
+					<8200 1>;
+
+		alarm-gpios = <&gpio1 6 GPIO_ACTIVE_LOW>;
+		#cooling-cells = <2>;
+	};
 };
 
 &uart1 {
 	status = "okay";
 };
+
+&mdio_aux {
+	status = "okay";
+
+	gpio1: expander@0 {
+		compatible = "realtek,rtl8231";
+		reg = <0>;
+
+		gpio-controller;
+		#gpio-cells = <2>;
+		gpio-ranges = <&gpio1 0 0 37>;
+
+		led-controller {
+			compatible = "realtek,rtl8231-leds";
+			status = "disabled";
+		};
+	};
+};
diff --git a/target/linux/realtek/dts/rtl8393_zyxel_gs1900-48.dts b/target/linux/realtek/dts/rtl8393_zyxel_gs1900-48.dts
index c7ddd8313a3214..6bb99b6137f350 100644
--- a/target/linux/realtek/dts/rtl8393_zyxel_gs1900-48.dts
+++ b/target/linux/realtek/dts/rtl8393_zyxel_gs1900-48.dts
@@ -32,26 +32,15 @@
 		};
 	};
 
-	gpio1: rtl8231-gpio {
-		compatible = "realtek,rtl8231-gpio";
-		#gpio-cells = <2>;
-		indirect-access-bus-id = <3>;
-		gpio-controller;
-	};
-
-	gpio-restart {
-		compatible = "gpio-restart";
-		gpios = <&gpio1 5 GPIO_ACTIVE_LOW>;
-	};
-
 	keys {
 		compatible = "gpio-keys-polled";
 		poll-interval = <20>;
 
-		mode {
+		reset {
 			label = "reset";
 			gpios = <&gpio1 3 GPIO_ACTIVE_LOW>;
 			linux,code = <KEY_RESTART>;
+			debounce-interval = <100>;
 		};
 	};
 
@@ -94,6 +83,24 @@
 	};
 };
 
+&mdio_aux {
+	status = "okay";
+
+	gpio1: expander@3 {
+		compatible = "realtek,rtl8231";
+		reg = <3>;
+
+		gpio-controller;
+		#gpio-cells = <2>;
+		gpio-ranges = <&gpio1 0 0 37>;
+
+		led-controller {
+			compatible = "realtek,rtl8231-leds";
+			status = "disabled";
+		};
+	};
+};
+
 &spi0 {
 	status = "okay";
 	flash@0 {
@@ -131,14 +138,10 @@
 			};
 			partition@260000 {
 				label = "firmware";
-				reg = <0x260000 0x6d0000>;
+				reg = <0x260000 0xda0000>;
 				compatible = "openwrt,uimage", "denx,uimage";
 				openwrt,ih-magic = <0x83800000>;
 			};
-			partition@930000 {
-				label = "runtime2";
-				reg = <0x930000 0x6d0000>;
-			};
 		};
 	};
 };
diff --git a/target/linux/realtek/dts/rtl839x.dtsi b/target/linux/realtek/dts/rtl839x.dtsi
index 3f87f5622e23df..7fc5aea70c4970 100644
--- a/target/linux/realtek/dts/rtl839x.dtsi
+++ b/target/linux/realtek/dts/rtl839x.dtsi
@@ -258,6 +258,22 @@
 
 	};
 
+	switchcore@1b000000 {
+		compatible = "syscon", "simple-mfd";
+		reg = <0x1b000000 0x20000>;
+
+		mdio_aux: mdio-aux {
+			compatible = "realtek,rtl8390-aux-mdio";
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			status = "disabled";
+
+			pinctrl-names = "default";
+			pinctrl-0 = <&mdio_aux_mdx>;
+		};
+	};
+
 	pinmux@1b000004 {
 		compatible = "pinctrl-single";
 		reg = <0x1b000004 0x4>;
@@ -290,6 +306,11 @@
 		pinmux_disable_sys_led: disable_sys_led {
 			pinctrl-single,bits = <0x0 0x0 0x4000>;
 		};
+
+		/* enable AUX MDC/MDIO */
+		mdio_aux_mdx: aux-mdx-pins {
+			pinctrl-single,bits = <0x0 0x100000 0x1c0000>;
+		};
 	};
 
 	ethernet0: ethernet@1b00a300 {
diff --git a/target/linux/realtek/dts/rtl83xx_d-link_dgs-1210_common.dtsi b/target/linux/realtek/dts/rtl83xx_d-link_dgs-1210_common.dtsi
index fa623d7a9006ae..c11c26f0791957 100644
--- a/target/linux/realtek/dts/rtl83xx_d-link_dgs-1210_common.dtsi
+++ b/target/linux/realtek/dts/rtl83xx_d-link_dgs-1210_common.dtsi
@@ -30,10 +30,6 @@
 	};
 };
 
-&gpio0 {
-	indirect-access-bus-id = <0>;
-};
-
 &spi0 {
 	status = "okay";
 	flash@0 {
diff --git a/target/linux/realtek/dts/rtl83xx_d-link_dgs-1210_gpio.dtsi b/target/linux/realtek/dts/rtl83xx_d-link_dgs-1210_gpio.dtsi
index b1477aa182148a..ccfeef3a39e1d4 100644
--- a/target/linux/realtek/dts/rtl83xx_d-link_dgs-1210_gpio.dtsi
+++ b/target/linux/realtek/dts/rtl83xx_d-link_dgs-1210_gpio.dtsi
@@ -17,11 +17,22 @@
 			linux,code = <KEY_RESTART>;
 		};
 	};
+};
+
+&mdio_aux {
+	status = "okay";
+
+	gpio1: expander@0 {
+		compatible = "realtek,rtl8231";
+		reg = <0>;
 
-	gpio1: rtl8231-gpio {
-		compatible = "realtek,rtl8231-gpio";
-		#gpio-cells = <2>;
 		gpio-controller;
-		indirect-access-bus-id = <0>;
+		#gpio-cells = <2>;
+		gpio-ranges = <&gpio1 0 0 37>;
+
+		led-controller {
+			compatible = "realtek,rtl8231-leds";
+			status = "disabled";
+		};
 	};
 };
diff --git a/target/linux/realtek/files-6.6/arch/mips/rtl838x/Platform b/target/linux/realtek/files-6.6/arch/mips/rtl838x/Platform
index 98f18cac1be13b..e824dee7b724d4 100644
--- a/target/linux/realtek/files-6.6/arch/mips/rtl838x/Platform
+++ b/target/linux/realtek/files-6.6/arch/mips/rtl838x/Platform
@@ -1,5 +1,5 @@
 #
 # Realtek RTL838x SoCs
 #
-cflags-$(CONFIG_RTL83XX)   += -I$(srctree)/arch/mips/include/asm/mach-rtl838x/
-load-$(CONFIG_RTL83XX)     += 0xffffffff80100000
+cflags-$(CONFIG_MACH_REALTEK_RTL)   += -I$(srctree)/arch/mips/include/asm/mach-rtl838x/
+load-$(CONFIG_MACH_REALTEK_RTL)     += 0xffffffff80100000
diff --git a/target/linux/realtek/files-6.6/drivers/clk/realtek/Kconfig b/target/linux/realtek/files-6.6/drivers/clk/realtek/Kconfig
index 4cf3cd963399a2..62b704077ac75f 100644
--- a/target/linux/realtek/files-6.6/drivers/clk/realtek/Kconfig
+++ b/target/linux/realtek/files-6.6/drivers/clk/realtek/Kconfig
@@ -2,13 +2,13 @@
 
 menuconfig COMMON_CLK_REALTEK
 	bool "Support for Realtek's clock controllers"
-	depends on RTL83XX
+	depends on MACH_REALTEK_RTL
 
 if COMMON_CLK_REALTEK
 
 config COMMON_CLK_RTL83XX
 	bool "Clock driver for Realtek RTL83XX"
-	depends on RTL83XX
+	depends on MACH_REALTEK_RTL
 	select SRAM
 	help
 	  This driver adds support for the Realtek RTL83xx series basic clocks.
diff --git a/target/linux/realtek/files-6.6/drivers/gpio/gpio-rtl8231.c b/target/linux/realtek/files-6.6/drivers/gpio/gpio-rtl8231.c
deleted file mode 100644
index 2821591a97ed9d..00000000000000
--- a/target/linux/realtek/files-6.6/drivers/gpio/gpio-rtl8231.c
+++ /dev/null
@@ -1,364 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-
-#include <linux/gpio/driver.h>
-#include <linux/module.h>
-#include <linux/platform_device.h>
-#include <linux/delay.h>
-#include <asm/mach-rtl838x/mach-rtl83xx.h>
-
-/* RTL8231 registers for LED control */
-#define RTL8231_LED_FUNC0			0x0000
-#define RTL8231_LED_FUNC1			0x0001
-#define RTL8231_READY_MASK			0x03f0
-#define RTL8231_READY_VALUE			0x0370
-#define RTL8231_GPIO_PIN_SEL(gpio)		((0x0002) + ((gpio) >> 4))
-#define RTL8231_GPIO_DIR(gpio)			((0x0005) + ((gpio) >> 4))
-#define RTL8231_GPIO_DATA(gpio)			((0x001C) + ((gpio) >> 4))
-
-#define USEC_TIMEOUT 5000
-
-#define RTL8231_SMI_BUS_ID_MAX			0x1F
-
-struct rtl8231_gpios {
-	struct gpio_chip gc;
-	struct device *dev;
-	u32 id;
-	u32 smi_bus_id;
-	u16 reg_shadow[0x20];
-	u32 reg_cached;
-	int ext_gpio_indrt_access;
-};
-
-extern struct rtl83xx_soc_info soc_info;
-
-DEFINE_MUTEX(miim_lock);
-
-static u32 rtl8231_read(struct rtl8231_gpios *gpios, u32 reg)
-{
-	u32 t = 0, n = 0;
-
-	reg &= 0x1f;
-
-	/* Calculate read register address */
-	t = (gpios->smi_bus_id << 2) | (reg << 7);
-
-	/* Set execution bit: cleared when operation completed */
-	t |= 1;
-
-	/* Start execution */
-	sw_w32(t, gpios->ext_gpio_indrt_access);
-	do {
-		udelay(1);
-		t = sw_r32(gpios->ext_gpio_indrt_access);
-		n++;
-	} while ((t & 1) && (n < USEC_TIMEOUT));
-
-	if (n >= USEC_TIMEOUT)
-		return 0x80000000;
-
-	pr_debug("%s: %x, %x, %x\n", __func__, gpios->smi_bus_id,
-		reg, (t & 0xffff0000) >> 16);
-
-	return (t & 0xffff0000) >> 16;
-}
-
-static int rtl8231_write(struct rtl8231_gpios *gpios, u32 reg, u32 data)
-{
-	u32 t = 0, n = 0;
-
-	pr_debug("%s: %x, %x, %x\n", __func__, gpios->smi_bus_id, reg, data);
-	reg &= 0x1f;
-
-	t = (gpios->smi_bus_id << 2) | (reg << 7) | (data << 16);
-	/* Set write bit */
-	t |= 2;
-
-	/* Set execution bit: cleared when operation completed */
-	t |= 1;
-
-	/* Start execution */
-	sw_w32(t, gpios->ext_gpio_indrt_access);
-	do {
-		udelay(1);
-		t = sw_r32(gpios->ext_gpio_indrt_access);
-	} while ((t & 1) && (n < USEC_TIMEOUT));
-
-	if (n >= USEC_TIMEOUT)
-		return -1;
-
-	return 0;
-}
-
-static u32 rtl8231_read_cached(struct rtl8231_gpios *gpios, u32 reg)
-{
-	if (reg > 0x1f)
-		return 0;
-
-	if (gpios->reg_cached & (1 << reg))
-		return gpios->reg_shadow[reg];
-
-	return rtl8231_read(gpios, reg);
-}
-
-/* Set Direction of the RTL8231 pin:
- * dir 1: input
- * dir 0: output
- */
-static int rtl8231_pin_dir(struct rtl8231_gpios *gpios, u32 gpio, u32 dir)
-{
-	u32 v;
-	int pin_sel_addr = RTL8231_GPIO_PIN_SEL(gpio);
-	int pin_dir_addr = RTL8231_GPIO_DIR(gpio);
-	int dpin = gpio % 16;
-
-	if (gpio > 31) {
-		pr_debug("WARNING: HIGH pin\n");
-		dpin += 5;
-		pin_dir_addr = pin_sel_addr;
-	}
-
-	v = rtl8231_read_cached(gpios, pin_dir_addr);
-	if (v & 0x80000000) {
-		pr_err("Error reading RTL8231\n");
-		return -1;
-	}
-
-	v = (v & ~(1 << dpin)) | (dir << dpin);
-	rtl8231_write(gpios, pin_dir_addr, v);
-	gpios->reg_shadow[pin_dir_addr] = v;
-	gpios->reg_cached |= 1 << pin_dir_addr;
-
-	return 0;
-}
-
-static int rtl8231_pin_dir_get(struct rtl8231_gpios *gpios, u32 gpio, u32 *dir)
-{
-	/* dir 1: input
-	 * dir 0: output
-	 */
-
-	u32  v;
-	int pin_dir_addr = RTL8231_GPIO_DIR(gpio);
-	int pin = gpio % 16;
-
-	if (gpio > 31) {
-		pin_dir_addr = RTL8231_GPIO_PIN_SEL(gpio);
-		pin += 5;
-	}
-
-	v = rtl8231_read(gpios, pin_dir_addr);
-	if (v & (1 << pin))
-		*dir = 1;
-	else
-		*dir = 0;
-
-	return 0;
-}
-
-static int rtl8231_pin_set(struct rtl8231_gpios *gpios, u32 gpio, u32 data)
-{
-	u32 v = rtl8231_read(gpios, RTL8231_GPIO_DATA(gpio));
-
-	pr_debug("%s: %d to %d\n", __func__, gpio, data);
-	if (v & 0x80000000) {
-		pr_err("Error reading RTL8231\n");
-		return -1;
-	}
-	v = (v & ~(1 << (gpio % 16))) | (data << (gpio % 16));
-	rtl8231_write(gpios, RTL8231_GPIO_DATA(gpio), v);
-	gpios->reg_shadow[RTL8231_GPIO_DATA(gpio)] = v;
-	gpios->reg_cached |= 1 << RTL8231_GPIO_DATA(gpio);
-
-	return 0;
-}
-
-static int rtl8231_pin_get(struct rtl8231_gpios *gpios, u32 gpio, u16 *state)
-{
-	u32 v = rtl8231_read(gpios, RTL8231_GPIO_DATA(gpio));
-
-	if (v & 0x80000000) {
-		pr_err("Error reading RTL8231\n");
-		return -1;
-	}
-
-	*state = v & 0xffff;
-
-	return 0;
-}
-
-static int rtl8231_direction_input(struct gpio_chip *gc, unsigned int offset)
-{
-	int err;
-	struct rtl8231_gpios *gpios = gpiochip_get_data(gc);
-
-	pr_debug("%s: %d\n", __func__, offset);
-	mutex_lock(&miim_lock);
-	err = rtl8231_pin_dir(gpios, offset, 1);
-	mutex_unlock(&miim_lock);
-
-	return err;
-}
-
-static int rtl8231_direction_output(struct gpio_chip *gc, unsigned int offset, int value)
-{
-	int err;
-	struct rtl8231_gpios *gpios = gpiochip_get_data(gc);
-
-	pr_debug("%s: %d\n", __func__, offset);
-	mutex_lock(&miim_lock);
-	err = rtl8231_pin_dir(gpios, offset, 0);
-	mutex_unlock(&miim_lock);
-
-	if (!err)
-		err = rtl8231_pin_set(gpios, offset, value);
-
-	return err;
-}
-
-static int rtl8231_get_direction(struct gpio_chip *gc, unsigned int offset)
-{
-	u32 v = 0;
-	struct rtl8231_gpios *gpios = gpiochip_get_data(gc);
-
-	pr_debug("%s: %d\n", __func__, offset);
-	mutex_lock(&miim_lock);
-	rtl8231_pin_dir_get(gpios, offset, &v);
-	mutex_unlock(&miim_lock);
-
-	return v;
-}
-
-static int rtl8231_gpio_get(struct gpio_chip *gc, unsigned int offset)
-{
-	u16 state = 0;
-	struct rtl8231_gpios *gpios = gpiochip_get_data(gc);
-
-	mutex_lock(&miim_lock);
-	rtl8231_pin_get(gpios, offset, &state);
-	mutex_unlock(&miim_lock);
-
-	if (state & (1 << (offset % 16)))
-		return 1;
-
-	return 0;
-}
-
-void rtl8231_gpio_set(struct gpio_chip *gc, unsigned int offset, int value)
-{
-	struct rtl8231_gpios *gpios = gpiochip_get_data(gc);
-
-	rtl8231_pin_set(gpios, offset, value);
-}
-
-int rtl8231_init(struct rtl8231_gpios *gpios)
-{
-	u32 ret;
-
-	pr_info("%s called, MDIO bus ID: %d\n", __func__, gpios->smi_bus_id);
-
-	gpios->reg_cached = 0;
-
-	if (soc_info.family == RTL8390_FAMILY_ID) {
-		/* RTL8390: Enable external gpio in global led control register */
-		sw_w32_mask(0x7 << 18, 0x4 << 18, RTL839X_LED_GLB_CTRL);
-	} else if (soc_info.family == RTL8380_FAMILY_ID) {
-		/* RTL8380: Enable RTL8231 indirect access mode */
-		sw_w32_mask(0, 1, RTL838X_EXTRA_GPIO_CTRL);
-		sw_w32_mask(3, 1, RTL838X_DMY_REG5);
-	}
-
-	ret = rtl8231_read(gpios, RTL8231_LED_FUNC1);
-	if ((ret & 0x80000000) || ((ret & RTL8231_READY_MASK) != RTL8231_READY_VALUE))
-		return -ENXIO;
-
-	/* Select GPIO functionality and force input direction for pins 0-36 */
-	rtl8231_write(gpios, RTL8231_GPIO_PIN_SEL(0), 0xffff);
-	rtl8231_write(gpios, RTL8231_GPIO_DIR(0), 0xffff);
-	rtl8231_write(gpios, RTL8231_GPIO_PIN_SEL(16), 0xffff);
-	rtl8231_write(gpios, RTL8231_GPIO_DIR(16), 0xffff);
-	rtl8231_write(gpios, RTL8231_GPIO_PIN_SEL(32), 0x03ff);
-
-	/* Set LED_Start to enable drivers for output mode */
-	rtl8231_write(gpios, RTL8231_LED_FUNC0, 1 << 1);
-
-	return 0;
-}
-
-static const struct of_device_id rtl8231_gpio_of_match[] = {
-	{ .compatible = "realtek,rtl8231-gpio" },
-	{},
-};
-
-MODULE_DEVICE_TABLE(of, rtl8231_gpio_of_match);
-
-static int rtl8231_gpio_probe(struct platform_device *pdev)
-{
-	struct device *dev = &pdev->dev;
-	struct device_node *np = dev->of_node;
-	struct rtl8231_gpios *gpios;
-	int err;
-
-	pr_info("Probing RTL8231 GPIOs\n");
-
-	if (!np) {
-		dev_err(&pdev->dev, "No DT found\n");
-		return -EINVAL;
-	}
-
-	gpios = devm_kzalloc(dev, sizeof(*gpios), GFP_KERNEL);
-	if (!gpios)
-		return -ENOMEM;
-
-	gpios->id = soc_info.id;
-	if (soc_info.family == RTL8380_FAMILY_ID) {
-		gpios->ext_gpio_indrt_access = RTL838X_EXT_GPIO_INDRT_ACCESS;
-	}
-
-	if (soc_info.family == RTL8390_FAMILY_ID) {
-		gpios->ext_gpio_indrt_access = RTL839X_EXT_GPIO_INDRT_ACCESS;
-	}
-
-	err = of_property_read_u32(np, "indirect-access-bus-id", &gpios->smi_bus_id);
-	if (!err && gpios->smi_bus_id > RTL8231_SMI_BUS_ID_MAX)
-		err = -EINVAL;
-
-	if (err) {
-		dev_err(dev, "invalid or missing indirect-access-bus-id\n");
-		return err;
-	}
-
-	err = rtl8231_init(gpios);
-	if (err) {
-		dev_err(dev, "no device found at bus address %d\n", gpios->smi_bus_id);
-		return err;
-	}
-
-	gpios->dev = dev;
-	gpios->gc.base = -1;
-	gpios->gc.ngpio = 37;
-	gpios->gc.label = "rtl8231";
-	gpios->gc.parent = dev;
-	gpios->gc.owner = THIS_MODULE;
-	gpios->gc.can_sleep = true;
-
-	gpios->gc.direction_input = rtl8231_direction_input;
-	gpios->gc.direction_output = rtl8231_direction_output;
-	gpios->gc.set = rtl8231_gpio_set;
-	gpios->gc.get = rtl8231_gpio_get;
-	gpios->gc.get_direction = rtl8231_get_direction;
-
-	return devm_gpiochip_add_data(dev, &gpios->gc, gpios);
-}
-
-static struct platform_driver rtl8231_gpio_driver = {
-	.driver = {
-		.name = "rtl8231-gpio",
-		.of_match_table	= rtl8231_gpio_of_match,
-	},
-	.probe = rtl8231_gpio_probe,
-};
-
-module_platform_driver(rtl8231_gpio_driver);
-
-MODULE_DESCRIPTION("Realtek RTL8231 GPIO expansion chip support");
-MODULE_LICENSE("GPL v2");
diff --git a/target/linux/realtek/files-6.6/drivers/net/dsa/rtl83xx/Kconfig b/target/linux/realtek/files-6.6/drivers/net/dsa/rtl83xx/Kconfig
index 3124ee8d20c219..0af4abcfb9cbd2 100644
--- a/target/linux/realtek/files-6.6/drivers/net/dsa/rtl83xx/Kconfig
+++ b/target/linux/realtek/files-6.6/drivers/net/dsa/rtl83xx/Kconfig
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0-only
 config NET_DSA_RTL83XX
 	tristate "Realtek RTL838x/RTL839x switch support"
-	depends on RTL83XX
+	depends on MACH_REALTEK_RTL
 	select NET_DSA_TAG_TRAILER
 	help
 	  This driver adds support for Realtek RTL83xx series switching.
diff --git a/target/linux/realtek/files-6.6/drivers/net/dsa/rtl83xx/common.c b/target/linux/realtek/files-6.6/drivers/net/dsa/rtl83xx/common.c
index 5468fc0653ef51..805ed182c20769 100644
--- a/target/linux/realtek/files-6.6/drivers/net/dsa/rtl83xx/common.c
+++ b/target/linux/realtek/files-6.6/drivers/net/dsa/rtl83xx/common.c
@@ -271,6 +271,20 @@ int write_phy(u32 port, u32 page, u32 reg, u32 val)
 	return -1;
 }
 
+static int rtldsa_mdio_read(struct mii_bus *bus, int addr, int regnum)
+{
+	struct rtl838x_switch_priv *priv = bus->priv;
+
+	return mdiobus_read_nested(priv->parent_bus, addr, regnum);
+}
+
+static int rtldsa_mdio_write(struct mii_bus *bus, int addr, int regnum, u16 val)
+{
+	struct rtl838x_switch_priv *priv = bus->priv;
+
+	return mdiobus_write_nested(priv->parent_bus, addr, regnum, val);
+}
+
 static int __init rtl83xx_mdio_probe(struct rtl838x_switch_priv *priv)
 {
 	struct device *dev = priv->dev;
@@ -288,8 +302,8 @@ static int __init rtl83xx_mdio_probe(struct rtl838x_switch_priv *priv)
 		return -ENODEV;
 	}
 
-	priv->mii_bus = of_mdio_find_bus(mii_np);
-	if (!priv->mii_bus) {
+	priv->parent_bus = of_mdio_find_bus(mii_np);
+	if (!priv->parent_bus) {
 		pr_debug("Deferring probe of mdio bus\n");
 		return -EPROBE_DEFER;
 	}
@@ -300,18 +314,14 @@ static int __init rtl83xx_mdio_probe(struct rtl838x_switch_priv *priv)
 	if (!bus)
 		return -ENOMEM;
 
-	bus->name = "rtl838x slave mii";
-
-	/* Since the NIC driver is loaded first, we can use the mdio rw functions
-	 * assigned there.
-	 */
-	bus->read = priv->mii_bus->read;
-	bus->write = priv->mii_bus->write;
+	bus->name = "rtldsa_mdio";
+	bus->read = rtldsa_mdio_read;
+	bus->write = rtldsa_mdio_write;
 	snprintf(bus->id, MII_BUS_ID_SIZE, "%s-%d", bus->name, dev->id);
 
 	bus->parent = dev;
 	priv->ds->slave_mii_bus = bus;
-	priv->ds->slave_mii_bus->priv = priv->mii_bus->priv;
+	priv->ds->slave_mii_bus->priv = priv;
 
 	ret = mdiobus_register(priv->ds->slave_mii_bus);
 	if (ret && mii_np) {
@@ -1492,7 +1502,9 @@ static int __init rtl83xx_sw_probe(struct platform_device *pdev)
 	priv->ds->needs_standalone_vlan_filtering = true;
 	priv->dev = dev;
 
-	mutex_init(&priv->reg_mutex);
+	err = devm_mutex_init(dev, &priv->reg_mutex);
+	if (err)
+		return err;
 
 	priv->family_id = soc_info.family;
 	priv->id = soc_info.id;
diff --git a/target/linux/realtek/files-6.6/drivers/net/dsa/rtl83xx/dsa.c b/target/linux/realtek/files-6.6/drivers/net/dsa/rtl83xx/dsa.c
index f9d37fb3bd2f98..b47a2f075eecd6 100644
--- a/target/linux/realtek/files-6.6/drivers/net/dsa/rtl83xx/dsa.c
+++ b/target/linux/realtek/files-6.6/drivers/net/dsa/rtl83xx/dsa.c
@@ -797,10 +797,6 @@ static void rtl93xx_phylink_mac_config(struct dsa_switch *ds, int port,
 {
 	struct rtl838x_switch_priv *priv = ds->priv;
 	int sds_num;
-	u32 reg;
-
-	pr_info("%s port %d, mode %x, phy-mode: %s, speed %d, link %d\n", __func__,
-		port, mode, phy_modes(state->interface), state->speed, state->link);
 
 	/* Nothing to be done for the CPU-port */
 	if (port == priv->cpu_port)
@@ -815,48 +811,6 @@ static void rtl93xx_phylink_mac_config(struct dsa_switch *ds, int port,
 	    (state->interface == PHY_INTERFACE_MODE_1000BASEX ||
 	     state->interface == PHY_INTERFACE_MODE_10GBASER))
 		rtl9300_serdes_setup(port, sds_num, state->interface);
-
-	reg = sw_r32(priv->r->mac_force_mode_ctrl(port));
-	reg &= ~(0xf << 3);
-
-	switch (state->speed) {
-	case SPEED_10000:
-		reg |= 4 << 3;
-		break;
-	case SPEED_5000:
-		reg |= 6 << 3;
-		break;
-	case SPEED_2500:
-		reg |= 5 << 3;
-		break;
-	case SPEED_1000:
-		reg |= 2 << 3;
-		break;
-	case SPEED_100:
-		reg |= 1 << 3;
-		break;
-	default:
-		/* Also covers 10M */
-		break;
-	}
-
-	if (state->link)
-		reg |= RTL930X_FORCE_LINK_EN;
-
-	if (priv->lagmembers & BIT_ULL(port))
-		reg |= RTL930X_DUPLEX_MODE | RTL930X_FORCE_LINK_EN;
-
-	if (state->duplex == DUPLEX_FULL)
-		reg |= RTL930X_DUPLEX_MODE;
-	else
-		reg &= ~RTL930X_DUPLEX_MODE; /* Clear duplex bit otherwise */
-
-	if (priv->ports[port].phy_is_integrated)
-		reg &= ~RTL930X_FORCE_EN; /* Clear MAC_FORCE_EN to allow SDS-MAC link */
-	else
-		reg |= RTL930X_FORCE_EN;
-
-	sw_w32(reg, priv->r->mac_force_mode_ctrl(port));
 }
 
 static void rtl83xx_phylink_mac_link_down(struct dsa_switch *ds, int port,
@@ -962,11 +916,49 @@ static void rtl93xx_phylink_mac_link_up(struct dsa_switch *ds, int port,
 				   int speed, int duplex,
 				   bool tx_pause, bool rx_pause)
 {
+	struct dsa_port *dp = dsa_to_port(ds, port);
 	struct rtl838x_switch_priv *priv = ds->priv;
+	u32 mcr, spdsel;
+
+	if (speed == SPEED_10000)
+		spdsel = RTL_SPEED_10000;
+	else if (speed == SPEED_5000)
+		spdsel = RTL_SPEED_5000;
+	else if (speed == SPEED_2500)
+		spdsel = RTL_SPEED_2500;
+	else if (speed == SPEED_1000)
+		spdsel = RTL_SPEED_1000;
+	else if (speed == SPEED_100)
+		spdsel = RTL_SPEED_100;
+	else
+		spdsel = RTL_SPEED_10;
+
+	mcr = sw_r32(priv->r->mac_force_mode_ctrl(port));
+
+	if (priv->family_id == RTL9300_FAMILY_ID) {
+		mcr &= ~RTL930X_RX_PAUSE_EN;
+		mcr &= ~RTL930X_TX_PAUSE_EN;
+		mcr &= ~RTL930X_DUPLEX_MODE;
+		mcr &= ~RTL930X_SPEED_MASK;
+		mcr |= RTL930X_FORCE_LINK_EN;
+		mcr |= spdsel << RTL930X_SPEED_SHIFT;
+
+		if (tx_pause)
+			mcr |= RTL930X_TX_PAUSE_EN;
+		if (rx_pause)
+			mcr |= RTL930X_RX_PAUSE_EN;
+		if (duplex == DUPLEX_FULL || priv->lagmembers & BIT_ULL(port))
+			mcr |= RTL930X_DUPLEX_MODE;
+		if (dsa_port_is_cpu(dp) || !priv->ports[port].phy_is_integrated)
+			mcr |= RTL930X_FORCE_EN;
+	}
+
+	pr_debug("%s port %d, mode %x, speed %d, duplex %d, txpause %d, rxpause %d: set mcr=%08x\n",
+		__func__, port, mode, speed, duplex, tx_pause, rx_pause, mcr);
+	sw_w32(mcr, priv->r->mac_force_mode_ctrl(port));
 
 	/* Restart TX/RX to port */
 	sw_w32_mask(0, 0x3, priv->r->mac_port_ctrl(port));
-	/* TODO: Set speed/duplex/pauses */
 }
 
 static void rtl83xx_get_strings(struct dsa_switch *ds,
diff --git a/target/linux/realtek/files-6.6/drivers/net/dsa/rtl83xx/rtl838x.h b/target/linux/realtek/files-6.6/drivers/net/dsa/rtl83xx/rtl838x.h
index 13a0bb5ffa394f..c721b4d0705ea4 100644
--- a/target/linux/realtek/files-6.6/drivers/net/dsa/rtl83xx/rtl838x.h
+++ b/target/linux/realtek/files-6.6/drivers/net/dsa/rtl83xx/rtl838x.h
@@ -147,6 +147,9 @@
 #define RTL_SPEED_10				0
 #define RTL_SPEED_100				1
 #define RTL_SPEED_1000				2
+#define RTL_SPEED_2500				5
+#define RTL_SPEED_5000				6
+#define RTL_SPEED_10000				4
 
 #define RTL83XX_FORCE_EN			(1 << 0)
 #define RTL83XX_FORCE_LINK_EN			(1 << 1)
@@ -169,6 +172,8 @@
 #define RTL930X_FORCE_EN			(1 << 0)
 #define RTL930X_FORCE_LINK_EN			(1 << 1)
 #define RTL930X_DUPLEX_MODE			(1 << 2)
+#define RTL930X_SPEED_SHIFT			(3)
+#define RTL930X_SPEED_MASK			(15 << RTL930X_SPEED_SHIFT)
 #define RTL930X_TX_PAUSE_EN			(1 << 7)
 #define RTL930X_RX_PAUSE_EN			(1 << 8)
 #define RTL930X_MAC_FORCE_FC_EN			(1 << 9)
@@ -1076,7 +1081,7 @@ struct rtl838x_switch_priv {
 	struct mutex pie_mutex;		/* Mutex for Packet Inspection Engine */
 	int link_state_irq;
 	int mirror_group_ports[4];
-	struct mii_bus *mii_bus;
+	struct mii_bus *parent_bus;
 	const struct rtl838x_reg *r;
 	u8 cpu_port;
 	u8 port_mask;
diff --git a/target/linux/realtek/files-6.6/drivers/net/ethernet/rtl838x_eth.c b/target/linux/realtek/files-6.6/drivers/net/ethernet/rtl838x_eth.c
index 4b79090696e341..d1d81e7845ce64 100644
--- a/target/linux/realtek/files-6.6/drivers/net/ethernet/rtl838x_eth.c
+++ b/target/linux/realtek/files-6.6/drivers/net/ethernet/rtl838x_eth.c
@@ -433,53 +433,29 @@ static void rtl839x_l2_notification_handler(struct rtl838x_eth_priv *priv)
 
 static irqreturn_t rtl83xx_net_irq(int irq, void *dev_id)
 {
-	struct net_device *dev = dev_id;
-	struct rtl838x_eth_priv *priv = netdev_priv(dev);
+	struct net_device *ndev = dev_id;
+	struct rtl838x_eth_priv *priv = netdev_priv(ndev);
 	u32 status = sw_r32(priv->r->dma_if_intr_sts);
+	unsigned long ring, rings;
 
-	pr_debug("IRQ: %08x\n", status);
+	netdev_dbg(ndev, "rx interrupt received, status %08x\n", status);
 
-	/*  Ignore TX interrupt */
-	if ((status & 0xf0000)) {
-		/* Clear ISR */
-		sw_w32(0x000f0000, priv->r->dma_if_intr_sts);
-	}
+	if (status & RTL83XX_DMA_IF_INTR_RX_RUN_OUT_MASK)
+		if (net_ratelimit())
+			netdev_warn(ndev, "rx ring overrun, status 0x%08x, mask 0x%08x\n",
+				    status, sw_r32(priv->r->dma_if_intr_msk));
 
-	/* RX interrupt */
-	if (status & 0x0ff00) {
-		/* ACK and disable RX interrupt for this ring */
-		sw_w32_mask(0xff00 & status, 0, priv->r->dma_if_intr_msk);
-		sw_w32(0x0000ff00 & status, priv->r->dma_if_intr_sts);
-		for (int i = 0; i < priv->rxrings; i++) {
-			if (status & BIT(i + 8)) {
-				pr_debug("Scheduling queue: %d\n", i);
-				napi_schedule(&priv->rx_qs[i].napi);
-			}
-		}
+	rings = FIELD_GET(RTL83XX_DMA_IF_INTR_RX_DONE_MASK, status);
+	for_each_set_bit(ring, &rings, priv->rxrings) {
+		netdev_dbg(ndev, "schedule rx ring %lu\n", ring);
+		sw_w32_mask(RTL83XX_DMA_IF_INTR_RX_MASK(ring), 0, priv->r->dma_if_intr_msk);
+		napi_schedule(&priv->rx_qs[ring].napi);
 	}
 
-	/* RX buffer overrun */
-	if (status & 0x000ff) {
-		pr_debug("RX buffer overrun: status %x, mask: %x\n",
-			 status, sw_r32(priv->r->dma_if_intr_msk));
-		sw_w32(status, priv->r->dma_if_intr_sts);
-		rtl838x_rb_cleanup(priv, status & 0xff);
-	}
-
-	if (priv->family_id == RTL8390_FAMILY_ID && status & 0x00100000) {
-		sw_w32(0x00100000, priv->r->dma_if_intr_sts);
+	if (status & RTL839X_DMA_IF_INTR_NOTIFY_MASK)
 		rtl839x_l2_notification_handler(priv);
-	}
 
-	if (priv->family_id == RTL8390_FAMILY_ID && status & 0x00200000) {
-		sw_w32(0x00200000, priv->r->dma_if_intr_sts);
-		rtl839x_l2_notification_handler(priv);
-	}
-
-	if (priv->family_id == RTL8390_FAMILY_ID && status & 0x00400000) {
-		sw_w32(0x00400000, priv->r->dma_if_intr_sts);
-		rtl839x_l2_notification_handler(priv);
-	}
+	sw_w32(status, priv->r->dma_if_intr_sts);
 
 	return IRQ_HANDLED;
 }
@@ -1358,25 +1334,22 @@ static int rtl838x_poll_rx(struct napi_struct *napi, int budget)
 {
 	struct rtl838x_rx_q *rx_q = container_of(napi, struct rtl838x_rx_q, napi);
 	struct rtl838x_eth_priv *priv = rx_q->priv;
+	int ring = rx_q->id;
 	int work_done = 0;
-	int r = rx_q->id;
-	int work;
 
 	while (work_done < budget) {
-		work = rtl838x_hw_receive(priv->netdev, r, budget - work_done);
+		int work = rtl838x_hw_receive(priv->netdev, ring, budget - work_done);
 		if (!work)
 			break;
 		work_done += work;
 	}
 
-	if (work_done < budget) {
-		napi_complete_done(napi, work_done);
-
-		/* Enable RX interrupt */
+	if (work_done < budget && napi_complete_done(napi, work_done)) {
+		/* Re-enable rx interrupts */
 		if (priv->family_id == RTL9300_FAMILY_ID || priv->family_id == RTL9310_FAMILY_ID)
 			sw_w32(0xffffffff, priv->r->dma_if_intr_rx_done_msk);
 		else
-			sw_w32_mask(0, 0xf00ff | BIT(r + 8), priv->r->dma_if_intr_msk);
+			sw_w32_mask(0, RTL83XX_DMA_IF_INTR_RX_MASK(ring), priv->r->dma_if_intr_msk);
 	}
 
 	return work_done;
diff --git a/target/linux/realtek/files-6.6/drivers/net/ethernet/rtl838x_eth.h b/target/linux/realtek/files-6.6/drivers/net/ethernet/rtl838x_eth.h
index d6d88fc2ed01b8..65684017c46ca6 100644
--- a/target/linux/realtek/files-6.6/drivers/net/ethernet/rtl838x_eth.h
+++ b/target/linux/realtek/files-6.6/drivers/net/ethernet/rtl838x_eth.h
@@ -48,6 +48,11 @@
 #define RTL930X_MAC_FORCE_MODE_CTRL		(0xCA1C)
 #define RTL931X_MAC_FORCE_MODE_CTRL		(0x0ddc)
 
+#define RTL839X_DMA_IF_INTR_NOTIFY_MASK		GENMASK(22, 20)
+#define RTL83XX_DMA_IF_INTR_RX_DONE_MASK	GENMASK(15, 8)
+#define RTL83XX_DMA_IF_INTR_RX_RUN_OUT_MASK	GENMASK(7, 0)
+#define RTL83XX_DMA_IF_INTR_RX_MASK(ring)	(BIT(ring) | BIT(ring + 8))
+
 /* MAC address settings */
 #define RTL838X_MAC				(0xa9ec)
 #define RTL839X_MAC				(0x02b4)
diff --git a/target/linux/realtek/files-6.6/drivers/net/phy/rtl83xx-phy.c b/target/linux/realtek/files-6.6/drivers/net/phy/rtl83xx-phy.c
index 09c6ca3b2cb130..fadd88c513a83c 100644
--- a/target/linux/realtek/files-6.6/drivers/net/phy/rtl83xx-phy.c
+++ b/target/linux/realtek/files-6.6/drivers/net/phy/rtl83xx-phy.c
@@ -1124,6 +1124,52 @@ static int rtl8214fc_get_port(struct phy_device *phydev)
 	return PORT_MII;
 }
 
+static int rtl8214fc_get_features(struct phy_device *phydev)
+{
+	int ret = 0;
+
+	ret = genphy_read_abilities(phydev);
+	if (ret)
+		return ret;
+	/*
+	 * The RTL8214FC only advertises TP capabilities in the standard registers. This is
+	 * independent from what fibre/copper combination is currently activated. For now just
+	 * announce the superset of all possible features.
+	 */
+	linkmode_set_bit(ETHTOOL_LINK_MODE_1000baseX_Full_BIT, phydev->supported);
+	linkmode_set_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, phydev->supported);
+
+	return 0;
+}
+
+static int rtl8214fc_read_status(struct phy_device *phydev)
+{
+	bool changed;
+	int ret;
+
+	if (rtl8214fc_media_is_fibre(phydev)) {
+		phydev->port = PORT_FIBRE;
+		ret = genphy_c37_read_status(phydev, &changed);
+	} else {
+		phydev->port = PORT_MII; /* for now aligend with rest of code */
+		ret = genphy_read_status(phydev);
+	}
+
+	return ret;
+}
+
+static int rtl8214fc_config_aneg(struct phy_device *phydev)
+{
+	int ret;
+
+	if (rtl8214fc_media_is_fibre(phydev))
+		ret = genphy_c37_config_aneg(phydev);
+	else
+		ret = genphy_config_aneg(phydev);
+
+	return ret;
+}
+
 /* Enable EEE on the RTL8218B PHYs
  * The method used is not the preferred way (which would be based on the MAC-EEE state,
  * but the only way that works since the kernel first enables EEE in the MAC
@@ -3699,7 +3745,15 @@ int rtl931x_link_sts_get(u32 sds)
 
 static int rtl8214fc_sfp_insert(void *upstream, const struct sfp_eeprom_id *id)
 {
+	__ETHTOOL_DECLARE_LINK_MODE_MASK(support) = { 0, };
+	DECLARE_PHY_INTERFACE_MASK(interfaces);
 	struct phy_device *phydev = upstream;
+	phy_interface_t iface;
+
+	sfp_parse_support(phydev->sfp_bus, id, support, interfaces);
+	iface = sfp_select_interface(phydev->sfp_bus, support);
+
+	dev_info(&phydev->mdio.dev, "%s SFP module inserted\n", phy_modes(iface));
 
 	rtl8214fc_media_set(phydev, true);
 
@@ -3903,17 +3957,18 @@ static struct phy_driver rtl83xx_phy_driver[] = {
 	{
 		.match_phy_device = rtl8214fc_match_phy_device,
 		.name		= "Realtek RTL8214FC",
-		.features	= PHY_GBIT_FIBRE_FEATURES,
+		.config_aneg	= rtl8214fc_config_aneg,
+		.get_eee	= rtl8214fc_get_eee,
+		.get_features	= rtl8214fc_get_features,
+		.get_port	= rtl8214fc_get_port,
 		.probe		= rtl8214fc_phy_probe,
 		.read_page	= rtl821x_read_page,
-		.write_page	= rtl821x_write_page,
-		.suspend	= rtl8214fc_suspend,
+		.read_status    = rtl8214fc_read_status,
 		.resume		= rtl8214fc_resume,
-		.set_loopback	= genphy_loopback,
-		.set_port	= rtl8214fc_set_port,
-		.get_port	= rtl8214fc_get_port,
 		.set_eee	= rtl8214fc_set_eee,
-		.get_eee	= rtl8214fc_get_eee,
+		.set_port	= rtl8214fc_set_port,
+		.suspend	= rtl8214fc_suspend,
+		.write_page	= rtl821x_write_page,
 	},
 	{
 		.match_phy_device = rtl8218b_ext_match_phy_device,
diff --git a/target/linux/realtek/image/common.mk b/target/linux/realtek/image/common.mk
index 27fcea86ece99b..e600b2347d71fc 100644
--- a/target/linux/realtek/image/common.mk
+++ b/target/linux/realtek/image/common.mk
@@ -56,14 +56,26 @@ define Device/hpe_1920
 	append-metadata
 endef
 
+define Device/hwmon-fan-migration
+  DEVICE_COMPAT_VERSION := 1.1
+  DEVICE_COMPAT_MESSAGE := Fan control switched to hwmon. Your fans will retain \
+	bootloader speed unless another control scheme is in place. \
+	Config cannot be kept due to conflict in gpio_switch config 'fan_ctrl' under \
+	/etc/config/system.
+endef
+
 define Device/zyxel_gs1900
+  DEVICE_COMPAT_VERSION := 2.0
+  DEVICE_COMPAT_MESSAGE := Dual firmware paritition merged due to size constraints. \
+	Upgrade requires a new factory install. Regular sysupgrade is not possible.
   DEVICE_VENDOR := Zyxel
-  IMAGE_SIZE := 6976k
+  IMAGE_SIZE := 13952k
   UIMAGE_MAGIC := 0x83800000
   KERNEL_INITRAMFS := \
 	kernel-bin | \
 	append-dtb | \
 	libdeflate-gzip | \
 	zyxel-vers | \
-	uImage gzip
+	uImage gzip | \
+	check-size 6976k
 endef
diff --git a/target/linux/realtek/image/rtl838x.mk b/target/linux/realtek/image/rtl838x.mk
index 01397af9310c74..3763418233e829 100644
--- a/target/linux/realtek/image/rtl838x.mk
+++ b/target/linux/realtek/image/rtl838x.mk
@@ -120,11 +120,12 @@ TARGET_DEVICES += hpe_1920-8g-poe-65w
 
 define Device/hpe_1920-8g-poe-180w
   $(Device/hpe_1920)
+  $(Device/hwmon-fan-migration)
   SOC := rtl8380
   DEVICE_MODEL := 1920-8G-PoE+ 180W (JG922A)
-  DEVICE_PACKAGES += realtek-poe
+  DEVICE_PACKAGES += realtek-poe kmod-hwmon-gpiofan
   H3C_DEVICE_ID := 0x00010025
-  SUPPORTED_DEVICES += hpe_1920-8g-poe
+  SUPPORTED_DEVICES += hpe,1920-8g-poe
 endef
 TARGET_DEVICES += hpe_1920-8g-poe-180w
 
@@ -144,6 +145,26 @@ define Device/hpe_1920-24g
 endef
 TARGET_DEVICES += hpe_1920-24g
 
+define Device/hpe_1920-24g-poe-180w
+  $(Device/hpe_1920)
+  $(Device/hwmon-fan-migration)
+  SOC := rtl8382
+  DEVICE_MODEL := 1920-24G-PoE+ 180W (JG925A)
+  DEVICE_PACKAGES += realtek-poe kmod-hwmon-gpiofan
+  H3C_DEVICE_ID := 0x00010028
+endef
+TARGET_DEVICES += hpe_1920-24g-poe-180w
+
+define Device/hpe_1920-24g-poe-370w
+  $(Device/hpe_1920)
+  $(Device/hwmon-fan-migration)
+  SOC := rtl8382
+  DEVICE_MODEL := 1920-24G-PoE+ 370W (JG926A)
+  DEVICE_PACKAGES += realtek-poe kmod-hwmon-gpiofan
+  H3C_DEVICE_ID := 0x00010029
+endef
+TARGET_DEVICES += hpe_1920-24g-poe-370w
+
 define Device/inaba_aml2-17gp
   SOC := rtl8382
   IMAGE_SIZE := 13504k
@@ -339,17 +360,25 @@ define Device/zyxel_gs1900-16
 endef
 TARGET_DEVICES += zyxel_gs1900-16
 
-define Device/zyxel_gs1900-8
+define Device/zyxel_gs1900-8-v1
   $(Device/zyxel_gs1900)
   SOC := rtl8380
   DEVICE_MODEL := GS1900-8
   DEVICE_VARIANT := v1
-  DEVICE_ALT0_VENDOR := Zyxel
-  DEVICE_ALT0_MODEL := GS1900-8
-  DEVICE_ALT0_VARIANT := v2
   ZYXEL_VERS := AAHH
+  SUPPORTED_DEVICES += zyxel,gs1900-8
+endef
+TARGET_DEVICES += zyxel_gs1900-8-v1
+
+define Device/zyxel_gs1900-8-v2
+  $(Device/zyxel_gs1900)
+  SOC := rtl8380
+  DEVICE_MODEL := GS1900-8
+  DEVICE_VARIANT := v2
+  ZYXEL_VERS := AAHH
+  SUPPORTED_DEVICES += zyxel,gs1900-8
 endef
-TARGET_DEVICES += zyxel_gs1900-8
+TARGET_DEVICES += zyxel_gs1900-8-v2
 
 define Device/zyxel_gs1900-8hp-v1
   $(Device/zyxel_gs1900)
diff --git a/target/linux/realtek/image/rtl839x.mk b/target/linux/realtek/image/rtl839x.mk
index 14d23ff371003c..5f9b6d56c65de1 100644
--- a/target/linux/realtek/image/rtl839x.mk
+++ b/target/linux/realtek/image/rtl839x.mk
@@ -21,7 +21,7 @@ define Device/hpe_1920-48g-poe
   $(Device/hpe_1920)
   SOC := rtl8393
   DEVICE_MODEL := 1920-48G-PoE (JG928A)
-  DEVICE_PACKAGES += realtek-poe
+  DEVICE_PACKAGES += realtek-poe kmod-hwmon-gpiofan
   H3C_DEVICE_ID := 0x0001002b
 endef
 TARGET_DEVICES += hpe_1920-48g-poe
diff --git a/target/linux/realtek/patches-6.6/300-mips-add-rtl838x-platform.patch b/target/linux/realtek/patches-6.6/300-mips-add-rtl838x-platform.patch
index 7adbbbc517431b..bb89a7864fe49a 100644
--- a/target/linux/realtek/patches-6.6/300-mips-add-rtl838x-platform.patch
+++ b/target/linux/realtek/patches-6.6/300-mips-add-rtl838x-platform.patch
@@ -9,64 +9,67 @@ configurations for the SoCs, which are introduced in addition.
 
 Submitted-by: Birger Koblitz <git@birger-koblitz.de>
 ---
- arch/mips/Kbuild.platforms                    |  1 +
- arch/mips/Kconfig                             | 57 ++++++++++++++
- 2 files changed, 58 insertions(+)
-
 --- a/arch/mips/Kbuild.platforms
 +++ b/arch/mips/Kbuild.platforms
 @@ -22,6 +22,7 @@ platform-$(CONFIG_MACH_NINTENDO64)	+= n6
  platform-$(CONFIG_PIC32MZDA)		+= pic32/
  platform-$(CONFIG_RALINK)		+= ralink/
  platform-$(CONFIG_MIKROTIK_RB532)	+= rb532/
-+platform-$(CONFIG_RTL83XX)		+= rtl838x/
++platform-$(CONFIG_MACH_REALTEK_RTL)	+= rtl838x/
  platform-$(CONFIG_SGI_IP22)		+= sgi-ip22/
  platform-$(CONFIG_SGI_IP27)		+= sgi-ip27/
  platform-$(CONFIG_SGI_IP28)		+= sgi-ip22/
 --- a/arch/mips/Kconfig
 +++ b/arch/mips/Kconfig
-@@ -968,8 +968,58 @@ config CAVIUM_OCTEON_SOC
- 		Hikari
- 	  Say Y here for most Octeon reference boards.
+@@ -620,21 +620,23 @@ config RALINK
  
-+config RTL83XX
-+	bool "Realtek based platforms"
-+	select DMA_NONCOHERENT
-+	select IRQ_MIPS_CPU
+ config MACH_REALTEK_RTL
+ 	bool "Realtek RTL838x/RTL839x based machines"
+-	select MIPS_GENERIC
+ 	select DMA_NONCOHERENT
+ 	select IRQ_MIPS_CPU
+-	select CSRC_R4K
+-	select CEVT_R4K
+ 	select SYS_HAS_CPU_MIPS32_R1
+ 	select SYS_HAS_CPU_MIPS32_R2
+ 	select SYS_SUPPORTS_BIG_ENDIAN
+ 	select SYS_SUPPORTS_32BIT_KERNEL
+ 	select SYS_SUPPORTS_MIPS16
+-	select SYS_SUPPORTS_MULTITHREADING
+-	select SYS_SUPPORTS_VPE_LOADER
+ 	select BOOT_RAW
+ 	select PINCTRL
+ 	select USE_OF
 +	select NO_EXCEPT_FILL
-+	select SYS_HAS_CPU_MIPS32_R1
-+	select SYS_HAS_CPU_MIPS32_R2
-+	select SYS_SUPPORTS_BIG_ENDIAN
 +	select SYS_SUPPORTS_HIGHMEM
-+	select SYS_SUPPORTS_32BIT_KERNEL
-+	select SYS_SUPPORTS_MIPS16
 +	select SYS_HAS_EARLY_PRINTK
 +	select SYS_HAS_EARLY_PRINTK_8250
 +	select USE_GENERIC_EARLY_PRINTK_8250
-+	select BOOT_RAW
-+	select PINCTRL
 +	select ARCH_HAS_RESET_CONTROLLER
 +	select RESET_CONTROLLER
-+	select USE_OF
-+
+ 
+ config SGI_IP22
+ 	bool "SGI IP22 (Indy/Indigo2)"
+@@ -970,6 +972,36 @@ config CAVIUM_OCTEON_SOC
+ 
  endchoice
  
 +config RTL838X
 +	bool "Realtek RTL838X based platforms"
-+	depends on RTL83XX
++	depends on MACH_REALTEK_RTL
 +	select CPU_SUPPORTS_CPUFREQ
 +	select MIPS_EXTERNAL_TIMER
 +
 +config RTL839X
 +	bool "Realtek RTL839X based platforms"
-+	depends on RTL83XX
++	depends on MACH_REALTEK_RTL
 +	select CPU_SUPPORTS_CPUFREQ
 +	select MIPS_EXTERNAL_TIMER
 +	select SYS_SUPPORTS_MULTITHREADING
 +
 +config RTL930X
 +	bool "Realtek RTL930X based platforms"
-+	depends on RTL83XX
++	depends on MACH_REALTEK_RTL
 +	select MIPS_CPU_SCACHE
 +	select MIPS_EXTERNAL_TIMER
 +	select SYS_SUPPORTS_MULTITHREADING
diff --git a/target/linux/realtek/patches-6.6/301-gpio-add-rtl8231-driver.patch b/target/linux/realtek/patches-6.6/301-gpio-add-rtl8231-driver.patch
deleted file mode 100644
index a1778764206d12..00000000000000
--- a/target/linux/realtek/patches-6.6/301-gpio-add-rtl8231-driver.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-From 2b88563ee5aafd9571d965b7f2093a0f58d98a31 Mon Sep 17 00:00:00 2001
-From: John Crispin <john@phrozen.org>
-Date: Thu, 26 Nov 2020 12:02:21 +0100
-Subject: [PATCH] realtek: update the tree to the latest refactored version
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-* rename the target to realtek
-* add refactored DSA driver
-* add latest gpio driver
-* lots of arch cleanups
-* new irq driver
-* additional boards
-
-Submitted-by: Bert Vermeulen <bert@biot.com>
-Submitted-by: Birger Koblitz <mail@birger-koblitz.de>
-Submitted-by: Sander Vanheule <sander@svanheule.net>
-Submitted-by: Bjørn Mork <bjorn@mork.no>
-Submitted-by: John Crispin <john@phrozen.org>
----
- drivers/gpio/Kconfig                          |    6 ++++++
- drivers/gpio/Makefile                         |    1 +
- 2 files changed, 7 insertions(+)
-
---- a/drivers/gpio/Kconfig
-+++ b/drivers/gpio/Kconfig
-@@ -553,6 +553,12 @@ config GPIO_ROCKCHIP
- 	help
- 	  Say yes here to support GPIO on Rockchip SoCs.
- 
-+config GPIO_RTL8231
-+	tristate "RTL8231 GPIO"
-+	depends on RTL83XX
-+	help
-+	  Say yes here to support Realtek RTL8231 GPIO expansion chips.
-+
- config GPIO_SAMA5D2_PIOBU
- 	tristate "SAMA5D2 PIOBU GPIO support"
- 	depends on MFD_SYSCON
---- a/drivers/gpio/Makefile
-+++ b/drivers/gpio/Makefile
-@@ -138,6 +138,7 @@ obj-$(CONFIG_GPIO_RDC321X)		+= gpio-rdc3
- obj-$(CONFIG_GPIO_REALTEK_OTTO)		+= gpio-realtek-otto.o
- obj-$(CONFIG_GPIO_REG)			+= gpio-reg.o
- obj-$(CONFIG_GPIO_ROCKCHIP)	+= gpio-rockchip.o
-+obj-$(CONFIG_GPIO_RTL8231)		+= gpio-rtl8231.o
- obj-$(CONFIG_ARCH_SA1100)		+= gpio-sa1100.o
- obj-$(CONFIG_GPIO_SAMA5D2_PIOBU)	+= gpio-sama5d2-piobu.o
- obj-$(CONFIG_GPIO_SCH311X)		+= gpio-sch311x.o
diff --git a/target/linux/realtek/patches-6.6/303-gpio-update-dependencies-for-gpio-realtek-otto.patch b/target/linux/realtek/patches-6.6/303-gpio-update-dependencies-for-gpio-realtek-otto.patch
deleted file mode 100644
index 2b466340e6343a..00000000000000
--- a/target/linux/realtek/patches-6.6/303-gpio-update-dependencies-for-gpio-realtek-otto.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 9bac1c20b8f39f2e0e342b087add5093b94feaed Mon Sep 17 00:00:00 2001
-From: INAGAKI Hiroshi <musashino.open@gmail.com>
-Date: Wed, 5 May 2021 22:05:39 +0900
-Subject: realtek: backport gpio-realtek-otto driver from 5.13 to 5.10
-
-This patch backports "gpio-realtek-otto" driver to Kernel 5.10.
-"MACH_REALTEK_RTL" is used as a platform name in upstream, but "RTL838X"
-is used in OpenWrt, so update the dependency by the additional patch.
-
-Submitted-by: INAGAKI Hiroshi <musashino.open@gmail.com>
----
- drivers/gpio/Kconfig                          |   4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
---- a/drivers/gpio/Kconfig
-+++ b/drivers/gpio/Kconfig
-@@ -527,8 +527,8 @@ config GPIO_RDA
- 
- config GPIO_REALTEK_OTTO
- 	tristate "Realtek Otto GPIO support"
--	depends on MACH_REALTEK_RTL
--	default MACH_REALTEK_RTL
-+	depends on RTL83XX
-+	default RTL838X
- 	select GPIO_GENERIC
- 	select GPIOLIB_IRQCHIP
- 	help
diff --git a/target/linux/realtek/patches-6.6/304-spi-update-dependency-for-spi-realtek-rtl.patch b/target/linux/realtek/patches-6.6/304-spi-update-dependency-for-spi-realtek-rtl.patch
deleted file mode 100644
index 01530257b857d9..00000000000000
--- a/target/linux/realtek/patches-6.6/304-spi-update-dependency-for-spi-realtek-rtl.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 0b000cbfe0aa0323bffa855ef8449c0687a4c071 Mon Sep 17 00:00:00 2001
-From: INAGAKI Hiroshi <musashino.open@gmail.com>
-Date: Thu, 6 May 2021 19:30:58 +0900
-Subject: realtek: backport spi-realtek-rtl driver from 5.12 to 5.10
-
-This patch backports "spi-realtek-rtl" driver to Kernel 5.10 from 5.12.
-"MACH_REALTEK_RTL" is used as a platform name in upstream, but "RTL838X"
-is used in OpenWrt, so update the dependency by the additional patch.
-
-Submitted-by: INAGAKI Hiroshi <musashino.open@gmail.com>
----
- drivers/spi/Makefile                          |  2 +-
- 1 files changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/spi/Makefile
-+++ b/drivers/spi/Makefile
-@@ -114,7 +114,7 @@ obj-$(CONFIG_SPI_QUP)			+= spi-qup.o
- obj-$(CONFIG_SPI_ROCKCHIP)		+= spi-rockchip.o
- obj-$(CONFIG_SPI_ROCKCHIP_SFC)		+= spi-rockchip-sfc.o
- obj-$(CONFIG_SPI_RB4XX)			+= spi-rb4xx.o
--obj-$(CONFIG_MACH_REALTEK_RTL)		+= spi-realtek-rtl.o
-+obj-$(CONFIG_RTL83XX)			+= spi-realtek-rtl.o
- obj-$(CONFIG_SPI_RPCIF)			+= spi-rpc-if.o
- obj-$(CONFIG_SPI_RSPI)			+= spi-rspi.o
- obj-$(CONFIG_SPI_RZV2M_CSI)		+= spi-rzv2m-csi.o
diff --git a/target/linux/realtek/patches-6.6/304-timer-otto-fix-stall-after-restart.patch b/target/linux/realtek/patches-6.6/304-timer-otto-fix-stall-after-restart.patch
new file mode 100644
index 00000000000000..0218f4efe913af
--- /dev/null
+++ b/target/linux/realtek/patches-6.6/304-timer-otto-fix-stall-after-restart.patch
@@ -0,0 +1,146 @@
+From: Markus Stockhausen <markus.stockhausen@gmx.de>
+Date: Sat, 19 Jul 2025 18:22:21 +0200
+Subject: [PATCH] realtek: fix stall after restart of otto timer
+
+With kernel 6.9 the kernel scheduler has been redesigned. This uncovered
+a bug in the realtek timer hardware and a misconception in the driver. 
+
+Regarding the driver: Software cannot set the current counter value to
+zero directly. This is automatically done when writing a new target value. 
+Drop function rttm_set_counter(). Additionally do not use stop timer
+during normal operation because it acknowledges interrupts. This should
+only be done from the interrupt handler. Replace this with disable_timer().
+
+Regarding the hardware: There is a minimal chance that a timer dies if it
+is reprogrammed within the 5us before its expiration time. Let's call this
+the "critical time window". Work around this issue by introducing a
+bounce() function. It restarts the timer directly before the normal
+restart functions as follows:
+
+- Stop timer
+- Restart timer with a slow frequency.
+- Target time will be >5us 
+- The subsequent normal restart will be outside the critical window
+
+While we are here clarify documentation and double the timer frequency to 
+6.25 Mhz. This allows for more detailed timestamps.
+
+Signed-off-by: Markus Stockhausen <markus.stockhausen@gmx.de>
+---
+
+--- a/drivers/clocksource/timer-rtl-otto.c
++++ b/drivers/clocksource/timer-rtl-otto.c
+@@ -20,12 +20,11 @@
+ 
+ /*
+  * The Otto platform provides multiple 28 bit timers/counters with the following
+- * operating logic. If enabled the timer counts up. Per timer one can set a
+- * maximum counter value as an end marker. If end marker is reached the timer
+- * fires an interrupt. If the timer "overflows" by reaching the end marker or
+- * by adding 1 to 0x0fffffff the counter is reset to 0. When this happens and
+- * the timer is in operating mode COUNTER it stops. In mode TIMER it will
+- * continue to count up.
++ * operating logic. If enabled the timer counts up. Per timer a counter target
++ * value can be set with the minimum being 0x2 and the maximumu being 0xfffffff.
++ * If the the target value is reached the timer is reset to 0. Depending on its
++ * configuration the timer will then fire an interrupt. In case the timer is in
++ * operating mode COUNTER it stops. In mode TIMER it will continue to count up.
+  */
+ #define RTTM_CTRL_COUNTER	0
+ #define RTTM_CTRL_TIMER		BIT(24)
+@@ -33,16 +32,15 @@
+ #define RTTM_BIT_COUNT		28
+ #define RTTM_MIN_DELTA		8
+ #define RTTM_MAX_DELTA		CLOCKSOURCE_MASK(28)
++#define RTTM_MAX_DIVISOR	GENMASK(15, 0)
+ 
+ /*
+- * Timers are derived from the LXB clock frequency. Usually this is a fixed
+- * multiple of the 25 MHz oscillator. The 930X SOC is an exception from that.
+- * Its LXB clock has only dividers and uses the switch PLL of 2.45 GHz as its
+- * base. The only meaningful frequencies we can achieve from that are 175.000
+- * MHz and 153.125 MHz. The greatest common divisor of all explained possible
+- * speeds is 3125000. Pin the timers to this 3.125 MHz reference frequency.
++ * Timers are derived from the lexra bus (LXB) clock frequency. This is 175 MHz
++ * on RTL930x and 200 MHz on the other platforms. With 6.25 MHz choose a common
++ * divisor to have enough range and detail. This even allows to compare the
++ * different platforms more easily.
+  */
+-#define RTTM_TICKS_PER_SEC	3125000
++#define RTTM_TICKS_PER_SEC	6250000
+ 
+ struct rttm_cs {
+ 	struct timer_of		to;
+@@ -50,11 +48,6 @@ struct rttm_cs {
+ };
+ 
+ /* Simple internal register functions */
+-static inline void rttm_set_counter(void __iomem *base, unsigned int counter)
+-{
+-	iowrite32(counter, base + RTTM_CNT);
+-}
+-
+ static inline unsigned int rttm_get_counter(void __iomem *base)
+ {
+ 	return ioread32(base + RTTM_CNT);
+@@ -107,6 +100,22 @@ static irqreturn_t rttm_timer_interrupt(
+ 	return IRQ_HANDLED;
+ }
+ 
++static void rttm_bounce_timer(void __iomem *base, u32 mode)
++{
++	/*
++	 * When a running timer has less than ~5us left, a stop/start sequence
++	 * might fail. While the details are unknown the most evident effect is 
++	 * that the subsequent interrupt will not be fired.
++	 *
++	 * As a workaround issue an intermediate restart with a very slow
++	 * frequency of ~3kHz keeping the target value. So the actual follow
++	 * up restart will always be issued outside the critical window.
++	 */
++
++	rttm_disable_timer(base);
++	rttm_enable_timer(base, mode, RTTM_MAX_DIVISOR);
++}
++
+ static void rttm_stop_timer(void __iomem *base)
+ {
+ 	rttm_disable_timer(base);
+@@ -115,7 +124,6 @@ static void rttm_stop_timer(void __iomem
+ 
+ static void rttm_start_timer(struct timer_of *to, u32 mode)
+ {
+-	rttm_set_counter(to->of_base.base, 0);
+ 	rttm_enable_timer(to->of_base.base, mode, to->of_clk.rate / RTTM_TICKS_PER_SEC);
+ }
+ 
+@@ -124,7 +132,8 @@ static int rttm_next_event(unsigned long
+ 	struct timer_of *to = to_timer_of(clkevt);
+ 
+ 	RTTM_DEBUG(to->of_base.base);
+-	rttm_stop_timer(to->of_base.base);
++	rttm_bounce_timer(to->of_base.base, RTTM_CTRL_COUNTER);
++	rttm_disable_timer(to->of_base.base);
+ 	rttm_set_period(to->of_base.base, delta);
+ 	rttm_start_timer(to, RTTM_CTRL_COUNTER);
+ 
+@@ -136,7 +145,8 @@ static int rttm_state_oneshot(struct clo
+ 	struct timer_of *to = to_timer_of(clkevt);
+ 
+ 	RTTM_DEBUG(to->of_base.base);
+-	rttm_stop_timer(to->of_base.base);
++	rttm_bounce_timer(to->of_base.base, RTTM_CTRL_COUNTER);
++	rttm_disable_timer(to->of_base.base);
+ 	rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+ 	rttm_start_timer(to, RTTM_CTRL_COUNTER);
+ 
+@@ -148,7 +158,8 @@ static int rttm_state_periodic(struct cl
+ 	struct timer_of *to = to_timer_of(clkevt);
+ 
+ 	RTTM_DEBUG(to->of_base.base);
+-	rttm_stop_timer(to->of_base.base);
++	rttm_bounce_timer(to->of_base.base, RTTM_CTRL_TIMER);
++	rttm_disable_timer(to->of_base.base);
+ 	rttm_set_period(to->of_base.base, RTTM_TICKS_PER_SEC / HZ);
+ 	rttm_start_timer(to, RTTM_CTRL_TIMER);
+ 
diff --git a/target/linux/realtek/patches-6.6/305-irqchip-update-dependency-for-irq-realtek-rtl.patch b/target/linux/realtek/patches-6.6/305-irqchip-update-dependency-for-irq-realtek-rtl.patch
deleted file mode 100644
index 0ecc33376e1c02..00000000000000
--- a/target/linux/realtek/patches-6.6/305-irqchip-update-dependency-for-irq-realtek-rtl.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 2cd00b51470a30198b048a5fca48a04db77e29cc Mon Sep 17 00:00:00 2001
-From: INAGAKI Hiroshi <musashino.open@gmail.com>
-Date: Fri, 21 May 2021 23:16:37 +0900
-Subject: [PATCH] realtek: backport irq-realtek-rtl driver from 5.12 to 5.10
-
-This patch backports "irq-realtek-rtl" driver to Kernel 5.10 from 5.12.
-"MACH_REALTEK_RTL" is used as a platform name in upstream, but "RTL838X"
-is used in OpenWrt, so update the dependency by the additional patch.
-
-Submitted-by: INAGAKI Hiroshi <musashino.open@gmail.com>
----
- drivers/irqchip/Makefile                      | 2 +-
- 1 files changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/irqchip/Makefile
-+++ b/drivers/irqchip/Makefile
-@@ -114,7 +114,7 @@ obj-$(CONFIG_LOONGSON_PCH_MSI)		+= irq-l
- obj-$(CONFIG_LOONGSON_PCH_LPC)		+= irq-loongson-pch-lpc.o
- obj-$(CONFIG_MST_IRQ)			+= irq-mst-intc.o
- obj-$(CONFIG_SL28CPLD_INTC)		+= irq-sl28cpld.o
--obj-$(CONFIG_MACH_REALTEK_RTL)		+= irq-realtek-rtl.o
-+obj-$(CONFIG_RTL83XX)			+= irq-realtek-rtl.o
- obj-$(CONFIG_WPCM450_AIC)		+= irq-wpcm450-aic.o
- obj-$(CONFIG_IRQ_IDT3243X)		+= irq-idt3243x.o
- obj-$(CONFIG_APPLE_AIC)			+= irq-apple-aic.o
diff --git a/target/linux/realtek/patches-6.6/307-wdt-update-dependency-for-realtek-otto-wdt.patch b/target/linux/realtek/patches-6.6/307-wdt-update-dependency-for-realtek-otto-wdt.patch
deleted file mode 100644
index c9dab65b72cea5..00000000000000
--- a/target/linux/realtek/patches-6.6/307-wdt-update-dependency-for-realtek-otto-wdt.patch
+++ /dev/null
@@ -1,32 +0,0 @@
-From b8fc5eecdc5d33cf261986436597b5482ab856da Mon Sep 17 00:00:00 2001
-From: Sander Vanheule <sander@svanheule.net>
-Date: Sun, 14 Nov 2021 19:45:32 +0100
-Subject: [PATCH] realtek: Backport Realtek Otto WDT driver
-
-Add patch submitted upstream to linux-watchdog and replace the MIPS
-architecture symbols. Requires one extra patch for the DIV_ROUND_*
-macros, which have moved to a different header since 5.10.
-
-Submitted-by: Sander Vanheule <sander@svanheule.net>
-Tested-by: Stijn Segers <foss@volatilesystems.org>
-Tested-by: Paul Fertser <fercerpav@gmail.com>
-Tested-by: Stijn Tintel <stijn@linux-ipv6.be>
----
- drivers/watchdog/Kconfig                      | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/drivers/watchdog/Kconfig
-+++ b/drivers/watchdog/Kconfig
-@@ -977,10 +977,10 @@ config RTD119X_WATCHDOG
- 
- config REALTEK_OTTO_WDT
- 	tristate "Realtek Otto MIPS watchdog support"
--	depends on MACH_REALTEK_RTL || COMPILE_TEST
-+	depends on RTL83XX
- 	depends on COMMON_CLK
- 	select WATCHDOG_CORE
--	default MACH_REALTEK_RTL
-+	default RTL83XX
- 	help
- 	  Say Y here to include support for the watchdog timer on Realtek
- 	  RTL838x, RTL839x, RTL930x SoCs. This watchdog has pretimeout
diff --git a/target/linux/realtek/patches-6.6/310-add-i2c-rtl9300-support.patch b/target/linux/realtek/patches-6.6/310-add-i2c-rtl9300-support.patch
index 71df91bdacb7a7..c3b30f5fb7814a 100644
--- a/target/linux/realtek/patches-6.6/310-add-i2c-rtl9300-support.patch
+++ b/target/linux/realtek/patches-6.6/310-add-i2c-rtl9300-support.patch
@@ -17,7 +17,7 @@ Submitted-by: Birger Koblitz <git@birger-koblitz.de>
 
 --- a/drivers/i2c/busses/Kconfig
 +++ b/drivers/i2c/busses/Kconfig
-@@ -1021,6 +1021,16 @@ config I2C_RK3X
+@@ -1024,6 +1024,16 @@ config I2C_RK3X
  	  This driver can also be built as a module. If so, the module will
  	  be called i2c-rk3x.
  
diff --git a/target/linux/realtek/patches-6.6/706-include-linux-add-phy-ops-for-rtl838x.patch b/target/linux/realtek/patches-6.6/706-include-linux-add-phy-ops-for-rtl838x.patch
index 09255c572147ef..8fb731206a8977 100644
--- a/target/linux/realtek/patches-6.6/706-include-linux-add-phy-ops-for-rtl838x.patch
+++ b/target/linux/realtek/patches-6.6/706-include-linux-add-phy-ops-for-rtl838x.patch
@@ -21,7 +21,7 @@ Submitted-by: John Crispin <john@phrozen.org>
 
 --- a/include/linux/phy.h
 +++ b/include/linux/phy.h
-@@ -1181,6 +1181,10 @@ struct phy_driver {
+@@ -1178,6 +1178,10 @@ struct phy_driver {
  	 */
  	int (*led_polarity_set)(struct phy_device *dev, int index,
  				unsigned long modes);
diff --git a/target/linux/realtek/patches-6.6/710-net-phy-sfp-re-probe-modules-on-DEV_UP-event.patch b/target/linux/realtek/patches-6.6/710-net-phy-sfp-re-probe-modules-on-DEV_UP-event.patch
index d7a232327d8b15..ca341f64374870 100644
--- a/target/linux/realtek/patches-6.6/710-net-phy-sfp-re-probe-modules-on-DEV_UP-event.patch
+++ b/target/linux/realtek/patches-6.6/710-net-phy-sfp-re-probe-modules-on-DEV_UP-event.patch
@@ -10,7 +10,7 @@ Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
 
 --- a/drivers/net/phy/sfp.c
 +++ b/drivers/net/phy/sfp.c
-@@ -2415,6 +2415,13 @@ static void sfp_sm_module(struct sfp *sf
+@@ -2432,6 +2432,13 @@ static void sfp_sm_module(struct sfp *sf
  		return;
  	}
  
diff --git a/target/linux/realtek/patches-6.6/714-net-phy-sfp-add-support-for-SMBus.patch b/target/linux/realtek/patches-6.6/714-net-phy-sfp-add-support-for-SMBus.patch
index 06d264d805e347..4d6aca99ee51e5 100644
--- a/target/linux/realtek/patches-6.6/714-net-phy-sfp-add-support-for-SMBus.patch
+++ b/target/linux/realtek/patches-6.6/714-net-phy-sfp-add-support-for-SMBus.patch
@@ -10,7 +10,7 @@ Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
 
 --- a/drivers/net/phy/sfp.c
 +++ b/drivers/net/phy/sfp.c
-@@ -662,10 +662,64 @@ static int sfp_i2c_write(struct sfp *sfp
+@@ -678,10 +678,64 @@ static int sfp_i2c_write(struct sfp *sfp
  	return ret == ARRAY_SIZE(msgs) ? len : 0;
  }
  
@@ -77,7 +77,7 @@ Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
  
  	sfp->i2c = i2c;
  	sfp->read = sfp_i2c_read;
-@@ -697,6 +751,29 @@ static int sfp_i2c_mdiobus_create(struct
+@@ -713,6 +767,29 @@ static int sfp_i2c_mdiobus_create(struct
  	return 0;
  }
  
@@ -107,7 +107,7 @@ Signed-off-by: Antoine Tenart <antoine.tenart@bootlin.com>
  static void sfp_i2c_mdiobus_destroy(struct sfp *sfp)
  {
  	mdiobus_unregister(sfp->i2c_mii);
-@@ -1870,8 +1947,15 @@ static void sfp_sm_fault(struct sfp *sfp
+@@ -1886,8 +1963,15 @@ static void sfp_sm_fault(struct sfp *sfp
  
  static int sfp_sm_add_mdio_bus(struct sfp *sfp)
  {
diff --git a/target/linux/realtek/patches-6.6/716-net-ethernet-add-support-for-rtl838x-ethernet.patch b/target/linux/realtek/patches-6.6/716-net-ethernet-add-support-for-rtl838x-ethernet.patch
index 9d79ea565d2ccb..e0c10bca633fad 100644
--- a/target/linux/realtek/patches-6.6/716-net-ethernet-add-support-for-rtl838x-ethernet.patch
+++ b/target/linux/realtek/patches-6.6/716-net-ethernet-add-support-for-rtl838x-ethernet.patch
@@ -29,7 +29,7 @@ Submitted-by: John Crispin <john@phrozen.org>
 +
 +config NET_RTL838X
 +	tristate "Realtek rtl838x Ethernet MAC support"
-+	depends on RTL83XX
++	depends on MACH_REALTEK_RTL
 +	help
 +	  Say Y here if you want to use the Realtek rtl838x Gbps Ethernet MAC.
 +
diff --git a/target/linux/realtek/patches-6.6/720-add-rtl-phy.patch b/target/linux/realtek/patches-6.6/720-add-rtl-phy.patch
index 78a57f0a3e9810..4d6866db24f8c0 100644
--- a/target/linux/realtek/patches-6.6/720-add-rtl-phy.patch
+++ b/target/linux/realtek/patches-6.6/720-add-rtl-phy.patch
@@ -14,13 +14,13 @@ Submitted-by: Birger Koblitz <mail@birger-koblitz.de>
 
 --- a/drivers/net/phy/Kconfig
 +++ b/drivers/net/phy/Kconfig
-@@ -410,6 +410,12 @@ config REALTEK_PHY
- 	help
- 	  Supports the Realtek 821x PHY.
+@@ -407,6 +407,12 @@ config QSEMI_PHY
+ 
+ source "drivers/net/phy/realtek/Kconfig"
  
 +config REALTEK_SOC_PHY
 +	tristate "Realtek SoC PHYs"
-+	depends on RTL83XX
++	depends on MACH_REALTEK_RTL
 +	help
 +	  Supports the PHYs found in combination with Realtek Switch SoCs
 +
@@ -32,7 +32,7 @@ Submitted-by: Birger Koblitz <mail@birger-koblitz.de>
 @@ -100,6 +100,7 @@ obj-$(CONFIG_NXP_TJA11XX_PHY)	+= nxp-tja
  obj-y				+= qcom/
  obj-$(CONFIG_QSEMI_PHY)		+= qsemi.o
- obj-$(CONFIG_REALTEK_PHY)	+= realtek.o
+ obj-$(CONFIG_REALTEK_PHY)	+= realtek/
 +obj-$(CONFIG_REALTEK_SOC_PHY)   += rtl83xx-phy.o
  obj-$(CONFIG_RENESAS_PHY)	+= uPD60620.o
  obj-$(CONFIG_ROCKCHIP_PHY)	+= rockchip.o
diff --git a/target/linux/realtek/patches-6.6/723-net-mdio-Add-Realtek-Otto-auxiliary-controller.patch b/target/linux/realtek/patches-6.6/723-net-mdio-Add-Realtek-Otto-auxiliary-controller.patch
new file mode 100644
index 00000000000000..7315899b3f3b06
--- /dev/null
+++ b/target/linux/realtek/patches-6.6/723-net-mdio-Add-Realtek-Otto-auxiliary-controller.patch
@@ -0,0 +1,227 @@
+From ffb7da9aa25765b2115e7ff3ee4f6dafa60f5421 Mon Sep 17 00:00:00 2001
+From: Sander Vanheule <sander@svanheule.net>
+Date: Fri, 27 Dec 2024 14:55:31 +0100
+Subject: [PATCH] net: mdio: Add Realtek Otto auxiliary controller
+
+SoCs in Realtek's Otto platform such as the RTL8380, RTL8391, and
+RTL9302 have a simple auxiliary MDIO controller that is commonly used to
+manage RTL8231 GPIO expanders on switch devices.
+
+Add a new MDIO controller driver supporting the RTL838x (maple), RTL839x
+(cypress), and RTL930x (longan) SoCs.
+
+Signed-off-by: Sander Vanheule <sander@svanheule.net>
+---
+ drivers/net/mdio/Kconfig                 |  10 ++
+ drivers/net/mdio/Makefile                |   1 +
+ drivers/net/mdio/mdio-realtek-otto-aux.c | 175 +++++++++++++++++++++++
+ 3 files changed, 186 insertions(+)
+ create mode 100644 drivers/net/mdio/mdio-realtek-otto-aux.c
+
+--- a/drivers/net/mdio/Kconfig
++++ b/drivers/net/mdio/Kconfig
+@@ -207,6 +207,16 @@ config MDIO_REGMAP
+ 	  regmap. Users willing to use this driver must explicitly select
+ 	  REGMAP.
+ 
++config MDIO_REALTEK_OTTO_AUX
++	tristate "Realtek Otto auxiliary MDIO interface support"
++	default MACH_REALTEK_RTL
++	depends on MACH_REALTEK_RTL
++	depends on MFD_SYSCON
++	select MDIO_DEVRES
++	help
++	  This driver supports the auxilairy MDIO bus on RTL838x SoCs. This bus
++	  is typically used to attach RTL8231 GPIO extenders.
++
+ config MDIO_THUNDER
+ 	tristate "ThunderX SOCs MDIO buses"
+ 	depends on 64BIT
+--- a/drivers/net/mdio/Makefile
++++ b/drivers/net/mdio/Makefile
+@@ -20,6 +20,7 @@ obj-$(CONFIG_MDIO_MSCC_MIIM)		+= mdio-ms
+ obj-$(CONFIG_MDIO_MVUSB)		+= mdio-mvusb.o
+ obj-$(CONFIG_MDIO_OCTEON)		+= mdio-octeon.o
+ obj-$(CONFIG_MDIO_REGMAP)		+= mdio-regmap.o
++obj-$(CONFIG_MDIO_REALTEK_OTTO_AUX)	+= mdio-realtek-otto-aux.o
+ obj-$(CONFIG_MDIO_SMBUS)		+= mdio-smbus.o
+ obj-$(CONFIG_MDIO_SUN4I)		+= mdio-sun4i.o
+ obj-$(CONFIG_MDIO_THUNDER)		+= mdio-thunder.o
+--- /dev/null
++++ b/drivers/net/mdio/mdio-realtek-otto-aux.c
+@@ -0,0 +1,175 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++
++#include <linux/mfd/core.h>
++#include <linux/mfd/syscon.h>
++#include <linux/module.h>
++#include <linux/of.h>
++#include <linux/of_mdio.h>
++#include <linux/of_platform.h>
++#include <linux/phy.h>
++#include <linux/platform_device.h>
++#include <linux/regmap.h>
++
++#define RTL8380_EXT_GPIO_INDIRECT_ACCESS	0xA09C
++#define RTL8390_EXT_GPIO_INDIRECT_ACCESS	0x0224
++#define RTL9300_EXT_GPIO_INDIRECT_ACCESS	0xC620
++
++#define RTL83XX_AUX_MDIO_DATA_OFFSET		16
++#define RTL83XX_AUX_MDIO_RCMD_FAIL		0
++
++#define RTL93XX_AUX_MDIO_DATA_OFFSET		12
++#define RTL93XX_AUX_MDIO_RCMD_FAIL		BIT(28)
++
++#define REALTEK_AUX_MDIO_REG			GENMASK(11, 7)
++#define REALTEK_AUX_MDIO_PHY_ADDR		GENMASK(6, 2)
++#define REALTEK_AUX_MDIO_WRITE			BIT(1)
++#define REALTEK_AUX_MDIO_READ			0
++#define REALTEK_AUX_MDIO_EXEC			BIT(0)
++
++struct realtek_aux_mdio_info {
++	unsigned int cmd_reg;
++	unsigned int data_offset;
++	unsigned int rcmd_fail_mask;
++	unsigned int timeout_us;
++};
++
++static const struct realtek_aux_mdio_info info_rtl838x = {
++	.cmd_reg = RTL8380_EXT_GPIO_INDIRECT_ACCESS,
++	.data_offset = RTL83XX_AUX_MDIO_DATA_OFFSET,
++	.rcmd_fail_mask = RTL83XX_AUX_MDIO_RCMD_FAIL,
++	.timeout_us = 1700,
++};
++
++static const struct realtek_aux_mdio_info info_rtl839x = {
++	.cmd_reg = RTL8390_EXT_GPIO_INDIRECT_ACCESS,
++	.data_offset = RTL83XX_AUX_MDIO_DATA_OFFSET,
++	.rcmd_fail_mask = RTL83XX_AUX_MDIO_RCMD_FAIL,
++	.timeout_us = 4120,
++};
++
++static const struct realtek_aux_mdio_info info_rtl930x = {
++	.cmd_reg = RTL9300_EXT_GPIO_INDIRECT_ACCESS,
++	.data_offset = RTL93XX_AUX_MDIO_DATA_OFFSET,
++	.rcmd_fail_mask = RTL93XX_AUX_MDIO_RCMD_FAIL,
++	.timeout_us = 19000,
++};
++
++struct realtek_aux_mdio_ctrl {
++	struct device *dev;
++	struct regmap *map;
++	const struct realtek_aux_mdio_info *info;
++};
++
++#define mii_bus_to_ctrl(bus)	((struct realtek_aux_mdio_ctrl *) bus->priv)
++
++static int realtek_aux_mdio_cmd(struct realtek_aux_mdio_ctrl *ctrl, int addr, int regnum,
++		u32 rw_bit, u16 *data)
++{
++	unsigned int cmd;
++	int err;
++
++	cmd = rw_bit | REALTEK_AUX_MDIO_EXEC;
++	cmd |= FIELD_PREP(REALTEK_AUX_MDIO_PHY_ADDR, addr);
++	cmd |= FIELD_PREP(REALTEK_AUX_MDIO_REG, regnum);
++
++	if (rw_bit == REALTEK_AUX_MDIO_WRITE)
++		cmd |= *data << ctrl->info->data_offset;
++
++	err = regmap_write(ctrl->map, ctrl->info->cmd_reg, cmd);
++	if (err)
++		return err;
++
++	err = regmap_read_poll_timeout_atomic(ctrl->map, ctrl->info->cmd_reg, cmd,
++			!(cmd & REALTEK_AUX_MDIO_EXEC), 3, ctrl->info->timeout_us);
++	if (err)
++		return err;
++
++	if (rw_bit == REALTEK_AUX_MDIO_READ) {
++		if (cmd & ctrl->info->rcmd_fail_mask)
++			return -EIO;
++
++		*data = (cmd >> ctrl->info->data_offset) & GENMASK(15, 0);
++	}
++
++	return 0;
++}
++
++static int realtek_aux_mdio_read(struct mii_bus *bus, int addr, int regnum)
++{
++	struct realtek_aux_mdio_ctrl *ctrl = mii_bus_to_ctrl(bus);
++	u16 data;
++	int err;
++
++	err = realtek_aux_mdio_cmd(ctrl, addr, regnum, REALTEK_AUX_MDIO_READ, &data);
++
++	if (err)
++		return err;
++	else
++		return data;
++}
++
++static int realtek_aux_mdio_write(struct mii_bus *bus, int addr, int regnum, u16 val)
++{
++	struct realtek_aux_mdio_ctrl *ctrl = mii_bus_to_ctrl(bus);
++
++	return realtek_aux_mdio_cmd(ctrl, addr, regnum, REALTEK_AUX_MDIO_WRITE, &val);
++}
++
++static int realtek_aux_mdio_probe(struct platform_device *pdev)
++{
++	struct device_node *np = pdev->dev.of_node;
++	struct realtek_aux_mdio_ctrl *ctrl;
++	struct mii_bus *bus;
++
++	bus = devm_mdiobus_alloc_size(&pdev->dev, sizeof(*ctrl));
++	if (!bus)
++		return -ENOMEM;
++
++	ctrl = bus->priv;
++	ctrl->dev = &pdev->dev;
++	ctrl->info = (const struct realtek_aux_mdio_info *) device_get_match_data(ctrl->dev);
++	ctrl->map = syscon_node_to_regmap(np->parent);
++	if (IS_ERR(ctrl->map))
++		return PTR_ERR(ctrl->map);
++
++	bus->name = "Realtek auxiliary MDIO bus";
++	snprintf(bus->id, MII_BUS_ID_SIZE, "realtek-aux-mdio") ;
++	bus->parent = ctrl->dev;
++	bus->read = realtek_aux_mdio_read;
++	bus->write = realtek_aux_mdio_write;
++	/* Don't have interrupts */
++	for (unsigned int i = 0; i < PHY_MAX_ADDR; i++)
++		bus->irq[i] = PHY_POLL;
++
++	return devm_of_mdiobus_register(ctrl->dev, bus, np);
++}
++
++static const struct of_device_id realtek_aux_mdio_of_match[] = {
++	{
++		.compatible = "realtek,rtl8380-aux-mdio",
++		.data = &info_rtl838x,
++	},
++	{
++		.compatible = "realtek,rtl8390-aux-mdio",
++		.data = &info_rtl839x,
++	},
++	{
++		.compatible = "realtek,rtl9300-aux-mdio",
++		.data = &info_rtl930x,
++	},
++	{ /* sentinel */ }
++};
++MODULE_DEVICE_TABLE(of, realtek_aux_mdio_of_match);
++
++static struct platform_driver realtek_aux_mdio_driver = {
++	.driver = {
++		.name = "realtek-otto-aux-mdio",
++		.of_match_table = realtek_aux_mdio_of_match
++	},
++	.probe = realtek_aux_mdio_probe,
++};
++module_platform_driver(realtek_aux_mdio_driver);
++
++MODULE_AUTHOR("Sander Vanheule <sander@svanheule.net>");
++MODULE_DESCRIPTION("Realtek otto auxiliary MDIO bus");
++MODULE_LICENSE("GPL v2");
diff --git a/target/linux/realtek/patches-6.6/800-gpio-regmap-Bypass-cache-for-shadowed-outputs.patch b/target/linux/realtek/patches-6.6/800-gpio-regmap-Bypass-cache-for-shadowed-outputs.patch
new file mode 100644
index 00000000000000..b4dbf320b2db43
--- /dev/null
+++ b/target/linux/realtek/patches-6.6/800-gpio-regmap-Bypass-cache-for-shadowed-outputs.patch
@@ -0,0 +1,56 @@
+From b3f79468c90d8770f007d628a1e32b2d5d44a5c2 Mon Sep 17 00:00:00 2001
+From: Sander Vanheule <sander@svanheule.net>
+Date: Sat, 15 May 2021 11:57:32 +0200
+Subject: [PATCH] gpio: regmap: Bypass cache for shadowed outputs
+
+Some chips have the read-only input and write-only output data registers
+aliased to the same offset, but do not perform direction multiplexing on
+writes. Upon writing the register, this then always updates the output
+value, even when the pin is configured as input. As a result it is not
+safe to perform read-modify-writes on output pins, when other pins are
+still configured as input.
+
+For example, on a bit-banged I2C bus, where the lines are switched
+between out-low and in (with external pull-up)
+
+    OUT(L) IN     OUT(H)
+SCK ....../''''''|''''''
+
+SDA '''''''''\..........
+             ^   ^- SCK switches to direction to OUT, but now has a high
+             |      value, breaking the clock.
+             |
+             \- Perform RMW to update SDA. This reads the current input
+                value for SCK, updates the SDA value and writes back a 1
+                for SCK as well.
+
+If a register is used for both the data input and data output (and is
+not marked as volatile) the driver should ensure the cache is not
+updated on register reads. This ensures proper functioning of writing
+the output register with regmap_update_bits(), which will then use and
+update the cache only on register writes.
+
+Signed-off-by: Sander Vanheule <sander@svanheule.net>
+---
+ drivers/gpio/gpio-regmap.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpio-regmap.c
++++ b/drivers/gpio/gpio-regmap.c
+@@ -74,7 +74,15 @@ static int gpio_regmap_get(struct gpio_c
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = regmap_read(gpio->regmap, reg, &val);
++	/*
++	 * Ensure we don't spoil the register cache with pin input values and
++	 * perform a bypassed read. This way the cache (if any) is only used and
++	 * updated on register writes.
++	 */
++	if (gpio->reg_dat_base == gpio->reg_set_base)
++		ret = regmap_read_bypassed(gpio->regmap, reg, &val);
++	else
++		ret = regmap_read(gpio->regmap, reg, &val);
+ 	if (ret)
+ 		return ret;
+ 
diff --git a/target/linux/realtek/patches-6.6/802-mfd-Add-RTL8231-core-device.patch b/target/linux/realtek/patches-6.6/802-mfd-Add-RTL8231-core-device.patch
new file mode 100644
index 00000000000000..df4d4aa143479c
--- /dev/null
+++ b/target/linux/realtek/patches-6.6/802-mfd-Add-RTL8231-core-device.patch
@@ -0,0 +1,330 @@
+From 4e3455e058d40eb2a7326016494e3c81dc506c33 Mon Sep 17 00:00:00 2001
+From: Sander Vanheule <sander@svanheule.net>
+Date: Mon, 10 May 2021 18:33:01 +0200
+Subject: [PATCH] mfd: Add RTL8231 core device
+
+The RTL8231 is implemented as an MDIO device, and provides a regmap
+interface for register access by the core and child devices.
+
+The chip can also be a device on an SMI bus, an I2C-like bus by Realtek.
+Since kernel support for SMI is limited, and no real-world SMI
+implementations have been encountered for this device, this is currently
+unimplemented. The use of the regmap interface should make any future
+support relatively straightforward.
+
+After reset, all pins are muxed to GPIO inputs before the pin drivers
+are enabled. This is done to prevent accidental system resets, when a
+pin is connected to the parent SoC's reset line.
+
+To provide different read and write semantics for the GPIO data
+registers, a secondary virtual register range is used to enable separate
+caching properties of pin input and output values.
+
+Signed-off-by: Sander Vanheule <sander@svanheule.net>
+---
+ drivers/mfd/Kconfig         |   9 ++
+ drivers/mfd/Makefile        |   1 +
+ drivers/mfd/rtl8231.c       | 193 ++++++++++++++++++++++++++++++++++++
+ include/linux/mfd/rtl8231.h |  71 +++++++++++++
+ 4 files changed, 274 insertions(+)
+ create mode 100644 drivers/mfd/rtl8231.c
+ create mode 100644 include/linux/mfd/rtl8231.h
+
+--- a/drivers/mfd/Kconfig
++++ b/drivers/mfd/Kconfig
+@@ -1171,6 +1171,15 @@ config MFD_RDC321X
+ 	  southbridge which provides access to GPIOs and Watchdog using the
+ 	  southbridge PCI device configuration space.
+ 
++config MFD_RTL8231
++	tristate "Realtek RTL8231 GPIO and LED expander"
++	select MFD_CORE
++	select REGMAP_MDIO
++	help
++	  Support for the Realtek RTL8231 GPIO and LED expander.
++	  Provides up to 37 GPIOs, 88 LEDs, and one PWM output.
++	  When built as a module, this module will be named rtl8231.
++
+ config MFD_RT4831
+ 	tristate "Richtek RT4831 four channel WLED and Display Bias Voltage"
+ 	depends on I2C
+--- a/drivers/mfd/Makefile
++++ b/drivers/mfd/Makefile
+@@ -240,6 +240,7 @@ obj-$(CONFIG_MFD_HI6421_PMIC)	+= hi6421-
+ obj-$(CONFIG_MFD_HI6421_SPMI)	+= hi6421-spmi-pmic.o
+ obj-$(CONFIG_MFD_HI655X_PMIC)   += hi655x-pmic.o
+ obj-$(CONFIG_MFD_DLN2)		+= dln2.o
++obj-$(CONFIG_MFD_RTL8231)	+= rtl8231.o
+ obj-$(CONFIG_MFD_RT4831)	+= rt4831.o
+ obj-$(CONFIG_MFD_RT5033)	+= rt5033.o
+ obj-$(CONFIG_MFD_RT5120)	+= rt5120.o
+--- /dev/null
++++ b/drivers/mfd/rtl8231.c
+@@ -0,0 +1,193 @@
++// SPDX-License-Identifier: GPL-2.0-only
++
++#include <linux/bits.h>
++#include <linux/bitfield.h>
++#include <linux/delay.h>
++#include <linux/gpio/consumer.h>
++#include <linux/mfd/core.h>
++#include <linux/mdio.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/property.h>
++#include <linux/regmap.h>
++
++#include <linux/mfd/rtl8231.h>
++
++static bool rtl8231_volatile_reg(struct device *dev, unsigned int reg)
++{
++	switch (reg) {
++	/*
++	 * Registers with self-clearing bits, strapping pin values.
++	 * Don't mark the data registers as volatile, since we need
++	 * caching for the output values.
++	 */
++	case RTL8231_REG_FUNC0:
++	case RTL8231_REG_FUNC1:
++	case RTL8231_REG_PIN_HI_CFG:
++	case RTL8231_REG_LED_END:
++		return true;
++	default:
++		return false;
++	}
++}
++
++static const struct reg_field RTL8231_FIELD_LED_START = REG_FIELD(RTL8231_REG_FUNC0, 1, 1);
++
++static const struct mfd_cell rtl8231_cells[] = {
++	{
++		.name = "rtl8231-pinctrl",
++	},
++	{
++		.name = "rtl8231-leds",
++		.of_compatible = "realtek,rtl8231-leds",
++	},
++};
++
++static int rtl8231_soft_reset(struct regmap *map)
++{
++	const unsigned int all_pins_mask = GENMASK(RTL8231_BITS_VAL - 1, 0);
++	unsigned int val;
++	int err;
++
++	/* SOFT_RESET bit self-clears when done */
++	regmap_write_bits(map, RTL8231_REG_PIN_HI_CFG,
++		RTL8231_PIN_HI_CFG_SOFT_RESET, RTL8231_PIN_HI_CFG_SOFT_RESET);
++	err = regmap_read_poll_timeout(map, RTL8231_REG_PIN_HI_CFG, val,
++		!(val & RTL8231_PIN_HI_CFG_SOFT_RESET), 50, 1000);
++	if (err)
++		return err;
++
++	regcache_mark_dirty(map);
++
++	/*
++	 * Chip reset results in a pin configuration that is a mix of LED and GPIO outputs.
++	 * Select GPI functionality for all pins before enabling pin outputs.
++	 */
++	regmap_write(map, RTL8231_REG_PIN_MODE0, all_pins_mask);
++	regmap_write(map, RTL8231_REG_GPIO_DIR0, all_pins_mask);
++	regmap_write(map, RTL8231_REG_PIN_MODE1, all_pins_mask);
++	regmap_write(map, RTL8231_REG_GPIO_DIR1, all_pins_mask);
++	regmap_write(map, RTL8231_REG_PIN_HI_CFG,
++		RTL8231_PIN_HI_CFG_MODE_MASK | RTL8231_PIN_HI_CFG_DIR_MASK);
++
++	return 0;
++}
++
++static int rtl8231_init(struct device *dev, struct regmap *map)
++{
++	struct regmap_field *led_start;
++	unsigned int started;
++	unsigned int val;
++	int err;
++
++	err = regmap_read(map, RTL8231_REG_FUNC1, &val);
++	if (err) {
++		dev_err(dev, "failed to read READY_CODE\n");
++		return err;
++	}
++
++	val = FIELD_GET(RTL8231_FUNC1_READY_CODE_MASK, val);
++	if (val != RTL8231_FUNC1_READY_CODE_VALUE) {
++		dev_err(dev, "RTL8231 not present or ready 0x%x != 0x%x\n",
++			val, RTL8231_FUNC1_READY_CODE_VALUE);
++		return -ENODEV;
++	}
++
++	led_start = dev_get_drvdata(dev);
++	err = regmap_field_read(led_start, &started);
++	if (err)
++		return err;
++
++	if (!started) {
++		err = rtl8231_soft_reset(map);
++		if (err)
++			return err;
++		/* LED_START enables power to output pins, and starts the LED engine */
++		err = regmap_field_force_write(led_start, 1);
++	}
++
++	return err;
++}
++
++static const struct regmap_config rtl8231_mdio_regmap_config = {
++	.val_bits = RTL8231_BITS_VAL,
++	.reg_bits = RTL8231_BITS_REG,
++	.volatile_reg = rtl8231_volatile_reg,
++	.max_register = RTL8231_REG_COUNT - 1,
++	.use_single_read = true,
++	.use_single_write = true,
++	.reg_format_endian = REGMAP_ENDIAN_BIG,
++	.val_format_endian = REGMAP_ENDIAN_BIG,
++	/* Cannot use REGCACHE_FLAT because it's not smart enough about cache invalidation  */
++	.cache_type = REGCACHE_RBTREE,
++};
++
++static int rtl8231_mdio_probe(struct mdio_device *mdiodev)
++{
++	struct device *dev = &mdiodev->dev;
++	struct regmap_field *led_start;
++	struct regmap *map;
++	int err;
++
++	map = devm_regmap_init_mdio(mdiodev, &rtl8231_mdio_regmap_config);
++	if (IS_ERR(map)) {
++		dev_err(dev, "failed to init regmap\n");
++		return PTR_ERR(map);
++	}
++
++	led_start = devm_regmap_field_alloc(dev, map, RTL8231_FIELD_LED_START);
++	if (IS_ERR(led_start))
++		return PTR_ERR(led_start);
++
++	dev_set_drvdata(dev, led_start);
++
++	mdiodev->reset_gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
++	if (IS_ERR(mdiodev->reset_gpio))
++		return PTR_ERR(mdiodev->reset_gpio);
++
++	device_property_read_u32(dev, "reset-assert-delay", &mdiodev->reset_assert_delay);
++	device_property_read_u32(dev, "reset-deassert-delay", &mdiodev->reset_deassert_delay);
++
++	err = rtl8231_init(dev, map);
++	if (err)
++		return err;
++
++	return devm_mfd_add_devices(dev, PLATFORM_DEVID_AUTO, rtl8231_cells,
++		ARRAY_SIZE(rtl8231_cells), NULL, 0, NULL);
++}
++
++__maybe_unused static int rtl8231_suspend(struct device *dev)
++{
++	struct regmap_field *led_start = dev_get_drvdata(dev);
++
++	return regmap_field_force_write(led_start, 0);
++}
++
++__maybe_unused static int rtl8231_resume(struct device *dev)
++{
++	struct regmap_field *led_start = dev_get_drvdata(dev);
++
++	return regmap_field_force_write(led_start, 1);
++}
++
++static SIMPLE_DEV_PM_OPS(rtl8231_pm_ops, rtl8231_suspend, rtl8231_resume);
++
++static const struct of_device_id rtl8231_of_match[] = {
++	{ .compatible = "realtek,rtl8231" },
++	{}
++};
++MODULE_DEVICE_TABLE(of, rtl8231_of_match);
++
++static struct mdio_driver rtl8231_mdio_driver = {
++	.mdiodrv.driver = {
++		.name = "rtl8231-expander",
++		.of_match_table	= rtl8231_of_match,
++		.pm = pm_ptr(&rtl8231_pm_ops),
++	},
++	.probe = rtl8231_mdio_probe,
++};
++mdio_module_driver(rtl8231_mdio_driver);
++
++MODULE_AUTHOR("Sander Vanheule <sander@svanheule.net>");
++MODULE_DESCRIPTION("Realtek RTL8231 GPIO and LED expander");
++MODULE_LICENSE("GPL");
+--- /dev/null
++++ b/include/linux/mfd/rtl8231.h
+@@ -0,0 +1,71 @@
++/* SPDX-License-Identifier: GPL-2.0-or-later */
++/*
++ * Register definitions the RTL8231 GPIO and LED expander chip
++ */
++
++#ifndef __LINUX_MFD_RTL8231_H
++#define __LINUX_MFD_RTL8231_H
++
++#include <linux/bits.h>
++
++/*
++ * Registers addresses are 5 bit, values are 16 bit
++ * Also define a duplicated range of virtual addresses, to enable
++ * different read/write behaviour on the GPIO data registers
++ */
++#define RTL8231_BITS_VAL		16
++#define RTL8231_BITS_REG		5
++
++/* Chip control */
++#define RTL8231_REG_FUNC0		0x00
++#define RTL8231_FUNC0_SCAN_MODE		BIT(0)
++#define RTL8231_FUNC0_SCAN_SINGLE	0
++#define RTL8231_FUNC0_SCAN_BICOLOR	BIT(0)
++
++#define RTL8231_REG_FUNC1		0x01
++#define RTL8231_FUNC1_READY_CODE_VALUE	0x37
++#define RTL8231_FUNC1_READY_CODE_MASK	GENMASK(9, 4)
++#define RTL8231_FUNC1_DEBOUNCE_MASK	GENMASK(15, 10)
++
++/* Pin control */
++#define RTL8231_REG_PIN_MODE0		0x02
++#define RTL8231_REG_PIN_MODE1		0x03
++
++#define RTL8231_PIN_MODE_LED		0
++#define RTL8231_PIN_MODE_GPIO		1
++
++/* Pin high config: pin and GPIO control for pins 32-26 */
++#define RTL8231_REG_PIN_HI_CFG		0x04
++#define RTL8231_PIN_HI_CFG_MODE_MASK	GENMASK(4, 0)
++#define RTL8231_PIN_HI_CFG_DIR_MASK	GENMASK(9, 5)
++#define RTL8231_PIN_HI_CFG_INV_MASK	GENMASK(14, 10)
++#define RTL8231_PIN_HI_CFG_SOFT_RESET	BIT(15)
++
++/* GPIO control registers */
++#define RTL8231_REG_GPIO_DIR0		0x05
++#define RTL8231_REG_GPIO_DIR1		0x06
++#define RTL8231_REG_GPIO_INVERT0	0x07
++#define RTL8231_REG_GPIO_INVERT1	0x08
++
++#define RTL8231_GPIO_DIR_IN		1
++#define RTL8231_GPIO_DIR_OUT		0
++
++/*
++ * GPIO data registers
++ * Only the output data can be written to these registers, and only the input
++ * data can be read.
++ */
++#define RTL8231_REG_GPIO_DATA0		0x1c
++#define RTL8231_REG_GPIO_DATA1		0x1d
++#define RTL8231_REG_GPIO_DATA2		0x1e
++#define RTL8231_PIN_HI_DATA_MASK	GENMASK(4, 0)
++
++/* LED control base registers */
++#define RTL8231_REG_LED0_BASE		0x09
++#define RTL8231_REG_LED1_BASE		0x10
++#define RTL8231_REG_LED2_BASE		0x17
++#define RTL8231_REG_LED_END		0x1b
++
++#define RTL8231_REG_COUNT		0x1f
++
++#endif /* __LINUX_MFD_RTL8231_H */
diff --git a/target/linux/realtek/patches-6.6/803-pinctrl-Add-RTL8231-pin-control-and-GPIO-support.patch b/target/linux/realtek/patches-6.6/803-pinctrl-Add-RTL8231-pin-control-and-GPIO-support.patch
new file mode 100644
index 00000000000000..de0f5ee8684207
--- /dev/null
+++ b/target/linux/realtek/patches-6.6/803-pinctrl-Add-RTL8231-pin-control-and-GPIO-support.patch
@@ -0,0 +1,581 @@
+From 098324288a63a6dcc44e96cc381aef3d5c48d89e Mon Sep 17 00:00:00 2001
+From: Sander Vanheule <sander@svanheule.net>
+Date: Mon, 10 May 2021 22:15:31 +0200
+Subject: [PATCH] pinctrl: Add RTL8231 pin control and GPIO support
+
+This driver implements the GPIO and pin muxing features provided by the
+RTL8231. The device should be instantiated as an MFD child, where the
+parent device has already configured the regmap used for register
+access.
+
+Debouncing is only available for the six highest GPIOs, and must be
+emulated when other pins are used for (button) inputs. Although
+described in the bindings, drive strength selection is currently not
+implemented.
+
+Signed-off-by: Sander Vanheule <sander@svanheule.net>
+---
+ drivers/pinctrl/Kconfig           |  11 +
+ drivers/pinctrl/Makefile          |   1 +
+ drivers/pinctrl/pinctrl-rtl8231.c | 521 ++++++++++++++++++++++++++++++
+ 3 files changed, 533 insertions(+)
+ create mode 100644 drivers/pinctrl/pinctrl-rtl8231.c
+
+--- a/drivers/pinctrl/Kconfig
++++ b/drivers/pinctrl/Kconfig
+@@ -417,6 +417,17 @@ config PINCTRL_ROCKCHIP
+ 	help
+           This support pinctrl and GPIO driver for Rockchip SoCs.
+ 
++config PINCTRL_RTL8231
++	tristate "Realtek RTL8231 GPIO expander's pin controller"
++	depends on MFD_RTL8231
++	default MFD_RTL8231
++	select GPIO_REGMAP
++	select GENERIC_PINCONF
++	select GENERIC_PINMUX_FUNCTIONS
++	help
++	  Support for RTL8231 expander's GPIOs and pin controller.
++	  When built as a module, the module will be called pinctrl-rtl8231.
++
+ config PINCTRL_SINGLE
+ 	tristate "One-register-per-pin type device tree based pinctrl driver"
+ 	depends on OF
+--- a/drivers/pinctrl/Makefile
++++ b/drivers/pinctrl/Makefile
+@@ -43,6 +43,7 @@ obj-$(CONFIG_PINCTRL_PIC32)	+= pinctrl-p
+ obj-$(CONFIG_PINCTRL_PISTACHIO)	+= pinctrl-pistachio.o
+ obj-$(CONFIG_PINCTRL_RK805)	+= pinctrl-rk805.o
+ obj-$(CONFIG_PINCTRL_ROCKCHIP)	+= pinctrl-rockchip.o
++obj-$(CONFIG_PINCTRL_RTL8231)	+= pinctrl-rtl8231.o
+ obj-$(CONFIG_PINCTRL_SINGLE)	+= pinctrl-single.o
+ obj-$(CONFIG_PINCTRL_ST) 	+= pinctrl-st.o
+ obj-$(CONFIG_PINCTRL_STMFX) 	+= pinctrl-stmfx.o
+--- /dev/null
++++ b/drivers/pinctrl/pinctrl-rtl8231.c
+@@ -0,0 +1,525 @@
++// SPDX-License-Identifier: GPL-2.0-only
++
++#include <linux/bitfield.h>
++#include <linux/gpio/driver.h>
++#include <linux/gpio/regmap.h>
++#include <linux/module.h>
++#include <linux/pinctrl/pinconf.h>
++#include <linux/pinctrl/pinctrl.h>
++#include <linux/pinctrl/pinmux.h>
++#include <linux/platform_device.h>
++#include <linux/regmap.h>
++
++#include "core.h"
++#include "pinmux.h"
++#include <linux/mfd/rtl8231.h>
++
++#define RTL8231_NUM_GPIOS		37
++#define RTL8231_DEBOUNCE_USEC		100000
++#define RTL8231_DEBOUNCE_MIN_OFFSET	31
++
++struct rtl8231_pin_ctrl {
++	struct pinctrl_desc pctl_desc;
++	struct regmap *map;
++};
++
++/*
++ * Pin controller functionality
++ */
++static const char * const rtl8231_pin_function_names[] = {
++	"gpio",
++	"led",
++	"pwm",
++};
++
++enum rtl8231_pin_function {
++	RTL8231_PIN_FUNCTION_GPIO = BIT(0),
++	RTL8231_PIN_FUNCTION_LED = BIT(1),
++	RTL8231_PIN_FUNCTION_PWM = BIT(2),
++};
++
++struct rtl8231_pin_desc {
++	const enum rtl8231_pin_function functions;
++	const u8 reg;
++	const u8 offset;
++	const u8 gpio_function_value;
++};
++
++#define RTL8231_PIN_DESC(_num, _func, _reg, _fld, _val)		\
++	[_num] = {						\
++		.functions = RTL8231_PIN_FUNCTION_GPIO | _func,	\
++		.reg = _reg,					\
++		.offset = _fld,					\
++		.gpio_function_value = _val,			\
++	}
++#define RTL8231_GPIO_PIN_DESC(_num, _reg, _fld)			\
++	RTL8231_PIN_DESC(_num, 0, _reg, _fld, RTL8231_PIN_MODE_GPIO)
++#define RTL8231_LED_PIN_DESC(_num, _reg, _fld)			\
++	RTL8231_PIN_DESC(_num, RTL8231_PIN_FUNCTION_LED, _reg, _fld, RTL8231_PIN_MODE_GPIO)
++#define RTL8231_PWM_PIN_DESC(_num, _reg, _fld)			\
++	RTL8231_PIN_DESC(_num, RTL8231_PIN_FUNCTION_PWM, _reg, _fld, 0)
++
++/*
++ * All pins have a GPIO/LED mux bit, but the bits for pins 35/36 are read-only. Use this bit
++ * for the GPIO-only pin instead of a placeholder, so the rest of the logic can stay generic.
++ */
++static struct rtl8231_pin_desc rtl8231_pin_data[RTL8231_NUM_GPIOS] = {
++	RTL8231_LED_PIN_DESC(0, RTL8231_REG_PIN_MODE0, 0),
++	RTL8231_LED_PIN_DESC(1, RTL8231_REG_PIN_MODE0, 1),
++	RTL8231_LED_PIN_DESC(2, RTL8231_REG_PIN_MODE0, 2),
++	RTL8231_LED_PIN_DESC(3, RTL8231_REG_PIN_MODE0, 3),
++	RTL8231_LED_PIN_DESC(4, RTL8231_REG_PIN_MODE0, 4),
++	RTL8231_LED_PIN_DESC(5, RTL8231_REG_PIN_MODE0, 5),
++	RTL8231_LED_PIN_DESC(6, RTL8231_REG_PIN_MODE0, 6),
++	RTL8231_LED_PIN_DESC(7, RTL8231_REG_PIN_MODE0, 7),
++	RTL8231_LED_PIN_DESC(8, RTL8231_REG_PIN_MODE0, 8),
++	RTL8231_LED_PIN_DESC(9, RTL8231_REG_PIN_MODE0, 9),
++	RTL8231_LED_PIN_DESC(10, RTL8231_REG_PIN_MODE0, 10),
++	RTL8231_LED_PIN_DESC(11, RTL8231_REG_PIN_MODE0, 11),
++	RTL8231_LED_PIN_DESC(12, RTL8231_REG_PIN_MODE0, 12),
++	RTL8231_LED_PIN_DESC(13, RTL8231_REG_PIN_MODE0, 13),
++	RTL8231_LED_PIN_DESC(14, RTL8231_REG_PIN_MODE0, 14),
++	RTL8231_LED_PIN_DESC(15, RTL8231_REG_PIN_MODE0, 15),
++	RTL8231_LED_PIN_DESC(16, RTL8231_REG_PIN_MODE1, 0),
++	RTL8231_LED_PIN_DESC(17, RTL8231_REG_PIN_MODE1, 1),
++	RTL8231_LED_PIN_DESC(18, RTL8231_REG_PIN_MODE1, 2),
++	RTL8231_LED_PIN_DESC(19, RTL8231_REG_PIN_MODE1, 3),
++	RTL8231_LED_PIN_DESC(20, RTL8231_REG_PIN_MODE1, 4),
++	RTL8231_LED_PIN_DESC(21, RTL8231_REG_PIN_MODE1, 5),
++	RTL8231_LED_PIN_DESC(22, RTL8231_REG_PIN_MODE1, 6),
++	RTL8231_LED_PIN_DESC(23, RTL8231_REG_PIN_MODE1, 7),
++	RTL8231_LED_PIN_DESC(24, RTL8231_REG_PIN_MODE1, 8),
++	RTL8231_LED_PIN_DESC(25, RTL8231_REG_PIN_MODE1, 9),
++	RTL8231_LED_PIN_DESC(26, RTL8231_REG_PIN_MODE1, 10),
++	RTL8231_LED_PIN_DESC(27, RTL8231_REG_PIN_MODE1, 11),
++	RTL8231_LED_PIN_DESC(28, RTL8231_REG_PIN_MODE1, 12),
++	RTL8231_LED_PIN_DESC(29, RTL8231_REG_PIN_MODE1, 13),
++	RTL8231_LED_PIN_DESC(30, RTL8231_REG_PIN_MODE1, 14),
++	RTL8231_LED_PIN_DESC(31, RTL8231_REG_PIN_MODE1, 15),
++	RTL8231_LED_PIN_DESC(32, RTL8231_REG_PIN_HI_CFG, 0),
++	RTL8231_LED_PIN_DESC(33, RTL8231_REG_PIN_HI_CFG, 1),
++	RTL8231_LED_PIN_DESC(34, RTL8231_REG_PIN_HI_CFG, 2),
++	RTL8231_PWM_PIN_DESC(35, RTL8231_REG_FUNC1, 3),
++	RTL8231_GPIO_PIN_DESC(36, RTL8231_REG_PIN_HI_CFG, 4),
++};
++
++#define RTL8231_PIN(_num)				\
++	{						\
++		.number = _num,				\
++		.name = "gpio" #_num,			\
++		.drv_data = &rtl8231_pin_data[_num]	\
++	}
++
++static const struct pinctrl_pin_desc rtl8231_pins[RTL8231_NUM_GPIOS] = {
++	RTL8231_PIN(0),
++	RTL8231_PIN(1),
++	RTL8231_PIN(2),
++	RTL8231_PIN(3),
++	RTL8231_PIN(4),
++	RTL8231_PIN(5),
++	RTL8231_PIN(6),
++	RTL8231_PIN(7),
++	RTL8231_PIN(8),
++	RTL8231_PIN(9),
++	RTL8231_PIN(10),
++	RTL8231_PIN(11),
++	RTL8231_PIN(12),
++	RTL8231_PIN(13),
++	RTL8231_PIN(14),
++	RTL8231_PIN(15),
++	RTL8231_PIN(16),
++	RTL8231_PIN(17),
++	RTL8231_PIN(18),
++	RTL8231_PIN(19),
++	RTL8231_PIN(20),
++	RTL8231_PIN(21),
++	RTL8231_PIN(22),
++	RTL8231_PIN(23),
++	RTL8231_PIN(24),
++	RTL8231_PIN(25),
++	RTL8231_PIN(26),
++	RTL8231_PIN(27),
++	RTL8231_PIN(28),
++	RTL8231_PIN(29),
++	RTL8231_PIN(30),
++	RTL8231_PIN(31),
++	RTL8231_PIN(32),
++	RTL8231_PIN(33),
++	RTL8231_PIN(34),
++	RTL8231_PIN(35),
++	RTL8231_PIN(36),
++};
++
++static int rtl8231_get_groups_count(struct pinctrl_dev *pctldev)
++{
++	return ARRAY_SIZE(rtl8231_pins);
++}
++
++static const char *rtl8231_get_group_name(struct pinctrl_dev *pctldev, unsigned int selector)
++{
++	return rtl8231_pins[selector].name;
++}
++
++static int rtl8231_get_group_pins(struct pinctrl_dev *pctldev, unsigned int selector,
++	const unsigned int **pins, unsigned int *num_pins)
++{
++	if (selector >= ARRAY_SIZE(rtl8231_pins))
++		return -EINVAL;
++
++	*pins = &rtl8231_pins[selector].number;
++	*num_pins = 1;
++
++	return 0;
++}
++
++static const struct pinctrl_ops rtl8231_pinctrl_ops = {
++	.get_groups_count = rtl8231_get_groups_count,
++	.get_group_name = rtl8231_get_group_name,
++	.get_group_pins = rtl8231_get_group_pins,
++	.dt_node_to_map = pinconf_generic_dt_node_to_map_all,
++	.dt_free_map = pinconf_generic_dt_free_map,
++};
++
++static int rtl8231_set_mux(struct pinctrl_dev *pctldev, unsigned int func_selector,
++	unsigned int group_selector)
++{
++	const struct function_desc *func = pinmux_generic_get_function(pctldev, func_selector);
++	const struct rtl8231_pin_desc *desc = rtl8231_pins[group_selector].drv_data;
++	const struct rtl8231_pin_ctrl *ctrl = pinctrl_dev_get_drvdata(pctldev);
++	unsigned int func_flag = (uintptr_t) func->data;
++	unsigned int function_mask;
++	unsigned int gpio_function;
++
++	if (!(desc->functions & func_flag))
++		return -EINVAL;
++
++	function_mask = BIT(desc->offset);
++	gpio_function = desc->gpio_function_value << desc->offset;
++
++	if (func_flag == RTL8231_PIN_FUNCTION_GPIO)
++		return regmap_update_bits(ctrl->map, desc->reg, function_mask, gpio_function);
++	else
++		return regmap_update_bits(ctrl->map, desc->reg, function_mask, ~gpio_function);
++}
++
++static int rtl8231_gpio_request_enable(struct pinctrl_dev *pctldev,
++	struct pinctrl_gpio_range *range, unsigned int offset)
++{
++	const struct rtl8231_pin_desc *desc = rtl8231_pins[offset].drv_data;
++	struct rtl8231_pin_ctrl *ctrl = pinctrl_dev_get_drvdata(pctldev);
++	unsigned int function_mask;
++	unsigned int gpio_function;
++
++	function_mask = BIT(desc->offset);
++	gpio_function = desc->gpio_function_value << desc->offset;
++
++	return regmap_update_bits(ctrl->map, desc->reg, function_mask, gpio_function);
++}
++
++static const struct pinmux_ops rtl8231_pinmux_ops = {
++	.get_functions_count = pinmux_generic_get_function_count,
++	.get_function_name = pinmux_generic_get_function_name,
++	.get_function_groups = pinmux_generic_get_function_groups,
++	.set_mux = rtl8231_set_mux,
++	.gpio_request_enable = rtl8231_gpio_request_enable,
++	.strict = true,
++};
++
++static int rtl8231_pin_config_get(struct pinctrl_dev *pctldev, unsigned int offset,
++	unsigned long *config)
++{
++	struct rtl8231_pin_ctrl *ctrl = pinctrl_dev_get_drvdata(pctldev);
++	unsigned int param = pinconf_to_config_param(*config);
++	unsigned int arg;
++	int err;
++	int v;
++
++	switch (param) {
++	case PIN_CONFIG_INPUT_DEBOUNCE:
++		if (offset < RTL8231_DEBOUNCE_MIN_OFFSET)
++			return -EINVAL;
++
++		err = regmap_read(ctrl->map, RTL8231_REG_FUNC1, &v);
++		if (err)
++			return err;
++
++		v = FIELD_GET(RTL8231_FUNC1_DEBOUNCE_MASK, v);
++		if (v & BIT(offset - RTL8231_DEBOUNCE_MIN_OFFSET))
++			arg = RTL8231_DEBOUNCE_USEC;
++		else
++			arg = 0;
++		break;
++	default:
++		return -ENOTSUPP;
++	}
++
++	*config = pinconf_to_config_packed(param, arg);
++
++	return 0;
++}
++
++static int rtl8231_pin_config_set(struct pinctrl_dev *pctldev, unsigned int offset,
++	unsigned long *configs, unsigned int num_configs)
++{
++	struct rtl8231_pin_ctrl *ctrl = pinctrl_dev_get_drvdata(pctldev);
++	unsigned int param, arg;
++	unsigned int pin_mask;
++	int err;
++	int i;
++
++	for (i = 0; i < num_configs; i++) {
++		param = pinconf_to_config_param(configs[i]);
++		arg = pinconf_to_config_argument(configs[i]);
++
++		switch (param) {
++		case PIN_CONFIG_INPUT_DEBOUNCE:
++			if (offset < RTL8231_DEBOUNCE_MIN_OFFSET)
++				return -EINVAL;
++
++			pin_mask = FIELD_PREP(RTL8231_FUNC1_DEBOUNCE_MASK,
++				BIT(offset - RTL8231_DEBOUNCE_MIN_OFFSET));
++
++			switch (arg) {
++			case 0:
++				err = regmap_update_bits(ctrl->map, RTL8231_REG_FUNC1,
++					pin_mask, 0);
++				break;
++			case RTL8231_DEBOUNCE_USEC:
++				err = regmap_update_bits(ctrl->map, RTL8231_REG_FUNC1,
++					pin_mask, pin_mask);
++				break;
++			default:
++				return -EINVAL;
++			}
++
++			break;
++		default:
++			return -ENOTSUPP;
++		}
++	}
++
++	return err;
++}
++
++static const struct pinconf_ops rtl8231_pinconf_ops = {
++	.is_generic = true,
++	.pin_config_get = rtl8231_pin_config_get,
++	.pin_config_set = rtl8231_pin_config_set,
++};
++
++static int rtl8231_pinctrl_init_functions(struct pinctrl_dev *pctl, struct rtl8231_pin_ctrl *ctrl)
++{
++	const char *function_name;
++	const char **groups;
++	unsigned int f_idx;
++	unsigned int pin;
++	int num_groups;
++	int err;
++
++	for (f_idx = 0; f_idx < ARRAY_SIZE(rtl8231_pin_function_names); f_idx++) {
++		function_name = rtl8231_pin_function_names[f_idx];
++
++		for (pin = 0, num_groups = 0; pin < ctrl->pctl_desc.npins; pin++)
++			if (rtl8231_pin_data[pin].functions & BIT(f_idx))
++				num_groups++;
++
++		groups = devm_kcalloc(pctl->dev, num_groups, sizeof(*groups), GFP_KERNEL);
++		if (!groups)
++			return -ENOMEM;
++
++		for (pin = 0, num_groups = 0; pin < ctrl->pctl_desc.npins; pin++)
++			if (rtl8231_pin_data[pin].functions & BIT(f_idx))
++				groups[num_groups++] = rtl8231_pins[pin].name;
++
++		err = pinmux_generic_add_function(pctl, function_name, groups, num_groups,
++			(void *) BIT(f_idx));
++		if (err < 0)
++			return err;
++	}
++
++	return 0;
++}
++
++struct pin_field_info {
++	const struct reg_field gpio_data;
++	const struct reg_field gpio_dir;
++	const struct reg_field mode;
++};
++
++static const struct pin_field_info pin_fields[] = {
++	{
++		.gpio_data = REG_FIELD(RTL8231_REG_GPIO_DATA0, 0, 15),
++		.gpio_dir = REG_FIELD(RTL8231_REG_GPIO_DIR0, 0, 15),
++		.mode = REG_FIELD(RTL8231_REG_PIN_MODE0, 0, 15),
++	},
++	{
++		.gpio_data = REG_FIELD(RTL8231_REG_GPIO_DATA1, 0, 15),
++		.gpio_dir = REG_FIELD(RTL8231_REG_GPIO_DIR1, 0, 15),
++		.mode = REG_FIELD(RTL8231_REG_PIN_MODE1, 0, 15),
++	},
++	{
++		.gpio_data = REG_FIELD(RTL8231_REG_GPIO_DATA2, 0, 4),
++		.gpio_dir = REG_FIELD(RTL8231_REG_PIN_HI_CFG, 5, 9),
++		.mode = REG_FIELD(RTL8231_REG_PIN_HI_CFG, 0, 4),
++	},
++};
++
++static int rtl8231_configure_safe(struct device *dev, struct regmap *map)
++{
++	struct regmap_field *field_data;
++	struct regmap_field *field_mode;
++	struct regmap_field *field_dir;
++	unsigned int is_output;
++	unsigned int is_gpio;
++	unsigned int data;
++	unsigned int mode;
++	unsigned int dir;
++	int err;
++
++	for (unsigned int i = 0; i < ARRAY_SIZE(pin_fields); i++) {
++		field_data = devm_regmap_field_alloc(dev, map, pin_fields[i].gpio_data);
++		if (IS_ERR(field_data))
++			return PTR_ERR(field_data);
++
++		field_dir = devm_regmap_field_alloc(dev, map, pin_fields[i].gpio_dir);
++		if (IS_ERR(field_dir))
++			return PTR_ERR(field_dir);
++
++		field_mode = devm_regmap_field_alloc(dev, map, pin_fields[i].mode);
++		if (IS_ERR(field_mode))
++			return PTR_ERR(field_mode);
++
++		/* The register cache is invalid at start-up, so this should read from HW */
++		err = regmap_field_read(field_data, &data);
++		if (err)
++			return err;
++
++		err = regmap_field_read(field_dir, &dir);
++		if (err)
++			return err;
++
++		err = regmap_field_read(field_mode, &mode);
++		if (err)
++			return err;
++
++		/* Write back only the GPIO-out values to fix the cache */
++		data &= ~dir;
++		regmap_field_write(field_data, data);
++
++		/*
++		 * Set every pin that is configured as gpio-output but muxed for the alternative
++		 * (LED) function to gpio-in. That way the pin will be high impedance when it is
++		 * muxed to GPIO, preventing unwanted glitches.
++		 * The pin muxes are left as-is, so there are no signal changes.
++		 */
++		is_gpio = mode;
++		is_output = ~dir;
++		regmap_field_write(field_dir, dir | (~is_gpio & is_output));
++
++		devm_regmap_field_free(dev, field_data);
++		devm_regmap_field_free(dev, field_dir);
++		devm_regmap_field_free(dev, field_mode);
++	}
++
++	return 0;
++}
++
++static int rtl8231_pinctrl_init(struct device *dev, struct rtl8231_pin_ctrl *ctrl)
++{
++	struct pinctrl_dev *pctldev;
++	int err;
++
++	ctrl->pctl_desc.name = "rtl8231-pinctrl";
++	ctrl->pctl_desc.owner = THIS_MODULE;
++	ctrl->pctl_desc.confops = &rtl8231_pinconf_ops;
++	ctrl->pctl_desc.pctlops = &rtl8231_pinctrl_ops;
++	ctrl->pctl_desc.pmxops = &rtl8231_pinmux_ops;
++	ctrl->pctl_desc.npins = ARRAY_SIZE(rtl8231_pins);
++	ctrl->pctl_desc.pins = rtl8231_pins;
++
++	err = devm_pinctrl_register_and_init(dev->parent, &ctrl->pctl_desc, ctrl, &pctldev);
++	if (err) {
++		dev_err(dev, "failed to register pin controller\n");
++		return err;
++	}
++
++	err = rtl8231_pinctrl_init_functions(pctldev, ctrl);
++	if (err)
++		return err;
++
++	err = pinctrl_enable(pctldev);
++	if (err)
++		dev_err(dev, "failed to enable pin controller\n");
++
++	return err;
++}
++
++/*
++ * GPIO controller functionality
++ */
++static int rtl8231_gpio_reg_mask_xlate(struct gpio_regmap *gpio, unsigned int base,
++	unsigned int offset, unsigned int *reg, unsigned int *mask)
++{
++	unsigned int pin_mask = BIT(offset % RTL8231_BITS_VAL);
++
++	if (base == RTL8231_REG_GPIO_DATA0 || offset < 32) {
++		*reg = base + offset / RTL8231_BITS_VAL;
++		*mask = pin_mask;
++	} else if (base == RTL8231_REG_GPIO_DIR0) {
++		*reg = RTL8231_REG_PIN_HI_CFG;
++		*mask = FIELD_PREP(RTL8231_PIN_HI_CFG_DIR_MASK, pin_mask);
++	} else {
++		return -EINVAL;
++	}
++
++	return 0;
++}
++
++static int rtl8231_pinctrl_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	struct rtl8231_pin_ctrl *ctrl;
++	struct gpio_regmap_config gpio_cfg = {};
++	int err;
++
++	ctrl = devm_kzalloc(dev, sizeof(*ctrl), GFP_KERNEL);
++	if (!ctrl)
++		return -ENOMEM;
++
++	ctrl->map = dev_get_regmap(dev->parent, NULL);
++	if (!ctrl->map)
++		return -ENODEV;
++
++	err = rtl8231_configure_safe(dev, ctrl->map);
++	if (err)
++		return err;
++
++	err = rtl8231_pinctrl_init(dev, ctrl);
++	if (err)
++		return err;
++
++	gpio_cfg.regmap = ctrl->map;
++	gpio_cfg.parent = dev->parent;
++	gpio_cfg.ngpio = RTL8231_NUM_GPIOS;
++	gpio_cfg.ngpio_per_reg = RTL8231_BITS_VAL;
++
++	gpio_cfg.reg_dat_base = GPIO_REGMAP_ADDR(RTL8231_REG_GPIO_DATA0);
++	gpio_cfg.reg_set_base = GPIO_REGMAP_ADDR(RTL8231_REG_GPIO_DATA0);
++	gpio_cfg.reg_dir_in_base = GPIO_REGMAP_ADDR(RTL8231_REG_GPIO_DIR0);
++
++	gpio_cfg.reg_mask_xlate = rtl8231_gpio_reg_mask_xlate;
++
++	return PTR_ERR_OR_ZERO(devm_gpio_regmap_register(dev, &gpio_cfg));
++}
++
++static struct platform_driver rtl8231_pinctrl_driver = {
++	.driver = {
++		.name = "rtl8231-pinctrl",
++	},
++	.probe = rtl8231_pinctrl_probe,
++};
++module_platform_driver(rtl8231_pinctrl_driver);
++
++MODULE_AUTHOR("Sander Vanheule <sander@svanheule.net>");
++MODULE_DESCRIPTION("Realtek RTL8231 pin control and GPIO support");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/realtek/patches-6.6/804-leds-Add-support-for-RTL8231-LED-scan-matrix.patch b/target/linux/realtek/patches-6.6/804-leds-Add-support-for-RTL8231-LED-scan-matrix.patch
new file mode 100644
index 00000000000000..396e544d73c378
--- /dev/null
+++ b/target/linux/realtek/patches-6.6/804-leds-Add-support-for-RTL8231-LED-scan-matrix.patch
@@ -0,0 +1,338 @@
+From 6b797a97c007e46d6081fc6f4b41ce8407078605 Mon Sep 17 00:00:00 2001
+From: Sander Vanheule <sander@svanheule.net>
+Date: Mon, 10 May 2021 22:16:11 +0200
+Subject: [PATCH] leds: Add support for RTL8231 LED scan matrix
+
+Both single and bi-color scanning modes are supported. The driver will
+verify that the addresses are valid for the current mode, before
+registering the LEDs. LEDs can be turned on, off, or toggled at one of
+six predefined rates from 40ms to 1280ms.
+
+Implements a platform device for use as a child device with RTL8231 MFD,
+and uses the parent regmap to access the required registers.
+
+Signed-off-by: Sander Vanheule <sander@svanheule.net>
+---
+ drivers/leds/Kconfig        |  10 ++
+ drivers/leds/Makefile       |   1 +
+ drivers/leds/leds-rtl8231.c | 291 ++++++++++++++++++++++++++++++++++++
+ 3 files changed, 302 insertions(+)
+ create mode 100644 drivers/leds/leds-rtl8231.c
+
+--- a/drivers/leds/Kconfig
++++ b/drivers/leds/Kconfig
+@@ -586,6 +586,16 @@ config LEDS_REGULATOR
+ 	help
+ 	  This option enables support for regulator driven LEDs.
+ 
++config LEDS_RTL8231
++	tristate "RTL8231 LED matrix support"
++	depends on LEDS_CLASS
++	depends on MFD_RTL8231
++	default MFD_RTL8231
++	help
++	  This option enables support for using the LED scanning matrix output
++	  of the RTL8231 GPIO and LED expander chip.
++	  When built as a module, this module will be named leds-rtl8231.
++
+ config LEDS_BD2606MVV
+ 	tristate "LED driver for BD2606MVV"
+ 	depends on LEDS_CLASS
+--- a/drivers/leds/Makefile
++++ b/drivers/leds/Makefile
+@@ -77,6 +77,7 @@ obj-$(CONFIG_LEDS_PM8058)		+= leds-pm805
+ obj-$(CONFIG_LEDS_POWERNV)		+= leds-powernv.o
+ obj-$(CONFIG_LEDS_PWM)			+= leds-pwm.o
+ obj-$(CONFIG_LEDS_REGULATOR)		+= leds-regulator.o
++obj-$(CONFIG_LEDS_RTL8231)		+= leds-rtl8231.o
+ obj-$(CONFIG_LEDS_SC27XX_BLTC)		+= leds-sc27xx-bltc.o
+ obj-$(CONFIG_LEDS_SUNFIRE)		+= leds-sunfire.o
+ obj-$(CONFIG_LEDS_SYSCON)		+= leds-syscon.o
+--- /dev/null
++++ b/drivers/leds/leds-rtl8231.c
+@@ -0,0 +1,285 @@
++// SPDX-License-Identifier: GPL-2.0-only
++
++#include <linux/device.h>
++#include <linux/leds.h>
++#include <linux/mod_devicetable.h>
++#include <linux/module.h>
++#include <linux/platform_device.h>
++#include <linux/property.h>
++#include <linux/regmap.h>
++
++#include <linux/mfd/rtl8231.h>
++
++/**
++ * struct led_toggle_rate - description of an LED blinking mode
++ * @interval_ms:	LED toggle rate in milliseconds
++ * @mode:		Register field value used to activate this mode
++ *
++ * For LED hardware accelerated blinking, with equal on and off delay.
++ * Both delays are given by @interval, so the interval at which the LED blinks
++ * (i.e. turn on and off once) is double this value.
++ */
++struct led_toggle_rate {
++	u16 interval_ms;
++	u8 mode;
++};
++
++/**
++ * struct led_modes - description of all LED modes
++ * @toggle_rates:	Array of led_toggle_rate values, sorted by ascending interval
++ * @num_toggle_rates:	Number of elements in @led_toggle_rate
++ * @off:		Register field value to turn LED off
++ * @on:			Register field value to turn LED on
++ */
++struct led_modes {
++	const struct led_toggle_rate *toggle_rates;
++	unsigned int num_toggle_rates;
++	u8 off;
++	u8 on;
++};
++
++struct rtl8231_led {
++	struct led_classdev led;
++	const struct led_modes *modes;
++	struct regmap_field *reg_field;
++};
++#define to_rtl8231_led(_cdev) container_of(_cdev, struct rtl8231_led, led)
++
++#define RTL8231_NUM_LEDS	3
++#define RTL8231_LED_PER_REG	5
++#define RTL8231_BITS_PER_LED	3
++
++static const unsigned int rtl8231_led_port_counts_single[RTL8231_NUM_LEDS] = {32, 32, 24};
++static const unsigned int rtl8231_led_port_counts_bicolor[RTL8231_NUM_LEDS] = {24, 24, 24};
++
++static const unsigned int rtl8231_led_base[RTL8231_NUM_LEDS] = {
++	RTL8231_REG_LED0_BASE,
++	RTL8231_REG_LED1_BASE,
++	RTL8231_REG_LED2_BASE,
++};
++
++#define RTL8231_DEFAULT_TOGGLE_INTERVAL_MS	500
++
++static const struct led_toggle_rate rtl8231_toggle_rates[] = {
++	{  40, 1},
++	{  80, 2},
++	{ 160, 3},
++	{ 320, 4},
++	{ 640, 5},
++	{1280, 6},
++};
++
++static const struct led_modes rtl8231_led_modes = {
++	.off = 0,
++	.on = 7,
++	.num_toggle_rates = ARRAY_SIZE(rtl8231_toggle_rates),
++	.toggle_rates = rtl8231_toggle_rates,
++};
++
++static void rtl8231_led_brightness_set(struct led_classdev *led_cdev,
++	enum led_brightness brightness)
++{
++	struct rtl8231_led *pled = to_rtl8231_led(led_cdev);
++
++	if (brightness)
++		regmap_field_write(pled->reg_field, pled->modes->on);
++	else
++		regmap_field_write(pled->reg_field, pled->modes->off);
++}
++
++static enum led_brightness rtl8231_led_brightness_get(struct led_classdev *led_cdev)
++{
++	struct rtl8231_led *pled = to_rtl8231_led(led_cdev);
++	u32 current_mode = pled->modes->off;
++
++	regmap_field_read(pled->reg_field, &current_mode);
++
++	if (current_mode == pled->modes->off)
++		return LED_OFF;
++	else
++		return LED_ON;
++}
++
++static unsigned int rtl8231_led_current_interval(struct rtl8231_led *pled)
++{
++	unsigned int mode;
++	unsigned int i;
++
++	if (regmap_field_read(pled->reg_field, &mode))
++		return 0;
++
++	for (i = 0; i < pled->modes->num_toggle_rates; i++)
++		if (mode == pled->modes->toggle_rates[i].mode)
++			return pled->modes->toggle_rates[i].interval_ms;
++
++	return 0;
++}
++
++static int rtl8231_led_blink_set(struct led_classdev *led_cdev, unsigned long *delay_on,
++	unsigned long *delay_off)
++{
++	struct rtl8231_led *pled = to_rtl8231_led(led_cdev);
++	const struct led_toggle_rate *rates = pled->modes->toggle_rates;
++	unsigned int num_rates = pled->modes->num_toggle_rates;
++	unsigned int interval_ms;
++	unsigned int i;
++	int err;
++
++	if (*delay_on == 0 && *delay_off == 0) {
++		interval_ms = RTL8231_DEFAULT_TOGGLE_INTERVAL_MS;
++	} else {
++		/*
++		 * If the current mode is blinking, choose the delay that (likely) changed.
++		 * Otherwise, choose the interval that would have the same total delay.
++		 */
++		interval_ms = rtl8231_led_current_interval(pled);
++		if (interval_ms > 0 && interval_ms == *delay_off)
++			interval_ms = *delay_on;
++		else if (interval_ms > 0 && interval_ms == *delay_on)
++			interval_ms = *delay_off;
++		else
++			interval_ms = (*delay_on + *delay_off) / 2;
++	}
++
++	/* Find clamped toggle interval */
++	for (i = 0; i < (num_rates - 1); i++)
++		if (interval_ms > rates[i].interval_ms)
++			break;
++
++	interval_ms = rates[i].interval_ms;
++
++	err = regmap_field_write(pled->reg_field, rates[i].mode);
++	if (err)
++		return err;
++
++	*delay_on = interval_ms;
++	*delay_off = interval_ms;
++
++	return 0;
++}
++
++static int rtl8231_led_read_address(struct fwnode_handle *fwnode, unsigned int *addr_port,
++	unsigned int *addr_led)
++{
++	u32 addr[2];
++	int err;
++
++	err = fwnode_property_count_u32(fwnode, "reg");
++	if (err < 0)
++		return err;
++	if (err != ARRAY_SIZE(addr))
++		return -EINVAL;
++
++	err = fwnode_property_read_u32_array(fwnode, "reg", addr, ARRAY_SIZE(addr));
++	if (err)
++		return err;
++
++	*addr_port = addr[0];
++	*addr_led = addr[1];
++
++	return 0;
++}
++
++static const struct regmap_field *rtl8231_led_get_field(struct device *dev, struct regmap *map,
++		unsigned int port_index, unsigned int led_index)
++{
++	unsigned int offset = port_index / RTL8231_LED_PER_REG;
++	unsigned int shift = (port_index % RTL8231_LED_PER_REG) * RTL8231_BITS_PER_LED;
++	const struct reg_field field = REG_FIELD(rtl8231_led_base[led_index] + offset, shift,
++			shift + RTL8231_BITS_PER_LED - 1);
++
++	return devm_regmap_field_alloc(dev, map, field);
++}
++
++static int rtl8231_led_probe_single(struct device *dev, struct regmap *map,
++	const unsigned int *port_counts, struct fwnode_handle *fwnode)
++{
++	struct led_init_data init_data = {};
++	struct rtl8231_led *pled;
++	unsigned int port_index;
++	unsigned int led_index;
++	int err;
++
++	pled = devm_kzalloc(dev, sizeof(*pled), GFP_KERNEL);
++	if (!pled)
++		return -ENOMEM;
++
++	err = rtl8231_led_read_address(fwnode, &port_index, &led_index);
++	if (err) {
++		dev_err(dev, "LED address invalid");
++		return err;
++	}
++
++	if (led_index >= RTL8231_NUM_LEDS || port_index >= port_counts[led_index]) {
++		dev_err(dev, "LED address (%d.%d) invalid", port_index, led_index);
++		return -EINVAL;
++	}
++
++	pled->reg_field = rtl8231_led_get_field(dev, map, port_index, led_index);
++	if (IS_ERR(pled->reg_field))
++		return PTR_ERR(pled->reg_field);
++
++	pled->modes = &rtl8231_led_modes;
++
++	pled->led.max_brightness = 1;
++	pled->led.brightness_get = rtl8231_led_brightness_get;
++	pled->led.brightness_set = rtl8231_led_brightness_set;
++	pled->led.blink_set = rtl8231_led_blink_set;
++
++	init_data.fwnode = fwnode;
++
++	return devm_led_classdev_register_ext(dev, &pled->led, &init_data);
++}
++
++static int rtl8231_led_probe(struct platform_device *pdev)
++{
++	struct device *dev = &pdev->dev;
++	const unsigned int *port_counts;
++	struct fwnode_handle *child;
++	struct regmap *map;
++	int err;
++
++	map = dev_get_regmap(dev->parent, NULL);
++	if (!map)
++		return -ENODEV;
++
++	if (device_property_match_string(dev, "realtek,led-scan-mode", "single-color") >= 0) {
++		port_counts = rtl8231_led_port_counts_single;
++		regmap_update_bits(map, RTL8231_REG_FUNC0,
++			RTL8231_FUNC0_SCAN_MODE, RTL8231_FUNC0_SCAN_SINGLE);
++	} else if (device_property_match_string(dev, "realtek,led-scan-mode", "bi-color") >= 0) {
++		port_counts = rtl8231_led_port_counts_bicolor;
++		regmap_update_bits(map, RTL8231_REG_FUNC0,
++			RTL8231_FUNC0_SCAN_MODE, RTL8231_FUNC0_SCAN_BICOLOR);
++	} else {
++		dev_err(dev, "scan mode missing or invalid");
++		return -EINVAL;
++	}
++
++	fwnode_for_each_available_child_node(dev->fwnode, child) {
++		err = rtl8231_led_probe_single(dev, map, port_counts, child);
++		if (err)
++			dev_warn(dev, "failed to register LED %pfwP", child);
++	}
++
++	return 0;
++}
++
++static const struct of_device_id of_rtl8231_led_match[] = {
++	{ .compatible = "realtek,rtl8231-leds" },
++	{}
++};
++MODULE_DEVICE_TABLE(of, of_rtl8231_led_match);
++
++static struct platform_driver rtl8231_led_driver = {
++	.driver = {
++		.name = "rtl8231-leds",
++		.of_match_table = of_rtl8231_led_match,
++	},
++	.probe = rtl8231_led_probe,
++};
++module_platform_driver(rtl8231_led_driver);
++
++MODULE_AUTHOR("Sander Vanheule <sander@svanheule.net>");
++MODULE_DESCRIPTION("Realtek RTL8231 LED support");
++MODULE_LICENSE("GPL");
diff --git a/target/linux/realtek/rtl838x/config-6.6 b/target/linux/realtek/rtl838x/config-6.6
index ad2c1b43cce8d7..c93a8c7878e71c 100644
--- a/target/linux/realtek/rtl838x/config-6.6
+++ b/target/linux/realtek/rtl838x/config-6.6
@@ -87,7 +87,7 @@ CONFIG_GPIO_GENERIC=y
 CONFIG_GPIO_PCA953X=y
 CONFIG_GPIO_PCA953X_IRQ=y
 CONFIG_GPIO_REALTEK_OTTO=y
-CONFIG_GPIO_RTL8231=y
+CONFIG_GPIO_REGMAP=y
 CONFIG_GPIO_WATCHDOG=y
 # CONFIG_GPIO_WATCHDOG_ARCH_INITCALL is not set
 CONFIG_GRO_CELLS=y
@@ -114,15 +114,22 @@ CONFIG_IRQ_MIPS_CPU=y
 CONFIG_IRQ_WORK=y
 CONFIG_JFFS2_ZLIB=y
 CONFIG_LEDS_GPIO=y
+# CONFIG_LEDS_RTL8231 is not set
 CONFIG_LIBFDT=y
 CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_MACH_REALTEK_RTL=y
 CONFIG_MARVELL_PHY=y
+CONFIG_MDIO_BITBANG=y
 CONFIG_MDIO_BUS=y
 CONFIG_MDIO_DEVICE=y
 CONFIG_MDIO_DEVRES=y
+CONFIG_MDIO_GPIO=y
 CONFIG_MDIO_I2C=y
+CONFIG_MDIO_REALTEK_OTTO_AUX=y
 CONFIG_MDIO_SMBUS=y
 CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_CORE=y
+CONFIG_MFD_RTL8231=y
 CONFIG_MFD_SYSCON=y
 CONFIG_MIGRATION=y
 CONFIG_MIPS=y
@@ -176,6 +183,7 @@ CONFIG_PGTABLE_LEVELS=2
 CONFIG_PHYLIB=y
 CONFIG_PHYLINK=y
 CONFIG_PINCTRL=y
+CONFIG_PINCTRL_RTL8231=y
 CONFIG_PM_OPP=y
 CONFIG_POWER_RESET=y
 CONFIG_POWER_RESET_GPIO_RESTART=y
@@ -185,14 +193,15 @@ CONFIG_RATIONAL=y
 CONFIG_REALTEK_OTTO_TIMER=y
 CONFIG_REALTEK_OTTO_WDT=y
 CONFIG_REALTEK_PHY=y
+CONFIG_REALTEK_PHY_HWMON=y
 CONFIG_REALTEK_SOC_PHY=y
 CONFIG_REGMAP=y
 CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MDIO=y
 CONFIG_REGMAP_MMIO=y
 CONFIG_RESET_CONTROLLER=y
 CONFIG_RTL838X=y
 # CONFIG_RTL839X is not set
-CONFIG_RTL83XX=y
 # CONFIG_RTL930X is not set
 CONFIG_SERIAL_MCTRL_GPIO=y
 CONFIG_SERIAL_OF_PLATFORM=y
diff --git a/target/linux/realtek/rtl839x/config-6.6 b/target/linux/realtek/rtl839x/config-6.6
index a357eb39666015..e10730ac875606 100644
--- a/target/linux/realtek/rtl839x/config-6.6
+++ b/target/linux/realtek/rtl839x/config-6.6
@@ -87,7 +87,7 @@ CONFIG_GPIO_GENERIC=y
 CONFIG_GPIO_PCA953X=y
 CONFIG_GPIO_PCA953X_IRQ=y
 CONFIG_GPIO_REALTEK_OTTO=y
-CONFIG_GPIO_RTL8231=y
+CONFIG_GPIO_REGMAP=y
 CONFIG_GPIO_WATCHDOG=y
 # CONFIG_GPIO_WATCHDOG_ARCH_INITCALL is not set
 CONFIG_GRO_CELLS=y
@@ -113,15 +113,20 @@ CONFIG_IRQ_MIPS_CPU=y
 CONFIG_IRQ_WORK=y
 CONFIG_JFFS2_ZLIB=y
 CONFIG_LEDS_GPIO=y
+# CONFIG_LEDS_RTL8231 is not set
 CONFIG_LIBFDT=y
 CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_MACH_REALTEK_RTL=y
 CONFIG_MARVELL_PHY=y
 CONFIG_MDIO_BUS=y
 CONFIG_MDIO_DEVICE=y
 CONFIG_MDIO_DEVRES=y
 CONFIG_MDIO_I2C=y
+CONFIG_MDIO_REALTEK_OTTO_AUX=y
 CONFIG_MDIO_SMBUS=y
 CONFIG_MEMFD_CREATE=y
+CONFIG_MFD_CORE=y
+CONFIG_MFD_RTL8231=y
 CONFIG_MFD_SYSCON=y
 CONFIG_MIGRATION=y
 CONFIG_MIPS=y
@@ -184,6 +189,7 @@ CONFIG_PGTABLE_LEVELS=2
 CONFIG_PHYLIB=y
 CONFIG_PHYLINK=y
 CONFIG_PINCTRL=y
+CONFIG_PINCTRL_RTL8231=y
 CONFIG_PM_OPP=y
 CONFIG_POWER_RESET=y
 CONFIG_POWER_RESET_GPIO_RESTART=y
@@ -195,16 +201,17 @@ CONFIG_RATIONAL=y
 CONFIG_REALTEK_OTTO_TIMER=y
 CONFIG_REALTEK_OTTO_WDT=y
 CONFIG_REALTEK_PHY=y
+CONFIG_REALTEK_PHY_HWMON=y
 CONFIG_REALTEK_SOC_PHY=y
 CONFIG_REGMAP=y
 CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MDIO=y
 CONFIG_REGMAP_MMIO=y
 CONFIG_RESET_CONTROLLER=y
 CONFIG_RFS_ACCEL=y
 CONFIG_RPS=y
 # CONFIG_RTL838X is not set
 CONFIG_RTL839X=y
-CONFIG_RTL83XX=y
 # CONFIG_RTL930X is not set
 CONFIG_SERIAL_MCTRL_GPIO=y
 CONFIG_SERIAL_OF_PLATFORM=y
diff --git a/target/linux/realtek/rtl930x/config-6.6 b/target/linux/realtek/rtl930x/config-6.6
index af5f2ca7a313b4..c0f3b39c41879d 100644
--- a/target/linux/realtek/rtl930x/config-6.6
+++ b/target/linux/realtek/rtl930x/config-6.6
@@ -69,7 +69,6 @@ CONFIG_GPIO_CDEV=y
 CONFIG_GPIO_GENERIC=y
 CONFIG_GPIO_PCA953X=y
 CONFIG_GPIO_REALTEK_OTTO=y
-CONFIG_GPIO_RTL8231=y
 CONFIG_GRO_CELLS=y
 CONFIG_HANDLE_DOMAIN_IRQ=y
 CONFIG_HARDWARE_WATCHPOINTS=y
@@ -97,13 +96,16 @@ CONFIG_JFFS2_ZLIB=y
 CONFIG_LEDS_GPIO=y
 CONFIG_LIBFDT=y
 CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_MACH_REALTEK_RTL=y
 CONFIG_MARVELL_PHY=y
 CONFIG_MDIO_BUS=y
 CONFIG_MDIO_DEVICE=y
 CONFIG_MDIO_DEVRES=y
 CONFIG_MDIO_I2C=y
+# CONFIG_MDIO_REALTEK_OTTO_AUX is not set
 CONFIG_MDIO_SMBUS=y
 CONFIG_MEMFD_CREATE=y
+# CONFIG_MFD_RTL8231 is not set
 CONFIG_MFD_SYSCON=y
 CONFIG_MIGRATION=y
 CONFIG_MIPS=y
@@ -165,6 +167,7 @@ CONFIG_RATIONAL=y
 CONFIG_REALTEK_OTTO_TIMER=y
 CONFIG_REALTEK_OTTO_WDT=y
 CONFIG_REALTEK_PHY=y
+CONFIG_REALTEK_PHY_HWMON=y
 CONFIG_REALTEK_SOC_PHY=y
 CONFIG_REGMAP=y
 CONFIG_REGMAP_I2C=y
@@ -172,7 +175,6 @@ CONFIG_REGMAP_MMIO=y
 CONFIG_RESET_CONTROLLER=y
 # CONFIG_RTL838X is not set
 # CONFIG_RTL839X is not set
-CONFIG_RTL83XX=y
 CONFIG_RTL930X=y
 # CONFIG_RTL931X is not set
 CONFIG_SERIAL_MCTRL_GPIO=y
diff --git a/target/linux/realtek/rtl931x/config-6.6 b/target/linux/realtek/rtl931x/config-6.6
index 736f4720296d8c..255ff9b2a0af5b 100644
--- a/target/linux/realtek/rtl931x/config-6.6
+++ b/target/linux/realtek/rtl931x/config-6.6
@@ -75,7 +75,6 @@ CONFIG_GPIOLIB_IRQCHIP=y
 CONFIG_GPIO_CDEV=y
 CONFIG_GPIO_GENERIC=y
 CONFIG_GPIO_REALTEK_OTTO=y
-CONFIG_GPIO_RTL8231=y
 CONFIG_GRO_CELLS=y
 CONFIG_HANDLE_DOMAIN_IRQ=y
 CONFIG_HARDWARE_WATCHPOINTS=y
@@ -106,13 +105,16 @@ CONFIG_KMAP_LOCAL=y
 CONFIG_LEDS_GPIO=y
 CONFIG_LIBFDT=y
 CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_MACH_REALTEK_RTL=y
 CONFIG_MARVELL_PHY=y
 CONFIG_MDIO_BUS=y
 CONFIG_MDIO_DEVICE=y
 CONFIG_MDIO_DEVRES=y
 CONFIG_MDIO_I2C=y
+# CONFIG_MDIO_REALTEK_OTTO_AUX is not set
 CONFIG_MDIO_SMBUS=y
 CONFIG_MEMFD_CREATE=y
+# CONFIG_MFD_RTL8231 is not set
 CONFIG_MFD_SYSCON=y
 CONFIG_MIGRATION=y
 CONFIG_MIPS=y
@@ -195,7 +197,6 @@ CONFIG_RFS_ACCEL=y
 CONFIG_RPS=y
 # CONFIG_RTL838X is not set
 # CONFIG_RTL839X is not set
-CONFIG_RTL83XX=y
 CONFIG_RTL930X=y
 CONFIG_RTL931X=y
 CONFIG_SENSORS_GPIO_FAN=y
diff --git a/target/linux/rockchip/armv8/base-files/etc/hotplug.d/net/40-net-smp-affinity b/target/linux/rockchip/armv8/base-files/etc/hotplug.d/net/40-net-smp-affinity
index 27d469bb47432a..f5cdd9be8a79f9 100644
--- a/target/linux/rockchip/armv8/base-files/etc/hotplug.d/net/40-net-smp-affinity
+++ b/target/linux/rockchip/armv8/base-files/etc/hotplug.d/net/40-net-smp-affinity
@@ -30,10 +30,8 @@ set_interface_core() {
 
 case "$(board_name)" in
 armsom,sige7|\
-friendlyarm,nanopc-t6|\
 friendlyarm,nanopi-r3s|\
 friendlyarm,nanopi-r5c|\
-friendlyarm,nanopi-r6c|\
 radxa,e25|\
 sinovoip,rk3568-bpi-r2pro)
 	set_interface_core 2 "eth0"
@@ -49,15 +47,21 @@ xunlong,orangepi-r1-plus-lts)
 	set_interface_core 4 "eth1" "xhci-hcd:usb[0-9]+"
 	;;
 friendlyarm,nanopi-r4s|\
-friendlyarm,nanopi-r4s-enterprise)
+friendlyarm,nanopi-r4s-enterprise|\
+friendlyarm,nanopi-r6c|\
+friendlyarm,nanopc-t6)
 	set_interface_core 10 "eth0"
 	set_interface_core 20 "eth1"
 	;;
-friendlyarm,nanopi-r5s|\
-friendlyarm,nanopi-r6s)
+friendlyarm,nanopi-r5s)
 	set_interface_core 2 "eth0"
 	set_interface_core 4 "eth1"
 	set_interface_core 8 "eth2"
 	;;
+friendlyarm,nanopi-r6s)
+	set_interface_core 10 "eth0"
+	set_interface_core 20 "eth1"
+	set_interface_core 40 "eth2"
+	;;
 esac
 
diff --git a/target/linux/rockchip/armv8/config-6.6 b/target/linux/rockchip/armv8/config-6.6
index fddc85f9d723a1..ec53273a2b5429 100644
--- a/target/linux/rockchip/armv8/config-6.6
+++ b/target/linux/rockchip/armv8/config-6.6
@@ -51,7 +51,6 @@ CONFIG_ARM64_PA_BITS_48=y
 CONFIG_ARM64_PTR_AUTH=y
 CONFIG_ARM64_PTR_AUTH_KERNEL=y
 CONFIG_ARM64_RAS_EXTN=y
-CONFIG_ARM64_SME=y
 CONFIG_ARM64_SVE=y
 CONFIG_ARM64_TAGGED_ADDR_ABI=y
 CONFIG_ARM64_VA_BITS=48
@@ -78,6 +77,7 @@ CONFIG_ARM_PSCI_CPUIDLE_DOMAIN=y
 CONFIG_ARM_PSCI_FW=y
 # CONFIG_ARM_RK3399_DMC_DEVFREQ is not set
 CONFIG_ARM_SCMI_CPUFREQ=y
+# CONFIG_ARM_SCMI_DEBUG_COUNTERS is not set
 CONFIG_ARM_SCMI_HAVE_SHMEM=y
 CONFIG_ARM_SCMI_HAVE_TRANSPORT=y
 CONFIG_ARM_SCMI_POWER_CONTROL=y
@@ -118,8 +118,6 @@ CONFIG_BUFFER_HEAD=y
 CONFIG_BUILTIN_RETURN_ADDRESS_STRIPS_PAC=y
 CONFIG_CC_HAVE_SHADOW_CALL_STACK=y
 CONFIG_CC_HAVE_STACKPROTECTOR_SYSREG=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CHARGER_GPIO=y
 # CONFIG_CHARGER_RK817 is not set
 CONFIG_CLKSRC_MMIO=y
@@ -179,8 +177,6 @@ CONFIG_CPU_THERMAL=y
 CONFIG_CRASH_CORE=y
 CONFIG_CRASH_DUMP=y
 CONFIG_CRC16=y
-# CONFIG_CRC32_SARWATE is not set
-CONFIG_CRC32_SLICEBY8=y
 CONFIG_CRC64=y
 CONFIG_CRC64_ROCKSOFT=y
 CONFIG_CRC_T10DIF=y
@@ -259,8 +255,6 @@ CONFIG_FUNCTION_ALIGNMENT_4B=y
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
-CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_GCC_SUPPORTS_DYNAMIC_FTRACE_WITH_ARGS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
@@ -533,12 +527,7 @@ CONFIG_POWER_RESET=y
 CONFIG_POWER_SUPPLY=y
 CONFIG_POWER_SUPPLY_HWMON=y
 CONFIG_PPS=y
-CONFIG_PREEMPT=y
-CONFIG_PREEMPTION=y
-CONFIG_PREEMPT_BUILD=y
-CONFIG_PREEMPT_COUNT=y
-# CONFIG_PREEMPT_NONE is not set
-CONFIG_PREEMPT_RCU=y
+CONFIG_PREEMPT_NONE_BUILD=y
 CONFIG_PRINTK_TIME=y
 CONFIG_PROC_PAGE_MONITOR=y
 CONFIG_PROC_VMCORE=y
@@ -559,6 +548,7 @@ CONFIG_RATIONAL=y
 # CONFIG_RAVE_SP_CORE is not set
 CONFIG_RCU_TRACE=y
 CONFIG_REALTEK_PHY=y
+CONFIG_REALTEK_PHY_HWMON=y
 CONFIG_REGMAP=y
 CONFIG_REGMAP_I2C=y
 CONFIG_REGMAP_IRQ=y
@@ -575,6 +565,7 @@ CONFIG_RELOCATABLE=y
 CONFIG_RESET_CONTROLLER=y
 CONFIG_RESET_SCMI=y
 CONFIG_RFS_ACCEL=y
+CONFIG_ROCKCHIP_ERRATUM_3568002=y
 CONFIG_ROCKCHIP_ERRATUM_3588001=y
 CONFIG_ROCKCHIP_GRF=y
 CONFIG_ROCKCHIP_IODOMAIN=y
@@ -612,10 +603,10 @@ CONFIG_SERIAL_8250_DWLIB=y
 CONFIG_SERIAL_8250_EXAR=y
 CONFIG_SERIAL_8250_EXTENDED=y
 CONFIG_SERIAL_8250_FSL=y
-CONFIG_SERIAL_8250_NR_UARTS=4
+CONFIG_SERIAL_8250_NR_UARTS=10
 CONFIG_SERIAL_8250_PCI=y
 CONFIG_SERIAL_8250_PCILIB=y
-CONFIG_SERIAL_8250_RUNTIME_UARTS=4
+CONFIG_SERIAL_8250_RUNTIME_UARTS=10
 CONFIG_SERIAL_8250_SHARE_IRQ=y
 CONFIG_SERIAL_AMBA_PL011=y
 CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
@@ -699,7 +690,6 @@ CONFIG_TYPEC_TCPM=y
 # CONFIG_TYPEC_WUSB3801 is not set
 # CONFIG_UCLAMP_TASK is not set
 # CONFIG_UEVENT_HELPER is not set
-CONFIG_UNINLINE_SPIN_UNLOCK=y
 CONFIG_UNMAP_KERNEL_AT_EL0=y
 CONFIG_USB=y
 CONFIG_USB_COMMON=y
diff --git a/target/linux/rockchip/image/armv8.mk b/target/linux/rockchip/image/armv8.mk
index 1c81005f8ea623..54ce6f771e0c82 100644
--- a/target/linux/rockchip/image/armv8.mk
+++ b/target/linux/rockchip/image/armv8.mk
@@ -183,6 +183,20 @@ define Device/radxa_rock-3c
 endef
 TARGET_DEVICES += radxa_rock-3c
 
+define Device/radxa_rock-4c-plus
+  DEVICE_VENDOR := Radxa
+  DEVICE_MODEL := ROCK 4C+
+  SOC := rk3399
+endef
+TARGET_DEVICES += radxa_rock-4c-plus
+
+define Device/radxa_rock-4se
+  DEVICE_VENDOR := Radxa
+  DEVICE_MODEL := ROCK 4SE
+  SOC := rk3399
+endef
+TARGET_DEVICES += radxa_rock-4se
+
 define Device/radxa_rock-5a
   DEVICE_VENDOR := Radxa
   DEVICE_MODEL := ROCK 5A
@@ -222,7 +236,7 @@ define Device/radxa_rock-pi-e-v3
   DEVICE_MODEL := ROCK Pi E v3.0
   SOC := rk3328
   DEVICE_DTS := rockchip/rk3328-rock-pi-e
-  DEVICE_PACKAGES := kmod-rtw88-8723du kmod-usb-net-cdc-ncm kmod-usb-net-rndis wpad-basic-mbedtls
+  DEVICE_PACKAGES := kmod-rtw88-8723du kmod-rtw88-8821cu kmod-usb-net-cdc-ncm kmod-usb-net-rndis wpad-basic-mbedtls
 endef
 TARGET_DEVICES += radxa_rock-pi-e-v3
 
diff --git a/target/linux/rockchip/patches-6.6/009-v6.10-arm64-dts-rockchip-Add-Radxa-ROCK-3C.patch b/target/linux/rockchip/patches-6.6/009-v6.10-arm64-dts-rockchip-Add-Radxa-ROCK-3C.patch
index 9901d9fff04d6b..164b65bdf5d876 100644
--- a/target/linux/rockchip/patches-6.6/009-v6.10-arm64-dts-rockchip-Add-Radxa-ROCK-3C.patch
+++ b/target/linux/rockchip/patches-6.6/009-v6.10-arm64-dts-rockchip-Add-Radxa-ROCK-3C.patch
@@ -30,7 +30,7 @@ Signed-off-by: Heiko Stuebner <heiko@sntech.de>
 
 --- a/arch/arm64/boot/dts/rockchip/Makefile
 +++ b/arch/arm64/boot/dts/rockchip/Makefile
-@@ -81,6 +81,7 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3566-qu
+@@ -82,6 +82,7 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3566-qu
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3566-quartz64-b.dtb
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3566-radxa-cm3-io.dtb
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3566-roc-pc.dtb
diff --git a/target/linux/rockchip/patches-6.6/011-v6.11-arm64-dts-rockchip-Add-Radxa-ZERO-3W-3E.patch b/target/linux/rockchip/patches-6.6/011-v6.11-arm64-dts-rockchip-Add-Radxa-ZERO-3W-3E.patch
index 746078cf9e226f..19e6377ad1dab3 100644
--- a/target/linux/rockchip/patches-6.6/011-v6.11-arm64-dts-rockchip-Add-Radxa-ZERO-3W-3E.patch
+++ b/target/linux/rockchip/patches-6.6/011-v6.11-arm64-dts-rockchip-Add-Radxa-ZERO-3W-3E.patch
@@ -32,7 +32,7 @@ Signed-off-by: Heiko Stuebner <heiko@sntech.de>
 
 --- a/arch/arm64/boot/dts/rockchip/Makefile
 +++ b/arch/arm64/boot/dts/rockchip/Makefile
-@@ -80,6 +80,8 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3566-pi
+@@ -81,6 +81,8 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3566-pi
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3566-quartz64-a.dtb
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3566-quartz64-b.dtb
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3566-radxa-cm3-io.dtb
diff --git a/target/linux/rockchip/patches-6.6/014-v6.11-arm64-dts-rockchip-Add-Radxa-ROCK-3B.patch b/target/linux/rockchip/patches-6.6/014-v6.11-arm64-dts-rockchip-Add-Radxa-ROCK-3B.patch
index e93a055c3ef0f0..4b2897f5249802 100644
--- a/target/linux/rockchip/patches-6.6/014-v6.11-arm64-dts-rockchip-Add-Radxa-ROCK-3B.patch
+++ b/target/linux/rockchip/patches-6.6/014-v6.11-arm64-dts-rockchip-Add-Radxa-ROCK-3B.patch
@@ -21,7 +21,7 @@ Signed-off-by: Heiko Stuebner <heiko@sntech.de>
 
 --- a/arch/arm64/boot/dts/rockchip/Makefile
 +++ b/arch/arm64/boot/dts/rockchip/Makefile
-@@ -100,6 +100,7 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3568-od
+@@ -101,6 +101,7 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3568-od
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3568-radxa-e25.dtb
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3568-roc-pc.dtb
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3568-rock-3a.dtb
diff --git a/target/linux/rockchip/patches-6.6/300-hwrng-add-hwrng-driver-for-Rockchip-RK3568-SoC.patch b/target/linux/rockchip/patches-6.6/016-v6.12-hwrng-rockchip-add-hwrng-driver-for-Rockchip-RK3568-.patch
similarity index 89%
rename from target/linux/rockchip/patches-6.6/300-hwrng-add-hwrng-driver-for-Rockchip-RK3568-SoC.patch
rename to target/linux/rockchip/patches-6.6/016-v6.12-hwrng-rockchip-add-hwrng-driver-for-Rockchip-RK3568-.patch
index 683d1b1d5e51c9..7eed8cc877446d 100644
--- a/target/linux/rockchip/patches-6.6/300-hwrng-add-hwrng-driver-for-Rockchip-RK3568-SoC.patch
+++ b/target/linux/rockchip/patches-6.6/016-v6.12-hwrng-rockchip-add-hwrng-driver-for-Rockchip-RK3568-.patch
@@ -1,7 +1,7 @@
-From cea47ad1fbd46d3096fcf5c6905db3d12b5da960 Mon Sep 17 00:00:00 2001
+From dcf4fef6631c302f9bdd188979fe3172e47a29c7 Mon Sep 17 00:00:00 2001
 From: Aurelien Jarno <aurelien@aurel32.net>
-Date: Sun, 21 Jul 2024 01:48:04 +0100
-Subject: [PATCH 2/3] hwrng: add hwrng driver for Rockchip RK3568 SoC
+Date: Tue, 30 Jul 2024 17:11:04 +0100
+Subject: [PATCH] hwrng: rockchip - add hwrng driver for Rockchip RK3568 SoC
 
 Rockchip SoCs used to have a random number generator as part of their
 crypto device, and support for it has to be added to the corresponding
@@ -11,17 +11,21 @@ greatly inspired from the downstream driver.
 
 The TRNG device does not seem to have a signal conditionner and the FIPS
 140-2 test returns a lot of failures. They can be reduced by increasing
-rockchip,sample-count in DT, in a tradeoff between quality and speed.
+RK_RNG_SAMPLE_CNT, in a tradeoff between quality and speed. This value
+has been adjusted to get ~90% of successes and the quality value has
+been set accordingly.
 
 Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
-[daniel@makrotpia.org: code style fixes, add DT properties]
+[daniel@makrotpia.org: code style fixes]
 Signed-off-by: Daniel Golle <daniel@makrotopia.org>
 Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
 ---
+ MAINTAINERS                           |   1 +
  drivers/char/hw_random/Kconfig        |  14 ++
  drivers/char/hw_random/Makefile       |   1 +
- drivers/char/hw_random/rockchip-rng.c | 230 ++++++++++++++++++++++++++
- 4 files changed, 246 insertions(+)
+ drivers/char/hw_random/rockchip-rng.c | 227 ++++++++++++++++++++++++++
+ 4 files changed, 243 insertions(+)
  create mode 100644 drivers/char/hw_random/rockchip-rng.c
 
 --- a/drivers/char/hw_random/Kconfig
@@ -57,7 +61,7 @@ Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
  obj-$(CONFIG_HW_RANDOM_JH7110) += jh7110-trng.o
 --- /dev/null
 +++ b/drivers/char/hw_random/rockchip-rng.c
-@@ -0,0 +1,230 @@
+@@ -0,0 +1,227 @@
 +// SPDX-License-Identifier: GPL-2.0
 +/*
 + * rockchip-rng.c True Random Number Generator driver for Rockchip RK3568 SoC
@@ -85,6 +89,13 @@ Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
 +#define RK_RNG_POLL_PERIOD_US		100
 +#define RK_RNG_POLL_TIMEOUT_US		10000
 +
++/*
++ * TRNG collects osc ring output bit every RK_RNG_SAMPLE_CNT time. The value is
++ * a tradeoff between speed and quality and has been adjusted to get a quality
++ * of ~900 (~87.5% of FIPS 140-2 successes).
++ */
++#define RK_RNG_SAMPLE_CNT		1000
++
 +/* TRNG registers from RK3568 TRM-Part2, section 5.4.1 */
 +#define TRNG_RST_CTL			0x0004
 +#define TRNG_RNG_CTL			0x0400
@@ -108,7 +119,6 @@ Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
 +	struct reset_control *rst;
 +	int clk_num;
 +	struct clk_bulk_data *clk_bulks;
-+	u32 sample_cnt;
 +};
 +
 +/* The mask in the upper 16 bits determines the bits that are updated */
@@ -131,7 +141,7 @@ Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
 +	}
 +
 +	/* set the sample period */
-+	writel(rk_rng->sample_cnt, rk_rng->base + TRNG_RNG_SAMPLE_CNT);
++	writel(RK_RNG_SAMPLE_CNT, rk_rng->base + TRNG_RNG_SAMPLE_CNT);
 +
 +	/* set osc ring speed and enable it */
 +	rk_rng_write_ctl(rk_rng, TRNG_RNG_CTL_LEN_256_BIT |
@@ -187,7 +197,6 @@ Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
 +{
 +	struct device *dev = &pdev->dev;
 +	struct rk_rng *rk_rng;
-+	u32 quality;
 +	int ret;
 +
 +	rk_rng = devm_kzalloc(dev, sizeof(*rk_rng), GFP_KERNEL);
@@ -208,14 +217,6 @@ Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
 +		return dev_err_probe(dev, PTR_ERR(rk_rng->rst),
 +				     "Failed to get reset property\n");
 +
-+	ret = of_property_read_u32(dev->of_node, "rockchip,sample-count", &rk_rng->sample_cnt);
-+	if (ret)
-+		return dev_err_probe(dev, ret, "Failed to get sample-count property\n");
-+
-+	ret = of_property_read_u32(dev->of_node, "quality", &quality);
-+	if (ret || quality > 1024)
-+		return dev_err_probe(dev, ret, "Failed to get quality property\n");
-+
 +	reset_control_assert(rk_rng->rst);
 +	udelay(2);
 +	reset_control_deassert(rk_rng->rst);
@@ -229,7 +230,7 @@ Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
 +	}
 +	rk_rng->rng.read = rk_rng_read;
 +	rk_rng->rng.priv = (unsigned long) dev;
-+	rk_rng->rng.quality = quality;
++	rk_rng->rng.quality = 900;
 +
 +	pm_runtime_set_autosuspend_delay(dev, RK_RNG_AUTOSUSPEND_DELAY);
 +	pm_runtime_use_autosuspend(dev);
diff --git a/target/linux/rockchip/patches-6.6/301-arm64-dts-rockchip-add-DT-entry-for-RNG-to-RK3568.patch b/target/linux/rockchip/patches-6.6/017-v6.12-arm64-dts-rockchip-add-DT-entry-for-RNG-to-RK356x.patch
similarity index 65%
rename from target/linux/rockchip/patches-6.6/301-arm64-dts-rockchip-add-DT-entry-for-RNG-to-RK3568.patch
rename to target/linux/rockchip/patches-6.6/017-v6.12-arm64-dts-rockchip-add-DT-entry-for-RNG-to-RK356x.patch
index 130bf6723cce9f..bd25881f6b6368 100644
--- a/target/linux/rockchip/patches-6.6/301-arm64-dts-rockchip-add-DT-entry-for-RNG-to-RK3568.patch
+++ b/target/linux/rockchip/patches-6.6/017-v6.12-arm64-dts-rockchip-add-DT-entry-for-RNG-to-RK356x.patch
@@ -1,27 +1,27 @@
-From 756e7d3251ad8f6c72e7bf4c476537a89f673e38 Mon Sep 17 00:00:00 2001
+From afeccc4084963aaa932931b734c8def55613c483 Mon Sep 17 00:00:00 2001
 From: Aurelien Jarno <aurelien@aurel32.net>
-Date: Sun, 21 Jul 2024 01:48:38 +0100
-Subject: [PATCH 3/3] arm64: dts: rockchip: add DT entry for RNG to RK356x
+Date: Tue, 30 Jul 2024 17:11:44 +0100
+Subject: [PATCH] arm64: dts: rockchip: add DT entry for RNG to RK356x
 
-Enable the just added Rockchip RNG driver for RK356x SoCs.
+Include the just added Rockchip RNG driver for RK356x SoCs and
+enable it on RK3568.
 
 Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
 Signed-off-by: Daniel Golle <daniel@makrotopia.org>
+Link: https://lore.kernel.org/r/d2beb15377dc8b580ca5557b1a4a6f50b74055aa.1722355365.git.daniel@makrotopia.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
 ---
- arch/arm64/boot/dts/rockchip/rk3568.dtsi |  7 +++++++
+ arch/arm64/boot/dts/rockchip/rk3568.dtsi |  4 ++++
  arch/arm64/boot/dts/rockchip/rk356x.dtsi | 10 ++++++++++
- 2 files changed, 17 insertions(+)
+ 2 files changed, 14 insertions(+)
 
 --- a/arch/arm64/boot/dts/rockchip/rk3568.dtsi
 +++ b/arch/arm64/boot/dts/rockchip/rk3568.dtsi
-@@ -257,6 +257,13 @@
+@@ -257,6 +257,10 @@
  	};
  };
  
 +&rng {
-+	rockchip,sample-count = <1000>;
-+	quality = <900>;
-+
 +	status = "okay";
 +};
 +
diff --git a/target/linux/rockchip/patches-6.6/018-v6.12-arm64-dts-rockchip-drop-obsolete-reset-names-from-rk.patch b/target/linux/rockchip/patches-6.6/018-v6.12-arm64-dts-rockchip-drop-obsolete-reset-names-from-rk.patch
new file mode 100644
index 00000000000000..14fcf50c22d25d
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/018-v6.12-arm64-dts-rockchip-drop-obsolete-reset-names-from-rk.patch
@@ -0,0 +1,28 @@
+From ec532f3591ce6e6ed5ec6c35773a66aae118e1f0 Mon Sep 17 00:00:00 2001
+From: Heiko Stuebner <heiko@sntech.de>
+Date: Thu, 15 Aug 2024 18:25:19 +0200
+Subject: [PATCH] arm64: dts: rockchip: drop obsolete reset-names from rk356x
+ rng node
+
+The reset-names property is not part of the binding, so drop it.
+It is also not used by the driver, so that property was likely
+a leftover from some vendor-kernel node.
+
+Fixes: afeccc408496 ("arm64: dts: rockchip: add DT entry for RNG to RK356x")
+Reported-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Link: https://lore.kernel.org/r/20240815162519.751193-1-heiko@sntech.de
+---
+ arch/arm64/boot/dts/rockchip/rk356x.dtsi | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/rockchip/rk356x.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk356x.dtsi
+@@ -1112,7 +1112,6 @@
+ 		clocks = <&cru CLK_TRNG_NS>, <&cru HCLK_TRNG_NS>;
+ 		clock-names = "core", "ahb";
+ 		resets = <&cru SRST_TRNG_NS>;
+-		reset-names = "reset";
+ 		status = "disabled";
+ 	};
+ 
diff --git a/target/linux/rockchip/patches-6.6/019-v6.13-arm64-dts-rockchip-add-reset-names-for-combphy-on-rk.patch b/target/linux/rockchip/patches-6.6/019-v6.13-arm64-dts-rockchip-add-reset-names-for-combphy-on-rk.patch
new file mode 100644
index 00000000000000..e98db5ffec5ad1
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/019-v6.13-arm64-dts-rockchip-add-reset-names-for-combphy-on-rk.patch
@@ -0,0 +1,44 @@
+From 8b9c12757f919157752646faf3821abf2b7d2a64 Mon Sep 17 00:00:00 2001
+From: Chukun Pan <amadeus@jmu.edu.cn>
+Date: Fri, 22 Nov 2024 15:30:05 +0800
+Subject: [PATCH] arm64: dts: rockchip: add reset-names for combphy on rk3568
+
+The reset-names of combphy are missing, add it.
+
+Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
+Fixes: fd3ac6e80497 ("dt-bindings: phy: rockchip: rk3588 has two reset lines")
+Link: https://lore.kernel.org/r/20241122073006.99309-1-amadeus@jmu.edu.cn
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ arch/arm64/boot/dts/rockchip/rk3568.dtsi      | 1 +
+ arch/arm64/boot/dts/rockchip/rk356x-base.dtsi | 2 ++
+ 2 files changed, 3 insertions(+)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3568.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3568.dtsi
+@@ -223,6 +223,7 @@
+ 		assigned-clocks = <&pmucru CLK_PCIEPHY0_REF>;
+ 		assigned-clock-rates = <100000000>;
+ 		resets = <&cru SRST_PIPEPHY0>;
++		reset-names = "phy";
+ 		rockchip,pipe-grf = <&pipegrf>;
+ 		rockchip,pipe-phy-grf = <&pipe_phy_grf0>;
+ 		#phy-cells = <1>;
+--- a/arch/arm64/boot/dts/rockchip/rk356x.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk356x.dtsi
+@@ -1756,6 +1756,7 @@
+ 		assigned-clocks = <&pmucru CLK_PCIEPHY1_REF>;
+ 		assigned-clock-rates = <100000000>;
+ 		resets = <&cru SRST_PIPEPHY1>;
++		reset-names = "phy";
+ 		rockchip,pipe-grf = <&pipegrf>;
+ 		rockchip,pipe-phy-grf = <&pipe_phy_grf1>;
+ 		#phy-cells = <1>;
+@@ -1772,6 +1773,7 @@
+ 		assigned-clocks = <&pmucru CLK_PCIEPHY2_REF>;
+ 		assigned-clock-rates = <100000000>;
+ 		resets = <&cru SRST_PIPEPHY2>;
++		reset-names = "phy";
+ 		rockchip,pipe-grf = <&pipegrf>;
+ 		rockchip,pipe-phy-grf = <&pipe_phy_grf2>;
+ 		#phy-cells = <1>;
diff --git a/target/linux/rockchip/patches-6.6/020-v6.13-irqchip-gic-v3-its-Share-ITS-tables-with-a-non-trust.patch b/target/linux/rockchip/patches-6.6/020-v6.13-irqchip-gic-v3-its-Share-ITS-tables-with-a-non-trust.patch
new file mode 100644
index 00000000000000..92e9bf6c868d84
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/020-v6.13-irqchip-gic-v3-its-Share-ITS-tables-with-a-non-trust.patch
@@ -0,0 +1,337 @@
+From b08e2f42e86b5848add254da45b56fc672e2bced Mon Sep 17 00:00:00 2001
+From: Steven Price <steven.price@arm.com>
+Date: Wed, 2 Oct 2024 15:16:29 +0100
+Subject: [PATCH] irqchip/gic-v3-its: Share ITS tables with a non-trusted
+ hypervisor
+
+Within a realm guest the ITS is emulated by the host. This means the
+allocations must have been made available to the host by a call to
+set_memory_decrypted(). Introduce an allocation function which performs
+this extra call.
+
+For the ITT use a custom genpool-based allocator that calls
+set_memory_decrypted() for each page allocated, but then suballocates the
+size needed for each ITT. Note that there is no mechanism implemented to
+return pages from the genpool, but it is unlikely that the peak number of
+devices will be much larger than the normal level - so this isn't expected
+to be an issue.
+
+Co-developed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
+Signed-off-by: Steven Price <steven.price@arm.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Tested-by: Will Deacon <will@kernel.org>
+Reviewed-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/all/20241002141630.433502-2-steven.price@arm.com
+---
+ drivers/irqchip/irq-gic-v3-its.c | 138 +++++++++++++++++++++++++------
+ 1 file changed, 115 insertions(+), 23 deletions(-)
+
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -12,12 +12,14 @@
+ #include <linux/crash_dump.h>
+ #include <linux/delay.h>
+ #include <linux/efi.h>
++#include <linux/genalloc.h>
+ #include <linux/interrupt.h>
+ #include <linux/iommu.h>
+ #include <linux/iopoll.h>
+ #include <linux/irqdomain.h>
+ #include <linux/list.h>
+ #include <linux/log2.h>
++#include <linux/mem_encrypt.h>
+ #include <linux/memblock.h>
+ #include <linux/mm.h>
+ #include <linux/msi.h>
+@@ -27,6 +29,7 @@
+ #include <linux/of_pci.h>
+ #include <linux/of_platform.h>
+ #include <linux/percpu.h>
++#include <linux/set_memory.h>
+ #include <linux/slab.h>
+ #include <linux/syscore_ops.h>
+ 
+@@ -163,6 +166,7 @@ struct its_device {
+ 	struct its_node		*its;
+ 	struct event_lpi_map	event_map;
+ 	void			*itt;
++	u32			itt_sz;
+ 	u32			nr_ites;
+ 	u32			device_id;
+ 	bool			shared;
+@@ -198,6 +202,87 @@ static DEFINE_IDA(its_vpeid_ida);
+ #define gic_data_rdist_rd_base()	(gic_data_rdist()->rd_base)
+ #define gic_data_rdist_vlpi_base()	(gic_data_rdist_rd_base() + SZ_128K)
+ 
++static struct page *its_alloc_pages_node(int node, gfp_t gfp,
++					 unsigned int order)
++{
++	struct page *page;
++	int ret = 0;
++
++	page = alloc_pages_node(node, gfp, order);
++
++	if (!page)
++		return NULL;
++
++	ret = set_memory_decrypted((unsigned long)page_address(page),
++				   1 << order);
++	/*
++	 * If set_memory_decrypted() fails then we don't know what state the
++	 * page is in, so we can't free it. Instead we leak it.
++	 * set_memory_decrypted() will already have WARNed.
++	 */
++	if (ret)
++		return NULL;
++
++	return page;
++}
++
++static struct page *its_alloc_pages(gfp_t gfp, unsigned int order)
++{
++	return its_alloc_pages_node(NUMA_NO_NODE, gfp, order);
++}
++
++static void its_free_pages(void *addr, unsigned int order)
++{
++	/*
++	 * If the memory cannot be encrypted again then we must leak the pages.
++	 * set_memory_encrypted() will already have WARNed.
++	 */
++	if (set_memory_encrypted((unsigned long)addr, 1 << order))
++		return;
++	free_pages((unsigned long)addr, order);
++}
++
++static struct gen_pool *itt_pool;
++
++static void *itt_alloc_pool(int node, int size)
++{
++	unsigned long addr;
++	struct page *page;
++
++	if (size >= PAGE_SIZE) {
++		page = its_alloc_pages_node(node, GFP_KERNEL | __GFP_ZERO, get_order(size));
++
++		return page ? page_address(page) : NULL;
++	}
++
++	do {
++		addr = gen_pool_alloc(itt_pool, size);
++		if (addr)
++			break;
++
++		page = its_alloc_pages_node(node, GFP_KERNEL | __GFP_ZERO, 1);
++		if (!page)
++			break;
++
++		gen_pool_add(itt_pool, (unsigned long)page_address(page), PAGE_SIZE, node);
++	} while (!addr);
++
++	return (void *)addr;
++}
++
++static void itt_free_pool(void *addr, int size)
++{
++	if (!addr)
++		return;
++
++	if (size >= PAGE_SIZE) {
++		its_free_pages(addr, get_order(size));
++		return;
++	}
++
++	gen_pool_free(itt_pool, (unsigned long)addr, size);
++}
++
+ /*
+  * Skip ITSs that have no vLPIs mapped, unless we're on GICv4.1, as we
+  * always have vSGIs mapped.
+@@ -2192,7 +2277,8 @@ static struct page *its_allocate_prop_ta
+ {
+ 	struct page *prop_page;
+ 
+-	prop_page = alloc_pages(gfp_flags, get_order(LPI_PROPBASE_SZ));
++	prop_page = its_alloc_pages(gfp_flags,
++				    get_order(LPI_PROPBASE_SZ));
+ 	if (!prop_page)
+ 		return NULL;
+ 
+@@ -2203,8 +2289,7 @@ static struct page *its_allocate_prop_ta
+ 
+ static void its_free_prop_table(struct page *prop_page)
+ {
+-	free_pages((unsigned long)page_address(prop_page),
+-		   get_order(LPI_PROPBASE_SZ));
++	its_free_pages(page_address(prop_page), get_order(LPI_PROPBASE_SZ));
+ }
+ 
+ static bool gic_check_reserved_range(phys_addr_t addr, unsigned long size)
+@@ -2326,7 +2411,7 @@ static int its_setup_baser(struct its_no
+ 		order = get_order(GITS_BASER_PAGES_MAX * psz);
+ 	}
+ 
+-	page = alloc_pages_node(its->numa_node, GFP_KERNEL | __GFP_ZERO, order);
++	page = its_alloc_pages_node(its->numa_node, GFP_KERNEL | __GFP_ZERO, order);
+ 	if (!page)
+ 		return -ENOMEM;
+ 
+@@ -2339,7 +2424,7 @@ static int its_setup_baser(struct its_no
+ 		/* 52bit PA is supported only when PageSize=64K */
+ 		if (psz != SZ_64K) {
+ 			pr_err("ITS: no 52bit PA support when psz=%d\n", psz);
+-			free_pages((unsigned long)base, order);
++			its_free_pages(base, order);
+ 			return -ENXIO;
+ 		}
+ 
+@@ -2395,7 +2480,7 @@ retry_baser:
+ 		pr_err("ITS@%pa: %s doesn't stick: %llx %llx\n",
+ 		       &its->phys_base, its_base_type_string[type],
+ 		       val, tmp);
+-		free_pages((unsigned long)base, order);
++		its_free_pages(base, order);
+ 		return -ENXIO;
+ 	}
+ 
+@@ -2534,8 +2619,7 @@ static void its_free_tables(struct its_n
+ 
+ 	for (i = 0; i < GITS_BASER_NR_REGS; i++) {
+ 		if (its->tables[i].base) {
+-			free_pages((unsigned long)its->tables[i].base,
+-				   its->tables[i].order);
++			its_free_pages(its->tables[i].base, its->tables[i].order);
+ 			its->tables[i].base = NULL;
+ 		}
+ 	}
+@@ -2801,7 +2885,7 @@ static bool allocate_vpe_l2_table(int cp
+ 
+ 	/* Allocate memory for 2nd level table */
+ 	if (!table[idx]) {
+-		page = alloc_pages(GFP_KERNEL | __GFP_ZERO, get_order(psz));
++		page = its_alloc_pages(GFP_KERNEL | __GFP_ZERO, get_order(psz));
+ 		if (!page)
+ 			return false;
+ 
+@@ -2920,7 +3004,7 @@ static int allocate_vpe_l1_table(void)
+ 
+ 	pr_debug("np = %d, npg = %lld, psz = %d, epp = %d, esz = %d\n",
+ 		 np, npg, psz, epp, esz);
+-	page = alloc_pages(GFP_ATOMIC | __GFP_ZERO, get_order(np * PAGE_SIZE));
++	page = its_alloc_pages(GFP_ATOMIC | __GFP_ZERO, get_order(np * PAGE_SIZE));
+ 	if (!page)
+ 		return -ENOMEM;
+ 
+@@ -2966,8 +3050,7 @@ static struct page *its_allocate_pending
+ {
+ 	struct page *pend_page;
+ 
+-	pend_page = alloc_pages(gfp_flags | __GFP_ZERO,
+-				get_order(LPI_PENDBASE_SZ));
++	pend_page = its_alloc_pages(gfp_flags | __GFP_ZERO, get_order(LPI_PENDBASE_SZ));
+ 	if (!pend_page)
+ 		return NULL;
+ 
+@@ -2979,7 +3062,7 @@ static struct page *its_allocate_pending
+ 
+ static void its_free_pending_table(struct page *pt)
+ {
+-	free_pages((unsigned long)page_address(pt), get_order(LPI_PENDBASE_SZ));
++	its_free_pages(page_address(pt), get_order(LPI_PENDBASE_SZ));
+ }
+ 
+ /*
+@@ -3314,8 +3397,8 @@ static bool its_alloc_table_entry(struct
+ 
+ 	/* Allocate memory for 2nd level table */
+ 	if (!table[idx]) {
+-		page = alloc_pages_node(its->numa_node, GFP_KERNEL | __GFP_ZERO,
+-					get_order(baser->psz));
++		page = its_alloc_pages_node(its->numa_node, GFP_KERNEL | __GFP_ZERO,
++					    get_order(baser->psz));
+ 		if (!page)
+ 			return false;
+ 
+@@ -3410,7 +3493,6 @@ static struct its_device *its_create_dev
+ 	if (WARN_ON(!is_power_of_2(nvecs)))
+ 		nvecs = roundup_pow_of_two(nvecs);
+ 
+-	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+ 	/*
+ 	 * Even if the device wants a single LPI, the ITT must be
+ 	 * sized as a power of two (and you need at least one bit...).
+@@ -3418,7 +3500,11 @@ static struct its_device *its_create_dev
+ 	nr_ites = max(2, nvecs);
+ 	sz = nr_ites * (FIELD_GET(GITS_TYPER_ITT_ENTRY_SIZE, its->typer) + 1);
+ 	sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1;
+-	itt = kzalloc_node(sz, GFP_KERNEL, its->numa_node);
++
++	itt = itt_alloc_pool(its->numa_node, sz);
++
++	dev = kzalloc(sizeof(*dev), GFP_KERNEL);
++
+ 	if (alloc_lpis) {
+ 		lpi_map = its_lpi_alloc(nvecs, &lpi_base, &nr_lpis);
+ 		if (lpi_map)
+@@ -3430,9 +3516,9 @@ static struct its_device *its_create_dev
+ 		lpi_base = 0;
+ 	}
+ 
+-	if (!dev || !itt ||  !col_map || (!lpi_map && alloc_lpis)) {
++	if (!dev || !itt || !col_map || (!lpi_map && alloc_lpis)) {
+ 		kfree(dev);
+-		kfree(itt);
++		itt_free_pool(itt, sz);
+ 		bitmap_free(lpi_map);
+ 		kfree(col_map);
+ 		return NULL;
+@@ -3442,6 +3528,7 @@ static struct its_device *its_create_dev
+ 
+ 	dev->its = its;
+ 	dev->itt = itt;
++	dev->itt_sz = sz;
+ 	dev->nr_ites = nr_ites;
+ 	dev->event_map.lpi_map = lpi_map;
+ 	dev->event_map.col_map = col_map;
+@@ -3469,7 +3556,7 @@ static void its_free_device(struct its_d
+ 	list_del(&its_dev->entry);
+ 	raw_spin_unlock_irqrestore(&its_dev->its->lock, flags);
+ 	kfree(its_dev->event_map.col_map);
+-	kfree(its_dev->itt);
++	itt_free_pool(its_dev->itt, its_dev->itt_sz);
+ 	kfree(its_dev);
+ }
+ 
+@@ -5112,8 +5199,9 @@ static int __init its_probe_one(struct i
+ 		}
+ 	}
+ 
+-	page = alloc_pages_node(its->numa_node, GFP_KERNEL | __GFP_ZERO,
+-				get_order(ITS_CMD_QUEUE_SZ));
++	page = its_alloc_pages_node(its->numa_node,
++				    GFP_KERNEL | __GFP_ZERO,
++				    get_order(ITS_CMD_QUEUE_SZ));
+ 	if (!page) {
+ 		err = -ENOMEM;
+ 		goto out_unmap_sgir;
+@@ -5177,7 +5265,7 @@ static int __init its_probe_one(struct i
+ out_free_tables:
+ 	its_free_tables(its);
+ out_free_cmd:
+-	free_pages((unsigned long)its->cmd_base, get_order(ITS_CMD_QUEUE_SZ));
++	its_free_pages(its->cmd_base, get_order(ITS_CMD_QUEUE_SZ));
+ out_unmap_sgir:
+ 	if (its->sgir_base)
+ 		iounmap(its->sgir_base);
+@@ -5659,6 +5747,10 @@ int __init its_init(struct fwnode_handle
+ 	bool has_v4_1 = false;
+ 	int err;
+ 
++	itt_pool = gen_pool_create(get_order(ITS_ITT_ALIGN), -1);
++	if (!itt_pool)
++		return -ENOMEM;
++
+ 	gic_rdists = rdists;
+ 
+ 	its_parent = parent_domain;
diff --git a/target/linux/rockchip/patches-6.6/021-v6.13-irqchip-gic-v3-its-Fix-over-allocation-in-itt_alloc.patch b/target/linux/rockchip/patches-6.6/021-v6.13-irqchip-gic-v3-its-Fix-over-allocation-in-itt_alloc.patch
new file mode 100644
index 00000000000000..a716cbee7de7f5
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/021-v6.13-irqchip-gic-v3-its-Fix-over-allocation-in-itt_alloc.patch
@@ -0,0 +1,33 @@
+From bc88d44bd7e45b992cf8c2c2ffbc7bb3e24db4a7 Mon Sep 17 00:00:00 2001
+From: Steven Price <steven.price@arm.com>
+Date: Mon, 21 Oct 2024 11:41:05 +0100
+Subject: [PATCH] irqchip/gic-v3-its: Fix over allocation in
+ itt_alloc_pool()
+
+itt_alloc_pool() calls its_alloc_pages_node() to allocate an individual
+page to add to the pool (for allocations <PAGE_SIZE). However the final
+argument of its_alloc_pages_node() is the page order not the number of
+pages. Currently it allocates two pages and leaks the second page.
+Fix it by passing 0 instead (1 << 0 = 1 page).
+
+Fixes: b08e2f42e86b ("irqchip/gic-v3-its: Share ITS tables with a non-trusted hypervisor")
+Reported-by: Shanker Donthineni <sdonthineni@nvidia.com>
+Signed-off-by: Steven Price <steven.price@arm.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/all/1f6e19c4-1fb9-43ab-a8a2-a465c9cff84b@arm.com
+Closes: https://lore.kernel.org/r/ed65312a-245c-4fa5-91ad-5d620cab7c6b%40nvidia.com
+---
+ drivers/irqchip/irq-gic-v3-its.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -260,7 +260,7 @@ static void *itt_alloc_pool(int node, in
+ 		if (addr)
+ 			break;
+ 
+-		page = its_alloc_pages_node(node, GFP_KERNEL | __GFP_ZERO, 1);
++		page = its_alloc_pages_node(node, GFP_KERNEL | __GFP_ZERO, 0);
+ 		if (!page)
+ 			break;
+ 
diff --git a/target/linux/rockchip/patches-6.6/022-v6.15-irqchip-gic-v3-Add-Rockchip-3568002-erratum-workaround.patch b/target/linux/rockchip/patches-6.6/022-v6.15-irqchip-gic-v3-Add-Rockchip-3568002-erratum-workaround.patch
new file mode 100644
index 00000000000000..9c9e643ff944f2
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/022-v6.15-irqchip-gic-v3-Add-Rockchip-3568002-erratum-workaround.patch
@@ -0,0 +1,105 @@
+From 2d81e1bb625238d40a686ed909ff3e1abab7556a Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Date: Mon, 17 Feb 2025 01:16:32 +0300
+Subject: [PATCH] irqchip/gic-v3: Add Rockchip 3568002 erratum workaround
+
+Rockchip RK3566/RK3568 GIC600 integration has DDR addressing
+limited to the first 32bit of physical address space. Rockchip
+assigned Erratum ID #3568002 for this issue. Add driver quirk for
+this Rockchip GIC Erratum.
+
+Note, that the 0x0201743b GIC600 ID is not Rockchip-specific and is
+common for many ARM GICv3 implementations. Hence, there is an extra
+of_machine_is_compatible() check.
+
+Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Acked-by: Marc Zyngier <maz@kernel.org>
+Link: https://lore.kernel.org/all/20250216221634.364158-2-dmitry.osipenko@collabora.com
+---
+ Documentation/arch/arm64/silicon-errata.rst |  2 ++
+ arch/arm64/Kconfig                          |  9 ++++++++
+ drivers/irqchip/irq-gic-v3-its.c            | 23 ++++++++++++++++++++-
+ 3 files changed, 33 insertions(+), 1 deletion(-)
+
+--- a/Documentation/arch/arm64/silicon-errata.rst
++++ b/Documentation/arch/arm64/silicon-errata.rst
+@@ -270,6 +270,8 @@ stable kernels.
+ +----------------+-----------------+-----------------+-----------------------------+
+ | Rockchip       | RK3588          | #3588001        | ROCKCHIP_ERRATUM_3588001    |
+ +----------------+-----------------+-----------------+-----------------------------+
++| Rockchip       | RK3568          | #3568002        | ROCKCHIP_ERRATUM_3568002    |
+++----------------+-----------------+-----------------+-----------------------------+
+ 
+ +----------------+-----------------+-----------------+-----------------------------+
+ | Fujitsu        | A64FX           | E#010001        | FUJITSU_ERRATUM_010001      |
+--- a/arch/arm64/Kconfig
++++ b/arch/arm64/Kconfig
+@@ -1267,6 +1267,15 @@ config NVIDIA_CARMEL_CNP_ERRATUM
+ 
+ 	  If unsure, say Y.
+ 
++config ROCKCHIP_ERRATUM_3568002
++	bool "Rockchip 3568002: GIC600 can not access physical addresses higher than 4GB"
++	default y
++	help
++	  The Rockchip RK3566 and RK3568 GIC600 SoC integrations have AXI
++	  addressing limited to the first 32bit of physical address space.
++
++	  If unsure, say Y.
++
+ config ROCKCHIP_ERRATUM_3588001
+ 	bool "Rockchip 3588001: GIC600 can not support shareability attributes"
+ 	default y
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -202,13 +202,15 @@ static DEFINE_IDA(its_vpeid_ida);
+ #define gic_data_rdist_rd_base()	(gic_data_rdist()->rd_base)
+ #define gic_data_rdist_vlpi_base()	(gic_data_rdist_rd_base() + SZ_128K)
+ 
++static gfp_t gfp_flags_quirk;
++
+ static struct page *its_alloc_pages_node(int node, gfp_t gfp,
+ 					 unsigned int order)
+ {
+ 	struct page *page;
+ 	int ret = 0;
+ 
+-	page = alloc_pages_node(node, gfp, order);
++	page = alloc_pages_node(node, gfp | gfp_flags_quirk, order);
+ 
+ 	if (!page)
+ 		return NULL;
+@@ -4851,6 +4853,17 @@ static bool its_set_non_coherent(void *d
+ 	return true;
+ }
+ 
++static bool __maybe_unused its_enable_rk3568002(void *data)
++{
++	if (!of_machine_is_compatible("rockchip,rk3566") &&
++	    !of_machine_is_compatible("rockchip,rk3568"))
++		return false;
++
++	gfp_flags_quirk |= GFP_DMA32;
++
++	return true;
++}
++
+ static const struct gic_quirk its_quirks[] = {
+ #ifdef CONFIG_CAVIUM_ERRATUM_22375
+ 	{
+@@ -4910,6 +4923,14 @@ static const struct gic_quirk its_quirks
+ 		.property = "dma-noncoherent",
+ 		.init   = its_set_non_coherent,
+ 	},
++#ifdef CONFIG_ROCKCHIP_ERRATUM_3568002
++	{
++		.desc   = "ITS: Rockchip erratum RK3568002",
++		.iidr   = 0x0201743b,
++		.mask   = 0xffffffff,
++		.init   = its_enable_rk3568002,
++	},
++#endif
+ 	{
+ 	}
+ };
diff --git a/target/linux/rockchip/patches-6.6/023-01-v6.15-arm64-dts-rockchip-rk356x-Add-MSI-controller-node.patch b/target/linux/rockchip/patches-6.6/023-01-v6.15-arm64-dts-rockchip-rk356x-Add-MSI-controller-node.patch
new file mode 100644
index 00000000000000..a31e4595c4dec6
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/023-01-v6.15-arm64-dts-rockchip-rk356x-Add-MSI-controller-node.patch
@@ -0,0 +1,51 @@
+From f15be3d4a0a55db2b50f319c378a2d16ceb21f86 Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Date: Mon, 17 Feb 2025 01:16:33 +0300
+Subject: [PATCH] arm64: dts: rockchip: rk356x: Add MSI controller node
+
+Rockchip 356x SoC's GIC has two hardware integration issues that
+affect MSI functionality of the GIC. Previously, both these GIC
+issues were worked around by using MBI for MSI instead of ITS
+because kernel GIC driver didn't have necessary quirks.
+
+First issue is about RK356x GIC not supporting programmable
+shareability, while reporting it as supported in a GIC's feature
+register. Rockchip assigned Erratum ID #3568001 for this issue. This
+patch adds dma-noncoherent property to the GIC node, denoting that a SW
+workaround is required for mitigating the issue.
+
+Second issue is about GIC AXI master interface addressing limited to
+the first 4GB of physical address space. Rockchip assigned Erratum
+ID #3568002 for this issue.
+
+Now that kernel supports quirks for both of the erratums, add
+MSI controller node to RK356x device-tree.
+
+Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/all/20250216221634.364158-3-dmitry.osipenko@collabora.com
+---
+ arch/arm64/boot/dts/rockchip/rk356x-base.dtsi | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+--- a/arch/arm64/boot/dts/rockchip/rk356x.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk356x.dtsi
+@@ -364,6 +364,18 @@
+ 		mbi-alias = <0x0 0xfd410000>;
+ 		mbi-ranges = <296 24>;
+ 		msi-controller;
++		ranges;
++		#address-cells = <2>;
++		#size-cells = <2>;
++		dma-noncoherent;
++
++		its: msi-controller@fd440000 {
++			compatible = "arm,gic-v3-its";
++			reg = <0x0 0xfd440000 0 0x20000>;
++			dma-noncoherent;
++			msi-controller;
++			#msi-cells = <1>;
++		};
+ 	};
+ 
+ 	usb_host0_ehci: usb@fd800000 {
diff --git a/target/linux/rockchip/patches-6.6/023-02-v6.15-arm64-dts-rockchip-rk356x-Move-PCIe-MSI-to-use-GIC.patch b/target/linux/rockchip/patches-6.6/023-02-v6.15-arm64-dts-rockchip-rk356x-Move-PCIe-MSI-to-use-GIC.patch
new file mode 100644
index 00000000000000..d1281332b45190
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/023-02-v6.15-arm64-dts-rockchip-rk356x-Move-PCIe-MSI-to-use-GIC.patch
@@ -0,0 +1,28 @@
+From b956c9de91757c9478e24fc9f6a57fd46f0a49f0 Mon Sep 17 00:00:00 2001
+From: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Date: Mon, 17 Feb 2025 01:16:34 +0300
+Subject: [PATCH] arm64: dts: rockchip: rk356x: Move PCIe MSI to use GIC
+ ITS instead of MBI
+
+Rockchip 356x device-tree now supports GIC ITS. Move PCIe controller's
+MSI to use ITS instead of MBI. This removes extra CPU overhead of handling
+PCIe MBIs by letting GIC's ITS to serve the PCIe MSIs.
+
+Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Link: https://lore.kernel.org/all/20250216221634.364158-4-dmitry.osipenko@collabora.com
+---
+ arch/arm64/boot/dts/rockchip/rk356x-base.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/rockchip/rk356x.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk356x.dtsi
+@@ -1043,7 +1043,7 @@
+ 		num-ib-windows = <6>;
+ 		num-ob-windows = <2>;
+ 		max-link-speed = <2>;
+-		msi-map = <0x0 &gic 0x0 0x1000>;
++		msi-map = <0x0 &its 0x0 0x1000>;
+ 		num-lanes = <1>;
+ 		phys = <&combphy2 PHY_TYPE_PCIE>;
+ 		phy-names = "pcie-phy";
diff --git a/target/linux/rockchip/patches-6.6/024-v6.16-arm64-dts-rockchip-Move-rk3568-PCIe3-MSI-to-use-GIC-.patch b/target/linux/rockchip/patches-6.6/024-v6.16-arm64-dts-rockchip-Move-rk3568-PCIe3-MSI-to-use-GIC-.patch
new file mode 100644
index 00000000000000..c5bbaed492fce4
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/024-v6.16-arm64-dts-rockchip-Move-rk3568-PCIe3-MSI-to-use-GIC-.patch
@@ -0,0 +1,54 @@
+From fbea35a661ed100cee2f3bab8015fb0155508106 Mon Sep 17 00:00:00 2001
+From: Chukun Pan <amadeus@jmu.edu.cn>
+Date: Sat, 8 Mar 2025 17:30:08 +0800
+Subject: [PATCH] arm64: dts: rockchip: Move rk3568 PCIe3 MSI to use GIC ITS
+
+Following commit b956c9de9175 ("arm64: dts: rockchip: rk356x: Move
+PCIe MSI to use GIC ITS instead of MBI"), change the PCIe3 controller's
+MSI on rk3568 to use ITS, so that all MSI-X can work properly.
+
+Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
+Link: https://lore.kernel.org/r/20250308093008.568437-2-amadeus@jmu.edu.cn
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ arch/arm64/boot/dts/rockchip/rk3568.dtsi | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3568.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3568.dtsi
+@@ -64,7 +64,7 @@
+ 		compatible = "rockchip,rk3568-pcie";
+ 		#address-cells = <3>;
+ 		#size-cells = <2>;
+-		bus-range = <0x0 0xf>;
++		bus-range = <0x10 0x1f>;
+ 		clocks = <&cru ACLK_PCIE30X1_MST>, <&cru ACLK_PCIE30X1_SLV>,
+ 			 <&cru ACLK_PCIE30X1_DBI>, <&cru PCLK_PCIE30X1>,
+ 			 <&cru CLK_PCIE30X1_AUX_NDFT>;
+@@ -87,7 +87,7 @@
+ 		num-ib-windows = <6>;
+ 		num-ob-windows = <2>;
+ 		max-link-speed = <3>;
+-		msi-map = <0x0 &gic 0x1000 0x1000>;
++		msi-map = <0x1000 &its 0x1000 0x1000>;
+ 		num-lanes = <1>;
+ 		phys = <&pcie30phy>;
+ 		phy-names = "pcie-phy";
+@@ -117,7 +117,7 @@
+ 		compatible = "rockchip,rk3568-pcie";
+ 		#address-cells = <3>;
+ 		#size-cells = <2>;
+-		bus-range = <0x0 0xf>;
++		bus-range = <0x20 0x2f>;
+ 		clocks = <&cru ACLK_PCIE30X2_MST>, <&cru ACLK_PCIE30X2_SLV>,
+ 			 <&cru ACLK_PCIE30X2_DBI>, <&cru PCLK_PCIE30X2>,
+ 			 <&cru CLK_PCIE30X2_AUX_NDFT>;
+@@ -140,7 +140,7 @@
+ 		num-ib-windows = <6>;
+ 		num-ob-windows = <2>;
+ 		max-link-speed = <3>;
+-		msi-map = <0x0 &gic 0x2000 0x1000>;
++		msi-map = <0x2000 &its 0x2000 0x1000>;
+ 		num-lanes = <2>;
+ 		phys = <&pcie30phy>;
+ 		phy-names = "pcie-phy";
diff --git a/target/linux/rockchip/patches-6.6/030-09-v6.12-clk-rockchip-Add-new-pll-type-pll_rk3588_ddr.patch b/target/linux/rockchip/patches-6.6/030-09-v6.12-clk-rockchip-Add-new-pll-type-pll_rk3588_ddr.patch
new file mode 100644
index 00000000000000..0d68f687faf8d1
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/030-09-v6.12-clk-rockchip-Add-new-pll-type-pll_rk3588_ddr.patch
@@ -0,0 +1,51 @@
+From e781bffc296766b55dbd048890d558655031e8d1 Mon Sep 17 00:00:00 2001
+From: Elaine Zhang <zhangqing@rock-chips.com>
+Date: Wed, 28 Aug 2024 15:42:52 +0000
+Subject: [PATCH] clk: rockchip: Add new pll type pll_rk3588_ddr
+
+That PLL type is similar to the other rk3588 pll types but the actual
+rate is twice the configured rate.
+Therefore, the returned calculated rate must be multiplied by two.
+
+Signed-off-by: Elaine Zhang <zhangqing@rock-chips.com>
+Signed-off-by: Detlev Casanova <detlev.casanova@collabora.com>
+Acked-by: Dragan Simic <dsimic@manjaro.org>
+Link: https://lore.kernel.org/r/0102019199a76ec4-9d5846d4-d76a-4e69-a241-c88c2983d607-000000@eu-west-1.amazonses.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ drivers/clk/rockchip/clk-pll.c | 6 +++++-
+ drivers/clk/rockchip/clk.h     | 1 +
+ 2 files changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/rockchip/clk-pll.c
++++ b/drivers/clk/rockchip/clk-pll.c
+@@ -914,7 +914,10 @@ static unsigned long rockchip_rk3588_pll
+ 	}
+ 	rate64 = rate64 >> cur.s;
+ 
+-	return (unsigned long)rate64;
++	if (pll->type == pll_rk3588_ddr)
++		return (unsigned long)rate64 * 2;
++	else
++		return (unsigned long)rate64;
+ }
+ 
+ static int rockchip_rk3588_pll_set_params(struct rockchip_clk_pll *pll,
+@@ -1167,6 +1170,7 @@ struct clk *rockchip_clk_register_pll(st
+ 		break;
+ 	case pll_rk3588:
+ 	case pll_rk3588_core:
++	case pll_rk3588_ddr:
+ 		if (!pll->rate_table)
+ 			init.ops = &rockchip_rk3588_pll_clk_norate_ops;
+ 		else
+--- a/drivers/clk/rockchip/clk.h
++++ b/drivers/clk/rockchip/clk.h
+@@ -287,6 +287,7 @@ enum rockchip_pll_type {
+ 	pll_rk3399,
+ 	pll_rk3588,
+ 	pll_rk3588_core,
++	pll_rk3588_ddr,
+ };
+ 
+ #define RK3036_PLL_RATE(_rate, _refdiv, _fbdiv, _postdiv1,	\
diff --git a/target/linux/rockchip/patches-6.6/030-10-v6.12-clk-rockchip-rk3588-drop-unused-code.patch b/target/linux/rockchip/patches-6.6/030-10-v6.12-clk-rockchip-rk3588-drop-unused-code.patch
new file mode 100644
index 00000000000000..0164bf26e579cc
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/030-10-v6.12-clk-rockchip-rk3588-drop-unused-code.patch
@@ -0,0 +1,65 @@
+From 2e7b3daa8cb1ebd17e6a7f417ef5e6553203035c Mon Sep 17 00:00:00 2001
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+Date: Mon, 25 Mar 2024 20:33:32 +0100
+Subject: [PATCH] clk: rockchip: rk3588: drop unused code
+
+All clocks are registered early using CLK_OF_DECLARE(), which marks
+the DT node as processed. For the processed DT node the probe routine
+is never called. Thus this whole code is never executed. This could
+be "fixed" by using CLK_OF_DECLARE_DRIVER, which avoids marking the
+DT node as processed. But then the probe routine would re-register
+all the clocks by calling rk3588_clk_init() again.
+
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Link: https://lore.kernel.org/r/20240325193609.237182-2-sebastian.reichel@collabora.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ drivers/clk/rockchip/clk-rk3588.c | 40 -------------------------------
+ 1 file changed, 40 deletions(-)
+
+--- a/drivers/clk/rockchip/clk-rk3588.c
++++ b/drivers/clk/rockchip/clk-rk3588.c
+@@ -2502,43 +2502,3 @@ static void __init rk3588_clk_init(struc
+ }
+ 
+ CLK_OF_DECLARE(rk3588_cru, "rockchip,rk3588-cru", rk3588_clk_init);
+-
+-struct clk_rk3588_inits {
+-	void (*inits)(struct device_node *np);
+-};
+-
+-static const struct clk_rk3588_inits clk_3588_cru_init = {
+-	.inits = rk3588_clk_init,
+-};
+-
+-static const struct of_device_id clk_rk3588_match_table[] = {
+-	{
+-		.compatible = "rockchip,rk3588-cru",
+-		.data = &clk_3588_cru_init,
+-	},
+-	{ }
+-};
+-
+-static int __init clk_rk3588_probe(struct platform_device *pdev)
+-{
+-	const struct clk_rk3588_inits *init_data;
+-	struct device *dev = &pdev->dev;
+-
+-	init_data = device_get_match_data(dev);
+-	if (!init_data)
+-		return -EINVAL;
+-
+-	if (init_data->inits)
+-		init_data->inits(dev->of_node);
+-
+-	return 0;
+-}
+-
+-static struct platform_driver clk_rk3588_driver = {
+-	.driver		= {
+-		.name	= "clk-rk3588",
+-		.of_match_table = clk_rk3588_match_table,
+-		.suppress_bind_attrs = true,
+-	},
+-};
+-builtin_platform_driver_probe(clk_rk3588_driver, clk_rk3588_probe);
diff --git a/target/linux/rockchip/patches-6.6/030-11-v6.13-clk-rockchip-fix-finding-of-maximum-clock-ID.patch b/target/linux/rockchip/patches-6.6/030-11-v6.13-clk-rockchip-fix-finding-of-maximum-clock-ID.patch
new file mode 100644
index 00000000000000..912c2c77780bf0
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/030-11-v6.13-clk-rockchip-fix-finding-of-maximum-clock-ID.patch
@@ -0,0 +1,29 @@
+From ad1081a0da2744141d12e94ff816ac91feb871ca Mon Sep 17 00:00:00 2001
+From: Yao Zi <ziyao@disroot.org>
+Date: Thu, 12 Sep 2024 13:32:05 +0000
+Subject: [PATCH] clk: rockchip: fix finding of maximum clock ID
+
+If an ID of a branch's child is greater than current maximum, we should
+set new maximum to the child's ID, instead of its parent's.
+
+Fixes: 2dc66a5ab2c6 ("clk: rockchip: rk3588: fix CLK_NR_CLKS usage")
+Signed-off-by: Yao Zi <ziyao@disroot.org>
+Link: https://lore.kernel.org/r/20240912133204.29089-2-ziyao@disroot.org
+Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Reviewed-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Stephen Boyd <sboyd@kernel.org>
+---
+ drivers/clk/rockchip/clk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/rockchip/clk.c
++++ b/drivers/clk/rockchip/clk.c
+@@ -439,7 +439,7 @@ unsigned long rockchip_clk_find_max_clk_
+ 		if (list->id > max)
+ 			max = list->id;
+ 		if (list->child && list->child->id > max)
+-			max = list->id;
++			max = list->child->id;
+ 	}
+ 
+ 	return max;
diff --git a/target/linux/rockchip/patches-6.6/030-12-v6.15-dt-bindings-reset-Add-SCMI-reset-IDs-for-RK3588.patch b/target/linux/rockchip/patches-6.6/030-12-v6.15-dt-bindings-reset-Add-SCMI-reset-IDs-for-RK3588.patch
new file mode 100644
index 00000000000000..8f98680aea1caf
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/030-12-v6.15-dt-bindings-reset-Add-SCMI-reset-IDs-for-RK3588.patch
@@ -0,0 +1,74 @@
+From 849d9db170fc8a03ce9f64133a1d0cd46c135105 Mon Sep 17 00:00:00 2001
+From: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+Date: Tue, 4 Feb 2025 16:35:46 +0100
+Subject: [PATCH] dt-bindings: reset: Add SCMI reset IDs for RK3588
+
+When TF-A is used to assert/deassert the resets through SCMI, the
+IDs communicated to it are different than the ones mainline Linux uses.
+
+Import the list of SCMI reset IDs from mainline TF-A so that devicetrees
+can use these IDs more easily.
+
+Co-developed-by: XiaoDong Huang <derrick.huang@rock-chips.com>
+Signed-off-by: XiaoDong Huang <derrick.huang@rock-chips.com>
+Acked-by: Conor Dooley <conor.dooley@microchip.com>
+Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ .../dt-bindings/reset/rockchip,rk3588-cru.h   | 41 ++++++++++++++++++-
+ 1 file changed, 40 insertions(+), 1 deletion(-)
+
+--- a/include/dt-bindings/reset/rockchip,rk3588-cru.h
++++ b/include/dt-bindings/reset/rockchip,rk3588-cru.h
+@@ -1,6 +1,6 @@
+ /* SPDX-License-Identifier: (GPL-2.0 OR MIT) */
+ /*
+- * Copyright (c) 2021 Rockchip Electronics Co. Ltd.
++ * Copyright (c) 2021, 2024 Rockchip Electronics Co. Ltd.
+  * Copyright (c) 2022 Collabora Ltd.
+  *
+  * Author: Elaine Zhang <zhangqing@rock-chips.com>
+@@ -753,4 +753,43 @@
+ 
+ #define SRST_A_HDMIRX_BIU		660
+ 
++/* SCMI Secure Resets */
++
++/* Name=SECURE_SOFTRST_CON00,Offset=0xA00 */
++#define SCMI_SRST_A_SECURE_NS_BIU	10
++#define SCMI_SRST_H_SECURE_NS_BIU	11
++#define SCMI_SRST_A_SECURE_S_BIU	12
++#define SCMI_SRST_H_SECURE_S_BIU	13
++#define SCMI_SRST_P_SECURE_S_BIU	14
++#define SCMI_SRST_CRYPTO_CORE		15
++/* Name=SECURE_SOFTRST_CON01,Offset=0xA04 */
++#define SCMI_SRST_CRYPTO_PKA		16
++#define SCMI_SRST_CRYPTO_RNG		17
++#define SCMI_SRST_A_CRYPTO		18
++#define SCMI_SRST_H_CRYPTO		19
++#define SCMI_SRST_KEYLADDER_CORE	25
++#define SCMI_SRST_KEYLADDER_RNG		26
++#define SCMI_SRST_A_KEYLADDER		27
++#define SCMI_SRST_H_KEYLADDER		28
++#define SCMI_SRST_P_OTPC_S		29
++#define SCMI_SRST_OTPC_S		30
++#define SCMI_SRST_WDT_S			31
++/* Name=SECURE_SOFTRST_CON02,Offset=0xA08 */
++#define SCMI_SRST_T_WDT_S		32
++#define SCMI_SRST_H_BOOTROM		33
++#define SCMI_SRST_A_DCF			34
++#define SCMI_SRST_P_DCF			35
++#define SCMI_SRST_H_BOOTROM_NS		37
++#define SCMI_SRST_P_KEYLADDER		46
++#define SCMI_SRST_H_TRNG_S		47
++/* Name=SECURE_SOFTRST_CON03,Offset=0xA0C */
++#define SCMI_SRST_H_TRNG_NS		48
++#define SCMI_SRST_D_SDMMC_BUFFER	49
++#define SCMI_SRST_H_SDMMC		50
++#define SCMI_SRST_H_SDMMC_BUFFER	51
++#define SCMI_SRST_SDMMC			52
++#define SCMI_SRST_P_TRNG_CHK		53
++#define SCMI_SRST_TRNG_S		54
++
++
+ #endif
diff --git a/target/linux/rockchip/patches-6.6/030-13-v6.15-dt-bindings-rng-add-binding-for-Rockchip-RK3588-RNG.patch b/target/linux/rockchip/patches-6.6/030-13-v6.15-dt-bindings-rng-add-binding-for-Rockchip-RK3588-RNG.patch
new file mode 100644
index 00000000000000..cb7e15527bdf34
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/030-13-v6.15-dt-bindings-rng-add-binding-for-Rockchip-RK3588-RNG.patch
@@ -0,0 +1,91 @@
+From e00fc3d6e7c2d0b2ab5cf03a576df39cd94479aa Mon Sep 17 00:00:00 2001
+From: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+Date: Tue, 4 Feb 2025 16:35:47 +0100
+Subject: [PATCH] dt-bindings: rng: add binding for Rockchip RK3588 RNG
+
+The Rockchip RK3588 SoC has two hardware RNGs accessible to the
+non-secure world: an RNG in the Crypto IP, and a standalone RNG that is
+new to this SoC.
+
+Add a binding for this new standalone RNG. It is distinct hardware from
+the existing rockchip,rk3568-rng, and therefore gets its own binding as
+the two hardware IPs are unrelated other than both being made by the
+same vendor.
+
+The RNG is capable of firing an interrupt when entropy is ready.
+
+The reset is optional, as the hardware does a power-on reset, and
+functions without the software manually resetting it.
+
+Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+Acked-by: Conor Dooley <conor.dooley@microchip.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ .../bindings/rng/rockchip,rk3588-rng.yaml     | 60 +++++++++++++++++++
+ MAINTAINERS                                   |  1 +
+ 2 files changed, 61 insertions(+)
+ create mode 100644 Documentation/devicetree/bindings/rng/rockchip,rk3588-rng.yaml
+
+--- /dev/null
++++ b/Documentation/devicetree/bindings/rng/rockchip,rk3588-rng.yaml
+@@ -0,0 +1,60 @@
++# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
++%YAML 1.2
++---
++$id: http://devicetree.org/schemas/rng/rockchip,rk3588-rng.yaml#
++$schema: http://devicetree.org/meta-schemas/core.yaml#
++
++title: Rockchip RK3588 TRNG
++
++description: True Random Number Generator on Rockchip RK3588 SoC
++
++maintainers:
++  - Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
++
++properties:
++  compatible:
++    enum:
++      - rockchip,rk3588-rng
++
++  reg:
++    maxItems: 1
++
++  clocks:
++    items:
++      - description: TRNG AHB clock
++
++  interrupts:
++    maxItems: 1
++
++  resets:
++    maxItems: 1
++
++required:
++  - compatible
++  - reg
++  - clocks
++  - interrupts
++
++additionalProperties: false
++
++examples:
++  - |
++    #include <dt-bindings/clock/rockchip,rk3588-cru.h>
++    #include <dt-bindings/interrupt-controller/arm-gic.h>
++    #include <dt-bindings/interrupt-controller/irq.h>
++    #include <dt-bindings/reset/rockchip,rk3588-cru.h>
++    bus {
++      #address-cells = <2>;
++      #size-cells = <2>;
++
++      rng@fe378000 {
++        compatible = "rockchip,rk3588-rng";
++        reg = <0x0 0xfe378000 0x0 0x200>;
++        interrupts = <GIC_SPI 400 IRQ_TYPE_LEVEL_HIGH 0>;
++        clocks = <&scmi_clk SCMI_HCLK_SECURE_NS>;
++        resets = <&scmi_reset SCMI_SRST_H_TRNG_NS>;
++        status = "okay";
++      };
++    };
++
++...
diff --git a/target/linux/rockchip/patches-6.6/030-14-v6.15-dt-bindings-rng-rockchip-rk3588-rng-Drop-unnecessary.patch b/target/linux/rockchip/patches-6.6/030-14-v6.15-dt-bindings-rng-rockchip-rk3588-rng-Drop-unnecessary.patch
new file mode 100644
index 00000000000000..1dde09f1af1a52
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/030-14-v6.15-dt-bindings-rng-rockchip-rk3588-rng-Drop-unnecessary.patch
@@ -0,0 +1,27 @@
+From 52b3b329d8e589575d16d8d9adbca9e08041ee82 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Fri, 7 Mar 2025 10:33:09 +0100
+Subject: [PATCH] dt-bindings: rng: rockchip,rk3588-rng: Drop unnecessary
+ status from example
+
+Device nodes are enabled by default, so no need for 'status = "okay"' in
+the DTS example.
+
+Reviewed-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Acked-by: Rob Herring (Arm) <robh@kernel.org>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ Documentation/devicetree/bindings/rng/rockchip,rk3588-rng.yaml | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/Documentation/devicetree/bindings/rng/rockchip,rk3588-rng.yaml
++++ b/Documentation/devicetree/bindings/rng/rockchip,rk3588-rng.yaml
+@@ -53,7 +53,6 @@ examples:
+         interrupts = <GIC_SPI 400 IRQ_TYPE_LEVEL_HIGH 0>;
+         clocks = <&scmi_clk SCMI_HCLK_SECURE_NS>;
+         resets = <&scmi_reset SCMI_SRST_H_TRNG_NS>;
+-        status = "okay";
+       };
+     };
+ 
diff --git a/target/linux/rockchip/patches-6.6/030-15-v6.14-clk-rockchip-support-clocks-registered-late.patch b/target/linux/rockchip/patches-6.6/030-15-v6.14-clk-rockchip-support-clocks-registered-late.patch
new file mode 100644
index 00000000000000..b5f32b2de6250b
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/030-15-v6.14-clk-rockchip-support-clocks-registered-late.patch
@@ -0,0 +1,106 @@
+From 9e89f02da718bc912f7f253b58804d4a52efed30 Mon Sep 17 00:00:00 2001
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+Date: Wed, 11 Dec 2024 17:58:50 +0100
+Subject: [PATCH] clk: rockchip: support clocks registered late
+
+When some clocks are registered late and some clocks are registered
+early we need to make sure the late registered clocks report probe defer
+until the final registration has happened.
+
+But we do not want to keep reporting probe defer after the late
+registration has happened. Also not all Rockchip SoCs have late
+registered clocks and may not need to report probe defer at all.
+
+This restructures code a bit, so that there is a new function
+rockchip_clk_init_early(), which should be used for initializing the CRU
+structure on SoCs making use of late initialization in addition to the
+early init. These platforms should call rockchip_clk_finalize()
+once all clocks have been registered.
+
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+[added EXPORT_SYMBOL_GPL(rockchip_clk_finalize) to match the early function]
+Link: https://lore.kernel.org/r/20241211165957.94922-2-sebastian.reichel@collabora.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ drivers/clk/rockchip/clk.c | 36 ++++++++++++++++++++++++++++++++----
+ drivers/clk/rockchip/clk.h |  3 +++
+ 2 files changed, 35 insertions(+), 4 deletions(-)
+
+--- a/drivers/clk/rockchip/clk.c
++++ b/drivers/clk/rockchip/clk.c
+@@ -359,14 +359,17 @@ static struct clk *rockchip_clk_register
+ 	return hw->clk;
+ }
+ 
+-struct rockchip_clk_provider *rockchip_clk_init(struct device_node *np,
+-						void __iomem *base,
+-						unsigned long nr_clks)
++static struct rockchip_clk_provider *rockchip_clk_init_base(
++		struct device_node *np, void __iomem *base,
++		unsigned long nr_clks, bool has_late_clocks)
+ {
+ 	struct rockchip_clk_provider *ctx;
+ 	struct clk **clk_table;
++	struct clk *default_clk_val;
+ 	int i;
+ 
++	default_clk_val = ERR_PTR(has_late_clocks ? -EPROBE_DEFER : -ENOENT);
++
+ 	ctx = kzalloc(sizeof(struct rockchip_clk_provider), GFP_KERNEL);
+ 	if (!ctx)
+ 		return ERR_PTR(-ENOMEM);
+@@ -376,7 +379,7 @@ struct rockchip_clk_provider *rockchip_c
+ 		goto err_free;
+ 
+ 	for (i = 0; i < nr_clks; ++i)
+-		clk_table[i] = ERR_PTR(-ENOENT);
++		clk_table[i] = default_clk_val;
+ 
+ 	ctx->reg_base = base;
+ 	ctx->clk_data.clks = clk_table;
+@@ -393,8 +396,33 @@ err_free:
+ 	kfree(ctx);
+ 	return ERR_PTR(-ENOMEM);
+ }
++
++struct rockchip_clk_provider *rockchip_clk_init(struct device_node *np,
++						void __iomem *base,
++						unsigned long nr_clks)
++{
++	return rockchip_clk_init_base(np, base, nr_clks, false);
++}
+ EXPORT_SYMBOL_GPL(rockchip_clk_init);
+ 
++struct rockchip_clk_provider *rockchip_clk_init_early(struct device_node *np,
++						      void __iomem *base,
++						      unsigned long nr_clks)
++{
++	return rockchip_clk_init_base(np, base, nr_clks, true);
++}
++EXPORT_SYMBOL_GPL(rockchip_clk_init_early);
++
++void rockchip_clk_finalize(struct rockchip_clk_provider *ctx)
++{
++	int i;
++
++	for (i = 0; i < ctx->clk_data.clk_num; ++i)
++		if (ctx->clk_data.clks[i] == ERR_PTR(-EPROBE_DEFER))
++			ctx->clk_data.clks[i] = ERR_PTR(-ENOENT);
++}
++EXPORT_SYMBOL_GPL(rockchip_clk_finalize);
++
+ void rockchip_clk_of_add_provider(struct device_node *np,
+ 				  struct rockchip_clk_provider *ctx)
+ {
+--- a/drivers/clk/rockchip/clk.h
++++ b/drivers/clk/rockchip/clk.h
+@@ -972,6 +972,9 @@ struct rockchip_clk_branch {
+ 
+ struct rockchip_clk_provider *rockchip_clk_init(struct device_node *np,
+ 			void __iomem *base, unsigned long nr_clks);
++struct rockchip_clk_provider *rockchip_clk_init_early(struct device_node *np,
++			void __iomem *base, unsigned long nr_clks);
++void rockchip_clk_finalize(struct rockchip_clk_provider *ctx);
+ void rockchip_clk_of_add_provider(struct device_node *np,
+ 				struct rockchip_clk_provider *ctx);
+ unsigned long rockchip_clk_find_max_clk_id(struct rockchip_clk_branch *list,
diff --git a/target/linux/rockchip/patches-6.6/030-16-v6.14-clk-rockchip-rk3588-register-GATE_LINK-later.patch b/target/linux/rockchip/patches-6.6/030-16-v6.14-clk-rockchip-rk3588-register-GATE_LINK-later.patch
new file mode 100644
index 00000000000000..5e47d89a8f24f3
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/030-16-v6.14-clk-rockchip-rk3588-register-GATE_LINK-later.patch
@@ -0,0 +1,150 @@
+From 33af96244a66f855baa43d424844bb437c79c30c Mon Sep 17 00:00:00 2001
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+Date: Wed, 11 Dec 2024 17:58:51 +0100
+Subject: [PATCH] clk: rockchip: rk3588: register GATE_LINK later
+
+The proper GATE_LINK implementation will use runtime PM to handle the
+linked gate clocks, which requires device context. Currently all clocks
+are registered early via CLK_OF_DECLARE, which is before the kernel
+knows about devices.
+
+Moving the full clocks registration to the probe routine does not work,
+since the clocks needed for timers must be registered early.
+
+To work around this issue, most of the clock tree is registered early,
+but GATE_LINK clocks are handled in the probe routine. Since the resets
+are not needed early either, they have also been moved to the probe
+routine.
+
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Link: https://lore.kernel.org/r/20241211165957.94922-3-sebastian.reichel@collabora.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ drivers/clk/rockchip/clk-rk3588.c | 66 +++++++++++++++++++++++++++----
+ 1 file changed, 58 insertions(+), 8 deletions(-)
+
+--- a/drivers/clk/rockchip/clk-rk3588.c
++++ b/drivers/clk/rockchip/clk-rk3588.c
+@@ -266,6 +266,8 @@ static struct rockchip_pll_rate_table rk
+ 	},							\
+ }
+ 
++static struct rockchip_clk_provider *early_ctx;
++
+ static struct rockchip_cpuclk_rate_table rk3588_cpub0clk_rates[] __initdata = {
+ 	RK3588_CPUB01CLK_RATE(2496000000, 1),
+ 	RK3588_CPUB01CLK_RATE(2400000000, 1),
+@@ -694,7 +696,7 @@ static struct rockchip_pll_clock rk3588_
+ 		     RK3588_MODE_CON0, 10, 15, 0, rk3588_pll_rates),
+ };
+ 
+-static struct rockchip_clk_branch rk3588_clk_branches[] __initdata = {
++static struct rockchip_clk_branch rk3588_early_clk_branches[] __initdata = {
+ 	/*
+ 	 * CRU Clock-Architecture
+ 	 */
+@@ -2428,7 +2430,9 @@ static struct rockchip_clk_branch rk3588
+ 			RK3588_CLKGATE_CON(68), 5, GFLAGS),
+ 	GATE(ACLK_AV1, "aclk_av1", "aclk_av1_pre", 0,
+ 			RK3588_CLKGATE_CON(68), 2, GFLAGS),
++};
+ 
++static struct rockchip_clk_branch rk3588_clk_branches[] = {
+ 	GATE_LINK(ACLK_ISP1_PRE, "aclk_isp1_pre", "aclk_isp1_root", ACLK_VI_ROOT, 0, RK3588_CLKGATE_CON(26), 6, GFLAGS),
+ 	GATE_LINK(HCLK_ISP1_PRE, "hclk_isp1_pre", "hclk_isp1_root", HCLK_VI_ROOT, 0, RK3588_CLKGATE_CON(26), 8, GFLAGS),
+ 	GATE_LINK(HCLK_NVM, "hclk_nvm", "hclk_nvm_root", ACLK_NVM_ROOT, RK3588_LINKED_CLK, RK3588_CLKGATE_CON(31), 2, GFLAGS),
+@@ -2453,26 +2457,31 @@ static struct rockchip_clk_branch rk3588
+ 	GATE_LINK(PCLK_VO1GRF, "pclk_vo1grf", "pclk_vo1_root", HCLK_VO1, CLK_IGNORE_UNUSED, RK3588_CLKGATE_CON(59), 12, GFLAGS),
+ };
+ 
+-static void __init rk3588_clk_init(struct device_node *np)
++static void __init rk3588_clk_early_init(struct device_node *np)
+ {
+ 	struct rockchip_clk_provider *ctx;
+-	unsigned long clk_nr_clks;
++	unsigned long clk_nr_clks, max_clk_id1, max_clk_id2;
+ 	void __iomem *reg_base;
+ 
+-	clk_nr_clks = rockchip_clk_find_max_clk_id(rk3588_clk_branches,
+-					ARRAY_SIZE(rk3588_clk_branches)) + 1;
++	max_clk_id1 = rockchip_clk_find_max_clk_id(rk3588_clk_branches,
++					ARRAY_SIZE(rk3588_clk_branches));
++	max_clk_id2 = rockchip_clk_find_max_clk_id(rk3588_early_clk_branches,
++					ARRAY_SIZE(rk3588_early_clk_branches));
++	clk_nr_clks = max(max_clk_id1, max_clk_id2) + 1;
++
+ 	reg_base = of_iomap(np, 0);
+ 	if (!reg_base) {
+ 		pr_err("%s: could not map cru region\n", __func__);
+ 		return;
+ 	}
+ 
+-	ctx = rockchip_clk_init(np, reg_base, clk_nr_clks);
++	ctx = rockchip_clk_init_early(np, reg_base, clk_nr_clks);
+ 	if (IS_ERR(ctx)) {
+ 		pr_err("%s: rockchip clk init failed\n", __func__);
+ 		iounmap(reg_base);
+ 		return;
+ 	}
++	early_ctx = ctx;
+ 
+ 	rockchip_clk_register_plls(ctx, rk3588_pll_clks,
+ 				   ARRAY_SIZE(rk3588_pll_clks),
+@@ -2491,14 +2500,55 @@ static void __init rk3588_clk_init(struc
+ 			&rk3588_cpub1clk_data, rk3588_cpub1clk_rates,
+ 			ARRAY_SIZE(rk3588_cpub1clk_rates));
+ 
++	rockchip_clk_register_branches(ctx, rk3588_early_clk_branches,
++				       ARRAY_SIZE(rk3588_early_clk_branches));
++
++	rockchip_clk_of_add_provider(np, ctx);
++}
++CLK_OF_DECLARE_DRIVER(rk3588_cru, "rockchip,rk3588-cru", rk3588_clk_early_init);
++
++static int clk_rk3588_probe(struct platform_device *pdev)
++{
++	struct rockchip_clk_provider *ctx = early_ctx;
++	struct device *dev = &pdev->dev;
++	struct device_node *np = dev->of_node;
++
+ 	rockchip_clk_register_branches(ctx, rk3588_clk_branches,
+ 				       ARRAY_SIZE(rk3588_clk_branches));
+ 
+-	rk3588_rst_init(np, reg_base);
++	rockchip_clk_finalize(ctx);
+ 
++	rk3588_rst_init(np, ctx->reg_base);
+ 	rockchip_register_restart_notifier(ctx, RK3588_GLB_SRST_FST, NULL);
+ 
++	/*
++	 * Re-add clock provider, so that the newly added clocks are also
++	 * re-parented and get their defaults configured.
++	 */
++	of_clk_del_provider(np);
+ 	rockchip_clk_of_add_provider(np, ctx);
++
++	return 0;
+ }
+ 
+-CLK_OF_DECLARE(rk3588_cru, "rockchip,rk3588-cru", rk3588_clk_init);
++static const struct of_device_id clk_rk3588_match_table[] = {
++	{
++		.compatible = "rockchip,rk3588-cru",
++	},
++	{ }
++};
++
++static struct platform_driver clk_rk3588_driver = {
++	.probe		= clk_rk3588_probe,
++	.driver		= {
++		.name	= "clk-rk3588",
++		.of_match_table = clk_rk3588_match_table,
++		.suppress_bind_attrs = true,
++	},
++};
++
++static int __init rockchip_clk_rk3588_drv_register(void)
++{
++	return platform_driver_register(&clk_rk3588_driver);
++}
++core_initcall(rockchip_clk_rk3588_drv_register);
diff --git a/target/linux/rockchip/patches-6.6/030-17-v6.14-clk-rockchip-expose-rockchip_clk_set_lookup.patch b/target/linux/rockchip/patches-6.6/030-17-v6.14-clk-rockchip-expose-rockchip_clk_set_lookup.patch
new file mode 100644
index 00000000000000..8711733f51e104
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/030-17-v6.14-clk-rockchip-expose-rockchip_clk_set_lookup.patch
@@ -0,0 +1,90 @@
+From fe0fb6675fa48cade97d8bcd46226479c4a704df Mon Sep 17 00:00:00 2001
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+Date: Wed, 11 Dec 2024 17:58:52 +0100
+Subject: [PATCH] clk: rockchip: expose rockchip_clk_set_lookup
+
+Move rockchip_clk_add_lookup to clk.h, so that it can be used
+by sub-devices with their own driver. These might also have to
+do a lookup, so rename the function to rockchip_clk_set_lookup
+and add a matching rockchip_clk_get_lookup.
+
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Link: https://lore.kernel.org/r/20241211165957.94922-4-sebastian.reichel@collabora.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ drivers/clk/rockchip/clk.c | 14 ++++----------
+ drivers/clk/rockchip/clk.h | 12 ++++++++++++
+ 2 files changed, 16 insertions(+), 10 deletions(-)
+
+--- a/drivers/clk/rockchip/clk.c
++++ b/drivers/clk/rockchip/clk.c
+@@ -197,12 +197,6 @@ static void rockchip_fractional_approxim
+ 	clk_fractional_divider_general_approximation(hw, rate, parent_rate, m, n);
+ }
+ 
+-static void rockchip_clk_add_lookup(struct rockchip_clk_provider *ctx,
+-				    struct clk *clk, unsigned int id)
+-{
+-	ctx->clk_data.clks[id] = clk;
+-}
+-
+ static struct clk *rockchip_clk_register_frac_branch(
+ 		struct rockchip_clk_provider *ctx, const char *name,
+ 		const char *const *parent_names, u8 num_parents,
+@@ -292,7 +286,7 @@ static struct clk *rockchip_clk_register
+ 			return mux_clk;
+ 		}
+ 
+-		rockchip_clk_add_lookup(ctx, mux_clk, child->id);
++		rockchip_clk_set_lookup(ctx, mux_clk, child->id);
+ 
+ 		/* notifier on the fraction divider to catch rate changes */
+ 		if (frac->mux_frac_idx >= 0) {
+@@ -452,7 +446,7 @@ void rockchip_clk_register_plls(struct r
+ 			continue;
+ 		}
+ 
+-		rockchip_clk_add_lookup(ctx, clk, list->id);
++		rockchip_clk_set_lookup(ctx, clk, list->id);
+ 	}
+ }
+ EXPORT_SYMBOL_GPL(rockchip_clk_register_plls);
+@@ -614,7 +608,7 @@ void rockchip_clk_register_branches(stru
+ 			continue;
+ 		}
+ 
+-		rockchip_clk_add_lookup(ctx, clk, list->id);
++		rockchip_clk_set_lookup(ctx, clk, list->id);
+ 	}
+ }
+ EXPORT_SYMBOL_GPL(rockchip_clk_register_branches);
+@@ -638,7 +632,7 @@ void rockchip_clk_register_armclk(struct
+ 		return;
+ 	}
+ 
+-	rockchip_clk_add_lookup(ctx, clk, lookup_id);
++	rockchip_clk_set_lookup(ctx, clk, lookup_id);
+ }
+ EXPORT_SYMBOL_GPL(rockchip_clk_register_armclk);
+ 
+--- a/drivers/clk/rockchip/clk.h
++++ b/drivers/clk/rockchip/clk.h
+@@ -970,6 +970,18 @@ struct rockchip_clk_branch {
+ #define SGRF_GATE(_id, cname, pname)				\
+ 		FACTOR(_id, cname, pname, 0, 1, 1)
+ 
++static inline struct clk *rockchip_clk_get_lookup(struct rockchip_clk_provider *ctx,
++						  unsigned int id)
++{
++	return ctx->clk_data.clks[id];
++}
++
++static inline void rockchip_clk_set_lookup(struct rockchip_clk_provider *ctx,
++					   struct clk *clk, unsigned int id)
++{
++	ctx->clk_data.clks[id] = clk;
++}
++
+ struct rockchip_clk_provider *rockchip_clk_init(struct device_node *np,
+ 			void __iomem *base, unsigned long nr_clks);
+ struct rockchip_clk_provider *rockchip_clk_init_early(struct device_node *np,
diff --git a/target/linux/rockchip/patches-6.6/030-18-v6.14-clk-rockchip-implement-linked-gate-clock-support.patch b/target/linux/rockchip/patches-6.6/030-18-v6.14-clk-rockchip-implement-linked-gate-clock-support.patch
new file mode 100644
index 00000000000000..6e8da4c82c8f46
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/030-18-v6.14-clk-rockchip-implement-linked-gate-clock-support.patch
@@ -0,0 +1,314 @@
+From c62fa612cfa66ab58ab215e5afc95c43c613b513 Mon Sep 17 00:00:00 2001
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+Date: Wed, 11 Dec 2024 17:58:53 +0100
+Subject: [PATCH] clk: rockchip: implement linked gate clock support
+
+Recent Rockchip SoCs have a new hardware block called Native Interface
+Unit (NIU), which gates clocks to devices behind them. These clock
+gates will only have a running output clock when all of the following
+conditions are met:
+
+1. the parent clock is enabled
+2. the enable bit is set correctly
+3. the linked clock is enabled
+
+To handle them this code registers them as a normal gate type clock,
+which takes care of condition 1 + 2. The linked clock is handled by
+using runtime PM clocks. Handling it via runtime PM requires setting
+up a struct device for each of these clocks with a driver attached
+to use the correct runtime PM operations. Thus the complete handling
+of these clocks has been moved into its own driver.
+
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Link: https://lore.kernel.org/r/20241211165957.94922-5-sebastian.reichel@collabora.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ drivers/clk/rockchip/Makefile     |  1 +
+ drivers/clk/rockchip/clk-rk3588.c | 23 +--------
+ drivers/clk/rockchip/clk.c        | 52 +++++++++++++++++++
+ drivers/clk/rockchip/clk.h        | 25 +++++++++
+ drivers/clk/rockchip/gate-link.c  | 85 +++++++++++++++++++++++++++++++
+ 5 files changed, 165 insertions(+), 21 deletions(-)
+ create mode 100644 drivers/clk/rockchip/gate-link.c
+
+--- a/drivers/clk/rockchip/Makefile
++++ b/drivers/clk/rockchip/Makefile
+@@ -13,6 +13,7 @@ clk-rockchip-y += clk-inverter.o
+ clk-rockchip-y += clk-mmc-phase.o
+ clk-rockchip-y += clk-muxgrf.o
+ clk-rockchip-y += clk-ddr.o
++clk-rockchip-y += gate-link.o
+ clk-rockchip-$(CONFIG_RESET_CONTROLLER) += softrst.o
+ 
+ obj-$(CONFIG_CLK_PX30)          += clk-px30.o
+--- a/drivers/clk/rockchip/clk-rk3588.c
++++ b/drivers/clk/rockchip/clk-rk3588.c
+@@ -12,25 +12,6 @@
+ #include <dt-bindings/clock/rockchip,rk3588-cru.h>
+ #include "clk.h"
+ 
+-/*
+- * Recent Rockchip SoCs have a new hardware block called Native Interface
+- * Unit (NIU), which gates clocks to devices behind them. These effectively
+- * need two parent clocks.
+- *
+- * Downstream enables the linked clock via runtime PM whenever the gate is
+- * enabled. This implementation uses separate clock nodes for each of the
+- * linked gate clocks, which leaks parts of the clock tree into DT.
+- *
+- * The GATE_LINK macro instead takes the second parent via 'linkname', but
+- * ignores the information. Once the clock framework is ready to handle it, the
+- * information should be passed on here. But since these clocks are required to
+- * access multiple relevant IP blocks, such as PCIe or USB, we mark all linked
+- * clocks critical until a better solution is available. This will waste some
+- * power, but avoids leaking implementation details into DT or hanging the
+- * system.
+- */
+-#define GATE_LINK(_id, cname, pname, linkedclk, f, o, b, gf) \
+-	GATE(_id, cname, pname, f, o, b, gf)
+ #define RK3588_LINKED_CLK		CLK_IS_CRITICAL
+ 
+ 
+@@ -2513,8 +2494,8 @@ static int clk_rk3588_probe(struct platf
+ 	struct device *dev = &pdev->dev;
+ 	struct device_node *np = dev->of_node;
+ 
+-	rockchip_clk_register_branches(ctx, rk3588_clk_branches,
+-				       ARRAY_SIZE(rk3588_clk_branches));
++	rockchip_clk_register_late_branches(dev, ctx, rk3588_clk_branches,
++					    ARRAY_SIZE(rk3588_clk_branches));
+ 
+ 	rockchip_clk_finalize(ctx);
+ 
+--- a/drivers/clk/rockchip/clk.c
++++ b/drivers/clk/rockchip/clk.c
+@@ -19,6 +19,7 @@
+ #include <linux/clk-provider.h>
+ #include <linux/io.h>
+ #include <linux/mfd/syscon.h>
++#include <linux/platform_device.h>
+ #include <linux/regmap.h>
+ #include <linux/reboot.h>
+ 
+@@ -468,6 +469,29 @@ unsigned long rockchip_clk_find_max_clk_
+ }
+ EXPORT_SYMBOL_GPL(rockchip_clk_find_max_clk_id);
+ 
++static struct platform_device *rockchip_clk_register_gate_link(
++		struct device *parent_dev,
++		struct rockchip_clk_provider *ctx,
++		struct rockchip_clk_branch *clkbr)
++{
++	struct rockchip_gate_link_platdata gate_link_pdata = {
++		.ctx = ctx,
++		.clkbr = clkbr,
++	};
++
++	struct platform_device_info pdevinfo = {
++		.parent = parent_dev,
++		.name = "rockchip-gate-link-clk",
++		.id = clkbr->id,
++		.fwnode = dev_fwnode(parent_dev),
++		.of_node_reused = true,
++		.data = &gate_link_pdata,
++		.size_data = sizeof(gate_link_pdata),
++	};
++
++	return platform_device_register_full(&pdevinfo);
++}
++
+ void rockchip_clk_register_branches(struct rockchip_clk_provider *ctx,
+ 				    struct rockchip_clk_branch *list,
+ 				    unsigned int nr_clk)
+@@ -593,6 +617,9 @@ void rockchip_clk_register_branches(stru
+ 				list->div_width, list->div_flags,
+ 				ctx->reg_base, &ctx->lock);
+ 			break;
++		case branch_linked_gate:
++			/* must be registered late, fall-through for error message */
++			break;
+ 		}
+ 
+ 		/* none of the cases above matched */
+@@ -613,6 +640,31 @@ void rockchip_clk_register_branches(stru
+ }
+ EXPORT_SYMBOL_GPL(rockchip_clk_register_branches);
+ 
++void rockchip_clk_register_late_branches(struct device *dev,
++					 struct rockchip_clk_provider *ctx,
++					 struct rockchip_clk_branch *list,
++					 unsigned int nr_clk)
++{
++	unsigned int idx;
++
++	for (idx = 0; idx < nr_clk; idx++, list++) {
++		struct platform_device *pdev = NULL;
++
++		switch (list->branch_type) {
++		case branch_linked_gate:
++			pdev = rockchip_clk_register_gate_link(dev, ctx, list);
++			break;
++		default:
++			dev_err(dev, "unknown clock type %d\n", list->branch_type);
++			break;
++		}
++
++		if (!pdev)
++			dev_err(dev, "failed to register device for clock %s\n", list->name);
++	}
++}
++EXPORT_SYMBOL_GPL(rockchip_clk_register_late_branches);
++
+ void rockchip_clk_register_armclk(struct rockchip_clk_provider *ctx,
+ 				  unsigned int lookup_id,
+ 				  const char *name, const char *const *parent_names,
+--- a/drivers/clk/rockchip/clk.h
++++ b/drivers/clk/rockchip/clk.h
+@@ -518,6 +518,7 @@ enum rockchip_clk_branch_type {
+ 	branch_divider,
+ 	branch_fraction_divider,
+ 	branch_gate,
++	branch_linked_gate,
+ 	branch_mmc,
+ 	branch_inverter,
+ 	branch_factor,
+@@ -545,6 +546,7 @@ struct rockchip_clk_branch {
+ 	int				gate_offset;
+ 	u8				gate_shift;
+ 	u8				gate_flags;
++	unsigned int			linked_clk_id;
+ 	struct rockchip_clk_branch	*child;
+ };
+ 
+@@ -843,6 +845,20 @@ struct rockchip_clk_branch {
+ 		.gate_flags	= gf,				\
+ 	}
+ 
++#define GATE_LINK(_id, cname, pname, linkedclk, f, o, b, gf)	\
++	{							\
++		.id		= _id,				\
++		.branch_type	= branch_linked_gate,		\
++		.name		= cname,			\
++		.parent_names	= (const char *[]){ pname },	\
++		.linked_clk_id	= linkedclk,			\
++		.num_parents	= 1,				\
++		.flags		= f,				\
++		.gate_offset	= o,				\
++		.gate_shift	= b,				\
++		.gate_flags	= gf,				\
++	}
++
+ #define MMC(_id, cname, pname, offset, shift)			\
+ 	{							\
+ 		.id		= _id,				\
+@@ -982,6 +998,11 @@ static inline void rockchip_clk_set_look
+ 	ctx->clk_data.clks[id] = clk;
+ }
+ 
++struct rockchip_gate_link_platdata {
++	struct rockchip_clk_provider *ctx;
++	struct rockchip_clk_branch *clkbr;
++};
++
+ struct rockchip_clk_provider *rockchip_clk_init(struct device_node *np,
+ 			void __iomem *base, unsigned long nr_clks);
+ struct rockchip_clk_provider *rockchip_clk_init_early(struct device_node *np,
+@@ -994,6 +1015,10 @@ unsigned long rockchip_clk_find_max_clk_
+ void rockchip_clk_register_branches(struct rockchip_clk_provider *ctx,
+ 				    struct rockchip_clk_branch *list,
+ 				    unsigned int nr_clk);
++void rockchip_clk_register_late_branches(struct device *dev,
++					 struct rockchip_clk_provider *ctx,
++					 struct rockchip_clk_branch *list,
++					 unsigned int nr_clk);
+ void rockchip_clk_register_plls(struct rockchip_clk_provider *ctx,
+ 				struct rockchip_pll_clock *pll_list,
+ 				unsigned int nr_pll, int grf_lock_offset);
+--- /dev/null
++++ b/drivers/clk/rockchip/gate-link.c
+@@ -0,0 +1,85 @@
++// SPDX-License-Identifier: GPL-2.0-or-later
++/*
++ * Copyright (c) 2024 Collabora Ltd.
++ * Author: Sebastian Reichel <sebastian.reichel@collabora.com>
++ */
++
++#include <linux/clk.h>
++#include <linux/platform_device.h>
++#include <linux/pm_clock.h>
++#include <linux/pm_runtime.h>
++#include <linux/property.h>
++#include "clk.h"
++
++static int rk_clk_gate_link_register(struct device *dev,
++				     struct rockchip_clk_provider *ctx,
++				     struct rockchip_clk_branch *clkbr)
++{
++	unsigned long flags = clkbr->flags | CLK_SET_RATE_PARENT;
++	struct clk *clk;
++
++	clk = clk_register_gate(dev, clkbr->name, clkbr->parent_names[0],
++				flags, ctx->reg_base + clkbr->gate_offset,
++				clkbr->gate_shift, clkbr->gate_flags,
++				&ctx->lock);
++
++	if (IS_ERR(clk))
++		return PTR_ERR(clk);
++
++	rockchip_clk_set_lookup(ctx, clk, clkbr->id);
++	return 0;
++}
++
++static int rk_clk_gate_link_probe(struct platform_device *pdev)
++{
++	struct rockchip_gate_link_platdata *pdata;
++	struct device *dev = &pdev->dev;
++	struct clk *linked_clk;
++	int ret;
++
++	pdata = dev_get_platdata(dev);
++	if (!pdata)
++		return dev_err_probe(dev, -ENODEV, "missing platform data");
++
++	ret = devm_pm_runtime_enable(dev);
++	if (ret)
++		return ret;
++
++	ret = devm_pm_clk_create(dev);
++	if (ret)
++		return ret;
++
++	linked_clk = rockchip_clk_get_lookup(pdata->ctx, pdata->clkbr->linked_clk_id);
++	ret = pm_clk_add_clk(dev, linked_clk);
++	if (ret)
++		return ret;
++
++	ret = rk_clk_gate_link_register(dev, pdata->ctx, pdata->clkbr);
++	if (ret)
++		goto err;
++
++	return 0;
++
++err:
++	pm_clk_remove_clk(dev, linked_clk);
++	return ret;
++}
++
++static const struct dev_pm_ops rk_clk_gate_link_pm_ops = {
++	SET_RUNTIME_PM_OPS(pm_clk_suspend, pm_clk_resume, NULL)
++};
++
++static struct platform_driver rk_clk_gate_link_driver = {
++	.probe		= rk_clk_gate_link_probe,
++	.driver		= {
++		.name	= "rockchip-gate-link-clk",
++		.pm = &rk_clk_gate_link_pm_ops,
++		.suppress_bind_attrs = true,
++	},
++};
++
++static int __init rk_clk_gate_link_drv_register(void)
++{
++	return platform_driver_register(&rk_clk_gate_link_driver);
++}
++core_initcall(rk_clk_gate_link_drv_register);
diff --git a/target/linux/rockchip/patches-6.6/030-19-v6.14-clk-rockchip-rk3588-drop-RK3588_LINKED_CLK.patch b/target/linux/rockchip/patches-6.6/030-19-v6.14-clk-rockchip-rk3588-drop-RK3588_LINKED_CLK.patch
new file mode 100644
index 00000000000000..0e487f9b48c927
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/030-19-v6.14-clk-rockchip-rk3588-drop-RK3588_LINKED_CLK.patch
@@ -0,0 +1,112 @@
+From e9cdd7d6cf2a5031a968dc21f4f566101b602150 Mon Sep 17 00:00:00 2001
+From: Sebastian Reichel <sebastian.reichel@collabora.com>
+Date: Wed, 11 Dec 2024 17:58:54 +0100
+Subject: [PATCH] clk: rockchip: rk3588: drop RK3588_LINKED_CLK
+
+With the proper GATE_LINK support, we no longer need to keep the
+linked clocks always on. Thus it's time to drop the CLK_IS_CRITICAL
+flag for them.
+
+Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
+Link: https://lore.kernel.org/r/20241211165957.94922-6-sebastian.reichel@collabora.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ drivers/clk/rockchip/clk-rk3588.c | 27 ++++++++++++---------------
+ 1 file changed, 12 insertions(+), 15 deletions(-)
+
+--- a/drivers/clk/rockchip/clk-rk3588.c
++++ b/drivers/clk/rockchip/clk-rk3588.c
+@@ -12,9 +12,6 @@
+ #include <dt-bindings/clock/rockchip,rk3588-cru.h>
+ #include "clk.h"
+ 
+-#define RK3588_LINKED_CLK		CLK_IS_CRITICAL
+-
+-
+ #define RK3588_GRF_SOC_STATUS0		0x600
+ #define RK3588_PHYREF_ALT_GATE		0xc38
+ 
+@@ -1439,7 +1436,7 @@ static struct rockchip_clk_branch rk3588
+ 	COMPOSITE_NODIV(HCLK_NVM_ROOT,  "hclk_nvm_root", mux_200m_100m_50m_24m_p, 0,
+ 			RK3588_CLKSEL_CON(77), 0, 2, MFLAGS,
+ 			RK3588_CLKGATE_CON(31), 0, GFLAGS),
+-	COMPOSITE(ACLK_NVM_ROOT, "aclk_nvm_root", gpll_cpll_p, RK3588_LINKED_CLK,
++	COMPOSITE(ACLK_NVM_ROOT, "aclk_nvm_root", gpll_cpll_p, 0,
+ 			RK3588_CLKSEL_CON(77), 7, 1, MFLAGS, 2, 5, DFLAGS,
+ 			RK3588_CLKGATE_CON(31), 1, GFLAGS),
+ 	GATE(ACLK_EMMC, "aclk_emmc", "aclk_nvm_root", 0,
+@@ -1668,13 +1665,13 @@ static struct rockchip_clk_branch rk3588
+ 			RK3588_CLKGATE_CON(42), 9, GFLAGS),
+ 
+ 	/* vdpu */
+-	COMPOSITE(ACLK_VDPU_ROOT, "aclk_vdpu_root", gpll_cpll_aupll_p, RK3588_LINKED_CLK,
++	COMPOSITE(ACLK_VDPU_ROOT, "aclk_vdpu_root", gpll_cpll_aupll_p, 0,
+ 			RK3588_CLKSEL_CON(98), 5, 2, MFLAGS, 0, 5, DFLAGS,
+ 			RK3588_CLKGATE_CON(44), 0, GFLAGS),
+ 	COMPOSITE_NODIV(ACLK_VDPU_LOW_ROOT, "aclk_vdpu_low_root", mux_400m_200m_100m_24m_p, 0,
+ 			RK3588_CLKSEL_CON(98), 7, 2, MFLAGS,
+ 			RK3588_CLKGATE_CON(44), 1, GFLAGS),
+-	COMPOSITE_NODIV(HCLK_VDPU_ROOT, "hclk_vdpu_root", mux_200m_100m_50m_24m_p, RK3588_LINKED_CLK,
++	COMPOSITE_NODIV(HCLK_VDPU_ROOT, "hclk_vdpu_root", mux_200m_100m_50m_24m_p, 0,
+ 			RK3588_CLKSEL_CON(98), 9, 2, MFLAGS,
+ 			RK3588_CLKGATE_CON(44), 2, GFLAGS),
+ 	COMPOSITE(ACLK_JPEG_DECODER_ROOT, "aclk_jpeg_decoder_root", gpll_cpll_aupll_spll_p, 0,
+@@ -1725,9 +1722,9 @@ static struct rockchip_clk_branch rk3588
+ 	COMPOSITE(ACLK_RKVENC0_ROOT, "aclk_rkvenc0_root", gpll_cpll_npll_p, 0,
+ 			RK3588_CLKSEL_CON(102), 7, 2, MFLAGS, 2, 5, DFLAGS,
+ 			RK3588_CLKGATE_CON(47), 1, GFLAGS),
+-	GATE(HCLK_RKVENC0, "hclk_rkvenc0", "hclk_rkvenc0_root", RK3588_LINKED_CLK,
++	GATE(HCLK_RKVENC0, "hclk_rkvenc0", "hclk_rkvenc0_root", 0,
+ 			RK3588_CLKGATE_CON(47), 4, GFLAGS),
+-	GATE(ACLK_RKVENC0, "aclk_rkvenc0", "aclk_rkvenc0_root", RK3588_LINKED_CLK,
++	GATE(ACLK_RKVENC0, "aclk_rkvenc0", "aclk_rkvenc0_root", 0,
+ 			RK3588_CLKGATE_CON(47), 5, GFLAGS),
+ 	COMPOSITE(CLK_RKVENC0_CORE, "clk_rkvenc0_core", gpll_cpll_aupll_npll_p, 0,
+ 			RK3588_CLKSEL_CON(102), 14, 2, MFLAGS, 9, 5, DFLAGS,
+@@ -1737,10 +1734,10 @@ static struct rockchip_clk_branch rk3588
+ 			RK3588_CLKGATE_CON(48), 6, GFLAGS),
+ 
+ 	/* vi */
+-	COMPOSITE(ACLK_VI_ROOT, "aclk_vi_root", gpll_cpll_npll_aupll_spll_p, RK3588_LINKED_CLK,
++	COMPOSITE(ACLK_VI_ROOT, "aclk_vi_root", gpll_cpll_npll_aupll_spll_p, 0,
+ 			RK3588_CLKSEL_CON(106), 5, 3, MFLAGS, 0, 5, DFLAGS,
+ 			RK3588_CLKGATE_CON(49), 0, GFLAGS),
+-	COMPOSITE_NODIV(HCLK_VI_ROOT, "hclk_vi_root", mux_200m_100m_50m_24m_p, RK3588_LINKED_CLK,
++	COMPOSITE_NODIV(HCLK_VI_ROOT, "hclk_vi_root", mux_200m_100m_50m_24m_p, 0,
+ 			RK3588_CLKSEL_CON(106), 8, 2, MFLAGS,
+ 			RK3588_CLKGATE_CON(49), 1, GFLAGS),
+ 	COMPOSITE_NODIV(PCLK_VI_ROOT, "pclk_vi_root", mux_100m_50m_24m_p, 0,
+@@ -1910,10 +1907,10 @@ static struct rockchip_clk_branch rk3588
+ 	COMPOSITE(ACLK_VOP_ROOT, "aclk_vop_root", gpll_cpll_dmyaupll_npll_spll_p, 0,
+ 			RK3588_CLKSEL_CON(110), 5, 3, MFLAGS, 0, 5, DFLAGS,
+ 			RK3588_CLKGATE_CON(52), 0, GFLAGS),
+-	COMPOSITE_NODIV(ACLK_VOP_LOW_ROOT, "aclk_vop_low_root", mux_400m_200m_100m_24m_p, RK3588_LINKED_CLK,
++	COMPOSITE_NODIV(ACLK_VOP_LOW_ROOT, "aclk_vop_low_root", mux_400m_200m_100m_24m_p, 0,
+ 			RK3588_CLKSEL_CON(110), 8, 2, MFLAGS,
+ 			RK3588_CLKGATE_CON(52), 1, GFLAGS),
+-	COMPOSITE_NODIV(HCLK_VOP_ROOT, "hclk_vop_root", mux_200m_100m_50m_24m_p, RK3588_LINKED_CLK,
++	COMPOSITE_NODIV(HCLK_VOP_ROOT, "hclk_vop_root", mux_200m_100m_50m_24m_p, 0,
+ 			RK3588_CLKSEL_CON(110), 10, 2, MFLAGS,
+ 			RK3588_CLKGATE_CON(52), 2, GFLAGS),
+ 	COMPOSITE_NODIV(PCLK_VOP_ROOT, "pclk_vop_root", mux_100m_50m_24m_p, 0,
+@@ -2416,7 +2413,7 @@ static struct rockchip_clk_branch rk3588
+ static struct rockchip_clk_branch rk3588_clk_branches[] = {
+ 	GATE_LINK(ACLK_ISP1_PRE, "aclk_isp1_pre", "aclk_isp1_root", ACLK_VI_ROOT, 0, RK3588_CLKGATE_CON(26), 6, GFLAGS),
+ 	GATE_LINK(HCLK_ISP1_PRE, "hclk_isp1_pre", "hclk_isp1_root", HCLK_VI_ROOT, 0, RK3588_CLKGATE_CON(26), 8, GFLAGS),
+-	GATE_LINK(HCLK_NVM, "hclk_nvm", "hclk_nvm_root", ACLK_NVM_ROOT, RK3588_LINKED_CLK, RK3588_CLKGATE_CON(31), 2, GFLAGS),
++	GATE_LINK(HCLK_NVM, "hclk_nvm", "hclk_nvm_root", ACLK_NVM_ROOT, 0, RK3588_CLKGATE_CON(31), 2, GFLAGS),
+ 	GATE_LINK(ACLK_USB, "aclk_usb", "aclk_usb_root", ACLK_VO1USB_TOP_ROOT, 0, RK3588_CLKGATE_CON(42), 2, GFLAGS),
+ 	GATE_LINK(HCLK_USB, "hclk_usb", "hclk_usb_root", HCLK_VO1USB_TOP_ROOT, 0, RK3588_CLKGATE_CON(42), 3, GFLAGS),
+ 	GATE_LINK(ACLK_JPEG_DECODER_PRE, "aclk_jpeg_decoder_pre", "aclk_jpeg_decoder_root", ACLK_VDPU_ROOT, 0, RK3588_CLKGATE_CON(44), 7, GFLAGS),
+@@ -2428,9 +2425,9 @@ static struct rockchip_clk_branch rk3588
+ 	GATE_LINK(HCLK_RKVDEC1_PRE, "hclk_rkvdec1_pre", "hclk_rkvdec1_root", HCLK_VDPU_ROOT, 0, RK3588_CLKGATE_CON(41), 4, GFLAGS),
+ 	GATE_LINK(ACLK_RKVDEC1_PRE, "aclk_rkvdec1_pre", "aclk_rkvdec1_root", ACLK_VDPU_ROOT, 0, RK3588_CLKGATE_CON(41), 5, GFLAGS),
+ 	GATE_LINK(ACLK_HDCP0_PRE, "aclk_hdcp0_pre", "aclk_vo0_root", ACLK_VOP_LOW_ROOT, 0, RK3588_CLKGATE_CON(55), 9, GFLAGS),
+-	GATE_LINK(HCLK_VO0, "hclk_vo0", "hclk_vo0_root", HCLK_VOP_ROOT, RK3588_LINKED_CLK, RK3588_CLKGATE_CON(55), 5, GFLAGS),
++	GATE_LINK(HCLK_VO0, "hclk_vo0", "hclk_vo0_root", HCLK_VOP_ROOT, 0, RK3588_CLKGATE_CON(55), 5, GFLAGS),
+ 	GATE_LINK(ACLK_HDCP1_PRE, "aclk_hdcp1_pre", "aclk_hdcp1_root", ACLK_VO1USB_TOP_ROOT, 0, RK3588_CLKGATE_CON(59), 6, GFLAGS),
+-	GATE_LINK(HCLK_VO1, "hclk_vo1", "hclk_vo1_root", HCLK_VO1USB_TOP_ROOT, RK3588_LINKED_CLK, RK3588_CLKGATE_CON(59), 9, GFLAGS),
++	GATE_LINK(HCLK_VO1, "hclk_vo1", "hclk_vo1_root", HCLK_VO1USB_TOP_ROOT, 0, RK3588_CLKGATE_CON(59), 9, GFLAGS),
+ 	GATE_LINK(ACLK_AV1_PRE, "aclk_av1_pre", "aclk_av1_root", ACLK_VDPU_ROOT, 0, RK3588_CLKGATE_CON(68), 1, GFLAGS),
+ 	GATE_LINK(PCLK_AV1_PRE, "pclk_av1_pre", "pclk_av1_root", HCLK_VDPU_ROOT, 0, RK3588_CLKGATE_CON(68), 4, GFLAGS),
+ 	GATE_LINK(HCLK_SDIO_PRE, "hclk_sdio_pre", "hclk_sdio_root", HCLK_NVM, 0, RK3588_CLKGATE_CON(75), 1, GFLAGS),
diff --git a/target/linux/rockchip/patches-6.6/030-20-v6.14-clk-rockchip-rk3588-make-refclko25m_ethX-critical.patch b/target/linux/rockchip/patches-6.6/030-20-v6.14-clk-rockchip-rk3588-make-refclko25m_ethX-critical.patch
new file mode 100644
index 00000000000000..76425559ad9be9
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/030-20-v6.14-clk-rockchip-rk3588-make-refclko25m_ethX-critical.patch
@@ -0,0 +1,54 @@
+From cd8b5366636bdff0449b789fb2d33abb20804255 Mon Sep 17 00:00:00 2001
+From: Heiko Stuebner <heiko.stuebner@cherry.de>
+Date: Sat, 14 Dec 2024 23:48:19 +0100
+Subject: [PATCH] clk: rockchip: rk3588: make refclko25m_ethX critical
+
+Ethernet phys normally need a 25MHz refclk input. On a lot of boards
+this is done with a dedicated 25MHz crystal. But the rk3588 CRU also
+provides a means for that via the refclko25m_ethX clock outputs that
+can be used for that function.
+
+The mdio bus normally probes devices on the bus at runtime, by reading
+specific phy registers. This requires the phy to be running and thus
+also being supplied by its reference clock.
+
+While there exist the possibility and dt-binding to declare these
+input clocks for each phy in the phy-dt-node, this is only relevant
+_after_ the phy has been detected and during the drivers probe-run.
+
+This results in a chicken-and-egg-problem. The refclks in the CRU are
+running on boot of course, but phy-probing can very well happen after
+clk_disable_unused has run.
+
+In the past I tried to make clock-handling part of the mdio bus code [0]
+but that wasn't very well received, due to it being specific to OF and
+clocks with the consensus being that resources needed for detection
+need to be enabled before.
+
+So to make probing ethernet phys using the internal refclks possible,
+make those 2 clocks critical.
+
+[0] https://lore.kernel.org/netdev/13590315.F0gNSz5aLb@diego/T/
+
+Signed-off-by: Heiko Stuebner <heiko.stuebner@cherry.de>
+Link: https://lore.kernel.org/r/20241214224820.200665-1-heiko@sntech.de
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ drivers/clk/rockchip/clk-rk3588.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/rockchip/clk-rk3588.c
++++ b/drivers/clk/rockchip/clk-rk3588.c
+@@ -772,10 +772,10 @@ static struct rockchip_clk_branch rk3588
+ 	COMPOSITE(MCLK_GMAC0_OUT, "mclk_gmac0_out", gpll_cpll_p, 0,
+ 			RK3588_CLKSEL_CON(15), 7, 1, MFLAGS, 0, 7, DFLAGS,
+ 			RK3588_CLKGATE_CON(5), 3, GFLAGS),
+-	COMPOSITE(REFCLKO25M_ETH0_OUT, "refclko25m_eth0_out", gpll_cpll_p, 0,
++	COMPOSITE(REFCLKO25M_ETH0_OUT, "refclko25m_eth0_out", gpll_cpll_p, CLK_IS_CRITICAL,
+ 			RK3588_CLKSEL_CON(15), 15, 1, MFLAGS, 8, 7, DFLAGS,
+ 			RK3588_CLKGATE_CON(5), 4, GFLAGS),
+-	COMPOSITE(REFCLKO25M_ETH1_OUT, "refclko25m_eth1_out", gpll_cpll_p, 0,
++	COMPOSITE(REFCLKO25M_ETH1_OUT, "refclko25m_eth1_out", gpll_cpll_p, CLK_IS_CRITICAL,
+ 			RK3588_CLKSEL_CON(16), 7, 1, MFLAGS, 0, 7, DFLAGS,
+ 			RK3588_CLKGATE_CON(5), 5, GFLAGS),
+ 	COMPOSITE(CLK_CIFOUT_OUT, "clk_cifout_out", gpll_cpll_24m_spll_p, 0,
diff --git a/target/linux/rockchip/patches-6.6/030-21-v6.15-clk-rockchip-rk3568-mark-hclk_vi-as-critical.patch b/target/linux/rockchip/patches-6.6/030-21-v6.15-clk-rockchip-rk3568-mark-hclk_vi-as-critical.patch
new file mode 100644
index 00000000000000..ab474ab81dcef2
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/030-21-v6.15-clk-rockchip-rk3568-mark-hclk_vi-as-critical.patch
@@ -0,0 +1,31 @@
+From 83dbeca33f7422f4a30c8a91a79d6c0dba4fb6af Mon Sep 17 00:00:00 2001
+From: Michael Riesch <michael.riesch@wolfvision.net>
+Date: Mon, 10 Feb 2025 09:29:02 +0100
+Subject: [PATCH] clk: rockchip: rk3568: mark hclk_vi as critical
+
+The clock 'pclk_vi_niu' has a dependency on 'hclk_vi_niu' according
+to the Technical Reference Manual section '2.8.6 NIU Clock gating
+reliance'. However, this kind of dependency cannot be addressed
+properly at the moment (until the support for linked clocks is
+implemented for the RK3568).
+As an intermediate solution, mark the hclk_vi as critical on the
+Rockchip RK3568.
+
+Suggested-by: Nicolas Frattaroli <frattaroli.nicolas@gmail.com>
+Signed-off-by: Michael Riesch <michael.riesch@wolfvision.net>
+Link: https://lore.kernel.org/r/20250210-rk3568-hclk-vi-v1-1-9ade2626f638@wolfvision.net
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ drivers/clk/rockchip/clk-rk3568.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/clk/rockchip/clk-rk3568.c
++++ b/drivers/clk/rockchip/clk-rk3568.c
+@@ -1593,6 +1593,7 @@ static const char *const rk3568_cru_crit
+ 	"hclk_php",
+ 	"pclk_php",
+ 	"hclk_usb",
++	"hclk_vi",
+ 	"hclk_vo",
+ };
+ 
diff --git a/target/linux/rockchip/patches-6.6/030-22-v6.16-clk-rockchip-rk3588-Add-PLL-rate-for-1500-MHz.patch b/target/linux/rockchip/patches-6.6/030-22-v6.16-clk-rockchip-rk3588-Add-PLL-rate-for-1500-MHz.patch
new file mode 100644
index 00000000000000..ba4df3d9be2935
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/030-22-v6.16-clk-rockchip-rk3588-Add-PLL-rate-for-1500-MHz.patch
@@ -0,0 +1,25 @@
+From 831a8ac72264426ccd0ee5d2b0d74491ea7d2bfb Mon Sep 17 00:00:00 2001
+From: Alexander Shiyan <eagle.alexander923@gmail.com>
+Date: Tue, 8 Apr 2025 09:46:12 +0300
+Subject: [PATCH] clk: rockchip: rk3588: Add PLL rate for 1500 MHz
+
+At least one RK3588 clock (CPLL) uses 1.5 GHz, so let's add
+that frequency to the PLL table.
+
+Signed-off-by: Alexander Shiyan <eagle.alexander923@gmail.com>
+Link: https://lore.kernel.org/r/20250408064612.41359-1-eagle.alexander923@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ drivers/clk/rockchip/clk-rk3588.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/clk/rockchip/clk-rk3588.c
++++ b/drivers/clk/rockchip/clk-rk3588.c
+@@ -64,6 +64,7 @@ static struct rockchip_pll_rate_table rk
+ 	RK3588_PLL_RATE(1560000000, 2, 260, 1, 0),
+ 	RK3588_PLL_RATE(1536000000, 2, 256, 1, 0),
+ 	RK3588_PLL_RATE(1512000000, 2, 252, 1, 0),
++	RK3588_PLL_RATE(1500000000, 2, 250, 1, 0),
+ 	RK3588_PLL_RATE(1488000000, 2, 248, 1, 0),
+ 	RK3588_PLL_RATE(1464000000, 2, 244, 1, 0),
+ 	RK3588_PLL_RATE(1440000000, 2, 240, 1, 0),
diff --git a/target/linux/rockchip/patches-6.6/030-23-v6.16-clk-rockchip-Drop-empty-init-callback-for-rk3588-PLL-type.patch b/target/linux/rockchip/patches-6.6/030-23-v6.16-clk-rockchip-Drop-empty-init-callback-for-rk3588-PLL-type.patch
new file mode 100644
index 00000000000000..61341a8e95d6dc
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/030-23-v6.16-clk-rockchip-Drop-empty-init-callback-for-rk3588-PLL-type.patch
@@ -0,0 +1,44 @@
+From 646bfc52bbe184c0579060c3919e5d70885b0dcc Mon Sep 17 00:00:00 2001
+From: Yao Zi <ziyao@disroot.org>
+Date: Wed, 26 Mar 2025 11:35:56 +0000
+Subject: [PATCH] clk: rockchip: Drop empty init callback for rk3588 PLL type
+
+Unlike PLLs in previous geneation of SoCs, PLLs in RK3588 type don't
+require any platform-specific initialization. Drop callback
+rockchip_rk3588_pll_init() that does nothing in fact to clean the
+driver up.
+
+Signed-off-by: Yao Zi <ziyao@disroot.org>
+Link: https://lore.kernel.org/r/20250326113556.21039-1-ziyao@disroot.org
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ drivers/clk/rockchip/clk-pll.c | 11 -----------
+ 1 file changed, 11 deletions(-)
+
+--- a/drivers/clk/rockchip/clk-pll.c
++++ b/drivers/clk/rockchip/clk-pll.c
+@@ -1025,16 +1025,6 @@ static int rockchip_rk3588_pll_is_enable
+ 	return !(pllcon & RK3588_PLLCON1_PWRDOWN);
+ }
+ 
+-static int rockchip_rk3588_pll_init(struct clk_hw *hw)
+-{
+-	struct rockchip_clk_pll *pll = to_rockchip_clk_pll(hw);
+-
+-	if (!(pll->flags & ROCKCHIP_PLL_SYNC_RATE))
+-		return 0;
+-
+-	return 0;
+-}
+-
+ static const struct clk_ops rockchip_rk3588_pll_clk_norate_ops = {
+ 	.recalc_rate = rockchip_rk3588_pll_recalc_rate,
+ 	.enable = rockchip_rk3588_pll_enable,
+@@ -1049,7 +1039,6 @@ static const struct clk_ops rockchip_rk3
+ 	.enable = rockchip_rk3588_pll_enable,
+ 	.disable = rockchip_rk3588_pll_disable,
+ 	.is_enabled = rockchip_rk3588_pll_is_enabled,
+-	.init = rockchip_rk3588_pll_init,
+ };
+ 
+ /*
diff --git a/target/linux/rockchip/patches-6.6/032-04-v6.10-phy-rockchip-Fix-typo-in-function-names.patch b/target/linux/rockchip/patches-6.6/032-04-v6.10-phy-rockchip-Fix-typo-in-function-names.patch
index 9495dd2b108839..08620d66ecfd4c 100644
--- a/target/linux/rockchip/patches-6.6/032-04-v6.10-phy-rockchip-Fix-typo-in-function-names.patch
+++ b/target/linux/rockchip/patches-6.6/032-04-v6.10-phy-rockchip-Fix-typo-in-function-names.patch
@@ -26,7 +26,7 @@ Signed-off-by: Vinod Koul <vkoul@kernel.org>
  	.init = rockchip_combphy_init,
  	.exit = rockchip_combphy_exit,
  	.owner = THIS_MODULE,
-@@ -364,7 +364,7 @@ static int rockchip_combphy_probe(struct
+@@ -367,7 +367,7 @@ static int rockchip_combphy_probe(struct
  		return ret;
  	}
  
diff --git a/target/linux/rockchip/patches-6.6/033-01-v6.12-hwrng-rockchip-rst-is-used-only-during-probe.patch b/target/linux/rockchip/patches-6.6/033-01-v6.12-hwrng-rockchip-rst-is-used-only-during-probe.patch
new file mode 100644
index 00000000000000..452506fe37970b
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/033-01-v6.12-hwrng-rockchip-rst-is-used-only-during-probe.patch
@@ -0,0 +1,53 @@
+From 9c2797093a4095a1d686b6c51fbd321a627855ee Mon Sep 17 00:00:00 2001
+From: Martin Kaiser <martin@kaiser.cx>
+Date: Wed, 21 Aug 2024 20:12:34 +0200
+Subject: [PATCH] hwrng: rockchip - rst is used only during probe
+
+The driver uses the rst variable only for an initial reset when the chip
+is probed. There's no need to store rst in the driver's private data, we
+can make it a local variable in the probe function.
+
+Signed-off-by: Martin Kaiser <martin@kaiser.cx>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ drivers/char/hw_random/rockchip-rng.c | 13 ++++++-------
+ 1 file changed, 6 insertions(+), 7 deletions(-)
+
+--- a/drivers/char/hw_random/rockchip-rng.c
++++ b/drivers/char/hw_random/rockchip-rng.c
+@@ -52,7 +52,6 @@
+ struct rk_rng {
+ 	struct hwrng rng;
+ 	void __iomem *base;
+-	struct reset_control *rst;
+ 	int clk_num;
+ 	struct clk_bulk_data *clk_bulks;
+ };
+@@ -132,6 +131,7 @@ out:
+ static int rk_rng_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
++	struct reset_control *rst;
+ 	struct rk_rng *rk_rng;
+ 	int ret;
+ 
+@@ -148,14 +148,13 @@ static int rk_rng_probe(struct platform_
+ 		return dev_err_probe(dev, rk_rng->clk_num,
+ 				     "Failed to get clks property\n");
+ 
+-	rk_rng->rst = devm_reset_control_array_get_exclusive(&pdev->dev);
+-	if (IS_ERR(rk_rng->rst))
+-		return dev_err_probe(dev, PTR_ERR(rk_rng->rst),
+-				     "Failed to get reset property\n");
++	rst = devm_reset_control_array_get_exclusive(&pdev->dev);
++	if (IS_ERR(rst))
++		return dev_err_probe(dev, PTR_ERR(rst), "Failed to get reset property\n");
+ 
+-	reset_control_assert(rk_rng->rst);
++	reset_control_assert(rst);
+ 	udelay(2);
+-	reset_control_deassert(rk_rng->rst);
++	reset_control_deassert(rst);
+ 
+ 	platform_set_drvdata(pdev, rk_rng);
+ 
diff --git a/target/linux/rockchip/patches-6.6/033-02-v6.12-hwrng-rockchip-handle-devm_pm_runtime_enable-errors.patch b/target/linux/rockchip/patches-6.6/033-02-v6.12-hwrng-rockchip-handle-devm_pm_runtime_enable-errors.patch
new file mode 100644
index 00000000000000..5d4b875bc95026
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/033-02-v6.12-hwrng-rockchip-handle-devm_pm_runtime_enable-errors.patch
@@ -0,0 +1,27 @@
+From 866ff78da10178cf98600f59ea353fb1b2b7976e Mon Sep 17 00:00:00 2001
+From: Martin Kaiser <martin@kaiser.cx>
+Date: Wed, 21 Aug 2024 20:12:35 +0200
+Subject: [PATCH] hwrng: rockchip - handle devm_pm_runtime_enable errors
+
+It's unlikely that devm_pm_runtime_enable ever fails. Still, it makes
+sense to read the return value and handle errors.
+
+Signed-off-by: Martin Kaiser <martin@kaiser.cx>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ drivers/char/hw_random/rockchip-rng.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/char/hw_random/rockchip-rng.c
++++ b/drivers/char/hw_random/rockchip-rng.c
+@@ -169,7 +169,9 @@ static int rk_rng_probe(struct platform_
+ 
+ 	pm_runtime_set_autosuspend_delay(dev, RK_RNG_AUTOSUSPEND_DELAY);
+ 	pm_runtime_use_autosuspend(dev);
+-	devm_pm_runtime_enable(dev);
++	ret = devm_pm_runtime_enable(dev);
++	if (ret)
++		return dev_err_probe(&pdev->dev, ret, "Runtime pm activation failed.\n");
+ 
+ 	ret = devm_hwrng_register(dev, &rk_rng->rng);
+ 	if (ret)
diff --git a/target/linux/rockchip/patches-6.6/033-03-v6.15-hwrng-rockchip-store-dev-pointer-in-driver-struct.patch b/target/linux/rockchip/patches-6.6/033-03-v6.15-hwrng-rockchip-store-dev-pointer-in-driver-struct.patch
new file mode 100644
index 00000000000000..2f14fcd8884bef
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/033-03-v6.15-hwrng-rockchip-store-dev-pointer-in-driver-struct.patch
@@ -0,0 +1,67 @@
+From 8bb8609293ff3d8998d75c8db605c0529e83bcd9 Mon Sep 17 00:00:00 2001
+From: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+Date: Tue, 4 Feb 2025 16:35:48 +0100
+Subject: [PATCH] hwrng: rockchip - store dev pointer in driver struct
+
+The rockchip rng driver does a dance to store the dev pointer in the
+hwrng's unsigned long "priv" member. However, since the struct hwrng
+member of rk_rng is not a pointer, we can use container_of to get the
+struct rk_rng instance from just the struct hwrng*, which means we don't
+have to subvert what little there is in C of a type system and can
+instead store a pointer to the device struct in the rk_rng itself.
+
+Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ drivers/char/hw_random/rockchip-rng.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/char/hw_random/rockchip-rng.c
++++ b/drivers/char/hw_random/rockchip-rng.c
+@@ -54,6 +54,7 @@ struct rk_rng {
+ 	void __iomem *base;
+ 	int clk_num;
+ 	struct clk_bulk_data *clk_bulks;
++	struct device *dev;
+ };
+ 
+ /* The mask in the upper 16 bits determines the bits that are updated */
+@@ -70,8 +71,7 @@ static int rk_rng_init(struct hwrng *rng
+ 	/* start clocks */
+ 	ret = clk_bulk_prepare_enable(rk_rng->clk_num, rk_rng->clk_bulks);
+ 	if (ret < 0) {
+-		dev_err((struct device *) rk_rng->rng.priv,
+-			"Failed to enable clks %d\n", ret);
++		dev_err(rk_rng->dev, "Failed to enable clocks: %d\n", ret);
+ 		return ret;
+ 	}
+ 
+@@ -105,7 +105,7 @@ static int rk_rng_read(struct hwrng *rng
+ 	u32 reg;
+ 	int ret = 0;
+ 
+-	ret = pm_runtime_resume_and_get((struct device *) rk_rng->rng.priv);
++	ret = pm_runtime_resume_and_get(rk_rng->dev);
+ 	if (ret < 0)
+ 		return ret;
+ 
+@@ -122,8 +122,8 @@ static int rk_rng_read(struct hwrng *rng
+ 	/* Read random data stored in the registers */
+ 	memcpy_fromio(buf, rk_rng->base + TRNG_RNG_DOUT, to_read);
+ out:
+-	pm_runtime_mark_last_busy((struct device *) rk_rng->rng.priv);
+-	pm_runtime_put_sync_autosuspend((struct device *) rk_rng->rng.priv);
++	pm_runtime_mark_last_busy(rk_rng->dev);
++	pm_runtime_put_sync_autosuspend(rk_rng->dev);
+ 
+ 	return (ret < 0) ? ret : to_read;
+ }
+@@ -164,7 +164,7 @@ static int rk_rng_probe(struct platform_
+ 		rk_rng->rng.cleanup = rk_rng_cleanup;
+ 	}
+ 	rk_rng->rng.read = rk_rng_read;
+-	rk_rng->rng.priv = (unsigned long) dev;
++	rk_rng->dev = dev;
+ 	rk_rng->rng.quality = 900;
+ 
+ 	pm_runtime_set_autosuspend_delay(dev, RK_RNG_AUTOSUSPEND_DELAY);
diff --git a/target/linux/rockchip/patches-6.6/033-04-v6.15-hwrng-rockchip-eliminate-some-unnecessary-dereferenc.patch b/target/linux/rockchip/patches-6.6/033-04-v6.15-hwrng-rockchip-eliminate-some-unnecessary-dereferenc.patch
new file mode 100644
index 00000000000000..a3bdff9641859b
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/033-04-v6.15-hwrng-rockchip-eliminate-some-unnecessary-dereferenc.patch
@@ -0,0 +1,42 @@
+From 24aaa42ed65c0811b598674a593fc653d643a7e6 Mon Sep 17 00:00:00 2001
+From: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+Date: Tue, 4 Feb 2025 16:35:49 +0100
+Subject: [PATCH] hwrng: rockchip - eliminate some unnecessary dereferences
+
+Despite assigning a temporary variable the value of &pdev->dev early on
+in the probe function, the probe function then continues to use this
+construct when it could just use the local dev variable instead.
+
+Simplify this by using the local dev variable directly.
+
+Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ drivers/char/hw_random/rockchip-rng.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/char/hw_random/rockchip-rng.c
++++ b/drivers/char/hw_random/rockchip-rng.c
+@@ -148,7 +148,7 @@ static int rk_rng_probe(struct platform_
+ 		return dev_err_probe(dev, rk_rng->clk_num,
+ 				     "Failed to get clks property\n");
+ 
+-	rst = devm_reset_control_array_get_exclusive(&pdev->dev);
++	rst = devm_reset_control_array_get_exclusive(dev);
+ 	if (IS_ERR(rst))
+ 		return dev_err_probe(dev, PTR_ERR(rst), "Failed to get reset property\n");
+ 
+@@ -171,11 +171,11 @@ static int rk_rng_probe(struct platform_
+ 	pm_runtime_use_autosuspend(dev);
+ 	ret = devm_pm_runtime_enable(dev);
+ 	if (ret)
+-		return dev_err_probe(&pdev->dev, ret, "Runtime pm activation failed.\n");
++		return dev_err_probe(dev, ret, "Runtime pm activation failed.\n");
+ 
+ 	ret = devm_hwrng_register(dev, &rk_rng->rng);
+ 	if (ret)
+-		return dev_err_probe(&pdev->dev, ret, "Failed to register Rockchip hwrng\n");
++		return dev_err_probe(dev, ret, "Failed to register Rockchip hwrng\n");
+ 
+ 	return 0;
+ }
diff --git a/target/linux/rockchip/patches-6.6/033-05-v6.15-hwrng-rockchip-add-support-for-rk3588-s-standalone-T.patch b/target/linux/rockchip/patches-6.6/033-05-v6.15-hwrng-rockchip-add-support-for-rk3588-s-standalone-T.patch
new file mode 100644
index 00000000000000..9ae621a54a20a8
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/033-05-v6.15-hwrng-rockchip-add-support-for-rk3588-s-standalone-T.patch
@@ -0,0 +1,422 @@
+From 8eff8eb83fc0ae8b5f76220e2bb8644d836e99ff Mon Sep 17 00:00:00 2001
+From: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+Date: Tue, 4 Feb 2025 16:35:50 +0100
+Subject: [PATCH] hwrng: rockchip - add support for rk3588's standalone TRNG
+
+The RK3588 SoC includes several TRNGs, one part of the Crypto IP block,
+and the other one (referred to as "trngv1") as a standalone new IP.
+
+Add support for this new standalone TRNG to the driver by both
+generalising it to support multiple different rockchip RNGs and then
+implementing the required functionality for the new hardware.
+
+This work was partly based on the downstream vendor driver by Rockchip's
+Lin Jinhan, which is why they are listed as a Co-author.
+
+While the hardware does support notifying the CPU with an IRQ when the
+random data is ready, I've discovered while implementing the code to use
+this interrupt that this results in significantly slower throughput of
+the TRNG even when under heavy CPU load. I assume this is because with
+only 32 bytes of data per invocation, the overhead of reinitialising a
+completion, enabling the interrupt, sleeping and then triggering the
+completion in the IRQ handler is way more expensive than busylooping.
+
+Speaking of busylooping, the poll interval for reading the ISTAT is an
+atomic read with a delay of 0. In my testing, I've found that this gives
+us the largest throughput, and it appears the random data is ready
+pretty much the moment we begin polling, as increasing the poll delay
+leads to a drop in throughput significant enough to not just be due to
+the poll interval missing the ideal timing by a microsecond or two.
+
+According to downstream, the IP should take 1024 clock cycles to
+generate 56 bits of random data, which at 150MHz should work out to
+6.8us. I did not test whether the data really does take 256/56*6.8us
+to arrive, though changing the readl to a __raw_readl makes no
+difference in throughput, and this data does pass the rngtest FIPS
+checks, so I'm not entirely sure what's going on but I presume it's got
+something to do with the AHB bus speed and the memory barriers that
+mainline's readl/writel functions insert.
+
+The only other current SoC that uses this new IP is the Rockchip RV1106,
+but that SoC does not have mainline support as of the time of writing,
+so we make no effort to declare it as supported for now.
+
+Co-developed-by: Lin Jinhan <troy.lin@rock-chips.com>
+Signed-off-by: Lin Jinhan <troy.lin@rock-chips.com>
+Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+---
+ drivers/char/hw_random/Kconfig        |   3 +-
+ drivers/char/hw_random/rockchip-rng.c | 234 +++++++++++++++++++++++---
+ 2 files changed, 216 insertions(+), 21 deletions(-)
+
+--- a/drivers/char/hw_random/Kconfig
++++ b/drivers/char/hw_random/Kconfig
+@@ -580,7 +580,8 @@ config HW_RANDOM_ROCKCHIP
+ 	default HW_RANDOM
+ 	help
+ 	  This driver provides kernel-side support for the True Random Number
+-	  Generator hardware found on some Rockchip SoC like RK3566 or RK3568.
++	  Generator hardware found on some Rockchip SoCs like RK3566, RK3568
++	  or RK3588.
+ 
+ 	  To compile this driver as a module, choose M here: the
+ 	  module will be called rockchip-rng.
+--- a/drivers/char/hw_random/rockchip-rng.c
++++ b/drivers/char/hw_random/rockchip-rng.c
+@@ -1,12 +1,14 @@
+ // SPDX-License-Identifier: GPL-2.0
+ /*
+- * rockchip-rng.c True Random Number Generator driver for Rockchip RK3568 SoC
++ * rockchip-rng.c True Random Number Generator driver for Rockchip SoCs
+  *
+  * Copyright (c) 2018, Fuzhou Rockchip Electronics Co., Ltd.
+  * Copyright (c) 2022, Aurelien Jarno
++ * Copyright (c) 2025, Collabora Ltd.
+  * Authors:
+  *  Lin Jinhan <troy.lin@rock-chips.com>
+  *  Aurelien Jarno <aurelien@aurel32.net>
++ *  Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+  */
+ #include <linux/clk.h>
+ #include <linux/hw_random.h>
+@@ -32,6 +34,9 @@
+  */
+ #define RK_RNG_SAMPLE_CNT		1000
+ 
++/* after how many bytes of output TRNGv1 implementations should be reseeded */
++#define RK_TRNG_V1_AUTO_RESEED_CNT	16000
++
+ /* TRNG registers from RK3568 TRM-Part2, section 5.4.1 */
+ #define TRNG_RST_CTL			0x0004
+ #define TRNG_RNG_CTL			0x0400
+@@ -49,25 +54,85 @@
+ #define TRNG_RNG_SAMPLE_CNT		0x0404
+ #define TRNG_RNG_DOUT			0x0410
+ 
++/*
++ * TRNG V1 register definitions
++ * The TRNG V1 IP is a stand-alone TRNG implementation (not part of a crypto IP)
++ * and can be found in the Rockchip RK3588 SoC
++ */
++#define TRNG_V1_CTRL				0x0000
++#define TRNG_V1_CTRL_NOP			0x00
++#define TRNG_V1_CTRL_RAND			0x01
++#define TRNG_V1_CTRL_SEED			0x02
++
++#define TRNG_V1_STAT				0x0004
++#define TRNG_V1_STAT_SEEDED			BIT(9)
++#define TRNG_V1_STAT_GENERATING			BIT(30)
++#define TRNG_V1_STAT_RESEEDING			BIT(31)
++
++#define TRNG_V1_MODE				0x0008
++#define TRNG_V1_MODE_128_BIT			(0x00 << 3)
++#define TRNG_V1_MODE_256_BIT			(0x01 << 3)
++
++/* Interrupt Enable register; unused because polling is faster */
++#define TRNG_V1_IE				0x0010
++#define TRNG_V1_IE_GLBL_EN			BIT(31)
++#define TRNG_V1_IE_SEED_DONE_EN			BIT(1)
++#define TRNG_V1_IE_RAND_RDY_EN			BIT(0)
++
++#define TRNG_V1_ISTAT				0x0014
++#define TRNG_V1_ISTAT_RAND_RDY			BIT(0)
++
++/* RAND0 ~ RAND7 */
++#define TRNG_V1_RAND0				0x0020
++#define TRNG_V1_RAND7				0x003C
++
++/* Auto Reseed Register */
++#define TRNG_V1_AUTO_RQSTS			0x0060
++
++#define TRNG_V1_VERSION				0x00F0
++#define TRNG_v1_VERSION_CODE			0x46bc
++/* end of TRNG_V1 register definitions */
++
++/* Before removing this assert, give rk3588_rng_read an upper bound of 32 */
++static_assert(RK_RNG_MAX_BYTE <= (TRNG_V1_RAND7 + 4 - TRNG_V1_RAND0),
++	      "You raised RK_RNG_MAX_BYTE and broke rk3588-rng, congrats.");
++
+ struct rk_rng {
+ 	struct hwrng rng;
+ 	void __iomem *base;
+ 	int clk_num;
+ 	struct clk_bulk_data *clk_bulks;
++	const struct rk_rng_soc_data *soc_data;
+ 	struct device *dev;
+ };
+ 
++struct rk_rng_soc_data {
++	int (*rk_rng_init)(struct hwrng *rng);
++	int (*rk_rng_read)(struct hwrng *rng, void *buf, size_t max, bool wait);
++	void (*rk_rng_cleanup)(struct hwrng *rng);
++	unsigned short quality;
++	bool reset_optional;
++};
++
+ /* The mask in the upper 16 bits determines the bits that are updated */
+ static void rk_rng_write_ctl(struct rk_rng *rng, u32 val, u32 mask)
+ {
+ 	writel((mask << 16) | val, rng->base + TRNG_RNG_CTL);
+ }
+ 
+-static int rk_rng_init(struct hwrng *rng)
++static inline void rk_rng_writel(struct rk_rng *rng, u32 val, u32 offset)
+ {
+-	struct rk_rng *rk_rng = container_of(rng, struct rk_rng, rng);
+-	int ret;
++	writel(val, rng->base + offset);
++}
+ 
++static inline u32 rk_rng_readl(struct rk_rng *rng, u32 offset)
++{
++	return readl(rng->base + offset);
++}
++
++static int rk_rng_enable_clks(struct rk_rng *rk_rng)
++{
++	int ret;
+ 	/* start clocks */
+ 	ret = clk_bulk_prepare_enable(rk_rng->clk_num, rk_rng->clk_bulks);
+ 	if (ret < 0) {
+@@ -75,6 +140,18 @@ static int rk_rng_init(struct hwrng *rng
+ 		return ret;
+ 	}
+ 
++	return 0;
++}
++
++static int rk3568_rng_init(struct hwrng *rng)
++{
++	struct rk_rng *rk_rng = container_of(rng, struct rk_rng, rng);
++	int ret;
++
++	ret = rk_rng_enable_clks(rk_rng);
++	if (ret < 0)
++		return ret;
++
+ 	/* set the sample period */
+ 	writel(RK_RNG_SAMPLE_CNT, rk_rng->base + TRNG_RNG_SAMPLE_CNT);
+ 
+@@ -87,7 +164,7 @@ static int rk_rng_init(struct hwrng *rng
+ 	return 0;
+ }
+ 
+-static void rk_rng_cleanup(struct hwrng *rng)
++static void rk3568_rng_cleanup(struct hwrng *rng)
+ {
+ 	struct rk_rng *rk_rng = container_of(rng, struct rk_rng, rng);
+ 
+@@ -98,7 +175,7 @@ static void rk_rng_cleanup(struct hwrng
+ 	clk_bulk_disable_unprepare(rk_rng->clk_num, rk_rng->clk_bulks);
+ }
+ 
+-static int rk_rng_read(struct hwrng *rng, void *buf, size_t max, bool wait)
++static int rk3568_rng_read(struct hwrng *rng, void *buf, size_t max, bool wait)
+ {
+ 	struct rk_rng *rk_rng = container_of(rng, struct rk_rng, rng);
+ 	size_t to_read = min_t(size_t, max, RK_RNG_MAX_BYTE);
+@@ -128,6 +205,114 @@ out:
+ 	return (ret < 0) ? ret : to_read;
+ }
+ 
++static int rk3588_rng_init(struct hwrng *rng)
++{
++	struct rk_rng *rk_rng = container_of(rng, struct rk_rng, rng);
++	u32 version, status, mask, istat;
++	int ret;
++
++	ret = rk_rng_enable_clks(rk_rng);
++	if (ret < 0)
++		return ret;
++
++	version = rk_rng_readl(rk_rng, TRNG_V1_VERSION);
++	if (version != TRNG_v1_VERSION_CODE) {
++		dev_err(rk_rng->dev,
++			"wrong trng version, expected = %08x, actual = %08x\n",
++			TRNG_V1_VERSION, version);
++		ret = -EFAULT;
++		goto err_disable_clk;
++	}
++
++	mask = TRNG_V1_STAT_SEEDED | TRNG_V1_STAT_GENERATING |
++	       TRNG_V1_STAT_RESEEDING;
++	if (readl_poll_timeout(rk_rng->base + TRNG_V1_STAT, status,
++			       (status & mask) == TRNG_V1_STAT_SEEDED,
++			       RK_RNG_POLL_PERIOD_US, RK_RNG_POLL_TIMEOUT_US) < 0) {
++		dev_err(rk_rng->dev, "timed out waiting for hwrng to reseed\n");
++		ret = -ETIMEDOUT;
++		goto err_disable_clk;
++	}
++
++	/*
++	 * clear ISTAT flag, downstream advises to do this to avoid
++	 * auto-reseeding "on power on"
++	 */
++	istat = rk_rng_readl(rk_rng, TRNG_V1_ISTAT);
++	rk_rng_writel(rk_rng, istat, TRNG_V1_ISTAT);
++
++	/* auto reseed after RK_TRNG_V1_AUTO_RESEED_CNT bytes */
++	rk_rng_writel(rk_rng, RK_TRNG_V1_AUTO_RESEED_CNT / 16, TRNG_V1_AUTO_RQSTS);
++
++	return 0;
++err_disable_clk:
++	clk_bulk_disable_unprepare(rk_rng->clk_num, rk_rng->clk_bulks);
++	return ret;
++}
++
++static void rk3588_rng_cleanup(struct hwrng *rng)
++{
++	struct rk_rng *rk_rng = container_of(rng, struct rk_rng, rng);
++
++	clk_bulk_disable_unprepare(rk_rng->clk_num, rk_rng->clk_bulks);
++}
++
++static int rk3588_rng_read(struct hwrng *rng, void *buf, size_t max, bool wait)
++{
++	struct rk_rng *rk_rng = container_of(rng, struct rk_rng, rng);
++	size_t to_read = min_t(size_t, max, RK_RNG_MAX_BYTE);
++	int ret = 0;
++	u32 reg;
++
++	ret = pm_runtime_resume_and_get(rk_rng->dev);
++	if (ret < 0)
++		return ret;
++
++	/* Clear ISTAT, even without interrupts enabled, this will be updated */
++	reg = rk_rng_readl(rk_rng, TRNG_V1_ISTAT);
++	rk_rng_writel(rk_rng, reg, TRNG_V1_ISTAT);
++
++	/* generate 256 bits of random data */
++	rk_rng_writel(rk_rng, TRNG_V1_MODE_256_BIT, TRNG_V1_MODE);
++	rk_rng_writel(rk_rng, TRNG_V1_CTRL_RAND, TRNG_V1_CTRL);
++
++	ret = readl_poll_timeout_atomic(rk_rng->base + TRNG_V1_ISTAT, reg,
++					(reg & TRNG_V1_ISTAT_RAND_RDY), 0,
++					RK_RNG_POLL_TIMEOUT_US);
++	if (ret < 0)
++		goto out;
++
++	/* Read random data that's in registers TRNG_V1_RAND0 through RAND7 */
++	memcpy_fromio(buf, rk_rng->base + TRNG_V1_RAND0, to_read);
++
++out:
++	/* Clear ISTAT */
++	rk_rng_writel(rk_rng, reg, TRNG_V1_ISTAT);
++	/* close the TRNG */
++	rk_rng_writel(rk_rng, TRNG_V1_CTRL_NOP, TRNG_V1_CTRL);
++
++	pm_runtime_mark_last_busy(rk_rng->dev);
++	pm_runtime_put_sync_autosuspend(rk_rng->dev);
++
++	return (ret < 0) ? ret : to_read;
++}
++
++static const struct rk_rng_soc_data rk3568_soc_data = {
++	.rk_rng_init = rk3568_rng_init,
++	.rk_rng_read = rk3568_rng_read,
++	.rk_rng_cleanup = rk3568_rng_cleanup,
++	.quality = 900,
++	.reset_optional = false,
++};
++
++static const struct rk_rng_soc_data rk3588_soc_data = {
++	.rk_rng_init = rk3588_rng_init,
++	.rk_rng_read = rk3588_rng_read,
++	.rk_rng_cleanup = rk3588_rng_cleanup,
++	.quality = 999,		/* as determined by actual testing */
++	.reset_optional = true,
++};
++
+ static int rk_rng_probe(struct platform_device *pdev)
+ {
+ 	struct device *dev = &pdev->dev;
+@@ -139,6 +324,7 @@ static int rk_rng_probe(struct platform_
+ 	if (!rk_rng)
+ 		return -ENOMEM;
+ 
++	rk_rng->soc_data = of_device_get_match_data(dev);
+ 	rk_rng->base = devm_platform_ioremap_resource(pdev, 0);
+ 	if (IS_ERR(rk_rng->base))
+ 		return PTR_ERR(rk_rng->base);
+@@ -148,24 +334,30 @@ static int rk_rng_probe(struct platform_
+ 		return dev_err_probe(dev, rk_rng->clk_num,
+ 				     "Failed to get clks property\n");
+ 
+-	rst = devm_reset_control_array_get_exclusive(dev);
+-	if (IS_ERR(rst))
+-		return dev_err_probe(dev, PTR_ERR(rst), "Failed to get reset property\n");
+-
+-	reset_control_assert(rst);
+-	udelay(2);
+-	reset_control_deassert(rst);
++	if (rk_rng->soc_data->reset_optional)
++		rst = devm_reset_control_array_get_optional_exclusive(dev);
++	else
++		rst = devm_reset_control_array_get_exclusive(dev);
++
++	if (rst) {
++		if (IS_ERR(rst))
++			return dev_err_probe(dev, PTR_ERR(rst), "Failed to get reset property\n");
++
++		reset_control_assert(rst);
++		udelay(2);
++		reset_control_deassert(rst);
++	}
+ 
+ 	platform_set_drvdata(pdev, rk_rng);
+ 
+ 	rk_rng->rng.name = dev_driver_string(dev);
+ 	if (!IS_ENABLED(CONFIG_PM)) {
+-		rk_rng->rng.init = rk_rng_init;
+-		rk_rng->rng.cleanup = rk_rng_cleanup;
++		rk_rng->rng.init = rk_rng->soc_data->rk_rng_init;
++		rk_rng->rng.cleanup = rk_rng->soc_data->rk_rng_cleanup;
+ 	}
+-	rk_rng->rng.read = rk_rng_read;
++	rk_rng->rng.read = rk_rng->soc_data->rk_rng_read;
+ 	rk_rng->dev = dev;
+-	rk_rng->rng.quality = 900;
++	rk_rng->rng.quality = rk_rng->soc_data->quality;
+ 
+ 	pm_runtime_set_autosuspend_delay(dev, RK_RNG_AUTOSUSPEND_DELAY);
+ 	pm_runtime_use_autosuspend(dev);
+@@ -184,7 +376,7 @@ static int __maybe_unused rk_rng_runtime
+ {
+ 	struct rk_rng *rk_rng = dev_get_drvdata(dev);
+ 
+-	rk_rng_cleanup(&rk_rng->rng);
++	rk_rng->soc_data->rk_rng_cleanup(&rk_rng->rng);
+ 
+ 	return 0;
+ }
+@@ -193,7 +385,7 @@ static int __maybe_unused rk_rng_runtime
+ {
+ 	struct rk_rng *rk_rng = dev_get_drvdata(dev);
+ 
+-	return rk_rng_init(&rk_rng->rng);
++	return rk_rng->soc_data->rk_rng_init(&rk_rng->rng);
+ }
+ 
+ static const struct dev_pm_ops rk_rng_pm_ops = {
+@@ -204,7 +396,8 @@ static const struct dev_pm_ops rk_rng_pm
+ };
+ 
+ static const struct of_device_id rk_rng_dt_match[] = {
+-	{ .compatible = "rockchip,rk3568-rng", },
++	{ .compatible = "rockchip,rk3568-rng", .data = (void *)&rk3568_soc_data },
++	{ .compatible = "rockchip,rk3588-rng", .data = (void *)&rk3588_soc_data },
+ 	{ /* sentinel */ },
+ };
+ 
+@@ -221,8 +414,9 @@ static struct platform_driver rk_rng_dri
+ 
+ module_platform_driver(rk_rng_driver);
+ 
+-MODULE_DESCRIPTION("Rockchip RK3568 True Random Number Generator driver");
++MODULE_DESCRIPTION("Rockchip True Random Number Generator driver");
+ MODULE_AUTHOR("Lin Jinhan <troy.lin@rock-chips.com>");
+ MODULE_AUTHOR("Aurelien Jarno <aurelien@aurel32.net>");
+ MODULE_AUTHOR("Daniel Golle <daniel@makrotopia.org>");
++MODULE_AUTHOR("Nicolas Frattaroli <nicolas.frattaroli@collabora.com>");
+ MODULE_LICENSE("GPL");
diff --git a/target/linux/rockchip/patches-6.6/034-v6.7-usb-dwc3-add-optional-PHY-interface-clocks.patch b/target/linux/rockchip/patches-6.6/034-v6.7-usb-dwc3-add-optional-PHY-interface-clocks.patch
index 3ae1c54ef2a057..4d358ea21954a1 100644
--- a/target/linux/rockchip/patches-6.6/034-v6.7-usb-dwc3-add-optional-PHY-interface-clocks.patch
+++ b/target/linux/rockchip/patches-6.6/034-v6.7-usb-dwc3-add-optional-PHY-interface-clocks.patch
@@ -18,7 +18,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 
 --- a/drivers/usb/dwc3/core.c
 +++ b/drivers/usb/dwc3/core.c
-@@ -845,8 +845,20 @@ static int dwc3_clk_enable(struct dwc3 *
+@@ -860,8 +860,20 @@ static int dwc3_clk_enable(struct dwc3 *
  	if (ret)
  		goto disable_ref_clk;
  
@@ -39,7 +39,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  disable_ref_clk:
  	clk_disable_unprepare(dwc->ref_clk);
  disable_bus_clk:
-@@ -856,6 +868,8 @@ disable_bus_clk:
+@@ -871,6 +883,8 @@ disable_bus_clk:
  
  static void dwc3_clk_disable(struct dwc3 *dwc)
  {
@@ -48,7 +48,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  	clk_disable_unprepare(dwc->susp_clk);
  	clk_disable_unprepare(dwc->ref_clk);
  	clk_disable_unprepare(dwc->bus_clk);
-@@ -1884,6 +1898,20 @@ static int dwc3_get_clocks(struct dwc3 *
+@@ -1886,6 +1900,20 @@ static int dwc3_get_clocks(struct dwc3 *
  		}
  	}
  
@@ -71,7 +71,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  
 --- a/drivers/usb/dwc3/core.h
 +++ b/drivers/usb/dwc3/core.h
-@@ -997,6 +997,8 @@ struct dwc3_scratchpad_array {
+@@ -1003,6 +1003,8 @@ struct dwc3_scratchpad_array {
   * @bus_clk: clock for accessing the registers
   * @ref_clk: reference clock
   * @susp_clk: clock used when the SS phy is in low power (S3) state
@@ -80,7 +80,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
   * @reset: reset control
   * @regs: base address for our registers
   * @regs_size: address space size
-@@ -1167,6 +1169,8 @@ struct dwc3 {
+@@ -1175,6 +1177,8 @@ struct dwc3 {
  	struct clk		*bus_clk;
  	struct clk		*ref_clk;
  	struct clk		*susp_clk;
diff --git a/target/linux/rockchip/patches-6.6/050-28-v6.15-arm64-dts-rockchip-Add-rng-node-to-RK3588.patch b/target/linux/rockchip/patches-6.6/050-28-v6.15-arm64-dts-rockchip-Add-rng-node-to-RK3588.patch
new file mode 100644
index 00000000000000..49d3c69b56b429
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/050-28-v6.15-arm64-dts-rockchip-Add-rng-node-to-RK3588.patch
@@ -0,0 +1,34 @@
+From 6ee0b9ad3995ee5fa229035c69013b7dd0d3634b Mon Sep 17 00:00:00 2001
+From: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+Date: Tue, 4 Feb 2025 16:35:51 +0100
+Subject: [PATCH] arm64: dts: rockchip: Add rng node to RK3588
+
+Add the RK3588's standalone hardware random number generator node to its
+device tree, and enable it.
+
+Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
+Link: https://lore.kernel.org/r/20250204-rk3588-trng-submission-v2-6-608172b6fd91@collabora.com
+[changed reset-id to its numeric value while the constant makes its
+ way through the crypto tree]
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ arch/arm64/boot/dts/rockchip/rk3588-base.dtsi | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi
+@@ -1763,6 +1763,14 @@
+ 		status = "disabled";
+ 	};
+ 
++	rng@fe378000 {
++		compatible = "rockchip,rk3588-rng";
++		reg = <0x0 0xfe378000 0x0 0x200>;
++		interrupts = <GIC_SPI 400 IRQ_TYPE_LEVEL_HIGH 0>;
++		clocks = <&scmi_clk SCMI_HCLK_SECURE_NS>;
++		resets = <&scmi_reset 48>;
++	};
++
+ 	i2s0_8ch: i2s@fe470000 {
+ 		compatible = "rockchip,rk3588-i2s-tdm";
+ 		reg = <0x0 0xfe470000 0x0 0x1000>;
diff --git a/target/linux/rockchip/patches-6.6/050-29-v6.15-arm64-dts-rockchip-change-rng-reset-id-back-to-its-c.patch b/target/linux/rockchip/patches-6.6/050-29-v6.15-arm64-dts-rockchip-change-rng-reset-id-back-to-its-c.patch
new file mode 100644
index 00000000000000..8ba4c45f77de29
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/050-29-v6.15-arm64-dts-rockchip-change-rng-reset-id-back-to-its-c.patch
@@ -0,0 +1,25 @@
+From 55a43c346d24434e46ef7fcc09a9df8179c346e4 Mon Sep 17 00:00:00 2001
+From: Heiko Stuebner <heiko@sntech.de>
+Date: Sun, 16 Feb 2025 16:27:42 +0100
+Subject: [PATCH] arm64: dts: rockchip: change rng reset id back to its
+ constant value
+
+With the binding header now providing the SCMI_SRST_H_TRNG_NS constant,
+switch back to it from the temporary numeric value.
+
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ arch/arm64/boot/dts/rockchip/rk3588-base.dtsi | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi
+@@ -1768,7 +1768,7 @@
+ 		reg = <0x0 0xfe378000 0x0 0x200>;
+ 		interrupts = <GIC_SPI 400 IRQ_TYPE_LEVEL_HIGH 0>;
+ 		clocks = <&scmi_clk SCMI_HCLK_SECURE_NS>;
+-		resets = <&scmi_reset 48>;
++		resets = <&scmi_reset SCMI_SRST_H_TRNG_NS>;
+ 	};
+ 
+ 	i2s0_8ch: i2s@fe470000 {
diff --git a/target/linux/rockchip/patches-6.6/053-v6.9-arm64-dts-rockchip-Add-support-for-NanoPi-R6S.patch b/target/linux/rockchip/patches-6.6/053-v6.9-arm64-dts-rockchip-Add-support-for-NanoPi-R6S.patch
index d0243023fc3089..f31f38ac9d9ce3 100644
--- a/target/linux/rockchip/patches-6.6/053-v6.9-arm64-dts-rockchip-Add-support-for-NanoPi-R6S.patch
+++ b/target/linux/rockchip/patches-6.6/053-v6.9-arm64-dts-rockchip-Add-support-for-NanoPi-R6S.patch
@@ -17,7 +17,7 @@ Signed-off-by: Heiko Stuebner <heiko@sntech.de>
 
 --- a/arch/arm64/boot/dts/rockchip/Makefile
 +++ b/arch/arm64/boot/dts/rockchip/Makefile
-@@ -108,4 +108,5 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3588-na
+@@ -109,4 +109,5 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3588-na
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3588-rock-5b.dtb
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3588s-indiedroid-nova.dtb
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3588s-khadas-edge2.dtb
diff --git a/target/linux/rockchip/patches-6.6/054-v6.9-arm64-dts-rockchip-Add-support-for-NanoPi-R6C.patch b/target/linux/rockchip/patches-6.6/054-v6.9-arm64-dts-rockchip-Add-support-for-NanoPi-R6C.patch
index 7e2b083cf8d076..b63c01338fcc89 100644
--- a/target/linux/rockchip/patches-6.6/054-v6.9-arm64-dts-rockchip-Add-support-for-NanoPi-R6C.patch
+++ b/target/linux/rockchip/patches-6.6/054-v6.9-arm64-dts-rockchip-Add-support-for-NanoPi-R6C.patch
@@ -17,7 +17,7 @@ Signed-off-by: Heiko Stuebner <heiko@sntech.de>
 
 --- a/arch/arm64/boot/dts/rockchip/Makefile
 +++ b/arch/arm64/boot/dts/rockchip/Makefile
-@@ -109,4 +109,5 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3588-ro
+@@ -110,4 +110,5 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3588-ro
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3588s-indiedroid-nova.dtb
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3588s-khadas-edge2.dtb
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3588s-nanopi-r6s.dtb
diff --git a/target/linux/rockchip/patches-6.6/055-16-v6.13-arm64-dts-rockchip-enable-USB3-on-NanoPC-T6.patch b/target/linux/rockchip/patches-6.6/055-16-v6.13-arm64-dts-rockchip-enable-USB3-on-NanoPC-T6.patch
new file mode 100644
index 00000000000000..d3aa8b9cc3e346
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/055-16-v6.13-arm64-dts-rockchip-enable-USB3-on-NanoPC-T6.patch
@@ -0,0 +1,87 @@
+From a6ae420439dc47a58550a6e61e596e9dd1562caf Mon Sep 17 00:00:00 2001
+From: Rick Wertenbroek <rick.wertenbroek@gmail.com>
+Date: Wed, 6 Nov 2024 14:03:13 +0100
+Subject: [PATCH] arm64: dts: rockchip: enable USB3 on NanoPC-T6
+
+Enable the USB3 port on FriendlyELEC NanoPC-T6.
+
+Signed-off-by: Rick Wertenbroek <rick.wertenbroek@gmail.com>
+Link: https://lore.kernel.org/r/20241106130314.1289055-1-rick.wertenbroek@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ .../boot/dts/rockchip/rk3588-nanopc-t6.dtsi   | 36 +++++++++++++++++++
+ 1 file changed, 36 insertions(+)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3588-nanopc-t6.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3588-nanopc-t6.dtsi
+@@ -160,6 +160,20 @@
+ 		vin-supply = <&vcc5v0_sys>;
+ 	};
+ 
++	vbus5v0_usb: vbus5v0-usb-regulator {
++		compatible = "regulator-fixed";
++		enable-active-high;
++		gpio = <&gpio4 RK_PB0 GPIO_ACTIVE_HIGH>;
++		pinctrl-names = "default";
++		pinctrl-0 = <&usb5v_pwren>;
++		regulator-always-on;
++		regulator-boot-on;
++		regulator-name = "vbus5v0_usb";
++		regulator-min-microvolt = <5000000>;
++		regulator-max-microvolt = <5000000>;
++		vin-supply = <&vcc5v0_sys>;
++	};
++
+ 	vcc3v3_pcie2x1l0: vcc3v3-pcie2x1l0-regulator {
+ 		compatible = "regulator-fixed";
+ 		enable-active-high;
+@@ -577,6 +591,10 @@
+ 			rockchip,pins = <1 RK_PD2 RK_FUNC_GPIO &pcfg_pull_none>;
+ 		};
+ 
++		usb5v_pwren: usb5v_pwren {
++			rockchip,pins = <4 RK_PB0 RK_FUNC_GPIO &pcfg_pull_none>;
++		};
++
+ 		usbc0_int: usbc0-int {
+ 			rockchip,pins = <0 RK_PD3 RK_FUNC_GPIO &pcfg_pull_up>;
+ 		};
+@@ -976,6 +994,14 @@
+ 	status = "okay";
+ };
+ 
++&u2phy1 {
++	status = "okay";
++};
++
++&u2phy1_otg {
++	status = "okay";
++};
++
+ &u2phy2_host {
+ 	status = "okay";
+ };
+@@ -1015,6 +1041,11 @@
+ 	};
+ };
+ 
++&usbdp_phy1 {
++	phy-supply = <&vbus5v0_usb>;
++	status = "okay";
++};
++
+ &usb_host0_ehci {
+ 	status = "okay";
+ };
+@@ -1035,6 +1066,11 @@
+ 	};
+ };
+ 
++&usb_host1_xhci {
++	dr_mode = "host";
++	status = "okay";
++};
++
+ &usb_host1_ehci {
+ 	status = "okay";
+ };
diff --git a/target/linux/rockchip/patches-6.6/056-01-v6.10-arm64-dts-rockchip-Add-ArmSom-Sige7-board.patch b/target/linux/rockchip/patches-6.6/056-01-v6.10-arm64-dts-rockchip-Add-ArmSom-Sige7-board.patch
index bc1845b0d3c344..c60b9791094205 100644
--- a/target/linux/rockchip/patches-6.6/056-01-v6.10-arm64-dts-rockchip-Add-ArmSom-Sige7-board.patch
+++ b/target/linux/rockchip/patches-6.6/056-01-v6.10-arm64-dts-rockchip-Add-ArmSom-Sige7-board.patch
@@ -44,7 +44,7 @@ Signed-off-by: Heiko Stuebner <heiko@sntech.de>
 
 --- a/arch/arm64/boot/dts/rockchip/Makefile
 +++ b/arch/arm64/boot/dts/rockchip/Makefile
-@@ -101,6 +101,7 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3568-ra
+@@ -102,6 +102,7 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3568-ra
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3568-roc-pc.dtb
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3568-rock-3a.dtb
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3568-rock-3b.dtb
diff --git a/target/linux/rockchip/patches-6.6/121-arm64-dts-rockchip-lower-mmc-speed-for-nanopc-t6.patch b/target/linux/rockchip/patches-6.6/121-arm64-dts-rockchip-lower-mmc-speed-for-nanopc-t6.patch
index bbcff0179068bb..901fcf2bc05b79 100644
--- a/target/linux/rockchip/patches-6.6/121-arm64-dts-rockchip-lower-mmc-speed-for-nanopc-t6.patch
+++ b/target/linux/rockchip/patches-6.6/121-arm64-dts-rockchip-lower-mmc-speed-for-nanopc-t6.patch
@@ -1,6 +1,16 @@
 --- a/arch/arm64/boot/dts/rockchip/rk3588-nanopc-t6.dtsi
 +++ b/arch/arm64/boot/dts/rockchip/rk3588-nanopc-t6.dtsi
-@@ -616,7 +616,7 @@
+@@ -621,8 +621,7 @@
+ 	no-sd;
+ 	non-removable;
+ 	max-frequency = <200000000>;
+-	mmc-hs400-1_8v;
+-	mmc-hs400-enhanced-strobe;
++	mmc-hs200-1_8v;
+ 	status = "okay";
+ };
+ 
+@@ -634,7 +633,7 @@
  	disable-wp;
  	no-mmc;
  	no-sdio;
diff --git a/target/linux/rockchip/patches-6.6/127-arm64-dts-rockchip-rk3566-Add-Nanopi-R3S.patch b/target/linux/rockchip/patches-6.6/127-arm64-dts-rockchip-rk3566-Add-Nanopi-R3S.patch
index ff2ad5bb9a8995..899c85e0d2bdce 100644
--- a/target/linux/rockchip/patches-6.6/127-arm64-dts-rockchip-rk3566-Add-Nanopi-R3S.patch
+++ b/target/linux/rockchip/patches-6.6/127-arm64-dts-rockchip-rk3566-Add-Nanopi-R3S.patch
@@ -557,7 +557,7 @@
 +};
 --- a/arch/arm64/boot/dts/rockchip/Makefile
 +++ b/arch/arm64/boot/dts/rockchip/Makefile
-@@ -75,6 +75,7 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3566-an
+@@ -76,6 +76,7 @@ dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3566-an
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3566-anbernic-rg353v.dtb
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3566-anbernic-rg353vs.dtb
  dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3566-anbernic-rg503.dtb
diff --git a/target/linux/rockchip/patches-6.6/129-rock-4c-plus-add-led-aliases-and-stop-heartbeat.patch b/target/linux/rockchip/patches-6.6/129-rock-4c-plus-add-led-aliases-and-stop-heartbeat.patch
new file mode 100644
index 00000000000000..a9fbf0eef5f3db
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/129-rock-4c-plus-add-led-aliases-and-stop-heartbeat.patch
@@ -0,0 +1,27 @@
+--- a/arch/arm64/boot/dts/rockchip/rk3399-rock-4c-plus.dts
++++ b/arch/arm64/boot/dts/rockchip/rk3399-rock-4c-plus.dts
+@@ -17,6 +17,10 @@
+ 	aliases {
+ 		mmc0 = &sdhci;
+ 		mmc1 = &sdmmc;
++		led-boot = &led_blue;
++		led-failsafe = &led_blue;
++		led-running = &led_blue;
++		led-upgrade = &led_blue;
+ 	};
+ 
+ 	chosen {
+@@ -44,11 +48,11 @@
+ 		};
+ 
+ 		/* USER_LED2 */
+-		led-1 {
++		led_blue: led-1 {
+ 			function = LED_FUNCTION_STATUS;
+ 			color = <LED_COLOR_ID_BLUE>;
++			default-state = "on";
+ 			gpios = <&gpio3 RK_PD5 GPIO_ACTIVE_HIGH>;
+-			linux,default-trigger = "heartbeat";
+ 		};
+ 	};
+ 
diff --git a/target/linux/rockchip/patches-6.6/130-rock-4se-add-led-aliases-and-stop-heartbeat.patch b/target/linux/rockchip/patches-6.6/130-rock-4se-add-led-aliases-and-stop-heartbeat.patch
new file mode 100644
index 00000000000000..0f7a2d44a19406
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/130-rock-4se-add-led-aliases-and-stop-heartbeat.patch
@@ -0,0 +1,27 @@
+--- a/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3399-rock-pi-4.dtsi
+@@ -14,6 +14,10 @@
+ 	aliases {
+ 		mmc0 = &sdhci;
+ 		mmc1 = &sdmmc;
++		led-boot = &led_blue;
++		led-failsafe = &led_blue;
++		led-running = &led_blue;
++		led-upgrade = &led_blue;
+ 	};
+ 
+ 	chosen {
+@@ -33,11 +37,11 @@
+ 		pinctrl-0 = <&user_led2>;
+ 
+ 		/* USER_LED2 */
+-		led-0 {
++		led_blue: led-0 {
+ 			function = LED_FUNCTION_STATUS;
+ 			color = <LED_COLOR_ID_BLUE>;
++			default-state = "on";
+ 			gpios = <&gpio3 RK_PD5 GPIO_ACTIVE_HIGH>;
+-			linux,default-trigger = "heartbeat";
+ 		};
+ 	};
+ 
diff --git a/target/linux/rockchip/patches-6.6/401-1-nanopi-r6-show-boot-status-on-system-led.patch b/target/linux/rockchip/patches-6.6/401-1-nanopi-r6-show-boot-status-on-system-led.patch
new file mode 100644
index 00000000000000..f891cf5f166bb7
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/401-1-nanopi-r6-show-boot-status-on-system-led.patch
@@ -0,0 +1,33 @@
+Nanopi R6: show boot progress on the system LED
+
+Set up openwrt to show boot progress on the nanopi R6S or R6C system LED.
+
+The LED blinking states indicate the boot stage. The led is defined as
+a power LED, but can still be set to heartbeat in /etc/config/system
+after the system is done booting.
+
+--- a/arch/arm64/boot/dts/rockchip/rk3588s-nanopi-r6.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3588s-nanopi-r6.dtsi
+@@ -16,6 +16,10 @@
+ 		ethernet0 = &gmac1;
+ 		mmc0 = &sdmmc;
+ 		mmc1 = &sdhci;
++		led-boot = &sys_led;
++		led-failsafe = &sys_led;
++		led-running = &sys_led;
++		led-upgrade = &sys_led;
+ 	};
+ 
+ 	chosen {
+@@ -54,9 +58,9 @@
+ 
+ 		sys_led: led-0 {
+ 			color = <LED_COLOR_ID_RED>;
+-			function = LED_FUNCTION_HEARTBEAT;
++			function = LED_FUNCTION_POWER;
+ 			gpios = <&gpio1 RK_PC1 GPIO_ACTIVE_HIGH>;
+-			linux,default-trigger = "heartbeat";
++			default-state = "on";
+ 			pinctrl-names = "default";
+ 			pinctrl-0 = <&sys_led_pin>;
+ 		};
diff --git a/target/linux/rockchip/patches-6.6/401-2-nanopi-r6-reset-button.patch b/target/linux/rockchip/patches-6.6/401-2-nanopi-r6-reset-button.patch
new file mode 100644
index 00000000000000..5ca4aff115ceea
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/401-2-nanopi-r6-reset-button.patch
@@ -0,0 +1,18 @@
+Nanopi R6: set up reset button to be handled by openwrt
+
+Set up openwrt to handle the reset button appropriately (so that it
+can trigger the various recovery modes) on the nanopi R6S and R6C models.
+
+--- a/arch/arm64/boot/dts/rockchip/rk3588s-nanopi-r6.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3588s-nanopi-r6.dtsi
+@@ -48,8 +48,8 @@
+ 		button-user {
+ 			debounce-interval = <50>;
+ 			gpios = <&gpio1 RK_PC0 GPIO_ACTIVE_LOW>;
+-			label = "User Button";
+-			linux,code = <BTN_1>;
++			label = "reset";
++			linux,code = <KEY_RESTART>;
+ 		};
+ 	};
+ 
diff --git a/target/linux/rockchip/patches-6.6/402-v6.13-arm64-dts-rockchip-Fix-the-SD-card-detection-on-Nano.patch b/target/linux/rockchip/patches-6.6/402-v6.13-arm64-dts-rockchip-Fix-the-SD-card-detection-on-Nano.patch
new file mode 100644
index 00000000000000..a24c4ab8e2bb52
--- /dev/null
+++ b/target/linux/rockchip/patches-6.6/402-v6.13-arm64-dts-rockchip-Fix-the-SD-card-detection-on-Nano.patch
@@ -0,0 +1,25 @@
+From 95147bb42bc163866fc103c957820345fefa96cd Mon Sep 17 00:00:00 2001
+From: Anton Kirilov <anton.kirilov@arm.com>
+Date: Thu, 19 Dec 2024 11:31:45 +0000
+Subject: [PATCH] arm64: dts: rockchip: Fix the SD card detection on NanoPi
+ R6C/R6S
+
+Fix the SD card detection on FriendlyElec NanoPi R6C/R6S boards.
+
+Signed-off-by: Anton Kirilov <anton.kirilov@arm.com>
+Link: https://lore.kernel.org/r/20241219113145.483205-1-anton.kirilov@arm.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+---
+ arch/arm64/boot/dts/rockchip/rk3588s-nanopi-r6.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/arm64/boot/dts/rockchip/rk3588s-nanopi-r6.dtsi
++++ b/arch/arm64/boot/dts/rockchip/rk3588s-nanopi-r6.dtsi
+@@ -410,6 +410,7 @@
+ &sdmmc {
+ 	bus-width = <4>;
+ 	cap-sd-highspeed;
++	cd-gpios = <&gpio0 RK_PA4 GPIO_ACTIVE_LOW>;
+ 	disable-wp;
+ 	max-frequency = <150000000>;
+ 	no-mmc;
diff --git a/target/linux/sifiveu/config-6.6 b/target/linux/sifiveu/config-6.6
index 2e5474ce2f5f7c..595090be19d1e0 100644
--- a/target/linux/sifiveu/config-6.6
+++ b/target/linux/sifiveu/config-6.6
@@ -23,8 +23,6 @@ CONFIG_BLK_DEV_SD=y
 CONFIG_BLK_MQ_PCI=y
 CONFIG_CAVIUM_PTP=y
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLK_ANALOGBITS_WRPLL_CLN28HPC=y
 CONFIG_CLK_SIFIVE=y
 CONFIG_CLK_SIFIVE_PRCI=y
@@ -118,7 +116,6 @@ CONFIG_FS_MBCACHE=y
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
 CONFIG_GENERIC_BUG=y
diff --git a/target/linux/siflower/files-6.6/drivers/gpio/gpio-siflower.c b/target/linux/siflower/files-6.6/drivers/gpio/gpio-siflower.c
index f061021e30a58f..bd3d8906b44540 100644
--- a/target/linux/siflower/files-6.6/drivers/gpio/gpio-siflower.c
+++ b/target/linux/siflower/files-6.6/drivers/gpio/gpio-siflower.c
@@ -333,7 +333,6 @@ static struct platform_driver sf_gpio_driver = {
 	.remove		= sf_gpio_remove,
 	.driver = {
 		.name		= "siflower_gpio",
-		.owner		= THIS_MODULE,
 		.of_match_table	= sf_gpio_ids,
 	},
 };
diff --git a/target/linux/siflower/sf19a2890/config-6.6 b/target/linux/siflower/sf19a2890/config-6.6
index bec75436e00458..2e15ca67d4a5ae 100644
--- a/target/linux/siflower/sf19a2890/config-6.6
+++ b/target/linux/siflower/sf19a2890/config-6.6
@@ -7,8 +7,6 @@ CONFIG_ARCH_SUSPEND_POSSIBLE=y
 CONFIG_ARM_AMBA=y
 CONFIG_BLK_DEV_LOOP=y
 CONFIG_BOARD_SCACHE=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CEVT_R4K=y
 CONFIG_CLKSRC_MIPS_GIC=y
 CONFIG_CLK_SF19A2890=y
@@ -69,7 +67,6 @@ CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ATOMIC64=y
 CONFIG_GENERIC_CLOCKEVENTS=y
diff --git a/target/linux/starfive/config-6.6 b/target/linux/starfive/config-6.6
index 8ebced1165c5a6..457fa86b9ac95d 100644
--- a/target/linux/starfive/config-6.6
+++ b/target/linux/starfive/config-6.6
@@ -27,8 +27,6 @@ CONFIG_AUXILIARY_BUS=y
 # CONFIG_AX45MP_L2_CACHE is not set
 # CONFIG_BT_AICUSB is not set
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CHECKPOINT_RESTORE=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLK_ANALOGBITS_WRPLL_CLN28HPC=y
@@ -190,7 +188,6 @@ CONFIG_FS_MBCACHE=y
 CONFIG_FWNODE_MDIO=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
 CONFIG_GENERIC_BUG=y
diff --git a/target/linux/starfive/patches-6.6/0003-clocksource-Add-JH7110-timer-driver.patch b/target/linux/starfive/patches-6.6/0003-clocksource-Add-JH7110-timer-driver.patch
index 68b9c38d5bb250..b4398ef146858f 100644
--- a/target/linux/starfive/patches-6.6/0003-clocksource-Add-JH7110-timer-driver.patch
+++ b/target/linux/starfive/patches-6.6/0003-clocksource-Add-JH7110-timer-driver.patch
@@ -15,7 +15,7 @@ Signed-off-by: Xingyu Wu <xingyu.wu@starfivetech.com>
 
 --- a/drivers/clocksource/Kconfig
 +++ b/drivers/clocksource/Kconfig
-@@ -641,6 +641,17 @@ config RISCV_TIMER
+@@ -642,6 +642,17 @@ config RISCV_TIMER
  	  is accessed via both the SBI and the rdcycle instruction.  This is
  	  required for all RISC-V systems.
  
diff --git a/target/linux/starfive/patches-6.6/0033-PCI-Add-PCIE_RESET_CONFIG_DEVICE_WAIT_MS-waiting-tim.patch b/target/linux/starfive/patches-6.6/0033-PCI-Add-PCIE_RESET_CONFIG_DEVICE_WAIT_MS-waiting-tim.patch
index cc50dfe68e81c9..ff089604681845 100644
--- a/target/linux/starfive/patches-6.6/0033-PCI-Add-PCIE_RESET_CONFIG_DEVICE_WAIT_MS-waiting-tim.patch
+++ b/target/linux/starfive/patches-6.6/0033-PCI-Add-PCIE_RESET_CONFIG_DEVICE_WAIT_MS-waiting-tim.patch
@@ -30,7 +30,7 @@ Acked-by: Bjorn Helgaas <bhelgaas@google.com>
 
 --- a/drivers/pci/pci.h
 +++ b/drivers/pci/pci.h
-@@ -19,6 +19,22 @@
+@@ -22,6 +22,22 @@
   */
  #define PCIE_PME_TO_L2_TIMEOUT_US	10000
  
diff --git a/target/linux/starfive/patches-6.6/0049-MAINTAINERS-Update-all-StarFive-entries.patch b/target/linux/starfive/patches-6.6/0049-MAINTAINERS-Update-all-StarFive-entries.patch
index a7a832dce29ec6..57e8c08c81f023 100644
--- a/target/linux/starfive/patches-6.6/0049-MAINTAINERS-Update-all-StarFive-entries.patch
+++ b/target/linux/starfive/patches-6.6/0049-MAINTAINERS-Update-all-StarFive-entries.patch
@@ -12,7 +12,7 @@ Signed-off-by: Hal Feng <hal.feng@starfivetech.com>
 
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -7053,6 +7053,14 @@ T:	git git://anongit.freedesktop.org/drm
+@@ -7054,6 +7054,14 @@ T:	git git://anongit.freedesktop.org/drm
  F:	Documentation/devicetree/bindings/display/rockchip/
  F:	drivers/gpu/drm/rockchip/
  
@@ -27,7 +27,7 @@ Signed-off-by: Hal Feng <hal.feng@starfivetech.com>
  DRM DRIVERS FOR STI
  M:	Alain Volmat <alain.volmat@foss.st.com>
  L:	dri-devel@lists.freedesktop.org
-@@ -16016,6 +16024,13 @@ F:	Documentation/i2c/busses/i2c-ocores.r
+@@ -16017,6 +16025,13 @@ F:	Documentation/i2c/busses/i2c-ocores.r
  F:	drivers/i2c/busses/i2c-ocores.c
  F:	include/linux/platform_data/i2c-ocores.h
  
@@ -41,7 +41,7 @@ Signed-off-by: Hal Feng <hal.feng@starfivetech.com>
  OPENRISC ARCHITECTURE
  M:	Jonas Bonn <jonas@southpole.se>
  M:	Stefan Kristiansson <stefan.kristiansson@saunalahti.fi>
-@@ -16427,6 +16442,14 @@ S:	Maintained
+@@ -16428,6 +16443,14 @@ S:	Maintained
  F:	Documentation/devicetree/bindings/pci/layerscape-pcie-gen4.txt
  F:	drivers/pci/controller/mobiveil/pcie-layerscape-gen4.c
  
@@ -56,7 +56,7 @@ Signed-off-by: Hal Feng <hal.feng@starfivetech.com>
  PCI DRIVER FOR RENESAS R-CAR
  M:	Marek Vasut <marek.vasut+renesas@gmail.com>
  M:	Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
-@@ -16658,7 +16681,7 @@ M:	Daire McNamara <daire.mcnamara@microc
+@@ -16659,7 +16682,7 @@ M:	Daire McNamara <daire.mcnamara@microc
  L:	linux-pci@vger.kernel.org
  S:	Supported
  F:	Documentation/devicetree/bindings/pci/microchip*
@@ -65,7 +65,7 @@ Signed-off-by: Hal Feng <hal.feng@starfivetech.com>
  
  PCIE DRIVER FOR QUALCOMM MSM
  M:	Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
-@@ -16682,6 +16705,13 @@ S:	Maintained
+@@ -16683,6 +16706,13 @@ S:	Maintained
  F:	Documentation/devicetree/bindings/pci/socionext,uniphier-pcie*
  F:	drivers/pci/controller/dwc/pcie-uniphier*
  
@@ -79,7 +79,7 @@ Signed-off-by: Hal Feng <hal.feng@starfivetech.com>
  PCIE DRIVER FOR ST SPEAR13XX
  M:	Pratyush Anand <pratyush.anand@gmail.com>
  L:	linux-pci@vger.kernel.org
-@@ -18454,7 +18484,7 @@ F:	drivers/char/hw_random/mpfs-rng.c
+@@ -18455,7 +18485,7 @@ F:	drivers/char/hw_random/mpfs-rng.c
  F:	drivers/clk/microchip/clk-mpfs*.c
  F:	drivers/i2c/busses/i2c-microchip-corei2c.c
  F:	drivers/mailbox/mailbox-mpfs.c
@@ -88,7 +88,7 @@ Signed-off-by: Hal Feng <hal.feng@starfivetech.com>
  F:	drivers/pwm/pwm-microchip-core.c
  F:	drivers/reset/reset-mpfs.c
  F:	drivers/rtc/rtc-mpfs.c
-@@ -20435,6 +20465,15 @@ M:	Ion Badulescu <ionut@badula.org>
+@@ -20436,6 +20466,15 @@ M:	Ion Badulescu <ionut@badula.org>
  S:	Odd Fixes
  F:	drivers/net/ethernet/adaptec/starfire*
  
@@ -104,7 +104,7 @@ Signed-off-by: Hal Feng <hal.feng@starfivetech.com>
  STARFIVE CRYPTO DRIVER
  M:	Jia Jie Ho <jiajie.ho@starfivetech.com>
  M:	William Qiu <william.qiu@starfivetech.com>
-@@ -20473,6 +20512,13 @@ S:	Supported
+@@ -20474,6 +20513,13 @@ S:	Supported
  F:	Documentation/devicetree/bindings/clock/starfive,jh7110-pll.yaml
  F:	drivers/clk/starfive/clk-starfive-jh7110-pll.c
  
@@ -118,7 +118,7 @@ Signed-off-by: Hal Feng <hal.feng@starfivetech.com>
  STARFIVE JH7110 SYSCON
  M:	William Qiu <william.qiu@starfivetech.com>
  M:	Xingyu Wu <xingyu.wu@starfivetech.com>
-@@ -20520,9 +20566,10 @@ F:	drivers/usb/cdns3/cdns3-starfive.c
+@@ -20521,9 +20567,10 @@ F:	drivers/usb/cdns3/cdns3-starfive.c
  
  STARFIVE JH71XX PMU CONTROLLER DRIVER
  M:	Walker Chen <walker.chen@starfivetech.com>
@@ -130,7 +130,7 @@ Signed-off-by: Hal Feng <hal.feng@starfivetech.com>
  F:	include/dt-bindings/power/starfive,jh7110-pmu.h
  
  STARFIVE SOC DRIVERS
-@@ -20530,7 +20577,13 @@ M:	Conor Dooley <conor@kernel.org>
+@@ -20531,7 +20578,13 @@ M:	Conor Dooley <conor@kernel.org>
  S:	Maintained
  T:	git https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux.git/
  F:	Documentation/devicetree/bindings/soc/starfive/
diff --git a/target/linux/starfive/patches-6.6/0052-ASoC-dwc-i2s-Fix-getting-platform-data-error-for-Sta.patch b/target/linux/starfive/patches-6.6/0052-ASoC-dwc-i2s-Fix-getting-platform-data-error-for-Sta.patch
index e274e84a259ddf..65ca992201db45 100644
--- a/target/linux/starfive/patches-6.6/0052-ASoC-dwc-i2s-Fix-getting-platform-data-error-for-Sta.patch
+++ b/target/linux/starfive/patches-6.6/0052-ASoC-dwc-i2s-Fix-getting-platform-data-error-for-Sta.patch
@@ -16,7 +16,7 @@ Signed-off-by: Hal Feng <hal.feng@starfivetech.com>
 
 --- a/sound/soc/dwc/dwc-i2s.c
 +++ b/sound/soc/dwc/dwc-i2s.c
-@@ -917,7 +917,11 @@ static int jh7110_i2stx0_clk_cfg(struct
+@@ -916,7 +916,11 @@ static int jh7110_i2stx0_clk_cfg(struct
  
  static int dw_i2s_probe(struct platform_device *pdev)
  {
diff --git a/target/linux/starfive/patches-6.6/0053-ASoC-dwc-i2s-Add-RX-master-support-for-StarFive-JH71.patch b/target/linux/starfive/patches-6.6/0053-ASoC-dwc-i2s-Add-RX-master-support-for-StarFive-JH71.patch
index 8203beca52ed91..48d47dce76000d 100644
--- a/target/linux/starfive/patches-6.6/0053-ASoC-dwc-i2s-Add-RX-master-support-for-StarFive-JH71.patch
+++ b/target/linux/starfive/patches-6.6/0053-ASoC-dwc-i2s-Add-RX-master-support-for-StarFive-JH71.patch
@@ -15,7 +15,7 @@ Signed-off-by: Hal Feng <hal.feng@starfivetech.com>
 
 --- a/sound/soc/dwc/dwc-i2s.c
 +++ b/sound/soc/dwc/dwc-i2s.c
-@@ -906,6 +906,27 @@ static int jh7110_i2srx_crg_init(struct
+@@ -905,6 +905,27 @@ static int jh7110_i2srx_crg_init(struct
  	return jh7110_i2s_crg_slave_init(dev);
  }
  
@@ -43,7 +43,7 @@ Signed-off-by: Hal Feng <hal.feng@starfivetech.com>
  static int jh7110_i2stx0_clk_cfg(struct i2s_clk_config_data *config)
  {
  	struct dw_i2s_dev *dev = container_of(config, struct dw_i2s_dev, config);
-@@ -1086,11 +1107,21 @@ static const struct i2s_platform_data jh
+@@ -1085,11 +1106,21 @@ static const struct i2s_platform_data jh
  	.i2s_pd_init = jh7110_i2srx_crg_init,
  };
  
diff --git a/target/linux/starfive/patches-6.6/0066-uart-8250-Add-dw-auto-flow-ctrl-support.patch b/target/linux/starfive/patches-6.6/0066-uart-8250-Add-dw-auto-flow-ctrl-support.patch
index c88008a6042dd5..68e495112cdacc 100644
--- a/target/linux/starfive/patches-6.6/0066-uart-8250-Add-dw-auto-flow-ctrl-support.patch
+++ b/target/linux/starfive/patches-6.6/0066-uart-8250-Add-dw-auto-flow-ctrl-support.patch
@@ -25,7 +25,7 @@ Signed-off-by: Minda Chen <minda.chen@starfivetech.com>
 +			uart->probe = up->probe;
  
  		if (uart->port.type != PORT_8250_CIR) {
- 			if (serial8250_isa_config != NULL)
+ 			if (uart_console_registered(&uart->port))
 --- a/drivers/tty/serial/8250/8250_dw.c
 +++ b/drivers/tty/serial/8250/8250_dw.c
 @@ -612,6 +612,9 @@ static int dw8250_probe(struct platform_
@@ -67,7 +67,7 @@ Signed-off-by: Minda Chen <minda.chen@starfivetech.com>
  }
  
  /*
-@@ -2813,7 +2826,6 @@ serial8250_do_set_termios(struct uart_po
+@@ -2821,7 +2834,6 @@ serial8250_do_set_termios(struct uart_po
  		if (termios->c_cflag & CRTSCTS)
  			up->mcr |= UART_MCR_AFE;
  	}
diff --git a/target/linux/starfive/patches-6.6/0072-drivers-nvme-Add-precheck-and-delay-for-CQE-pending-.patch b/target/linux/starfive/patches-6.6/0072-drivers-nvme-Add-precheck-and-delay-for-CQE-pending-.patch
index d602df9e4c3c10..7b768a9bc5a09f 100644
--- a/target/linux/starfive/patches-6.6/0072-drivers-nvme-Add-precheck-and-delay-for-CQE-pending-.patch
+++ b/target/linux/starfive/patches-6.6/0072-drivers-nvme-Add-precheck-and-delay-for-CQE-pending-.patch
@@ -22,7 +22,7 @@ Signed-off-by: Kevin.xie <kevin.xie@starfivetech.com>
  
  #include "trace.h"
  #include "nvme.h"
-@@ -1062,6 +1063,15 @@ static inline int nvme_poll_cq(struct nv
+@@ -1058,6 +1059,15 @@ static inline int nvme_poll_cq(struct nv
  {
  	int found = 0;
  
diff --git a/target/linux/starfive/patches-6.6/0109-usb-xhci-To-improve-performance-usb-using-lowmem-for.patch b/target/linux/starfive/patches-6.6/0109-usb-xhci-To-improve-performance-usb-using-lowmem-for.patch
index 2554e731987841..e514e4e47b1738 100644
--- a/target/linux/starfive/patches-6.6/0109-usb-xhci-To-improve-performance-usb-using-lowmem-for.patch
+++ b/target/linux/starfive/patches-6.6/0109-usb-xhci-To-improve-performance-usb-using-lowmem-for.patch
@@ -50,7 +50,7 @@ Signed-off-by: minda.chen <minda.chen@starfivetech.com>
  
  #include "xhci.h"
  #include "xhci-trace.h"
-@@ -1842,6 +1843,7 @@ xhci_free_interrupter(struct xhci_hcd *x
+@@ -1884,6 +1885,7 @@ EXPORT_SYMBOL_GPL(xhci_remove_secondary_
  void xhci_mem_cleanup(struct xhci_hcd *xhci)
  {
  	struct device	*dev = xhci_to_hcd(xhci)->self.sysdev;
@@ -58,7 +58,7 @@ Signed-off-by: minda.chen <minda.chen@starfivetech.com>
  	int i, j, num_ports;
  
  	cancel_delayed_work_sync(&xhci->cmd_timer);
-@@ -1887,6 +1889,13 @@ void xhci_mem_cleanup(struct xhci_hcd *x
+@@ -1934,6 +1936,13 @@ void xhci_mem_cleanup(struct xhci_hcd *x
  	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
  			"Freed medium stream array pool");
  
@@ -72,9 +72,9 @@ Signed-off-by: minda.chen <minda.chen@starfivetech.com>
  	if (xhci->dcbaa)
  		dma_free_coherent(dev, sizeof(*xhci->dcbaa),
  				xhci->dcbaa, xhci->dcbaa->dma);
-@@ -2300,6 +2309,55 @@ xhci_add_interrupter(struct xhci_hcd *xh
- 	return 0;
+@@ -2405,6 +2414,55 @@ xhci_create_secondary_interrupter(struct
  }
+ EXPORT_SYMBOL_GPL(xhci_create_secondary_interrupter);
  
 +int xhci_setup_local_lowmem(struct xhci_hcd *xhci, size_t size)
 +{
@@ -127,8 +127,8 @@ Signed-off-by: minda.chen <minda.chen@starfivetech.com>
 +
  int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
  {
- 	dma_addr_t	dma;
-@@ -2436,6 +2494,12 @@ int xhci_mem_init(struct xhci_hcd *xhci,
+ 	struct xhci_interrupter *ir;
+@@ -2546,6 +2604,12 @@ int xhci_mem_init(struct xhci_hcd *xhci,
  
  	xhci->isoc_bei_interval = AVOID_BEI_INTERVAL_MAX;
  
@@ -160,7 +160,7 @@ Signed-off-by: minda.chen <minda.chen@starfivetech.com>
  	}
 --- a/drivers/usb/host/xhci-ring.c
 +++ b/drivers/usb/host/xhci-ring.c
-@@ -3664,7 +3664,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
+@@ -3729,7 +3729,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
  
  	full_len = urb->transfer_buffer_length;
  	/* If we have scatter/gather list, we use it. */
@@ -172,7 +172,7 @@ Signed-off-by: minda.chen <minda.chen@starfivetech.com>
  		addr = (u64) sg_dma_address(sg);
 --- a/drivers/usb/host/xhci.c
 +++ b/drivers/usb/host/xhci.c
-@@ -18,6 +18,8 @@
+@@ -19,6 +19,8 @@
  #include <linux/slab.h>
  #include <linux/dmi.h>
  #include <linux/dma-mapping.h>
@@ -181,7 +181,7 @@ Signed-off-by: minda.chen <minda.chen@starfivetech.com>
  
  #include "xhci.h"
  #include "xhci-trace.h"
-@@ -1285,6 +1287,55 @@ static void xhci_unmap_temp_buf(struct u
+@@ -1314,6 +1316,55 @@ static void xhci_unmap_temp_buf(struct u
  	urb->transfer_buffer = NULL;
  }
  
@@ -237,7 +237,7 @@ Signed-off-by: minda.chen <minda.chen@starfivetech.com>
  /*
   * Bypass the DMA mapping if URB is suitable for Immediate Transfer (IDT),
   * we'll copy the actual data into the TRB address register. This is limited to
-@@ -1305,9 +1356,11 @@ static int xhci_map_urb_for_dma(struct u
+@@ -1334,9 +1385,11 @@ static int xhci_map_urb_for_dma(struct u
  		if (xhci_urb_temp_buffer_required(hcd, urb))
  			return xhci_map_temp_buffer(hcd, urb);
  	}
@@ -249,7 +249,7 @@ Signed-off-by: minda.chen <minda.chen@starfivetech.com>
  static void xhci_unmap_urb_for_dma(struct usb_hcd *hcd, struct urb *urb)
  {
  	struct xhci_hcd *xhci;
-@@ -1320,8 +1373,10 @@ static void xhci_unmap_urb_for_dma(struc
+@@ -1349,8 +1402,10 @@ static void xhci_unmap_urb_for_dma(struc
  
  	if ((xhci->quirks & XHCI_SG_TRB_CACHE_SIZE_QUIRK) && unmap_temp_buf)
  		xhci_unmap_temp_buf(hcd, urb);
@@ -263,7 +263,7 @@ Signed-off-by: minda.chen <minda.chen@starfivetech.com>
  /**
 --- a/drivers/usb/host/xhci.h
 +++ b/drivers/usb/host/xhci.h
-@@ -1764,6 +1764,13 @@ struct xhci_hub {
+@@ -1506,6 +1506,13 @@ struct xhci_hub {
  	u8			min_rev;
  };
  
@@ -277,16 +277,16 @@ Signed-off-by: minda.chen <minda.chen@starfivetech.com>
  /* There is one xhci_hcd structure per controller */
  struct xhci_hcd {
  	struct usb_hcd *main_hcd;
-@@ -1917,6 +1924,8 @@ struct xhci_hcd {
- #define XHCI_WRITE_64_HI_LO	BIT_ULL(47)
- #define XHCI_CDNS_SCTX_QUIRK	BIT_ULL(48)
+@@ -1661,6 +1668,8 @@ struct xhci_hcd {
+ #define XHCI_ETRON_HOST	BIT_ULL(49)
+ #define XHCI_LIMIT_ENDPOINT_INTERVAL_9 BIT_ULL(50)
  
 +#define XHCI_LOCAL_BUFFER	BIT_ULL(63)
 +
  	unsigned int		num_active_eps;
  	unsigned int		limit_active_eps;
  	struct xhci_port	*hw_ports;
-@@ -1946,6 +1955,8 @@ struct xhci_hcd {
+@@ -1690,6 +1699,8 @@ struct xhci_hcd {
  	struct list_head	regset_list;
  
  	void			*dbc;
diff --git a/target/linux/starfive/patches-6.6/0110-usb-xhci-using-dma_alloc_noncoherent-to-alloc-low-me.patch b/target/linux/starfive/patches-6.6/0110-usb-xhci-using-dma_alloc_noncoherent-to-alloc-low-me.patch
index a9c03feecf684e..2a72bcb9cf4c5f 100644
--- a/target/linux/starfive/patches-6.6/0110-usb-xhci-using-dma_alloc_noncoherent-to-alloc-low-me.patch
+++ b/target/linux/starfive/patches-6.6/0110-usb-xhci-using-dma_alloc_noncoherent-to-alloc-low-me.patch
@@ -16,7 +16,7 @@ Signed-off-by: Minda Chen <minda.chen@starfivetech.com>
 
 --- a/drivers/usb/host/xhci-mem.c
 +++ b/drivers/usb/host/xhci-mem.c
-@@ -1891,7 +1891,8 @@ void xhci_mem_cleanup(struct xhci_hcd *x
+@@ -1938,7 +1938,8 @@ void xhci_mem_cleanup(struct xhci_hcd *x
  
  	if (xhci->lowmem_pool.pool) {
  		pool = &xhci->lowmem_pool;
@@ -26,7 +26,7 @@ Signed-off-by: Minda Chen <minda.chen@starfivetech.com>
  		gen_pool_destroy(pool->pool);
  		pool->pool = NULL;
  	}
-@@ -2320,15 +2321,15 @@ int xhci_setup_local_lowmem(struct xhci_
+@@ -2425,15 +2426,15 @@ int xhci_setup_local_lowmem(struct xhci_
  	if (!pool->pool) {
  		/* minimal alloc one page */
  		pool->pool = gen_pool_create(PAGE_SHIFT, dev_to_node(hcd->self.sysdev));
@@ -48,7 +48,7 @@ Signed-off-by: Minda Chen <minda.chen@starfivetech.com>
  		goto destroy_pool;
  	}
  
-@@ -2338,11 +2339,11 @@ int xhci_setup_local_lowmem(struct xhci_
+@@ -2443,11 +2444,11 @@ int xhci_setup_local_lowmem(struct xhci_
  	 * for it.
  	 */
  	err = gen_pool_add_virt(pool->pool, (unsigned long)buffer,
@@ -62,7 +62,7 @@ Signed-off-by: Minda Chen <minda.chen@starfivetech.com>
  		goto destroy_pool;
  	}
  
-@@ -2365,7 +2366,7 @@ int xhci_mem_init(struct xhci_hcd *xhci,
+@@ -2471,7 +2472,7 @@ int xhci_mem_init(struct xhci_hcd *xhci,
  	unsigned int	val, val2;
  	u64		val_64;
  	u32		page_size, temp;
@@ -71,7 +71,7 @@ Signed-off-by: Minda Chen <minda.chen@starfivetech.com>
  
  	INIT_LIST_HEAD(&xhci->cmd_list);
  
-@@ -2495,9 +2496,11 @@ int xhci_mem_init(struct xhci_hcd *xhci,
+@@ -2605,9 +2606,11 @@ int xhci_mem_init(struct xhci_hcd *xhci,
  	xhci->isoc_bei_interval = AVOID_BEI_INTERVAL_MAX;
  
  	if (xhci->quirks & XHCI_LOCAL_BUFFER) {
diff --git a/target/linux/starfive/patches-6.6/1000-serial-8250_dw-Add-starfive-jh7100-hsuart-compatible.patch b/target/linux/starfive/patches-6.6/1000-serial-8250_dw-Add-starfive-jh7100-hsuart-compatible.patch
index 463c7eb7b667fc..a094e4b5d69187 100644
--- a/target/linux/starfive/patches-6.6/1000-serial-8250_dw-Add-starfive-jh7100-hsuart-compatible.patch
+++ b/target/linux/starfive/patches-6.6/1000-serial-8250_dw-Add-starfive-jh7100-hsuart-compatible.patch
@@ -15,11 +15,11 @@ Signed-off-by: Emil Renner Berthing <kernel@esmil.dk>
 
 --- a/drivers/tty/serial/8250/8250_dw.c
 +++ b/drivers/tty/serial/8250/8250_dw.c
-@@ -802,6 +802,7 @@ static const struct of_device_id dw8250_
- 	{ .compatible = "cavium,octeon-3860-uart", .data = &dw8250_octeon_3860_data },
+@@ -803,6 +803,7 @@ static const struct of_device_id dw8250_
  	{ .compatible = "marvell,armada-38x-uart", .data = &dw8250_armada_38x_data },
  	{ .compatible = "renesas,rzn1-uart", .data = &dw8250_renesas_rzn1_data },
-+	{ .compatible = "starfive,jh7100-hsuart", .data = &dw8250_starfive_jh7100_data },
- 	{ .compatible = "starfive,jh7100-uart", .data = &dw8250_starfive_jh7100_data },
+ 	{ .compatible = "sophgo,sg2044-uart", .data = &dw8250_skip_set_rate_data },
++	{ .compatible = "starfive,jh7100-hsuart", .data = &dw8250_skip_set_rate_data },
+ 	{ .compatible = "starfive,jh7100-uart", .data = &dw8250_skip_set_rate_data },
  	{ /* Sentinel */ }
  };
diff --git a/target/linux/starfive/patches-6.6/1009-net-stmmac-use-GFP_DMA32.patch b/target/linux/starfive/patches-6.6/1009-net-stmmac-use-GFP_DMA32.patch
index ad8b92f7158083..4d3997b24ecc02 100644
--- a/target/linux/starfive/patches-6.6/1009-net-stmmac-use-GFP_DMA32.patch
+++ b/target/linux/starfive/patches-6.6/1009-net-stmmac-use-GFP_DMA32.patch
@@ -10,7 +10,7 @@ Signed-off-by: Matteo Croce <mcroce@microsoft.com>
 
 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
 +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
-@@ -1434,7 +1434,7 @@ static int stmmac_init_rx_buffers(struct
+@@ -1439,7 +1439,7 @@ static int stmmac_init_rx_buffers(struct
  {
  	struct stmmac_rx_queue *rx_q = &dma_conf->rx_queue[queue];
  	struct stmmac_rx_buffer *buf = &rx_q->buf_pool[i];
@@ -19,7 +19,7 @@ Signed-off-by: Matteo Croce <mcroce@microsoft.com>
  
  	if (priv->dma_cap.host_dma_width <= 32)
  		gfp |= GFP_DMA32;
-@@ -4673,7 +4673,7 @@ static inline void stmmac_rx_refill(stru
+@@ -4693,7 +4693,7 @@ static inline void stmmac_rx_refill(stru
  	struct stmmac_rx_queue *rx_q = &priv->dma_conf.rx_queue[queue];
  	int dirty = stmmac_rx_dirty(priv, queue);
  	unsigned int entry = rx_q->dirty_rx;
diff --git a/target/linux/starfive/patches-6.6/1014-reset-starfive-Add-JH7100-audio-reset-driver.patch b/target/linux/starfive/patches-6.6/1014-reset-starfive-Add-JH7100-audio-reset-driver.patch
index bc33188a44a7e3..79e7d4ddb48cbb 100644
--- a/target/linux/starfive/patches-6.6/1014-reset-starfive-Add-JH7100-audio-reset-driver.patch
+++ b/target/linux/starfive/patches-6.6/1014-reset-starfive-Add-JH7100-audio-reset-driver.patch
@@ -20,7 +20,7 @@ Signed-off-by: Emil Renner Berthing <kernel@esmil.dk>
 
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -20554,7 +20554,7 @@ STARFIVE JH71X0 RESET CONTROLLER DRIVERS
+@@ -20555,7 +20555,7 @@ STARFIVE JH71X0 RESET CONTROLLER DRIVERS
  M:	Emil Renner Berthing <kernel@esmil.dk>
  M:	Hal Feng <hal.feng@starfivetech.com>
  S:	Maintained
diff --git a/target/linux/stm32/Makefile b/target/linux/stm32/Makefile
new file mode 100644
index 00000000000000..3020d0b2b8e5b7
--- /dev/null
+++ b/target/linux/stm32/Makefile
@@ -0,0 +1,24 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2024 Bootlin
+#
+
+include $(TOPDIR)/rules.mk
+
+BOARD:=stm32
+BOARDNAME:=STMicroelectronics STM32
+FEATURES:=boot-part emmc ext4 gpio rtc usb
+SUBTARGETS:=stm32mp1
+CPU_TYPE:=
+
+KERNEL_PATCHVER:=6.6
+
+include $(INCLUDE_DIR)/target.mk
+
+DEFAULT_PACKAGES += blockdev kmod-gpio-button-hotplug
+
+define Target/Description
+	Build firmware image for STM32 devices
+endef
+
+$(eval $(call BuildTarget))
diff --git a/target/linux/realtek/base-files/etc/board.d/03_gpio_switches b/target/linux/stm32/base-files/etc/board.d/02_network
similarity index 54%
rename from target/linux/realtek/base-files/etc/board.d/03_gpio_switches
rename to target/linux/stm32/base-files/etc/board.d/02_network
index 1e49d89c64a241..a96fada9a4e332 100644
--- a/target/linux/realtek/base-files/etc/board.d/03_gpio_switches
+++ b/target/linux/stm32/base-files/etc/board.d/02_network
@@ -1,13 +1,15 @@
 
 . /lib/functions/uci-defaults.sh
+. /lib/functions.sh
+. /lib/functions/system.sh
 
 board_config_update
 
 board=$(board_name)
 
 case "$board" in
-hpe,1920-8g-poe-180w)
-	ucidef_add_gpio_switch "fan_ctrl" "Fan control" "456" "0"
+st,stm32mp135f-dk)
+	ucidef_set_interfaces_lan_wan "eth0" "eth1"
 	;;
 esac
 
diff --git a/target/linux/stm32/base-files/lib/preinit/79_move_config b/target/linux/stm32/base-files/lib/preinit/79_move_config
new file mode 100644
index 00000000000000..bc7db4c7828f6a
--- /dev/null
+++ b/target/linux/stm32/base-files/lib/preinit/79_move_config
@@ -0,0 +1,15 @@
+
+move_config() {
+	. /lib/upgrade/common.sh
+	. /lib/upgrade/platform.sh
+
+	if export_bootdevice && export_partdevice partdev 4; then
+		mount -t ext4 -o rw,noatime "/dev/$partdev" /mnt
+		if [ -f "/mnt/$BACKUP_FILE" ]; then
+			mv -f "/mnt/$BACKUP_FILE" /
+		fi
+		umount /mnt
+	fi
+}
+
+boot_hook_add preinit_mount_root move_config
diff --git a/target/linux/stm32/base-files/lib/upgrade/platform.sh b/target/linux/stm32/base-files/lib/upgrade/platform.sh
new file mode 100644
index 00000000000000..4cd88ab6bd383e
--- /dev/null
+++ b/target/linux/stm32/base-files/lib/upgrade/platform.sh
@@ -0,0 +1,181 @@
+REQUIRE_IMAGE_METADATA=1
+
+UBOOT_ENV_PART=3
+BOOT_PART=4
+ROOTFS_PART=5
+
+RAMFS_COPY_BIN='blockdev'
+
+export_bootdevice() {
+	local cmdline uuid blockdev uevent line class
+	local MAJOR MINOR DEVNAME DEVTYPE
+	local rootpart="$(cmdline_get_var root)"
+
+	case "$rootpart" in
+		PARTUUID=????????-????-????-????-??????????0?/PARTNROFF=1 | \
+		PARTUUID=????????-????-????-????-??????????05)
+			uuid="${rootpart#PARTUUID=}"
+			uuid="${uuid%/PARTNROFF=1}"
+			uuid="${uuid%0?}00"
+			for disk in $(find /dev -type b); do
+				set -- $(dd if=$disk bs=1 skip=568 count=16 2>/dev/null | hexdump -v -e '8/1 "%02x "" "2/1 "%02x""-"6/1 "%02x"')
+				if [ "$4$3$2$1-$6$5-$8$7-$9" = "$uuid" ]; then
+					uevent="/sys/class/block/${disk##*/}/uevent"
+					break
+				fi
+			done
+		;;
+	esac
+
+	if [ -e "$uevent" ]; then
+		while read line; do
+			export -n "$line"
+		done < "$uevent"
+		export BOOTDEV_MAJOR=$MAJOR
+		export BOOTDEV_MINOR=$MINOR
+		return 0
+	fi
+
+	return 1
+}
+
+platform_check_image() {
+	local diskdev partdev diff
+
+        [ "$#" -gt 1 ] && return 1
+
+	export_bootdevice && export_partdevice diskdev 0 || {
+		v "platform_check_image: Unable to determine upgrade device"
+		return 1
+	}
+
+	get_partitions "/dev/$diskdev" bootdisk
+
+	v "Extract the boot sector from the image"
+	get_image_dd "$1" of=/tmp/image.bs count=63 bs=512b
+
+	get_partitions /tmp/image.bs image
+
+	#compare tables
+	diff="$(grep -F -x -v -f /tmp/partmap.bootdisk /tmp/partmap.image)"
+
+	rm -f /tmp/image.bs /tmp/partmap.bootdisk /tmp/partmap.image
+
+	if [ -n "$diff" ]; then
+		echo "Partition layout has changed. Full image will be written."
+		ask_bool 0 "Abort" && exit 1
+		return 0
+	fi
+}
+
+platform_do_upgrade() {
+	local diskdev partdev diff partlabel
+
+	export_bootdevice && export_partdevice diskdev 0 || {
+		v "platform_do_upgrade: Unable to determine upgrade device"
+		return 1
+	}
+
+	sync
+
+	if [ "$UPGRADE_OPT_SAVE_PARTITIONS" = "1" ]; then
+		get_partitions "/dev/$diskdev" bootdisk
+
+		v "Extract boot sector from the image"
+		get_image_dd "$1" of=/tmp/image.bs count=63 bs=512b
+
+		get_partitions /tmp/image.bs image
+
+		#compare tables
+		diff="$(grep -F -x -v -f /tmp/partmap.bootdisk /tmp/partmap.image)"
+	else
+		diff=1
+	fi
+
+	if [ -n "$diff" ]; then
+		rm -rf /tmp/ubootenv
+
+		if export_partdevice partdev $UBOOT_ENV_PART; then
+			v "Saving u-boot env (/dev/$partdev) before to write image"
+			get_image_dd "/dev/$partdev" of=/tmp/ubootenv
+		fi
+
+		v "Writing image to /dev/$diskdev..."
+		get_image_dd "$1" of="/dev/$diskdev" conv=fsync
+
+		blockdev --rereadpt "/dev/$diskdev"
+
+		[ -f /tmp/ubootenv ] && {
+			# iterate over each partition from the image to find the
+			# u-boot-env partition and restore u-boot env.
+			while read part start size; do
+				if export_partdevice partdev $part; then
+					while read line; do
+						eval "local l$line"
+					done < "/sys/class/block/$partdev/uevent"
+
+					[ "$lPARTNAME" = "u-boot-env" ] || continue
+
+					v "Writting u-boot env to /dev/$partdev"
+					get_image_dd /tmp/ubootenv of="/dev/$partdev" conv=fsync
+
+					return 0
+				fi
+			done < /tmp/partmap.image
+		}
+		return 0
+	fi
+
+	#iterate over each partition from the image and write it to the boot disk
+	while read part start size; do
+		if export_partdevice partdev $part; then
+			# do not erase u-boot env
+			[ "$part" = "$UBOOT_ENV_PART" ] && continue
+
+			v "Writing image to /dev/$partdev..."
+			v "Normal partition, doing DD"
+			get_image_dd "$1" of="/dev/$partdev" ibs=512 obs=1M skip="$start" \
+				count="$size" conv=fsync
+		else
+			v "Unable to find partition $part device, skipped."
+		fi
+	done < /tmp/partmap.image
+
+	if export_partdevice partdev "$BOOT_PART"; then
+		mount -t ext4 -o rw,noatime "/dev/$partdev" /mnt
+		local partuuid="$(cmdline_get_var root)"
+		v "Setting rootfs ${partuuid}"
+		sed -i "s/PARTUUID=[a-f0-9-]\+/${partuuid}/ig" \
+			/mnt/extlinux/extlinux.conf
+		umount /mnt
+	fi
+}
+
+platform_copy_config() {
+	local partdev
+
+	# Iterate over each partition from the image to find the boot partition
+	# and copy the config tarball.
+	# The partlabel is used to find the partition.
+	# An hardcoded partition number cannot be used, as it could be wrong if
+	# the partition table changed, and the full image was written.
+	while read part start size; do
+		# config is copied in the boot partition, as for squashfs image, the
+		# rootfs partition is not writable.
+		if export_partdevice partdev "$part"; then
+			while read line; do
+				eval "local l$line"
+			done < "/sys/class/block/$partdev/uevent"
+
+			[ "$lPARTNAME" = "boot" ] || continue
+
+			mount -t ext4 -o rw,noatime "/dev/$partdev" /mnt
+			cp -af "$UPGRADE_BACKUP" "/mnt/$BACKUP_FILE"
+			umount /mnt
+			return 0
+		else
+			v "ERROR: Unable to find partition to copy config data to"
+		fi
+	done < /tmp/partmap.image
+}
+
diff --git a/target/linux/stm32/image/Makefile b/target/linux/stm32/image/Makefile
new file mode 100644
index 00000000000000..77c25edaf892ad
--- /dev/null
+++ b/target/linux/stm32/image/Makefile
@@ -0,0 +1,63 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2024 Bootlin
+#
+
+include $(TOPDIR)/rules.mk
+include $(INCLUDE_DIR)/image.mk
+
+define Build/boot-img-ext4
+	rm -fR $@.boot
+	mkdir -p $@.boot
+	$(foreach dts,$(DEVICE_DTS), $(CP) $(KDIR)/image-$(dts).dtb $@.boot/$(dts).dtb;)
+	$(CP) $(IMAGE_KERNEL) $@.boot/$(KERNEL_IMG)
+	$(INSTALL_DIR) $@.boot/extlinux
+	$(CP) ./extlinux.conf $@.boot/extlinux/
+	$(SED) 's/@KERNEL@/$(KERNEL_IMG)/' $@.boot/extlinux/extlinux.conf
+	$(SED) 's/@DEVICE@/$(DEVICE_NAME)/' $@.boot/extlinux/extlinux.conf
+	$(SED) 's/@DTS@/$(DEVICE_DTS)/' $@.boot/extlinux/extlinux.conf
+	$(SED) 's/@ROOT@/PARTUUID=$(shell echo $(IMG_PART_DISKGUID) | sed 's/00$$/05/')/' $@.boot/extlinux/extlinux.conf
+
+	make_ext4fs -J -L kernel -l $(CONFIG_TARGET_KERNEL_PARTSIZE)M \
+		$(if $(SOURCE_DATE_EPOCH),-T $(SOURCE_DATE_EPOCH)) \
+		$@.bootimg $@.boot
+endef
+
+define Build/sdcard-img
+	GUID=$(IMG_PART_DISKGUID) ./gen_stm32_sdcard_img.sh \
+	     $@ $(STAGING_DIR_IMAGE)/tf-a-$(DEVICE_NAME).stm32 \
+	     $(STAGING_DIR_IMAGE)/fip-$(DEVICE_NAME).bin $@.bootimg $(IMAGE_ROOTFS) \
+	     $(ENV_SIZE) $(CONFIG_TARGET_KERNEL_PARTSIZE) $(CONFIG_TARGET_ROOTFS_PARTSIZE)
+endef
+
+define Device/Default
+  PROFILES := Default
+  DEVICE_VENDOR := STMicroelectronics
+  IMAGES := factory.img.gz sysupgrade.img.gz
+  IMAGE/factory.img.gz := boot-img-ext4 | sdcard-img | gzip
+  IMAGE/sysupgrade.img.gz := boot-img-ext4 | sdcard-img | gzip | append-metadata
+  KERNEL := kernel-bin
+  KERNEL_NAME := zImage
+  KERNEL_IMG := zImage
+  DEVICE_DTS_DIR := $(DTS_DIR)/st
+  ENV_SIZE := 0x200000
+  DEVICE_PACKAGES := kmod-brcmfmac \
+		     murata-firmware-43430-sdio \
+		     murata-nvram-43430-sdio \
+		     wpad-basic-mbedtls \
+		     kmod-phy-stm32-usbphyc \
+		     kmod-usb2 \
+		     kmod-usb-storage \
+		     kmod-usb-ledtrig-usbport \
+		     -mtd
+endef
+
+define Device/stm32mp135f-dk
+  DEVICE_MODEL := STM32MP135F-DK
+  DEVICE_DTS := stm32mp135f-dk
+  SUPPORTED_DEVICES := st,stm32mp135f-dk
+endef
+
+TARGET_DEVICES += stm32mp135f-dk
+
+$(eval $(call BuildImage))
diff --git a/target/linux/stm32/image/extlinux.conf b/target/linux/stm32/image/extlinux.conf
new file mode 100644
index 00000000000000..5c7773c2a82792
--- /dev/null
+++ b/target/linux/stm32/image/extlinux.conf
@@ -0,0 +1,4 @@
+label @DEVICE@-openwrt
+  kernel /@KERNEL@
+  devicetree /@DTS@.dtb
+  append root=@ROOT@ rootwait
diff --git a/target/linux/stm32/image/gen_stm32_sdcard_img.sh b/target/linux/stm32/image/gen_stm32_sdcard_img.sh
new file mode 100755
index 00000000000000..9af891694a4531
--- /dev/null
+++ b/target/linux/stm32/image/gen_stm32_sdcard_img.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+# Copyright (C) 2024 Bootlin
+
+set -ex
+[ $# -eq 8 ] || {
+    echo "SYNTAX: $0 <file> <fsbl> <fip> <bootfs image> <rootfs image> <env size> <bootfs size> <rootfs size>"
+    exit 1
+}
+
+OUTPUT="${1}"
+FSBL="${2}"
+FIP="${3}"
+BOOTFS="${4}"
+ROOTFS="${5}"
+ENVSIZE="$((${6} / 1024))"
+BOOTFSSIZE="${7}"
+ROOTFSSIZE="${8}"
+
+set $(ptgen -o "${OUTPUT}" -g -a 4 -l 2048 -G ${GUID} -N fsbla -p 2M -N fip -p 3M -N u-boot-env -p "${ENVSIZE}" -N boot -p${BOOTFSSIZE}M -N rootfs -p ${ROOTFSSIZE}M)
+FSBLAOFFSET="$((${1} / 512))"
+FSBLASIZE="$((${2} / 512))"
+FIPOFFSET="$((${3} / 512))"
+FIPSIZE="$((${4} / 512))"
+ENVOFFSET="$((${5} / 512))"
+ENVSIZE="$((${6} / 512))"
+BOOTFSOFFSET="$((${7} / 512))"
+BOOTFSSIZE="$((${8} / 512))"
+ROOTFSOFFSET="$((${9} / 512))"
+ROOTFSSIZE="$((${10} / 512))"
+
+dd bs=512 if="${FSBL}" of="${OUTPUT}" seek="${FSBLAOFFSET}" conv=notrunc
+dd bs=512 if="${FIP}"  of="${OUTPUT}" seek="${FIPOFFSET}" conv=notrunc
+dd bs=512 if=/dev/zero of="${OUTPUT}" seek="${ENVOFFSET}" count="${ENVSIZE}" conv=notrunc
+dd bs=512 if="${BOOTFS}" of="${OUTPUT}" seek="${BOOTFSOFFSET}" conv=notrunc
+dd bs=512 if="${ROOTFS}" of="${OUTPUT}" seek="${ROOTFSOFFSET}" conv=notrunc
diff --git a/target/linux/stm32/modules.mk b/target/linux/stm32/modules.mk
new file mode 100644
index 00000000000000..2a9ec36e46d930
--- /dev/null
+++ b/target/linux/stm32/modules.mk
@@ -0,0 +1,257 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2024 Bootlin
+
+define KernelPackage/phy-stm32-usbphyc
+  TITLE:=STM32 USB HS PHY Controller driver
+  DEPENDS:=@TARGET_stm32
+  KCONFIG:=CONFIG_PHY_STM32_USBPHYC
+  FILES:=$(LINUX_DIR)/drivers/phy/st/phy-stm32-usbphyc.ko
+  AUTOLOAD:=$(call AutoProbe,phy-stm32-usbphyc,)
+endef
+
+define KernelPackage/phy-stm32-usbphyc/description
+  Kernel module for STM32 USB HS PHY Controller
+endef
+
+$(eval $(call KernelPackage,phy-stm32-usbphyc))
+
+
+define KernelPackage/bxcan
+  TITLE:=STM32 Basic Extended CAN (bxCAN) devices
+  KCONFIG:=CONFIG_CAN_BXCAN
+  FILES=$(LINUX_DIR)/drivers/net/can/bxcan.ko
+  AUTOLOAD:=$(call AutoProbe,bxcan)
+  $(call AddDepends/can,@TARGET_stm32)
+endef
+
+$(eval $(call KernelPackage,bxcan))
+
+
+define KernelPackage/spi-stm32
+  SUBMENU=$(SPI_MENU)
+  TITLE:=STM32 SPI controller
+  DEPENDS:=@TARGET_stm32
+  KCONFIG:=CONFIG_SPI_STM32 \
+	   CONFIG_SPI=y \
+	   CONFIG_SPI_MASTER=y \
+	   CONFIG_SPI_SLAVE_TIME=n \
+	   CONFIG_SPI_SLAVE_SYSTEM_CONTROL=n
+  FILES=$(LINUX_DIR)/drivers/spi/spi-stm32.ko
+  AUTOLOAD:=$(call AutoProbe,spi-stm32)
+endef
+
+define KernelPackage/spi-stm32/description
+  SPI driver for STMicroelectronics STM32 SoCs.
+endef
+
+$(eval $(call KernelPackage,spi-stm32))
+
+
+define KernelPackage/scmi-hwmon
+  TITLE:=ARM SCMI Sensors
+  KCONFIG:=CONFIG_SENSORS_ARM_SCMI
+  FILES:=$(LINUX_DIR)/drivers/hwmon/scmi-hwmon.ko
+  AUTOLOAD:=$(call AutoProbe,scmi-hwmon)
+  $(call AddDepends/hwmon,@TARGET_stm32 +kmod-thermal)
+endef
+
+$(eval $(call KernelPackage,scmi-hwmon))
+
+
+define KernelPackage/stm32-dcmi
+  TITLE:=STM32 Digital Camera Memory Interface support
+  KCONFIG:=CONFIG_VIDEO_STM32_DCMI
+  FILES:=$(LINUX_DIR)/drivers/media/platform/st/stm32/stm32-dcmi.ko
+  AUTOLOAD:=$(call AutoProbe,stm32-dcmi)
+  $(call AddDepends/video,@TARGET_stm32 +kmod-video-videobuf2 +kmod-video-dma-contig +kmod-video-async +kmod-video-fwnode)
+endef
+
+$(eval $(call KernelPackage,stm32-dcmi))
+
+
+define KernelPackage/sound-soc-stm32-sai
+  TITLE:=STM32 SAI interface (Serial Audio Interface) support
+  KCONFIG:=CONFIG_SND_SOC_STM32_SAI
+  FILES:=$(LINUX_DIR)/sound/soc/stm/snd-soc-stm32-sai-sub.ko \
+	 $(LINUX_DIR)/sound/soc/stm/snd-soc-stm32-sai.ko
+  AUTOLOAD:=$(call AutoProbe,snd-soc-stm32-sai-sub snd-soc-stm32-sai)
+  $(call AddDepends/sound,@TARGET_stm32 +kmod-sound-soc-core)
+endef
+
+$(eval $(call KernelPackage,sound-soc-stm32-sai))
+
+
+define KernelPackage/sound-soc-stm32-i2s
+  TITLE:=STM32 I2S interface (SPI/I2S block) support
+  KCONFIG:=CONFIG_SND_SOC_STM32_I2S
+  FILES:=$(LINUX_DIR)/sound/soc/stm/snd-soc-stm32-i2s.ko
+  AUTOLOAD:=$(call AutoProbe,snd-soc-stm32-i2s)
+  $(call AddDepends/sound,@TARGET_stm32 +kmod-sound-soc-core)
+endef
+
+$(eval $(call KernelPackage,sound-soc-stm32-i2s))
+
+
+define KernelPackage/sound-soc-stm32-spdifrx
+  TITLE:=STM32 S/PDIF receiver (SPDIFRX) support
+  KCONFIG:=CONFIG_SND_SOC_STM32_SPDIFRX
+  FILES:=$(LINUX_DIR)/sound/soc/stm/snd-soc-stm32-spdifrx.ko
+  AUTOLOAD:=$(call AutoProbe,snd-soc-stm32-spdifrx)
+  $(call AddDepends/sound,@TARGET_stm32 +kmod-sound-soc-core)
+endef
+
+$(eval $(call KernelPackage,sound-soc-stm32-spdifrx))
+
+
+define KernelPackage/sound-soc-stm32-dfsdm
+  TITLE:=SoC Audio support for STM32 DFSDM
+  KCONFIG:=CONFIG_SND_SOC_STM32_DFSDM
+  FILES:=$(LINUX_DIR)/sound/soc/stm/stm32_adfsdm.ko
+  AUTOLOAD:=$(call AutoProbe,stm32_adfsdm)
+  $(call AddDepends/sound,@TARGET_stm32 +kmod-sound-soc-core +kmod-stm32-dfsdm-adc +kmod-industrialio-buffer-cb)
+endef
+
+$(eval $(call KernelPackage,sound-soc-stm32-dfsdm))
+
+
+define KernelPackage/stm32-timers
+  TITLE:=STM32 Timers
+  DEPENDS:=@TARGET_stm32 +kmod-mfd
+  KCONFIG:=CONFIG_MFD_STM32_TIMERS
+  FILES:=$(LINUX_DIR)/drivers/mfd/stm32-timers.ko
+  AUTOLOAD:=$(call AutoProbe,stm32-timers)
+endef
+
+$(eval $(call KernelPackage,stm32-timers))
+
+
+define KernelPackage/stm32-timer-trigger
+  TITLE:=STM32 Timer Trigger
+  KCONFIG:=CONFIG_IIO_STM32_TIMER_TRIGGER
+  FILES:=$(LINUX_DIR)/drivers/iio/trigger/stm32-timer-trigger.ko
+  AUTOLOAD:=$(call AutoProbe,stm32-timer-trigger)
+  $(call AddDepends/iio,@TARGET_stm32 +kmod-stm32-timers)
+endef
+
+$(eval $(call KernelPackage,stm32-timer-trigger))
+
+
+define KernelPackage/stm32-adc
+  TITLE:=STM32 ADC
+  KCONFIG:=CONFIG_STM32_ADC_CORE \
+	   CONFIG_STM32_ADC
+  FILES:=$(LINUX_DIR)/drivers/iio/adc/stm32-adc-core.ko \
+	 $(LINUX_DIR)/drivers/iio/adc/stm32-adc.ko
+  AUTOLOAD:=$(call AutoProbe,stm32-adc-core stm32-adc)
+  $(call AddDepends/iio,@TARGET_stm32 +kmod-stm32-timer-trigger +kmod-industrialio-triggered-buffer)
+endef
+
+$(eval $(call KernelPackage,stm32-adc))
+
+
+define KernelPackage/stm32-dfsdm-adc
+  TITLE:=STM32 DFSDM ADC
+  KCONFIG:=CONFIG_STM32_DFSDM_CORE \
+	   CONFIG_STM32_DFSDM_ADC
+  FILES:=$(LINUX_DIR)/drivers/iio/adc/stm32-dfsdm-core.ko \
+	 $(LINUX_DIR)/drivers/iio/adc/stm32-dfsdm-adc.ko
+  AUTOLOAD:=$(call AutoProbe,stm32-dfsdm-core stm32-dfsdm-adc)
+  $(call AddDepends/iio,@TARGET_stm32 +kmod-stm32-timer-trigger +kmod-industrialio-triggered-buffer +kmod-industrialio-hw-consumer)
+endef
+
+$(eval $(call KernelPackage,stm32-dfsdm-adc))
+
+
+define KernelPackage/scmi-iio
+  TITLE:=IIO SCMI
+  KCONFIG=CONFIG_IIO_SCMI
+  FILES:=$(LINUX_DIR)/drivers/iio/common/scmi_sensors/scmi_iio.ko
+  AUTOLOAD:=$(call AutoProbe,scmi_iio)
+  $(call AddDepends/iio,@TARGET_stm32 +kmod-iio-kfifo-buf)
+endef
+
+$(eval $(call KernelPackage,scmi-iio))
+
+
+define KernelPackage/stm32-dac
+  TITLE:=STM32 DAC
+  DEPENDS:=@TARGET_stm32
+  KCONFIG:=CONFIG_STM32_DAC_CORE \
+	   CONFIG_STM32_DAC
+  FILES:=$(LINUX_DIR)/drivers/iio/dac/stm32-dac-core.ko \
+	 $(LINUX_DIR)/drivers/iio/dac/stm32-dac.ko
+  AUTOLOAD:=$(call AutoProbe,stm32-dac-core stm32-dac)
+  $(call AddDepends/iio,@TARGET_stm32)
+endef
+
+$(eval $(call KernelPackage,stm32-dac))
+
+
+define KernelPackage/nvmem-stm32-romem
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=STM32 factory-programmed memory support
+  DEPENDS:=@TARGET_stm32
+  KCONFIG:=CONFIG_NVMEM_STM32_ROMEM
+  FILES:=$(LINUX_DIR)/drivers/nvmem/nvmem_stm32_romem.ko
+  AUTOLOAD:=$(call AutoProbe,nvmem-stm32-romem)
+endef
+
+$(eval $(call KernelPackage,nvmem-stm32-romem))
+
+
+define KernelPackage/stm32-crc32
+  TITLE:=Support for STM32 crc accelerators
+  KCONFIG:=CONFIG_CRYPTO_DEV_STM32_CRC \
+	   CONFIG_CRYPTO_HW=y
+  FILES:=$(LINUX_DIR)/drivers/crypto/stm32/stm32-crc32.ko
+  AUTOLOAD:=$(call AutoProbe,stm32-crc32)
+  $(call AddDepends/crypto,@TARGET_stm32 +kmod-crypto-crc32)
+endef
+
+$(eval $(call KernelPackage,stm32-crc32))
+
+
+define KernelPackage/stm32-hash
+  SUBMENU:=$(CRYPTO_MENU)
+  TITLE:=Support for STM32 hash accelerators
+  DEPENDS:=@TARGET_stm32 \
+	   +kmod-crypto-engine \
+	   +kmod-crypto-md5 \
+	   +kmod-crypto-sha1 \
+	   +kmod-crypto-sha256 \
+	   +kmod-crypto-sha3 \
+	   +kmod-crypto-rsa
+  KCONFIG:=CONFIG_CRYPTO_DEV_STM32_HASH \
+	   CONFIG_CRYPTO_ENGINE=y
+  FILES:=$(LINUX_DIR)/drivers/crypto/stm32/stm32-hash.ko
+  AUTOLOAD:=$(call AutoProbe,stm32-hash)
+endef
+
+$(eval $(call KernelPackage,stm32-hash))
+
+
+define KernelPackage/stm32-cryp
+  TITLE:=Support for STM32 cryp accelerators
+  KCONFIG:=CONFIG_CRYPTO_DEV_STM32_CRYP \
+	   CONFIG_CRYPTO_LIB_DES=y
+  FILES:=$(LINUX_DIR)/drivers/crypto/stm32/stm32-cryp.ko
+  AUTOLOAD:=$(call AutoProbe,stm32-cryp)
+  $(call AddDepends/crypto,@TARGET_stm32 +kmod-crypto-hash +kmod-crypto-des +kmod-crypto-engine)
+endef
+
+$(eval $(call KernelPackage,stm32-cryp))
+
+
+define KernelPackage/st-thermal
+  SUBMENU:=$(OTHER_MENU)
+  TITLE:=Thermal sensors on STMicroelectronics STi series of SoCs
+  KCONFIG:=CONFIG_ST_THERMAL \
+	   CONFIG_ST_THERMAL_MEMMAP
+  DEPENDS:=@TARGET_stm32 +kmod-thermal
+  FILES:=$(LINUX_DIR)/drivers/thermal/st/st_thermal.ko \
+	 $(LINUX_DIR)/drivers/thermal/st/st_thermal_memmap.ko
+  AUTOLOAD:=$(call AutoProbe,st_thermal st_thermal_memmap)
+endef
+
+$(eval $(call KernelPackage,st-thermal))
diff --git a/target/linux/stm32/patches-6.6/001-net-stmmac-dwmac-stm32-use-devm_stmmac_probe_config_.patch b/target/linux/stm32/patches-6.6/001-net-stmmac-dwmac-stm32-use-devm_stmmac_probe_config_.patch
new file mode 100644
index 00000000000000..cf192fdef483dd
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/001-net-stmmac-dwmac-stm32-use-devm_stmmac_probe_config_.patch
@@ -0,0 +1,69 @@
+From 1ddced59ac1f7c739f21e930d87b126a30c561bb Mon Sep 17 00:00:00 2001
+From: Jisheng Zhang <jszhang@kernel.org>
+Date: Sat, 16 Sep 2023 15:58:23 +0800
+Subject: [PATCH 1/8] net: stmmac: dwmac-stm32: use
+ devm_stmmac_probe_config_dt()
+
+Simplify the driver's probe() function by using the devres
+variant of stmmac_probe_config_dt().
+
+Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-stm32.c   | 17 ++++++-----------
+ 1 file changed, 6 insertions(+), 11 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+@@ -372,21 +372,18 @@ static int stm32_dwmac_probe(struct plat
+ 	if (ret)
+ 		return ret;
+ 
+-	plat_dat = stmmac_probe_config_dt(pdev, stmmac_res.mac);
++	plat_dat = devm_stmmac_probe_config_dt(pdev, stmmac_res.mac);
+ 	if (IS_ERR(plat_dat))
+ 		return PTR_ERR(plat_dat);
+ 
+ 	dwmac = devm_kzalloc(&pdev->dev, sizeof(*dwmac), GFP_KERNEL);
+-	if (!dwmac) {
+-		ret = -ENOMEM;
+-		goto err_remove_config_dt;
+-	}
++	if (!dwmac)
++		return -ENOMEM;
+ 
+ 	data = of_device_get_match_data(&pdev->dev);
+ 	if (!data) {
+ 		dev_err(&pdev->dev, "no of match data provided\n");
+-		ret = -EINVAL;
+-		goto err_remove_config_dt;
++		return -EINVAL;
+ 	}
+ 
+ 	dwmac->ops = data;
+@@ -395,14 +392,14 @@ static int stm32_dwmac_probe(struct plat
+ 	ret = stm32_dwmac_parse_data(dwmac, &pdev->dev);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "Unable to parse OF data\n");
+-		goto err_remove_config_dt;
++		return ret;
+ 	}
+ 
+ 	plat_dat->bsp_priv = dwmac;
+ 
+ 	ret = stm32_dwmac_init(plat_dat);
+ 	if (ret)
+-		goto err_remove_config_dt;
++		return ret;
+ 
+ 	ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
+ 	if (ret)
+@@ -412,8 +409,6 @@ static int stm32_dwmac_probe(struct plat
+ 
+ err_clk_disable:
+ 	stm32_dwmac_clk_disable(dwmac);
+-err_remove_config_dt:
+-	stmmac_remove_config_dt(pdev, plat_dat);
+ 
+ 	return ret;
+ }
diff --git a/target/linux/stm32/patches-6.6/002-net-stmmac-dwmac-stm32-refactor-clock-config.patch b/target/linux/stm32/patches-6.6/002-net-stmmac-dwmac-stm32-refactor-clock-config.patch
new file mode 100644
index 00000000000000..dd791dab6a0615
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/002-net-stmmac-dwmac-stm32-refactor-clock-config.patch
@@ -0,0 +1,241 @@
+From 73c350e3fb32e9598b66f61081c7e06a7fba49f8 Mon Sep 17 00:00:00 2001
+From: Ben Wolsieffer <ben.wolsieffer@hefring.com>
+Date: Mon, 9 Oct 2023 10:59:04 -0400
+Subject: [PATCH 2/8] net: stmmac: dwmac-stm32: refactor clock config
+
+Currently, clock configuration is spread throughout the driver and
+partially duplicated for the STM32MP1 and STM32 MCU variants. This makes
+it difficult to keep track of which clocks need to be enabled or disabled
+in various scenarios.
+
+This patch adds symmetric stm32_dwmac_clk_enable/disable() functions
+that handle all clock configuration, including quirks required while
+suspending or resuming. syscfg_clk and clk_eth_ck are not present on
+STM32 MCUs, but it is fine to try to configure them anyway since NULL
+clocks are ignored.
+
+Signed-off-by: Ben Wolsieffer <ben.wolsieffer@hefring.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-stm32.c | 113 +++++++-----------
+ 1 file changed, 45 insertions(+), 68 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+@@ -98,7 +98,6 @@ struct stm32_dwmac {
+ 
+ struct stm32_ops {
+ 	int (*set_mode)(struct plat_stmmacenet_data *plat_dat);
+-	int (*clk_prepare)(struct stm32_dwmac *dwmac, bool prepare);
+ 	int (*suspend)(struct stm32_dwmac *dwmac);
+ 	void (*resume)(struct stm32_dwmac *dwmac);
+ 	int (*parse_data)(struct stm32_dwmac *dwmac,
+@@ -107,62 +106,55 @@ struct stm32_ops {
+ 	bool clk_rx_enable_in_suspend;
+ };
+ 
+-static int stm32_dwmac_init(struct plat_stmmacenet_data *plat_dat)
++static int stm32_dwmac_clk_enable(struct stm32_dwmac *dwmac, bool resume)
+ {
+-	struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
+ 	int ret;
+ 
+-	if (dwmac->ops->set_mode) {
+-		ret = dwmac->ops->set_mode(plat_dat);
+-		if (ret)
+-			return ret;
+-	}
+-
+ 	ret = clk_prepare_enable(dwmac->clk_tx);
+ 	if (ret)
+-		return ret;
++		goto err_clk_tx;
+ 
+-	if (!dwmac->ops->clk_rx_enable_in_suspend ||
+-	    !dwmac->dev->power.is_suspended) {
++	if (!dwmac->ops->clk_rx_enable_in_suspend || !resume) {
+ 		ret = clk_prepare_enable(dwmac->clk_rx);
+-		if (ret) {
+-			clk_disable_unprepare(dwmac->clk_tx);
+-			return ret;
+-		}
++		if (ret)
++			goto err_clk_rx;
+ 	}
+ 
+-	if (dwmac->ops->clk_prepare) {
+-		ret = dwmac->ops->clk_prepare(dwmac, true);
+-		if (ret) {
+-			clk_disable_unprepare(dwmac->clk_rx);
+-			clk_disable_unprepare(dwmac->clk_tx);
+-		}
++	ret = clk_prepare_enable(dwmac->syscfg_clk);
++	if (ret)
++		goto err_syscfg_clk;
++
++	if (dwmac->enable_eth_ck) {
++		ret = clk_prepare_enable(dwmac->clk_eth_ck);
++		if (ret)
++			goto err_clk_eth_ck;
+ 	}
+ 
+ 	return ret;
++
++err_clk_eth_ck:
++	clk_disable_unprepare(dwmac->syscfg_clk);
++err_syscfg_clk:
++	if (!dwmac->ops->clk_rx_enable_in_suspend || !resume)
++		clk_disable_unprepare(dwmac->clk_rx);
++err_clk_rx:
++	clk_disable_unprepare(dwmac->clk_tx);
++err_clk_tx:
++	return ret;
+ }
+ 
+-static int stm32mp1_clk_prepare(struct stm32_dwmac *dwmac, bool prepare)
++static int stm32_dwmac_init(struct plat_stmmacenet_data *plat_dat, bool resume)
+ {
+-	int ret = 0;
++	struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
++	int ret;
+ 
+-	if (prepare) {
+-		ret = clk_prepare_enable(dwmac->syscfg_clk);
++	if (dwmac->ops->set_mode) {
++		ret = dwmac->ops->set_mode(plat_dat);
+ 		if (ret)
+ 			return ret;
+-		if (dwmac->enable_eth_ck) {
+-			ret = clk_prepare_enable(dwmac->clk_eth_ck);
+-			if (ret) {
+-				clk_disable_unprepare(dwmac->syscfg_clk);
+-				return ret;
+-			}
+-		}
+-	} else {
+-		clk_disable_unprepare(dwmac->syscfg_clk);
+-		if (dwmac->enable_eth_ck)
+-			clk_disable_unprepare(dwmac->clk_eth_ck);
+ 	}
+-	return ret;
++
++	return stm32_dwmac_clk_enable(dwmac, resume);
+ }
+ 
+ static int stm32mp1_set_mode(struct plat_stmmacenet_data *plat_dat)
+@@ -252,13 +244,15 @@ static int stm32mcu_set_mode(struct plat
+ 				 dwmac->ops->syscfg_eth_mask, val << 23);
+ }
+ 
+-static void stm32_dwmac_clk_disable(struct stm32_dwmac *dwmac)
++static void stm32_dwmac_clk_disable(struct stm32_dwmac *dwmac, bool suspend)
+ {
+ 	clk_disable_unprepare(dwmac->clk_tx);
+-	clk_disable_unprepare(dwmac->clk_rx);
++	if (!dwmac->ops->clk_rx_enable_in_suspend || !suspend)
++		clk_disable_unprepare(dwmac->clk_rx);
+ 
+-	if (dwmac->ops->clk_prepare)
+-		dwmac->ops->clk_prepare(dwmac, false);
++	clk_disable_unprepare(dwmac->syscfg_clk);
++	if (dwmac->enable_eth_ck)
++		clk_disable_unprepare(dwmac->clk_eth_ck);
+ }
+ 
+ static int stm32_dwmac_parse_data(struct stm32_dwmac *dwmac,
+@@ -397,7 +391,7 @@ static int stm32_dwmac_probe(struct plat
+ 
+ 	plat_dat->bsp_priv = dwmac;
+ 
+-	ret = stm32_dwmac_init(plat_dat);
++	ret = stm32_dwmac_init(plat_dat, false);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -408,7 +402,7 @@ static int stm32_dwmac_probe(struct plat
+ 	return 0;
+ 
+ err_clk_disable:
+-	stm32_dwmac_clk_disable(dwmac);
++	stm32_dwmac_clk_disable(dwmac, false);
+ 
+ 	return ret;
+ }
+@@ -421,7 +415,7 @@ static void stm32_dwmac_remove(struct pl
+ 
+ 	stmmac_dvr_remove(&pdev->dev);
+ 
+-	stm32_dwmac_clk_disable(priv->plat->bsp_priv);
++	stm32_dwmac_clk_disable(dwmac, false);
+ 
+ 	if (dwmac->irq_pwr_wakeup >= 0) {
+ 		dev_pm_clear_wake_irq(&pdev->dev);
+@@ -431,18 +425,7 @@ static void stm32_dwmac_remove(struct pl
+ 
+ static int stm32mp1_suspend(struct stm32_dwmac *dwmac)
+ {
+-	int ret = 0;
+-
+-	ret = clk_prepare_enable(dwmac->clk_ethstp);
+-	if (ret)
+-		return ret;
+-
+-	clk_disable_unprepare(dwmac->clk_tx);
+-	clk_disable_unprepare(dwmac->syscfg_clk);
+-	if (dwmac->enable_eth_ck)
+-		clk_disable_unprepare(dwmac->clk_eth_ck);
+-
+-	return ret;
++	return clk_prepare_enable(dwmac->clk_ethstp);
+ }
+ 
+ static void stm32mp1_resume(struct stm32_dwmac *dwmac)
+@@ -450,14 +433,6 @@ static void stm32mp1_resume(struct stm32
+ 	clk_disable_unprepare(dwmac->clk_ethstp);
+ }
+ 
+-static int stm32mcu_suspend(struct stm32_dwmac *dwmac)
+-{
+-	clk_disable_unprepare(dwmac->clk_tx);
+-	clk_disable_unprepare(dwmac->clk_rx);
+-
+-	return 0;
+-}
+-
+ #ifdef CONFIG_PM_SLEEP
+ static int stm32_dwmac_suspend(struct device *dev)
+ {
+@@ -468,6 +443,10 @@ static int stm32_dwmac_suspend(struct de
+ 	int ret;
+ 
+ 	ret = stmmac_suspend(dev);
++	if (ret)
++		return ret;
++
++	stm32_dwmac_clk_disable(dwmac, true);
+ 
+ 	if (dwmac->ops->suspend)
+ 		ret = dwmac->ops->suspend(dwmac);
+@@ -485,7 +464,7 @@ static int stm32_dwmac_resume(struct dev
+ 	if (dwmac->ops->resume)
+ 		dwmac->ops->resume(dwmac);
+ 
+-	ret = stm32_dwmac_init(priv->plat);
++	ret = stm32_dwmac_init(priv->plat, true);
+ 	if (ret)
+ 		return ret;
+ 
+@@ -500,13 +479,11 @@ static SIMPLE_DEV_PM_OPS(stm32_dwmac_pm_
+ 
+ static struct stm32_ops stm32mcu_dwmac_data = {
+ 	.set_mode = stm32mcu_set_mode,
+-	.suspend = stm32mcu_suspend,
+ 	.syscfg_eth_mask = SYSCFG_MCU_ETH_MASK
+ };
+ 
+ static struct stm32_ops stm32mp1_dwmac_data = {
+ 	.set_mode = stm32mp1_set_mode,
+-	.clk_prepare = stm32mp1_clk_prepare,
+ 	.suspend = stm32mp1_suspend,
+ 	.resume = stm32mp1_resume,
+ 	.parse_data = stm32mp1_parse_data,
diff --git a/target/linux/stm32/patches-6.6/003-net-stmmac-dwmac-stm32-Separate-out-external-clock-r.patch b/target/linux/stm32/patches-6.6/003-net-stmmac-dwmac-stm32-Separate-out-external-clock-r.patch
new file mode 100644
index 00000000000000..bcdd23b4ebf9a6
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/003-net-stmmac-dwmac-stm32-Separate-out-external-clock-r.patch
@@ -0,0 +1,125 @@
+From 23c08dc4ff28b5ca1aa5ee745a5e9688561e8f6a Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Tue, 11 Jun 2024 10:36:00 +0200
+Subject: [PATCH 3/8] net: stmmac: dwmac-stm32: Separate out external clock
+ rate validation
+
+Pull the external clock frequency validation into a separate function,
+to avoid conflating it with external clock DT property decoding and
+clock mux register configuration. This should make the code easier to
+read and understand.
+
+This does change the code behavior slightly. The clock mux PMCR register
+setting now depends solely on the DT properties which configure the clock
+mux between external clock and internal RCC generated clock. The mux PMCR
+register settings no longer depend on the supplied clock frequency, that
+supplied clock frequency is now only validated, and if the clock frequency
+is invalid for a mode, it is rejected.
+
+Previously, the code would switch the PMCR register clock mux to internal
+RCC generated clock if external clock couldn't provide suitable frequency,
+without checking whether the RCC generated clock frequency is correct. Such
+behavior is risky at best, user should have configured their clock correctly
+in the first place, so this behavior is removed here.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-stm32.c | 51 +++++++++++++++----
+ 1 file changed, 41 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+@@ -157,25 +157,54 @@ static int stm32_dwmac_init(struct plat_
+ 	return stm32_dwmac_clk_enable(dwmac, resume);
+ }
+ 
++static int stm32mp1_validate_ethck_rate(struct plat_stmmacenet_data *plat_dat)
++{
++	struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
++	const u32 clk_rate = clk_get_rate(dwmac->clk_eth_ck);
++
++	switch (plat_dat->mac_interface) {
++	case PHY_INTERFACE_MODE_MII:
++	case PHY_INTERFACE_MODE_GMII:
++		if (clk_rate == ETH_CK_F_25M)
++			return 0;
++		break;
++	case PHY_INTERFACE_MODE_RMII:
++		if (clk_rate == ETH_CK_F_25M || clk_rate == ETH_CK_F_50M)
++			return 0;
++		break;
++	case PHY_INTERFACE_MODE_RGMII:
++	case PHY_INTERFACE_MODE_RGMII_ID:
++	case PHY_INTERFACE_MODE_RGMII_RXID:
++	case PHY_INTERFACE_MODE_RGMII_TXID:
++		if (clk_rate == ETH_CK_F_25M || clk_rate == ETH_CK_F_125M)
++			return 0;
++		break;
++	default:
++		break;
++	}
++
++	dev_err(dwmac->dev, "Mode %s does not match eth-ck frequency %d Hz",
++		phy_modes(plat_dat->mac_interface), clk_rate);
++	return -EINVAL;
++}
++
+ static int stm32mp1_set_mode(struct plat_stmmacenet_data *plat_dat)
+ {
+ 	struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
+-	u32 reg = dwmac->mode_reg, clk_rate;
+-	int val;
++	u32 reg = dwmac->mode_reg;
++	int val, ret;
+ 
+-	clk_rate = clk_get_rate(dwmac->clk_eth_ck);
+ 	dwmac->enable_eth_ck = false;
+ 	switch (plat_dat->mac_interface) {
+ 	case PHY_INTERFACE_MODE_MII:
+-		if (clk_rate == ETH_CK_F_25M && dwmac->ext_phyclk)
++		if (dwmac->ext_phyclk)
+ 			dwmac->enable_eth_ck = true;
+ 		val = SYSCFG_PMCR_ETH_SEL_MII;
+ 		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_MII\n");
+ 		break;
+ 	case PHY_INTERFACE_MODE_GMII:
+ 		val = SYSCFG_PMCR_ETH_SEL_GMII;
+-		if (clk_rate == ETH_CK_F_25M &&
+-		    (dwmac->eth_clk_sel_reg || dwmac->ext_phyclk)) {
++		if (dwmac->eth_clk_sel_reg || dwmac->ext_phyclk) {
+ 			dwmac->enable_eth_ck = true;
+ 			val |= SYSCFG_PMCR_ETH_CLK_SEL;
+ 		}
+@@ -183,8 +212,7 @@ static int stm32mp1_set_mode(struct plat
+ 		break;
+ 	case PHY_INTERFACE_MODE_RMII:
+ 		val = SYSCFG_PMCR_ETH_SEL_RMII;
+-		if ((clk_rate == ETH_CK_F_25M || clk_rate == ETH_CK_F_50M) &&
+-		    (dwmac->eth_ref_clk_sel_reg || dwmac->ext_phyclk)) {
++		if (dwmac->eth_ref_clk_sel_reg || dwmac->ext_phyclk) {
+ 			dwmac->enable_eth_ck = true;
+ 			val |= SYSCFG_PMCR_ETH_REF_CLK_SEL;
+ 		}
+@@ -195,8 +223,7 @@ static int stm32mp1_set_mode(struct plat
+ 	case PHY_INTERFACE_MODE_RGMII_RXID:
+ 	case PHY_INTERFACE_MODE_RGMII_TXID:
+ 		val = SYSCFG_PMCR_ETH_SEL_RGMII;
+-		if ((clk_rate == ETH_CK_F_25M || clk_rate == ETH_CK_F_125M) &&
+-		    (dwmac->eth_clk_sel_reg || dwmac->ext_phyclk)) {
++		if (dwmac->eth_clk_sel_reg || dwmac->ext_phyclk) {
+ 			dwmac->enable_eth_ck = true;
+ 			val |= SYSCFG_PMCR_ETH_CLK_SEL;
+ 		}
+@@ -209,6 +236,10 @@ static int stm32mp1_set_mode(struct plat
+ 		return -EINVAL;
+ 	}
+ 
++	ret = stm32mp1_validate_ethck_rate(plat_dat);
++	if (ret)
++		return ret;
++
+ 	/* Need to update PMCCLRR (clear register) */
+ 	regmap_write(dwmac->regmap, reg + SYSCFG_PMCCLRR_OFFSET,
+ 		     dwmac->ops->syscfg_eth_mask);
diff --git a/target/linux/stm32/patches-6.6/004-net-stmmac-dwmac-stm32-Separate-out-external-clock-s.patch b/target/linux/stm32/patches-6.6/004-net-stmmac-dwmac-stm32-Separate-out-external-clock-s.patch
new file mode 100644
index 00000000000000..2e8f76158d41a4
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/004-net-stmmac-dwmac-stm32-Separate-out-external-clock-s.patch
@@ -0,0 +1,132 @@
+From d23ba64e733580db2809e6f6dbf6f093fbd1b91b Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Tue, 11 Jun 2024 10:36:01 +0200
+Subject: [PATCH 4/8] net: stmmac: dwmac-stm32: Separate out external clock
+ selector
+
+Pull the external clock selector into a separate function, to avoid
+conflating it with external clock rate validation and clock mux
+register configuration. This should make the code easier to read and
+understand.
+
+The dwmac->enable_eth_ck variable in the end indicates whether the MAC
+clock are supplied by external oscillator (true) or internal RCC clock
+IP (false). The dwmac->enable_eth_ck value is set based on multiple DT
+properties, some of them deprecated, some of them specific to bus mode.
+
+The following DT properties and variables are taken into account. In
+each case, if the property is present or true, MAC clock is supplied
+by external oscillator.
+- "st,ext-phyclk", assigned to variable dwmac->ext_phyclk
+  - Used in any mode (MII/RMII/GMII/RGMII)
+  - The only non-deprecated DT property of the three
+- "st,eth-clk-sel", assigned to variable dwmac->eth_clk_sel_reg
+  - Valid only in GMII/RGMII mode
+  - Deprecated property, backward compatibility only
+- "st,eth-ref-clk-sel", assigned to variable dwmac->eth_ref_clk_sel_reg
+  - Valid only in RMII mode
+  - Deprecated property, backward compatibility only
+
+The stm32mp1_select_ethck_external() function handles the aforementioned
+DT properties and sets dwmac->enable_eth_ck accordingly.
+
+The stm32mp1_set_mode() is adjusted to call stm32mp1_select_ethck_external()
+first and then only use dwmac->enable_eth_ck to determine hardware clock mux
+settings.
+
+No functional change intended.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-stm32.c | 50 ++++++++++++++-----
+ 1 file changed, 38 insertions(+), 12 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+@@ -157,6 +157,37 @@ static int stm32_dwmac_init(struct plat_
+ 	return stm32_dwmac_clk_enable(dwmac, resume);
+ }
+ 
++static int stm32mp1_select_ethck_external(struct plat_stmmacenet_data *plat_dat)
++{
++	struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
++
++	switch (plat_dat->mac_interface) {
++	case PHY_INTERFACE_MODE_MII:
++		dwmac->enable_eth_ck = dwmac->ext_phyclk;
++		return 0;
++	case PHY_INTERFACE_MODE_GMII:
++		dwmac->enable_eth_ck = dwmac->eth_clk_sel_reg ||
++				       dwmac->ext_phyclk;
++		return 0;
++	case PHY_INTERFACE_MODE_RMII:
++		dwmac->enable_eth_ck = dwmac->eth_ref_clk_sel_reg ||
++				       dwmac->ext_phyclk;
++		return 0;
++	case PHY_INTERFACE_MODE_RGMII:
++	case PHY_INTERFACE_MODE_RGMII_ID:
++	case PHY_INTERFACE_MODE_RGMII_RXID:
++	case PHY_INTERFACE_MODE_RGMII_TXID:
++		dwmac->enable_eth_ck = dwmac->eth_clk_sel_reg ||
++				       dwmac->ext_phyclk;
++		return 0;
++	default:
++		dwmac->enable_eth_ck = false;
++		dev_err(dwmac->dev, "Mode %s not supported",
++			phy_modes(plat_dat->mac_interface));
++		return -EINVAL;
++	}
++}
++
+ static int stm32mp1_validate_ethck_rate(struct plat_stmmacenet_data *plat_dat)
+ {
+ 	struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
+@@ -194,28 +225,25 @@ static int stm32mp1_set_mode(struct plat
+ 	u32 reg = dwmac->mode_reg;
+ 	int val, ret;
+ 
+-	dwmac->enable_eth_ck = false;
++	ret = stm32mp1_select_ethck_external(plat_dat);
++	if (ret)
++		return ret;
++
+ 	switch (plat_dat->mac_interface) {
+ 	case PHY_INTERFACE_MODE_MII:
+-		if (dwmac->ext_phyclk)
+-			dwmac->enable_eth_ck = true;
+ 		val = SYSCFG_PMCR_ETH_SEL_MII;
+ 		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_MII\n");
+ 		break;
+ 	case PHY_INTERFACE_MODE_GMII:
+ 		val = SYSCFG_PMCR_ETH_SEL_GMII;
+-		if (dwmac->eth_clk_sel_reg || dwmac->ext_phyclk) {
+-			dwmac->enable_eth_ck = true;
++		if (dwmac->enable_eth_ck)
+ 			val |= SYSCFG_PMCR_ETH_CLK_SEL;
+-		}
+ 		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_GMII\n");
+ 		break;
+ 	case PHY_INTERFACE_MODE_RMII:
+ 		val = SYSCFG_PMCR_ETH_SEL_RMII;
+-		if (dwmac->eth_ref_clk_sel_reg || dwmac->ext_phyclk) {
+-			dwmac->enable_eth_ck = true;
++		if (dwmac->enable_eth_ck)
+ 			val |= SYSCFG_PMCR_ETH_REF_CLK_SEL;
+-		}
+ 		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_RMII\n");
+ 		break;
+ 	case PHY_INTERFACE_MODE_RGMII:
+@@ -223,10 +251,8 @@ static int stm32mp1_set_mode(struct plat
+ 	case PHY_INTERFACE_MODE_RGMII_RXID:
+ 	case PHY_INTERFACE_MODE_RGMII_TXID:
+ 		val = SYSCFG_PMCR_ETH_SEL_RGMII;
+-		if (dwmac->eth_clk_sel_reg || dwmac->ext_phyclk) {
+-			dwmac->enable_eth_ck = true;
++		if (dwmac->enable_eth_ck)
+ 			val |= SYSCFG_PMCR_ETH_CLK_SEL;
+-		}
+ 		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_RGMII\n");
+ 		break;
+ 	default:
diff --git a/target/linux/stm32/patches-6.6/005-net-stmmac-dwmac-stm32-Extract-PMCR-configuration.patch b/target/linux/stm32/patches-6.6/005-net-stmmac-dwmac-stm32-Extract-PMCR-configuration.patch
new file mode 100644
index 00000000000000..b28884df586ef7
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/005-net-stmmac-dwmac-stm32-Extract-PMCR-configuration.patch
@@ -0,0 +1,71 @@
+From bb7ab910631ee0ade0758a3c4aa8dadc3b6934b6 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Tue, 11 Jun 2024 10:36:02 +0200
+Subject: [PATCH 5/8] net: stmmac: dwmac-stm32: Extract PMCR configuration
+
+Pull the PMCR clock mux configuration into a separate function. This is
+the final change of three, which moves external clock rate validation,
+external clock selector decoding, and clock mux configuration into
+separate functions. This should make the code easier to understand.
+No functional change intended.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-stm32.c | 27 ++++++++++++-------
+ 1 file changed, 17 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+@@ -219,15 +219,11 @@ static int stm32mp1_validate_ethck_rate(
+ 	return -EINVAL;
+ }
+ 
+-static int stm32mp1_set_mode(struct plat_stmmacenet_data *plat_dat)
++static int stm32mp1_configure_pmcr(struct plat_stmmacenet_data *plat_dat)
+ {
+ 	struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
+ 	u32 reg = dwmac->mode_reg;
+-	int val, ret;
+-
+-	ret = stm32mp1_select_ethck_external(plat_dat);
+-	if (ret)
+-		return ret;
++	int val;
+ 
+ 	switch (plat_dat->mac_interface) {
+ 	case PHY_INTERFACE_MODE_MII:
+@@ -262,10 +258,6 @@ static int stm32mp1_set_mode(struct plat
+ 		return -EINVAL;
+ 	}
+ 
+-	ret = stm32mp1_validate_ethck_rate(plat_dat);
+-	if (ret)
+-		return ret;
+-
+ 	/* Need to update PMCCLRR (clear register) */
+ 	regmap_write(dwmac->regmap, reg + SYSCFG_PMCCLRR_OFFSET,
+ 		     dwmac->ops->syscfg_eth_mask);
+@@ -275,6 +267,21 @@ static int stm32mp1_set_mode(struct plat
+ 				 dwmac->ops->syscfg_eth_mask, val);
+ }
+ 
++static int stm32mp1_set_mode(struct plat_stmmacenet_data *plat_dat)
++{
++	int ret;
++
++	ret = stm32mp1_select_ethck_external(plat_dat);
++	if (ret)
++		return ret;
++
++	ret = stm32mp1_validate_ethck_rate(plat_dat);
++	if (ret)
++		return ret;
++
++	return stm32mp1_configure_pmcr(plat_dat);
++}
++
+ static int stm32mcu_set_mode(struct plat_stmmacenet_data *plat_dat)
+ {
+ 	struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
diff --git a/target/linux/stm32/patches-6.6/006-net-stmmac-dwmac-stm32-Clean-up-the-debug-prints.patch b/target/linux/stm32/patches-6.6/006-net-stmmac-dwmac-stm32-Clean-up-the-debug-prints.patch
new file mode 100644
index 00000000000000..45050ae0775ed6
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/006-net-stmmac-dwmac-stm32-Clean-up-the-debug-prints.patch
@@ -0,0 +1,83 @@
+From 0476213f50452446fedd1a918b7bc72eb39a4c46 Mon Sep 17 00:00:00 2001
+From: Marek Vasut <marex@denx.de>
+Date: Tue, 11 Jun 2024 10:36:03 +0200
+Subject: [PATCH 6/8] net: stmmac: dwmac-stm32: Clean up the debug prints
+
+Use dev_err()/dev_dbg() and phy_modes() to print PHY mode instead of
+pr_debug() and hand-written PHY mode decoding. This way, each debug
+print has associated device with it and duplicated mode decoding is
+removed.
+
+Signed-off-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-stm32.c  | 18 ++++++++----------
+ 1 file changed, 8 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+@@ -228,19 +228,16 @@ static int stm32mp1_configure_pmcr(struc
+ 	switch (plat_dat->mac_interface) {
+ 	case PHY_INTERFACE_MODE_MII:
+ 		val = SYSCFG_PMCR_ETH_SEL_MII;
+-		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_MII\n");
+ 		break;
+ 	case PHY_INTERFACE_MODE_GMII:
+ 		val = SYSCFG_PMCR_ETH_SEL_GMII;
+ 		if (dwmac->enable_eth_ck)
+ 			val |= SYSCFG_PMCR_ETH_CLK_SEL;
+-		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_GMII\n");
+ 		break;
+ 	case PHY_INTERFACE_MODE_RMII:
+ 		val = SYSCFG_PMCR_ETH_SEL_RMII;
+ 		if (dwmac->enable_eth_ck)
+ 			val |= SYSCFG_PMCR_ETH_REF_CLK_SEL;
+-		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_RMII\n");
+ 		break;
+ 	case PHY_INTERFACE_MODE_RGMII:
+ 	case PHY_INTERFACE_MODE_RGMII_ID:
+@@ -249,15 +246,16 @@ static int stm32mp1_configure_pmcr(struc
+ 		val = SYSCFG_PMCR_ETH_SEL_RGMII;
+ 		if (dwmac->enable_eth_ck)
+ 			val |= SYSCFG_PMCR_ETH_CLK_SEL;
+-		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_RGMII\n");
+ 		break;
+ 	default:
+-		pr_debug("SYSCFG init :  Do not manage %d interface\n",
+-			 plat_dat->mac_interface);
++		dev_err(dwmac->dev, "Mode %s not supported",
++			phy_modes(plat_dat->mac_interface));
+ 		/* Do not manage others interfaces */
+ 		return -EINVAL;
+ 	}
+ 
++	dev_dbg(dwmac->dev, "Mode %s", phy_modes(plat_dat->mac_interface));
++
+ 	/* Need to update PMCCLRR (clear register) */
+ 	regmap_write(dwmac->regmap, reg + SYSCFG_PMCCLRR_OFFSET,
+ 		     dwmac->ops->syscfg_eth_mask);
+@@ -291,19 +289,19 @@ static int stm32mcu_set_mode(struct plat
+ 	switch (plat_dat->mac_interface) {
+ 	case PHY_INTERFACE_MODE_MII:
+ 		val = SYSCFG_MCU_ETH_SEL_MII;
+-		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_MII\n");
+ 		break;
+ 	case PHY_INTERFACE_MODE_RMII:
+ 		val = SYSCFG_MCU_ETH_SEL_RMII;
+-		pr_debug("SYSCFG init : PHY_INTERFACE_MODE_RMII\n");
+ 		break;
+ 	default:
+-		pr_debug("SYSCFG init :  Do not manage %d interface\n",
+-			 plat_dat->mac_interface);
++		dev_err(dwmac->dev, "Mode %s not supported",
++			phy_modes(plat_dat->mac_interface));
+ 		/* Do not manage others interfaces */
+ 		return -EINVAL;
+ 	}
+ 
++	dev_dbg(dwmac->dev, "Mode %s", phy_modes(plat_dat->mac_interface));
++
+ 	return regmap_update_bits(dwmac->regmap, reg,
+ 				 dwmac->ops->syscfg_eth_mask, val << 23);
+ }
diff --git a/target/linux/stm32/patches-6.6/007-net-stmmac-dwmac-stm32-Mask-support-for-PMCR-configu.patch b/target/linux/stm32/patches-6.6/007-net-stmmac-dwmac-stm32-Mask-support-for-PMCR-configu.patch
new file mode 100644
index 00000000000000..336378abb34380
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/007-net-stmmac-dwmac-stm32-Mask-support-for-PMCR-configu.patch
@@ -0,0 +1,101 @@
+From 796669a85c5c4fa80cb8790e9adcccbbd99750e8 Mon Sep 17 00:00:00 2001
+From: Christophe Roullier <christophe.roullier@foss.st.com>
+Date: Tue, 11 Jun 2024 10:36:05 +0200
+Subject: [PATCH 7/8] net: stmmac: dwmac-stm32: Mask support for PMCR
+ configuration
+
+Add possibility to have second argument in syscon property to manage
+mask. This mask will be used to address right BITFIELDS of PMCR register.
+
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Reviewed-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-stm32.c | 28 +++++++++++++------
+ 1 file changed, 19 insertions(+), 9 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+@@ -90,6 +90,7 @@ struct stm32_dwmac {
+ 	int eth_ref_clk_sel_reg;
+ 	int irq_pwr_wakeup;
+ 	u32 mode_reg;		 /* MAC glue-logic mode register */
++	u32 mode_mask;
+ 	struct regmap *regmap;
+ 	u32 speed;
+ 	const struct stm32_ops *ops;
+@@ -102,8 +103,8 @@ struct stm32_ops {
+ 	void (*resume)(struct stm32_dwmac *dwmac);
+ 	int (*parse_data)(struct stm32_dwmac *dwmac,
+ 			  struct device *dev);
+-	u32 syscfg_eth_mask;
+ 	bool clk_rx_enable_in_suspend;
++	u32 syscfg_clr_off;
+ };
+ 
+ static int stm32_dwmac_clk_enable(struct stm32_dwmac *dwmac, bool resume)
+@@ -256,13 +257,16 @@ static int stm32mp1_configure_pmcr(struc
+ 
+ 	dev_dbg(dwmac->dev, "Mode %s", phy_modes(plat_dat->mac_interface));
+ 
++	/* Shift value at correct ethernet MAC offset in SYSCFG_PMCSETR */
++	val <<= ffs(dwmac->mode_mask) - ffs(SYSCFG_MP1_ETH_MASK);
++
+ 	/* Need to update PMCCLRR (clear register) */
+-	regmap_write(dwmac->regmap, reg + SYSCFG_PMCCLRR_OFFSET,
+-		     dwmac->ops->syscfg_eth_mask);
++	regmap_write(dwmac->regmap, dwmac->ops->syscfg_clr_off,
++		     dwmac->mode_mask);
+ 
+ 	/* Update PMCSETR (set register) */
+ 	return regmap_update_bits(dwmac->regmap, reg,
+-				 dwmac->ops->syscfg_eth_mask, val);
++				 dwmac->mode_mask, val);
+ }
+ 
+ static int stm32mp1_set_mode(struct plat_stmmacenet_data *plat_dat)
+@@ -303,7 +307,7 @@ static int stm32mcu_set_mode(struct plat
+ 	dev_dbg(dwmac->dev, "Mode %s", phy_modes(plat_dat->mac_interface));
+ 
+ 	return regmap_update_bits(dwmac->regmap, reg,
+-				 dwmac->ops->syscfg_eth_mask, val << 23);
++				 SYSCFG_MCU_ETH_MASK, val << 23);
+ }
+ 
+ static void stm32_dwmac_clk_disable(struct stm32_dwmac *dwmac, bool suspend)
+@@ -348,8 +352,15 @@ static int stm32_dwmac_parse_data(struct
+ 		return PTR_ERR(dwmac->regmap);
+ 
+ 	err = of_property_read_u32_index(np, "st,syscon", 1, &dwmac->mode_reg);
+-	if (err)
++	if (err) {
+ 		dev_err(dev, "Can't get sysconfig mode offset (%d)\n", err);
++		return err;
++	}
++
++	dwmac->mode_mask = SYSCFG_MP1_ETH_MASK;
++	err = of_property_read_u32_index(np, "st,syscon", 2, &dwmac->mode_mask);
++	if (err)
++		dev_dbg(dev, "Warning sysconfig register mask not set\n");
+ 
+ 	return err;
+ }
+@@ -540,8 +551,7 @@ static SIMPLE_DEV_PM_OPS(stm32_dwmac_pm_
+ 	stm32_dwmac_suspend, stm32_dwmac_resume);
+ 
+ static struct stm32_ops stm32mcu_dwmac_data = {
+-	.set_mode = stm32mcu_set_mode,
+-	.syscfg_eth_mask = SYSCFG_MCU_ETH_MASK
++	.set_mode = stm32mcu_set_mode
+ };
+ 
+ static struct stm32_ops stm32mp1_dwmac_data = {
+@@ -549,7 +559,7 @@ static struct stm32_ops stm32mp1_dwmac_d
+ 	.suspend = stm32mp1_suspend,
+ 	.resume = stm32mp1_resume,
+ 	.parse_data = stm32mp1_parse_data,
+-	.syscfg_eth_mask = SYSCFG_MP1_ETH_MASK,
++	.syscfg_clr_off = 0x44,
+ 	.clk_rx_enable_in_suspend = true
+ };
+ 
diff --git a/target/linux/stm32/patches-6.6/008-net-stmmac-dwmac-stm32-add-management-of-stm32mp13-f.patch b/target/linux/stm32/patches-6.6/008-net-stmmac-dwmac-stm32-add-management-of-stm32mp13-f.patch
new file mode 100644
index 00000000000000..c2526019e2c7a9
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/008-net-stmmac-dwmac-stm32-add-management-of-stm32mp13-f.patch
@@ -0,0 +1,94 @@
+From 8d28aaf5d5dbfd1f452286fa6ac571df0bcf00ad Mon Sep 17 00:00:00 2001
+From: Christophe Roullier <christophe.roullier@foss.st.com>
+Date: Tue, 11 Jun 2024 10:36:06 +0200
+Subject: [PATCH 8/8] net: stmmac: dwmac-stm32: add management of stm32mp13 for
+ stm32
+
+Add Ethernet support for STM32MP13.
+STM32MP13 is STM32 SOC with 2 GMACs instances.
+GMAC IP version is SNPS 4.20.
+GMAC IP configure with 1 RX and 1 TX queue.
+DMA HW capability register supported
+RX Checksum Offload Engine supported
+TX Checksum insertion supported
+Wake-Up On Lan supported
+TSO supported
+
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Reviewed-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-stm32.c | 32 ++++++++++++++++---
+ 1 file changed, 28 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+@@ -104,6 +104,7 @@ struct stm32_ops {
+ 	int (*parse_data)(struct stm32_dwmac *dwmac,
+ 			  struct device *dev);
+ 	bool clk_rx_enable_in_suspend;
++	bool is_mp13;
+ 	u32 syscfg_clr_off;
+ };
+ 
+@@ -224,11 +225,18 @@ static int stm32mp1_configure_pmcr(struc
+ {
+ 	struct stm32_dwmac *dwmac = plat_dat->bsp_priv;
+ 	u32 reg = dwmac->mode_reg;
+-	int val;
++	int val = 0;
+ 
+ 	switch (plat_dat->mac_interface) {
+ 	case PHY_INTERFACE_MODE_MII:
+-		val = SYSCFG_PMCR_ETH_SEL_MII;
++		/*
++		 * STM32MP15xx supports both MII and GMII, STM32MP13xx MII only.
++		 * SYSCFG_PMCSETR ETH_SELMII is present only on STM32MP15xx and
++		 * acts as a selector between 0:GMII and 1:MII. As STM32MP13xx
++		 * supports only MII, ETH_SELMII is not present.
++		 */
++		if (!dwmac->ops->is_mp13)  /* Select MII mode on STM32MP15xx */
++			val |= SYSCFG_PMCR_ETH_SEL_MII;
+ 		break;
+ 	case PHY_INTERFACE_MODE_GMII:
+ 		val = SYSCFG_PMCR_ETH_SEL_GMII;
+@@ -359,8 +367,12 @@ static int stm32_dwmac_parse_data(struct
+ 
+ 	dwmac->mode_mask = SYSCFG_MP1_ETH_MASK;
+ 	err = of_property_read_u32_index(np, "st,syscon", 2, &dwmac->mode_mask);
+-	if (err)
+-		dev_dbg(dev, "Warning sysconfig register mask not set\n");
++	if (err) {
++		if (dwmac->ops->is_mp13)
++			dev_err(dev, "Sysconfig register mask must be set (%d)\n", err);
++		else
++			dev_dbg(dev, "Warning sysconfig register mask not set\n");
++	}
+ 
+ 	return err;
+ }
+@@ -560,12 +572,24 @@ static struct stm32_ops stm32mp1_dwmac_d
+ 	.resume = stm32mp1_resume,
+ 	.parse_data = stm32mp1_parse_data,
+ 	.syscfg_clr_off = 0x44,
++	.is_mp13 = false,
++	.clk_rx_enable_in_suspend = true
++};
++
++static struct stm32_ops stm32mp13_dwmac_data = {
++	.set_mode = stm32mp1_set_mode,
++	.suspend = stm32mp1_suspend,
++	.resume = stm32mp1_resume,
++	.parse_data = stm32mp1_parse_data,
++	.syscfg_clr_off = 0x08,
++	.is_mp13 = true,
+ 	.clk_rx_enable_in_suspend = true
+ };
+ 
+ static const struct of_device_id stm32_dwmac_match[] = {
+ 	{ .compatible = "st,stm32-dwmac", .data = &stm32mcu_dwmac_data},
+ 	{ .compatible = "st,stm32mp1-dwmac", .data = &stm32mp1_dwmac_data},
++	{ .compatible = "st,stm32mp13-dwmac", .data = &stm32mp13_dwmac_data},
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(of, stm32_dwmac_match);
diff --git a/target/linux/stm32/patches-6.6/009-ARM-dts-stm32-add-ETZPC-as-a-system-bus-for-STM32MP1.patch b/target/linux/stm32/patches-6.6/009-ARM-dts-stm32-add-ETZPC-as-a-system-bus-for-STM32MP1.patch
new file mode 100644
index 00000000000000..f00001bc473daa
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/009-ARM-dts-stm32-add-ETZPC-as-a-system-bus-for-STM32MP1.patch
@@ -0,0 +1,1192 @@
+From d788961c5b25d9d822c4230bfbc536a6736b91ff Mon Sep 17 00:00:00 2001
+From: Gatien Chevallier <gatien.chevallier@foss.st.com>
+Date: Fri, 5 Jan 2024 14:04:03 +0100
+Subject: [PATCH 1/5] ARM: dts: stm32: add ETZPC as a system bus for STM32MP13x
+ boards
+
+ETZPC is a firewall controller. Put all peripherals filtered by the
+ETZPC as ETZPC subnodes and keep the "simple-bus" compatible for
+backward compatibility.
+
+Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+---
+ arch/arm/boot/dts/st/stm32mp131.dtsi  | 1020 +++++++++++++------------
+ arch/arm/boot/dts/st/stm32mp133.dtsi  |   50 +-
+ arch/arm/boot/dts/st/stm32mp13xc.dtsi |   18 +-
+ arch/arm/boot/dts/st/stm32mp13xf.dtsi |   18 +-
+ 4 files changed, 569 insertions(+), 537 deletions(-)
+
+--- a/arch/arm/boot/dts/st/stm32mp131.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp131.dtsi
+@@ -745,340 +745,6 @@
+ 			dma-channels = <16>;
+ 		};
+ 
+-		adc_2: adc@48004000 {
+-			compatible = "st,stm32mp13-adc-core";
+-			reg = <0x48004000 0x400>;
+-			interrupts = <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc ADC2>, <&rcc ADC2_K>;
+-			clock-names = "bus", "adc";
+-			interrupt-controller;
+-			#interrupt-cells = <1>;
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			status = "disabled";
+-
+-			adc2: adc@0 {
+-				compatible = "st,stm32mp13-adc";
+-				#io-channel-cells = <1>;
+-				#address-cells = <1>;
+-				#size-cells = <0>;
+-				reg = <0x0>;
+-				interrupt-parent = <&adc_2>;
+-				interrupts = <0>;
+-				dmas = <&dmamux1 10 0x400 0x80000001>;
+-				dma-names = "rx";
+-				status = "disabled";
+-
+-				channel@13 {
+-					reg = <13>;
+-					label = "vrefint";
+-				};
+-				channel@14 {
+-					reg = <14>;
+-					label = "vddcore";
+-				};
+-				channel@16 {
+-					reg = <16>;
+-					label = "vddcpu";
+-				};
+-				channel@17 {
+-					reg = <17>;
+-					label = "vddq_ddr";
+-				};
+-			};
+-		};
+-
+-		usbotg_hs: usb@49000000 {
+-			compatible = "st,stm32mp15-hsotg", "snps,dwc2";
+-			reg = <0x49000000 0x40000>;
+-			clocks = <&rcc USBO_K>;
+-			clock-names = "otg";
+-			resets = <&rcc USBO_R>;
+-			reset-names = "dwc2";
+-			interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>;
+-			g-rx-fifo-size = <512>;
+-			g-np-tx-fifo-size = <32>;
+-			g-tx-fifo-size = <256 16 16 16 16 16 16 16>;
+-			dr_mode = "otg";
+-			otg-rev = <0x200>;
+-			usb33d-supply = <&scmi_usb33>;
+-			status = "disabled";
+-		};
+-
+-		usart1: serial@4c000000 {
+-			compatible = "st,stm32h7-uart";
+-			reg = <0x4c000000 0x400>;
+-			interrupts-extended = <&exti 26 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc USART1_K>;
+-			resets = <&rcc USART1_R>;
+-			wakeup-source;
+-			dmas = <&dmamux1 41 0x400 0x5>,
+-			       <&dmamux1 42 0x400 0x1>;
+-			dma-names = "rx", "tx";
+-			status = "disabled";
+-		};
+-
+-		usart2: serial@4c001000 {
+-			compatible = "st,stm32h7-uart";
+-			reg = <0x4c001000 0x400>;
+-			interrupts-extended = <&exti 27 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc USART2_K>;
+-			resets = <&rcc USART2_R>;
+-			wakeup-source;
+-			dmas = <&dmamux1 43 0x400 0x5>,
+-			       <&dmamux1 44 0x400 0x1>;
+-			dma-names = "rx", "tx";
+-			status = "disabled";
+-		};
+-
+-		i2s4: audio-controller@4c002000 {
+-			compatible = "st,stm32h7-i2s";
+-			reg = <0x4c002000 0x400>;
+-			#sound-dai-cells = <0>;
+-			interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
+-			dmas = <&dmamux1 83 0x400 0x01>,
+-			       <&dmamux1 84 0x400 0x01>;
+-			dma-names = "rx", "tx";
+-			status = "disabled";
+-		};
+-
+-		spi4: spi@4c002000 {
+-			compatible = "st,stm32h7-spi";
+-			reg = <0x4c002000 0x400>;
+-			interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc SPI4_K>;
+-			resets = <&rcc SPI4_R>;
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			dmas = <&dmamux1 83 0x400 0x01>,
+-			       <&dmamux1 84 0x400 0x01>;
+-			dma-names = "rx", "tx";
+-			status = "disabled";
+-		};
+-
+-		spi5: spi@4c003000 {
+-			compatible = "st,stm32h7-spi";
+-			reg = <0x4c003000 0x400>;
+-			interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc SPI5_K>;
+-			resets = <&rcc SPI5_R>;
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			dmas = <&dmamux1 85 0x400 0x01>,
+-			       <&dmamux1 86 0x400 0x01>;
+-			dma-names = "rx", "tx";
+-			status = "disabled";
+-		};
+-
+-		i2c3: i2c@4c004000 {
+-			compatible = "st,stm32mp13-i2c";
+-			reg = <0x4c004000 0x400>;
+-			interrupt-names = "event", "error";
+-			interrupts = <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 74 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc I2C3_K>;
+-			resets = <&rcc I2C3_R>;
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			dmas = <&dmamux1 73 0x400 0x1>,
+-			       <&dmamux1 74 0x400 0x1>;
+-			dma-names = "rx", "tx";
+-			st,syscfg-fmp = <&syscfg 0x4 0x4>;
+-			i2c-analog-filter;
+-			status = "disabled";
+-		};
+-
+-		i2c4: i2c@4c005000 {
+-			compatible = "st,stm32mp13-i2c";
+-			reg = <0x4c005000 0x400>;
+-			interrupt-names = "event", "error";
+-			interrupts = <GIC_SPI 93 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 94 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc I2C4_K>;
+-			resets = <&rcc I2C4_R>;
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			dmas = <&dmamux1 75 0x400 0x1>,
+-			       <&dmamux1 76 0x400 0x1>;
+-			dma-names = "rx", "tx";
+-			st,syscfg-fmp = <&syscfg 0x4 0x8>;
+-			i2c-analog-filter;
+-			status = "disabled";
+-		};
+-
+-		i2c5: i2c@4c006000 {
+-			compatible = "st,stm32mp13-i2c";
+-			reg = <0x4c006000 0x400>;
+-			interrupt-names = "event", "error";
+-			interrupts = <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>,
+-				     <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc I2C5_K>;
+-			resets = <&rcc I2C5_R>;
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			dmas = <&dmamux1 115 0x400 0x1>,
+-			       <&dmamux1 116 0x400 0x1>;
+-			dma-names = "rx", "tx";
+-			st,syscfg-fmp = <&syscfg 0x4 0x10>;
+-			i2c-analog-filter;
+-			status = "disabled";
+-		};
+-
+-		timers12: timer@4c007000 {
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			compatible = "st,stm32-timers";
+-			reg = <0x4c007000 0x400>;
+-			interrupts = <GIC_SPI 104 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "global";
+-			clocks = <&rcc TIM12_K>;
+-			clock-names = "int";
+-			status = "disabled";
+-
+-			pwm {
+-				compatible = "st,stm32-pwm";
+-				#pwm-cells = <3>;
+-				status = "disabled";
+-			};
+-
+-			timer@11 {
+-				compatible = "st,stm32h7-timer-trigger";
+-				reg = <11>;
+-				status = "disabled";
+-			};
+-		};
+-
+-		timers13: timer@4c008000 {
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			compatible = "st,stm32-timers";
+-			reg = <0x4c008000 0x400>;
+-			interrupts = <GIC_SPI 111 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "global";
+-			clocks = <&rcc TIM13_K>;
+-			clock-names = "int";
+-			status = "disabled";
+-
+-			pwm {
+-				compatible = "st,stm32-pwm";
+-				#pwm-cells = <3>;
+-				status = "disabled";
+-			};
+-
+-			timer@12 {
+-				compatible = "st,stm32h7-timer-trigger";
+-				reg = <12>;
+-				status = "disabled";
+-			};
+-		};
+-
+-		timers14: timer@4c009000 {
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			compatible = "st,stm32-timers";
+-			reg = <0x4c009000 0x400>;
+-			interrupts = <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "global";
+-			clocks = <&rcc TIM14_K>;
+-			clock-names = "int";
+-			status = "disabled";
+-
+-			pwm {
+-				compatible = "st,stm32-pwm";
+-				#pwm-cells = <3>;
+-				status = "disabled";
+-			};
+-
+-			timer@13 {
+-				compatible = "st,stm32h7-timer-trigger";
+-				reg = <13>;
+-				status = "disabled";
+-			};
+-		};
+-
+-		timers15: timer@4c00a000 {
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			compatible = "st,stm32-timers";
+-			reg = <0x4c00a000 0x400>;
+-			interrupts = <GIC_SPI 101 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "global";
+-			clocks = <&rcc TIM15_K>;
+-			clock-names = "int";
+-			dmas = <&dmamux1 105 0x400 0x1>,
+-			       <&dmamux1 106 0x400 0x1>,
+-			       <&dmamux1 107 0x400 0x1>,
+-			       <&dmamux1 108 0x400 0x1>;
+-			dma-names = "ch1", "up", "trig", "com";
+-			status = "disabled";
+-
+-			pwm {
+-				compatible = "st,stm32-pwm";
+-				#pwm-cells = <3>;
+-				status = "disabled";
+-			};
+-
+-			timer@14 {
+-				compatible = "st,stm32h7-timer-trigger";
+-				reg = <14>;
+-				status = "disabled";
+-			};
+-		};
+-
+-		timers16: timer@4c00b000 {
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			compatible = "st,stm32-timers";
+-			reg = <0x4c00b000 0x400>;
+-			interrupts = <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "global";
+-			clocks = <&rcc TIM16_K>;
+-			clock-names = "int";
+-			dmas = <&dmamux1 109 0x400 0x1>,
+-			       <&dmamux1 110 0x400 0x1>;
+-			dma-names = "ch1", "up";
+-			status = "disabled";
+-
+-			pwm {
+-				compatible = "st,stm32-pwm";
+-				#pwm-cells = <3>;
+-				status = "disabled";
+-			};
+-
+-			timer@15 {
+-				compatible = "st,stm32h7-timer-trigger";
+-				reg = <15>;
+-				status = "disabled";
+-			};
+-		};
+-
+-		timers17: timer@4c00c000 {
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			compatible = "st,stm32-timers";
+-			reg = <0x4c00c000 0x400>;
+-			interrupts = <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>;
+-			interrupt-names = "global";
+-			clocks = <&rcc TIM17_K>;
+-			clock-names = "int";
+-			dmas = <&dmamux1 111 0x400 0x1>,
+-			       <&dmamux1 112 0x400 0x1>;
+-			dma-names = "ch1", "up";
+-			status = "disabled";
+-
+-			pwm {
+-				compatible = "st,stm32-pwm";
+-				#pwm-cells = <3>;
+-				status = "disabled";
+-			};
+-
+-			timer@16 {
+-				compatible = "st,stm32h7-timer-trigger";
+-				reg = <16>;
+-				status = "disabled";
+-			};
+-		};
+-
+ 		rcc: rcc@50000000 {
+ 			compatible = "st,stm32mp13-rcc", "syscon";
+ 			reg = <0x50000000 0x1000>;
+@@ -1105,69 +771,6 @@
+ 			clocks = <&rcc SYSCFG>;
+ 		};
+ 
+-		lptimer2: timer@50021000 {
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			compatible = "st,stm32-lptimer";
+-			reg = <0x50021000 0x400>;
+-			interrupts-extended = <&exti 48 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc LPTIM2_K>;
+-			clock-names = "mux";
+-			wakeup-source;
+-			status = "disabled";
+-
+-			pwm {
+-				compatible = "st,stm32-pwm-lp";
+-				#pwm-cells = <3>;
+-				status = "disabled";
+-			};
+-
+-			trigger@1 {
+-				compatible = "st,stm32-lptimer-trigger";
+-				reg = <1>;
+-				status = "disabled";
+-			};
+-
+-			counter {
+-				compatible = "st,stm32-lptimer-counter";
+-				status = "disabled";
+-			};
+-
+-			timer {
+-				compatible = "st,stm32-lptimer-timer";
+-				status = "disabled";
+-			};
+-		};
+-
+-		lptimer3: timer@50022000 {
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			compatible = "st,stm32-lptimer";
+-			reg = <0x50022000 0x400>;
+-			interrupts-extended = <&exti 50 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc LPTIM3_K>;
+-			clock-names = "mux";
+-			wakeup-source;
+-			status = "disabled";
+-
+-			pwm {
+-				compatible = "st,stm32-pwm-lp";
+-				#pwm-cells = <3>;
+-				status = "disabled";
+-			};
+-
+-			trigger@2 {
+-				compatible = "st,stm32-lptimer-trigger";
+-				reg = <2>;
+-				status = "disabled";
+-			};
+-
+-			timer {
+-				compatible = "st,stm32-lptimer-timer";
+-				status = "disabled";
+-			};
+-		};
+-
+ 		lptimer4: timer@50023000 {
+ 			compatible = "st,stm32-lptimer";
+ 			reg = <0x50023000 0x400>;
+@@ -1220,79 +823,10 @@
+ 			dma-requests = <48>;
+ 		};
+ 
+-		fmc: memory-controller@58002000 {
+-			compatible = "st,stm32mp1-fmc2-ebi";
+-			reg = <0x58002000 0x1000>;
+-			ranges = <0 0 0x60000000 0x04000000>, /* EBI CS 1 */
+-				 <1 0 0x64000000 0x04000000>, /* EBI CS 2 */
+-				 <2 0 0x68000000 0x04000000>, /* EBI CS 3 */
+-				 <3 0 0x6c000000 0x04000000>, /* EBI CS 4 */
+-				 <4 0 0x80000000 0x10000000>; /* NAND */
+-			#address-cells = <2>;
+-			#size-cells = <1>;
+-			clocks = <&rcc FMC_K>;
+-			resets = <&rcc FMC_R>;
+-			status = "disabled";
+-
+-			nand-controller@4,0 {
+-				compatible = "st,stm32mp1-fmc2-nfc";
+-				reg = <4 0x00000000 0x1000>,
+-				      <4 0x08010000 0x1000>,
+-				      <4 0x08020000 0x1000>,
+-				      <4 0x01000000 0x1000>,
+-				      <4 0x09010000 0x1000>,
+-				      <4 0x09020000 0x1000>;
+-				#address-cells = <1>;
+-				#size-cells = <0>;
+-				interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>;
+-				dmas = <&mdma 24 0x2 0x12000a02 0x0 0x0>,
+-				       <&mdma 24 0x2 0x12000a08 0x0 0x0>,
+-				       <&mdma 25 0x2 0x12000a0a 0x0 0x0>;
+-				dma-names = "tx", "rx", "ecc";
+-				status = "disabled";
+-			};
+-		};
+-
+-		qspi: spi@58003000 {
+-			compatible = "st,stm32f469-qspi";
+-			reg = <0x58003000 0x1000>, <0x70000000 0x10000000>;
+-			reg-names = "qspi", "qspi_mm";
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			interrupts = <GIC_SPI 91 IRQ_TYPE_LEVEL_HIGH>;
+-			dmas = <&mdma 26 0x2 0x10100002 0x0 0x0>,
+-			       <&mdma 26 0x2 0x10100008 0x0 0x0>;
+-			dma-names = "tx", "rx";
+-			clocks = <&rcc QSPI_K>;
+-			resets = <&rcc QSPI_R>;
+-			status = "disabled";
+-		};
+-
+-		sdmmc1: mmc@58005000 {
+-			compatible = "st,stm32-sdmmc2", "arm,pl18x", "arm,primecell";
+-			arm,primecell-periphid = <0x20253180>;
+-			reg = <0x58005000 0x1000>, <0x58006000 0x1000>;
+-			interrupts = <GIC_SPI 50 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc SDMMC1_K>;
+-			clock-names = "apb_pclk";
+-			resets = <&rcc SDMMC1_R>;
+-			cap-sd-highspeed;
+-			cap-mmc-highspeed;
+-			max-frequency = <130000000>;
+-			status = "disabled";
+-		};
+-
+-		sdmmc2: mmc@58007000 {
+-			compatible = "st,stm32-sdmmc2", "arm,pl18x", "arm,primecell";
+-			arm,primecell-periphid = <0x20253180>;
+-			reg = <0x58007000 0x1000>, <0x58008000 0x1000>;
+-			interrupts = <GIC_SPI 108 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc SDMMC2_K>;
+-			clock-names = "apb_pclk";
+-			resets = <&rcc SDMMC2_R>;
+-			cap-sd-highspeed;
+-			cap-mmc-highspeed;
+-			max-frequency = <130000000>;
++		crc1: crc@58009000 {
++			compatible = "st,stm32f7-crc";
++			reg = <0x58009000 0x400>;
++			clocks = <&rcc CRC1>;
+ 			status = "disabled";
+ 		};
+ 
+@@ -1323,29 +857,6 @@
+ 			status = "disabled";
+ 		};
+ 
+-		usbphyc: usbphyc@5a006000 {
+-			#address-cells = <1>;
+-			#size-cells = <0>;
+-			#clock-cells = <0>;
+-			compatible = "st,stm32mp1-usbphyc";
+-			reg = <0x5a006000 0x1000>;
+-			clocks = <&rcc USBPHY_K>;
+-			resets = <&rcc USBPHY_R>;
+-			vdda1v1-supply = <&scmi_reg11>;
+-			vdda1v8-supply = <&scmi_reg18>;
+-			status = "disabled";
+-
+-			usbphyc_port0: usb-phy@0 {
+-				#phy-cells = <0>;
+-				reg = <0>;
+-			};
+-
+-			usbphyc_port1: usb-phy@1 {
+-				#phy-cells = <1>;
+-				reg = <1>;
+-			};
+-		};
+-
+ 		rtc: rtc@5c004000 {
+ 			compatible = "st,stm32mp1-rtc";
+ 			reg = <0x5c004000 0x400>;
+@@ -1374,6 +885,529 @@
+ 			};
+ 		};
+ 
++		etzpc: bus@5c007000 {
++			compatible = "simple-bus";
++			reg = <0x5c007000 0x400>;
++			#address-cells = <1>;
++			#size-cells = <1>;
++			ranges;
++
++			adc_2: adc@48004000 {
++				compatible = "st,stm32mp13-adc-core";
++				reg = <0x48004000 0x400>;
++				interrupts = <GIC_SPI 19 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc ADC2>, <&rcc ADC2_K>;
++				clock-names = "bus", "adc";
++				interrupt-controller;
++				#interrupt-cells = <1>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++				status = "disabled";
++
++				adc2: adc@0 {
++					compatible = "st,stm32mp13-adc";
++					#io-channel-cells = <1>;
++					#address-cells = <1>;
++					#size-cells = <0>;
++					reg = <0x0>;
++					interrupt-parent = <&adc_2>;
++					interrupts = <0>;
++					dmas = <&dmamux1 10 0x400 0x80000001>;
++					dma-names = "rx";
++					status = "disabled";
++
++					channel@13 {
++						reg = <13>;
++						label = "vrefint";
++					};
++					channel@14 {
++						reg = <14>;
++						label = "vddcore";
++					};
++					channel@16 {
++						reg = <16>;
++						label = "vddcpu";
++					};
++					channel@17 {
++						reg = <17>;
++						label = "vddq_ddr";
++					};
++				};
++			};
++
++			usbotg_hs: usb@49000000 {
++				compatible = "st,stm32mp15-hsotg", "snps,dwc2";
++				reg = <0x49000000 0x40000>;
++				clocks = <&rcc USBO_K>;
++				clock-names = "otg";
++				resets = <&rcc USBO_R>;
++				reset-names = "dwc2";
++				interrupts = <GIC_SPI 96 IRQ_TYPE_LEVEL_HIGH>;
++				g-rx-fifo-size = <512>;
++				g-np-tx-fifo-size = <32>;
++				g-tx-fifo-size = <256 16 16 16 16 16 16 16>;
++				dr_mode = "otg";
++				otg-rev = <0x200>;
++				usb33d-supply = <&scmi_usb33>;
++				status = "disabled";
++			};
++
++			usart1: serial@4c000000 {
++				compatible = "st,stm32h7-uart";
++				reg = <0x4c000000 0x400>;
++				interrupts-extended = <&exti 26 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc USART1_K>;
++				resets = <&rcc USART1_R>;
++				wakeup-source;
++				dmas = <&dmamux1 41 0x400 0x5>,
++				<&dmamux1 42 0x400 0x1>;
++				dma-names = "rx", "tx";
++				status = "disabled";
++			};
++
++			usart2: serial@4c001000 {
++				compatible = "st,stm32h7-uart";
++				reg = <0x4c001000 0x400>;
++				interrupts-extended = <&exti 27 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc USART2_K>;
++				resets = <&rcc USART2_R>;
++				wakeup-source;
++				dmas = <&dmamux1 43 0x400 0x5>,
++				<&dmamux1 44 0x400 0x1>;
++				dma-names = "rx", "tx";
++				status = "disabled";
++			};
++
++			i2s4: audio-controller@4c002000 {
++				compatible = "st,stm32h7-i2s";
++				reg = <0x4c002000 0x400>;
++				#sound-dai-cells = <0>;
++				interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
++				dmas = <&dmamux1 83 0x400 0x01>,
++				<&dmamux1 84 0x400 0x01>;
++				dma-names = "rx", "tx";
++				status = "disabled";
++			};
++
++			spi4: spi@4c002000 {
++				compatible = "st,stm32h7-spi";
++				reg = <0x4c002000 0x400>;
++				interrupts = <GIC_SPI 85 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc SPI4_K>;
++				resets = <&rcc SPI4_R>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++				dmas = <&dmamux1 83 0x400 0x01>,
++				       <&dmamux1 84 0x400 0x01>;
++				dma-names = "rx", "tx";
++				status = "disabled";
++			};
++
++			spi5: spi@4c003000 {
++				compatible = "st,stm32h7-spi";
++				reg = <0x4c003000 0x400>;
++				interrupts = <GIC_SPI 86 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc SPI5_K>;
++				resets = <&rcc SPI5_R>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++				dmas = <&dmamux1 85 0x400 0x01>,
++				       <&dmamux1 86 0x400 0x01>;
++				dma-names = "rx", "tx";
++				status = "disabled";
++			};
++
++			i2c3: i2c@4c004000 {
++				compatible = "st,stm32mp13-i2c";
++				reg = <0x4c004000 0x400>;
++				interrupt-names = "event", "error";
++				interrupts = <GIC_SPI 73 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 74 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc I2C3_K>;
++				resets = <&rcc I2C3_R>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++				dmas = <&dmamux1 73 0x400 0x1>,
++				       <&dmamux1 74 0x400 0x1>;
++				dma-names = "rx", "tx";
++				st,syscfg-fmp = <&syscfg 0x4 0x4>;
++				i2c-analog-filter;
++				status = "disabled";
++			};
++
++			i2c4: i2c@4c005000 {
++				compatible = "st,stm32mp13-i2c";
++				reg = <0x4c005000 0x400>;
++				interrupt-names = "event", "error";
++				interrupts = <GIC_SPI 93 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 94 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc I2C4_K>;
++				resets = <&rcc I2C4_R>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++				dmas = <&dmamux1 75 0x400 0x1>,
++				       <&dmamux1 76 0x400 0x1>;
++				dma-names = "rx", "tx";
++				st,syscfg-fmp = <&syscfg 0x4 0x8>;
++				i2c-analog-filter;
++				status = "disabled";
++			};
++
++			i2c5: i2c@4c006000 {
++				compatible = "st,stm32mp13-i2c";
++				reg = <0x4c006000 0x400>;
++				interrupt-names = "event", "error";
++				interrupts = <GIC_SPI 114 IRQ_TYPE_LEVEL_HIGH>,
++					     <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc I2C5_K>;
++				resets = <&rcc I2C5_R>;
++				#address-cells = <1>;
++				#size-cells = <0>;
++				dmas = <&dmamux1 115 0x400 0x1>,
++				       <&dmamux1 116 0x400 0x1>;
++				dma-names = "rx", "tx";
++				st,syscfg-fmp = <&syscfg 0x4 0x10>;
++				i2c-analog-filter;
++				status = "disabled";
++			};
++
++			timers12: timer@4c007000 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "st,stm32-timers";
++				reg = <0x4c007000 0x400>;
++				interrupts = <GIC_SPI 104 IRQ_TYPE_LEVEL_HIGH>;
++				interrupt-names = "global";
++				clocks = <&rcc TIM12_K>;
++				clock-names = "int";
++				status = "disabled";
++
++				pwm {
++					compatible = "st,stm32-pwm";
++					#pwm-cells = <3>;
++					status = "disabled";
++				};
++
++				timer@11 {
++					compatible = "st,stm32h7-timer-trigger";
++					reg = <11>;
++					status = "disabled";
++				};
++			};
++
++			timers13: timer@4c008000 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "st,stm32-timers";
++				reg = <0x4c008000 0x400>;
++				interrupts = <GIC_SPI 111 IRQ_TYPE_LEVEL_HIGH>;
++				interrupt-names = "global";
++				clocks = <&rcc TIM13_K>;
++				clock-names = "int";
++				status = "disabled";
++
++				pwm {
++					compatible = "st,stm32-pwm";
++					#pwm-cells = <3>;
++					status = "disabled";
++				};
++
++				timer@12 {
++					compatible = "st,stm32h7-timer-trigger";
++					reg = <12>;
++					status = "disabled";
++				};
++			};
++
++			timers14: timer@4c009000 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "st,stm32-timers";
++				reg = <0x4c009000 0x400>;
++				interrupts = <GIC_SPI 112 IRQ_TYPE_LEVEL_HIGH>;
++				interrupt-names = "global";
++				clocks = <&rcc TIM14_K>;
++				clock-names = "int";
++				status = "disabled";
++
++				pwm {
++					compatible = "st,stm32-pwm";
++					#pwm-cells = <3>;
++					status = "disabled";
++				};
++
++				timer@13 {
++					compatible = "st,stm32h7-timer-trigger";
++					reg = <13>;
++					status = "disabled";
++				};
++			};
++
++			timers15: timer@4c00a000 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "st,stm32-timers";
++				reg = <0x4c00a000 0x400>;
++				interrupts = <GIC_SPI 101 IRQ_TYPE_LEVEL_HIGH>;
++				interrupt-names = "global";
++				clocks = <&rcc TIM15_K>;
++				clock-names = "int";
++				dmas = <&dmamux1 105 0x400 0x1>,
++				<&dmamux1 106 0x400 0x1>,
++				<&dmamux1 107 0x400 0x1>,
++				<&dmamux1 108 0x400 0x1>;
++				dma-names = "ch1", "up", "trig", "com";
++				status = "disabled";
++
++				pwm {
++					compatible = "st,stm32-pwm";
++					#pwm-cells = <3>;
++					status = "disabled";
++				};
++
++				timer@14 {
++					compatible = "st,stm32h7-timer-trigger";
++					reg = <14>;
++					status = "disabled";
++				};
++			};
++
++			timers16: timer@4c00b000 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "st,stm32-timers";
++				reg = <0x4c00b000 0x400>;
++				interrupts = <GIC_SPI 102 IRQ_TYPE_LEVEL_HIGH>;
++				interrupt-names = "global";
++				clocks = <&rcc TIM16_K>;
++				clock-names = "int";
++				dmas = <&dmamux1 109 0x400 0x1>,
++				<&dmamux1 110 0x400 0x1>;
++				dma-names = "ch1", "up";
++				status = "disabled";
++
++				pwm {
++					compatible = "st,stm32-pwm";
++					#pwm-cells = <3>;
++					status = "disabled";
++				};
++
++				timer@15 {
++					compatible = "st,stm32h7-timer-trigger";
++					reg = <15>;
++					status = "disabled";
++				};
++			};
++
++			timers17: timer@4c00c000 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "st,stm32-timers";
++				reg = <0x4c00c000 0x400>;
++				interrupts = <GIC_SPI 103 IRQ_TYPE_LEVEL_HIGH>;
++				interrupt-names = "global";
++				clocks = <&rcc TIM17_K>;
++				clock-names = "int";
++				dmas = <&dmamux1 111 0x400 0x1>,
++				       <&dmamux1 112 0x400 0x1>;
++				dma-names = "ch1", "up";
++				status = "disabled";
++
++				pwm {
++					compatible = "st,stm32-pwm";
++					#pwm-cells = <3>;
++					status = "disabled";
++				};
++
++				timer@16 {
++					compatible = "st,stm32h7-timer-trigger";
++					reg = <16>;
++					status = "disabled";
++				};
++			};
++
++			lptimer2: timer@50021000 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "st,stm32-lptimer";
++				reg = <0x50021000 0x400>;
++				interrupts-extended = <&exti 48 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc LPTIM2_K>;
++				clock-names = "mux";
++				wakeup-source;
++				status = "disabled";
++
++				pwm {
++					compatible = "st,stm32-pwm-lp";
++					#pwm-cells = <3>;
++					status = "disabled";
++				};
++
++				trigger@1 {
++					compatible = "st,stm32-lptimer-trigger";
++					reg = <1>;
++					status = "disabled";
++				};
++
++				counter {
++					compatible = "st,stm32-lptimer-counter";
++					status = "disabled";
++				};
++
++				timer {
++					compatible = "st,stm32-lptimer-timer";
++					status = "disabled";
++				};
++			};
++
++			lptimer3: timer@50022000 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				compatible = "st,stm32-lptimer";
++				reg = <0x50022000 0x400>;
++				interrupts-extended = <&exti 50 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc LPTIM3_K>;
++				clock-names = "mux";
++				wakeup-source;
++				status = "disabled";
++
++				pwm {
++					compatible = "st,stm32-pwm-lp";
++					#pwm-cells = <3>;
++					status = "disabled";
++				};
++
++				trigger@2 {
++					compatible = "st,stm32-lptimer-trigger";
++					reg = <2>;
++					status = "disabled";
++				};
++
++				timer {
++					compatible = "st,stm32-lptimer-timer";
++					status = "disabled";
++				};
++			};
++
++			hash: hash@54003000 {
++				compatible = "st,stm32mp13-hash";
++				reg = <0x54003000 0x400>;
++				interrupts = <GIC_SPI 81 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc HASH1>;
++				resets = <&rcc HASH1_R>;
++				dmas = <&mdma 30 0x2 0x1000a02 0x0 0x0>;
++				dma-names = "in";
++				status = "disabled";
++			};
++
++			rng: rng@54004000 {
++				compatible = "st,stm32mp13-rng";
++				reg = <0x54004000 0x400>;
++				clocks = <&rcc RNG1_K>;
++				resets = <&rcc RNG1_R>;
++				status = "disabled";
++			};
++
++			fmc: memory-controller@58002000 {
++				compatible = "st,stm32mp1-fmc2-ebi";
++				reg = <0x58002000 0x1000>;
++				ranges = <0 0 0x60000000 0x04000000>, /* EBI CS 1 */
++					 <1 0 0x64000000 0x04000000>, /* EBI CS 2 */
++					 <2 0 0x68000000 0x04000000>, /* EBI CS 3 */
++					 <3 0 0x6c000000 0x04000000>, /* EBI CS 4 */
++					 <4 0 0x80000000 0x10000000>; /* NAND */
++				#address-cells = <2>;
++				#size-cells = <1>;
++				clocks = <&rcc FMC_K>;
++				resets = <&rcc FMC_R>;
++				status = "disabled";
++
++				nand-controller@4,0 {
++					compatible = "st,stm32mp1-fmc2-nfc";
++					reg = <4 0x00000000 0x1000>,
++					      <4 0x08010000 0x1000>,
++					      <4 0x08020000 0x1000>,
++					      <4 0x01000000 0x1000>,
++					      <4 0x09010000 0x1000>,
++					      <4 0x09020000 0x1000>;
++					#address-cells = <1>;
++					#size-cells = <0>;
++					interrupts = <GIC_SPI 49 IRQ_TYPE_LEVEL_HIGH>;
++					dmas = <&mdma 24 0x2 0x12000a02 0x0 0x0>,
++					       <&mdma 24 0x2 0x12000a08 0x0 0x0>,
++					       <&mdma 25 0x2 0x12000a0a 0x0 0x0>;
++					dma-names = "tx", "rx", "ecc";
++					status = "disabled";
++				};
++			};
++
++			qspi: spi@58003000 {
++				compatible = "st,stm32f469-qspi";
++				reg = <0x58003000 0x1000>, <0x70000000 0x10000000>;
++				reg-names = "qspi", "qspi_mm";
++				#address-cells = <1>;
++				#size-cells = <0>;
++				interrupts = <GIC_SPI 91 IRQ_TYPE_LEVEL_HIGH>;
++				dmas = <&mdma 26 0x2 0x10100002 0x0 0x0>,
++				       <&mdma 26 0x2 0x10100008 0x0 0x0>;
++				dma-names = "tx", "rx";
++				clocks = <&rcc QSPI_K>;
++				resets = <&rcc QSPI_R>;
++				status = "disabled";
++			};
++
++			sdmmc1: mmc@58005000 {
++				compatible = "st,stm32-sdmmc2", "arm,pl18x", "arm,primecell";
++				arm,primecell-periphid = <0x20253180>;
++				reg = <0x58005000 0x1000>, <0x58006000 0x1000>;
++				interrupts = <GIC_SPI 50 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc SDMMC1_K>;
++				clock-names = "apb_pclk";
++				resets = <&rcc SDMMC1_R>;
++				cap-sd-highspeed;
++				cap-mmc-highspeed;
++				max-frequency = <130000000>;
++				status = "disabled";
++			};
++
++			sdmmc2: mmc@58007000 {
++				compatible = "st,stm32-sdmmc2", "arm,pl18x", "arm,primecell";
++				arm,primecell-periphid = <0x20253180>;
++				reg = <0x58007000 0x1000>, <0x58008000 0x1000>;
++				interrupts = <GIC_SPI 108 IRQ_TYPE_LEVEL_HIGH>;
++				clocks = <&rcc SDMMC2_K>;
++				clock-names = "apb_pclk";
++				resets = <&rcc SDMMC2_R>;
++				cap-sd-highspeed;
++				cap-mmc-highspeed;
++				max-frequency = <130000000>;
++				status = "disabled";
++			};
++
++			usbphyc: usbphyc@5a006000 {
++				#address-cells = <1>;
++				#size-cells = <0>;
++				#clock-cells = <0>;
++				compatible = "st,stm32mp1-usbphyc";
++				reg = <0x5a006000 0x1000>;
++				clocks = <&rcc USBPHY_K>;
++				resets = <&rcc USBPHY_R>;
++				vdda1v1-supply = <&scmi_reg11>;
++				vdda1v8-supply = <&scmi_reg18>;
++				status = "disabled";
++
++				usbphyc_port0: usb-phy@0 {
++					#phy-cells = <0>;
++					reg = <0>;
++				};
++
++				usbphyc_port1: usb-phy@1 {
++					#phy-cells = <1>;
++					reg = <1>;
++				};
++			};
++		};
++
+ 		/*
+ 		 * Break node order to solve dependency probe issue between
+ 		 * pinctrl and exti.
+--- a/arch/arm/boot/dts/st/stm32mp133.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp133.dtsi
+@@ -33,35 +33,37 @@
+ 			bosch,mram-cfg = <0x1400 0 0 32 0 0 2 2>;
+ 			status = "disabled";
+ 		};
++	};
++};
++
++&etzpc {
++	adc_1: adc@48003000 {
++		compatible = "st,stm32mp13-adc-core";
++		reg = <0x48003000 0x400>;
++		interrupts = <GIC_SPI 18 IRQ_TYPE_LEVEL_HIGH>;
++		clocks = <&rcc ADC1>, <&rcc ADC1_K>;
++		clock-names = "bus", "adc";
++		interrupt-controller;
++		#interrupt-cells = <1>;
++		#address-cells = <1>;
++		#size-cells = <0>;
++		status = "disabled";
+ 
+-		adc_1: adc@48003000 {
+-			compatible = "st,stm32mp13-adc-core";
+-			reg = <0x48003000 0x400>;
+-			interrupts = <GIC_SPI 18 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc ADC1>, <&rcc ADC1_K>;
+-			clock-names = "bus", "adc";
+-			interrupt-controller;
+-			#interrupt-cells = <1>;
++		adc1: adc@0 {
++			compatible = "st,stm32mp13-adc";
++			#io-channel-cells = <1>;
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
++			reg = <0x0>;
++			interrupt-parent = <&adc_1>;
++			interrupts = <0>;
++			dmas = <&dmamux1 9 0x400 0x80000001>;
++			dma-names = "rx";
+ 			status = "disabled";
+ 
+-			adc1: adc@0 {
+-				compatible = "st,stm32mp13-adc";
+-				#io-channel-cells = <1>;
+-				#address-cells = <1>;
+-				#size-cells = <0>;
+-				reg = <0x0>;
+-				interrupt-parent = <&adc_1>;
+-				interrupts = <0>;
+-				dmas = <&dmamux1 9 0x400 0x80000001>;
+-				dma-names = "rx";
+-				status = "disabled";
+-
+-				channel@18 {
+-					reg = <18>;
+-					label = "vrefint";
+-				};
++			channel@18 {
++				reg = <18>;
++				label = "vrefint";
+ 			};
+ 		};
+ 	};
+--- a/arch/arm/boot/dts/st/stm32mp13xc.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp13xc.dtsi
+@@ -4,15 +4,13 @@
+  * Author: Alexandre Torgue <alexandre.torgue@foss.st.com> for STMicroelectronics.
+  */
+ 
+-/ {
+-	soc {
+-		cryp: crypto@54002000 {
+-			compatible = "st,stm32mp1-cryp";
+-			reg = <0x54002000 0x400>;
+-			interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc CRYP1>;
+-			resets = <&rcc CRYP1_R>;
+-			status = "disabled";
+-		};
++&etzpc {
++	cryp: crypto@54002000 {
++		compatible = "st,stm32mp1-cryp";
++		reg = <0x54002000 0x400>;
++		interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>;
++		clocks = <&rcc CRYP1>;
++		resets = <&rcc CRYP1_R>;
++		status = "disabled";
+ 	};
+ };
+--- a/arch/arm/boot/dts/st/stm32mp13xf.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp13xf.dtsi
+@@ -4,15 +4,13 @@
+  * Author: Alexandre Torgue <alexandre.torgue@foss.st.com> for STMicroelectronics.
+  */
+ 
+-/ {
+-	soc {
+-		cryp: crypto@54002000 {
+-			compatible = "st,stm32mp1-cryp";
+-			reg = <0x54002000 0x400>;
+-			interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>;
+-			clocks = <&rcc CRYP1>;
+-			resets = <&rcc CRYP1_R>;
+-			status = "disabled";
+-		};
++&etzpc {
++	cryp: crypto@54002000 {
++		compatible = "st,stm32mp1-cryp";
++		reg = <0x54002000 0x400>;
++		interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>;
++		clocks = <&rcc CRYP1>;
++		resets = <&rcc CRYP1_R>;
++		status = "disabled";
+ 	};
+ };
diff --git a/target/linux/stm32/patches-6.6/010-ARM-dts-stm32-put-ETZPC-as-an-access-controller-for-.patch b/target/linux/stm32/patches-6.6/010-ARM-dts-stm32-put-ETZPC-as-an-access-controller-for-.patch
new file mode 100644
index 00000000000000..e6a4eee0571b23
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/010-ARM-dts-stm32-put-ETZPC-as-an-access-controller-for-.patch
@@ -0,0 +1,265 @@
+From 21ca3d7c59595d76237faebeff4f6a979cf7ae82 Mon Sep 17 00:00:00 2001
+From: Alexandre Torgue <alexandre.torgue@foss.st.com>
+Date: Fri, 5 Apr 2024 13:45:24 +0200
+Subject: [PATCH 2/5] ARM: dts: stm32: put ETZPC as an access controller for
+ STM32MP13x boards
+
+Reference ETZPC as an access-control-provider.
+
+For more information on which peripheral is securable or supports MCU
+isolation, please read the STM32MP13 reference manual
+
+Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+---
+ arch/arm/boot/dts/st/stm32mp131.dtsi  | 28 ++++++++++++++++++++++++++-
+ arch/arm/boot/dts/st/stm32mp133.dtsi  |  1 +
+ arch/arm/boot/dts/st/stm32mp13xc.dtsi |  1 +
+ arch/arm/boot/dts/st/stm32mp13xf.dtsi |  1 +
+ 4 files changed, 30 insertions(+), 1 deletion(-)
+
+--- a/arch/arm/boot/dts/st/stm32mp131.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp131.dtsi
+@@ -886,10 +886,11 @@
+ 		};
+ 
+ 		etzpc: bus@5c007000 {
+-			compatible = "simple-bus";
++			compatible = "st,stm32-etzpc", "simple-bus";
+ 			reg = <0x5c007000 0x400>;
+ 			#address-cells = <1>;
+ 			#size-cells = <1>;
++			#access-controller-cells = <1>;
+ 			ranges;
+ 
+ 			adc_2: adc@48004000 {
+@@ -902,6 +903,7 @@
+ 				#interrupt-cells = <1>;
+ 				#address-cells = <1>;
+ 				#size-cells = <0>;
++				access-controllers = <&etzpc 33>;
+ 				status = "disabled";
+ 
+ 				adc2: adc@0 {
+@@ -949,6 +951,7 @@
+ 				dr_mode = "otg";
+ 				otg-rev = <0x200>;
+ 				usb33d-supply = <&scmi_usb33>;
++				access-controllers = <&etzpc 34>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -962,6 +965,7 @@
+ 				dmas = <&dmamux1 41 0x400 0x5>,
+ 				<&dmamux1 42 0x400 0x1>;
+ 				dma-names = "rx", "tx";
++				access-controllers = <&etzpc 16>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -975,6 +979,7 @@
+ 				dmas = <&dmamux1 43 0x400 0x5>,
+ 				<&dmamux1 44 0x400 0x1>;
+ 				dma-names = "rx", "tx";
++				access-controllers = <&etzpc 17>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -986,6 +991,7 @@
+ 				dmas = <&dmamux1 83 0x400 0x01>,
+ 				<&dmamux1 84 0x400 0x01>;
+ 				dma-names = "rx", "tx";
++				access-controllers = <&etzpc 13>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1000,6 +1006,7 @@
+ 				dmas = <&dmamux1 83 0x400 0x01>,
+ 				       <&dmamux1 84 0x400 0x01>;
+ 				dma-names = "rx", "tx";
++				access-controllers = <&etzpc 18>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1014,6 +1021,7 @@
+ 				dmas = <&dmamux1 85 0x400 0x01>,
+ 				       <&dmamux1 86 0x400 0x01>;
+ 				dma-names = "rx", "tx";
++				access-controllers = <&etzpc 19>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1032,6 +1040,7 @@
+ 				dma-names = "rx", "tx";
+ 				st,syscfg-fmp = <&syscfg 0x4 0x4>;
+ 				i2c-analog-filter;
++				access-controllers = <&etzpc 20>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1050,6 +1059,7 @@
+ 				dma-names = "rx", "tx";
+ 				st,syscfg-fmp = <&syscfg 0x4 0x8>;
+ 				i2c-analog-filter;
++				access-controllers = <&etzpc 21>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1068,6 +1078,7 @@
+ 				dma-names = "rx", "tx";
+ 				st,syscfg-fmp = <&syscfg 0x4 0x10>;
+ 				i2c-analog-filter;
++				access-controllers = <&etzpc 22>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1080,6 +1091,7 @@
+ 				interrupt-names = "global";
+ 				clocks = <&rcc TIM12_K>;
+ 				clock-names = "int";
++				access-controllers = <&etzpc 23>;
+ 				status = "disabled";
+ 
+ 				pwm {
+@@ -1104,6 +1116,7 @@
+ 				interrupt-names = "global";
+ 				clocks = <&rcc TIM13_K>;
+ 				clock-names = "int";
++				access-controllers = <&etzpc 24>;
+ 				status = "disabled";
+ 
+ 				pwm {
+@@ -1128,6 +1141,7 @@
+ 				interrupt-names = "global";
+ 				clocks = <&rcc TIM14_K>;
+ 				clock-names = "int";
++				access-controllers = <&etzpc 25>;
+ 				status = "disabled";
+ 
+ 				pwm {
+@@ -1157,6 +1171,7 @@
+ 				<&dmamux1 107 0x400 0x1>,
+ 				<&dmamux1 108 0x400 0x1>;
+ 				dma-names = "ch1", "up", "trig", "com";
++				access-controllers = <&etzpc 26>;
+ 				status = "disabled";
+ 
+ 				pwm {
+@@ -1184,6 +1199,7 @@
+ 				dmas = <&dmamux1 109 0x400 0x1>,
+ 				<&dmamux1 110 0x400 0x1>;
+ 				dma-names = "ch1", "up";
++				access-controllers = <&etzpc 27>;
+ 				status = "disabled";
+ 
+ 				pwm {
+@@ -1211,6 +1227,7 @@
+ 				dmas = <&dmamux1 111 0x400 0x1>,
+ 				       <&dmamux1 112 0x400 0x1>;
+ 				dma-names = "ch1", "up";
++				access-controllers = <&etzpc 28>;
+ 				status = "disabled";
+ 
+ 				pwm {
+@@ -1235,6 +1252,7 @@
+ 				clocks = <&rcc LPTIM2_K>;
+ 				clock-names = "mux";
+ 				wakeup-source;
++				access-controllers = <&etzpc 1>;
+ 				status = "disabled";
+ 
+ 				pwm {
+@@ -1269,6 +1287,7 @@
+ 				clocks = <&rcc LPTIM3_K>;
+ 				clock-names = "mux";
+ 				wakeup-source;
++				access-controllers = <&etzpc 2>;
+ 				status = "disabled";
+ 
+ 				pwm {
+@@ -1297,6 +1316,7 @@
+ 				resets = <&rcc HASH1_R>;
+ 				dmas = <&mdma 30 0x2 0x1000a02 0x0 0x0>;
+ 				dma-names = "in";
++				access-controllers = <&etzpc 41>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1305,6 +1325,7 @@
+ 				reg = <0x54004000 0x400>;
+ 				clocks = <&rcc RNG1_K>;
+ 				resets = <&rcc RNG1_R>;
++				access-controllers = <&etzpc 40>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1320,6 +1341,7 @@
+ 				#size-cells = <1>;
+ 				clocks = <&rcc FMC_K>;
+ 				resets = <&rcc FMC_R>;
++				access-controllers = <&etzpc 54>;
+ 				status = "disabled";
+ 
+ 				nand-controller@4,0 {
+@@ -1353,6 +1375,7 @@
+ 				dma-names = "tx", "rx";
+ 				clocks = <&rcc QSPI_K>;
+ 				resets = <&rcc QSPI_R>;
++				access-controllers = <&etzpc 55>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1367,6 +1390,7 @@
+ 				cap-sd-highspeed;
+ 				cap-mmc-highspeed;
+ 				max-frequency = <130000000>;
++				access-controllers = <&etzpc 50>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1381,6 +1405,7 @@
+ 				cap-sd-highspeed;
+ 				cap-mmc-highspeed;
+ 				max-frequency = <130000000>;
++				access-controllers = <&etzpc 51>;
+ 				status = "disabled";
+ 			};
+ 
+@@ -1394,6 +1419,7 @@
+ 				resets = <&rcc USBPHY_R>;
+ 				vdda1v1-supply = <&scmi_reg11>;
+ 				vdda1v8-supply = <&scmi_reg18>;
++				access-controllers = <&etzpc 5>;
+ 				status = "disabled";
+ 
+ 				usbphyc_port0: usb-phy@0 {
+--- a/arch/arm/boot/dts/st/stm32mp133.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp133.dtsi
+@@ -47,6 +47,7 @@
+ 		#interrupt-cells = <1>;
+ 		#address-cells = <1>;
+ 		#size-cells = <0>;
++		access-controllers = <&etzpc 32>;
+ 		status = "disabled";
+ 
+ 		adc1: adc@0 {
+--- a/arch/arm/boot/dts/st/stm32mp13xc.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp13xc.dtsi
+@@ -11,6 +11,7 @@
+ 		interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>;
+ 		clocks = <&rcc CRYP1>;
+ 		resets = <&rcc CRYP1_R>;
++		access-controllers = <&etzpc 42>;
+ 		status = "disabled";
+ 	};
+ };
+--- a/arch/arm/boot/dts/st/stm32mp13xf.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp13xf.dtsi
+@@ -11,6 +11,7 @@
+ 		interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>;
+ 		clocks = <&rcc CRYP1>;
+ 		resets = <&rcc CRYP1_R>;
++		access-controllers = <&etzpc 42>;
+ 		status = "disabled";
+ 	};
+ };
diff --git a/target/linux/stm32/patches-6.6/011-ARM-dts-stm32-add-ethernet1-2-RMII-pins-for-STM32MP1.patch b/target/linux/stm32/patches-6.6/011-ARM-dts-stm32-add-ethernet1-2-RMII-pins-for-STM32MP1.patch
new file mode 100644
index 00000000000000..123bde88417e28
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/011-ARM-dts-stm32-add-ethernet1-2-RMII-pins-for-STM32MP1.patch
@@ -0,0 +1,126 @@
+From b1468a44e0c0f43a06e027efeff4183b3aee0cf7 Mon Sep 17 00:00:00 2001
+From: Christophe Roullier <christophe.roullier@foss.st.com>
+Date: Mon, 10 Jun 2024 10:03:08 +0200
+Subject: [PATCH 3/5] ARM: dts: stm32: add ethernet1/2 RMII pins for
+ STM32MP13F-DK board
+
+Those pins are used for Ethernet 1 and 2 on STM32MP13F-DK board.
+ethernet1: RMII with crystal.
+ethernet2: RMII without crystal.
+Add analog gpio pin configuration ("sleep") to manage power mode on
+stm32mp13.
+
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Reviewed-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+---
+ arch/arm/boot/dts/st/stm32mp13-pinctrl.dtsi | 98 +++++++++++++++++++++
+ 1 file changed, 98 insertions(+)
+
+--- a/arch/arm/boot/dts/st/stm32mp13-pinctrl.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp13-pinctrl.dtsi
+@@ -13,6 +13,104 @@
+ 		};
+ 	};
+ 
++	eth1_rgmii_pins_a: eth1-rgmii-0 {
++		pins1 {
++			pinmux = <STM32_PINMUX('G', 13, AF11)>, /* ETH_RGMII_TXD0 */
++				 <STM32_PINMUX('G', 14, AF11)>, /* ETH_RGMII_TXD1 */
++				 <STM32_PINMUX('C', 2, AF11)>, /* ETH_RGMII_TXD2 */
++				 <STM32_PINMUX('E', 5, AF10)>, /* ETH_RGMII_TXD3 */
++				 <STM32_PINMUX('B', 11, AF11)>, /* ETH_RGMII_TX_CTL */
++				 <STM32_PINMUX('C', 1, AF11)>, /* ETH_RGMII_GTX_CLK */
++				 <STM32_PINMUX('A', 2, AF11)>, /* ETH_MDIO */
++				 <STM32_PINMUX('G', 2, AF11)>; /* ETH_MDC */
++			bias-disable;
++			drive-push-pull;
++			slew-rate = <2>;
++		};
++
++		pins2 {
++			pinmux = <STM32_PINMUX('C', 4, AF11)>, /* ETH_RGMII_RXD0 */
++				 <STM32_PINMUX('C', 5, AF11)>, /* ETH_RGMII_RXD1 */
++				 <STM32_PINMUX('B', 0, AF11)>, /* ETH_RGMII_RXD2 */
++				 <STM32_PINMUX('B', 1, AF11)>, /* ETH_RGMII_RXD3 */
++				 <STM32_PINMUX('A', 7, AF11)>, /* ETH_RGMII_RX_CTL */
++				 <STM32_PINMUX('D', 7, AF10)>; /* ETH_RGMII_RX_CLK */
++			bias-disable;
++		};
++
++	};
++
++	eth1_rmii_pins_a: eth1-rmii-0 {
++		pins1 {
++			pinmux = <STM32_PINMUX('G', 13, AF11)>, /* ETH_RMII_TXD0 */
++				 <STM32_PINMUX('G', 14, AF11)>, /* ETH_RMII_TXD1 */
++				 <STM32_PINMUX('B', 11, AF11)>, /* ETH_RMII_TX_EN */
++				 <STM32_PINMUX('A', 1, AF11)>, /* ETH_RMII_REF_CLK */
++				 <STM32_PINMUX('A', 2, AF11)>, /* ETH_MDIO */
++				 <STM32_PINMUX('G', 2, AF11)>; /* ETH_MDC */
++			bias-disable;
++			drive-push-pull;
++			slew-rate = <1>;
++		};
++
++		pins2 {
++			pinmux = <STM32_PINMUX('C', 4, AF11)>, /* ETH_RMII_RXD0 */
++				 <STM32_PINMUX('C', 5, AF11)>, /* ETH_RMII_RXD1 */
++				 <STM32_PINMUX('C', 1, AF10)>; /* ETH_RMII_CRS_DV */
++			bias-disable;
++		};
++
++	};
++
++	eth1_rmii_sleep_pins_a: eth1-rmii-sleep-0 {
++		pins1 {
++			pinmux = <STM32_PINMUX('G', 13, ANALOG)>, /* ETH_RMII_TXD0 */
++				 <STM32_PINMUX('G', 14, ANALOG)>, /* ETH_RMII_TXD1 */
++				 <STM32_PINMUX('B', 11, ANALOG)>, /* ETH_RMII_TX_EN */
++				 <STM32_PINMUX('A', 1, ANALOG)>, /* ETH_RMII_REF_CLK */
++				 <STM32_PINMUX('A', 2, ANALOG)>, /* ETH_MDIO */
++				 <STM32_PINMUX('G', 2, ANALOG)>, /* ETH_MDC */
++				 <STM32_PINMUX('C', 4, ANALOG)>, /* ETH_RMII_RXD0 */
++				 <STM32_PINMUX('C', 5, ANALOG)>, /* ETH_RMII_RXD1 */
++				 <STM32_PINMUX('C', 1, ANALOG)>; /* ETH_RMII_CRS_DV */
++		};
++	};
++
++	eth2_rmii_pins_a: eth2-rmii-0 {
++		pins1 {
++			pinmux = <STM32_PINMUX('F', 7, AF11)>, /* ETH_RMII_TXD0 */
++				 <STM32_PINMUX('G', 11, AF10)>, /* ETH_RMII_TXD1 */
++				 <STM32_PINMUX('G', 8, AF13)>, /* ETH_RMII_ETHCK */
++				 <STM32_PINMUX('F', 6, AF11)>, /* ETH_RMII_TX_EN */
++				 <STM32_PINMUX('B', 2, AF11)>, /* ETH_MDIO */
++				 <STM32_PINMUX('G', 5, AF10)>; /* ETH_MDC */
++			bias-disable;
++			drive-push-pull;
++			slew-rate = <1>;
++		};
++
++		pins2 {
++			pinmux = <STM32_PINMUX('F', 4, AF11)>, /* ETH_RMII_RXD0 */
++				 <STM32_PINMUX('E', 2, AF10)>, /* ETH_RMII_RXD1 */
++				 <STM32_PINMUX('A', 12, AF11)>; /* ETH_RMII_CRS_DV */
++			bias-disable;
++		};
++	};
++
++	eth2_rmii_sleep_pins_a: eth2-rmii-sleep-0 {
++		pins1 {
++			pinmux = <STM32_PINMUX('F', 7, ANALOG)>, /* ETH_RMII_TXD0 */
++				 <STM32_PINMUX('G', 11, ANALOG)>, /* ETH_RMII_TXD1 */
++				 <STM32_PINMUX('G', 8, ANALOG)>, /* ETH_RMII_ETHCK */
++				 <STM32_PINMUX('F', 6, ANALOG)>, /* ETH_RMII_TX_EN */
++				 <STM32_PINMUX('B', 2, ANALOG)>, /* ETH_MDIO */
++				 <STM32_PINMUX('G', 5, ANALOG)>, /* ETH_MDC */
++				 <STM32_PINMUX('F', 4, ANALOG)>, /* ETH_RMII_RXD0 */
++				 <STM32_PINMUX('E', 2, ANALOG)>, /* ETH_RMII_RXD1 */
++				 <STM32_PINMUX('A', 12, ANALOG)>; /* ETH_RMII_CRS_DV */
++		};
++	};
++
+ 	i2c1_pins_a: i2c1-0 {
+ 		pins {
+ 			pinmux = <STM32_PINMUX('D', 12, AF5)>, /* I2C1_SCL */
diff --git a/target/linux/stm32/patches-6.6/012-ARM-dts-stm32-add-ethernet1-and-ethernet2-support-on.patch b/target/linux/stm32/patches-6.6/012-ARM-dts-stm32-add-ethernet1-and-ethernet2-support-on.patch
new file mode 100644
index 00000000000000..947b1413244e33
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/012-ARM-dts-stm32-add-ethernet1-and-ethernet2-support-on.patch
@@ -0,0 +1,108 @@
+From fcf6ca2da4650d0a7a9cd62c8c72341860931159 Mon Sep 17 00:00:00 2001
+From: Christophe Roullier <christophe.roullier@foss.st.com>
+Date: Mon, 10 Jun 2024 10:03:07 +0200
+Subject: [PATCH 4/5] ARM: dts: stm32: add ethernet1 and ethernet2 support on
+ stm32mp13
+
+Both instances ethernet based on GMAC SNPS IP on stm32mp13.
+GMAC IP version is SNPS 4.20.
+
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+---
+ arch/arm/boot/dts/st/stm32mp131.dtsi | 38 ++++++++++++++++++++++++++++
+ arch/arm/boot/dts/st/stm32mp133.dtsi | 31 +++++++++++++++++++++++
+ 2 files changed, 69 insertions(+)
+
+--- a/arch/arm/boot/dts/st/stm32mp131.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp131.dtsi
+@@ -883,6 +883,12 @@
+ 			ts_cal2: calib@5e {
+ 				reg = <0x5e 0x2>;
+ 			};
++			ethernet_mac1_address: mac1@e4 {
++				reg = <0xe4 0x6>;
++			};
++			ethernet_mac2_address: mac2@ea {
++				reg = <0xea 0x6>;
++			};
+ 		};
+ 
+ 		etzpc: bus@5c007000 {
+@@ -1409,6 +1415,38 @@
+ 				status = "disabled";
+ 			};
+ 
++			ethernet1: ethernet@5800a000 {
++				compatible = "st,stm32mp13-dwmac", "snps,dwmac-4.20a";
++				reg = <0x5800a000 0x2000>;
++				reg-names = "stmmaceth";
++				interrupts-extended = <&intc GIC_SPI 62 IRQ_TYPE_LEVEL_HIGH>,
++						      <&exti 68 1>;
++				interrupt-names = "macirq", "eth_wake_irq";
++				clock-names = "stmmaceth",
++					      "mac-clk-tx",
++					      "mac-clk-rx",
++					      "ethstp",
++					      "eth-ck";
++				clocks = <&rcc ETH1MAC>,
++					 <&rcc ETH1TX>,
++					 <&rcc ETH1RX>,
++					 <&rcc ETH1STP>,
++					 <&rcc ETH1CK_K>;
++				st,syscon = <&syscfg 0x4 0xff0000>;
++				snps,mixed-burst;
++				snps,pbl = <2>;
++				snps,axi-config = <&stmmac_axi_config_1>;
++				snps,tso;
++				access-controllers = <&etzpc 48>;
++				status = "disabled";
++
++				stmmac_axi_config_1: stmmac-axi-config {
++					snps,blen = <0 0 0 0 16 8 4>;
++					snps,rd_osr_lmt = <0x7>;
++					snps,wr_osr_lmt = <0x7>;
++				};
++			};
++
+ 			usbphyc: usbphyc@5a006000 {
+ 				#address-cells = <1>;
+ 				#size-cells = <0>;
+--- a/arch/arm/boot/dts/st/stm32mp133.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp133.dtsi
+@@ -68,4 +68,35 @@
+ 			};
+ 		};
+ 	};
++
++	ethernet2: ethernet@5800e000 {
++		compatible = "st,stm32mp13-dwmac", "snps,dwmac-4.20a";
++		reg = <0x5800e000 0x2000>;
++		reg-names = "stmmaceth";
++		interrupts-extended = <&intc GIC_SPI 97 IRQ_TYPE_LEVEL_HIGH>;
++		interrupt-names = "macirq";
++		clock-names = "stmmaceth",
++			      "mac-clk-tx",
++			      "mac-clk-rx",
++			      "ethstp",
++			      "eth-ck";
++		clocks = <&rcc ETH2MAC>,
++			 <&rcc ETH2TX>,
++			 <&rcc ETH2RX>,
++			 <&rcc ETH2STP>,
++			 <&rcc ETH2CK_K>;
++		st,syscon = <&syscfg 0x4 0xff000000>;
++		snps,mixed-burst;
++		snps,pbl = <2>;
++		snps,axi-config = <&stmmac_axi_config_2>;
++		snps,tso;
++		access-controllers = <&etzpc 49>;
++		status = "disabled";
++
++		stmmac_axi_config_2: stmmac-axi-config {
++			snps,blen = <0 0 0 0 16 8 4>;
++			snps,rd_osr_lmt = <0x7>;
++			snps,wr_osr_lmt = <0x7>;
++		};
++	};
+ };
diff --git a/target/linux/stm32/patches-6.6/013-ARM-dts-stm32-add-ethernet1-for-STM32MP135F-DK-board.patch b/target/linux/stm32/patches-6.6/013-ARM-dts-stm32-add-ethernet1-for-STM32MP135F-DK-board.patch
new file mode 100644
index 00000000000000..79408c5badeb9d
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/013-ARM-dts-stm32-add-ethernet1-for-STM32MP135F-DK-board.patch
@@ -0,0 +1,58 @@
+From b255afeeb33efaa974b1b2454b1f58252d783b67 Mon Sep 17 00:00:00 2001
+From: Christophe Roullier <christophe.roullier@foss.st.com>
+Date: Mon, 10 Jun 2024 10:03:09 +0200
+Subject: [PATCH 5/5] ARM: dts: stm32: add ethernet1 for STM32MP135F-DK board
+
+Ethernet1: RMII with crystal
+Ethernet2: RMII with no cristal, need "phy-supply" property to work,
+today this property was managed by Ethernet glue, but should be present
+and managed in PHY node. So I will push second Ethernet in next step.
+
+PHYs used are SMSC (LAN8742A)
+
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Reviewed-by: Marek Vasut <marex@denx.de>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+---
+ arch/arm/boot/dts/st/stm32mp135f-dk.dts | 23 +++++++++++++++++++++++
+ 1 file changed, 23 insertions(+)
+
+--- a/arch/arm/boot/dts/st/stm32mp135f-dk.dts
++++ b/arch/arm/boot/dts/st/stm32mp135f-dk.dts
+@@ -19,6 +19,7 @@
+ 	compatible = "st,stm32mp135f-dk", "st,stm32mp135";
+ 
+ 	aliases {
++		ethernet0 = &ethernet1;
+ 		serial0 = &uart4;
+ 		serial1 = &usart1;
+ 		serial2 = &uart8;
+@@ -92,6 +93,28 @@
+ 		};
+ 	};
+ };
++
++&ethernet1 {
++	status = "okay";
++	pinctrl-0 = <&eth1_rmii_pins_a>;
++	pinctrl-1 = <&eth1_rmii_sleep_pins_a>;
++	pinctrl-names = "default", "sleep";
++	phy-mode = "rmii";
++	phy-handle = <&phy0_eth1>;
++
++	mdio {
++		#address-cells = <1>;
++		#size-cells = <0>;
++		compatible = "snps,dwmac-mdio";
++
++		phy0_eth1: ethernet-phy@0 {
++			compatible = "ethernet-phy-id0007.c131";
++			reg = <0>;
++			reset-gpios = <&mcp23017 9 GPIO_ACTIVE_LOW>;
++			wakeup-source;
++		};
++	};
++};
+ 
+ &i2c1 {
+ 	pinctrl-names = "default", "sleep";
diff --git a/target/linux/stm32/patches-6.6/020-mmc-mmci-stm32-add-SDIO-in-band-interrupt-mode.patch b/target/linux/stm32/patches-6.6/020-mmc-mmci-stm32-add-SDIO-in-band-interrupt-mode.patch
new file mode 100644
index 00000000000000..235efb57168826
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/020-mmc-mmci-stm32-add-SDIO-in-band-interrupt-mode.patch
@@ -0,0 +1,166 @@
+From 1bcfbfd7c9aa716f61a01682345a1b329f6a6e66 Mon Sep 17 00:00:00 2001
+From: Christophe Kerello <christophe.kerello@foss.st.com>
+Date: Wed, 8 Nov 2023 15:16:37 +0100
+Subject: [PATCH] mmc: mmci: stm32: add SDIO in-band interrupt mode
+
+Add the support of SDIO in-band interrupt mode for STM32 and Ux500
+variants.
+It allows the SD I/O card to interrupt the host on SDMMC_D1 data line.
+It is not enabled by default on Ux500 variant as this is unstable and
+Ux500 users should use out-of-band IRQs.
+
+Signed-off-by: Christophe Kerello <christophe.kerello@foss.st.com>
+Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20231108141637.119497-1-yann.gautier@foss.st.com
+Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
+---
+ drivers/mmc/host/mmci.c | 69 +++++++++++++++++++++++++++++++++++++++--
+ drivers/mmc/host/mmci.h |  2 ++
+ 2 files changed, 69 insertions(+), 2 deletions(-)
+
+--- a/drivers/mmc/host/mmci.c
++++ b/drivers/mmc/host/mmci.c
+@@ -272,6 +272,7 @@ static struct variant_data variant_stm32
+ 	.datactrl_mask_sdio	= MCI_DPSM_ST_SDIOEN,
+ 	.stm32_idmabsize_mask	= GENMASK(12, 5),
+ 	.stm32_idmabsize_align	= BIT(5),
++	.supports_sdio_irq	= true,
+ 	.busy_timeout		= true,
+ 	.busy_detect		= true,
+ 	.busy_detect_flag	= MCI_STM32_BUSYD0,
+@@ -299,6 +300,7 @@ static struct variant_data variant_stm32
+ 	.datactrl_mask_sdio	= MCI_DPSM_ST_SDIOEN,
+ 	.stm32_idmabsize_mask	= GENMASK(16, 5),
+ 	.stm32_idmabsize_align	= BIT(5),
++	.supports_sdio_irq	= true,
+ 	.dma_lli		= true,
+ 	.busy_timeout		= true,
+ 	.busy_detect		= true,
+@@ -327,6 +329,7 @@ static struct variant_data variant_stm32
+ 	.datactrl_mask_sdio	= MCI_DPSM_ST_SDIOEN,
+ 	.stm32_idmabsize_mask	= GENMASK(16, 6),
+ 	.stm32_idmabsize_align	= BIT(6),
++	.supports_sdio_irq	= true,
+ 	.dma_lli		= true,
+ 	.busy_timeout		= true,
+ 	.busy_detect		= true,
+@@ -420,8 +423,9 @@ void mmci_write_pwrreg(struct mmci_host
+  */
+ static void mmci_write_datactrlreg(struct mmci_host *host, u32 datactrl)
+ {
+-	/* Keep busy mode in DPSM if enabled */
+-	datactrl |= host->datactrl_reg & host->variant->busy_dpsm_flag;
++	/* Keep busy mode in DPSM and SDIO mask if enabled */
++	datactrl |= host->datactrl_reg & (host->variant->busy_dpsm_flag |
++					  host->variant->datactrl_mask_sdio);
+ 
+ 	if (host->datactrl_reg != datactrl) {
+ 		host->datactrl_reg = datactrl;
+@@ -1761,6 +1765,25 @@ static irqreturn_t mmci_pio_irq(int irq,
+ 	return IRQ_HANDLED;
+ }
+ 
++static void mmci_write_sdio_irq_bit(struct mmci_host *host, int enable)
++{
++	void __iomem *base = host->base;
++	u32 mask = readl_relaxed(base + MMCIMASK0);
++
++	if (enable)
++		writel_relaxed(mask | MCI_ST_SDIOITMASK, base + MMCIMASK0);
++	else
++		writel_relaxed(mask & ~MCI_ST_SDIOITMASK, base + MMCIMASK0);
++}
++
++static void mmci_signal_sdio_irq(struct mmci_host *host, u32 status)
++{
++	if (status & MCI_ST_SDIOIT) {
++		mmci_write_sdio_irq_bit(host, 0);
++		sdio_signal_irq(host->mmc);
++	}
++}
++
+ /*
+  * Handle completion of command and data transfers.
+  */
+@@ -1805,6 +1828,9 @@ static irqreturn_t mmci_irq(int irq, voi
+ 			mmci_data_irq(host, host->data, status);
+ 		}
+ 
++		if (host->variant->supports_sdio_irq)
++			mmci_signal_sdio_irq(host, status);
++
+ 		/*
+ 		 * Busy detection has been handled by mmci_cmd_irq() above.
+ 		 * Clear the status bit to prevent polling in IRQ context.
+@@ -2041,6 +2067,35 @@ static int mmci_sig_volt_switch(struct m
+ 	return ret;
+ }
+ 
++static void mmci_enable_sdio_irq(struct mmc_host *mmc, int enable)
++{
++	struct mmci_host *host = mmc_priv(mmc);
++	unsigned long flags;
++
++	if (enable)
++		/* Keep the SDIO mode bit if SDIO irqs are enabled */
++		pm_runtime_get_sync(mmc_dev(mmc));
++
++	spin_lock_irqsave(&host->lock, flags);
++	mmci_write_sdio_irq_bit(host, enable);
++	spin_unlock_irqrestore(&host->lock, flags);
++
++	if (!enable) {
++		pm_runtime_mark_last_busy(mmc_dev(mmc));
++		pm_runtime_put_autosuspend(mmc_dev(mmc));
++	}
++}
++
++static void mmci_ack_sdio_irq(struct mmc_host *mmc)
++{
++	struct mmci_host *host = mmc_priv(mmc);
++	unsigned long flags;
++
++	spin_lock_irqsave(&host->lock, flags);
++	mmci_write_sdio_irq_bit(host, 1);
++	spin_unlock_irqrestore(&host->lock, flags);
++}
++
+ static struct mmc_host_ops mmci_ops = {
+ 	.request	= mmci_request,
+ 	.pre_req	= mmci_pre_request,
+@@ -2316,6 +2371,16 @@ static int mmci_probe(struct amba_device
+ 		mmc->caps |= MMC_CAP_WAIT_WHILE_BUSY;
+ 	}
+ 
++	if (variant->supports_sdio_irq && host->mmc->caps & MMC_CAP_SDIO_IRQ) {
++		mmc->caps2 |= MMC_CAP2_SDIO_IRQ_NOTHREAD;
++
++		mmci_ops.enable_sdio_irq = mmci_enable_sdio_irq;
++		mmci_ops.ack_sdio_irq	= mmci_ack_sdio_irq;
++
++		mmci_write_datactrlreg(host,
++				       host->variant->datactrl_mask_sdio);
++	}
++
+ 	/* Variants with mandatory busy timeout in HW needs R1B responses. */
+ 	if (variant->busy_timeout)
+ 		mmc->caps |= MMC_CAP_NEED_RSP_BUSY;
+--- a/drivers/mmc/host/mmci.h
++++ b/drivers/mmc/host/mmci.h
+@@ -331,6 +331,7 @@ enum mmci_busy_state {
+  *	       register.
+  * @opendrain: bitmask identifying the OPENDRAIN bit inside MMCIPOWER register
+  * @dma_lli: true if variant has dma link list feature.
++ * @supports_sdio_irq: allow SD I/O card to interrupt the host
+  * @stm32_idmabsize_mask: stm32 sdmmc idma buffer size.
+  */
+ struct variant_data {
+@@ -376,6 +377,7 @@ struct variant_data {
+ 	u32			start_err;
+ 	u32			opendrain;
+ 	u8			dma_lli:1;
++	bool			supports_sdio_irq;
+ 	u32			stm32_idmabsize_mask;
+ 	u32			stm32_idmabsize_align;
+ 	void (*init)(struct mmci_host *host);
diff --git a/target/linux/stm32/patches-6.6/030-rtc-stm32-add-pinctrl-and-pinmux-interfaces.patch b/target/linux/stm32/patches-6.6/030-rtc-stm32-add-pinctrl-and-pinmux-interfaces.patch
new file mode 100644
index 00000000000000..e06ea134c5a1bc
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/030-rtc-stm32-add-pinctrl-and-pinmux-interfaces.patch
@@ -0,0 +1,189 @@
+From c15671ce05a038b8c92a6f1e24b0b850a154ba59 Mon Sep 17 00:00:00 2001
+From: Valentin Caron <valentin.caron@foss.st.com>
+Date: Mon, 22 Jul 2024 18:00:20 +0200
+Subject: [PATCH] rtc: stm32: add pinctrl and pinmux interfaces
+
+STM32 RTC is capable to handle 3 specific pins of the soc.
+"out1, out2 and out2_rmp". To handle this, we use pinctrl framework.
+There is a single pin per group.
+
+Signed-off-by: Valentin Caron <valentin.caron@foss.st.com>
+Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
+Link: https://lore.kernel.org/r/20240722160022.454226-3-valentin.caron@foss.st.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+---
+ drivers/rtc/Kconfig     |   5 ++
+ drivers/rtc/rtc-stm32.c | 120 ++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 125 insertions(+)
+
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -1887,6 +1887,11 @@ config RTC_DRV_STM32
+ 	tristate "STM32 RTC"
+ 	select REGMAP_MMIO
+ 	depends on ARCH_STM32 || COMPILE_TEST
++	depends on OF
++	depends on PINCTRL
++	select PINMUX
++	select PINCONF
++	select GENERIC_PINCONF
+ 	help
+ 	   If you say yes here you get support for the STM32 On-Chip
+ 	   Real Time Clock.
+--- a/drivers/rtc/rtc-stm32.c
++++ b/drivers/rtc/rtc-stm32.c
+@@ -12,6 +12,9 @@
+ #include <linux/mfd/syscon.h>
+ #include <linux/module.h>
+ #include <linux/of.h>
++#include <linux/pinctrl/pinctrl.h>
++#include <linux/pinctrl/pinconf-generic.h>
++#include <linux/pinctrl/pinmux.h>
+ #include <linux/platform_device.h>
+ #include <linux/pm_wakeirq.h>
+ #include <linux/regmap.h>
+@@ -94,6 +97,14 @@
+ /* STM32 RTC driver time helpers */
+ #define SEC_PER_DAY		(24 * 60 * 60)
+ 
++/* STM32 RTC pinctrl helpers */
++#define STM32_RTC_PINMUX(_name, _action, ...) { \
++	.name = (_name), \
++	.action = (_action), \
++	.groups = ((const char *[]){ __VA_ARGS__ }), \
++	.num_groups = ARRAY_SIZE(((const char *[]){ __VA_ARGS__ })), \
++}
++
+ struct stm32_rtc;
+ 
+ struct stm32_rtc_registers {
+@@ -149,6 +160,106 @@ static void stm32_rtc_wpr_lock(struct st
+ 	writel_relaxed(RTC_WPR_WRONG_KEY, rtc->base + regs->wpr);
+ }
+ 
++enum stm32_rtc_pin_name {
++	NONE,
++	OUT1,
++	OUT2,
++	OUT2_RMP
++};
++
++static const struct pinctrl_pin_desc stm32_rtc_pinctrl_pins[] = {
++	PINCTRL_PIN(OUT1, "out1"),
++	PINCTRL_PIN(OUT2, "out2"),
++	PINCTRL_PIN(OUT2_RMP, "out2_rmp"),
++};
++
++static int stm32_rtc_pinctrl_get_groups_count(struct pinctrl_dev *pctldev)
++{
++	return ARRAY_SIZE(stm32_rtc_pinctrl_pins);
++}
++
++static const char *stm32_rtc_pinctrl_get_group_name(struct pinctrl_dev *pctldev,
++						    unsigned int selector)
++{
++	return stm32_rtc_pinctrl_pins[selector].name;
++}
++
++static int stm32_rtc_pinctrl_get_group_pins(struct pinctrl_dev *pctldev,
++					    unsigned int selector,
++					    const unsigned int **pins,
++					    unsigned int *num_pins)
++{
++	*pins = &stm32_rtc_pinctrl_pins[selector].number;
++	*num_pins = 1;
++	return 0;
++}
++
++static const struct pinctrl_ops stm32_rtc_pinctrl_ops = {
++	.dt_node_to_map		= pinconf_generic_dt_node_to_map_all,
++	.dt_free_map		= pinconf_generic_dt_free_map,
++	.get_groups_count	= stm32_rtc_pinctrl_get_groups_count,
++	.get_group_name		= stm32_rtc_pinctrl_get_group_name,
++	.get_group_pins		= stm32_rtc_pinctrl_get_group_pins,
++};
++
++struct stm32_rtc_pinmux_func {
++	const char *name;
++	const char * const *groups;
++	const unsigned int num_groups;
++	int (*action)(struct pinctrl_dev *pctl_dev, unsigned int pin);
++};
++
++static const struct stm32_rtc_pinmux_func stm32_rtc_pinmux_functions[] = {
++};
++
++static int stm32_rtc_pinmux_get_functions_count(struct pinctrl_dev *pctldev)
++{
++	return ARRAY_SIZE(stm32_rtc_pinmux_functions);
++}
++
++static const char *stm32_rtc_pinmux_get_fname(struct pinctrl_dev *pctldev, unsigned int selector)
++{
++	return stm32_rtc_pinmux_functions[selector].name;
++}
++
++static int stm32_rtc_pinmux_get_groups(struct pinctrl_dev *pctldev, unsigned int selector,
++				       const char * const **groups, unsigned int * const num_groups)
++{
++	*groups = stm32_rtc_pinmux_functions[selector].groups;
++	*num_groups = stm32_rtc_pinmux_functions[selector].num_groups;
++	return 0;
++}
++
++static int stm32_rtc_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned int selector,
++				    unsigned int group)
++{
++	struct stm32_rtc_pinmux_func selected_func = stm32_rtc_pinmux_functions[selector];
++	struct pinctrl_pin_desc pin = stm32_rtc_pinctrl_pins[group];
++
++	/* Call action */
++	if (selected_func.action)
++		return selected_func.action(pctldev, pin.number);
++
++	return -EINVAL;
++}
++
++static const struct pinmux_ops stm32_rtc_pinmux_ops = {
++	.get_functions_count	= stm32_rtc_pinmux_get_functions_count,
++	.get_function_name	= stm32_rtc_pinmux_get_fname,
++	.get_function_groups	= stm32_rtc_pinmux_get_groups,
++	.set_mux		= stm32_rtc_pinmux_set_mux,
++	.strict			= true,
++};
++
++static struct pinctrl_desc stm32_rtc_pdesc = {
++	.name = DRIVER_NAME,
++	.pins = stm32_rtc_pinctrl_pins,
++	.npins = ARRAY_SIZE(stm32_rtc_pinctrl_pins),
++	.owner = THIS_MODULE,
++	.pctlops = &stm32_rtc_pinctrl_ops,
++	.pmxops = &stm32_rtc_pinmux_ops,
++};
++
+ static int stm32_rtc_enter_init_mode(struct stm32_rtc *rtc)
+ {
+ 	const struct stm32_rtc_registers *regs = &rtc->data->regs;
+@@ -723,6 +834,7 @@ static int stm32_rtc_probe(struct platfo
+ {
+ 	struct stm32_rtc *rtc;
+ 	const struct stm32_rtc_registers *regs;
++	struct pinctrl_dev *pctl;
+ 	int ret;
+ 
+ 	rtc = devm_kzalloc(&pdev->dev, sizeof(*rtc), GFP_KERNEL);
+@@ -834,6 +946,14 @@ static int stm32_rtc_probe(struct platfo
+ 		goto err;
+ 	}
+ 
++	ret = devm_pinctrl_register_and_init(&pdev->dev, &stm32_rtc_pdesc, rtc, &pctl);
++	if (ret)
++		return dev_err_probe(&pdev->dev, ret, "pinctrl register failed");
++
++	ret = pinctrl_enable(pctl);
++	if (ret)
++		return dev_err_probe(&pdev->dev, ret, "pinctrl enable failed");
++
+ 	/*
+ 	 * If INITS flag is reset (calendar year field set to 0x00), calendar
+ 	 * must be initialized
diff --git a/target/linux/stm32/patches-6.6/031-rtc-stm32-add-Low-Speed-Clock-Output-LSCO-support.patch b/target/linux/stm32/patches-6.6/031-rtc-stm32-add-Low-Speed-Clock-Output-LSCO-support.patch
new file mode 100644
index 00000000000000..1ac097457217e5
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/031-rtc-stm32-add-Low-Speed-Clock-Output-LSCO-support.patch
@@ -0,0 +1,253 @@
+From 229476a4de2e237ebadddca8a82d20afa9298f71 Mon Sep 17 00:00:00 2001
+From: Valentin Caron <valentin.caron@foss.st.com>
+Date: Mon, 22 Jul 2024 18:00:21 +0200
+Subject: [PATCH] rtc: stm32: add Low Speed Clock Output (LSCO) support
+
+RTC is able to output on a pin the "LSE" internal clock.
+
+STM32 RTC is now registered as a clock provider.
+It provides rtc_lsco clock, that means RTC_LSCO is output on either
+RTC_OUT1 or RTC_OUT2_RMP, depending on pinmux DT property.
+The clock is marked as CLK_IGNORE_UNUSED and CLK_IS_CRITICAL because
+RTC_LSCO can be early required by devices needed it to init.
+
+Add LSCO in pinmux functions.
+
+Add "stm32_rtc_clean_outs" to disable LSCO. As RTC is part of "backup"
+power domain, it is not reset during shutdown or reboot. So force LSCO
+disable at probe.
+
+Co-developed-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
+Signed-off-by: Valentin Caron <valentin.caron@foss.st.com>
+Link: https://lore.kernel.org/r/20240722160022.454226-4-valentin.caron@foss.st.com
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+---
+ drivers/rtc/Kconfig     |  1 +
+ drivers/rtc/rtc-stm32.c | 99 +++++++++++++++++++++++++++++++++++++++++
+ 2 files changed, 100 insertions(+)
+
+--- a/drivers/rtc/Kconfig
++++ b/drivers/rtc/Kconfig
+@@ -1892,6 +1892,7 @@ config RTC_DRV_STM32
+ 	select PINMUX
+ 	select PINCONF
+ 	select GENERIC_PINCONF
++	depends on COMMON_CLK
+ 	help
+ 	   If you say yes here you get support for the STM32 On-Chip
+ 	   Real Time Clock.
+--- a/drivers/rtc/rtc-stm32.c
++++ b/drivers/rtc/rtc-stm32.c
+@@ -6,6 +6,7 @@
+ 
+ #include <linux/bcd.h>
+ #include <linux/clk.h>
++#include <linux/clk-provider.h>
+ #include <linux/errno.h>
+ #include <linux/iopoll.h>
+ #include <linux/ioport.h>
+@@ -44,6 +45,10 @@
+ #define STM32_RTC_CR_FMT		BIT(6)
+ #define STM32_RTC_CR_ALRAE		BIT(8)
+ #define STM32_RTC_CR_ALRAIE		BIT(12)
++#define STM32_RTC_CR_OSEL		GENMASK(22, 21)
++#define STM32_RTC_CR_COE		BIT(23)
++#define STM32_RTC_CR_TAMPOE		BIT(26)
++#define STM32_RTC_CR_OUT2EN		BIT(31)
+ 
+ /* STM32_RTC_ISR/STM32_RTC_ICSR bit fields */
+ #define STM32_RTC_ISR_ALRAWF		BIT(0)
+@@ -80,6 +85,12 @@
+ /* STM32_RTC_SR/_SCR bit fields */
+ #define STM32_RTC_SR_ALRA		BIT(0)
+ 
++/* STM32_RTC_CFGR bit fields */
++#define STM32_RTC_CFGR_OUT2_RMP		BIT(0)
++#define STM32_RTC_CFGR_LSCOEN		GENMASK(2, 1)
++#define STM32_RTC_CFGR_LSCOEN_OUT1	1
++#define STM32_RTC_CFGR_LSCOEN_OUT2_RMP	2
++
+ /* STM32_RTC_VERR bit fields */
+ #define STM32_RTC_VERR_MINREV_SHIFT	0
+ #define STM32_RTC_VERR_MINREV		GENMASK(3, 0)
+@@ -117,6 +128,7 @@ struct stm32_rtc_registers {
+ 	u16 wpr;
+ 	u16 sr;
+ 	u16 scr;
++	u16 cfgr;
+ 	u16 verr;
+ };
+ 
+@@ -131,6 +143,7 @@ struct stm32_rtc_data {
+ 	bool has_pclk;
+ 	bool need_dbp;
+ 	bool need_accuracy;
++	bool has_lsco;
+ };
+ 
+ struct stm32_rtc {
+@@ -143,6 +156,7 @@ struct stm32_rtc {
+ 	struct clk *rtc_ck;
+ 	const struct stm32_rtc_data *data;
+ 	int irq_alarm;
++	struct clk *clk_lsco;
+ };
+ 
+ static void stm32_rtc_wpr_unlock(struct stm32_rtc *rtc)
+@@ -209,7 +223,68 @@ struct stm32_rtc_pinmux_func {
+ 	int (*action)(struct pinctrl_dev *pctl_dev, unsigned int pin);
+ };
+ 
++static int stm32_rtc_pinmux_lsco_available(struct pinctrl_dev *pctldev, unsigned int pin)
++{
++	struct stm32_rtc *rtc = pinctrl_dev_get_drvdata(pctldev);
++	struct stm32_rtc_registers regs = rtc->data->regs;
++	unsigned int cr = readl_relaxed(rtc->base + regs.cr);
++	unsigned int cfgr = readl_relaxed(rtc->base + regs.cfgr);
++	unsigned int calib = STM32_RTC_CR_COE;
++	unsigned int tampalrm = STM32_RTC_CR_TAMPOE | STM32_RTC_CR_OSEL;
++
++	switch (pin) {
++	case OUT1:
++		if ((!(cr & STM32_RTC_CR_OUT2EN) &&
++		     ((cr & calib) || cr & tampalrm)) ||
++		     ((cr & calib) && (cr & tampalrm)))
++			return -EBUSY;
++		break;
++	case OUT2_RMP:
++		if ((cr & STM32_RTC_CR_OUT2EN) &&
++		    (cfgr & STM32_RTC_CFGR_OUT2_RMP) &&
++		    ((cr & calib) || (cr & tampalrm)))
++			return -EBUSY;
++		break;
++	default:
++		return -EINVAL;
++	}
++
++	if (clk_get_rate(rtc->rtc_ck) != 32768)
++		return -ERANGE;
++
++	return 0;
++}
++
++static int stm32_rtc_pinmux_action_lsco(struct pinctrl_dev *pctldev, unsigned int pin)
++{
++	struct stm32_rtc *rtc = pinctrl_dev_get_drvdata(pctldev);
++	struct stm32_rtc_registers regs = rtc->data->regs;
++	struct device *dev = rtc->rtc_dev->dev.parent;
++	u8 lscoen;
++	int ret;
++
++	if (!rtc->data->has_lsco)
++		return -EPERM;
++
++	ret = stm32_rtc_pinmux_lsco_available(pctldev, pin);
++	if (ret)
++		return ret;
++
++	lscoen = (pin == OUT1) ? STM32_RTC_CFGR_LSCOEN_OUT1 : STM32_RTC_CFGR_LSCOEN_OUT2_RMP;
++
++	rtc->clk_lsco = clk_register_gate(dev, "rtc_lsco", __clk_get_name(rtc->rtc_ck),
++					  CLK_IGNORE_UNUSED | CLK_IS_CRITICAL,
++					  rtc->base + regs.cfgr, lscoen, 0, NULL);
++	if (IS_ERR(rtc->clk_lsco))
++		return PTR_ERR(rtc->clk_lsco);
++
++	of_clk_add_provider(dev->of_node, of_clk_src_simple_get, rtc->clk_lsco);
++
++	return 0;
++}
++
+ static const struct stm32_rtc_pinmux_func stm32_rtc_pinmux_functions[] = {
++	STM32_RTC_PINMUX("lsco", &stm32_rtc_pinmux_action_lsco, "out1", "out2_rmp"),
+ };
+ 
+ static int stm32_rtc_pinmux_get_functions_count(struct pinctrl_dev *pctldev)
+@@ -664,6 +739,7 @@ static const struct stm32_rtc_data stm32
+ 	.has_pclk = false,
+ 	.need_dbp = true,
+ 	.need_accuracy = false,
++	.has_lsco = false,
+ 	.regs = {
+ 		.tr = 0x00,
+ 		.dr = 0x04,
+@@ -674,6 +750,7 @@ static const struct stm32_rtc_data stm32
+ 		.wpr = 0x24,
+ 		.sr = 0x0C, /* set to ISR offset to ease alarm management */
+ 		.scr = UNDEF_REG,
++		.cfgr = UNDEF_REG,
+ 		.verr = UNDEF_REG,
+ 	},
+ 	.events = {
+@@ -686,6 +763,7 @@ static const struct stm32_rtc_data stm32
+ 	.has_pclk = true,
+ 	.need_dbp = true,
+ 	.need_accuracy = false,
++	.has_lsco = false,
+ 	.regs = {
+ 		.tr = 0x00,
+ 		.dr = 0x04,
+@@ -696,6 +774,7 @@ static const struct stm32_rtc_data stm32
+ 		.wpr = 0x24,
+ 		.sr = 0x0C, /* set to ISR offset to ease alarm management */
+ 		.scr = UNDEF_REG,
++		.cfgr = UNDEF_REG,
+ 		.verr = UNDEF_REG,
+ 	},
+ 	.events = {
+@@ -717,6 +796,7 @@ static const struct stm32_rtc_data stm32
+ 	.has_pclk = true,
+ 	.need_dbp = false,
+ 	.need_accuracy = true,
++	.has_lsco = true,
+ 	.regs = {
+ 		.tr = 0x00,
+ 		.dr = 0x04,
+@@ -727,6 +807,7 @@ static const struct stm32_rtc_data stm32
+ 		.wpr = 0x24,
+ 		.sr = 0x50,
+ 		.scr = 0x5C,
++		.cfgr = 0x60,
+ 		.verr = 0x3F4,
+ 	},
+ 	.events = {
+@@ -743,6 +824,19 @@ static const struct of_device_id stm32_r
+ };
+ MODULE_DEVICE_TABLE(of, stm32_rtc_of_match);
+ 
++static void stm32_rtc_clean_outs(struct stm32_rtc *rtc)
++{
++	struct stm32_rtc_registers regs = rtc->data->regs;
++
++	if (regs.cfgr != UNDEF_REG) {
++		unsigned int cfgr = readl_relaxed(rtc->base + regs.cfgr);
++
++		cfgr &= ~STM32_RTC_CFGR_LSCOEN;
++		cfgr &= ~STM32_RTC_CFGR_OUT2_RMP;
++		writel_relaxed(cfgr, rtc->base + regs.cfgr);
++	}
++}
++
+ static int stm32_rtc_init(struct platform_device *pdev,
+ 			  struct stm32_rtc *rtc)
+ {
+@@ -946,6 +1040,8 @@ static int stm32_rtc_probe(struct platfo
+ 		goto err;
+ 	}
+ 
++	stm32_rtc_clean_outs(rtc);
++
+ 	ret = devm_pinctrl_register_and_init(&pdev->dev, &stm32_rtc_pdesc, rtc, &pctl);
+ 	if (ret)
+ 		return dev_err_probe(&pdev->dev, ret, "pinctrl register failed");
+@@ -992,6 +1088,9 @@ static void stm32_rtc_remove(struct plat
+ 	const struct stm32_rtc_registers *regs = &rtc->data->regs;
+ 	unsigned int cr;
+ 
++	if (!IS_ERR_OR_NULL(rtc->clk_lsco))
++		clk_unregister_gate(rtc->clk_lsco);
++
+ 	/* Disable interrupts */
+ 	stm32_rtc_wpr_unlock(rtc);
+ 	cr = readl_relaxed(rtc->base + regs->cr);
diff --git a/target/linux/stm32/patches-6.6/032-ARM-dts-stm32-rtc-add-pin-to-provide-LSCO-on-stm32mp.patch b/target/linux/stm32/patches-6.6/032-ARM-dts-stm32-rtc-add-pin-to-provide-LSCO-on-stm32mp.patch
new file mode 100644
index 00000000000000..1d5bedbad37af5
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/032-ARM-dts-stm32-rtc-add-pin-to-provide-LSCO-on-stm32mp.patch
@@ -0,0 +1,31 @@
+From 92483a156238078562d187f527de6b358cb53a08 Mon Sep 17 00:00:00 2001
+From: Valentin Caron <valentin.caron@foss.st.com>
+Date: Tue, 27 Aug 2024 16:04:48 +0200
+Subject: [PATCH] ARM: dts: stm32: rtc, add pin to provide LSCO on
+ stm32mp13
+
+Declare pin for LSCO in stm32-pinctrl provider node to reserve this pin
+for RTC OUT2_RMP, in stm32mp13-pinctrl.dtsi.
+
+Signed-off-by: Valentin Caron <valentin.caron@foss.st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+---
+ arch/arm/boot/dts/st/stm32mp13-pinctrl.dtsi | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/arm/boot/dts/st/stm32mp13-pinctrl.dtsi
++++ b/arch/arm/boot/dts/st/stm32mp13-pinctrl.dtsi
+@@ -212,6 +212,13 @@
+ 		};
+ 	};
+ 
++	/omit-if-no-ref/
++	rtc_rsvd_pins_a: rtc-rsvd-0 {
++		pins {
++			pinmux = <STM32_PINMUX('I', 1, ANALOG)>; /* RTC_OUT2_RMP */
++		};
++	};
++
+ 	sdmmc1_b4_pins_a: sdmmc1-b4-0 {
+ 		pins {
+ 			pinmux = <STM32_PINMUX('C', 8, AF12)>, /* SDMMC1_D0 */
diff --git a/target/linux/stm32/patches-6.6/033-ARM-dts-stm32-rtc-add-LSCO-to-WLAN-BT-module-on-stm3.patch b/target/linux/stm32/patches-6.6/033-ARM-dts-stm32-rtc-add-LSCO-to-WLAN-BT-module-on-stm3.patch
new file mode 100644
index 00000000000000..ec6a086a7d0b8b
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/033-ARM-dts-stm32-rtc-add-LSCO-to-WLAN-BT-module-on-stm3.patch
@@ -0,0 +1,34 @@
+From d6e424f926397e682fc44a952d5b3a1e34b2cd73 Mon Sep 17 00:00:00 2001
+From: Valentin Caron <valentin.caron@foss.st.com>
+Date: Tue, 27 Aug 2024 16:04:50 +0200
+Subject: [PATCH] ARM: dts: stm32: rtc, add LSCO to WLAN/BT module on
+ stm32mp135f-dk
+
+On stm32mp135f-dk board, WLAN/BT module LPO_IN pin is wired to
+RTC OUT2_RMP pin.
+
+Provide a pinctrl configuration to enable LSCO on OUT2_RMP.
+
+Signed-off-by: Valentin Caron <valentin.caron@foss.st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+---
+ arch/arm/boot/dts/st/stm32mp135f-dk.dts | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/arch/arm/boot/dts/st/stm32mp135f-dk.dts
++++ b/arch/arm/boot/dts/st/stm32mp135f-dk.dts
+@@ -184,7 +184,14 @@
+ };
+ 
+ &rtc {
++	pinctrl-names = "default";
++	pinctrl-0 = <&rtc_rsvd_pins_a>;
+ 	status = "okay";
++
++	rtc_lsco_pins_a: rtc-lsco-0 {
++		pins = "out2_rmp";
++		function = "lsco";
++	};
+ };
+ 
+ &scmi_regu {
diff --git a/target/linux/stm32/patches-6.6/034-ARM-dts-stm32-add-support-of-WLAN-BT-on-stm32mp135f-.patch b/target/linux/stm32/patches-6.6/034-ARM-dts-stm32-add-support-of-WLAN-BT-on-stm32mp135f-.patch
new file mode 100644
index 00000000000000..e2b69ac8c77277
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/034-ARM-dts-stm32-add-support-of-WLAN-BT-on-stm32mp135f-.patch
@@ -0,0 +1,84 @@
+From 6b44fdef4c7ad112e17d7cbd64d7d522a426d6e4 Mon Sep 17 00:00:00 2001
+From: Christophe Roullier <christophe.roullier@foss.st.com>
+Date: Tue, 27 Aug 2024 16:04:52 +0200
+Subject: [PATCH] ARM: dts: stm32: add support of WLAN/BT on stm32mp135f-dk
+
+Add support of WLAN/BT Murata Type 1DX module:
+- usart2 is used for Bluetooth interface
+- sdmmc2 is used for WLAN (sdio) interface
+
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+Signed-off-by: Valentin Caron <valentin.caron@foss.st.com>
+Signed-off-by: Alexandre Torgue <alexandre.torgue@foss.st.com>
+---
+ arch/arm/boot/dts/st/stm32mp135f-dk.dts | 45 +++++++++++++++++++++++++
+ 1 file changed, 45 insertions(+)
+
+--- a/arch/arm/boot/dts/st/stm32mp135f-dk.dts
++++ b/arch/arm/boot/dts/st/stm32mp135f-dk.dts
+@@ -67,6 +67,19 @@
+ 			default-state = "off";
+ 		};
+ 	};
++
++	v3v3_ao: v3v3-ao {
++		compatible = "regulator-fixed";
++		regulator-name = "v3v3_ao";
++		regulator-min-microvolt = <3300000>;
++		regulator-max-microvolt = <3300000>;
++		regulator-always-on;
++	};
++
++	wifi_pwrseq: wifi-pwrseq {
++		compatible = "mmc-pwrseq-simple";
++		reset-gpios = <&mcp23017 11 GPIO_ACTIVE_LOW>;
++	};
+ };
+ 
+ &adc_1 {
+@@ -230,6 +243,30 @@
+ 	status = "okay";
+ };
+ 
++/* Wifi */
++&sdmmc2 {
++	pinctrl-names = "default", "opendrain", "sleep";
++	pinctrl-0 = <&sdmmc2_b4_pins_a &sdmmc2_clk_pins_a>;
++	pinctrl-1 = <&sdmmc2_b4_od_pins_a &sdmmc2_clk_pins_a>;
++	pinctrl-2 = <&sdmmc2_b4_sleep_pins_a>;
++	non-removable;
++	cap-sdio-irq;
++	st,neg-edge;
++	bus-width = <4>;
++	vmmc-supply = <&v3v3_ao>;
++	mmc-pwrseq = <&wifi_pwrseq>;
++	#address-cells = <1>;
++	#size-cells = <0>;
++	status = "okay";
++
++	brcmf: bcrmf@1 {
++		reg = <1>;
++		compatible = "brcm,bcm4329-fmac";
++		pinctrl-names = "default";
++		pinctrl-0 = <&rtc_lsco_pins_a>;
++	};
++};
++
+ &spi5 {
+ 	pinctrl-names = "default", "sleep";
+ 	pinctrl-0 = <&spi5_pins_a>;
+@@ -332,6 +369,14 @@
+ 	pinctrl-2 = <&usart2_idle_pins_a>;
+ 	uart-has-rtscts;
+ 	status = "okay";
++
++	bluetooth {
++		shutdown-gpios = <&mcp23017 13 GPIO_ACTIVE_HIGH>;
++		compatible = "brcm,bcm43438-bt";
++		max-speed = <3000000>;
++		vbat-supply = <&v3v3_ao>;
++		vddio-supply = <&v3v3_ao>;
++	};
+ };
+ 
+ &usbh_ehci {
diff --git a/target/linux/stm32/patches-6.6/700-net-stmmac-dwmac-stm32-add-support-of-phy-supply-pro.patch b/target/linux/stm32/patches-6.6/700-net-stmmac-dwmac-stm32-add-support-of-phy-supply-pro.patch
new file mode 100644
index 00000000000000..57d2a26c1af5b1
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/700-net-stmmac-dwmac-stm32-add-support-of-phy-supply-pro.patch
@@ -0,0 +1,106 @@
+From 7bfe3404a02923ca3858abf56b18a098b4be33b2 Mon Sep 17 00:00:00 2001
+From: Christophe Roullier <christophe.roullier@st.com>
+Date: Wed, 10 Nov 2021 17:39:40 +0100
+Subject: [PATCH] net: ethernet: stmmac: stm32: support the phy-supply
+ regulator binding
+
+Configure the phy regulator if defined by the "phy-supply" DT phandle.
+
+Signed-off-by: Christophe Roullier <christophe.roullier@foss.st.com>
+---
+ .../net/ethernet/stmicro/stmmac/dwmac-stm32.c | 51 ++++++++++++++++++-
+ 1 file changed, 50 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-stm32.c
+@@ -14,6 +14,7 @@
+ #include <linux/of_net.h>
+ #include <linux/phy.h>
+ #include <linux/platform_device.h>
++#include <linux/regulator/consumer.h>
+ #include <linux/pm_wakeirq.h>
+ #include <linux/regmap.h>
+ #include <linux/slab.h>
+@@ -92,6 +93,7 @@ struct stm32_dwmac {
+ 	u32 mode_reg;		 /* MAC glue-logic mode register */
+ 	u32 mode_mask;
+ 	struct regmap *regmap;
++	struct regulator *regulator;
+ 	u32 speed;
+ 	const struct stm32_ops *ops;
+ 	struct device *dev;
+@@ -374,6 +376,16 @@ static int stm32_dwmac_parse_data(struct
+ 			dev_dbg(dev, "Warning sysconfig register mask not set\n");
+ 	}
+ 
++	dwmac->regulator = devm_regulator_get_optional(dev, "phy");
++	if (IS_ERR(dwmac->regulator)) {
++		if (PTR_ERR(dwmac->regulator) == -EPROBE_DEFER) {
++			dev_dbg(dev, "phy regulator is not available yet, deferred probing\n");
++			return -EPROBE_DEFER;
++		}
++		dev_dbg(dev, "no regulator found\n");
++		dwmac->regulator = NULL;
++	}
++
+ 	return err;
+ }
+ 
+@@ -439,6 +451,28 @@ static int stm32mp1_parse_data(struct st
+ 	return err;
+ }
+ 
++static int phy_power_on(struct stm32_dwmac *bsp_priv, bool enable)
++{
++	int ret;
++	struct device *dev = bsp_priv->dev;
++
++	if (!bsp_priv->regulator)
++		return 0;
++
++	if (enable) {
++		ret = regulator_enable(bsp_priv->regulator);
++		if (ret)
++			dev_err(dev, "fail to enable phy-supply\n");
++	} else {
++		ret = regulator_disable(bsp_priv->regulator);
++		if (ret)
++			dev_err(dev, "fail to disable phy-supply\n");
++	}
++
++	return 0;
++}
++
++
+ static int stm32_dwmac_probe(struct platform_device *pdev)
+ {
+ 	struct plat_stmmacenet_data *plat_dat;
+@@ -480,12 +514,18 @@ static int stm32_dwmac_probe(struct plat
+ 	if (ret)
+ 		return ret;
+ 
+-	ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
++	ret = phy_power_on(plat_dat->bsp_priv, true);
+ 	if (ret)
+ 		goto err_clk_disable;
+ 
++	ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
++	if (ret)
++		goto err_gmac_powerdown;
++
+ 	return 0;
+ 
++err_gmac_powerdown:
++	phy_power_on(plat_dat->bsp_priv, false);
+ err_clk_disable:
+ 	stm32_dwmac_clk_disable(dwmac, false);
+ 
+@@ -506,6 +546,8 @@ static void stm32_dwmac_remove(struct pl
+ 		dev_pm_clear_wake_irq(&pdev->dev);
+ 		device_init_wakeup(&pdev->dev, false);
+ 	}
++
++	phy_power_on(priv->plat->bsp_priv, false);
+ }
+ 
+ static int stm32mp1_suspend(struct stm32_dwmac *dwmac)
diff --git a/target/linux/stm32/patches-6.6/900-ARM-dts-stm32-add-ethernet2-for-STM32MP135F-DK-board.patch b/target/linux/stm32/patches-6.6/900-ARM-dts-stm32-add-ethernet2-for-STM32MP135F-DK-board.patch
new file mode 100644
index 00000000000000..48fa446bd86220
--- /dev/null
+++ b/target/linux/stm32/patches-6.6/900-ARM-dts-stm32-add-ethernet2-for-STM32MP135F-DK-board.patch
@@ -0,0 +1,53 @@
+From 63c84f846ec5b794a6c90a1c5813cdb0ae75daf6 Mon Sep 17 00:00:00 2001
+From: Thomas Richard <thomas.richard@bootlin.com>
+Date: Thu, 26 Sep 2024 16:48:52 +0200
+Subject: [PATCH] ARM: dts: stm32: add ethernet2 for STM32MP135F-DK board
+
+This patch is based on the stm32mp135f-dk devicetree from 6.6 ST kernel.
+
+Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
+---
+ arch/arm/boot/dts/st/stm32mp135f-dk.dts | 25 +++++++++++++++++++++++++
+ 1 file changed, 25 insertions(+)
+
+--- a/arch/arm/boot/dts/st/stm32mp135f-dk.dts
++++ b/arch/arm/boot/dts/st/stm32mp135f-dk.dts
+@@ -20,6 +20,7 @@
+ 
+ 	aliases {
+ 		ethernet0 = &ethernet1;
++		ethernet1 = &ethernet2;
+ 		serial0 = &uart4;
+ 		serial1 = &usart1;
+ 		serial2 = &uart8;
+@@ -129,6 +130,30 @@
+ 	};
+ };
+ 
++&ethernet2 {
++	status = "okay";
++	pinctrl-0 = <&eth2_rmii_pins_a>;
++	pinctrl-1 = <&eth2_rmii_sleep_pins_a>;
++	pinctrl-names = "default", "sleep";
++	phy-mode = "rmii";
++	phy-handle = <&phy0_eth2>;
++	st,ext-phyclk;
++	phy-supply = <&scmi_v3v3_sw>;
++
++	mdio1 {
++		#address-cells = <1>;
++		#size-cells = <0>;
++		compatible = "snps,dwmac-mdio";
++		phy0_eth2: ethernet-phy@0 {
++			compatible = "ethernet-phy-id0007.c131";
++			reset-gpios = <&mcp23017 10 GPIO_ACTIVE_LOW>;
++			reg = <0>;
++		};
++	};
++};
++
++
++
+ &i2c1 {
+ 	pinctrl-names = "default", "sleep";
+ 	pinctrl-0 = <&i2c1_pins_a>;
diff --git a/target/linux/stm32/stm32mp1/config-6.6 b/target/linux/stm32/stm32mp1/config-6.6
new file mode 100644
index 00000000000000..f6f9efaf9382ac
--- /dev/null
+++ b/target/linux/stm32/stm32mp1/config-6.6
@@ -0,0 +1,483 @@
+CONFIG_ALIGNMENT_TRAP=y
+CONFIG_ARCH_32BIT_OFF_T=y
+CONFIG_ARCH_FORCE_MAX_ORDER=12
+CONFIG_ARCH_HIBERNATION_POSSIBLE=y
+CONFIG_ARCH_KEEP_MEMBLOCK=y
+CONFIG_ARCH_MIGHT_HAVE_PC_PARPORT=y
+CONFIG_ARCH_MULTIPLATFORM=y
+CONFIG_ARCH_MULTI_V6_V7=y
+CONFIG_ARCH_MULTI_V7=y
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX=y
+CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT=y
+CONFIG_ARCH_SELECT_MEMORY_MODEL=y
+CONFIG_ARCH_SPARSEMEM_ENABLE=y
+CONFIG_ARCH_STACKWALK=y
+CONFIG_ARCH_STM32=y
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
+CONFIG_ARM=y
+CONFIG_ARM_AMBA=y
+CONFIG_ARM_APPENDED_DTB=y
+CONFIG_ARM_ARCH_TIMER=y
+CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y
+CONFIG_ARM_ATAG_DTB_COMPAT=y
+CONFIG_ARM_ATAG_DTB_COMPAT_CMDLINE_FROM_BOOTLOADER=y
+CONFIG_ARM_CPU_SUSPEND=y
+CONFIG_ARM_ERRATA_430973=y
+CONFIG_ARM_ERRATA_643719=y
+CONFIG_ARM_ERRATA_720789=y
+CONFIG_ARM_ERRATA_754322=y
+CONFIG_ARM_ERRATA_754327=y
+CONFIG_ARM_ERRATA_764369=y
+CONFIG_ARM_ERRATA_775420=y
+CONFIG_ARM_ERRATA_798181=y
+CONFIG_ARM_ERRATA_814220=y
+CONFIG_ARM_GIC=y
+CONFIG_ARM_HAS_GROUP_RELOCS=y
+# CONFIG_ARM_HIGHBANK_CPUIDLE is not set
+CONFIG_ARM_L1_CACHE_SHIFT=6
+CONFIG_ARM_L1_CACHE_SHIFT_6=y
+CONFIG_ARM_PATCH_IDIV=y
+CONFIG_ARM_PATCH_PHYS_VIRT=y
+# CONFIG_ARM_PL172_MPMC is not set
+CONFIG_ARM_PSCI=y
+CONFIG_ARM_PSCI_CPUIDLE=y
+CONFIG_ARM_PSCI_CPUIDLE_DOMAIN=y
+CONFIG_ARM_PSCI_FW=y
+CONFIG_ARM_SCMI_CPUFREQ=y
+# CONFIG_ARM_SCMI_DEBUG_COUNTERS is not set
+CONFIG_ARM_SCMI_HAVE_MSG=y
+CONFIG_ARM_SCMI_HAVE_SHMEM=y
+CONFIG_ARM_SCMI_HAVE_TRANSPORT=y
+# CONFIG_ARM_SCMI_POWER_CONTROL is not set
+CONFIG_ARM_SCMI_POWER_DOMAIN=y
+CONFIG_ARM_SCMI_PROTOCOL=y
+# CONFIG_ARM_SCMI_RAW_MODE_SUPPORT is not set
+CONFIG_ARM_SCMI_TRANSPORT_OPTEE=y
+CONFIG_ARM_SCMI_TRANSPORT_SMC=y
+# CONFIG_ARM_SCMI_TRANSPORT_SMC_ATOMIC_ENABLE is not set
+CONFIG_ARM_SMCCC_SOC_ID=y
+CONFIG_ARM_SMC_WATCHDOG=y
+# CONFIG_ARM_SMMU is not set
+CONFIG_ARM_THUMB=y
+CONFIG_ARM_THUMBEE=y
+CONFIG_ARM_UNWIND=y
+CONFIG_ARM_VIRT_EXT=y
+CONFIG_AUTO_ZRELADDR=y
+CONFIG_BINFMT_FLAT_ARGVP_ENVP_ON_STACK=y
+# CONFIG_BLK_DEV_INITRD is not set
+CONFIG_BLK_DEV_SD=y
+CONFIG_BLK_PM=y
+CONFIG_BOUNCE=y
+CONFIG_BUFFER_HEAD=y
+# CONFIG_CACHE_L2X0 is not set
+CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
+CONFIG_CHR_DEV_SG=y
+CONFIG_CLKSRC_MMIO=y
+CONFIG_CLKSRC_STM32=y
+CONFIG_CLK_ICST=y
+CONFIG_CLONE_BACKWARDS=y
+CONFIG_CMA=y
+CONFIG_CMA_ALIGNMENT=8
+CONFIG_CMA_AREAS=7
+# CONFIG_CMA_DEBUG is not set
+# CONFIG_CMA_DEBUGFS is not set
+CONFIG_CMA_SIZE_MBYTES=64
+# CONFIG_CMA_SIZE_SEL_MAX is not set
+CONFIG_CMA_SIZE_SEL_MBYTES=y
+# CONFIG_CMA_SIZE_SEL_MIN is not set
+# CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set
+# CONFIG_CMA_SYSFS is not set
+CONFIG_CMDLINE_PARTITION=y
+CONFIG_COMMON_CLK=y
+CONFIG_COMMON_CLK_SCMI=y
+CONFIG_COMMON_CLK_STM32MP135=y
+CONFIG_COMPACT_UNEVICTABLE_DEFAULT=1
+CONFIG_COMPAT_32BIT_TIME=y
+CONFIG_CONSOLE_TRANSLATIONS=y
+CONFIG_CONTEXT_TRACKING=y
+CONFIG_CONTEXT_TRACKING_IDLE=y
+CONFIG_CONTIG_ALLOC=y
+CONFIG_COREDUMP=y
+CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_CPUFREQ_DT_PLATDEV=y
+CONFIG_CPU_32v6K=y
+CONFIG_CPU_32v7=y
+CONFIG_CPU_ABRT_EV7=y
+CONFIG_CPU_CACHE_V7=y
+CONFIG_CPU_CACHE_VIPT=y
+CONFIG_CPU_COPY_V6=y
+CONFIG_CPU_CP15=y
+CONFIG_CPU_CP15_MMU=y
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
+# CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set
+CONFIG_CPU_FREQ_GOV_ATTR_SET=y
+CONFIG_CPU_FREQ_GOV_COMMON=y
+# CONFIG_CPU_FREQ_GOV_CONSERVATIVE is not set
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_HAS_ASID=y
+CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_IDLE_MULTIPLE_DRIVERS=y
+CONFIG_CPU_ISOLATION=y
+CONFIG_CPU_LITTLE_ENDIAN=y
+CONFIG_CPU_MITIGATIONS=y
+CONFIG_CPU_PABRT_V7=y
+CONFIG_CPU_PM=y
+CONFIG_CPU_RMAP=y
+CONFIG_CPU_SPECTRE=y
+CONFIG_CPU_THUMB_CAPABLE=y
+CONFIG_CPU_TLB_V7=y
+CONFIG_CPU_V7=y
+CONFIG_CRC16=y
+CONFIG_CROSS_MEMORY_ATTACH=y
+CONFIG_CRYPTO_CRC32C=y
+CONFIG_CRYPTO_DEFLATE=y
+CONFIG_CRYPTO_LIB_BLAKE2S_GENERIC=y
+CONFIG_CRYPTO_LIB_GF128MUL=y
+CONFIG_CRYPTO_LIB_SHA1=y
+CONFIG_CRYPTO_LIB_UTILS=y
+CONFIG_CRYPTO_SHA1=y
+CONFIG_CURRENT_POINTER_IN_TPIDRURO=y
+CONFIG_DCACHE_WORD_ACCESS=y
+CONFIG_DEBUG_ALIGN_RODATA=y
+CONFIG_DEBUG_INFO=y
+CONFIG_DEBUG_LL_INCLUDE="mach/debug-macro.S"
+CONFIG_DEVFREQ_GOV_PASSIVE=y
+# CONFIG_DEVFREQ_GOV_PERFORMANCE is not set
+# CONFIG_DEVFREQ_GOV_POWERSAVE is not set
+CONFIG_DEVFREQ_GOV_SIMPLE_ONDEMAND=y
+# CONFIG_DEVFREQ_GOV_USERSPACE is not set
+CONFIG_DMADEVICES=y
+CONFIG_DMA_CMA=y
+CONFIG_DMA_ENGINE=y
+CONFIG_DMA_OF=y
+CONFIG_DMA_OPS=y
+CONFIG_DMA_SHARED_BUFFER=y
+CONFIG_DMA_VIRTUAL_CHANNELS=y
+CONFIG_DNOTIFY=y
+CONFIG_DTC=y
+CONFIG_DT_IDLE_GENPD=y
+CONFIG_DT_IDLE_STATES=y
+CONFIG_DUMMY_CONSOLE=y
+CONFIG_DWMAC_DWC_QOS_ETH=y
+CONFIG_DWMAC_GENERIC=y
+CONFIG_DWMAC_STM32=y
+CONFIG_DW_DMAC=y
+CONFIG_DW_DMAC_CORE=y
+CONFIG_EDAC=y
+CONFIG_EDAC_ATOMIC_SCRUB=y
+# CONFIG_EDAC_DEBUG is not set
+CONFIG_EDAC_LEGACY_SYSFS=y
+CONFIG_EDAC_SUPPORT=y
+CONFIG_ELF_CORE=y
+CONFIG_EXCLUSIVE_SYSTEM_RAM=y
+CONFIG_EXT4_FS=y
+CONFIG_FIXED_PHY=y
+CONFIG_FIX_EARLYCON_MEM=y
+CONFIG_FREEZER=y
+CONFIG_FS_IOMAP=y
+CONFIG_FS_MBCACHE=y
+CONFIG_FUNCTION_ALIGNMENT=0
+CONFIG_FWNODE_MDIO=y
+CONFIG_FW_CACHE=y
+# CONFIG_FW_LOADER_USER_HELPER is not set
+CONFIG_GENERIC_ALLOCATOR=y
+CONFIG_GENERIC_ARCH_TOPOLOGY=y
+CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_CLOCKEVENTS=y
+CONFIG_GENERIC_CLOCKEVENTS_BROADCAST=y
+CONFIG_GENERIC_CPU_AUTOPROBE=y
+CONFIG_GENERIC_CPU_VULNERABILITIES=y
+CONFIG_GENERIC_EARLY_IOREMAP=y
+CONFIG_GENERIC_GETTIMEOFDAY=y
+CONFIG_GENERIC_IDLE_POLL_SETUP=y
+CONFIG_GENERIC_IRQ_CHIP=y
+CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y
+CONFIG_GENERIC_IRQ_MIGRATION=y
+CONFIG_GENERIC_IRQ_MULTI_HANDLER=y
+CONFIG_GENERIC_IRQ_SHOW=y
+CONFIG_GENERIC_IRQ_SHOW_LEVEL=y
+CONFIG_GENERIC_LIB_DEVMEM_IS_ALLOWED=y
+CONFIG_GENERIC_PCI_IOMAP=y
+CONFIG_GENERIC_PHY=y
+CONFIG_GENERIC_PINCONF=y
+CONFIG_GENERIC_PINCTRL_GROUPS=y
+CONFIG_GENERIC_PINMUX_FUNCTIONS=y
+CONFIG_GENERIC_SCHED_CLOCK=y
+CONFIG_GENERIC_SMP_IDLE_THREAD=y
+CONFIG_GENERIC_STRNCPY_FROM_USER=y
+CONFIG_GENERIC_STRNLEN_USER=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
+CONFIG_GENERIC_VDSO_32=y
+CONFIG_GLOB=y
+CONFIG_GPIOLIB_IRQCHIP=y
+CONFIG_GPIO_CDEV=y
+CONFIG_GPIO_GENERIC=y
+CONFIG_GPIO_GENERIC_PLATFORM=y
+CONFIG_GPIO_SYSCON=y
+# CONFIG_GPIO_SYSFS is not set
+CONFIG_HARDEN_BRANCH_PREDICTOR=y
+CONFIG_HARDIRQS_SW_RESEND=y
+CONFIG_HAS_DMA=y
+CONFIG_HAS_IOMEM=y
+CONFIG_HAS_IOPORT=y
+CONFIG_HAS_IOPORT_MAP=y
+CONFIG_HAVE_SMP=y
+CONFIG_HIGHMEM=y
+CONFIG_HIGHPTE=y
+CONFIG_HOTPLUG_CORE_SYNC=y
+CONFIG_HOTPLUG_CORE_SYNC_DEAD=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_HW_CONSOLE=y
+CONFIG_HW_RANDOM=y
+CONFIG_HW_RANDOM_OPTEE=y
+# CONFIG_HW_RANDOM_STM32 is not set
+CONFIG_HZ_FIXED=0
+CONFIG_I2C=y
+CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_COMPAT=y
+CONFIG_I2C_DEMUX_PINCTRL=y
+CONFIG_I2C_HELPER_AUTO=y
+CONFIG_I2C_MUX=y
+CONFIG_I2C_MUX_GPIO=y
+CONFIG_I2C_MUX_PCA954x=y
+CONFIG_I2C_MUX_PINCTRL=y
+CONFIG_I2C_SLAVE=y
+# CONFIG_I2C_SLAVE_TESTUNIT is not set
+CONFIG_I2C_SMBUS=y
+# CONFIG_I2C_STM32F4 is not set
+CONFIG_I2C_STM32F7=y
+CONFIG_INPUT=y
+# CONFIG_IOMMUFD is not set
+# CONFIG_IOMMU_DEBUGFS is not set
+CONFIG_IOMMU_IO_PGTABLE=y
+# CONFIG_IOMMU_IO_PGTABLE_ARMV7S is not set
+CONFIG_IOMMU_IO_PGTABLE_LPAE=y
+# CONFIG_IOMMU_IO_PGTABLE_LPAE_SELFTEST is not set
+CONFIG_IOMMU_SUPPORT=y
+CONFIG_IRQCHIP=y
+CONFIG_IRQSTACKS=y
+CONFIG_IRQ_DOMAIN=y
+CONFIG_IRQ_DOMAIN_HIERARCHY=y
+CONFIG_IRQ_FORCED_THREADING=y
+CONFIG_IRQ_WORK=y
+CONFIG_JBD2=y
+CONFIG_KERNEL_GZIP=y
+# CONFIG_KERNEL_XZ is not set
+CONFIG_KMAP_LOCAL=y
+CONFIG_KMAP_LOCAL_NON_LINEAR_PTE_ARRAY=y
+# CONFIG_LEDS_BRIGHTNESS_HW_CHANGED is not set
+# CONFIG_LEDS_CLASS_MULTICOLOR is not set
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_ONESHOT=y
+CONFIG_LEDS_TRIGGER_TRANSIENT=y
+CONFIG_LIBFDT=y
+CONFIG_LOCK_DEBUGGING_SUPPORT=y
+CONFIG_LOCK_SPIN_ON_OWNER=y
+CONFIG_LOG_BUF_SHIFT=16
+# CONFIG_LRU_GEN is not set
+CONFIG_LZO_DECOMPRESS=y
+CONFIG_MACH_STM32MP13=y
+# CONFIG_MACH_STM32MP157 is not set
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_MAGIC_SYSRQ_SERIAL=y
+CONFIG_MDIO_BITBANG=y
+CONFIG_MDIO_BUS=y
+CONFIG_MDIO_DEVICE=y
+CONFIG_MDIO_DEVRES=y
+# CONFIG_MDIO_GPIO is not set
+CONFIG_MEMORY=y
+CONFIG_MEMORY_ISOLATION=y
+# CONFIG_MFD_STM32_LPTIMER is not set
+# CONFIG_MFD_STM32_TIMERS is not set
+CONFIG_MFD_SYSCON=y
+CONFIG_MIGHT_HAVE_CACHE_L2X0=y
+CONFIG_MIGRATION=y
+CONFIG_MMC=y
+CONFIG_MMC_ARMMMCI=y
+CONFIG_MMC_BLOCK=y
+CONFIG_MMC_BLOCK_MINORS=16
+CONFIG_MMC_STM32_SDMMC=y
+CONFIG_MMU_LAZY_TLB_REFCOUNT=y
+CONFIG_MODULES_USE_ELF_REL=y
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+CONFIG_NEED_DMA_MAP_STATE=y
+CONFIG_NEED_SRCU_NMI_SAFE=y
+CONFIG_NEON=y
+CONFIG_NET_EGRESS=y
+CONFIG_NET_FLOW_LIMIT=y
+CONFIG_NET_INGRESS=y
+CONFIG_NET_PTP_CLASSIFY=y
+CONFIG_NET_SELFTESTS=y
+CONFIG_NET_XGRESS=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NR_CPUS=2
+CONFIG_OF=y
+CONFIG_OF_ADDRESS=y
+CONFIG_OF_DYNAMIC=y
+CONFIG_OF_EARLY_FLATTREE=y
+CONFIG_OF_FLATTREE=y
+CONFIG_OF_GPIO=y
+CONFIG_OF_IRQ=y
+CONFIG_OF_KOBJ=y
+CONFIG_OF_MDIO=y
+CONFIG_OF_OVERLAY=y
+CONFIG_OF_RESOLVE=y
+CONFIG_OLD_SIGACTION=y
+CONFIG_OLD_SIGSUSPEND3=y
+CONFIG_OPTEE=y
+CONFIG_PADATA=y
+CONFIG_PAGE_OFFSET=0xC0000000
+CONFIG_PAGE_POOL=y
+CONFIG_PAGE_POOL_STATS=y
+CONFIG_PAGE_SIZE_LESS_THAN_256KB=y
+CONFIG_PAGE_SIZE_LESS_THAN_64KB=y
+# CONFIG_PANIC_ON_OOPS is not set
+CONFIG_PANIC_ON_OOPS_VALUE=0
+CONFIG_PANIC_TIMEOUT=0
+CONFIG_PCS_XPCS=y
+CONFIG_PERF_USE_VMALLOC=y
+CONFIG_PGTABLE_LEVELS=2
+CONFIG_PHYLIB=y
+CONFIG_PHYLIB_LEDS=y
+CONFIG_PHYLINK=y
+# CONFIG_PHY_STM32_USBPHYC is not set
+CONFIG_PINCTRL=y
+CONFIG_PINCTRL_MCP23S08=y
+CONFIG_PINCTRL_MCP23S08_I2C=y
+CONFIG_PINCTRL_STM32=y
+CONFIG_PINCTRL_STM32MP135=y
+# CONFIG_PL353_SMC is not set
+CONFIG_PM=y
+CONFIG_PM_CLK=y
+CONFIG_PM_DEVFREQ=y
+CONFIG_PM_DEVFREQ_EVENT=y
+CONFIG_PM_GENERIC_DOMAINS=y
+CONFIG_PM_GENERIC_DOMAINS_OF=y
+CONFIG_PM_GENERIC_DOMAINS_SLEEP=y
+CONFIG_PM_OPP=y
+CONFIG_PM_SLEEP=y
+CONFIG_PM_SLEEP_SMP=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
+CONFIG_POWER_RESET=y
+CONFIG_POWER_RESET_GPIO=y
+CONFIG_POWER_RESET_GPIO_RESTART=y
+CONFIG_POWER_RESET_SYSCON=y
+CONFIG_POWER_RESET_SYSCON_POWEROFF=y
+CONFIG_POWER_SUPPLY=y
+CONFIG_PPS=y
+CONFIG_PREEMPT_NONE_BUILD=y
+CONFIG_PRINTK_TIME=y
+CONFIG_PTP_1588_CLOCK=y
+CONFIG_PTP_1588_CLOCK_OPTIONAL=y
+CONFIG_RANDSTRUCT_NONE=y
+CONFIG_RAS=y
+CONFIG_RATIONAL=y
+# CONFIG_RAVE_SP_CORE is not set
+CONFIG_REGMAP=y
+CONFIG_REGMAP_I2C=y
+CONFIG_REGMAP_MMIO=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_ARM_SCMI=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+# CONFIG_REGULATOR_STM32_BOOSTER is not set
+# CONFIG_REGULATOR_STM32_PWR is not set
+# CONFIG_REGULATOR_STM32_VREFBUF is not set
+CONFIG_RESET_CONTROLLER=y
+CONFIG_RESET_SCMI=y
+CONFIG_RESET_SIMPLE=y
+CONFIG_RFS_ACCEL=y
+CONFIG_RPS=y
+CONFIG_RTC_CLASS=y
+# CONFIG_RTC_DRV_CMOS is not set
+# CONFIG_RTC_DRV_OPTEE is not set
+CONFIG_RTC_DRV_STM32=y
+CONFIG_RTC_I2C_AND_SPI=y
+CONFIG_RWSEM_SPIN_ON_OWNER=y
+CONFIG_SCSI=y
+CONFIG_SCSI_COMMON=y
+# CONFIG_SERIAL_8250 is not set
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+CONFIG_SERIAL_DEV_CTRL_TTYPORT=y
+CONFIG_SERIAL_MCTRL_GPIO=y
+CONFIG_SERIAL_STM32=y
+CONFIG_SERIAL_STM32_CONSOLE=y
+CONFIG_SERIO=y
+CONFIG_SERIO_LIBPS2=y
+CONFIG_SERIO_SERPORT=y
+CONFIG_SGL_ALLOC=y
+CONFIG_SG_POOL=y
+CONFIG_SMP=y
+CONFIG_SMP_ON_UP=y
+CONFIG_SMSC_PHY=y
+CONFIG_SOCK_RX_QUEUE_MAPPING=y
+CONFIG_SOC_BUS=y
+CONFIG_SOFTIRQ_ON_OWN_STACK=y
+CONFIG_SPARSE_IRQ=y
+CONFIG_SQUASHFS_DECOMP_MULTI_PERCPU=y
+# CONFIG_SQUASHFS_EMBEDDED is not set
+CONFIG_SQUASHFS_FILE_CACHE=y
+# CONFIG_SQUASHFS_FILE_DIRECT is not set
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_ZLIB=y
+CONFIG_STM32_DMA=y
+CONFIG_STM32_DMAMUX=y
+CONFIG_STM32_EXTI=y
+# CONFIG_STM32_FMC2_EBI is not set
+CONFIG_STM32_MDMA=y
+CONFIG_STM32_WATCHDOG=y
+CONFIG_STMMAC_ETH=y
+CONFIG_STMMAC_PLATFORM=y
+# CONFIG_STRIP_ASM_SYMS is not set
+CONFIG_SUSPEND=y
+CONFIG_SUSPEND_FREEZER=y
+CONFIG_SWPHY=y
+CONFIG_SWP_EMULATE=y
+CONFIG_SYS_SUPPORTS_APM_EMULATION=y
+CONFIG_TEE=y
+CONFIG_THREAD_INFO_IN_TASK=y
+CONFIG_TICK_CPU_ACCOUNTING=y
+CONFIG_TIMER_OF=y
+CONFIG_TIMER_PROBE=y
+CONFIG_TREE_RCU=y
+CONFIG_TREE_SRCU=y
+CONFIG_TRUSTED_FOUNDATIONS=y
+# CONFIG_UCLAMP_TASK is not set
+# CONFIG_UEVENT_HELPER is not set
+CONFIG_UNCOMPRESS_INCLUDE="debug/uncompress.h"
+CONFIG_UNWINDER_ARM=y
+CONFIG_USB_SUPPORT=y
+CONFIG_USELIB=y
+CONFIG_USE_OF=y
+CONFIG_VFP=y
+CONFIG_VFPv3=y
+CONFIG_VMAP_STACK=y
+CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_VT=y
+CONFIG_VT_CONSOLE=y
+CONFIG_VT_CONSOLE_SLEEP=y
+CONFIG_VT_HW_CONSOLE_BINDING=y
+CONFIG_WATCHDOG_CORE=y
+# CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set
+CONFIG_XPS=y
+CONFIG_XZ_DEC_ARM=y
+CONFIG_XZ_DEC_ARMTHUMB=y
+CONFIG_XZ_DEC_BCJ=y
+CONFIG_ZBOOT_ROM_BSS=0x0
+CONFIG_ZBOOT_ROM_TEXT=0x0
+CONFIG_ZLIB_DEFLATE=y
+CONFIG_ZLIB_INFLATE=y
diff --git a/target/linux/stm32/stm32mp1/target.mk b/target/linux/stm32/stm32mp1/target.mk
new file mode 100644
index 00000000000000..c41055d5b52462
--- /dev/null
+++ b/target/linux/stm32/stm32mp1/target.mk
@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Copyright (C) 2024 Bootlin
+#
+
+BOARDNAME:=STM32MP1 boards
+ARCH:=arm
+CPU_TYPE:=cortex-a7
+CPU_SUBTYPE=neon-vfpv4
+FEATURES+=fpu
+KERNEL_IMAGES:=zImage
+
diff --git a/target/linux/sunxi/patches-6.6/017-v6.10-firmware-smccc-Export-revision-soc_id-function.patch b/target/linux/sunxi/patches-6.6/017-v6.10-firmware-smccc-Export-revision-soc_id-function.patch
index 538484dd82b6e4..aacd0ba9067316 100644
--- a/target/linux/sunxi/patches-6.6/017-v6.10-firmware-smccc-Export-revision-soc_id-function.patch
+++ b/target/linux/sunxi/patches-6.6/017-v6.10-firmware-smccc-Export-revision-soc_id-function.patch
@@ -22,7 +22,7 @@ Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
 
 --- a/drivers/firmware/smccc/smccc.c
 +++ b/drivers/firmware/smccc/smccc.c
-@@ -69,6 +69,7 @@ s32 arm_smccc_get_soc_id_revision(void)
+@@ -65,6 +65,7 @@ s32 arm_smccc_get_soc_id_revision(void)
  {
  	return smccc_soc_id_revision;
  }
diff --git a/target/linux/tegra/config-6.6 b/target/linux/tegra/config-6.6
index 9cecf9f6932a45..a98d81c92da193 100644
--- a/target/linux/tegra/config-6.6
+++ b/target/linux/tegra/config-6.6
@@ -56,8 +56,6 @@ CONFIG_BOUNCE=y
 CONFIG_BUFFER_HEAD=y
 CONFIG_CACHE_L2X0=y
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLONE_BACKWARDS=y
 CONFIG_CLZ_TAB=y
@@ -210,7 +208,6 @@ CONFIG_FS_MBCACHE=y
 CONFIG_FUNCTION_ALIGNMENT=0
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
diff --git a/target/linux/tegra/patches-6.6/100-serial8250-on-tegra-hsuart-recover-from-spurious-interrupts-due-to-tegra2-silicon-bug.patch b/target/linux/tegra/patches-6.6/100-serial8250-on-tegra-hsuart-recover-from-spurious-interrupts-due-to-tegra2-silicon-bug.patch
new file mode 100644
index 00000000000000..8f01f73eb24a98
--- /dev/null
+++ b/target/linux/tegra/patches-6.6/100-serial8250-on-tegra-hsuart-recover-from-spurious-interrupts-due-to-tegra2-silicon-bug.patch
@@ -0,0 +1,77 @@
+From patchwork Fri Jul 13 11:32:42 2018
+Content-Type: text/plain; charset="utf-8"
+MIME-Version: 1.0
+Content-Transfer-Encoding: 7bit
+Subject: serial8250 on tegra hsuart: recover from spurious interrupts due to
+ tegra2 silicon bug
+X-Patchwork-Submitter: "David R. Piegdon" <lkml@p23q.org>
+X-Patchwork-Id: 943440
+Message-Id: <4676ea34-69ce-5422-1ded-94218b89f7d9@p23q.org>
+To: linux-tegra@vger.kernel.org
+Date: Fri, 13 Jul 2018 11:32:42 +0000
+From: "David R. Piegdon" <lkml@p23q.org>
+List-Id: <linux-tegra.vger.kernel.org>
+
+Hi,
+a while back I sent a few mails regarding spurious interrupts in the
+UARTA (hsuart) block of the Tegra2 SoC, when using the 8250 driver for
+it instead of the hsuart driver. After going down a pretty deep
+debugging/testing hole, I think I found a patch that fixes the issue. So
+far testing in a reboot-cycle suggests that the error frequency dropped
+from >3% of all reboots to at least <0.05% of all reboots. Tests
+continue to run over the weekend.
+
+The patch below already is a second iteration; the first did not reset
+the MCR or contain the lines below '// clear interrupts'. This resulted
+in no more spurious interrupts, but in a few % of spurious interrupts
+that were recovered the UART block did not receive any characters any
+more. So further resetting was required to fully reacquire operational
+state of the UART block.
+
+I'd love any comments/suggestions on this!
+
+Cheers,
+
+David
+
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -134,6 +134,38 @@ static irqreturn_t serial8250_interrupt(
+ 
+ 		if (l == i->head && pass_counter++ > PASS_LIMIT)
+ 			break;
++
++#ifdef CONFIG_ARCH_TEGRA_2x_SOC
++		if (!handled && (port->type == PORT_TEGRA)) {
++			/*
++			 * Fix Tegra 2 CPU silicon bug where sometimes
++			 * "TX holding register empty" interrupts result in a
++			 * bad (metastable?) state in Tegras HSUART IP core.
++			 * Only way to recover seems to be to reset all
++			 * interrupts as well as the TX queue and the MCR.
++			 * But we don't want to loose any outgoing characters,
++			 * so only do it if the RX and TX queues are empty.
++			 */
++			unsigned char lsr = port->serial_in(port, UART_LSR);
++			const unsigned char fifo_empty_mask =
++						(UART_LSR_TEMT | UART_LSR_THRE);
++			if (((lsr & (UART_LSR_DR | fifo_empty_mask)) ==
++							fifo_empty_mask)) {
++				port->serial_out(port, UART_IER, 0);
++				port->serial_out(port, UART_MCR, 0);
++				serial8250_clear_and_reinit_fifos(up);
++				port->serial_out(port, UART_MCR, up->mcr);
++				port->serial_out(port, UART_IER, up->ier);
++				// clear interrupts
++				serial_port_in(port, UART_LSR);
++				serial_port_in(port, UART_RX);
++				serial_port_in(port, UART_IIR);
++				serial_port_in(port, UART_MSR);
++				up->lsr_saved_flags = 0;
++				up->msr_saved_flags = 0;
++			}
++		}
++#endif
+ 	} while (l != end);
+ 
+ 	spin_unlock(&i->lock);
diff --git a/target/linux/x86/64/config-6.6 b/target/linux/x86/64/config-6.6
index def4527f77180b..49e6890cd17a94 100644
--- a/target/linux/x86/64/config-6.6
+++ b/target/linux/x86/64/config-6.6
@@ -151,30 +151,6 @@ CONFIG_DRM_FBDEV_EMULATION=y
 CONFIG_DRM_FBDEV_OVERALLOC=100
 CONFIG_DRM_GEM_SHMEM_HELPER=y
 # CONFIG_DRM_HYPERV is not set
-CONFIG_DRM_I915=y
-CONFIG_DRM_I915_CAPTURE_ERROR=y
-CONFIG_DRM_I915_COMPRESS_ERROR=y
-# CONFIG_DRM_I915_DEBUG is not set
-# CONFIG_DRM_I915_DEBUG_GUC is not set
-# CONFIG_DRM_I915_DEBUG_MMIO is not set
-# CONFIG_DRM_I915_DEBUG_RUNTIME_PM is not set
-# CONFIG_DRM_I915_DEBUG_VBLANK_EVADE is not set
-CONFIG_DRM_I915_FENCE_TIMEOUT=10000
-CONFIG_DRM_I915_FORCE_PROBE=""
-CONFIG_DRM_I915_HEARTBEAT_INTERVAL=2500
-# CONFIG_DRM_I915_LOW_LEVEL_TRACEPOINTS is not set
-CONFIG_DRM_I915_MAX_REQUEST_BUSYWAIT=8000
-CONFIG_DRM_I915_PREEMPT_TIMEOUT=640
-CONFIG_DRM_I915_PREEMPT_TIMEOUT_COMPUTE=7500
-CONFIG_DRM_I915_REQUEST_TIMEOUT=20000
-# CONFIG_DRM_I915_SELFTEST is not set
-CONFIG_DRM_I915_STOP_TIMEOUT=100
-# CONFIG_DRM_I915_SW_FENCE_CHECK_DAG is not set
-# CONFIG_DRM_I915_SW_FENCE_DEBUG_OBJECTS is not set
-CONFIG_DRM_I915_TIMESLICE_DURATION=1
-CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND=250
-CONFIG_DRM_I915_USERPTR=y
-# CONFIG_DRM_I915_WERROR is not set
 CONFIG_DRM_KMS_HELPER=y
 CONFIG_DRM_MIPI_DSI=y
 CONFIG_DRM_PANEL=y
@@ -316,9 +292,6 @@ CONFIG_INTEL_IOMMU_PERF_EVENTS=y
 # CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON is not set
 # CONFIG_INTEL_IOMMU_SVM is not set
 # CONFIG_INTEL_IPS is not set
-# CONFIG_INTEL_MEI_GSC_PROXY is not set
-# CONFIG_INTEL_MEI_HDCP is not set
-# CONFIG_INTEL_MEI_PXP is not set
 CONFIG_INTEL_PCH_THERMAL=y
 # CONFIG_INTEL_SAR_INT1092 is not set
 # CONFIG_INTEL_SCU_PLATFORM is not set
@@ -372,6 +345,7 @@ CONFIG_MFD_CORE=y
 # CONFIG_MFD_INTEL_LPSS_ACPI is not set
 # CONFIG_MFD_INTEL_PMC_BXT is not set
 CONFIG_MMC=y
+CONFIG_MMCONF_FAM10H=y
 CONFIG_MMC_BLOCK=y
 CONFIG_MMC_CQHCI=y
 CONFIG_MMC_RICOH_MMC=y
@@ -431,7 +405,7 @@ CONFIG_PCIEPORTBUS=y
 CONFIG_PCIE_PME=y
 CONFIG_PCI_HYPERV=y
 CONFIG_PCI_HYPERV_INTERFACE=y
-# CONFIG_PCI_MMCONFIG is not set
+CONFIG_PCI_MMCONFIG=y
 CONFIG_PCI_PASID=y
 CONFIG_PCI_PRI=y
 CONFIG_PCI_XEN=y
diff --git a/target/linux/x86/base-files/etc/board.d/02_network b/target/linux/x86/base-files/etc/board.d/02_network
index dc744db05d6315..b3d1855764be11 100644
--- a/target/linux/x86/base-files/etc/board.d/02_network
+++ b/target/linux/x86/base-files/etc/board.d/02_network
@@ -58,7 +58,7 @@ gowin-solution-co-ltd-gw-mb-u01)
 		ucidef_set_network_device_path_port "sfp2" "$sfp_device/$sfp_port" "0"
 	fi
 
-	ucidef_set_interface_lan "eth1 eth2 eth3 eth4"
+	ucidef_set_interfaces_lan_wan "eth1 eth2 eth3 eth4 poe" "sfp1 sfp2"
 	;;
 pc-engines-apu1|pc-engines-apu2|pc-engines-apu3)
 	ucidef_set_interfaces_lan_wan "eth1 eth2" "eth0"
diff --git a/target/linux/x86/config-6.6 b/target/linux/x86/config-6.6
index b8d38e60fa372c..4a852287e7477c 100644
--- a/target/linux/x86/config-6.6
+++ b/target/linux/x86/config-6.6
@@ -33,8 +33,6 @@ CONFIG_BLK_DEV_SD=y
 CONFIG_BLK_MQ_PCI=y
 CONFIG_BOUNCE=y
 CONFIG_BUFFER_HEAD=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKBLD_I8253=y
 CONFIG_CLKEVT_I8253=y
 CONFIG_CLKSRC_I8253=y
@@ -48,6 +46,7 @@ CONFIG_COMPAT_32=y
 CONFIG_COMPAT_32BIT_TIME=y
 # CONFIG_COMPAT_VDSO is not set
 CONFIG_CONSOLE_TRANSLATIONS=y
+# CONFIG_CONTEXT_TRACKING_USER_FORCE is not set
 # CONFIG_CPU5_WDT is not set
 CONFIG_CPU_FREQ=y
 CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y
@@ -61,7 +60,10 @@ CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
 # CONFIG_CPU_FREQ_GOV_USERSPACE is not set
 CONFIG_CPU_FREQ_STAT=y
 CONFIG_CPU_IDLE=y
+CONFIG_CPU_IDLE_GOV_HALTPOLL=y
 CONFIG_CPU_IDLE_GOV_LADDER=y
+CONFIG_CPU_IDLE_GOV_MENU=y
+CONFIG_CPU_IDLE_GOV_TEO=y
 CONFIG_CPU_MITIGATIONS=y
 CONFIG_CPU_SUP_AMD=y
 CONFIG_CPU_SUP_CENTAUR=y
@@ -133,7 +135,6 @@ CONFIG_FUSION_MAX_SGE=128
 CONFIG_FUSION_SPI=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC11_NO_ARRAY_BOUNDS=y
 CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND=y
 # CONFIG_GDS_FORCE_MITIGATION is not set
 CONFIG_GENERIC_ALLOCATOR=y
@@ -180,7 +181,6 @@ CONFIG_HW_RANDOM=y
 CONFIG_HW_RANDOM_GEODE=y
 CONFIG_HW_RANDOM_VIA=y
 # CONFIG_HYPERVISOR_GUEST is not set
-CONFIG_HZ_PERIODIC=y
 CONFIG_I8253_LOCK=y
 CONFIG_IA32_FEAT_CTL=y
 # CONFIG_IB700_WDT is not set
@@ -239,8 +239,12 @@ CONFIG_M686=y
 # CONFIG_MGEODEGX1 is not set
 # CONFIG_MGEODE_LX is not set
 CONFIG_MICROCODE=y
+CONFIG_MICROCODE_INITRD32=y
+CONFIG_MICROCODE_LATE_FORCE_MINREV=y
 CONFIG_MICROCODE_LATE_LOADING=y
 CONFIG_MIGRATION=y
+CONFIG_MITIGATION_ITS=y
+CONFIG_MITIGATION_TSA=y
 CONFIG_MITIGATION_RFDS=y
 CONFIG_MITIGATION_SPECTRE_BHI=y
 # CONFIG_MK6 is not set
@@ -275,6 +279,9 @@ CONFIG_NET_XGRESS=y
 CONFIG_NLS=y
 # CONFIG_NMI_CHECK_CPU is not set
 # CONFIG_NOHIGHMEM is not set
+CONFIG_NO_HZ=y
+CONFIG_NO_HZ_COMMON=y
+CONFIG_NO_HZ_FULL=y
 CONFIG_NR_CPUS=1
 CONFIG_NR_CPUS_DEFAULT=1
 CONFIG_NR_CPUS_RANGE_BEGIN=1
@@ -330,6 +337,8 @@ CONFIG_PTP_1588_CLOCK_OPTIONAL=y
 # CONFIG_PUNIT_ATOM_DEBUG is not set
 CONFIG_RANDSTRUCT_NONE=y
 CONFIG_RATIONAL=y
+CONFIG_RCU_LAZY=y
+# CONFIG_RCU_NOCB_CPU_DEFAULT_ALL is not set
 CONFIG_RD_BZIP2=y
 CONFIG_RD_GZIP=y
 CONFIG_RETHUNK=y
diff --git a/target/linux/x86/generic/config-6.6 b/target/linux/x86/generic/config-6.6
index 091584e0774aa8..404e3ac330d5c1 100644
--- a/target/linux/x86/generic/config-6.6
+++ b/target/linux/x86/generic/config-6.6
@@ -86,30 +86,6 @@ CONFIG_DRM_FBDEV_EMULATION=y
 CONFIG_DRM_FBDEV_OVERALLOC=100
 CONFIG_DRM_GEM_SHMEM_HELPER=y
 # CONFIG_DRM_HYPERV is not set
-CONFIG_DRM_I915=y
-CONFIG_DRM_I915_CAPTURE_ERROR=y
-CONFIG_DRM_I915_COMPRESS_ERROR=y
-# CONFIG_DRM_I915_DEBUG is not set
-# CONFIG_DRM_I915_DEBUG_GUC is not set
-# CONFIG_DRM_I915_DEBUG_MMIO is not set
-# CONFIG_DRM_I915_DEBUG_RUNTIME_PM is not set
-# CONFIG_DRM_I915_DEBUG_VBLANK_EVADE is not set
-CONFIG_DRM_I915_FENCE_TIMEOUT=10000
-CONFIG_DRM_I915_FORCE_PROBE=""
-CONFIG_DRM_I915_HEARTBEAT_INTERVAL=2500
-# CONFIG_DRM_I915_LOW_LEVEL_TRACEPOINTS is not set
-CONFIG_DRM_I915_MAX_REQUEST_BUSYWAIT=8000
-CONFIG_DRM_I915_PREEMPT_TIMEOUT=640
-CONFIG_DRM_I915_PREEMPT_TIMEOUT_COMPUTE=7500
-CONFIG_DRM_I915_REQUEST_TIMEOUT=20000
-# CONFIG_DRM_I915_SELFTEST is not set
-CONFIG_DRM_I915_STOP_TIMEOUT=100
-# CONFIG_DRM_I915_SW_FENCE_CHECK_DAG is not set
-# CONFIG_DRM_I915_SW_FENCE_DEBUG_OBJECTS is not set
-CONFIG_DRM_I915_TIMESLICE_DURATION=1
-CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND=250
-CONFIG_DRM_I915_USERPTR=y
-# CONFIG_DRM_I915_WERROR is not set
 CONFIG_DRM_KMS_HELPER=y
 CONFIG_DRM_MIPI_DSI=y
 CONFIG_DRM_PANEL=y
@@ -235,9 +211,6 @@ CONFIG_INPUT_XEN_KBDDEV_FRONTEND=y
 CONFIG_INTEL_GTT=y
 CONFIG_INTEL_IDLE=y
 # CONFIG_INTEL_IPS is not set
-# CONFIG_INTEL_MEI_GSC_PROXY is not set
-# CONFIG_INTEL_MEI_HDCP is not set
-# CONFIG_INTEL_MEI_PXP is not set
 CONFIG_INTEL_PCH_THERMAL=y
 # CONFIG_INTEL_SAR_INT1092 is not set
 # CONFIG_INTEL_SCU_PLATFORM is not set
diff --git a/target/linux/x86/image/64.mk b/target/linux/x86/image/64.mk
index 7bc79006d348bc..88c0248b58ffd4 100644
--- a/target/linux/x86/image/64.mk
+++ b/target/linux/x86/image/64.mk
@@ -4,7 +4,7 @@ define Device/generic
   DEVICE_PACKAGES += \
 	kmod-amazon-ena kmod-amd-xgbe kmod-bnx2 kmod-dwmac-intel kmod-e1000e kmod-e1000 \
 	kmod-forcedeth kmod-fs-vfat kmod-igb kmod-igc kmod-ixgbe kmod-r8169 \
-	kmod-tg3
+	kmod-tg3 kmod-drm-i915
   GRUB2_VARIANT := generic
 endef
 TARGET_DEVICES += generic
diff --git a/target/linux/x86/image/generic.mk b/target/linux/x86/image/generic.mk
index e9545fbf319123..f8dd15ed3696fb 100644
--- a/target/linux/x86/image/generic.mk
+++ b/target/linux/x86/image/generic.mk
@@ -3,7 +3,8 @@ define Device/generic
   DEVICE_MODEL := x86
   DEVICE_PACKAGES += kmod-3c59x kmod-8139too kmod-e100 kmod-e1000 kmod-natsemi \
 	kmod-ne2k-pci kmod-pcnet32 kmod-r8169 kmod-sis900 kmod-tg3 \
-	kmod-via-rhine kmod-via-velocity kmod-forcedeth kmod-fs-vfat
+	kmod-via-rhine kmod-via-velocity kmod-forcedeth kmod-fs-vfat \
+	kmod-drm-i915
   GRUB2_VARIANT := generic
 endef
 TARGET_DEVICES += generic
diff --git a/target/linux/x86/image/legacy.mk b/target/linux/x86/image/legacy.mk
index 6c0d8e78f9ab57..cf65a542f000e1 100644
--- a/target/linux/x86/image/legacy.mk
+++ b/target/linux/x86/image/legacy.mk
@@ -3,7 +3,8 @@ define Device/generic
   DEVICE_MODEL := x86/legacy
   DEVICE_PACKAGES += kmod-3c59x kmod-8139too kmod-e100 kmod-e1000 \
 	kmod-natsemi kmod-ne2k-pci kmod-pcnet32 kmod-r8169 kmod-sis900 \
-	kmod-tg3 kmod-via-rhine kmod-via-velocity kmod-forcedeth
+	kmod-tg3 kmod-via-rhine kmod-via-velocity kmod-forcedeth \
+	kmod-drm-i915
   GRUB2_VARIANT := legacy
 endef
 TARGET_DEVICES += generic
diff --git a/target/linux/x86/legacy/config-6.6 b/target/linux/x86/legacy/config-6.6
index 8ce9237a21dfe5..bc7e74ac3f0e57 100644
--- a/target/linux/x86/legacy/config-6.6
+++ b/target/linux/x86/legacy/config-6.6
@@ -67,30 +67,6 @@ CONFIG_DRM_DISPLAY_HELPER=y
 CONFIG_DRM_EXEC=y
 CONFIG_DRM_FBDEV_EMULATION=y
 CONFIG_DRM_FBDEV_OVERALLOC=100
-CONFIG_DRM_I915=y
-CONFIG_DRM_I915_CAPTURE_ERROR=y
-CONFIG_DRM_I915_COMPRESS_ERROR=y
-# CONFIG_DRM_I915_DEBUG is not set
-# CONFIG_DRM_I915_DEBUG_GUC is not set
-# CONFIG_DRM_I915_DEBUG_MMIO is not set
-# CONFIG_DRM_I915_DEBUG_RUNTIME_PM is not set
-# CONFIG_DRM_I915_DEBUG_VBLANK_EVADE is not set
-CONFIG_DRM_I915_FENCE_TIMEOUT=10000
-CONFIG_DRM_I915_FORCE_PROBE=""
-CONFIG_DRM_I915_HEARTBEAT_INTERVAL=2500
-# CONFIG_DRM_I915_LOW_LEVEL_TRACEPOINTS is not set
-CONFIG_DRM_I915_MAX_REQUEST_BUSYWAIT=8000
-CONFIG_DRM_I915_PREEMPT_TIMEOUT=640
-CONFIG_DRM_I915_PREEMPT_TIMEOUT_COMPUTE=7500
-CONFIG_DRM_I915_REQUEST_TIMEOUT=20000
-# CONFIG_DRM_I915_SELFTEST is not set
-CONFIG_DRM_I915_STOP_TIMEOUT=100
-# CONFIG_DRM_I915_SW_FENCE_CHECK_DAG is not set
-# CONFIG_DRM_I915_SW_FENCE_DEBUG_OBJECTS is not set
-CONFIG_DRM_I915_TIMESLICE_DURATION=1
-CONFIG_DRM_I915_USERFAULT_AUTOSUSPEND=250
-CONFIG_DRM_I915_USERPTR=y
-# CONFIG_DRM_I915_WERROR is not set
 CONFIG_DRM_KMS_HELPER=y
 CONFIG_DRM_MIPI_DSI=y
 CONFIG_DRM_PANEL=y
@@ -153,9 +129,6 @@ CONFIG_INPUT_MOUSEDEV_SCREEN_Y=768
 CONFIG_INTEL_GTT=y
 CONFIG_INTEL_IDLE=y
 # CONFIG_INTEL_IPS is not set
-# CONFIG_INTEL_MEI_GSC_PROXY is not set
-# CONFIG_INTEL_MEI_HDCP is not set
-# CONFIG_INTEL_MEI_PXP is not set
 # CONFIG_INTEL_SAR_INT1092 is not set
 # CONFIG_INTEL_SCU_PLATFORM is not set
 # CONFIG_INTEL_SOC_DTS_THERMAL is not set
diff --git a/target/linux/x86/patches-6.6/103-pcengines_apu6_platform.patch b/target/linux/x86/patches-6.6/103-pcengines_apu6_platform.patch
index 1fd6fc89c88131..4c22d0bb02ba65 100644
--- a/target/linux/x86/patches-6.6/103-pcengines_apu6_platform.patch
+++ b/target/linux/x86/patches-6.6/103-pcengines_apu6_platform.patch
@@ -63,7 +63,7 @@ Sighed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
  
 --- a/drivers/platform/x86/Kconfig
 +++ b/drivers/platform/x86/Kconfig
-@@ -707,7 +707,7 @@ config XO1_RFKILL
+@@ -708,7 +708,7 @@ config XO1_RFKILL
  	  laptop.
  
  config PCENGINES_APU2
@@ -72,7 +72,7 @@ Sighed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
  	depends on INPUT && INPUT_KEYBOARD && GPIOLIB
  	depends on LEDS_CLASS
  	select GPIO_AMD_FCH
-@@ -715,7 +715,7 @@ config PCENGINES_APU2
+@@ -716,7 +716,7 @@ config PCENGINES_APU2
  	select LEDS_GPIO
  	help
  	  This driver provides support for the front button and LEDs on
diff --git a/target/linux/zynq/config-6.6 b/target/linux/zynq/config-6.6
index 15716a12cdbc75..69a31d254b7759 100644
--- a/target/linux/zynq/config-6.6
+++ b/target/linux/zynq/config-6.6
@@ -59,8 +59,6 @@ CONFIG_CACHE_L2X0=y
 CONFIG_CADENCE_TTC_TIMER=y
 CONFIG_CADENCE_WATCHDOG=y
 CONFIG_CC_HAVE_STACKPROTECTOR_TLS=y
-CONFIG_CC_IMPLICIT_FALLTHROUGH="-Wimplicit-fallthrough=5"
-CONFIG_CC_NO_ARRAY_BOUNDS=y
 CONFIG_CLKSRC_ARM_GLOBAL_TIMER_SCHED_CLOCK=y
 CONFIG_CLKSRC_MMIO=y
 CONFIG_CLKSRC_VERSATILE=y
@@ -191,7 +189,6 @@ CONFIG_FWNODE_MDIO=y
 CONFIG_FW_CACHE=y
 CONFIG_FW_LOADER_PAGED_BUF=y
 CONFIG_FW_LOADER_SYSFS=y
-CONFIG_GCC10_NO_ARRAY_BOUNDS=y
 CONFIG_GENERIC_ALLOCATOR=y
 CONFIG_GENERIC_ARCH_TOPOLOGY=y
 CONFIG_GENERIC_BUG=y
diff --git a/target/sdk/Config.in b/target/sdk/Config.in
index 1984e242e721b5..9fee5abdc36c51 100644
--- a/target/sdk/Config.in
+++ b/target/sdk/Config.in
@@ -10,6 +10,7 @@ config SDK
 config SDK_LLVM_BPF
 	bool "Build the LLVM-BPF toolchain tarball"
 	depends on BPF_TOOLCHAIN_BUILD_LLVM
+	select NEED_BPF_TOOLCHAIN
 	default BUILDBOT
 	help
 	  This is a tarball of the precompiled LLVM toolchain suitable
diff --git a/toolchain/Config.in b/toolchain/Config.in
index b4ba5b3b677cf9..71ebbeb47bf2a0 100644
--- a/toolchain/Config.in
+++ b/toolchain/Config.in
@@ -40,9 +40,8 @@ menuconfig TARGET_OPTIONS
 
 	choice BPF_TOOLCHAIN
 		prompt "BPF toolchain" if DEVEL
-		default BPF_TOOLCHAIN_BUILD_LLVM if BUILDBOT
 		default BPF_TOOLCHAIN_PREBUILT if HAS_PREBUILT_LLVM_TOOLCHAIN
-		default BPF_TOOLCHAIN_NONE
+		default BPF_TOOLCHAIN_BUILD_LLVM
 
 		config BPF_TOOLCHAIN_NONE
 			bool "None"
@@ -57,7 +56,7 @@ menuconfig TARGET_OPTIONS
 			bool "Use host LLVM toolchain"
 
 		config BPF_TOOLCHAIN_BUILD_LLVM
-			select USE_LLVM_BUILD
+			select USE_LLVM_BUILD if NEED_BPF_TOOLCHAIN
 			bool "Build LLVM toolchain for eBPF"
 			help
 			  If enabled, a LLVM toolchain for building eBPF binaries will be built.
@@ -320,23 +319,24 @@ config GDB_PYTHON
 	  Enable the python bindings for GDB to allow using python in the gdb shell.
 
 config HAS_BPF_TOOLCHAIN
+	default y if !BPF_TOOLCHAIN_NONE
+	bool
+
+config NEED_BPF_TOOLCHAIN
 	bool
 
 config HAS_PREBUILT_LLVM_TOOLCHAIN
 	def_bool $(shell, [ -f llvm-bpf/.llvm-version ] && echo y || echo n)
 
 config USE_LLVM_HOST
-	select HAS_BPF_TOOLCHAIN
 	bool
 
 config USE_LLVM_PREBUILT
-	select HAS_BPF_TOOLCHAIN
 	default y if !DEVEL && !BUILDBOT && HAS_PREBUILT_LLVM_TOOLCHAIN
 	bool
 
 config USE_LLVM_BUILD
-	default y if !DEVEL && BUILDBOT
-	select HAS_BPF_TOOLCHAIN
+	default y if !DEVEL && NEED_BPF_TOOLCHAIN && (BUILDBOT || !HAS_PREBUILT_LLVM_TOOLCHAIN)
 	bool
 
 config USE_GLIBC
diff --git a/toolchain/binutils/patches/2.40/050-PR-32372-opcodes-fix-std-gnu23-compatibility-wrt-static_asser.patch b/toolchain/binutils/patches/2.40/050-PR-32372-opcodes-fix-std-gnu23-compatibility-wrt-static_asser.patch
new file mode 100644
index 00000000000000..3364e9ae04cf53
--- /dev/null
+++ b/toolchain/binutils/patches/2.40/050-PR-32372-opcodes-fix-std-gnu23-compatibility-wrt-static_asser.patch
@@ -0,0 +1,66 @@
+From 8ebe62f3f0d27806b1bf69f301f5e188b4acd2b4 Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Sat, 16 Nov 2024 05:03:52 +0000
+Subject: [PATCH] opcodes: fix -std=gnu23 compatibility wrt static_assert
+
+static_assert is declared in C23 so we can't reuse that identifier:
+* Define our own static_assert conditionally;
+
+* Rename "static assert" hacks to _N as we do already in some places
+  to avoid a conflict.
+
+ChangeLog:
+	PR ld/32372
+
+        * i386-gen.c (static_assert): Define conditionally.
+        * mips-formats.h (MAPPED_INT): Rename identifier.
+        (MAPPED_REG): Rename identifier.
+        (OPTIONAL_MAPPED_REG): Rename identifier.
+        * s390-opc.c (static_assert): Define conditionally.
+---
+ opcodes/i386-gen.c     | 2 ++
+ opcodes/mips-formats.h | 6 +++---
+ opcodes/s390-opc.c     | 2 ++
+ 3 files changed, 7 insertions(+), 3 deletions(-)
+
+--- a/opcodes/i386-gen.c
++++ b/opcodes/i386-gen.c
+@@ -33,7 +33,9 @@
+ 
+ /* Build-time checks are preferrable over runtime ones.  Use this construct
+    in preference where possible.  */
++#ifndef static_assert
+ #define static_assert(e) ((void)sizeof (struct { int _:1 - 2 * !(e); }))
++#endif
+ 
+ static const char *program_name = NULL;
+ static int debug = 0;
+--- a/opcodes/mips-formats.h
++++ b/opcodes/mips-formats.h
+@@ -49,7 +49,7 @@
+ #define MAPPED_INT(SIZE, LSB, MAP, PRINT_HEX) \
+   { \
+     typedef char ATTRIBUTE_UNUSED \
+-      static_assert[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
++      static_assert_3[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
+     static const struct mips_mapped_int_operand op = { \
+       { OP_MAPPED_INT, SIZE, LSB }, MAP, PRINT_HEX \
+     }; \
+@@ -83,7 +83,7 @@
+ #define MAPPED_REG(SIZE, LSB, BANK, MAP) \
+   { \
+     typedef char ATTRIBUTE_UNUSED \
+-      static_assert[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
++      static_assert_4[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
+     static const struct mips_reg_operand op = { \
+       { OP_REG, SIZE, LSB }, OP_REG_##BANK, MAP \
+     }; \
+@@ -93,7 +93,7 @@
+ #define OPTIONAL_MAPPED_REG(SIZE, LSB, BANK, MAP) \
+   { \
+     typedef char ATTRIBUTE_UNUSED \
+-      static_assert[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
++      static_assert_5[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
+     static const struct mips_reg_operand op = { \
+       { OP_OPTIONAL_REG, SIZE, LSB }, OP_REG_##BANK, MAP \
+     }; \
diff --git a/toolchain/binutils/patches/2.42/003-PR-32372-opcodes-fix-std-gnu23-compatibility-wrt-static_asser.patch b/toolchain/binutils/patches/2.42/003-PR-32372-opcodes-fix-std-gnu23-compatibility-wrt-static_asser.patch
new file mode 100644
index 00000000000000..9454f3fa9f2374
--- /dev/null
+++ b/toolchain/binutils/patches/2.42/003-PR-32372-opcodes-fix-std-gnu23-compatibility-wrt-static_asser.patch
@@ -0,0 +1,78 @@
+From 8ebe62f3f0d27806b1bf69f301f5e188b4acd2b4 Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Sat, 16 Nov 2024 05:03:52 +0000
+Subject: [PATCH] opcodes: fix -std=gnu23 compatibility wrt static_assert
+
+static_assert is declared in C23 so we can't reuse that identifier:
+* Define our own static_assert conditionally;
+
+* Rename "static assert" hacks to _N as we do already in some places
+  to avoid a conflict.
+
+ChangeLog:
+	PR ld/32372
+
+        * i386-gen.c (static_assert): Define conditionally.
+        * mips-formats.h (MAPPED_INT): Rename identifier.
+        (MAPPED_REG): Rename identifier.
+        (OPTIONAL_MAPPED_REG): Rename identifier.
+        * s390-opc.c (static_assert): Define conditionally.
+---
+ opcodes/i386-gen.c     | 2 ++
+ opcodes/mips-formats.h | 6 +++---
+ opcodes/s390-opc.c     | 2 ++
+ 3 files changed, 7 insertions(+), 3 deletions(-)
+
+--- a/opcodes/i386-gen.c
++++ b/opcodes/i386-gen.c
+@@ -30,7 +30,9 @@
+ 
+ /* Build-time checks are preferrable over runtime ones.  Use this construct
+    in preference where possible.  */
++#ifndef static_assert
+ #define static_assert(e) ((void)sizeof (struct { int _:1 - 2 * !(e); }))
++#endif
+ 
+ static const char *program_name = NULL;
+ static int debug = 0;
+--- a/opcodes/mips-formats.h
++++ b/opcodes/mips-formats.h
+@@ -49,7 +49,7 @@
+ #define MAPPED_INT(SIZE, LSB, MAP, PRINT_HEX) \
+   { \
+     typedef char ATTRIBUTE_UNUSED \
+-      static_assert[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
++      static_assert_3[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
+     static const struct mips_mapped_int_operand op = { \
+       { OP_MAPPED_INT, SIZE, LSB }, MAP, PRINT_HEX \
+     }; \
+@@ -83,7 +83,7 @@
+ #define MAPPED_REG(SIZE, LSB, BANK, MAP) \
+   { \
+     typedef char ATTRIBUTE_UNUSED \
+-      static_assert[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
++      static_assert_4[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
+     static const struct mips_reg_operand op = { \
+       { OP_REG, SIZE, LSB }, OP_REG_##BANK, MAP \
+     }; \
+@@ -93,7 +93,7 @@
+ #define OPTIONAL_MAPPED_REG(SIZE, LSB, BANK, MAP) \
+   { \
+     typedef char ATTRIBUTE_UNUSED \
+-      static_assert[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
++      static_assert_5[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
+     static const struct mips_reg_operand op = { \
+       { OP_OPTIONAL_REG, SIZE, LSB }, OP_REG_##BANK, MAP \
+     }; \
+--- a/opcodes/s390-opc.c
++++ b/opcodes/s390-opc.c
+@@ -36,7 +36,9 @@
+ 
+ /* Build-time checks are preferrable over runtime ones.  Use this construct
+    in preference where possible.  */
++#ifndef static_assert
+ #define static_assert(e) ((void)sizeof (struct { int _:1 - 2 * !(e); }))
++#endif
+ 
+ #define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
+ 
diff --git a/toolchain/binutils/patches/2.43.1/003-PR-32372-opcodes-fix-std-gnu23-compatibility-wrt-static_asser.patch b/toolchain/binutils/patches/2.43.1/003-PR-32372-opcodes-fix-std-gnu23-compatibility-wrt-static_asser.patch
new file mode 100644
index 00000000000000..9454f3fa9f2374
--- /dev/null
+++ b/toolchain/binutils/patches/2.43.1/003-PR-32372-opcodes-fix-std-gnu23-compatibility-wrt-static_asser.patch
@@ -0,0 +1,78 @@
+From 8ebe62f3f0d27806b1bf69f301f5e188b4acd2b4 Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Sat, 16 Nov 2024 05:03:52 +0000
+Subject: [PATCH] opcodes: fix -std=gnu23 compatibility wrt static_assert
+
+static_assert is declared in C23 so we can't reuse that identifier:
+* Define our own static_assert conditionally;
+
+* Rename "static assert" hacks to _N as we do already in some places
+  to avoid a conflict.
+
+ChangeLog:
+	PR ld/32372
+
+        * i386-gen.c (static_assert): Define conditionally.
+        * mips-formats.h (MAPPED_INT): Rename identifier.
+        (MAPPED_REG): Rename identifier.
+        (OPTIONAL_MAPPED_REG): Rename identifier.
+        * s390-opc.c (static_assert): Define conditionally.
+---
+ opcodes/i386-gen.c     | 2 ++
+ opcodes/mips-formats.h | 6 +++---
+ opcodes/s390-opc.c     | 2 ++
+ 3 files changed, 7 insertions(+), 3 deletions(-)
+
+--- a/opcodes/i386-gen.c
++++ b/opcodes/i386-gen.c
+@@ -30,7 +30,9 @@
+ 
+ /* Build-time checks are preferrable over runtime ones.  Use this construct
+    in preference where possible.  */
++#ifndef static_assert
+ #define static_assert(e) ((void)sizeof (struct { int _:1 - 2 * !(e); }))
++#endif
+ 
+ static const char *program_name = NULL;
+ static int debug = 0;
+--- a/opcodes/mips-formats.h
++++ b/opcodes/mips-formats.h
+@@ -49,7 +49,7 @@
+ #define MAPPED_INT(SIZE, LSB, MAP, PRINT_HEX) \
+   { \
+     typedef char ATTRIBUTE_UNUSED \
+-      static_assert[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
++      static_assert_3[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
+     static const struct mips_mapped_int_operand op = { \
+       { OP_MAPPED_INT, SIZE, LSB }, MAP, PRINT_HEX \
+     }; \
+@@ -83,7 +83,7 @@
+ #define MAPPED_REG(SIZE, LSB, BANK, MAP) \
+   { \
+     typedef char ATTRIBUTE_UNUSED \
+-      static_assert[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
++      static_assert_4[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
+     static const struct mips_reg_operand op = { \
+       { OP_REG, SIZE, LSB }, OP_REG_##BANK, MAP \
+     }; \
+@@ -93,7 +93,7 @@
+ #define OPTIONAL_MAPPED_REG(SIZE, LSB, BANK, MAP) \
+   { \
+     typedef char ATTRIBUTE_UNUSED \
+-      static_assert[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
++      static_assert_5[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
+     static const struct mips_reg_operand op = { \
+       { OP_OPTIONAL_REG, SIZE, LSB }, OP_REG_##BANK, MAP \
+     }; \
+--- a/opcodes/s390-opc.c
++++ b/opcodes/s390-opc.c
+@@ -36,7 +36,9 @@
+ 
+ /* Build-time checks are preferrable over runtime ones.  Use this construct
+    in preference where possible.  */
++#ifndef static_assert
+ #define static_assert(e) ((void)sizeof (struct { int _:1 - 2 * !(e); }))
++#endif
+ 
+ #define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
+ 
diff --git a/toolchain/gcc/patches-11.x/800-arm_v5te_no_ldrd_strd.patch b/toolchain/gcc/patches-11.x/800-arm_v5te_no_ldrd_strd.patch
new file mode 100644
index 00000000000000..e83cb1bebbb34b
--- /dev/null
+++ b/toolchain/gcc/patches-11.x/800-arm_v5te_no_ldrd_strd.patch
@@ -0,0 +1,11 @@
+--- a/gcc/config/arm/arm.h
++++ b/gcc/config/arm/arm.h
+@@ -165,7 +165,7 @@ emission of floating point pcs attribute
+ /* Thumb-1 only.  */
+ #define TARGET_THUMB1_ONLY		(TARGET_THUMB1 && !arm_arch_notm)
+ 
+-#define TARGET_LDRD			(arm_arch5te && ARM_DOUBLEWORD_ALIGN \
++#define TARGET_LDRD			(arm_arch6 && ARM_DOUBLEWORD_ALIGN \
+                                          && !TARGET_THUMB1)
+ 
+ #define TARGET_CRC32			(arm_arch_crc)
diff --git a/toolchain/gcc/patches-11.x/980-fix-build-error-with-Xcode-16.3.patch b/toolchain/gcc/patches-11.x/980-fix-build-error-with-Xcode-16.3.patch
new file mode 100644
index 00000000000000..3f4cdd57261cb2
--- /dev/null
+++ b/toolchain/gcc/patches-11.x/980-fix-build-error-with-Xcode-16.3.patch
@@ -0,0 +1,52 @@
+From 93954654b87552c4fe0273cab99d0f42f213f7f8 Mon Sep 17 00:00:00 2001
+From: Georgi Valkov <gvalkov@gmail.com>
+Date: Mon, 14 Apr 2025 15:45:59 +0300
+Subject: [PATCH] zlib: fix build error with Xcode 16.3
+
+Xcode 16.3 defines TARGET_OS_MAC, it was not defined in prior versions.
+zutil.h conditionally defines fdopen as NULL when this macro is defined,
+resulting in the following build error:
+
+/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include/_stdio.h:318:7: error: expected identifier or '('
+  318 | FILE    *fdopen(int, const char *) __DARWIN_ALIAS_STARTING(__MAC_10_6, __IPHONE_2_0, __DARWIN_ALIAS(fdopen));
+      |          ^
+./zutil.h:147:33: note: expanded from macro 'fdopen'
+  147 | #        define fdopen(fd,mode) NULL /* No fdopen() */
+
+In Xcode 16.2 and earlier, TARGET_OS_MAC was not defined so this entire
+block was ignored, gcc and gdb used to compile and work fine.
+
+This may have been used for compatibility with older versions of macOS,
+but is no longer needed. By pure luck, the build worked fine for a long
+time, because it did not properly detect macOS.
+Fixed by removing the check for TARGET_OS_MAC.
+
+Note that since Xcode 16.3, an entire set of TARGET_OS macros
+are now defined, most of which are set to 0:
+TARGET_OS_LINUX 0
+TARGET_OS_MAC 1
+TARGET_OS_OSX 1
+
+[1] https://github.com/openwrt/openwrt/pull/18467
+
+Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
+---
+ zlib/zutil.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/zlib/zutil.h b/zlib/zutil.h
+index 4b596adf629..9ea8d840643 100644
+--- a/zlib/zutil.h
++++ b/zlib/zutil.h
+@@ -130,7 +130,7 @@ extern z_const char * const z_errmsg[10]; /* indexed by 2-zlib_error */
+ #  endif
+ #endif
+ 
+-#if defined(MACOS) || defined(TARGET_OS_MAC)
++#if defined(MACOS)
+ #  define OS_CODE  7
+ #  ifndef Z_SOLO
+ #    if defined(__MWERKS__) && __dest_os != __be_os && __dest_os != __win32_os
+-- 
+2.49.0
+
diff --git a/toolchain/gcc/patches-12.x/800-arm_v5te_no_ldrd_strd.patch b/toolchain/gcc/patches-12.x/800-arm_v5te_no_ldrd_strd.patch
new file mode 100644
index 00000000000000..e83cb1bebbb34b
--- /dev/null
+++ b/toolchain/gcc/patches-12.x/800-arm_v5te_no_ldrd_strd.patch
@@ -0,0 +1,11 @@
+--- a/gcc/config/arm/arm.h
++++ b/gcc/config/arm/arm.h
+@@ -165,7 +165,7 @@ emission of floating point pcs attribute
+ /* Thumb-1 only.  */
+ #define TARGET_THUMB1_ONLY		(TARGET_THUMB1 && !arm_arch_notm)
+ 
+-#define TARGET_LDRD			(arm_arch5te && ARM_DOUBLEWORD_ALIGN \
++#define TARGET_LDRD			(arm_arch6 && ARM_DOUBLEWORD_ALIGN \
+                                          && !TARGET_THUMB1)
+ 
+ #define TARGET_CRC32			(arm_arch_crc)
diff --git a/toolchain/gcc/patches-12.x/980-fix-build-error-with-Xcode-16.3.patch b/toolchain/gcc/patches-12.x/980-fix-build-error-with-Xcode-16.3.patch
new file mode 100644
index 00000000000000..3f4cdd57261cb2
--- /dev/null
+++ b/toolchain/gcc/patches-12.x/980-fix-build-error-with-Xcode-16.3.patch
@@ -0,0 +1,52 @@
+From 93954654b87552c4fe0273cab99d0f42f213f7f8 Mon Sep 17 00:00:00 2001
+From: Georgi Valkov <gvalkov@gmail.com>
+Date: Mon, 14 Apr 2025 15:45:59 +0300
+Subject: [PATCH] zlib: fix build error with Xcode 16.3
+
+Xcode 16.3 defines TARGET_OS_MAC, it was not defined in prior versions.
+zutil.h conditionally defines fdopen as NULL when this macro is defined,
+resulting in the following build error:
+
+/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include/_stdio.h:318:7: error: expected identifier or '('
+  318 | FILE    *fdopen(int, const char *) __DARWIN_ALIAS_STARTING(__MAC_10_6, __IPHONE_2_0, __DARWIN_ALIAS(fdopen));
+      |          ^
+./zutil.h:147:33: note: expanded from macro 'fdopen'
+  147 | #        define fdopen(fd,mode) NULL /* No fdopen() */
+
+In Xcode 16.2 and earlier, TARGET_OS_MAC was not defined so this entire
+block was ignored, gcc and gdb used to compile and work fine.
+
+This may have been used for compatibility with older versions of macOS,
+but is no longer needed. By pure luck, the build worked fine for a long
+time, because it did not properly detect macOS.
+Fixed by removing the check for TARGET_OS_MAC.
+
+Note that since Xcode 16.3, an entire set of TARGET_OS macros
+are now defined, most of which are set to 0:
+TARGET_OS_LINUX 0
+TARGET_OS_MAC 1
+TARGET_OS_OSX 1
+
+[1] https://github.com/openwrt/openwrt/pull/18467
+
+Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
+---
+ zlib/zutil.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/zlib/zutil.h b/zlib/zutil.h
+index 4b596adf629..9ea8d840643 100644
+--- a/zlib/zutil.h
++++ b/zlib/zutil.h
+@@ -130,7 +130,7 @@ extern z_const char * const z_errmsg[10]; /* indexed by 2-zlib_error */
+ #  endif
+ #endif
+ 
+-#if defined(MACOS) || defined(TARGET_OS_MAC)
++#if defined(MACOS)
+ #  define OS_CODE  7
+ #  ifndef Z_SOLO
+ #    if defined(__MWERKS__) && __dest_os != __be_os && __dest_os != __win32_os
+-- 
+2.49.0
+
diff --git a/toolchain/gcc/patches-13.x/800-arm_v5te_no_ldrd_strd.patch b/toolchain/gcc/patches-13.x/800-arm_v5te_no_ldrd_strd.patch
new file mode 100644
index 00000000000000..e83cb1bebbb34b
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/800-arm_v5te_no_ldrd_strd.patch
@@ -0,0 +1,11 @@
+--- a/gcc/config/arm/arm.h
++++ b/gcc/config/arm/arm.h
+@@ -165,7 +165,7 @@ emission of floating point pcs attribute
+ /* Thumb-1 only.  */
+ #define TARGET_THUMB1_ONLY		(TARGET_THUMB1 && !arm_arch_notm)
+ 
+-#define TARGET_LDRD			(arm_arch5te && ARM_DOUBLEWORD_ALIGN \
++#define TARGET_LDRD			(arm_arch6 && ARM_DOUBLEWORD_ALIGN \
+                                          && !TARGET_THUMB1)
+ 
+ #define TARGET_CRC32			(arm_arch_crc)
diff --git a/toolchain/gcc/patches-13.x/980-fix-build-error-with-Xcode-16.3.patch b/toolchain/gcc/patches-13.x/980-fix-build-error-with-Xcode-16.3.patch
new file mode 100644
index 00000000000000..3f4cdd57261cb2
--- /dev/null
+++ b/toolchain/gcc/patches-13.x/980-fix-build-error-with-Xcode-16.3.patch
@@ -0,0 +1,52 @@
+From 93954654b87552c4fe0273cab99d0f42f213f7f8 Mon Sep 17 00:00:00 2001
+From: Georgi Valkov <gvalkov@gmail.com>
+Date: Mon, 14 Apr 2025 15:45:59 +0300
+Subject: [PATCH] zlib: fix build error with Xcode 16.3
+
+Xcode 16.3 defines TARGET_OS_MAC, it was not defined in prior versions.
+zutil.h conditionally defines fdopen as NULL when this macro is defined,
+resulting in the following build error:
+
+/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include/_stdio.h:318:7: error: expected identifier or '('
+  318 | FILE    *fdopen(int, const char *) __DARWIN_ALIAS_STARTING(__MAC_10_6, __IPHONE_2_0, __DARWIN_ALIAS(fdopen));
+      |          ^
+./zutil.h:147:33: note: expanded from macro 'fdopen'
+  147 | #        define fdopen(fd,mode) NULL /* No fdopen() */
+
+In Xcode 16.2 and earlier, TARGET_OS_MAC was not defined so this entire
+block was ignored, gcc and gdb used to compile and work fine.
+
+This may have been used for compatibility with older versions of macOS,
+but is no longer needed. By pure luck, the build worked fine for a long
+time, because it did not properly detect macOS.
+Fixed by removing the check for TARGET_OS_MAC.
+
+Note that since Xcode 16.3, an entire set of TARGET_OS macros
+are now defined, most of which are set to 0:
+TARGET_OS_LINUX 0
+TARGET_OS_MAC 1
+TARGET_OS_OSX 1
+
+[1] https://github.com/openwrt/openwrt/pull/18467
+
+Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
+---
+ zlib/zutil.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/zlib/zutil.h b/zlib/zutil.h
+index 4b596adf629..9ea8d840643 100644
+--- a/zlib/zutil.h
++++ b/zlib/zutil.h
+@@ -130,7 +130,7 @@ extern z_const char * const z_errmsg[10]; /* indexed by 2-zlib_error */
+ #  endif
+ #endif
+ 
+-#if defined(MACOS) || defined(TARGET_OS_MAC)
++#if defined(MACOS)
+ #  define OS_CODE  7
+ #  ifndef Z_SOLO
+ #    if defined(__MWERKS__) && __dest_os != __be_os && __dest_os != __win32_os
+-- 
+2.49.0
+
diff --git a/toolchain/gcc/patches-14.x/800-arm_v5te_no_ldrd_strd.patch b/toolchain/gcc/patches-14.x/800-arm_v5te_no_ldrd_strd.patch
new file mode 100644
index 00000000000000..e83cb1bebbb34b
--- /dev/null
+++ b/toolchain/gcc/patches-14.x/800-arm_v5te_no_ldrd_strd.patch
@@ -0,0 +1,11 @@
+--- a/gcc/config/arm/arm.h
++++ b/gcc/config/arm/arm.h
+@@ -165,7 +165,7 @@ emission of floating point pcs attribute
+ /* Thumb-1 only.  */
+ #define TARGET_THUMB1_ONLY		(TARGET_THUMB1 && !arm_arch_notm)
+ 
+-#define TARGET_LDRD			(arm_arch5te && ARM_DOUBLEWORD_ALIGN \
++#define TARGET_LDRD			(arm_arch6 && ARM_DOUBLEWORD_ALIGN \
+                                          && !TARGET_THUMB1)
+ 
+ #define TARGET_CRC32			(arm_arch_crc)
diff --git a/toolchain/gcc/patches-14.x/980-fix-build-error-with-Xcode-16.3.patch b/toolchain/gcc/patches-14.x/980-fix-build-error-with-Xcode-16.3.patch
new file mode 100644
index 00000000000000..3f4cdd57261cb2
--- /dev/null
+++ b/toolchain/gcc/patches-14.x/980-fix-build-error-with-Xcode-16.3.patch
@@ -0,0 +1,52 @@
+From 93954654b87552c4fe0273cab99d0f42f213f7f8 Mon Sep 17 00:00:00 2001
+From: Georgi Valkov <gvalkov@gmail.com>
+Date: Mon, 14 Apr 2025 15:45:59 +0300
+Subject: [PATCH] zlib: fix build error with Xcode 16.3
+
+Xcode 16.3 defines TARGET_OS_MAC, it was not defined in prior versions.
+zutil.h conditionally defines fdopen as NULL when this macro is defined,
+resulting in the following build error:
+
+/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include/_stdio.h:318:7: error: expected identifier or '('
+  318 | FILE    *fdopen(int, const char *) __DARWIN_ALIAS_STARTING(__MAC_10_6, __IPHONE_2_0, __DARWIN_ALIAS(fdopen));
+      |          ^
+./zutil.h:147:33: note: expanded from macro 'fdopen'
+  147 | #        define fdopen(fd,mode) NULL /* No fdopen() */
+
+In Xcode 16.2 and earlier, TARGET_OS_MAC was not defined so this entire
+block was ignored, gcc and gdb used to compile and work fine.
+
+This may have been used for compatibility with older versions of macOS,
+but is no longer needed. By pure luck, the build worked fine for a long
+time, because it did not properly detect macOS.
+Fixed by removing the check for TARGET_OS_MAC.
+
+Note that since Xcode 16.3, an entire set of TARGET_OS macros
+are now defined, most of which are set to 0:
+TARGET_OS_LINUX 0
+TARGET_OS_MAC 1
+TARGET_OS_OSX 1
+
+[1] https://github.com/openwrt/openwrt/pull/18467
+
+Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
+---
+ zlib/zutil.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/zlib/zutil.h b/zlib/zutil.h
+index 4b596adf629..9ea8d840643 100644
+--- a/zlib/zutil.h
++++ b/zlib/zutil.h
+@@ -130,7 +130,7 @@ extern z_const char * const z_errmsg[10]; /* indexed by 2-zlib_error */
+ #  endif
+ #endif
+ 
+-#if defined(MACOS) || defined(TARGET_OS_MAC)
++#if defined(MACOS)
+ #  define OS_CODE  7
+ #  ifndef Z_SOLO
+ #    if defined(__MWERKS__) && __dest_os != __be_os && __dest_os != __win32_os
+-- 
+2.49.0
+
diff --git a/toolchain/gdb/Makefile b/toolchain/gdb/Makefile
index 9b9ee5a9d8d13a..861876d54a29c8 100644
--- a/toolchain/gdb/Makefile
+++ b/toolchain/gdb/Makefile
@@ -8,7 +8,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=gdb
 PKG_VERSION:=15.2
-PKG_RELEASE:=1
+PKG_RELEASE:=2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@GNU/gdb
@@ -56,6 +56,8 @@ else
   HOST_CONFIGURE_ARGS+= --without-python
 endif
 
+HOST_CFLAGS += -std=gnu17
+
 define Host/Install
 	mkdir -p $(TOOLCHAIN_DIR)/bin
 	$(INSTALL_BIN) $(HOST_BUILD_DIR)/gdb/gdb $(TOOLCHAIN_DIR)/bin/$(TARGET_CROSS)gdb
diff --git a/toolchain/gdb/patches/130-fix-build-error-with-Xcode-16.3.patch b/toolchain/gdb/patches/130-fix-build-error-with-Xcode-16.3.patch
new file mode 100644
index 00000000000000..4f76ed3c89b831
--- /dev/null
+++ b/toolchain/gdb/patches/130-fix-build-error-with-Xcode-16.3.patch
@@ -0,0 +1,52 @@
+From 0a084bb6c04e453183530c3e20727be1cc55ff9a Mon Sep 17 00:00:00 2001
+From: Georgi Valkov <gvalkov@gmail.com>
+Date: Mon, 14 Apr 2025 15:18:00 +0300
+Subject: [PATCH] zlib: fix build error with Xcode 16.3
+
+Xcode 16.3 defines TARGET_OS_MAC, it was not defined in prior versions.
+zutil.h conditionally defines fdopen as NULL when this macro is defined,
+resulting in the following build error:
+
+/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX.sdk/usr/include/_stdio.h:318:7: error: expected identifier or '('
+  318 | FILE    *fdopen(int, const char *) __DARWIN_ALIAS_STARTING(__MAC_10_6, __IPHONE_2_0, __DARWIN_ALIAS(fdopen));
+      |          ^
+./zutil.h:147:33: note: expanded from macro 'fdopen'
+  147 | #        define fdopen(fd,mode) NULL /* No fdopen() */
+
+In Xcode 16.2 and earlier, TARGET_OS_MAC was not defined so this entire
+block was ignored, gcc and gdb used to compile and work fine.
+
+This may have been used for compatibility with older versions of macOS,
+but is no longer needed. By pure luck, the build worked fine for a long
+time, because it did not properly detect macOS.
+Fixed by removing the check for TARGET_OS_MAC.
+
+Note that since Xcode 16.3, an entire set of TARGET_OS macros
+are now defined, most of which are set to 0:
+TARGET_OS_LINUX 0
+TARGET_OS_MAC 1
+TARGET_OS_OSX 1
+
+[1] https://github.com/openwrt/openwrt/pull/18467
+
+Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
+---
+ zlib/zutil.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/zlib/zutil.h b/zlib/zutil.h
+index d9a20ae1bf4..183e51b96b6 100644
+--- a/zlib/zutil.h
++++ b/zlib/zutil.h
+@@ -137,7 +137,7 @@ extern z_const char * const z_errmsg[10]; /* indexed by 2-zlib_error */
+ #  endif
+ #endif
+ 
+-#if defined(MACOS) || defined(TARGET_OS_MAC)
++#if defined(MACOS)
+ #  define OS_CODE  7
+ #  ifndef Z_SOLO
+ #    if defined(__MWERKS__) && __dest_os != __be_os && __dest_os != __win32_os
+-- 
+2.49.0
+
diff --git a/toolchain/glibc/common.mk b/toolchain/glibc/common.mk
index 28beda04ebdcc3..f0d451474f15ca 100644
--- a/toolchain/glibc/common.mk
+++ b/toolchain/glibc/common.mk
@@ -12,8 +12,8 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_SUBDIR:=$(PKG_NAME)-$(PKG_VERSION)
-PKG_SOURCE_VERSION:=e9f05fa1c62c8044ff025963498063f73eb51c5f
-PKG_MIRROR_HASH:=fd61eb2caea0d4100638b8aa8285b0f1bc23af921c376516307c9ab8ac307739
+PKG_SOURCE_VERSION:=6a52d5cab01ee8d3303f7c0939d6b2618c8a9606
+PKG_MIRROR_HASH:=2f55c40271e064e4fa338d9a04fd258c4c59a6ad198ab4bbfb7782e318db80c2
 PKG_SOURCE_URL:=https://sourceware.org/git/glibc.git
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION)-$(PKG_SOURCE_VERSION).tar.zst
 PKG_CPE_ID:=cpe:/a:gnu:glibc
diff --git a/toolchain/glibc/patches/200-add-dl-search-paths.patch b/toolchain/glibc/patches/200-add-dl-search-paths.patch
index 15106541ca51fc..083dc3df404647 100644
--- a/toolchain/glibc/patches/200-add-dl-search-paths.patch
+++ b/toolchain/glibc/patches/200-add-dl-search-paths.patch
@@ -2,7 +2,7 @@ add /usr/lib to default search path for the dynamic linker
 
 --- a/Makeconfig
 +++ b/Makeconfig
-@@ -632,6 +632,9 @@ else
+@@ -656,6 +656,9 @@ else
  default-rpath = $(libdir)
  endif
  
diff --git a/toolchain/mold/Makefile b/toolchain/mold/Makefile
index a2acba89d3c808..60361841aaaf64 100644
--- a/toolchain/mold/Makefile
+++ b/toolchain/mold/Makefile
@@ -3,6 +3,9 @@
 # See /LICENSE for more information.
 #
 include $(TOPDIR)/rules.mk
+
+PKG_NAME:=ld.mold
+
 include $(INCLUDE_DIR)/toolchain-build.mk
 
 define Host/Configure
diff --git a/tools/Makefile b/tools/Makefile
index b16c5d9c5b1e6c..563b9018922e6e 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -93,6 +93,7 @@ $(curdir)/automake/compile := $(curdir)/autoconf/compile $(curdir)/pkgconf/compi
 $(curdir)/b43-tools/compile := $(curdir)/bison/compile
 $(curdir)/bc/compile := $(curdir)/bison/compile $(curdir)/libtool/compile
 $(curdir)/bison/compile := $(curdir)/flex/compile
+$(curdir)/bzip2/compile := $(curdir)/cmake/compile
 $(curdir)/cbootimage/compile += $(curdir)/automake/compile
 $(curdir)/cmake/compile += $(curdir)/libressl/compile $(curdir)/ninja/compile $(curdir)/expat/compile $(curdir)/xz/compile $(curdir)/zlib/compile $(curdir)/zstd/compile
 $(curdir)/dosfstools/compile := $(curdir)/automake/compile
diff --git a/tools/b43-tools/Makefile b/tools/b43-tools/Makefile
index 8ec13309beb898..eb2fb284a89536 100644
--- a/tools/b43-tools/Makefile
+++ b/tools/b43-tools/Makefile
@@ -8,12 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=b43-tools
-PKG_DATE:=2022-07-05
+PKG_DATE:=2025-05-04
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://github.com/mbuesch/b43-tools.git
-PKG_SOURCE_VERSION:=2fe10ea6690df9a068cb21cde537236bae784a14
-PKG_MIRROR_HASH:=4009d6c1f9ede43102897d6ebf4bd954331f3c4e2a94d4e61c0e5f303f929914
+PKG_SOURCE_VERSION:=cc352349153eeda9c164ecd0d06c161a59ec8753
+PKG_MIRROR_HASH:=c1feba649c2cf3e984a2b897b4a6938252515c0833358d51bd15e049b6b2fb65
 
 include $(INCLUDE_DIR)/host-build.mk
 
diff --git a/tools/ccache/Makefile b/tools/ccache/Makefile
index 47c24a5c98864a..447bc3ea432f04 100644
--- a/tools/ccache/Makefile
+++ b/tools/ccache/Makefile
@@ -7,11 +7,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=ccache
-PKG_VERSION:=4.10
+PKG_VERSION:=4.10.2
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/ccache/ccache/releases/download/v$(PKG_VERSION)
-PKG_HASH:=16972ba62c8499045edc3ae7d7b8a0b419a961567f5ff0f01bf5a44194204775
+PKG_HASH:=108100960bb7e64573ea925af2ee7611701241abb36ce0aae3354528403a7d87
 
 include $(INCLUDE_DIR)/host-build.mk
 include $(INCLUDE_DIR)/cmake.mk
diff --git a/tools/ccache/patches/100-honour-copts.patch b/tools/ccache/patches/100-honour-copts.patch
index a40665ea25836c..c07c8ce8eb3a25 100644
--- a/tools/ccache/patches/100-honour-copts.patch
+++ b/tools/ccache/patches/100-honour-copts.patch
@@ -1,6 +1,6 @@
 --- a/src/ccache/ccache.cpp
 +++ b/src/ccache/ccache.cpp
-@@ -1906,6 +1906,7 @@ get_manifest_key(Context& ctx, Hash& has
+@@ -1914,6 +1914,7 @@ get_manifest_key(Context& ctx, Hash& has
      "OBJCPLUS_INCLUDE_PATH",        // Clang
      "CLANG_CONFIG_FILE_SYSTEM_DIR", // Clang
      "CLANG_CONFIG_FILE_USER_DIR",   // Clang
diff --git a/tools/cpio/patches/cpio-c23.patch b/tools/cpio/patches/cpio-c23.patch
new file mode 100644
index 00000000000000..825f369d6e9004
--- /dev/null
+++ b/tools/cpio/patches/cpio-c23.patch
@@ -0,0 +1,23 @@
+--- a/src/extern.h
++++ b/src/extern.h
+@@ -97,7 +97,8 @@ extern char input_is_special;
+ extern char output_is_special;
+ extern char input_is_seekable;
+ extern char output_is_seekable;
+-extern int (*xstat) ();
++//void not good enough
++extern int (*xstat) (const char * restrict,  struct stat * restrict);
+ extern void (*copy_function) ();
+ extern char *change_directory_option;
+ 
+--- a/src/global.c
++++ b/src/global.c
+@@ -185,7 +185,7 @@ bool to_stdout_option = false;
+ 
+ /* A pointer to either lstat or stat, depending on whether
+    dereferencing of symlinks is done for input files.  */
+-int (*xstat) ();
++int (*xstat) (const char * restrict,  struct stat * restrict);
+ 
+ /* Which copy operation to perform. (-i, -o, -p) */
+ void (*copy_function) () = 0;
diff --git a/tools/dwarves/Makefile b/tools/dwarves/Makefile
index bcb16dd3da36b1..53461267767afb 100644
--- a/tools/dwarves/Makefile
+++ b/tools/dwarves/Makefile
@@ -3,12 +3,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=dwarves
-PKG_VERSION:=1.27
+PKG_VERSION:=1.28
 PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
 PKG_SOURCE_URL:=https://fedorapeople.org/~acme/dwarves/
-PKG_HASH:=ef7f21f1c6016896d03a01f05cab225151f9068e19cc8cddc6e754b2b5cbe279
+PKG_HASH:=826efc0fc9237d3c1e9c01553ea387a8cb46e8dc119ff863889043f4ed54b2ae
 
 PKG_MAINTAINER:=Tony Ambardar <itugrok@yahoo.com>
 PKG_LICENSE:=GPL-2.0-only
diff --git a/tools/dwarves/patches/100-reproducible-builds.patch b/tools/dwarves/patches/100-reproducible-builds.patch
index 15bddd56457a38..d8cbd114c61e48 100644
--- a/tools/dwarves/patches/100-reproducible-builds.patch
+++ b/tools/dwarves/patches/100-reproducible-builds.patch
@@ -1,6 +1,6 @@
 --- a/pahole.c
 +++ b/pahole.c
-@@ -3723,6 +3723,9 @@ int main(int argc, char *argv[])
+@@ -3681,6 +3681,9 @@ int main(int argc, char *argv[])
  		goto out;
  	}
  
diff --git a/tools/e2fsprogs/Makefile b/tools/e2fsprogs/Makefile
index 50c3888b642b4b..5deee081609b66 100644
--- a/tools/e2fsprogs/Makefile
+++ b/tools/e2fsprogs/Makefile
@@ -9,10 +9,10 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=e2fsprogs
 PKG_CPE_ID:=cpe:/a:e2fsprogs_project:e2fsprogs
-PKG_VERSION:=1.47.0
-PKG_HASH:=0b4fe723d779b0927fb83c9ae709bc7b40f66d7df36433bef143e41c54257084
+PKG_VERSION:=1.47.2
+PKG_HASH:=08242e64ca0e8194d9c1caad49762b19209a06318199b63ce74ae4ef2d74e63c
 
-PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=@KERNEL/linux/kernel/people/tytso/e2fsprogs/v$(PKG_VERSION)/
 
 HOST_BUILD_PARALLEL:=1
diff --git a/tools/elfutils/Makefile b/tools/elfutils/Makefile
index 2836cadc87d60b..ae829cd3400bd3 100644
--- a/tools/elfutils/Makefile
+++ b/tools/elfutils/Makefile
@@ -69,7 +69,7 @@ ifeq ($(HOST_OS),Darwin)
   HOST_CFLAGS += -I/opt/homebrew/include
 endif
 
-HOST_CFLAGS += -Wno-error -fPIC
+HOST_CFLAGS += -Wno-error -fPIC -std=gnu17
 
 HOST_CONFIGURE_ARGS += \
 	--without-libintl-prefix \
diff --git a/tools/expat/Makefile b/tools/expat/Makefile
index d48837233f3040..941f0c3fbfb890 100644
--- a/tools/expat/Makefile
+++ b/tools/expat/Makefile
@@ -9,10 +9,10 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=expat
 PKG_CPE_ID:=cpe:/a:libexpat:libexpat
-PKG_VERSION:=2.6.3
+PKG_VERSION:=2.7.1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
-PKG_HASH:=17aa6cfc5c4c219c09287abfc10bc13f0c06f30bb654b28bfe6f567ca646eb79
+PKG_HASH:=0cce2e6e69b327fc607b8ff264f4b66bdf71ead55a87ffd5f3143f535f15cfa2
 PKG_SOURCE_URL:=https://github.com/libexpat/libexpat/releases/download/R_$(subst .,_,$(PKG_VERSION))
 
 HOST_BUILD_PARALLEL:=1
diff --git a/tools/firmware-utils/Makefile b/tools/firmware-utils/Makefile
index 62222b6dafc2d8..96146637b3c479 100644
--- a/tools/firmware-utils/Makefile
+++ b/tools/firmware-utils/Makefile
@@ -11,9 +11,9 @@ PKG_RELEASE:=1
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL=$(PROJECT_GIT)/project/firmware-utils.git
-PKG_SOURCE_DATE:=2024-10-20
-PKG_SOURCE_VERSION:=4b7638925d3eac03e614e40bc30cb49f5877c46d
-PKG_MIRROR_HASH:=ea0e30f2b20211e4153704019ebb3f8789269893a4af6d853a85fae7c091802c
+PKG_SOURCE_DATE:=2025-08-03
+PKG_SOURCE_VERSION:=950f83405a935395492d61c9972b5e5ca826eeee
+PKG_MIRROR_HASH:=19f5b7547dc6f9460e25183c83d55aca9d1f18148466c09b64504a64379a34ae
 
 include $(INCLUDE_DIR)/host-build.mk
 include $(INCLUDE_DIR)/cmake.mk
diff --git a/tools/gmp/patches/001-acinclude-m4-fix-std23.patch b/tools/gmp/patches/001-acinclude-m4-fix-std23.patch
new file mode 100644
index 00000000000000..05271764b7e574
--- /dev/null
+++ b/tools/gmp/patches/001-acinclude-m4-fix-std23.patch
@@ -0,0 +1,19 @@
+# HG changeset patch
+# User Marc Glisse <marc.glisse@inria.fr>
+# Date 1738186682 -3600
+#      Wed Jan 29 22:38:02 2025 +0100
+# Node ID 8e7bb4ae7a18b1405ea7f9cbcda450b7d920a901
+# Parent  e84c5c785bbe8ed8c3620194e50b65adfc2f5d83
+Complete function prototype in acinclude.m4 for C23 compatibility
+
+--- a/acinclude.m4
++++ b/acinclude.m4
+@@ -609,7 +609,7 @@ GMP_PROG_CC_WORKS_PART([$1], [long long
+ 
+ #if defined (__GNUC__) && ! defined (__cplusplus)
+ typedef unsigned long long t1;typedef t1*t2;
+-void g(){}
++void g(int,t1 const*,t1,t2,t1 const*,int){}
+ void h(){}
+ static __inline__ t1 e(t2 rp,t2 up,int n,t1 v0)
+ {t1 c,x,r;int i;if(v0){c=1;for(i=1;i<n;i++){x=up[i];r=x+1;rp[i]=r;}}return c;}
diff --git a/tools/gmp/patches/002-acinclude-m4-add-parameter-names.patch b/tools/gmp/patches/002-acinclude-m4-add-parameter-names.patch
new file mode 100644
index 00000000000000..9bfa5ecea44019
--- /dev/null
+++ b/tools/gmp/patches/002-acinclude-m4-add-parameter-names.patch
@@ -0,0 +1,22 @@
+# HG changeset patch
+# User Marc Glisse <marc.glisse@inria.fr>
+# Date 1743513946 -7200
+#      Tue Apr 01 15:25:46 2025 +0200
+# Node ID d66d66d82dbbe4f561920d28c1e1cbe6818452c7
+# Parent  1a2ad0e32507e842486c8ac9d5cdc772fd0c335e
+Add parameter names to function prototype
+
+ 2025-02-01  Marc Glisse <marc.glisse@inria.fr>
+ 
+ 	* longlong.h (loongarch64 umul_ppmm): __int128__ -> __int128.
+--- a/acinclude.m4
++++ b/acinclude.m4
+@@ -609,7 +609,7 @@ GMP_PROG_CC_WORKS_PART([$1], [long long
+ 
+ #if defined (__GNUC__) && ! defined (__cplusplus)
+ typedef unsigned long long t1;typedef t1*t2;
+-void g(int,t1 const*,t1,t2,t1 const*,int){}
++void g(int a,t1 const*b,t1 c,t2 d,t1 const*e,int f){}
+ void h(){}
+ static __inline__ t1 e(t2 rp,t2 up,int n,t1 v0)
+ {t1 c,x,r;int i;if(v0){c=1;for(i=1;i<n;i++){x=up[i];r=x+1;rp[i]=r;}}return c;}
diff --git a/tools/llvm-bpf/patches/100-gcc15.patch b/tools/llvm-bpf/patches/100-gcc15.patch
new file mode 100644
index 00000000000000..5b92af04e40761
--- /dev/null
+++ b/tools/llvm-bpf/patches/100-gcc15.patch
@@ -0,0 +1,23 @@
+From 7e44305041d96b064c197216b931ae3917a34ac1 Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Fri, 2 Aug 2024 23:07:21 +0100
+Subject: [PATCH] [ADT] Add `<cstdint>` to SmallVector (#101761)
+
+SmallVector uses `uint32_t`, `uint64_t` without including `<cstdint>`
+which fails to build w/ GCC 15 after a change in libstdc++ [0]
+
+[0] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=3a817a4a5a6d94da9127af3be9f84a74e3076ee2
+---
+ llvm/include/llvm/ADT/SmallVector.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/llvm/include/llvm/ADT/SmallVector.h
++++ b/llvm/include/llvm/ADT/SmallVector.h
+@@ -19,6 +19,7 @@
+ #include <algorithm>
+ #include <cassert>
+ #include <cstddef>
++#include <cstdint>
+ #include <cstdlib>
+ #include <cstring>
+ #include <functional>
diff --git a/tools/m4/Makefile b/tools/m4/Makefile
index ee369f3cbb3d99..c13155397d25f3 100644
--- a/tools/m4/Makefile
+++ b/tools/m4/Makefile
@@ -18,6 +18,7 @@ HOST_BUILD_PARALLEL:=1
 
 include $(INCLUDE_DIR)/host-build.mk
 
+HOST_CFLAGS += -std=gnu17
 HOST_CONFIGURE_VARS += gl_cv_func_strstr_linear=no
 
 define Host/Uninstall
diff --git a/tools/patch/Makefile b/tools/patch/Makefile
index f4cf588622ffa9..785793685c0a39 100644
--- a/tools/patch/Makefile
+++ b/tools/patch/Makefile
@@ -7,13 +7,13 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=patch
-PKG_VERSION:=2.7.6
-PKG_RELEASE:=7
+PKG_VERSION:=2.8
+PKG_RELEASE:=1
 PKG_CPE_ID:=cpe:/a:gnu:patch
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=@GNU/patch
-PKG_HASH:=8cf86e00ad3aaa6d26aca30640e86b0e3e1f395ed99f189b06d4c9f74bc58a4e
+PKG_HASH:=308a4983ff324521b9b21310bfc2398ca861798f02307c79eb99bb0e0d2bf980
 
 HOST_BUILD_PARALLEL := 1
 
diff --git a/tools/patch/patches/010-CVE-2018-6951.patch b/tools/patch/patches/010-CVE-2018-6951.patch
deleted file mode 100644
index 10dc56809932ef..00000000000000
--- a/tools/patch/patches/010-CVE-2018-6951.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-From 1f7853c05f9949d81da9be7a02b90cc64284d1f8 Mon Sep 17 00:00:00 2001
-From: Andreas Gruenbacher <agruen@gnu.org>
-Date: Mon, 12 Feb 2018 16:48:24 +0100
-Subject: [PATCH] Fix segfault with mangled rename patch
-
-http://savannah.gnu.org/bugs/?53132
-* src/pch.c (intuit_diff_type): Ensure that two filenames are specified
-for renames and copies (fix the existing check).
----
- src/pch.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
---- a/src/pch.c
-+++ b/src/pch.c
-@@ -974,7 +974,8 @@ intuit_diff_type (bool need_header, mode
-     if ((pch_rename () || pch_copy ())
- 	&& ! inname
- 	&& ! ((i == OLD || i == NEW) &&
--	      p_name[! reverse] &&
-+	      p_name[reverse] && p_name[! reverse] &&
-+	      name_is_valid (p_name[reverse]) &&
- 	      name_is_valid (p_name[! reverse])))
-       {
- 	say ("Cannot %s file without two valid file names\n", pch_rename () ? "rename" : "copy");
diff --git a/tools/patch/patches/020-CVE-2018-1000156.patch b/tools/patch/patches/020-CVE-2018-1000156.patch
deleted file mode 100644
index 99dfe540753412..00000000000000
--- a/tools/patch/patches/020-CVE-2018-1000156.patch
+++ /dev/null
@@ -1,142 +0,0 @@
-From b3a0ca3deed00334f9feece43f76776b6a168e47 Mon Sep 17 00:00:00 2001
-From: Andreas Gruenbacher <agruen@gnu.org>
-Date: Fri, 6 Apr 2018 12:14:49 +0200
-Subject: [PATCH] Fix arbitrary command execution in ed-style patches
- (CVE-2018-1000156)
-
-* src/pch.c (do_ed_script): Write ed script to a temporary file instead
-of piping it to ed: this will cause ed to abort on invalid commands
-instead of rejecting them and carrying on.
-* tests/ed-style: New test case.
-* tests/Makefile.am (TESTS): Add test case.
----
- src/pch.c | 89 +++++++++++++++++++++++++++++++++++++++++--------------
- 1 file changed, 66 insertions(+), 23 deletions(-)
-
---- a/src/pch.c
-+++ b/src/pch.c
-@@ -33,6 +33,7 @@
- # include <io.h>
- #endif
- #include <safe.h>
-+#include <sys/wait.h>
- 
- #define INITHUNKMAX 125			/* initial dynamic allocation size */
- 
-@@ -2389,22 +2390,28 @@ do_ed_script (char const *inname, char c
-     static char const editor_program[] = EDITOR_PROGRAM;
- 
-     file_offset beginning_of_this_line;
--    FILE *pipefp = 0;
-     size_t chars_read;
-+    FILE *tmpfp = 0;
-+    char const *tmpname;
-+    int tmpfd;
-+    pid_t pid;
-+
-+    if (! dry_run && ! skip_rest_of_patch)
-+      {
-+	/* Write ed script to a temporary file.  This causes ed to abort on
-+	   invalid commands such as when line numbers or ranges exceed the
-+	   number of available lines.  When ed reads from a pipe, it rejects
-+	   invalid commands and treats the next line as a new command, which
-+	   can lead to arbitrary command execution.  */
-+
-+	tmpfd = make_tempfile (&tmpname, 'e', NULL, O_RDWR | O_BINARY, 0);
-+	if (tmpfd == -1)
-+	  pfatal ("Can't create temporary file %s", quotearg (tmpname));
-+	tmpfp = fdopen (tmpfd, "w+b");
-+	if (! tmpfp)
-+	  pfatal ("Can't open stream for file %s", quotearg (tmpname));
-+      }
- 
--    if (! dry_run && ! skip_rest_of_patch) {
--	int exclusive = *outname_needs_removal ? 0 : O_EXCL;
--	assert (! inerrno);
--	*outname_needs_removal = true;
--	copy_file (inname, outname, 0, exclusive, instat.st_mode, true);
--	sprintf (buf, "%s %s%s", editor_program,
--		 verbosity == VERBOSE ? "" : "- ",
--		 outname);
--	fflush (stdout);
--	pipefp = popen(buf, binary_transput ? "wb" : "w");
--	if (!pipefp)
--	  pfatal ("Can't open pipe to %s", quotearg (buf));
--    }
-     for (;;) {
- 	char ed_command_letter;
- 	beginning_of_this_line = file_tell (pfp);
-@@ -2415,14 +2422,14 @@ do_ed_script (char const *inname, char c
- 	}
- 	ed_command_letter = get_ed_command_letter (buf);
- 	if (ed_command_letter) {
--	    if (pipefp)
--		if (! fwrite (buf, sizeof *buf, chars_read, pipefp))
-+	    if (tmpfp)
-+		if (! fwrite (buf, sizeof *buf, chars_read, tmpfp))
- 		    write_fatal ();
- 	    if (ed_command_letter != 'd' && ed_command_letter != 's') {
- 	        p_pass_comments_through = true;
- 		while ((chars_read = get_line ()) != 0) {
--		    if (pipefp)
--			if (! fwrite (buf, sizeof *buf, chars_read, pipefp))
-+		    if (tmpfp)
-+			if (! fwrite (buf, sizeof *buf, chars_read, tmpfp))
- 			    write_fatal ();
- 		    if (chars_read == 2  &&  strEQ (buf, ".\n"))
- 			break;
-@@ -2435,13 +2442,49 @@ do_ed_script (char const *inname, char c
- 	    break;
- 	}
-     }
--    if (!pipefp)
-+    if (!tmpfp)
-       return;
--    if (fwrite ("w\nq\n", sizeof (char), (size_t) 4, pipefp) == 0
--	|| fflush (pipefp) != 0)
-+    if (fwrite ("w\nq\n", sizeof (char), (size_t) 4, tmpfp) == 0
-+	|| fflush (tmpfp) != 0)
-       write_fatal ();
--    if (pclose (pipefp) != 0)
--      fatal ("%s FAILED", editor_program);
-+
-+    if (lseek (tmpfd, 0, SEEK_SET) == -1)
-+      pfatal ("Can't rewind to the beginning of file %s", quotearg (tmpname));
-+
-+    if (! dry_run && ! skip_rest_of_patch) {
-+	int exclusive = *outname_needs_removal ? 0 : O_EXCL;
-+	*outname_needs_removal = true;
-+	if (inerrno != ENOENT)
-+	  {
-+	    *outname_needs_removal = true;
-+	    copy_file (inname, outname, 0, exclusive, instat.st_mode, true);
-+	  }
-+	sprintf (buf, "%s %s%s", editor_program,
-+		 verbosity == VERBOSE ? "" : "- ",
-+		 outname);
-+	fflush (stdout);
-+
-+	pid = fork();
-+	if (pid == -1)
-+	  pfatal ("Can't fork");
-+	else if (pid == 0)
-+	  {
-+	    dup2 (tmpfd, 0);
-+	    execl ("/bin/sh", "sh", "-c", buf, (char *) 0);
-+	    _exit (2);
-+	  }
-+	else
-+	  {
-+	    int wstatus;
-+	    if (waitpid (pid, &wstatus, 0) == -1
-+	        || ! WIFEXITED (wstatus)
-+		|| WEXITSTATUS (wstatus) != 0)
-+	      fatal ("%s FAILED", editor_program);
-+	  }
-+    }
-+
-+    fclose (tmpfp);
-+    safe_unlink (tmpname);
- 
-     if (ofp)
-       {
diff --git a/tools/patch/patches/030-CVE-2018-6952.patch b/tools/patch/patches/030-CVE-2018-6952.patch
deleted file mode 100644
index 36b58c79ddbaa7..00000000000000
--- a/tools/patch/patches/030-CVE-2018-6952.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From df40f2ea17254de269a3624319a12a93a4e395ff Mon Sep 17 00:00:00 2001
-From: Andreas Gruenbacher <agruen@gnu.org>
-Date: Fri, 17 Aug 2018 13:35:40 +0200
-Subject: [PATCH] Fix swapping fake lines in pch_swap
-
-* src/pch.c (pch_swap): Fix swapping p_bfake and p_efake when there is a
-blank line in the middle of a context-diff hunk: that empty line stays
-in the middle of the hunk and isn't swapped.
-
-Fixes: https://savannah.gnu.org/bugs/index.php?53133
----
- src/pch.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/src/pch.c
-+++ b/src/pch.c
-@@ -2115,7 +2115,7 @@ pch_swap (void)
-     }
-     if (p_efake >= 0) {			/* fix non-freeable ptr range */
- 	if (p_efake <= i)
--	    n = p_end - i + 1;
-+	    n = p_end - p_ptrn_lines;
- 	else
- 	    n = -i;
- 	p_efake += n;
diff --git a/tools/patch/patches/040-Fix-error-handling-with-git-style-patches.patch b/tools/patch/patches/040-Fix-error-handling-with-git-style-patches.patch
deleted file mode 100644
index 5cc958e74641b0..00000000000000
--- a/tools/patch/patches/040-Fix-error-handling-with-git-style-patches.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 424da221cec76ea200cff1fa9b08a6f3d94c28a7 Mon Sep 17 00:00:00 2001
-From: Lubomir Rintel <lkundrak@v3.sk>
-Date: Wed, 31 Oct 2018 16:39:13 -0700
-Subject: [PATCH] Fix error handling with git-style patches
-
-When an error is encountered in output_files(), the subsequent call to
-cleanup() calls back into output_files() resulting in an infinte recursion.
-This is trivially reproduced with a git-style patch (which utilizes
-output_file_later()) that tries to patch a nonexistent or unreadable
-file (see attached test case).
-
-* src/patch.c: (output_files) clear the files_to_output list before
-iterating it, so that recursive calls won't iterate the same files.
----
- src/patch.c | 12 ++++++++----
- 1 file changed, 8 insertions(+), 4 deletions(-)
-
---- a/src/patch.c
-+++ b/src/patch.c
-@@ -1938,8 +1938,12 @@ output_files (struct stat const *st)
- {
-   gl_list_iterator_t iter;
-   const void *elt;
-+  gl_list_t files;
- 
--  iter = gl_list_iterator (files_to_output);
-+  files = files_to_output;
-+  init_files_to_output ();
-+
-+  iter = gl_list_iterator (files);
-   while (gl_list_iterator_next (&iter, &elt, NULL))
-     {
-       const struct file_to_output *file_to_output = elt;
-@@ -1957,8 +1961,8 @@ output_files (struct stat const *st)
- 	  /* Free the list up to here. */
- 	  for (;;)
- 	    {
--	      const void *elt2 = gl_list_get_at (files_to_output, 0);
--	      gl_list_remove_at (files_to_output, 0);
-+	      const void *elt2 = gl_list_get_at (files, 0);
-+	      gl_list_remove_at (files, 0);
- 	      if (elt == elt2)
- 		break;
- 	    }
-@@ -1967,7 +1971,7 @@ output_files (struct stat const *st)
- 	}
-     }
-   gl_list_iterator_free (&iter);
--  gl_list_clear (files_to_output);
-+  gl_list_clear (files);
- }
- 
- /* Fatal exit with cleanup. */
diff --git a/tools/patch/patches/050-CVE-2019-13636.patch b/tools/patch/patches/050-CVE-2019-13636.patch
deleted file mode 100644
index d819838bba44f7..00000000000000
--- a/tools/patch/patches/050-CVE-2019-13636.patch
+++ /dev/null
@@ -1,101 +0,0 @@
-From dce4683cbbe107a95f1f0d45fabc304acfb5d71a Mon Sep 17 00:00:00 2001
-From: Andreas Gruenbacher <agruen@gnu.org>
-Date: Mon, 15 Jul 2019 16:21:48 +0200
-Subject: Don't follow symlinks unless --follow-symlinks is given
-
-* src/inp.c (plan_a, plan_b), src/util.c (copy_to_fd, copy_file,
-append_to_file): Unless the --follow-symlinks option is given, open files with
-the O_NOFOLLOW flag to avoid following symlinks.  So far, we were only doing
-that consistently for input files.
-* src/util.c (create_backup): When creating empty backup files, (re)create them
-with O_CREAT | O_EXCL to avoid following symlinks in that case as well.
----
- src/inp.c  | 12 ++++++++++--
- src/util.c | 14 +++++++++++---
- 2 files changed, 21 insertions(+), 5 deletions(-)
-
---- a/src/inp.c
-+++ b/src/inp.c
-@@ -238,8 +238,13 @@ plan_a (char const *filename)
-     {
-       if (S_ISREG (instat.st_mode))
-         {
--	  int ifd = safe_open (filename, O_RDONLY|binary_transput, 0);
-+	  int flags = O_RDONLY | binary_transput;
- 	  size_t buffered = 0, n;
-+	  int ifd;
-+
-+	  if (! follow_symlinks)
-+	    flags |= O_NOFOLLOW;
-+	  ifd = safe_open (filename, flags, 0);
- 	  if (ifd < 0)
- 	    pfatal ("can't open file %s", quotearg (filename));
- 
-@@ -340,6 +345,7 @@ plan_a (char const *filename)
- static void
- plan_b (char const *filename)
- {
-+  int flags = O_RDONLY | binary_transput;
-   int ifd;
-   FILE *ifp;
-   int c;
-@@ -353,7 +359,9 @@ plan_b (char const *filename)
- 
-   if (instat.st_size == 0)
-     filename = NULL_DEVICE;
--  if ((ifd = safe_open (filename, O_RDONLY | binary_transput, 0)) < 0
-+  if (! follow_symlinks)
-+    flags |= O_NOFOLLOW;
-+  if ((ifd = safe_open (filename, flags, 0)) < 0
-       || ! (ifp = fdopen (ifd, binary_transput ? "rb" : "r")))
-     pfatal ("Can't open file %s", quotearg (filename));
-   if (TMPINNAME_needs_removal)
---- a/src/util.c
-+++ b/src/util.c
-@@ -388,7 +388,7 @@ create_backup (char const *to, const str
- 
- 	  try_makedirs_errno = ENOENT;
- 	  safe_unlink (bakname);
--	  while ((fd = safe_open (bakname, O_CREAT | O_WRONLY | O_TRUNC, 0666)) < 0)
-+	  while ((fd = safe_open (bakname, O_CREAT | O_EXCL | O_WRONLY | O_TRUNC, 0666)) < 0)
- 	    {
- 	      if (errno != try_makedirs_errno)
- 		pfatal ("Can't create file %s", quotearg (bakname));
-@@ -579,10 +579,13 @@ create_file (char const *file, int open_
- static void
- copy_to_fd (const char *from, int tofd)
- {
-+  int from_flags = O_RDONLY | O_BINARY;
-   int fromfd;
-   ssize_t i;
- 
--  if ((fromfd = safe_open (from, O_RDONLY | O_BINARY, 0)) < 0)
-+  if (! follow_symlinks)
-+    from_flags |= O_NOFOLLOW;
-+  if ((fromfd = safe_open (from, from_flags, 0)) < 0)
-     pfatal ("Can't reopen file %s", quotearg (from));
-   while ((i = read (fromfd, buf, bufsize)) != 0)
-     {
-@@ -625,6 +628,8 @@ copy_file (char const *from, char const
-   else
-     {
-       assert (S_ISREG (mode));
-+      if (! follow_symlinks)
-+	to_flags |= O_NOFOLLOW;
-       tofd = create_file (to, O_WRONLY | O_BINARY | to_flags, mode,
- 			  to_dir_known_to_exist);
-       copy_to_fd (from, tofd);
-@@ -640,9 +645,12 @@ copy_file (char const *from, char const
- void
- append_to_file (char const *from, char const *to)
- {
-+  int to_flags = O_WRONLY | O_APPEND | O_BINARY;
-   int tofd;
- 
--  if ((tofd = safe_open (to, O_WRONLY | O_BINARY | O_APPEND, 0)) < 0)
-+  if (! follow_symlinks)
-+    to_flags |= O_NOFOLLOW;
-+  if ((tofd = safe_open (to, to_flags, 0)) < 0)
-     pfatal ("Can't reopen file %s", quotearg (to));
-   copy_to_fd (from, tofd);
-   if (close (tofd) != 0)
diff --git a/tools/patch/patches/060-CVE-2019-13638.patch b/tools/patch/patches/060-CVE-2019-13638.patch
deleted file mode 100644
index 590cf186e7c67e..00000000000000
--- a/tools/patch/patches/060-CVE-2019-13638.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From 3fcd042d26d70856e826a42b5f93dc4854d80bf0 Mon Sep 17 00:00:00 2001
-From: Andreas Gruenbacher <agruen@gnu.org>
-Date: Fri, 6 Apr 2018 19:36:15 +0200
-Subject: Invoke ed directly instead of using the shell
-
-* src/pch.c (do_ed_script): Invoke ed directly instead of using a shell
-command to avoid quoting vulnerabilities.
----
- src/pch.c | 6 ++----
- 1 file changed, 2 insertions(+), 4 deletions(-)
-
---- a/src/pch.c
-+++ b/src/pch.c
-@@ -2459,9 +2459,6 @@ do_ed_script (char const *inname, char c
- 	    *outname_needs_removal = true;
- 	    copy_file (inname, outname, 0, exclusive, instat.st_mode, true);
- 	  }
--	sprintf (buf, "%s %s%s", editor_program,
--		 verbosity == VERBOSE ? "" : "- ",
--		 outname);
- 	fflush (stdout);
- 
- 	pid = fork();
-@@ -2470,7 +2467,8 @@ do_ed_script (char const *inname, char c
- 	else if (pid == 0)
- 	  {
- 	    dup2 (tmpfd, 0);
--	    execl ("/bin/sh", "sh", "-c", buf, (char *) 0);
-+	    assert (outname[0] != '!' && outname[0] != '-');
-+	    execlp (editor_program, editor_program, "-", outname, (char  *) NULL);
- 	    _exit (2);
- 	  }
- 	else
diff --git a/tools/patch/patches/070-don-t-fail-hard-on-EACCES-when-copying-xattrs.patch b/tools/patch/patches/070-don-t-fail-hard-on-EACCES-when-copying-xattrs.patch
deleted file mode 100644
index e19a9c0845b4fb..00000000000000
--- a/tools/patch/patches/070-don-t-fail-hard-on-EACCES-when-copying-xattrs.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From f42cbe1a91a3a6f79d1eec594ce7c72aec79179b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Thomas=20Wei=C3=9Fschuh?= <thomas@t-8ch.de>
-Date: Wed, 9 Nov 2022 05:08:22 +0100
-Subject: [PATCH] don't fail hard on EACCES when copying xattrs
-
-On btrfs the xattr "btrfs.compressed" requires privileges to set,
-otherwise EACCES is returned.
-When patch tries to do copy this attribute it receives the error and
-aborts.
----
- src/util.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
---- a/src/util.c
-+++ b/src/util.c
-@@ -182,7 +182,7 @@ copy_attr_error (struct error_context *c
-   int err = errno;
-   va_list ap;
- 
--  if (err != ENOSYS && err != ENOTSUP && err != EPERM)
-+  if (err != ENOSYS && err != ENOTSUP && err != EPERM && err != EACCES)
-     {
-       /* use verror module to print error message */
-       va_start (ap, fmt);
-@@ -284,7 +284,7 @@ set_file_attributes (char const *to, enu
-     }
-   if (attr & FA_XATTRS)
-     if (copy_attr (from, to) != 0
--	&& errno != ENOSYS && errno != ENOTSUP && errno != EPERM)
-+	&& errno != ENOSYS && errno != ENOTSUP && errno != EPERM && errno != EACCES)
-       fatal_exit (0);
-   if (attr & FA_MODE)
-     {
diff --git a/tools/squashfs3-lzma/patches/160-gcc15.patch b/tools/squashfs3-lzma/patches/160-gcc15.patch
new file mode 100644
index 00000000000000..542fa52202457f
--- /dev/null
+++ b/tools/squashfs3-lzma/patches/160-gcc15.patch
@@ -0,0 +1,20 @@
+--- a/squashfs-tools/mksquashfs.c
++++ b/squashfs-tools/mksquashfs.c
+@@ -290,7 +290,7 @@ void restorefs()
+ }
+ 
+ 
+-void sighandler()
++void sighandler(int i)
+ {
+ 	if(interrupted == 1)
+ 		restorefs();
+@@ -302,7 +302,7 @@ void sighandler()
+ }
+ 
+ 
+-void sighandler2()
++void sighandler2(int i)
+ {
+ 	EXIT_MKSQUASHFS();
+ }
diff --git a/tools/zstd/Makefile b/tools/zstd/Makefile
index e1d36c59cfbe87..88a961f323efc4 100644
--- a/tools/zstd/Makefile
+++ b/tools/zstd/Makefile
@@ -1,11 +1,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=zstd
-PKG_VERSION:=1.5.6
+PKG_VERSION:=1.5.7
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/facebook/zstd/releases/download/v$(PKG_VERSION)
-PKG_HASH:=8c29e06cf42aacc1eafc4077ae2ec6c6fcb96a626157e0593d5e82a34fd403c1
+PKG_HASH:=eb33e51f49a15e023950cd7825ca74a4a2b43db8354825ac24fc1b7ee09e6fa3
 
 PKG_LICENSE:=BSD-3-Clause
 PKG_LICENSE_FILES:=LICENSE
diff --git a/tools/zstd/patches/001-Provide-variant-pkg-config-file-for-multi-threaded-s.patch b/tools/zstd/patches/001-Provide-variant-pkg-config-file-for-multi-threaded-s.patch
deleted file mode 100644
index 1bbcaf4c8a10a3..00000000000000
--- a/tools/zstd/patches/001-Provide-variant-pkg-config-file-for-multi-threaded-s.patch
+++ /dev/null
@@ -1,126 +0,0 @@
-From f1f1ae369a4cefd3474b3528e8d1847b18750605 Mon Sep 17 00:00:00 2001
-From: Christian Marangi <ansuelsmth@gmail.com>
-Date: Sat, 6 Apr 2024 14:41:54 +0200
-Subject: [PATCH] Provide variant pkg-config file for multi-threaded static lib
-
-Multi-threaded static library require -pthread to correctly link and works.
-The pkg-config we provide tho only works with dynamic multi-threaded library
-and won't provide the correct libs and cflags values if lib-mt is used.
-
-To handle this, introduce an env variable MT to permit advanced user to
-install and generate a correct pkg-config file for lib-mt or detect if
-lib-mt target is called.
-
-With MT env set on calling make install-pc, libzstd.pc.in is a
-pkg-config file for a multi-threaded static library.
-
-On calling make lib-mt, a libzstd.pc is generated for a multi-threaded
-static library as it's what asked by the user by forcing it.
-
-libzstd.pc is changed to PHONY to force regeneration of it on calling
-lib targets or install-pc to handle case where the same directory is
-used for mixed compilation.
-
-This was notice while migrating from meson to make build system where
-meson generates a correct .pc file while make doesn't.
-
-Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
----
- lib/Makefile      | 20 +++++++++++++++++++-
- lib/README.md     |  4 ++++
- lib/libzstd.pc.in |  4 ++--
- 3 files changed, 25 insertions(+), 3 deletions(-)
-
---- a/lib/Makefile
-+++ b/lib/Makefile
-@@ -63,6 +63,8 @@ CPPFLAGS_DYNLIB  += -DZSTD_MULTITHREAD #
- LDFLAGS_DYNLIB   += -pthread
- CPPFLAGS_STATICLIB +=                  # static library build defaults to single-threaded
- 
-+# pkg-config Libs.private points to LDFLAGS_DYNLIB
-+PCLIB := $(LDFLAGS_DYNLIB)
- 
- ifeq ($(findstring GCC,$(CCVER)),GCC)
- decompress/zstd_decompress_block.o : CFLAGS+=-fno-tree-vectorize
-@@ -186,12 +188,15 @@ lib : libzstd.a libzstd
- %-mt : CPPFLAGS_DYNLIB  := -DZSTD_MULTITHREAD
- %-mt : CPPFLAGS_STATICLIB := -DZSTD_MULTITHREAD
- %-mt : LDFLAGS_DYNLIB   := -pthread
-+%-mt : PCLIB :=
-+%-mt : PCMTLIB := $(LDFLAGS_DYNLIB)
- %-mt : %
- 	@echo multi-threaded build completed
- 
- %-nomt : CPPFLAGS_DYNLIB  :=
- %-nomt : LDFLAGS_DYNLIB   :=
- %-nomt : CPPFLAGS_STATICLIB :=
-+%-nomt : PCLIB :=
- %-nomt : %
- 	@echo single-threaded build completed
- 
-@@ -292,6 +297,14 @@ PCLIBPREFIX := $(if $(findstring $(LIBDI
- # to PREFIX, rather than as a resolved value.
- PCEXEC_PREFIX := $(if $(HAS_EXPLICIT_EXEC_PREFIX),$(EXEC_PREFIX),$${prefix})
- 
-+
-+ifneq ($(MT),)
-+  PCLIB :=
-+  PCMTLIB := $(LDFLAGS_DYNLIB)
-+else
-+  PCLIB := $(LDFLAGS_DYNLIB)
-+endif
-+
- ifneq (,$(filter $(UNAME),FreeBSD NetBSD DragonFly))
-   PKGCONFIGDIR ?= $(PREFIX)/libdata/pkgconfig
- else
-@@ -308,6 +321,10 @@ INSTALL_PROGRAM ?= $(INSTALL)
- INSTALL_DATA    ?= $(INSTALL) -m 644
- 
- 
-+# pkg-config library define.
-+# For static single-threaded library declare -pthread in Libs.private
-+# For static multi-threaded library declare -pthread in Libs and Cflags
-+.PHONY: libzstd.pc
- libzstd.pc: libzstd.pc.in
- 	@echo creating pkgconfig
- 	@sed \
-@@ -316,7 +333,8 @@ libzstd.pc: libzstd.pc.in
- 	        -e 's|@INCLUDEDIR@|$(PCINCPREFIX)$(PCINCDIR)|' \
- 	        -e 's|@LIBDIR@|$(PCLIBPREFIX)$(PCLIBDIR)|' \
- 	        -e 's|@VERSION@|$(VERSION)|' \
--	        -e 's|@LIBS_PRIVATE@|$(LDFLAGS_DYNLIB)|' \
-+	        -e 's|@LIBS_MT@|$(PCMTLIB)|' \
-+	        -e 's|@LIBS_PRIVATE@|$(PCLIB)|' \
- 	        $< >$@
- 
- .PHONY: install
---- a/lib/README.md
-+++ b/lib/README.md
-@@ -27,12 +27,16 @@ Enabling multithreading requires 2 condi
- 
- For convenience, we provide a build target to generate multi and single threaded libraries:
- - Force enable multithreading on both dynamic and static libraries by appending `-mt` to the target, e.g. `make lib-mt`.
-+  Note that the `.pc` generated on calling `make lib-mt` will already include the require Libs and Cflags.
- - Force disable multithreading on both dynamic and static libraries by appending `-nomt` to the target, e.g. `make lib-nomt`.
- - By default, as mentioned before, dynamic library is multithreaded, and static library is single-threaded, e.g. `make lib`.
- 
- When linking a POSIX program with a multithreaded version of `libzstd`,
- note that it's necessary to invoke the `-pthread` flag during link stage.
- 
-+The `.pc` generated from `make install` or `make install-pc` always assume a single-threaded static library
-+is compiled. To correctly generate a `.pc` for the multi-threaded static library, set `MT=1` as ENV variable.
-+
- Multithreading capabilities are exposed
- via the [advanced API defined in `lib/zstd.h`](https://github.com/facebook/zstd/blob/v1.4.3/lib/zstd.h#L351).
- 
---- a/lib/libzstd.pc.in
-+++ b/lib/libzstd.pc.in
-@@ -11,6 +11,6 @@ Name: zstd
- Description: fast lossless compression algorithm library
- URL: https://facebook.github.io/zstd/
- Version: @VERSION@
--Libs: -L${libdir} -lzstd
-+Libs: -L${libdir} -lzstd @LIBS_MT@
- Libs.private: @LIBS_PRIVATE@
--Cflags: -I${includedir}
-+Cflags: -I${includedir} @LIBS_MT@